Geeky Tattoos - <AUTHOR> http://www.geekytattoos.com/

<comment><USER2> I don't have any tattoos, but I sure have an admiration for a lot that I see in the wild. However, am I alone in cringing over literally every single tattoo in this collection? Not (primarily) because of subject matter, but execution. Particularly the brightly coloured ones, but also the plain black - they look just _so_ amateurish and poorly done.</comment>


Scotland to use 100% renewables on time to host 2020 climate summit - <AUTHOR> https://reneweconomy.com.au/scotland-to-reach-100-renewables-in-time-to-host-2020-climate-summit-60854 <comment><USER2> This is somewhat misleading - it appears to be offsetting energy exported when there's particularly good conditions for renewables against times when there's not. In reality they are still both burning some fossil fuels and importing energy from countries that are burning fossil fuels. What really should matter is the carbon intensity of both electricity production and consumption.

In terms of hard numbers for Scotland, their carbon intensity is 59 gCO2/KWh ([https://www.carbonintensity.org.uk/](https://www.carbonintensity.org.uk/)), which is actually pretty great. You can compare against other countries here - [https://www.electricitymap.org](https://www.electricitymap.org). Here's the current breakdown of their electricity production:

Wind: 36.5%

Nuclear: 31.1%

Hydro: 16.7%

Gas: 13.5%

Biomass: 1.4%

So right now they are 52.2% renewable energy. Presuming they are running renewables to capacity, this low carbon intensity figure is actually being kept low due to the fact they are sourcing a third of their load from nuclear. Should the Scottish government phase out nuclear as they are currently planning ([https://www.gov.scot/policies/nuclear- energy/](https://www.gov.scot/policies/nuclear-energy/)), then we can expect this carbon intensity to rise as gas is used to pick up the base load when conditions for renewables aren't favourable.

<comment><USER3> I can't figure out which numbers you added to get 52.2% renewable. I would say wind, hydro, and biomass are renewable, with the possible addition of nuclear. Even just wind and hydro add up to (slightly) more.

<comment><USER2> It was a typo, it was 53.2% for wind + hydro. Biomass I refuse to count as it is absolutely awful for the environment. Nuclear is not technically renewable either.

Regardless, I agree that getting fixated on the "renewable" label is not particularly productive. What matters is "zero-carbon".

<comment><USER4> Biomass can cover a range of technologies, some of which are greener than others e.g. if you capture methane from landfills or anaerobic digestion of organic waste then the absolute best thing to do would be to turn it into chemical feedstocks, but burning it for energy is definitely better than just letting it rot and escape into the atmosphere while also burning using fossil methane gas

</comment></comment></comment></comment><comment><USER5> Excellent resource on this topic: _Sustainability Without the Hot Air_ by David MacKay, a Caltech-trained Oxford physics professor. Free download: [http://www.withouthotair.com/Contents.html](http://www.withouthotair.com/Contents.html).

In the article on Scotland, however, not one word on the most safe, economical, immediately available, and effective technique: reducing consumption. Trying to reach sustainability without lowering consumption feels like trying to make a company profitable without considering lowering costs. I haven't visited Scotland, but most Americans could reduce their energy consumption 75% or more purely improving their lives before any challenging decisions.

\---

A short description by MacKay of his book:

"Sustainable Energy - without the hot air" presents the numbers that are needed to answer these questions:

\- How huge are Britain's renewable resources, compared with our current energy consumption?

\- How big do renewable energy facilities have to be, to make a significant contribution?

\- How big would our energy consumption be if we adopted strong efficiency measures?

\- Which efficiency measures offer big savings, and which offer only 5 or 10%?

\- Do new much-hyped technologies such as hydrogen or electric cars reduce energy consumption, or do they actually make our energy problem worse?

Wherever possible, I answer these questions from first principles.

<comment><USER6> While I wholeheartedly agree with the sentiment of reducing energy consumption where it can be done I don't see why we shouldn't do both?

And ofc there is always the danger of things like electric vehicles etc. becoming an case of indulgence: people paying to atone their sins. Consumption and shiny new things alone won't solve the climate emergency.

For the UK the first thing that comes to my mind when thinking about inefficency is heating. I grew up in the alps and we usually have quite well insulated houses (incentivized by government). Using solar and heat exchangers is increasingly common etc.

When I had been to England first, I was shocked at the building standards with these thin walls that barely keep the heat inside. On top they seem to heat a lot with electricity — something which you only would do in an emergency in the alps.

If you can quickly save energy by modernizing heating and insulation go for it and expand renewables as well.

<comment><USER7> >On top they seem to heat a lot with electricity — something which you only would do in an emergency in the alps.

How else would you propose heating a property in England in the winter?

<comment><USER8> Gas, which in my experience is far more prevalent in the UK than electric heating.

<comment><USER7> Not in new properties. I've not had gas heating in a property in the last four years or so. Natural gas is non-renewable, too.

<comment><USER8> Bought my new property in 2016, it's GCH. Only comes on in deep winter, and that's with a thermostat at 21C 24/7

</comment></comment></comment></comment></comment></comment><comment><USER9> This is great news but I wish people would start talking about total energy and not just electric generation. They're still using a ton of gas and oil for heating and transportation. It would be good to be honest about this.

<comment><USER10> I was kinda shocked to learn that long-haul natural gas pipelines are more efficient than long-haul power lines. They also tend not to fail during ice storms.

The Greater Seattle Area has had whole areas without power for days or weeks within recent memory. It's not just an issue for old or rural areas.

Putting all of your eggs into the electricity basket can get people killed. We should work on addressing these problems (or accepting energy diversity) sooner rather than later.

<comment><USER11> I am not quite sure I understand your point. Renewable electricity has the potential to be the most resilient form of energy we have ever had. You can already generate enough electricity for a typical home by putting solar panels on the roof. The main issue is storage but that is mostly an issue of cost not technology. For about 10-15k you can get enough storage to get you through a multi-day outage. And for double that you could probably go off-grid entirely.

<comment><USER12> The projected battery production in 2080 will only cover about 0,01% of Europe's electricity demand. Batteries are not scalable and hydroelectric dams have their own geographic requirements which can't be met in flat countries like The Netherlands or Denmark.

<comment><USER13> That's a strange projection.

Given that you only need to store energy for about a day[0] and that the batteries last at least three years when you use them like this, world battery production is already 1% of the storage requirements for worldwide 100% renewable.

One forecast I've seen estimates that battery production will go up by a factor of four by by 2028.

[0] longer periods with no wind and no sun are dealt with more cost- efficiently with long distance power lines than with storage.

</comment></comment></comment></comment></comment><comment><USER14> >Scotland [...] has a goal to source the equivalent of 100% of its electricity demand from renewable energy sources by the end of this year.

What does 'equivalent' mean in this sentence?

<comment><USER15> Scotland does not have an independent grid. There is an EU wide market to trade electric energy between countries. Some days they export elecric energy, other days they import it. Even if 100% of their local production is renewable, the energy they import is probably (partly) not. So I guess the 'equivalent' means that summed up over the entire year, they export at least the same amount of energy that they import.

You can check this site for the present state (it doesn't show scotland though): [https://www.electricitymap.org/](https://www.electricitymap.org/)

<comment><USER16> Might change with Brexit (re independent grid).

<comment><USER17> They have nothing to win to do this.

<comment><USER16> I'm not arguing the rationality, only the possible outcome.

Texas has its own grid (ERCOT) because Texas. Humans are quirky.

</comment></comment></comment></comment></comment><comment><USER18> Speaking of selling/buying energy equivalents, I've recently become addicted to great real-time data feeds like [https://caiso.com](https://caiso.com) for California's grid and Chrome/Firefox plugins to watch the data like [https://twitter.com/EnergyLollipop/status/122120582076489728...](https://twitter.com/EnergyLollipop/status/1221205820764897281?s=20)

<comment><USER16> Check out [https://www.electricitymap.org/?page=map&solar=false&remote=...](https://www.electricitymap.org/?page=map&solar=false&remote=true&wind=false)

It scrapes any public grid/ISO operator's site for live and historical electrical generation mix data.

<comment><USER18> Wow!! Hadn't heard about it. Tmorow is also great for personal carbon tracking - trying them out as we speak.

<comment><USER16> They are great folks, hope you enjoy their products!

ElectricityMap is open source; please consider politely poking grid operators not yet providing data for grayed out areas so that the map fills out!

</comment></comment></comment></comment><comment><USER19> When I was there I thought to myself that their wind could probably power the whole world. I have never been to a place with that much wind.

<comment><USER10> Did you see that Discovery Channel show where they documented the building of a giant oil platform for oil extraction in the North Sea? All of the things (and forces) they had to deal with... wow.

The North Sea has a -lot- of energy in it, and climate change will probably accentuate that.

<comment><USER20> Yeah this is also why the west coast of Denmark is full of wind mills

</comment></comment></comment><comment><USER21> > has a goal to source the _equivalent_ of 100% of its electricity demand from > renewable energy sources by the end of this year.

> production _outstripping_ demand on 20 out of 30 days and over the whole > month providing _109 per cent_ of electricity demand.

Emphasis mine. This is a great summary of what really happens if you attempt to go full renewable on wind power: you don't control the supply so you need a foreign market to buy your excess production on windy days and to provide power the other days. And no, battery isn't really an option because you can have (and usually have, in anticyclonic conditions) weeks with low wind, and you won't get enough batteries to supply your country for one or more weeks. (I did a calculation for France bases on real power data 2 years ago, and it needed about 4 Tesla Model S battery per inhabitant).

<comment><USER22> Wind turbines are trivial to downregulate. The foreign market just allows you to shift the strike price for downregulation, making the generation in total more cost-efficient.

<comment><USER21> Technically you can, but not financially: the advertised energy cost of wind power relies on the fact that turbines produce as much as they can, and in most European countries there has been contracts between windfarms owners and governments to guarantee a buying price, decorelated from the spot market price.

<comment><USER23> It may be marketed that way in press releases, etc (although I don't even think that's true).

But I bet you anything that the people investing in these projects, and the companies pricing their power and betting their future in them, are not doing it on the basis of selling every unit of energy generated.

<comment><USER21> > But I bet you anything that the people investing in these projects, and the > companies pricing their power and betting their future in them, are not > doing it on the basis of selling every unit of energy generated.

Wind power has been subsidized a lot in Europe during the past decade, so for at least 80% of the projects, not only the investors cared about selling every unit being generated, but they even relied on them being sold at 3 times the market price!

</comment></comment></comment></comment></comment><comment><USER24> Really great of Scotland. Clearly the adults in the room. Unfortunately, the room is filled with 99.9% children and likely the only way to go at this point is to start seriously looking at carbon capture and storage. Sad, but time to face facts. The children are children and no amount of complaining has or will change that fact.

Well, either that or find ways to enjoy a much warmer earth.

</comment><comment><USER25> huge achievement -- no equivocation -- congrats

</comment><comment><USER26> Scotland is also coal power-free.

</comment><comment><USER27> the country that invented haggis is a natural leader in sustainable development

</comment><comment><USER28> But aren't 10s of 1000 of people flying in from all over the world for this "summit"?

Let's talk about renewables for powering videoconferencing, otherwise this is just a band aid.

<comment><USER23> I'm pretty sure a few percentage decrease in Scotland's fossil fuel usage will make up for all those flights in a few weeks, never mind all the other countries that may be driven to do the same based on the outcome of the summit.</comment></comment>


Ask HN: Anyone Versed on Apple HealthKit? - <AUTHOR> I need help comparing Apples HealthKit to Redox Engine and 1up Health-unless HealthKit is completely different. I get how Redox and 1up work and their pricing, but does HealthKit work the same: is HealthKit just an iOS equivalent? Also, Redox charges to connect to a health system, while 1up charges per API call, but what does Apple charge? <comment><AUTHOR> If anyone is curious, according to 1up Health:

Apple Health via Healthkit recently introduce the ability to pull individual patient health records from hospitals and clinics using the same FHIR functionality as 1upHealth. (Note that Apple Health does not support all the health systems supported by 1upHealth) That patient data is stored on the device and does not natively support a cloud or RESTful API experience. That is a limiting experience because you cannot query your patient data across populations or for specific items within their medical record. To enable a cloud based functionality, you can push the FHIR healthcare records from the user's device to 1upHealth and store it in our cloud backend enabling your applications to interact with the data in a RESTful manner. Star by creating a free 1upHealth developer account. Then follow the other steps below.

</comment><comment><AUTHOR> Is there a fee to use HealthKit, beyond the developer membership fee?</comment>


Rupert Murdoch Says Google Is Stealing His Content. So Why Doesn't He Stop Them? - <AUTHOR> http://blog.newsweek.com/blogs/techtonicshifts/archive/2009/10/09/rupert-murdoch-says-google-is-stealing-his-content-so-why-doesn-t-he-stop-them.aspx <comment><USER2> The obvious problem here is that there is an oversupply of news.

In an age of electronic worldwide distribution, do you need 938 outlets reprinting the exact same story? No. But that's what you see on Google News.

Oversupply means that weeding has to happen. Those outlets that survive will be those that provide unique information (either local news, infotainment, or big budget national/international news).

The newspaper as an institution is no more sacred than the Broadway play (which was destroyed by movies) or the family farm (which was automated and scaled up).

The only reason many people believe it is somehow different is that a significant fraction of what they read is written by newspaper writers (as opposed to, say, playwrights or farmers).

<comment><USER3> You have a good analogy, but the you take it a little too far. Broadway plays have hardly died. From what I hear, they are doing relatively well, and I have watched a number of them as they left broadway and toured into my city at the time. They have fallen somewhat in prominence though.

Similarly, family farms have lost their former prominence in society, but they are far from dead. My grandparents ran one until my grandfather retired due to health problems (recently deceased), and even then they leased their land to another family farm nearby.

There will be a winnowing in journalism, but this does not mean destruction for any of news, plays, or family farms.

<comment><USER2> Well, by "destruction" what I mean is that

1) In 1850 55% of Americans listed their occupation as farmer or farm laborer. Now it's about 1%. Source here:

<http://flare.prefuse.org/apps/job_voyager>

2) Regarding plays (Broadway and elsewhere), they've died in the sense that they represent a much smaller fraction of the entertainment dollar relative to movies.

<comment><USER3> Percentage wise those have both died and you make valid points, but that is hardly death in a true sense. Family farms are still alive and well in many places in America, as are plays, they are just smaller percentages than in the past.

<comment><USER4> The general consensus is that a successful small family farm is a very rare and dying breed. See: <http://www.methlandbook.com/>

Would be interesting to see counterexamples, that is some small family farms that are doing good.

</comment></comment></comment></comment></comment><comment><USER5> Google could simply remove them from their index for a week, see if a 25% decrease in traffic for a month will make them think twice.

I bet that they would change their tune by the the 3rd day and beg google to re-add them.

EDIT: Also as someone said further down, google could even charge for their indexing of the news, IMO they are providing a service to the news companies.

<comment><USER6> Should Google be able to do that without consequence? I guess they don't because we would go over to Bing.

<comment><USER5> In theory this is akin to holding someone hostage, but isnt this what the media companies want? I doubt google would ever pay to license the links so the only other option would be to omit them...

</comment></comment></comment><comment><USER7> This is off on a tangent from the piece about Google and Rupert, but it's worth noting that in the general discussion of the demise of the traditional print newspaper business, few folks point out that the small community papers are in a better spot.

The real issue is that the national and world news has become a commodity that you can get from nearly anywhere. At the same time, the quality of the reporting has declined. Folks like Politico may represent the future of national reporting -- a leaner group of highly talented journalists getting interesting stories out. But why pay to read about some major national news story in paper XXX when you have 1,000 other news sources to read essentially the same content?

Conversely, take a look at small community papers. For example, my hometown paper is online at <http://bristolri.com/>. These guys are doing just fine (I know the publisher). You can't get their content anywhere else. And you know what? Average everyday people want to read local stories about the new school superintendent, the police report, the controversy over a local land development deal, the letters to the editor from their neighbors, etc. They buy the paper. Local advertisers still advertise. The paper is doing fine, and he's not alone -- lots of small papers are doing OK because their content has not been commoditized.

As for Rupert Murdoch, I think he's going in the wrong direction. If I were him, I'd worry less about distribution rights on my essentially worthless commodity national news content, and I would instead set my target on the big ratings agencies. The ratings agencies played a huge role in the credit crisis -- they basically gave bonds a gold star that were, in reality, crap. They should be vulnerable with some sort of new model. There are few companies positioned as well to destroy Moody's as News Corp / WSJ / Dow Jones with their depth of financial industry content / resources / etc. I don't have any idea of exactly what a rating agency 2.0 would look like, but it would seem like a much more productive and valuable place for Rupert to put his focus.

<comment><USER8> The other problem the big newspapers chains have is that many of them have substantial debut burdens, which is, again, something a lot of smaller locally owned papers didn't have the privilege or inclination to do.

</comment></comment><comment><USER9> I think the real debate here is that value in the internet is moving relentlessly away from content producers towards content aggregators. Even a big newspaper site doesn't have the diversity that you find in an aggregator like Google News; likewise, no tech blog can compete with the diversity of news in Hacker News. I visit TechMeme and Hacker News far more than I visit any single blog, for example. TechMeme makes far more money than any professional tech blogger too.

Aggregators tend to build much more value to themselves quickly by riding on other people's content. Yet, aggregators are worth nothing without the underlying content. This irks many content producers, particularly the professional ones whose output accounts of the bulk of the traffic that aggregators end up sending. This trend of professionally produced content accounting for the bulk of the links is evident even in Hacker News.

If these trends continue, giant aggregators could end up controlling much of the content. Yahoo already produces a lot of content, and licenses content for Yahoo News (which is fitting considering Yahoo News has more traffic than any news site in the world). Google News, Digg etc. could follow.

This is the future I suspect Murdoch does not like, because it appears from his perspective to be third parties building value out of his content, without compensating him. Legally, I am not sure he has a claim - if there is a lawsuit on this, it will reach the Supreme Court, that's for sure.

<comment><USER10> Exactly. I don't think Murdoch is actually upset that Google drives people to his sites, what bugs him is that they go to Google first.

When you read a story in a newspaper, you almost automatically consume other content in that paper, including ads. Why pick up another paper to read more news when it's already in your hands? To a lesser extent the same is true for cable news, you watch a brief segment and you are bombarded with "coming up next" teasers and flashy graphics, pretty anchors, etc., all designed to keep you on that channel (watching ads).

The web is way less sticky than even television, sure you could flip channels but you lose context, and you might have to keep flipping to find something interesting, broadcast is a push medium. Contrast this with the web page: what is the easiest thing to do after reading the linked story? Search around the new site (that you may not be familiar with) or hit the back button and resume what you were doing: Pulling down stories you want to read, instead of waiting to see if something interesting comes up.

I think Murdoch gets the power of the aggregator, I don't think he understands that he has always pushed content to consumers. (Yes a lot of work goes into creating a brand that attracts these consumers to the paper/network but once they are there they have content pushed to them.) The web is a pull medium.

Billions were spent on the "portal wars" of the 90's, and everyone who participated lost to a page with a text box and 2 buttons.

</comment></comment><comment><USER11> I want google to comply and stop linking to AP and Murdoch. See if their revenues increase after less people can find their content.

<comment><USER8> Yeah, I think such a move would hurt Murdoch and AP more than it would hurt Google. I understand contextual advertising, I suspect that Google makes far less than average on searches for news related terms, because people aren't looking to buy something, or solve a problem.

And while they are at it, they should cut off access to customers on ISPs that are pursuing an anti-net-neutrality agenda.

In both cases, I think Google would be better fit out for a war of attrition than their adversaries. On the other hand, Google probably doesn't want to hand Microsoft any opportunities right now by cutting off ISPs.

</comment></comment><comment><USER12> I've seen this story repeated a number of times now. Murdoch seems to be obviously wrong to those of us that follow this stuff. I wonder however, if Murdoch is trying to convince the 99% of the public who don't read HN/Techcrunch et all that Google is doing something bad here when he doesn't believe it himself.

If not he is simply out of touch.

</comment><comment><USER13> It seems obvious to me that Murdoch et al. want to stay in the Web and be paid rather than de-index and disappear. Given that, these "just use robots.txt" articles seem just as disingenuous as the original statements they're mocking.

<comment><USER14> You was downmoded, but I think you are right. From the article:

"go to Google News, or type a newsy topic like "Obama wins Nobel" into Google's search box. What do you get? Headlines and very brief teasers linking to news stories from news sites. If you click on them, you are taken to that news site, where you can read the story, which is surrounded by that site's ads. What, exactly, did Google steal in this scenario?"

What exactly did Google steal? Very exactly, Google steal "Headlines and very brief teasers". From the perspective of copyright law, yes, it can be classified as quoting, so they can't sue google, but those "headlines and teasers" do carry news value and in some cases took large amount of resources to produce. Now, Google took it and provided link as a payoff. Is that payoff adequate? Murdoch and many news producers don't think so.

Of course, teoretically you can use robots.txt. But in reality you can't, since your competition is also indexed, so you have to play by Google rules, even if you believe they didn't pay you enough for the value they are taking.

<comment><USER15> I think that you can do this under "fair use", but "fair use" doesn't exist in all countries in the world.

And google has to obey to local laws and local copyrights and not just to US law.

The google book case is just another thing that's going to backfire at google. The ignorant attitude of google making foreign books (books written by authors where it is clearly illegal by the law do scan in the books and make those freely searchable on the net) available to all US citizens, even though the authors don't want their books to be available trough google, will only create more hate against google.

<comment><USER16> Anyone who wants to can opt out.

I personally know an author who is simply delighted that google is making his (out of print) book available. I think he will even get payment if someone wants the whole book.

<comment><USER15> It should be opt in, not opt out!

You can't also steal something in a store, just because the store didn't tell you not to steal something!

</comment></comment></comment></comment></comment><comment><USER17> As many people have said before, you can get reprinted news from everywhere, people will never pay for that kind of news as there will never be a situation where someone doesn't find value distributing in with the advertising model.

Investigative journalism and niche long form articles are the way to go, you create an interesting enough website for long form in a niche and people interested in that area will pay (well at least I could justify it).

</comment><comment><USER18> I can't believe Google ever paid the AP in the first place. Seems like a bad deal from Google's perspective. They could have easily done without the AP's content.

<comment><USER19> AP doesn't compete with Google, they don't run ads. The newspapers do - if the newspapers were to all disappear but AP survived that might be good for an online source of news and ads?

</comment></comment><comment><USER20> Because he doesn't want his ad salespeople to have to admit to potential advertisers that "well, yes, in fact, we are not findable on google and other search engines."

</comment><comment><USER21> First they ignore you, then they laugh at you, then they fight you, then you win.</comment>


css question - <AUTHOR>

I know this is probably the most trivial thing of all, but are most of you using xhtml fully valid css, or do you tend to hack it? I have hacked quite a bit (okay, cut and pasted from other sites) of css, and written very little (fully valid css). What are other newsy startuppers doing? <comment><USER2> My goal is generally "Works in Firefox, IE, and Safari", but last time I checked it validated fine. In general, I tend to think "it works" is more important than "it's right", but if I can make it right too without totally convoluting or breaking things, I might as well.

I never cut & paste from other sites. I like to understand what I'm doing - it's the best way to ensure that it stays working.

One thing that surprised me - after I got things working in Firefox, it was only about a half day's worth of effort to get them working in IE as well. I was expecting it to be _much_ worse, given all the griping about cross-browser compatibility. So perhaps knowing what you're doing does have some benefits...

</comment><comment><USER3> Hack it how?

There is no reason to use hacks if you use conditional comments to deal with Microsoft's abominations one browser at a time. Most of the other browsers will work just fine, and when they don't, I either live with it, or alter the design so they do.

<comment><AUTHOR> ok...here are some of my more traditional 'hacks'

negative margins ( margin-top:-5px; ) stylesheet switchers <?php if(xbrowser) { include'stylesheet1.php';} ?>

and so on

</comment></comment><comment><USER4> I mix and match.

At work I'm valid.(I do this on purpose cause it takes a little bit longer)

For my stuff, I hack.(I do this cause it will still render correctly, as long as I check it on multiple OS and Browsers!)

<comment><AUTHOR> hell yeah!

</comment></comment><comment><USER5> css always valid, if you know what you're doing no hacks should be necessary

<comment><AUTHOR> thats not really true. I won't post details, but I seem to run into situations daily where a certain rule gets applied in a variety of permutations over the domain of browsers.</comment></comment>


Is the Sunk Cost Fallacy Actually Smart Business? - <AUTHOR> http://insight.kellogg.northwestern.edu/article/is_the_sunk_cost_fallacy_actually_smart_business <comment><USER2> So it's like "social proof" with your past self providing the peer pressure.</comment>


Writing high-performance servers in modern C++ - <AUTHOR> https://medium.com/@jamesperry/writing-high-performance-servers-in-modern-c-7cd00926828#.lcsmnff1d <comment><USER2> A lot of people state that Python/PHP/Ruby/Javascript on the dynamic language side and Java and other JVM languages on the statically typed side and much quicker to develop than C++, but being a very experienced Java programmer and a decent Javascript programmer I find that I can program just as fast with C++ as long as you use the right choices of libraries and use C++11 or greater. With libraries like Boost, fbfolly, wangle, etc. I find it can be just as quick to develop C++ code as with other languages. I think too many people think C++ is a huge investment above other languages due to past experience, but I feel that it is just not true anymore. Thanks for this post, I think it shows just how quick it is to write performant modern C++, when you stand on the shoulders of other libraries. Just like the other languages.

<comment><USER3> Does modern C++ have a decent story for writing nonblocking concurrent code yet? Something that could compete with async-await in C# or monads in functional programming?

<comment><USER4> A networking library based on Asio has been proposed for C++17. In the meantime, use Asio.

[http://think-async.com/](http://think-async.com/)

<comment><USER5> [http://think-async.com/Asio/AsioStandalone](http://think- async.com/Asio/AsioStandalone)

!! I've always heard that Asio is great, but never bothered to look because I don't like introducing Boost's 450 megs of compiler-test-suite-worthy C++ to my >45kb programs. But, as a stand-alone library. That's interesting!

</comment></comment></comment></comment><comment><USER6> I don't understand the point of saying something like:

> _" I show how to build a modern C++ high-performance, asynchronous echo > server that can be written with just 48 lines of code."_

The fact that it is 48 lines of code is almost meaningless. If the framework was a different design it could be done in 1 line of C++ code or 1 line of COBOL. Given the right library/framework, any application can be done with 1 line of code (taking a bit of poetic licence here, but hopefully you see my point).

As a discussion about using Wangle in C++, the article has far more merit.

Perhaps I am just being overly pedantic.

<comment><USER7> it may not be an information-dense sentence, but it is merely a single sentence. one which you've isolated from it's context.

<comment><USER6> It is the direct TL;DR quote from the Author himself, given prominence with blank line separators, italics, bold prefix and located near the very start of the article, so hardly out of context.

</comment></comment></comment><comment><USER8> For what it's worth, the network I/O model design+implementation is rarely what makes the difference between high performance, or not, 'servers' \-- and that is a mostly solved problem, at least in terms of patterns and practices that are adopted by 'modern' servers (few threads, no more than actual hardware CPU cores, async.multiplexing, etc).

High performance is about everything else, including processing actual incoming requests efficiently, reducing block/busy time in threads, caring a lot about memory access/caches. They key IMO is concurrency and migrating blocking operations to other dedicated threads, and this is where an efficient coroutines implementation would help both with accomplishing that task, but, perhaps more importantly, keeping the programming model simple.

C++17 will introduce support for reusmable functions ( [http://blogs.msdn.com/b/vcblog/archive/2014/11/12/resumable-...](http://blogs.msdn.com/b/vcblog/archive/2014/11/12/resumable- functions-in-c.aspx) ). This will be a game changer. Now, you can approximate this by e.g creating task abstractions and use lower-level(but slow) setjmp/longjmp functions, or just design tasks/functors that hold state that can schedule other tasks in turn, and so on. It works, but the overhead, mental, but also n terms of processing/executing/scheduling can be too great.

</comment><comment><USER9> >I must warn that it unfortunately doesn't build on Max OS X as of yet so I recommend to virtualize Ubuntu 14.04 to install it.

Important info for some folks (i.e. myself).

</comment><comment><USER10> I stopped reading after reading the first line of code containing a virtual function and smart pointers. Nothing is performance oriented in this post. It's just a plain old dummy TCP server like anyone would write.

<comment><USER11> I half agree; it's easy to be cynical. Virtual functions can be a terrible idea... if they are in a hot path.

Is EchoHandler::read such a path? Maybe, you really can't say without profiling. If anything using std::string is the red flag for me.

</comment></comment><comment><USER12> no benchmarks. what gives ?

<comment><USER13> Yeah, and no mention about boost::async, which is in Boost, ie almost standard.

<comment><USER14> Folly, the library underneath wangle, is running on top of boost::asio, so this is basically an abstraction on asio two layers up.

<comment><USER15> Folly does not use boost::asio, but rather libevent:

      libevent is an excellent cross-platform eventing library.
      Folly's async provides C++ object wrappers for fd callbacks
      and event_base, as well as providing implementations for
      many common types of fd uses.

[https://github.com/facebook/folly/blob/master/folly/io/async...](https://github.com/facebook/folly/blob/master/folly/io/async/README.md)

grepping the codebase for `asio` brings up nothing.

<comment><USER14> Interesting. Thanks for the correction. I had seen the boost dependency and assumed it was using asio under the hood I guess.

</comment></comment></comment></comment></comment><comment><USER16> I love to read stuff like this, "with a bit of effort I was able to build the whole back-end for my startup using C++", then I start to think: what would it take for me to migrate off Golang to C++?

I love to develop in Mac and deploy in Linux/Docker, so whatever stack I pick has to be compatible with both OS's, with this in mind I made a list of libraries I'd need to move my API to C++:

* Web Server library

* Web Framework-ish library

* JSON library for REST interface

* Database client library for my database

* Integration testing

After reading these useful blog posts I guess I'll pick:

* Web Server => Facebook's Proxygen

* Web Framework-ish library => Facebook's Wangle, but it doesn't seem to work in Mac, that's already a problem, I don't like having to have two dev environments.

* JSON library => looks like Facebook's Folly seems to have something for it, let's hope it uses modern c++ constructs and not some obscure templating magic to make it faster than other implementations.

* Database client library for RethinkDB: RethinkDB has no official driver and the only community driver public repository has only 22 starts and no CI setup on Github, I'm reluctant to trust this code, this is already a deal breaker to me.

* Integration testing => Wangle's documentation is scarce, there wiki is empty and the repo doesn't have a single code sample to take a look at. I can't go to production without testing, another deal breaker.

Yes, I agree, I don't have to pick RethinkDB. MySQL and PostgreSQL c++ drivers are very mature to use in production apps.

Of course they are, but:

* Do these drivers use modern C++ constructs?

* Would these drivers block proxygen/wangle IO loop(in case they have one?)

* Would I have to use callbacks to make achieve full IO speed? I hate callbacks, there is a reason I abandoned Node.js a long ago.

* How do I put all these dependencies together?

As with Golang, as much as I hate it's lack of generics and proper inheritance:

* Web server: Standard library `net/http`

* Web framework-ish: I don't really need a framework/pipeline for it, there are some neat web routers out there that just help me do the job.

* JSON library: Standard library `encoding/json`

* Database client library: gorethink and almost all the Golang database clients out there have significant adoption with over 700 stars on Github.

* Integration testing: Standard library `net/http/httptest`

Unlike D, C++ and Rust; the Golang ecosystem is unified, I know I'm able to pick a client library and it'd work with whatever stack I have in place because there's only one scheduler and therefore only one way to do IO, plus it's non-blocking without callbacks. I'm not a fan of vendoring dependencies, but it simply works.

In conclusion, I love C++ and even with all the significant progress made in C++11 and C++14, I'm still stucked with Go because it just works.

<comment><USER17> I also run into this problem all the time. I hope that with the networking TS standardizing on basically boost Asio and the incorporation of coroutines into C++ we should start seeing some unification across all network/do client libraries in terms on non-blocking use.

</comment></comment><comment><USER18> That's a lot of code.

</comment><comment><USER19> Did you test your server with 1.000.000 connections?

<comment><USER11> How about input fuzzing? Did you try crashing it and see how quickly it can recover? Unit tests? What about zero downtime upgrades? DDoS resiliency? Can it utilize all cores on a machine? Scalable? What are the median and max response times under load?

Oh it's just a quick demo? Nevermind.

<comment><USER20> Title needs to be edited to: How to quickly write a basic, modern C++ using Wangle.

</comment></comment></comment><comment><USER21> The API looks a lot like Netty

</comment><comment><USER22> I enjoy seeing Facebook libraries and Google libraries in the same program.

<comment><USER23> It's nice that google are using snake case for library filenames and facebook are using camelcase. :)

Example:

#include <proxygen/httpserver/HTTPServer.h>

#include <grpc++/server_context.h>

</comment></comment><comment><USER24> Reminds me of Doug Schmidt's ACE Reactor...

</comment><comment><USER25> Any classical logic is possible, because C++ is a Turing-complete language.

That said, of course, how much you can actually do and how fast you can do it depends a lot on the hardware you have available. Not every computer can run fast, high-quality graphics, no matter what language you coded in.

THAT said, C++ is considered a relatively high-performance language and is often used for things like advanced game graphics.</comment>


Show HN: Codeless automated UI testing for cloud services - <AUTHOR> https://www.qanairy.com <comment><USER2> [https://app.qanairy.com/](https://app.qanairy.com/) shows me a blank page with many javascript errors. Firefox 70 with adblockers. The adblocker reports 7 connections were blocked, e.g.

Loading failed for the <script> with source "[https://js.hs- analytics.net/analytics/1573674900000/4077132....](https://js.hs- analytics.net/analytics/1573674900000/4077132.js"). app.qanairy.com:1:1 Loading failed for the <script> with source "[https://app.qanairy.com/components/analytics/event.js"](https://app.qanairy.com/components/analytics/event.js"). app.qanairy.com:107:1 Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at [https://fullstory.com/s/fs.js](https://fullstory.com/s/fs.js). (Reason: CORS request did not succeed).

<comment><AUTHOR> Thank you for bringing this to my attention! I'll be sure to work on a fix for this over the next few days.</comment></comment>


Web 2.0: Do tags work? (Case study: Flickr) - <AUTHOR> http://www.tekka.net/10/tags.html#

<comment><USER2> It's a strawman argument -- tags do not replace library science, film at 11 -- but she does say some interesting things along the way. If you replace "tags ought to do" with "archival systems ought to do" it's an interesting meditation.

Although, her notion of encoding potential narratives into images seems like the old AI dream. Like you could somehow query "triumph against adversity" and get a picture of a schooner crashing through a wave. I think after the last 50 years we have to be more humble about what machines can achieve.

P.S: this is the fault of the hosting magazine, Tekka, but they are certainly failing even at elementary archiving and contextualization duties here. The date of publication is not noted, nor is there any link to describe who Cathy Marshall is. There's an issue/volume header at the top, without any other context. They're thinking print, not web. The tagline of "serious hypertext" is silly.

</comment><comment><USER3> I agree with what joshu (delicious founder, but thats not the point) said last time this was posted:

<http://news.ycombinator.com/item?id=448669>

> Flickr tags are by people categorizing their own photos (that is, publisher- > generated categorization.) Not people categorizing things they've found or > aren't theirs. This leads to radically different behavior. Given this is a > librarian, the second case is much more relevant and interesting.

</comment><comment><USER4> Well-written, but it ignores that the main use of tags are for individual users. I tag my photos in Flickr so that they're sortable within _my_ photos. So Flickr.com/unalone/tag/mike (that's not the actual URL) gets me every photo that I've taken with Mike in it. No, it doesn't help the omnipotent Mike searcher - perhaps I'm mucking data up - but it means that as I continue to photograph Mike, I get a quick pool of photos that revolve around that theme.

Not everything is about creating an indexable, searchable database. If anything, I'd think that some level of user moderation for searches would be more logical than tag sorting. No - tags are best used as a more flexible version of taxonomy, for localized sorting and filing.

</comment><comment><USER5> Pretty well-written article. Interesting analysis.</comment>


The rules for using "ſ" (long s) - <AUTHOR> http://babelstone.blogspot.com/2006/06/rules-for-long-s.html

<comment><USER2> 'ſ' is just an 's'. It's a typographic variation carrying no semantics. The proper way to reproduce it in a new medium is simply to use 's' everywhere. To do this is no more unfaithful to the original work than using Times Roman on the screen when the original was printed in Caslon.

<comment><USER3> You seem to be completely missing the point of this article. What are you contending? That there was no difference between s and ſ, and that they were used in free variation? Or that there is no need to know anything about ſ today because it is no longer in use? In either case, as I said, you've missed the point.

<comment><USER2> I'm taking issue with the decision stated in the first sentence: "In my previous post about the grand old trade of basket-making I included several extracts from some 18th century books, in which I preserved the long s (ſ) as used in the original printed texts".

<comment><USER3> To what end? Do you suspect that the author thinks there was another letter of the alphabet in the 18th century?

<comment><USER2> No. I merely think he's missing the forest for the trees by preserving one obsolete typographic detail in a historical text yet translating the whole thing into HTML with minimal styling. This is somewhat akin to completely remodeling a 100-year-old building yet insisting on preserving the original knob-and-tube electrical wiring for authenticity -- you lose all the original charm yet you're still stuck replacing fuses twice a day and offending your readers every time the word 'succor' appears.

<comment><USER4> So "proper" just refers to your aesthetic preference, not to any actual rule?

<comment><USER2> Uh, somewhere in between, I think. I'm contending that one way is logical, conventional, and clear, and the other way is illogical, odd, and confusing. I think that's a stronger statement than just an aesthetic preference, but I'm not citing anyone else's prescription.

<comment><USER4> I don't get it. Seems awfully petty. It just a blogger and what he did is not in any way wrong. I could understand you if he had made any statement to the effect that everyone should do it like him but he absolutely did not.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Wow, This was a pleaſure to read! This is the quinteſsential obſcure but captivating topic that nerds like us _love_. I'm impreſsed by the level of detail that was put into this.

</comment><comment><USER6> I found it very interesting to see how the 'ſ' directly followed by a 's' were combined into the ligurature 'ß'.

<http://en.wikipedia.org/wiki/ß>

<comment><USER7> Agreed. It's particularly evident here:

<http://www.babelstone.co.uk/Blog/Images/Micrographia.jpg>

Understanding that `fs' was mostly a typographical device for adding more flair to a line certainly makes the German deprecation of the `ß' in favor of `ss' more palatable.

</comment></comment><comment><AUTHOR> It's not addressed in the article, but I've always wondered whether maybe long-s was kept around for so long as an affectation of the Greek terminal- sigma, in much the same way that classically-educated English speakers would refuse to split infinitives just because it was impossible to do in Latin.

</comment><comment><USER8> The 1745 example has another interesting usage: "it's" where we would write "its". When did this become improper? And could it be that all those endless typo "it's"es online nowadays are not part of a plot to drive me crazy after all, but rather the return of some older norm?

<comment><USER9> I would suspect that there were some other rules for apostrophes some centuries ago, but maybe _it's_ / _its_ is some typo that has been in the English language for centuries?

While talking about the English language, does anyone know what happened to thou/thee/thy/thine/ye?

<comment><USER10> Thou/thee/thy/thine are singular forms, whereas you/ye/your are plural. Just as we and our became royal pronouns, where a monarch would emphasize that they spoke for a whole country by referring to themselves in the plural, it became popular for the upper and eventually middle classes to refer to each other as plural, as a more respectful or formal usage.

Quoting from Wikipedia (<http://en.wikipedia.org/wiki/Thou>):

 _"Following a process found in other Indo-European languages, thou was later used to express intimacy, familiarity, or even disrespect, while another pronoun, you, the oblique/objective form of ye, was used for formal circumstances"_

<comment><USER11> Interesting - I've read that the common pronunciation where we use "Ye" pronounced as "Yee" is a mistake - it was always pronounced "The"

It's a vestige of how the Thorne transformed over the years - eventually it looked very similar a Y with a small "e" above it... leading to someone looking at an old document to assume it was just a Y.

We could be talking about two separate uses of the word though....

</comment></comment></comment></comment><comment><USER12> I've always wondered this, but I could never figure out how to google it.

...I'm juft glad we ftopped ufing it.

</comment><comment><USER13> Actually, long s is still very frequently used, and will never become extinct. Look at the integral sign! Long live long s.

<comment><USER14> Could someone sum up for me why integration uses "S"? It doesn't square with me, nor does it add up.

<comment><USER15> wikipedia tells me it is because S stands for the latin word summa.

<comment><USER13> Exactly.(Riemann) integral is summation with infinitesimal quantities. (It was Leibniz who used long s to denote integration, though. <http://jeff560.tripod.com/calculus.html> ) Also, for discrete summation, capital 's'igma is used.

</comment></comment></comment></comment><comment><USER16> I find the long f confufing and hard to read. Pleafe do not revive it.

<comment><USER17> It's not a long f, it's a long ſ

<comment><USER16> I was demonstrating how my brain parses its use.

<comment><USER18> Perhaps your brain juſt needs more conditioning. Sign up for more long ſ training seſsions today!

</comment></comment></comment></comment><comment><USER11> The long-s was used in the middle or the beginning of a word. It was not used as the last letter of a word - the last letter would be a standard/short/miniscule s.

Per a wikipedia example - ſinfulneſs ("sinfulness")

<comment><USER19> ...Did you read the article? It discusses that rule and how it is not a complete description of the actual use of the character.

</comment></comment><comment><USER20> Ingenious. This article served to clarify something I had wondered about for years.</comment>


Two-Factor Authentication and the Police State - <AUTHOR> http://shkspr.mobi/blog/2013/08/two-factor-authentication-and-the-police-state/ <comment><USER3> A few people are making a similar mistake. They are saying that RIPA forces you to hand over the keys to allow people to decrypt your content.

That's only partially accurate. RIPA also allows 'them' to demand that you make the plain text content available.

Not having the keys doesn't help you if you have had the keys, or 'they' think that you can get the keys. Thus, the wikileaks files are safe for me because there's no reasonable expectation that I can get access to the plaintext content. But if I have a bunch of encrypted files on my computer and encryption software and etc they are going to claim that I have access to the plain text data.

([http://www.legislation.gov.uk/ukpga/2000/23/contents](http://www.legislation.gov.uk/ukpga/2000/23/contents))

Note that while the law talks about keys it also talks about "intelligible content" \- ([http://www.legislation.gov.uk/ukpga/2000/23/contents](http://www.legislation.gov.uk/ukpga/2000/23/contents))

> _that it is not reasonably practicable for the person with the appropriate > permission to obtain possession of the protected information in an > intelligible form without the giving of a notice under this section,_

See also ([http://wiki.openrightsgroup.org/wiki/Regulation_of_Investiga...](http://wiki.openrightsgroup.org/wiki/Regulation_of_Investigatory_Powers_Act_2000/Part_III))

</comment><comment><USER4> If you are not allowed to talk to your lawyer, then maybe your lawyer should be the one who has the password.

<comment><USER5> This could be easily combined with joshuaellinger's suggestion for a "travel mode". Flip a switch before you leave (analogous to "airplane mode") and then 2FA codes must come from a third party (your lawyer). When you arrive, contact the third party (your lawyer) and re-enable access using your own 2FA.

<comment><USER6> Sadly, I'm pretty sure a lawyer can be compelled to divulge passwords and tokens.

<comment><USER7> I think the point here is not that the lawyer could refuse the 2FA token if he detects duress. You have to give up the login credentials if you're able. The point is that you're now able to inform your lawyer that you're in detention.

You can work out a protocol with your 3rd party (e.g. lawyer) ahead of time that requires you to state where you are, and there's all sorts of coding available to you for that. He'll give up the token regardless, but might be able to start action on your behalf if he detects that you're not where you should be.

</comment></comment></comment></comment><comment><USER8> Going after 2-factor auth as the _simple_ way to manage this ("I can't get access, personally") seems wrong to me.

The second factor is something you have. You'll normally travel with the "thing you have", and since many sites implement 2-factor differently, you'd have to change the setup for _all_ of those sites before you travel.

Instead, what about not knowing the password?

This is pretty easy to do, and it's _also_ good personal security generally.

Use a password manager (like KeePass or LastPass), and set all passwords to unique random strings of 16 characters or so. If the password manager enters the passwords into websites for you, you'll never type them (and thus never memorize them).

Then you just need a way to not know the keyphrase that unlocks your password manager datastore... that's easier to change quickly before you travel (or let your partner manage this, or use 2-factor on LastPass, etc. -- it's an easier problem, because it's just one thing).

</comment><comment><USER9> Use YubiKeys (something you have).

Use TrueCrypt volumes on USB sticks (encrypted data). Put puppet scripts on there to bootstrap your system.

Ship both separately and confirm receipt of YubiKey before shipping the USB stick.

Travel with unencrypted, freshly imaged hardware with no sensitive data (perhaps run an OS from a read-only file system).

Arrive, insert USB stick and YubiKey... now enter password (something you know)... and bootstrap your system to use it.

This is all a big pain in the arse, but leaves you travelling with nothing likely to get you into trouble.

<comment><USER10> From what I can tell, if they've targeted you, they're going to take your stuff. Doesn't matter if the drives look like noise or are nothing but zeros. The point is primarily to be a thorn in your side and to drain you of money. Any intel gleaned is just icing on the cake.

<comment><USER9> Actually, in the scenario I outlined you don't need to take a laptop anywhere.

Just ship the data and use a commodity device at the other end.

<comment><USER11> This, I think, is where it's at. I reset my phone and delete my TrueCrypt volume every time I cross a border. On the other side I just download the TC volume, download my app[1] onto my phone, and re-sync my data.

[1] This a DB I wrote myself, is sideloaded (i.e. isn't in an app store), and syncs data between my phone, laptop and desktop.

<comment><USER12> If they're watching you already, they are going to know about this DB full of good stuff you have, and they're going to demand you give them access to it, in the same way they can demand you give them keys and unencrypted data.

</comment></comment></comment></comment></comment><comment><USER13> This got me thinking about the equipment I fly with from the UK. It seems that the only good way to protect your equipment while travelling is to actually not know your password at the time. This may be even implemented fairly simply - unless you're addicted to checking your email every minute, you can reasonably protect every sensitive drive / account with a new password before leaving, arrange for the password to be physically available at the destination and turn everything off before departure.

I really don't have any idea what the response to that would be. But I'd rather have my laptop with full disk encryption taken away than to give access to emails. (and in practice to all other services via password resets)

For phones without a full disk encryption, you can reasonably easily back everything up, leave a copy online and restore on arrival, so that's not a big deal either. You can still use it as a phone in the meantime, just make sure it's completely wiped and has no connected accounts.

</comment><comment><USER14> Imagine a police state aware 'travel mode' that does the following: 1\. Locks all your devices at the start of travel. 2\. To log into your laptop, you need a code from your phone. 3\. If your phone received a login request, it would record your location and ambient conversation to a destination of your choice. Put in a little delay between recieving the code and displaying it. 4\. When you login with this code, you go into a low-privilege user account and/or locks you out of anything sensitive. 5\. To unlock, you request another code from your phone. It only works if you are either at home.

You could carve out some exceptions for things you need while traveling that the bad guys who think they are good guys would already know.

<comment><USER15> You could also have a trusted person set your device passcodes and/or receive your 2fa codes and instruct them to not answer calls/reply to messages until you are at your destination.

</comment></comment><comment><USER16> Some work has already been done in this area: [http://en.m.wikipedia.org/wiki/Rubberhose_(file_system)](http://en.m.wikipedia.org/wiki/Rubberhose_\(file_system\))

<comment><USER17> Non-mobile link: [http://en.wikipedia.org/wiki/Rubberhose_(file_system)](http://en.wikipedia.org/wiki/Rubberhose_\(file_system\))

</comment></comment><comment><USER18> How about a distress code password that you can give them which when used triggers a self-destruct mechanism.

<comment><AUTHOR> Distress codes are an interesting idea. Although I'm sure that there are probably laws around supplying false information and/or destruction of evidence.

<comment><USER19> Dangerous, but what if your destruction code was 1 character out of 20 different to your actual password, do you reckon you could claim the intruder had fat fingers?

<comment><USER20> You could claim that no matter what, it wouldn't work though.

</comment></comment></comment></comment><comment><USER21> What you need is a dummy account... login in to PC with the dummy password and you see a different system.

<comment><USER13> My system doesn't have much data I couldn't clone from github or copy again from $some_picture_upload_service. GPG key is the only one that comes to mind really. It's the password to online services that's critical.

</comment></comment><comment><USER22> I like this, skip the political bull and jump straight to subversion, bravo!

Idea for a new service; trusted tor homed token vendor (a la dpr or similar bonded agency), takes advantage of the trusted third party model whlist providing a jackboot-thug resistant party to verify the full transaction. For bonus points add duress challenges which will fail authentication in a non obvious way or provide fake but plausible data instead of the real thing.

<comment><USER5> You could also use those two-of-three or three-of-four encryption schemes (I only know about this partially--I've seen it mentioned as a way to safely store bitcoin private keys so that no one individual can access the account-- only a quorum). Then it would take participation of two of three people (or three of four, etc) that know you to restore access (allows for some of the people you're relying on to be unreachable/dead).

That way the state doesn't have just one additional third-party target for getting access, they have to go after a group of hopefully decentralized people en masse.

</comment></comment><comment><USER23> Two factor authentication is a good defense against many practical threats _but_...

Wasn't Mr. Miranda's cell phone confiscated as well? That's what I understood from the news reports, they took his laptop and his phone, and required his passwords. So your regular Google/Facebook two factor authentication is useless if you've lost your phone.

<comment><USER24> Did you read the article? It directly addresses that issue.

</comment></comment><comment><USER25> Why not one-time use codes (e.g. [1]) instead of the phone? You can discreetly destroy the list that you carry as long as you can only get a new list at your destination.

[1] [https://support.google.com/accounts/answer/1187538](https://support.google.com/accounts/answer/1187538)

<comment><AUTHOR> That rather assumes that you have a convenient, fast, and unobtrusive way of destroying the list while being told "would you mind stepping over here, sir" in an airport full of security cameras.

The alternative - and much more practical suggestion - is not to travel with the codes. You run the risk of not being able to connect to the service - <USER2> at least no-one else can.

<comment><USER25> Rice paper doesn't taste too bad. How will they prove in court that my snack had security codes on it?

<comment><USER26> Startup idea: Security Snacks - one-time pads printed on pairs of snack foods

<comment><USER27> Sorry, couldn't decrypt messages, was hungry or keys got wet.

</comment></comment></comment></comment></comment><comment><USER28> Change all your passwords with insanely long random keys. Store these in a place you cannot access without being present (for example bank) (encrypted so the bank doesn't access it, and possibly, more then 1 copy).

Don't travel with anything you wish to loose. On return reclaim saved passwords.

</comment><comment><USER29> I wonder how well security by obscurity - or at least partially by obscurity - would work in this sort of situation. Do they know enough to ask for the passwords to your randomly chosen sever? Do they know enough to do steg on some random imgur photo, or on your forum avatar? Do they know enough to ask for the passwords for something that's going to be sent to you via the internet, on time-delay, _after_ you've left their custody - and which you'll have plenty of time to send an abort code to, like say asking your computer back in your country of origin for a different file than the backup, if the password is compromised anyway?

</comment><comment><USER30> I appreciate the people who are developing and evangelizing technology to fight these problems, but in my opinion it's akin to putting a band-aid on a gunshot wound. The problem is that the US government has repeatedly shown itself to be acting without an acceptable level of honesty, transparency, responsibility, or ethics. Until that changes, I don't think technology is going to solve this problem.

<comment><USER12> I agree with you wholeheartedly, though to continue your analogy, the problem of gun violence doesn't mean we should stop innovating band-aids.

</comment></comment><comment><USER31> Here is how you enable 2FA (assuming the service provider doesn't provide these directly to the bad guys). SMS can fall to bad guys hands easily:

1\. Install OATH Toolkit. 2\. Encrypt Swap space using eCryptFS. 3\. Create a TrueCrypt file system with your 2FA keys in it. 4\. Every time you need the code, mount (3), run(1), umount(3)

Again, this assumes the service provider doesn't provide the access directly to the bad guy.

<comment><AUTHOR> Perhaps I'm missing something, but what's to stop the security services demanding you reveal the password to your TrueCrypt partition?

<comment><USER31> It depends how far you want to go with torture.

<comment><USER32> Torture? They affair at the london airport has shown, that you do not need any torture: You have to tell them your passwords or you get in trouble.

<comment><USER31> "You get in trouble" is what I meant. How much torture you can handle before releasing the password for the truecrypt volume.

</comment></comment></comment></comment></comment><comment><USER33> Do such laws (you must give password) apply to you if you are just visiting a country with such laws?

<comment><USER34> IANAL, but I would definitely say so. There have been stories here on HN in the past about people have to hand over laptops and passwords when crossing the US border. A country's laws apply to its citizens and those visiting.

</comment></comment><comment><USER7> > Classic multi-authentication security is based around the idea of:

> Something you know (e.g. a password).

> Something you have (e.g. a smart card)

> Something you are (e.g. a fingerprint)

> rather than sending an SMS to his phone, it sent it to his partner's phone. > Every time he wanted to log in to Facebook, he would have to ring his > partner and ask for the one-time code.

New CloudSystems' _Four Factor Authentication_. The first factor stops your spouse. Then the second factor stops your boss. The third factor stops a random crackhead after he grabs your laptop out of your car. And finally, the _fourth_ factor stops the NSA and GCHQ for up to nine hours.

Four Factor Authentication: Because -- You'll believe anything.

(Based on SNL's Triple Trac Razor parody. [https://en.wikipedia.org/wiki/List_of_Saturday_Night_Live_co...](https://en.wikipedia.org/wiki/List_of_Saturday_Night_Live_commercial_parodies#T) )

</comment><comment><USER35> 2fa keeps hackers out, encryption keeps the state out

<comment><USER32> and you don't think they have enough time in those 9 hours asking you for your truecrypt password? Remember: You have to give them your password!

The only way is encrypting your disk and not knowing the password. Sounds impractically, and it is. But maybe your phone could use geofencing to look whether you reached your destination and then display the password on the lock screen? But you should hope nobody steals your notebook and phone and travels to this location xD

<comment><USER5> Perhaps rather than a simple geo-fence, you have to physically trace an unlock pattern (visit a pre-determined set of locations in a specific order).

The only problem is that if you KNOW how to unlock the devices, you're required to unlock them. So really, you have to NOT know how to do the unlock (geo-fencing doesn't help--you'd be expected to tell them about the fence and how to pass).

The point of the third-party 2FA is that you can tell them exactly what has to be done.

<comment><USER36> The real problem here is that one of the players has the ability to alter the rules of the game as the game proceeds, to ensure a win.

The only winning move is not to play.

</comment></comment></comment></comment><comment><USER33> One password unlocks your encrypted drives, another one destroys all data. Authorities can look into your Google or Facebook anyway.

</comment><comment><USER37> Truecrypt hidden volumes already solve the problem of password extortion, although they are not easy to setup properly.

<comment><USER38> Still not solving for:

1 clone drive

2 force you give password

3 if no sensitive data show up use $5 pipe wrench and go to step 2.

<comment><USER39> If they are going to torture you just in case there is a hidden volume, they might as well torture you just for fun.</comment></comment></comment>


The 1-Bit Instrument - <AUTHOR> https://online.ucpress.edu/jsmg/article/1/1/44/2337/The-1-Bit-InstrumentThe-Fundamentals-of-1-Bit <comment><USER2> You can make any sound with 1 bit if you can switch it fast enough. In fact it is called a Class D amplifier [https://en.wikipedia.org/wiki/Class- D_amplifier](https://en.wikipedia.org/wiki/Class-D_amplifier). They are often very-high quality, and very efficient!

This is also how high quality electronic motor drives and servos generally work.

<comment><USER3> Sony used to hype its 1-bit CD players. They did invest in sending a bitstream to the amplifier at a high enough bit rate to keep the resulting "quantization" noise from being audible in the first place.

Switched power supplies have always seemed to be, to me, kin to class D amplifiers, though the block diagrams don't highlight the similarities.

<comment><USER2> Yeah, it's basically PWM, which is used in basically everything.

<comment><USER4> Well, it Sigma-Delta modulation which isn't PWM.

<comment><USER4> I should have added: "But Sigma-Delta is as easy (in fact, probably easier) to implement that I really don't understand why people ever use PWM anywhere. It's so inferior IMO."

<comment><USER2> Well PWM is probably easier to analyze mathematically. The harmonics produced are more predictable. Knowing min off-time and on-time so easily is helpful when designing circuits. It's also super easy to implement PWM in digital logic or software, it basically needs only timer and a comparator.

<comment><USER5> Sigma-Delta is very easy to implement as well; it just requires a different way of thinking. In S-D you always try to preserve and compensate for the errors you make in quantization, while in PWM you throw the errors away. In physics you'd label S-D an error-conserving system vs PWM an error-dissipative system.

<comment><USER4> Well put. Another example is Floyd–Steinberg dithering which is also error- conserving.

My (effectively one-line) implementation above was derived from first- principle:

Given a desired target level 0 <= T <= 1, control the output O in {1,0}, such that O on on average is T. Do this by integrating the error T - O over time and switching O such that the sum of (T - O) is finite.

       S = O = 0
       loop:
         S = S + (T - O)
         O = (S >= 0)

In fixed point arithmetic this becomes even simpler (assume N-bit arith) S = Sf * 2^N = Sf << N. As |S| <= 1, N+2 bits is sufficient

       S = O = 0
       loop:
         D = T + (~O + 1) << N === T + (O << N) + (O << (N+1))
         S = S + D
         O = 1 & ~(S >> (N+1))

and that's the Verilog below

<comment><USER5> Completely agree. I've always considered Floyd-Steinberg dithering to be a 2D version of Sigma-Delta. It's all about diffusing and minimizing error quantities, to trade higher sampling _rate_ for lower sample _resolution_ while conserving total information content.

Another example is Bresenham's algorithm for drawing straight lines on raster displays. The quantity being approximated there is the slope of the line, which is approximated with minimal diffused error _as the line is being drawn_ with only integer adds and subtracts. No divisions and no floating point needed.

These are some of the most subtly beautiful algorithms in computing.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> There was a music program for the Sol-20 microcomputer, which was an 8080 running a tad slower than 2MHz. 4 voice polyphony.

The program came with a tiny card plugged into the S-100 bus consisting of nothing more than an RC filter. The Sol didn't use interrupts. The program worked by toggling EI/DI (enable and disable interrupt) to cause one of the pins on the s-100 bus to toggle.

The intonation of especially suffers because those notes are more affected by the fixed 8080 clock cycle.

Here is a clip of it. This clip is from an emulator of the Sol-20, and it uses a higher order filter than the first order RC used by the original hardware. The real hardware is harsher sounding than this. The ten seconds of the 25 second clip is unimpressive, but the 2nd half shows how much can be done with such limited hardware.

[http://sol20.org/media/d-minor.mp3](http://sol20.org/media/d-minor.mp3)

<comment><USER7> It reminds me of the PC-Speaker program which ran on 8086 computers (at 4.77Mhz or 12Mhz if you had a turbo switch). PC-Speaker was really quite distorted by comparison, but you could create reasonably understandable voice. Anything too complicated just sounded like a hissy mess.

<comment><USER8> DAISY.COM

</comment></comment></comment><comment><USER9> Related in name, but still super cool, is the 1-Bit Symphony by Tristan Perich. He programmed a symphony on an ATTiny that outputs directly from one of the output pins (through a volume pot) to the headphone jack.

[http://www.1bitsymphony.com/](http://www.1bitsymphony.com/)

<comment><USER10> If you want to listen first and already have spotify:

[https://open.spotify.com/album/6Ie1GtBI9ZCfmcT1OsK8a0?si=Aov...](https://open.spotify.com/album/6Ie1GtBI9ZCfmcT1OsK8a0?si=Aov1MkSvTV6rkd4ZyeWAjQ)

If you're into chiptunes, this hits the spot.

</comment></comment><comment><USER11> Seems like the author owned a ZX Spectrum and little else.

There were other 1-bit machines out there, like the Apple ][. Paul Lutus' _Electric Duet_ managed to get two-voices out of the speaker and he describes the process here:

[https://arachnoid.com/electric_duet/index.html](https://arachnoid.com/electric_duet/index.html)

</comment><comment> seph-reed This was the top hit for 1bit music that I could find: neat!

[https://www.youtube.com/watch?v=lZRcGWa0Rrw](https://www.youtube.com/watch?v=lZRcGWa0Rrw)

</comment><comment><USER12> This video explains how they used 1-bit sound to generate Pikachu's sounds in Pokemon Yellow on the Game Boy.

[https://www.youtube.com/watch?v=fooSxCuWvZ4](https://www.youtube.com/watch?v=fooSxCuWvZ4)

<comment><USER13> Neat work, but their method of improving the audio quality is not very good. They could get much better results by looking at the magnitude spectrum of the source audio, lowpass filtering with a cutoff chosen to keep 95% (if possible) of the energy (likely 1-2 kHz) then downsampling to nyquist. 4 kSamp/s @ 4 bits per sample would sound much better than his method, and it wouldn't take extra fancy software tricks. The driver/speaker on a gameboy isn't going to have a very controlled lowpass filter, and it's behavior is also unknown. Delta-sigma is heavily reliant on the output lowpass filter.

</comment></comment><comment><USER14> Let us not forget Tim Follin's masterpieces: Agent X and Agent X II. Hearing this come out of a Spectrum in the mid-80s was _astonishing_. I recorded them onto tape for Walkman listening.

[https://www.youtube.com/watch?v=JOZ8rbmlWrk](https://www.youtube.com/watch?v=JOZ8rbmlWrk)

[https://www.youtube.com/watch?v=pDfsAemVaDA](https://www.youtube.com/watch?v=pDfsAemVaDA)

<comment><USER15> Here's another tune along with a remake of it for the C64.

Tim Follins original ZX Spectrum tune: [https://www.youtube.com/watch?v=Iz46pCROkjM](https://www.youtube.com/watch?v=Iz46pCROkjM)

Remake: [https://www.youtube.com/watch?v=shj1_T68SBo](https://www.youtube.com/watch?v=shj1_T68SBo)

</comment></comment><comment><USER16> So basically an SACD.

<comment><USER13> Without oversampling and with a lot of clever hacks.</comment></comment>


New DNS Exploitation Technique: Ghost Domain Names - <AUTHOR> http://resources.infosecinstitute.com/ghost-domain-names/

<comment><USER2> I see the bug but I don't see the exploitation. You have to be in charge of the DNS zone, right? The best use I can think of here is having a subdomain that only shows up on a certain DNS server but you could do that by having your authoritative DNS server return different results to different IPs.</comment>


"The Witcher 3" Developers started out with no clue how to make games - <AUTHOR> http://www.pcgamer.com/the-witcher-3-devs-started-out-with-no-clue-how-to-make-games/ <comment><USER2> This is just an excerpt of a longer post here: [http://www.glixel.com/interviews/witcher-studio-boss-we- had-...](http://www.glixel.com/interviews/witcher-studio-boss-we-had-no-clue- how-to-make-games-w472316)

Somewhat gratifying to know the origin of their bizarre, 90s-era retro company name:

> I had contacts in the United States through the bulletin-board system scene, > and one of my friends from the BBS recommended a game wholesaler. We started > importing CDs, and initially Michał was selling them at the computer market > on the weekends. Initially, we got them from any channel we could. I > remember one of our first contacts was a company called Just CDs in Anaheim. > I was just on the phone, ordering games like, "Five units of Indiana Jones. > Two units of Day of the Tentacle." After three months of this sort of > incubation, in the gray zone so to speak, we said, "Hey, it's going well. > Let's start a company."

> And that's why it's called CD Projekt?

> Exactly, because we were the first with CDs. And then, you know, we slowly > learned how the industry worked. We went for the first time to the Consumer > Electronics Show. We were in heaven.</comment>


My domain name generator just passed 120k searches, here's the top 50 keywords - <AUTHOR> http://blamcast.net/articles/domain-name-generator

<comment><USER2> I've seen a few of these domain name generators / suggestion tools, and always wonder how they verify that the domain names are available? I've yet to find an API that lets me query them, and merely checking if there's a server registered for the domain name isn't sufficient, as it isn't required to have one.

I guess what I'm really asking is, how do you verify that they aren't taken already?

<comment><USER3> Fastest way is to check whether it exists in the nightly zone file, and then a DNS lookup, and whois query.

<comment><USER4> What is the nightly zone file?

<comment><USER5> It is zone file from the last night (or day). It requires free account from Verisign for .COM and .NET. I used such account for a while.

edit: "Zone file" is the file containing the records of all registered domains in a zone (.com or .net). Last time I checked it was something 80M records for .com

</comment></comment></comment></comment><comment><USER6> Works great! You should add a couple of extra registrar options (I use GoDaddy) so you can get the affiliate commission.

</comment><comment><USER7> I guess that you didn't eat your own dog food ;-)

</comment><comment><USER8> Have you been logging how many went on to be purchased?

<comment><USER9> It took me about 2 years to get 10k purchased on my domain generator.

It would be interesting to see how this one does.

</comment></comment><comment><USER10> That is pretty useful.

Can you not create affiliate accounts with other registrars? I hate to have registrar fragmentation. So, when your tool suggested dashbiz.com, I bought it through godaddy.

</comment><comment><USER11> I used it yesterday and ended up registering a madmeta.com. Thanks!

If you included an affiliate link to godaddy I would have clicked it. They use cj.com for their aff program and auto-approve.

</comment><comment><USER12> Great tool! This one and wordroid are my favorites to use

</comment><comment><USER13> This is nice. You could increase user engagement by changing the select menus to radio buttons (reducing clicks by 50%).

</comment><comment><USER14> I got the same domain-names in the same search-result. A bug you probably could fix pretty easy. Neat tool, thanks.</comment>


ArXiv for Engineering - <AUTHOR> https://engrxiv.org/ <comment><USER2> I'm all for this, it does seem like arxiv is already the arxiv for engineering though.

<comment><USER3> Right, is there a reason not to just integrate with the normal arxiv? There are already categories for CS and EE.

</comment></comment><comment><USER4> I'm in Engineering Physics and arxiv was already fine for me. What's the point? It just means everyone has to search in more places...

<comment><USER5> Same also eng phys, arxiv was fine

</comment></comment><comment><USER6> Why would anyone Need it? Is it a homework project to show some installation skills??</comment>


Why your first job out of college matters - <AUTHOR> https://www.cnbc.com/2018/06/25/why-your-first-job-out-of-college-really-really-matters.html <comment><USER2> Absolutely. I was in the 39% of math majors who started out underemployed and was chronically underemployed for years until I finally broke into the tech industry. Once I did, my advancement and salary growth was fairly rapid, but I'm missing about 10 years of experience I should have had.</comment>


Rails i18n TextMate Bundle: myGengo/Google to localize your Rails Yaml Files. - <AUTHOR> http://www.agileproductions.com/blog_posts/15-Rails-i18n-Internationalization-Textmate-Bundle Brilliant and easy. <comment><USER2> This is pretty cool...

Basically the bundle works with your yaml file and allows you to order translation, either by machine, or using myGengo's human translation service.

The guy who created the bundle has pretty much thought of everything. We're pretty excited by it as it's a great use of our API.

[disclosure — I'm one of the founders of myGengo]</comment>


Drupal 8 is 2x to 200x faster than Drupal 7 for anonymous users - <AUTHOR> http://wimleers.com/blog/drupal-8-page-caching-enabled-by-default?utm_content=buffer66dab&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer

<comment><USER2> You would have more upvotes if you explained that it uses cache-tags (didn't know about them) in the title.</comment>


What happens when you add a new teller? (2008) - <AUTHOR> https://www.johndcook.com/blog/2008/10/21/what-happens-when-you-add-a-new-teller/ <comment><USER2> Kind of a textbook description of queue theory if you were taking a stochastic processes class. If the author really is suggesting this for use in retail line situations, he is out of touch because... retail managers have no idea what queue theory is. If they did, they would be making much more money, and not working in retail. Staffing is more of a function of how many people you can get on the clock without getting yelled at by regional managers (who also do not know queue theory) for overstaffing.

<comment><USER3> That's not true at all! A good GM understands throughput and may get bonuses based on that.

The retailer I worked at in the 90s also tracked the ring rate and time per customer for cashiers, and made scheduling and hour decisions based on performance.

<comment><USER2> Thats great and all, but also not queue theory.

</comment></comment></comment><comment><USER4> This is classic open-loop queuing theory with Poisson arrivals. Nothing really works like that. There's always a "rejection rate", where people leave the line before being serviced. Or, in networking, the connection times out. Or, for a shopping site or a real store, you get an "abandoned cart". In real life, this has a lot to do with how many sales you lose.

In the early days of the Internet, people were trying to analyze datagram networks as open-loop systems with Poisson arrivals. That's because everybody read Kleinrock back then. His thesis was on Western Union Plan 55-A, which was Sendmail made out of telephone relays and paper tape punches feeding paper tape readers as buffers. A mail system behaves much more like an open loop system - people don't mail less as the mail propagation time goes up. That was the wrong model for IP messages, because TCP connections add a closed loop system on top of IP.

</comment><comment><USER5> Seems to me the big problem with any kind of retail queue is highly inconsistent service times. If you have a consistent time/ customer, it's easy to predict. As soon as you have some customers taking 20 minutes and some taking 2 minutes all the simple math goes out the window. This is why some people get so infuriated when they see the person in the front of the line break out a fist full of coupons, food stamps, or wants to pay with a check. It's also why so many businesses use a single queue with multiple tellers/ cashiers.

<comment><USER6> This happens a lot in retail, the DMV, post office, etc. The best way to model it is with a meta-process where servers randomly disappear and reappear. This also captures the infuriating phenomenon of tellers going on break or (worse) looking like they're available when they're not because they have to stop and count the till or something.

</comment></comment><comment><USER7> It's all fun and games until it's not a bank with one teller, but a LabCorp with one phlebotomist, and you're not there to give a blood sample, but a urine sample.

<comment><USER8> Or you get some one like me with uncommon tests I once had 75% of my local hospitals phlebotomist's working out how to do this particular test.

</comment></comment><comment><USER9> Did a fun project for my MBA. A bike parking facility downtown, where you can park your bike securely, showers, lockers, towel service, ironing boards, buy some coffee and a snack. Raised $80k for it...needed 100. Anyways

We modeled the showering process. Had some data on how long people took to shower. Needed something like 3 showers per gender to get good throughput

One of the MBA profs didn't like this for some reason. Didn't believe it would be enough (without any numbers to back it up). We were like, well if we add a fourth shower we can accommodate dozens of more people. He liked that even less

<comment><USER10> Why gender the showers in the first place? Seems like added complication for little to no benefit by splitting into separate queues.

<comment><USER9> we did a survey of cyclists and gendered bathrooms were much preferred. this was 9 years ago though...

<comment><USER11> Community consultation is the right thing to do! I wonder if modelling might have predicted better service times for the majority gender with non-gendered bathrooms, and that might have swung the survey result.

</comment></comment></comment></comment><comment><USER12> A thread from 2015: [https://news.ycombinator.com/item?id=9652882](https://news.ycombinator.com/item?id=9652882)

</comment><comment><USER13> Why I will never live anywhere with roommates, or have an event, anywhere with one bathroom!

<comment><USER14> Meh, it's not that bad. I lived my 6 years of college in a dorm with 5 people lodged in one room - 15ish m2. One bathroom in each two room duplex containing two sinks, one private toilet and one private shower. Surprisingly, it worked really well. We rarely had to que and if someone was using a part of the bathroom you could still use the rest of the facilities.

</comment></comment><comment><USER15> The teller post and queueing theory ideas are included here: [https://github.com/joelparkerhenderson/queueing_theory](https://github.com/joelparkerhenderson/queueing_theory)

</comment><comment><USER16> What does it mean that service times are exponential?

<comment><USER17> Good question! It means that the probably of finishing in the next increment of time is always the same. Just got up to the teller? There's, say, a 20% chance that you're done within the next minute. Been at the teller's desk for 30 minutes already? Still a 20% chance that you're going to be wrapped up in the next minute.

<comment><USER18> This might be saying the same thing in a slightly different way. But does it also mean that if we plot "service times" on the X axis and frequency on the Y, then in the first quadrant we get something high on the left, getting lower as it goes right, and asymptotically approaching zero as it goes to infinity on the right?</comment></comment></comment>


Prompting for app reviews - <AUTHOR> http://dancounsell.com/articles/prompting-for-app-reviews

<comment><USER2> good balanced approach. I like the suggestion to ask for a review after something good has happened.</comment>