PHP Cross-Platform Desktop GUI Framework - <AUTHOR> https://github.com/naetech/nightrain <comment><USER2> Can i just say that clearly everyone knows its not the best tool for an actual serious project, but theres nothing wrong with whimsy. Its fun to do things because you can, that doesnt mean its going to become a serious tool. We just had a story about "Stupid Projects From The Stupid Hackathon"[1], just because its not a serious tool doesnt mean we should be throwing the hate, lets just take it for what it is, a bit of fun and a project you do because you can.

[1] [https://news.ycombinator.com/item?id=8621886](https://news.ycombinator.com/item?id=8621886)

<comment><USER3> The problem with whimsical projects is that eventually people make things in them thinking they are serious, and then other people have to maintain said things.

<comment><USER4> kind of like javascript (originally created in 10 days)...[1]

Eventually if people like the core idea, these things enter a positive feedback loop and the quality goes up. If nobody likes it or uses it...no harm.

[1] [https://www.w3.org/community/webed/wiki/A_Short_History_of_J...](https://www.w3.org/community/webed/wiki/A_Short_History_of_JavaScript)

<comment><USER5> well, some people would argue javascript is [still] a mess. Douglas Crockford has spent a career pointing out a lot of the weak spots (while still loving the language mind you). PHP started out as a non-serious project, and today it's had some serious problems (multi-threading to name one).

However, on the other hand, there are also projects that start out as non- serious and get serious quick - the Linux kernel comes to mind.

I guess it can go two ways, but I'd contend a project that is started out with short-cuts because the author doesn't anticipate or plan for it to scale, will have a much tougher time doing so.

<comment><USER6> > PHP started out as a non-serious project, and today it's had some serious > problems (multi-threading to name one).

What's the multi-threading problem? The engine is thread-safe.

<comment><USER5> it wasn't always... that is a relatively new thing.

</comment></comment></comment></comment></comment></comment><comment><USER7> This is really cool. We have a few internal automation scripts built with PHP but its a pain to train non-technical users on using the command line. This would make it very easy to create a simple UI and make those tools more accessible, not to mention easier to bundle and distribute.

<comment><USER8> I agree. I inherited some perl scripts around my work, and getting users up and running on them is kinda a pain (plus playing find the cpan depenency...)

New functionality is in php on the internal site which makes distributing better. Another way to distribute tools though is not a bad thing.

<comment><USER9> I used Zenity to provide some dialogs to PHP scripts with little effort.

</comment></comment></comment><comment><USER10> When it said "GUI framework", I kind of expected a way to make cross-platform apps with their native UI controls, not a web view with an embedded PHP executable.

<comment><USER11> Can you list some native UI controls that you'd like to use but can't recreate in HTML? I am writing a similar framework and would like to know the use-cases for doing this.

Edit: besides Window and Menu, of course

<comment><USER10> You can recreate almost anything in css/html but you'd have to write a different style for each OS yourself, and it will never match the actual "feel" of the UI. It'll be a little off.

Also, for example Mac OS X has lots of little widgets like the share button.

Maybe someone could make a Bootstrap-like project for these kinds of things?

<comment><USER12> There's tint2 for doing native apps with JS.

</comment></comment></comment></comment><comment><USER13> I can see this being pretty useful for utility type apps on the desktop. If you already have a lot invested in PHP then it seems like it would be really comfortable. Since it's basically just running a local server, it's going to be just like writing a web app except (I assume) with access to the local file system and system calls.

There's a few comments here about using native GUI widgets and such but I think that's a tricky approach. Dealing with long-running state of a native app seems very un-PHP. I consider myself fairly experienced with PHP but I'm not familiar with creating background threads with PHP which you'd need for a responsive GUI.

My greatest fear with all of these various wrapper frameworks is that they become abandoned. With a node.js/Javascript one at least there are several out there and the code is likely to be portable from one to the next. With this PHP one, you'd be committed to Nighttrain.

<comment><USER14> There is pthreads, PCNTL on posix systems, and Semaphores. The Implementation is pretty basic, but it works. The main issue are no native framework bindings other than the very old PHP-GTK... (edit, just read about wxPHP and QT...whoops)

Honestly, I still have a soft spot for PHP, mainly because its so easy to develop small things quickly. I'd love to see it move into other applications, much like JavaScript has...but the world is against the language, so I dont see that happening.

<comment><USER13> A cool. I knew there was some type of thread support. I figured most PHP devs would be more comfortable with the short running "page" concept rather than diving into threads and long-running stateful apps.

Anyway, I feel the same way about PHP. It's simple and easy and if you use it for the right job then it just works great. I think a lot of the hate is based on old, sloppy PHP code. Modern PHP apps are organized and use frameworks that don't look radically different from more popular languages.

<comment><USER15> The problem with things like pthreads in PHP is that 98% of the time your runtime is via mod_php5, and spinning threads off of an Apache worker instance is one of the worst ideas imaginable.

I (once, ignorantly) tried to do some kind of super lightweight background- like worker with pthreads in PHP instead of bringing in a full queue and worker design and it turned out that there is absolutely 0 capability of doing it with the slightest hint of sanity. Having libraries like that is cool, but it's not for what PHP was designed for: web pages. Arguably and controversially, web applications are even a stretch for the language, but the support is and has been getting better with actual classes, namespaces, and tooling support like Composer and agreed-upon libraries like Doctrine. Then again, I just fled a company who's entire infrastructure was dependent on cronjobs running tasks using relational databases as queuing mechanisms with very little use of ORMs. It doesn't really matter if the language gets better, because the bar isn't really getting raised, unfortunately. After making the language more desirable (which has been done), a community effort needs to be made to shame and call out bad code, which might end up requiring a jump to 6.0 finally and breaking backwards compatibility with everything that's changed since 4.x (mysql_escape_string, mysql_x instead of mysqli_x or PDO, etc.) At least non-parseable code isn't going to fester bad practices.

<comment><USER16> > 98% of the time your runtime is via mod_php5

Not true anymore, a lot of code is running in php-fpm nowadays.

</comment></comment></comment></comment></comment><comment><USER17> First it's not a GUI Framework,it's a webview that uses a Python GUI framework with a PHP server. I bet one could create the exact same tool on top of node- webkit,since you'll be basically running a server.

The hell,you could do the exact same stuff with next to no "serverside" javascript by launching a PHP server yourself in node-webkit,with the advantage of using a better webview because i'm pretty sure the one used in wxPython is pretty old.

edit:s/bindings/server

<comment><USER18> HTML/CSS is a GUI framework and besides you said it yourself:

Python GUI framework with PHP "bindings"

I don't think you should be dismissive of what the OP has done. You clearly believe this should be done differently. If that's the case I encourage you to spend your time and effort to do so just as the OP did. And then be brave enough to post your work on HN just as the OP was.

<comment><USER17> I feel the title isnt accurate.

> HTML/CSS is a GUI framework

Sure,it's just not WPF,Flex,Swing,Gtk or whatever.That's what I expect when I hear GUI framework.

Just because I found the title of this news vague doesnt mean I'm dismissive of anything.

Finally I just pointed out that it's likely the webview used in that project wont run any modern javascript lib or framework.

node-webkit runs Webgl and all the latest web techs

</comment></comment></comment><comment><USER19> I don't understand why this would not be a good idea for some of the commenters here. It can be useful to develop something for the desktop without learning c++ or c# (even if c# is rather easy), Adobe Air is not a solution of course. Yes it's a webview but how many developers know how to create a web app ? More than c#/c++/java/...

<comment><USER20> I enjoy projects like this (and others like node-webkit and cordova) because it lets me build prototypes relatively quick for my company (an ad agency). I'm strongest in HTML/CSS/JS and PHP so I don't have to spend time learning another language for something that is meant to be a demo anyways. I always tell them that if they want to get serious with one of the prototypes that we'd have to look into doing it the proper way. Although sometimes a project can be simple enough to just continue using it.

</comment></comment><comment><USER21> It is nice and everything, but don't really see the point. By the look of it is just a webview + a server running on localhost:8000.

Much rather prefer using node-webkit for this kind of desktop app (note: PHP is my go-to language)

<comment><USER10> Isn't node-webkit basically the same thing? If php is your goto language, why not use this?

<comment><USER21> node-webkit lets me fiddle with the chrome + i have the ability to install packages with npm.

I can see this being used in internal systems (to replace command line commands for non-technical colleges) but can't see the value in actual end user products

</comment></comment></comment><comment><USER22> As people are noting, there are other GUI toolkits for PHP. In fact there is growing interest in using PHP for more than just web apps, and I think this is only going to increase as PHP develops further as a general purpose language, and more and more non-web libraries mature. Then again I may be biased [1]

[1] [http://www.phpbeyondtheweb.com](http://www.phpbeyondtheweb.com)

</comment><comment><USER9> I think the title is a bit misleading; proper GUI frameworks currently available for PHP are wxPHP (working, and you may export PHP code from wxFormBuilder), Qt (experimental, I think) and GTK (probably abandoned).

<comment><AUTHOR> About the title, see my other reply: [https://news.ycombinator.com/item?id=8631506](https://news.ycombinator.com/item?id=8631506)

</comment></comment><comment><USER23> I wish there was something like this for Haskell :(... Currently I'm aware of threepenny-gui[0], but that launches in the actual browser (correct me if I'm wrong), which isn't exactly what you'd want.

[0] [https://hackage.haskell.org/package/threepenny- gui](https://hackage.haskell.org/package/threepenny-gui)

<comment><USER24> Found this recently. Bindings for Haskell to Chromium Embedded Framework:

* [https://github.com/fluffynukeit/bindings-cef3](https://github.com/fluffynukeit/bindings-cef3)

* [https://code.google.com/p/chromiumembedded/](https://code.google.com/p/chromiumembedded/)

</comment></comment><comment><AUTHOR> I should maybe add that the main reason I posted this project to HN was I noticed they need a push, i.e.: contributors.

Oh, yeah, about the submission title, I couldn't find anything that described it better, even after a lot of head scratching. No, I'm not eloquent, I know... ;)

</comment><comment><USER25> I can't think of many use cases for this but it does look like a cool project.

</comment><comment><USER26> This is a good project, it opens the desktop platform to PHP developers.

I am no fan of PHP myself and for this kind of requirement I would use node- webkit which provides seamless integration of the webview and host JS (node.js)

But the most important thing here is that it opens the doors to desktop programming to PHP devs and therefore we may see more useful apps for the desktop being developed, previously some PHP devs may have had some interesting concepts for the desktop but they weren't able to make them happen due to their lack of skills or time to learn GUI programming.

</comment><comment><USER27> See also PHPDesktop: [https://code.google.com/p/phpdesktop/](https://code.google.com/p/phpdesktop/)

</comment><comment><USER28> anyone else remember WinBinder [1] or wxPHP [2]?

[1] [http://winbinder.org/](http://winbinder.org/) (inactive since '10)

[2] [http://wxphp.org/](http://wxphp.org/) (active)

</comment><comment><USER29> I shuddered when I saw this. It was like looking at the inverse of Java Applets. While interesting as a flight of fancy for the developer; I would hope a real GUI toolkit would be used for a serious application.

</comment><comment><USER30> Seems to work by using Python's wx module for html display. I cannot find info on what kind of HTML5/CSS3/JS support it has, anyone know?

</comment><comment><USER31> Looks like a clone of node-webkit. What are the serious frameworks for cross platform GUI these days??

<comment><USER29> This is really a good question. I haven't done any native GUI in quite some time, but last time I did Qt and WxWidgets were sort of "top tier" for cross platform. Are people still largely on these, are are there better alternatives now?

</comment></comment><comment><USER32> @PHP_CEO is going to be ecstatic...

</comment><comment><USER33> How is this different than MacGap etc.?

</comment><comment><USER34> Looks awesome! Any examples though?

</comment><comment><USER35> Worst idea ever.

</comment><comment><USER36> > _Create your next OS X, Windows or Linux desktop application in pure PHP_

No, thank you.

More specifically, I spent last Saturday setting up PocketMine (a Minecraft server) for my kids. This remarkable piece of engineering is a console app done completely in PHP and one of the first things it logged was "Can't keep up! Is the server overloaded?". That's a completely idle server on a beefy box. And all I could think was how regrettable it was that a clearly capable programmer voluntarily painted himself in a corner by picking a language that wasn't fit for the job. Same thing with GUI in PHP - yes, it's doable, yes, there's probably a demand for it, but this demand is misplaced and misguided and it's not worth of endorsing. It's like giving devs a heavier weight to sink deeper into a tar pit instead of giving them a rope for getting out. Desktop apps should never ever be written in PHP unless it's some sort of quick and disposable hack, which is likely not what this project has in mind.

<comment><USER23> >Same thing with GUI in PHP

I'd more call it a GUI in HTML/CSS/JS. PHP is just for the backend.

<comment><USER36> I understand that. It's a clever and elegant hack and I appreciate it, but ultimately it is _not_ a viable cross-platform desktop app development option, which is, however, what it says on a tin.

That is, I have a problem with the labeling, not the contents.

<comment><USER37> In what way is the labeling misrepresenting what it accomplishes?

I don't see anywhere in the documentation where it boasts as being more viable or comparing itself to other options in any way.</comment></comment></comment></comment>


How Amazon is quietly shortchanging everyday Americans - <AUTHOR> http://www.salon.com/2014/10/08/amazons_gross_new_innovation_how_theyre_shortchanging_everyday_americans/

<comment><USER2> Coincidence? According to the Washington Free Beacon, since 1988 some 88 percent of Bezos' donations went to Democrats.

[http://www.Newsmax.com/Newsfront/Bezos-contributions- Democra...](http://www.Newsmax.com/Newsfront/Bezos-contributions-Democrat- Washington-Post/2013/08/07/id/519168/#ixzz3Ff1s3Vz7)</comment>


U.S. Promotes Network to Foil Digital Spying - <AUTHOR> http://www.nytimes.com/2014/04/21/us/us-promotes-network-to-foil-digital-spying.html?hpw&rref=technology

<comment><USER2> If anyone wants to know more about the Red Hook Wifi network mentioned that survived Hurricane Sandy:

[http://jrbaldwin.com/tidepoolswifi/](http://jrbaldwin.com/tidepoolswifi/)

[http://tidepools.co](http://tidepools.co)

Also: "Get started on building community networks before a disaster hits and ensure that communities prone to disasters are aware of mesh technology beforehand."

</comment><comment><USER3> It seems like an instance where I'm happy the U.S. government is not unified in its goals.

It could also be a very ironic instance of

"The beuaracracy expands to meet the needs of the expanding beuracracy" \- Oscar Wilde

The NSA erodes privacy so the state department promotes it so the NSA has more privacy to erode so the state department... etc etc.</comment>


Skeuomorphism's Last Hope - <AUTHOR> http://jfornear.co/jack-dorsey-skeuomorphisms-last-hope/

<comment><USER2> Hmmm, I have to disagree with the conclusion: "Either skeuomorphism is over and Jack Dorsey isn't the next Steve Jobs, or skeuomorphism isn't over and Jack Dorsey is the next Steve Jobs."

with the thought that it is possible skeuomorphism isn't over and Jack Dorsey is not the next Steve Jobs.

<comment><USER3> Seriously. Who wrote this, Jack Dorsey's mom?

</comment></comment><comment><USER4> "Deviation from the Apple aesthetic has been risky and mostly unsuccessful (Metro, Zune, etc.)"

I think it's a bit early to call Metro unsuccessful. The fact that Windows Phone has even survived is proof that some people prefer it, since design is all that platform has going for it. Metro's just been attached to fairly weak products until now.

</comment><comment><USER5> While skeumorphism is a perfectly valid thing to debate, this might've been the most pointless article possible to write about it. Why would Jack Dorsey give a flying fuck if an Apple exec who happened to like it left the company?

</comment><comment><USER6> What does Jack Dorsey have to do with Apple making changes?</comment>


'Sushi parasites' have increased 283-fold in past 40 years - <AUTHOR> https://www.eurekalert.org/pub_releases/2020-03/uow-ph031520.php <comment><USER2> If parasites weren't bad enough:

> They found that one-fourth of the fish samples with identifiable DNA were > mislabeled. A piece of sushi sold as the luxury treat white tuna turned out > to be Mozambique tilapia, a much cheaper fish that is often raised by > farming. Roe supposedly from flying fish was actually from smelt. Seven of > nine samples that were called red snapper were mislabeled, and they turned > out to be anything from Atlantic cod to Acadian redfish, an endangered > species.

[https://www.nytimes.com/2008/08/22/science/22fish.html](https://www.nytimes.com/2008/08/22/science/22fish.html)

> A piece of tuna sushi has the potential to be an endangered species, a fraud > or a health hazard. All three of these cases were uncovered in this study.

[https://journals.plos.org/plosone/article?id=10.1371/journal...](https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0007866) and [https://www.wired.com/2009/11/tunadna/](https://www.wired.com/2009/11/tunadna/)

<comment><USER3> I'm not a fish eating person but I live in a fishing (and farming) region. I've heard people from here who have gone away on vacation say often the fish they are served is wrong. Usually it's a cheaper type substituted for more expensive species of fish.

<comment><USER4> This happens extremely often in Greece, targetting clueless tourists.

<comment><AUTHOR> No, it doesn't. In tourists' spots in Greece the fish is served whole, not filleted. There's no way you can order one thing and be served something else. Also the menu regarding fish products isn't fixed. It depends on what is available on any given day. What can and does happen occasionally is to be served fish that isn't quite fresh.

<comment><USER5> Serving the fish whole doesn't address the problem that most people not accustomed to being served a whole fish likely don't know what a salmon or tuna or trout or tilapia or yellowtail or what have you actually looks like, let alone be able to differentiate between them. Sure, maybe they'll figure out some obvious cases (catfish are pretty distinctive, and anchovies/sardines are typically served whole even in the "West"), and some freshwater fish like salmon and trout might be recognizable to folks who've gone fishing at least once in their lives, but otherwise there's a pretty good chance you can point at a halibut, say "this is a tilapia", and get someone to believe you.

</comment></comment></comment></comment></comment><comment><USER6> From the article: "Despite their name, herring worms can be found in a variety of marine fish and squid species. When people eat live herring worms, the parasite can invade the intestinal wall and cause symptoms that mimic those of food poisoning, such as nausea, vomiting and diarrhea. In most cases, the worm dies after a few days and the symptoms disappear."

</comment><comment><USER7> I thought all sushi had to be flash frozen to kill parasites. Is this a myth?

<comment><USER8> You will still eat the worms, not that it is necessarily a bad thing. When I go fish in the south of Norway I see these worms in maybe 1 out of 10 fish I catch. I personally don't eat them but I don't think it's unhealthy as long as they are dead.

Considering health and seafood, I'd be much more worried about is eating Norwegian farmed salmon, that stuff is poison [1]. The amount of toxins has not go down since this article was warning Norwegians.

I never touch it myself and the wild fish you catch close to the mares are monsters compared to the fish that does not consume leftovers from feeding the salmon.

[1] [https://translate.google.com/translate?sl=no&tl=en&u=https%3...](https://translate.google.com/translate?sl=no&tl=en&u=https%3A%2F%2Fwww.vg.no%2Fforbruker%2Fhelse%2Fi%2FRLL6d%2Fleger- og-professorer-ikke-spis-oppdrettslaks) (Google translate)

<comment><USER9> I read something recently about AquaStorm, which aims to move fish farms out of the fjords and into deeper sea water, with the purported benefits of avoiding sea lice and disease. Do you have an insider opinion on this?

<comment><USER8> I'm not an insider, just a Norwegian that consumes seafood :)

But that might help if they reduce the drugs they put in the feed. However I think what needs to happen is that they stop poisoning public waters and move everything to highly controlled on-shore facilities.

I would still be worried about heavy metals etc as the feed contains left- overs from other fish like bones (high in toxins) and fatty tissues that humans don't want to eat.

They take the "role" of the apex predator except for us and it's typical that the higher you are in the food chain the more toxins build up.

<comment><USER10> As far as I know, most ( or at least All current export I know of ) _Farmed_ Salmon are Deep Sea type Farmed Salmon. The idea is instead of having the possibility of them going to fresh water to spawn, they are kept at specific region of deep sea and greatly reduce the chances of getting parasites.

So I am not entirely sure what the article is suggesting. May be for Salmon that is not intend to be served as sushi? Because Freshwater Salmon doesn't fit that bill.

</comment></comment></comment></comment></comment><comment><USER11> Where was the testing? After living in Japan I stopped eating sushi in the US. It's always painful when someone asks me to recommend a "good sushi place" here, I'm not sure what to say.

<comment><USER12> personally I prefer US sushi places, local salmon in particular is an insanely buttery and delectable slice of raw fish, Ive never understood the japanese obsession with rice, it's fine but salmon is better imo

<comment><USER13> What do you mean "Japanese obsession with rice"? That's literally what sushi is (rice with vinegar and sugar). Sushi doesn't have to have fish on it to be sushi, it can have vegetables or fruit or whatever else you want. If your sushi place doesn't make good rice, it's literally a bad sushi place (though it could be a good sashimi place if it has good fish).

</comment></comment></comment><comment><USER14> This article is a clickbait. The title tells about sushi parasites, but there is no such thing.

</comment><comment><USER15> I also heard that salmon farming is the biggest "consumer" of antibiotics, is that true?

<comment><USER16> Not even remotely playing in the same league as chicken

</comment></comment><comment><USER17> That proverbial gas station sushi. There, I said it, mark me down. It was worth it.

</comment><comment><USER18> This is a horse shit study turned into click bait. It's a meta analysis (aka they built linear regression models on top of reported numbers in papers over a 37 year time span) and they explicitly state that it mostly applies to cetaceans rather than human beings. There are other results in the paper that indicate the methodology was flawed: aka other closely related, or ecologically similar worm species didn't increase in the samples in the meta data.

[https://drive.google.com/drive/folders/1mYokKOGyhQxKntSnogcm...](https://drive.google.com/drive/folders/1mYokKOGyhQxKntSnogcm_ZFSzLMK- aB7)

There's a larger lesson to be learned here, but at the moment stating the obvious about mass media dipshits reporting on bad stats doesn't seem to be appreciated.</comment>


Ask HN: What improvements would you want to see to Google Maps Nearby feature - <AUTHOR> Google maps, as powerful as it is, still serves primarily as a navigation tool.  It doesn't have the fine-tuned sense of a concierge or a recommendation service for particular events or happenings in the area.  As a diverse and somewhat stratified collection of tools and layers on Maps, what would you like to see in the instance of locality and nearby recommendations?  What sort of improvements do you think could be made on the model Google has with dominant market share? <comment><USER2> You mean that "Explore nearby" thing? I wish it would just stay down. Every single time I open the map I have to drag it down. It uses too much space, and what do I want to explore in my home city for? I know all the places I want to go to. It really serves no purpose on the average use of Google Maps. There's an "Explore" button that brings it up, so why does it have to take up 50% of my screen every time I open Google Maps? "Explore" by its very nature is not so useful that the UI needs to prioritize it at the same level as the map itself.

<comment><USER3> Agreed. Google maps is too bloated, slow, and cluttered, and I suspect the explore feature is a big component of all of those things.

Don't get me wrong - it's a nice feature and sometimes useful. It just isn't useful enough to be worth taking 2 extra seconds to load anything.

</comment></comment><comment> alok-g Aside: Most importantly, I would like to see the older Google maps interface back that did less trying to predict what I want to click. The current version continues to mispredict nearly all the time.

<comment><USER4> +1

This seems to be pattern with all services that got infected with "Clippy" syndrome and keep stepping on your toes trying to predict/help/correct without being asked for. Then they pimp themselves on how advanced they are in leveraging AI.

I find myself learning to make explicit "wrong" choices so they're auto- correct me in the actual direction I want to go.</comment></comment>


A Quiz About Integers in C - <AUTHOR> http://blog.regehr.org/archives/721

<comment><USER2> As a long-time C programmer (20+ years), this quiz -- despite its flaws -- are a good example of how difficult it really is to write 100% portable C code.

I often hear developers talking about how C is a simple language, but it may or may not be, depending on how you define "simple". For example, a written alphabet with only two letters -- A and B -- is "simple" to grasp (there's only two letters to learn!), but it would be very difficult, in the real world, to read and write such a language.

I think C is similar: "simple" in a sense, but very, very complex in another sense. C could use some massive clean-up, in my opinion. Much of its design was so that it could be ported to CPUs which haven't really existed in the wild in a long time in great enough numbers to warrant all the undefined and implementation dependent behavior.

The language could be hugely simplified, in the usage sense, if much of the cruft were jettisoned.

<comment><USER3> That's a huge problem with programming languages: Designers can always add things, but removing stuff is _hard_. JavaScript is a great example of this. It still has automatic semicolon insertion, variable hoisting, and a broken comparator (==). Practically everyone agrees these are bad things, but they can't be changed. Doing so would break backwards compatibility, and there's a huge ecosystem of JavaScript programs that would need to be updated.

Also, language users often rebel when language designers make breaking changes. Python 3 tried to remove cruft, and look how slowly it's been adopted. Instead of adopting 3.x, people backported the features they wanted to 2.x.

I would love it if C had less cruft, but when I say that I mean, "I want C with less cruft, but with the same huge ecosystem of documentation and libraries and tools and debuggers and profilers that crufty-C has."

<comment><USER4> That's why I think the language Go is such a great development. The authors seem to have added only the minimum set of features that make the language workable for their initial needs.

As a result, these features are largely orthogonal, and the rules are simple to state and learn -- even if they at first seem a bit odd (you have to cast all numeric types to each-other before they can interact).

In contrast to Scala, another modern language I investigated recently, which seemed like quite a thicket of features.. some of which seemed just to be there to mediate the interaction of other features.

</comment></comment></comment><comment><USER5> I was really surprised how many errors there were in the quiz.

Errors in the quiz:

3\. (unsigned short)1 > -1: This will evaluate to 0 on systems where sizeof(short)<sizeof(int), and 1 on systems where sizeof(short)==sizeof(int). Yes, such systems exist. Old Cray supercomputers and various DSP processors don't have byte-addressable memory, only word-addressable, so they make all primitive types a word long.

5\. SCHAR_MAX == CHAR_MAX: The person who wrote the quiz even ACKNOWLEDGES that the quiz is incorrect here and apologizes. This is implementation- dependent, it is 1 when char is signed and 0 when char is unsigned. Both types of systems exist. You can use -funsigned-char on GCC, for example.

11: int x; x << 31: This is only defined for some values on platforms where int has at least 32 bits. There exist systems where int has 16 bits, in which case this is undefined for all values. Old DOS PCs often used 16-bit ints, and I believe that ints were 16 bits when C was invented.

12: int x; x << 32: This is only undefined on systems where int has no more than 32 bits. There exist systems where int has more bits. Do a search for ILP64 if you wish to hear about such systems.

14: unsigned x; x << 31: Again, this is only defined on systems where int has at least 32 bits. See #11.

15: unsigned short; x << 31: This one is tricky. There are four different cases, depending on the size of int and whether sizeof(short)==sizeof(int).

15a: sizeof(short) == sizeof(int): defined for all x, since x gets promoted to unsigned.

15b: sizeof(short) < sizeof(int), int has less than 32 bits: defined for no x. I don't think any such systems exist.

15c: sizeof(short) < sizeof(int), int has at least 32 bits but less than 32 more than a short: defined for some x. This is the most common, with 16-bit short and 32-bit int.

15d: sizeof(short) < sizeof(int), int has at least 32 more bits than a short: defined for all x. This is the uncommon ILP64 system.

18: int x; (short)x + 1: This is outright incorrect. Casting int to short results in undefined behavior if the value cannot be represented as a short. Truncation is only guaranteed to occur for unsigned types.

<comment><USER6> The intro text explicitly defines those datatype sizes:

 _In other words, please answer each question in the context of a C compiler whose implementation-defined characteristics include two's complement signed integers, 8-bit chars, 16-bit shorts, and 32-bit ints. The long type is 32 bits on x86, but 64 bits on x86-64 (this is LP64, for those who care about such things)._

<comment><USER5> Hm, okay... the intro text apparently disappears as soon as you click start.

<comment><USER7> Specifying those things is really weak anyways. "Here is a portability test on how the standard defines int's, but oh, assume this implementation".

<comment><USER8> I don't think it's intended as a portability test, but rather an implementation-defined vs undefined behavior test. And in practice it's safe to make assumptions about implementation-defined behavior as long as you're programming for general-purpose computers.

Regehr clarifies this in the comments section: "Regarding signed overflow being defined or not, compiler developers generally draw a sharp distinction between undefined behavior and implementation-defined behavior. 32-bit ints, 2's complement, etc. are examples of the latter and signed overflow is an example of the former. A lot of developers do not draw such a sharp distinction, which is why I made a point of asking questions about this issue."

<comment><USER5> For an example of signed overflow versus unsigned overflow, certain compilers are known to assume that int loop variables won't overflow. So "for (int i = 0; i != -1; ++i)" is transformed into "for (int i = 0; ; ++i)", since both are equal in the eyes of the C standard (both will iterate through all non- negative values that fit in an int, then both will invoke undefined behavior, so they are the same).

The funny part is that it's often better to use int exactly because of the undefined behavior on overflow. By signaling to the compiler that you don't intend to overflow a particular variable, it can optimize appropriately.

</comment></comment></comment></comment></comment></comment><comment><USER9> Isn't the real answer to these questions "don't do that, you fool"?

<comment><USER10> in theory yes, but often there are cases where you can't avoid mixing signed and unsigned stuff for example. Think about write() and read() syscalls that will return a signed type, but are often used in a context where buffer lengths are expressed in unsigned types.

<comment><USER9> Then you probably want to mark it with an explicit function named something like "int32_to_uint32()" which you have defined (and debugged) in one place that performs the appropriate conversion with sanity checks.

Basically, IMO, C's implicit conversions are a flaw in the spec. A more sensible language would require every conversion (aside from those involving un-dimensioned constant data) to be spelled out explicitly. Since you can't make C sensible, the next best thing is to scrupulously isolate the stupid parts.

</comment></comment></comment><comment><USER11> I believe that the answers are incorrect. They assume that all true boolean expressions evaluate to 1, whereas the c standard only guarantees that they don't evaluate to 0.

Edit: As pointed out by the responses, I am wrong

<comment><USER12> Not true, !0 is always 1 in the C standard. Other parts are wrong though (they assume short is narrower than int, and that int is 32 bits).

<comment><USER13> It's not wrong. If you read the intro, they note that those traits are implementation defined, so they say to assume you're using an implementation with those characteristics.

<comment><USER14> So this is incorrectly titled. This should be a "A Quiz About Integers in C on common x86 and x64 ABI."

Unfortunately this does not educate people to that kind of issues, which is very unfortunate.

</comment></comment></comment></comment><comment><USER15> What is the reasoning behind the fact that, say, (INT_MAX + 1) != INT_MIN?

<comment><USER16> Some reasons (the first one being the most important one):

1\. To give compilers some leeway when optimizing stuff (for examples, see [http://blog.llvm.org/2011/05/what-every-c-programmer- should-...](http://blog.llvm.org/2011/05/what-every-c-programmer-should- know.html))

2\. To make C usable for those worried about erroneous overflows in their code.

3\. To make it easier to write C compilers for CPUs that trap on integer overflow.

4\. To allow for performant C compilers on CPUs that use one's complement arithmetic.

<comment><USER17> > 1\. To give compilers some leeway when optimizing stuff (for examples, see > <http://blog.llvm.org/2011/05/what-every-c-programmer-should-...>)

I'm curious about this. See below.

> 2\. To make C usable for those worried about erroneous overflows in their > code.

I think you're saying that the rule allows compilers to implement -fwrapv if they choose, which sounds reasonable.

> 3\. To make it easier to write C compilers for CPUs that trap on integer > overflow. > 4\. To allow for performant C compilers on CPUs that use one's > complement arithmetic.

I wonder how much these matter nowadays.

For optimization, the blog post you cite describes the following examples:

         - "X+1 > X" to true
         - "X*2/2" to "X"
         - "<= loops" and "int" induction variables

On the first two, presumably these usually only come up after macro expansion and inlining, however they're still suspicious. If a function is scaling its return value and its caller is de-scaling it, it's usually a sign that the API isn't designed quite right. I'd be curious to know how often these come up.

Code using "int" induction variables to step through arrays on 64-bit targets is often sloppy. Such code won't handle very large arrays properly, due to the limited range of "int", which is a bug that may not be quickly noticed.

And for the "<= loop" itself:

      for (i = 0; i <= N; ++i) { ... }

it's really unlikely that the code is actually intended to be an infinite loop in the case where N happens to be INT_MAX. Code like this would usually be clearer written as "i < N + 1" to emphasize that it really does intend to iterate N+1 times rather than just N times, and it just so happens that this form makes optimizers happier as well.

Instead of having compiler writers sit around and think up clever ways to repurpose anachronistic language rules, I might prefer to have them focus instead on ways they can help me write better code instead :-).

<comment><USER18> In response to the last paragraph, there's a tension between two different visions for the C language. One of the visions is what's sometimes called "high-level assembly language". In that case, undefined behavior lets implementors choose the behavior that makes the most sense in that situation. Someone writing software for a DSP is going to have different expectations for the behavior or integers than someone writing software for a general purpose processor. Forcing both implementations to use the exact same semantics is going to slow both of them down, because extra checks will have to be added to work around the differences in the underlying hardware.

The other vision for C is a portable systems programming language. When trying to write portable code, undefined or implementation-defined behavior is a big problem. I'm glad that compiler writers employ a take-no-prisoners approach here. People shouldn't be relying on undefined behavior when trying to write portable code, so compiler writers shouldn't be bound to implement consistent behavior in those cases. That's especially the case if code ever needs to be compiled with a different compiler, which might decide to implement different consistent behavior.

It's also worth noting that in some cases, the exploitation of undefined behavior doesn't always happen in a single place in a compiler. Instead, it can be a combination of applying a few different rules in different optimization passes that produces surprising results.

With that being said, it sure would be nice if the compiler writers figured out how to give more warnings when undefined behavior is detected. If x + 1 > x is optimized to false, tell me! If a dereference of a pointer that could be null leads to potentially dead code being eliminated, tell me about that too! It's the silently surprising behavior that causes the most problems.

<comment><USER17> Virtually all CPUs today implement two's complement signed integers natively. Even the few C-capable DSPs that I know about do too (and have separate types and operations for saturation etc.). The main loss would be the compiler optimizations, and most of those can be recovered if programmers can avoid a few pitfalls, such as the ones I discussed.

The problem with undefined behavior is not people ignoring portability. It's that it's actually really easy to accidentally misuse it. For example, Regehr's group has found quite a few such bugs in widely ported code written by smart people [0].

[0] <http://embed.cs.utah.edu/ioc/>

</comment></comment></comment></comment></comment><comment><USER19> So in question 5, the C Standard answer is rejected because the x86-specific answer is required. But then in question 7, the x86 (and all normal archs) answer is rejected and the C Standard answer is required.

Would it really kill you to decide on the questionnaire rules before writing the questions? :-)

<comment><USER20> There's a difference between 'implementation-defined' and 'undefined'. Question 5 is implementation-defined behaviour, while question 7 is undefined behaviour.

</comment></comment><comment><USER21> While I didn't expect to do well on this (if for no other reason, then lack of parenthesis to demarcate evaluation order!), however could someone please explain why CHAR_MAX == SCHAR_MAX? My understanding is that no such guarantee exists for the range of these types.

A few of the questions seemed odd, or mixing implementation specifics with standardize.

Edit: s/width/range/

<comment><USER22> That tripped me up too, and I'm pretty sure that answer is wrong. It's implementation defined, since it's implementation defined whether or not 'char' is signed or not.

<comment><USER20> It is, but this quiz is in the context of x86 and x86-64.

> Also assume that x86 or x86-64 is the target. In other words, please answer > each question in the context of a C compiler whose implementation-defined > characteristics include two's complement signed integers, 8-bit chars, > 16-bit shorts, and 32-bit ints. The long type is 32 bits on x86, but 64 bits > on x86-64 (this is LP64, for those who care about such things).

</comment></comment></comment><comment><USER23> This might be a naive question.

On Question 12 ("Assume x has type int. Is the expression x<<32..."), why is this considered an error? Why do we want a compiler to prefer this over "x<<n means shift x by (n % sizeof(int))"?

<comment><USER24> One possible reason: it makes little sense for _1 << 33_ to be less than _1 << 31_ but not zero (assuming 32-bit ints -- replace 31 and 33 with 63 and 65 for 64-bit ints). In other words, if you keep shifting a number to the left, it should keep growing, until all the bits are gone.

Another possible reason: CPUs have instructions for implementing << as it now stands.

<comment><USER8> On x86, the shift instruction only looks at the bottom 5 bits of the shift distance. x<<32 effectively is interpreted as x<<0\. (I'm sure other architectures have the same restriction.)

<comment><USER25> Different architectures use different numbers of bits. I think PPC uses 4 but I can't remember how to check this at the moment.

<comment><USER24> Does that imply that PPC is limited to shifting at most 15 bits at a time?

<comment><USER25> In fact the answer was 5 bits for 32bit and 7 bits for 64bit[1]. x86-64 uses 5 bits for 32bit and for 64bit (shld/shrd can't shift more than 31 bits).

7 bits is problematic because some code may assume that x << -y is an optimization for x << (32-y). I thought there was some architecture where this assumption didn't work on 32bit either, which led to my post above.

[1] [http://pic.dhe.ibm.com/infocenter/aix/v7r1/topic/com.ibm.aix...](http://pic.dhe.ibm.com/infocenter/aix/v7r1/topic/com.ibm.aix.aixassem/doc/alangref/alangref.pdf)</comment></comment></comment></comment></comment></comment>


What can we learn from suicide data for the last 30 years? - <AUTHOR> https://www.kaggle.com/fredzanella/should-we-care-about-money-an-eda-on-suicide <comment><USER2> Interesting, liked the country dashboard near the end. I supposed from the start that it shouldn't be such an easy analysis. Best exploitation from this dataset i saw, even being a common one on kaggle.

<comment><AUTHOR> Thanks! Glad you enjoyed</comment></comment>


Should Google's Ad Market Be Regulated Like the Stock Market? - <AUTHOR> https://www.wired.com/story/google-ad-market-regulated-like-stock-market/ <comment><USER2> Yes. As the article mentions, Google has hilariously set in products on all sides of the market, and then slowly forced everyone to switch to using them.

When you sell ad space, you have to use a Google program to broker that deal for you. When you buy ad space, you have to use a Google program to broker that deal for you. And the market these deals are brokered on is also Google's.

In an ideal world, the brokers buying and selling ad space should be trying to get the best deal for their customers. But when Google runs all sides of the table, it's optimizing for it's own profit.

</comment><comment><USER3> The full article [1]. The coolest part about the original is its detailed description of the ad market structure.

And, yes, the world would be a better place if markets with a network monopoly were subject to compulsory routing rules (like reg NMS) and anti-fraud rules (like 10b-5).

Compulsory routing should kick in after a reasonable run of first-mover monopoly profits, balancing the need to incentivize investment against the need to limit rent seeking.

[1] [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3500919](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3500919)

</comment><comment><USER4> Google seems a little harder to break up than Amazon/AWS, but you could probably do it with a little work:

\- GCP is one thing

\- The various consumer facing loss leader content services can stick together: YouTube, Gmail, Maps…

\- Google ad market, YouTube recs, and Google search should be spun off and regulated as neutral platforms

</comment><comment><USER5> Third-party cookies are going away across the major browsers. Hulu, Roku, and Xfinity all launched self-serve advertising products recently. Targeted video advertising is going to be interesting in the next few years.

</comment><comment><USER6> No.

</comment><comment><USER7> Paywall bypass:

[https://web.archive.org/web/20200831131910/https://www.wired...](https://web.archive.org/web/20200831131910/https://www.wired.com/story/google- ad-market-regulated-like-stock-market/)

</comment><comment><USER8> Google Ads is the biggest financial scam in the human history to this day. Misandry Today made a video on it last year, i think. Worth a watch.

<comment><USER9> Link for curious people: [https://misandrytoday.com/is-googles-empire-built- on-fraud/](https://misandrytoday.com/is-googles-empire-built-on-fraud/)</comment></comment>


Warn HN: Namecheap.com Cyber Monday WhoisGuard Issue - <AUTHOR> Presumably due to the heavy traffic, Namecheap's ordering system is sometimes failing to add WhoisGuard protection by default to eligible domains when you add them to the cart.
Failure to notice this during the haste to complete an order results in your personal information being unwittingly published in various WHOIS databases forever.
For example: I've had multiple domains with the same ccTLD extension in the cart, and somehow a single one would arbitrarily lack WhoisGuard, while the others possessed it as expected.
After reviewing past orders, I realized I'd already been burned, hence this post. Be careful! <comment><USER2> Yea, same here :( Although they do have Wildcard certs for $20 bucks now. Problem is you need to activate by end of Jan.</comment>


Europe Remotely – EU-friendly remote dev jobs - <AUTHOR> http://europeremotely.com/2015/12/10/issue-8.html <comment><USER3> I think a lot of these job postings would have a lot more success if they showed salary ranges, in fact that just applies to all job postings.

Why apply for EU remote working (if living in the EU) when you can remote work for a US based company? The timezone is off but programmers should be able to work autonomously and independently.

<comment><USER4> Not posting salaries always baffles me. I mean, I understand the negotiating advantage. Maybe also wanting to keep salary information quite within the company. But, surely, this is a relevant piece of information for the person deciding to apply.

I'm surprised jobs sites don't enforce it. Only jobs with salary information are allowed.

<comment><USER5> I've worked my entire career in Germany, Austria & Israel and not once did I see a job ad advertise salary. This might be location dependent?

<comment><USER6> How on earth do you determine which jobs are worth applying to, then?

<comment><USER5> I apply to those that sounds interesting (company and/or project) & if both sides want to go on after the interview we discuss salary.

A couple of times this proved to be the breaking point but not that often.

</comment></comment></comment></comment></comment><comment><USER7> When you are full-time employed, remotely, by a european company, and living in another european country, does anyone know :

— do you set yourself up as a freelance consultant, and pay your healthcare and retirement fund yourself?

— …or do you let the company pay that for you in the country they are based in, and somehow benefit from that?

How does it work exactly for these social benefits that are very important in the european welfare model?

<comment><USER8> In France it's risky to be self-employed and have only one customer, that could be re-qualified as a disguised employment.

I don't know exactly how that works with foreign companies.

edit: my remark on foreign company is that, by having no nexus in the country of the consultant, going after them seems difficult

<comment><USER9> Same in Germany. It is risky for the company, not for the "disguised employee", because the company can find that the freelancer subsequently demands back-payment of entitlements.

I've never actually heard of this happening, but I've encountered difficulties as a freelancer because a company was scared this could happen.

True ridiculous story: a German bank I did a consulting gig at for several months would not allow consultants to have their names on the office doors, unlike employees. They thought that having our names on the doors could be enough to turn us into "disguised employees".

<comment><USER10> No is not ridiculous at all: having your name on a door means that you are "forced" to work there, thus rendering you in a employee since you cannot determine for yourself the place and location of work, the cornerstones of beeing a freelancer.

I do consulting for a big technology company in Munich and they have special freelancer areas where you can have any place you want, since there is no concept of "office" for a freelancers like. Some colleagues always have to chase me, since I can choose to take another place than they are used to :).

Also, you have to bring your own coffee machine, water, you are not allowed to use the ones from the kitchen, since they are only for employees. But I just don't care :), and use them anyway.

PS. i had some other crazy contract where I had to show them proof I am working also for another client, otherwise not able to take the gig. Germany is quite special :)

<comment><USER11> I heard this has to do with the fact that once social services prove that you are not actually self employed the employer would have to pay back a significant amount to social services AND a fine on top of that.

I understand that these laws should prevent abuse of employees by big corporations, but it's hilarious that they go after self employed consultants that make several 100k Euros per year and already pay the maximum amount of social security that is possible.

And it's not like these companies have 2 or 3 consultants, they will likely have 10, 100 or even more. We are talking about fines that could be as high as many millions for these companies.

<comment><USER12> In Germany you need to make about 60000€ a year to get private health insurance (better service, lower price) OR you have to be self-employed, where it doesn't matter how much you make. (500€ private, 750€ public)

Yes, this doesn't matter for an engineer who makes about 100000€ a year. :)

But!

If you're an employee, you have to pay into a government-controlled retirement fund, if you're self-employed you don't.

If you make about 100k, you (and your employer) would have to pay more than 10k a year.

So, no, if you're self-employed and make good money, you don't necessarily have to pay "the maximum amount of social security" :)

<comment><USER13> For the retirement fund only the first 74,400€ (west) or 64,800€ (east) of your income is used (2016 numbers, different rules if you work in mining). For anything over you don't pay into the retirement fund.

There are some self-employed that need to pay into the retirement fund, including teachers (which is applied broadly, e.g. training supervisors and moderators), journalists, and artists.

Also don't forget about the unemployment fund into which employees must pay.

> lower price, 500€ private

Heavily depends on your health and age. Additionally family members are insured for free in public but not private insurance which might tip the scale. Also important to note is that it's close to impossible for most to switch back to public insurance once they decided to go private (e.g. if the premiums rise in the future).

<comment><USER12> Only after 50 it is impossible to switch back.

Before that you just have to report, that you're unemployed and the state forces you to go back into public healthcare

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Thanks! This is really nice. I find it frustrating to browse remote job ads only to find out at the end, that they mean "remote, but US only".

(Of course I can understand why US companies make this restriction, I just wish other job boards would help them make this more clear up front.)

<comment><USER15> I agree with this. I applied on a handful of jobs stating "work from everywhere you want" in the past only to later find out that they meant US only.

Now I want something for asia timezones and I'm happy.

</comment></comment><comment><USER16> The first item on the list is "I Will Teach You To Be Rich". That, to me, is a sign that I won't find serious opportunities on there.

<comment><AUTHOR> I was reluctant to add that posting because of the project name. However if you read the job posting it seems much more serious than the name implies. It was an edge case but I decided to add it in the end.

<comment><USER17> If it becomes an issue, you could change the project name to Ramit Sethi (the guy behind IWTYTBR). He's pretty well known and has personal brand recognition. I don't really recognise any of the other companies on the list, maybe Semaphore, but I was really surprised to see "Whoa, Ramit's hiring."

</comment></comment></comment><comment><USER18> > You should be (or have a strong desire to become) a HTML5 geek, JavaScript > nerd and CSS wizard.

I had to double check if I am reading a job ad or hipster blogger's about page.

Though, the site itself is great, there are indeed many 'remote' job ads, though somehow by default many are 'remote in USA', so it's great value.

<comment><USER19> > > You should be (or have a strong desire to become) a HTML5 geek, JavaScript > nerd and CSS wizard.

Indeed, it seems that there is hardly any room left for mere _programmers_ in this industry :-).

</comment></comment><comment><USER20> This is awesome.

One observation: maybe in this case, including the number of subscribers is actually a deterrent for getting people to subscribe. I'm talking about the "Join over 1100 subscribers." line.

You may be triggering a "damn, I'm going to have to compete with _that_ many other developers for the same handful of jobs?" response instead of the usual "If that many people trust this guy with their email, it must be OK for me to give it" one that this best practice suggests.

<comment><AUTHOR> That's a good point, even though 1100 is really not that much of a competition when you think about it. Five or more jobs per week, each requiring different skills, it really adds up in job opportunities. But I get your point - <USER2> makes a negative psychological effect, I'll consider removing it. Thanks!

</comment></comment><comment><USER21> As an Indian, I doubt I'll qualify for work in these companies. The problem for non-EU, non-US devs wishing to work remotely [1] is that most companies can't legally employ you or aren't willing to jump through bureaucratic hoops just to employ you.

I'd subscribed to a remote-only jobs board and the issue was that either I didn't qualify for work due to my residency, or the company never really responded.

I would say if these issues didn't exist most companies wouldn't have to import a workforce from elsewhere. Most third-world countries have a decent quality of life that we wouldn't have to transplant ourselves & be harassed by less-qualified xenophobic residents just to work and pay obscene taxes (by third-world standards) that in the end does serve them.

I'd love for the EU and the US to become more Anti-immigrant (thankfully it's rising) and for the populace to wake up once the industries that kept them at the top move out of there.

[1] - Most of us speak fluent English and are aware of western cultural sensibilities & work ethics (thanks, Hollywood! & outsourcing firms). Our skill level isn't to blame either since we adhere to industry standards in code-quality, best practices, design patterns, etc.

I'm Westernized, loved America & the U.K. when I visited them and the people were awesome, but thanks to nationalities and nationalists the U.S. has imposed these arbitrary impediments designed to keep away those willing to move from their native countries to further their careers.

<comment> saiya-jin a rather selfish approach to keep things polite.

\- you want us to be more xenophobic, but in the same time steal local jobs for yourself, with our pay, but your local expenses. just WOW

\- there are specific laws to prevent what you want to do, at least in some cases. it's called protection of local market, and a very good think to do, helps economy long term.

\- again, xenophobic WHAT? I sit in 1 row here with Swiss, British (err... Scotch), Belgian, Kiwi, Chinese, French, Dutch, Ukrainian, Indian, Philippino etc. No issues whatsoever.

\- you have a naive view of how good remote Indian resources are. technical skills happen to be OK in many cases, but all remaining, and at least EQUALLY necessary are not. 0 initiative, 0 willingness to take any risk/personal responsibility for decisions. "please hand me over perfect spec and I'll get it done" is nice, but doesn't work in world without perfect spec, or any spec at all. Plus Bangalore is not cheap anymore, Pune is so-so. Eastern Europe wins so far in price/value ratio.

and I could go on and on... one strongly suspect troll there :)

<comment><USER22> >err... Scotch

Wouldn't recommend calling us Scots "Scotch". We're not whisky ;)

<comment><USER21> Isn't British inoffensive to Scots? Odd he decided to bundle an entire nation with whiskey :P

<comment><USER23> I think people in the UK who refer to themselves as "British" are actually in the minority - most people I know would say they are English, Scottish etc.

</comment></comment></comment></comment></comment><comment><USER24> How are you filtering these jobs? Six jobs in a week (the interval between emails) seems a bit on the low end to me. Maybe you apply very strict criteria for including a job on the list?

I couldn't resist and applied a similar filter to the jobs / gigs I found for my own service, SendGigs. I require one of the the tags full-time or salary, and exclude everything that is tagged US-only. Then I'm left with 20 jobs, see [https://www.sendgigs.com/2015-12-10](https://www.sendgigs.com/2015-12-10)

So at least to me it looks like there is a lot of remote opportunities for non-US developers. And it is getting better with more and more companies figuring out remote work.

</comment><comment><USER25> Note that to submit jobs, here's the link: [http://europeremotely.com/submit_job.html](http://europeremotely.com/submit_job.html)

(I started writing this as a question but found the answer myself in the footer links...)

We're based roughly around London time -- though we now have developers from Costa Rica to Bangalore. Bangalore was easy, though, and US timezones were harder. The gap in timezones there is big enough that it took us a while to jump that successfully (and people working in US timezones still need to be fairly independent), so I imagine it works similarly in the other direction (US-based companies hiring EU-based remote workers)... once the gap is more than 3-4 hours you either need an established core of senior full-stack people in that timezone range, or just proceed quite carefully and offer extra support.

<comment><USER26> I think Bangalore is easier to work with because they adapt, not you - i.e. it is generally easier to stay up late than getting up early.

</comment></comment><comment><USER27> I very nearly managed an application from my iPhone

The Elixr position had a "apply with LinkedIn" which worked surprisingly well (must look into how, that seems a sellable app), and I almost had an online CV to upload. Almost.

</comment><comment><USER28> How about remote admin jobs? I have quite a few free time, and would easily take a 2nd job remotely.

</comment><comment><USER29> This is great! Would love something like this for broader roles in the tech field, though

</comment><comment><USER30> This is great. Thanks for sharing. Is there a Japanese version?

</comment><comment><USER31> A section for devops would be nice as well.

<comment><USER32> Most of the links of that newsletter are from weworkremotely.com that has a DevOps section

[https://weworkremotely.com/categories/6-devops- sysadmin/jobs...](https://weworkremotely.com/categories/6-devops- sysadmin/jobs#intro)</comment></comment>


Startup School 2013 Notes - <AUTHOR> https://docs.google.com/document/d/1Xo99mjzc4nyK3J4_GBiba_Kz4h1NPL2Os06JhvbCh5c/ <comment><USER3> Quote from the Google Doc:

"You shouldn't be friends with people who you wouldn't start a company with."

(Made by Phil Libin / Founder, Evernote, CoreStreet) [https://docs.google.com/document/d/1Xo99mjzc4nyK3J4_GBiba_Kz...](https://docs.google.com/document/d/1Xo99mjzc4nyK3J4_GBiba_Kz4h1NPL2Os06JhvbCh5c/preview?sle=true#heading=h.hvkxyhqup7qy)

Am I the only one who thinks this is a terrible advice? I have friends, long- term friends from kindergarden. I enjoy being with them but I would not start a company with them for several reasons. What does this say about the friendship?

Edit: Does anyone know this reasons for giving that advice?

<comment><USER4> There's more context at [https://github.com/charlesfeng/startup- school-2013/blob/mast...](https://github.com/charlesfeng/startup- school-2013/blob/master/PhilLibin.md) \- "You shouldn't even make friends with people you don't see starting a company with — why bother? You only have so many best friends, so use those resources wisely."

Doesn't sound like a fun way to live.

<comment><USER3> Thanks for the context. The additional context does not really make the statement any better IMHO.

Starting a company with one of your friends has a lot of "drawbacks". If your friend is underperforming by a huge margin you often don't want to risk the friendship by telling the truth.

Some of my friends have nothing to do with tech or business - most of them enjoy a very low risk way to live (employed with the state or county for example) and don't want to do it any other way. I enjoy a little bit of risk in my live. :) This different way of living does not make my friends any worse or better...

</comment></comment></comment><comment><USER5> _Before Dropbox, there were 100 cloud storage companies, half of which were VC funded. But Dropbox knew the problem better than anyone else, focused on making the actual use of space easier, and disrupted the existing solutions who were merely trying to compete on economy (offer more space and /or charge less)_

This is a very true piece of advice in many ways.

(1) If there are "no" competitors, there is likely no market;

(2) There can be many competitors, but no "competition" if you execute well

(3) You need true _insight_ to pull off #2

(4) A good screen is (3), and in the presence of (2) a huge market opportunity for an investor.

(5) Talent drives (3) more than age; but experience matters

(6) Corralary to (5) is _rare experience_ has value in the context of (3)

</comment><comment><USER6> Are the videos mirrored anywhere? I was working so I couldn't watch the talks.

<comment><USER7> They usually upload them to YouTube a few days after startup school.

</comment></comment><comment><USER8> _> A very handy memory device. Make do / dont's lists. Note all the things you never want to do again_

Does anyone know what does Jack Dorsey use exactly? Evernote would make sense although he didn't say so specifically.

<comment><USER9> He said he used the Notes app built into his iPhone.

<comment><USER8> Thanks! Definitely makes sense with his emphasis on simplicity.

Tip - I also use Notes and I change the default account to gmail so I can recover accidental deletions.

</comment></comment></comment><comment><USER10> > _You shouldn 't be friends with people who you wouldn't start a company > with._

Ouch. Not everyone is an MBA. I'm guessing that note is exaggerated or out of context.

<comment><USER11> The idea, as I understood it, was that you have a very limited amount of time on this earth, so you should (in general) avoid spending time or other resources on building deep relationships with people that you can't rely on.

<comment><USER12> I have amazing friends that I can rely on - friends of over 2 decades that would literally give their lives for mine. But they'd make horrible business partners. They aren't self motivated in the way they'd need to be. They require the structure of a 9 to 5.

I get the sentiment of the quote - that you need trustworthy cofounders - <USER2> it's a really odd and incorrect way to phrase it.

</comment></comment></comment><comment><USER13> It would be awesome if someone could take these notes and pair them with the videos when they post the videos.

</comment><comment><USER14> I'll post mine when I get a chance.. I thought the speaker line up was pretty good. Lots of diversity.

</comment><comment><USER15> download as pdf link for the paranoid

[https://docs.google.com/document/d/1Xo99mjzc4nyK3J4_GBiba_Kz...](https://docs.google.com/document/d/1Xo99mjzc4nyK3J4_GBiba_Kz4h1NPL2Os06JhvbCh5c/export?format=pdf&id=1Xo99mjzc4nyK3J4_GBiba_Kz4h1NPL2Os06JhvbCh5c)</comment>


Bridging the Gap: Stripe Notifications - <AUTHOR> http://blog.sendwithus.com/2013/10/03/bridging-the-gap-with-stripe/

<comment><USER2> This looks really nice, and the zero-code aspect especially. A friend of mine just released a zero-code SaaS that specifically handles the dunning aspect called ChurnBuster[1] which is already saving customers on the order of thousands of dollars in LTV. I also talk about how to properly handle Stripe events in a Rails app in my ebook Mastering Modern Payments, if that's more the thing you're looking for. [2]

[1]: [http://churnbuster.io/](http://churnbuster.io/)

[2]: [https://www.petekeen.net/mastering-modern- payments](https://www.petekeen.net/mastering-modern-payments)

</comment><comment><USER3> Totally wish I had this for a project I worked on recently. Stripe is bad-ass, but implementing the bag of standard emails to tell customers about payment "events" of various types was a PITA.

<comment><AUTHOR> Thanks! We've got several templates for each event, with all the right variables in place -- it should be dead-simple to get going :)

</comment></comment><comment><USER4> Also check out Stunning: [https://bestunning.net](https://bestunning.net)

We've been doing dunning for Stripe from the beginning, support a ton of email types and events, have an iPhone app with push notifications of payments and other important events, payment update pages for your customers to easily update billing info, and we can even send out emails _before_ cards expire.

<comment><AUTHOR> Hey Richard! We're big fans of stunning -- I think we hit very different markets as well, as we're looking at companies that want to integrate payment and dunning emails into the same workflow as the rest of their transactional email.

I think the number of apps you've put it is really amazing and you've got an awesome portfolio; keep kicking ass :)

</comment></comment><comment><USER5> I've really been needing something like this. Can't wait to dive in and automate my emails.

</comment><comment><USER6> The "no code" aspect is bandied about a lot but it looks legit in this case. That's extremely attractive; sending common automated emails should really not need development team effort. Nice work!

<comment><AUTHOR> You literally connect Stripe to us, create a template, and then connect it with your ESP (SendGrid/Mailgun/Mandrill/etc). No code, I promise!

</comment></comment><comment><USER7> At $work (in Australia) we use EWay as our payment provider so the Stripe integration obviously won't help me. However, dunning emails would be _very_ helpful to our head of sales in her qoal of meeting monthly sales targets. Is there a more generic sendwithus product I could use? The three events mentioned in the post would be perfect.

<comment><AUTHOR> Hey AJ, send me an email (firstname.lastname@example.com) and I'll see what we can do -- we're always looking for more integrations!

</comment></comment><comment><USER8> Perfect timing, was going to add this in as we are losing people due to credit card failures so sending these emails is crucial. Definitely giving it a try

<comment><AUTHOR> That's awesome -- you can hit me up at firstname.lastname@example.com with any feedback, I'd love to hear what you think. Also willing to give out HN-discounts, just ask :)

</comment></comment><comment><USER9> Seems like a good tool. Looking forward to trying it out. There are a bunch of other integrations like shopify that would also be great!

<comment><AUTHOR> Thanks bliggs! We're looking at many different integrations, good to know what people think would be valuable.

</comment></comment><comment><USER10> to code or not to code... this looks almost <i>too</i> enticing.

<comment><AUTHOR> Try the integration, if you don't like it, you can always code it later ;)</comment></comment>


The History of Refereeing at Scientific Journals and Funding Bodies - <AUTHOR> https://scholarlykitchen.sspnet.org/2018/09/26/the-rise-of-peer-review-melinda-baldwin-on-the-history-of-refereeing-at-scientific-journals-and-funding-bodies/ <comment><USER2> Fun fact: Einstein's 1905 papers were published in Annalen der Physik without any peer review [1]. I think at that period, the number of incoming papers were small in numbers that editors can go through themselves and make decisions. The journal had 90-95% acceptance rate. However by 1936, journal Physics Review required peer reviews and Einstein faced the double blind review for the first time [2]. However he refused to subject himself to "anonymous" expert and went to publish the paper somewhere else. Although he did incorporated some of the reviewer's critic :).

[1] [http://theconversation.com/hate-the-peer-review-process- eins...](http://theconversation.com/hate-the-peer-review-process-einstein-did- too-27405) [2] [http://www.geology.cwu.edu/facstaff/lee/courses/g503/Einstei...](http://www.geology.cwu.edu/facstaff/lee/courses/g503/Einstein_review.pdf)

</comment><comment><USER3> It is quite interesting to read how recent the idea of peer review being required for publication is (1973 for Nature apparently). It's well known that in biology that the 1953 Watson & Crick paper in Nature was published without review after Nobel Laureate Sir William Lawrence Bragg (Watson & Crick's ultimate boss) vouched for it, but it seems that wasn't atypical at all for the era.

</comment><comment><USER4> The link is to an interview with the author. The paper itself is behind a paywall:

[https://www.journals.uchicago.edu/doi/abs/10.1086/700070](https://www.journals.uchicago.edu/doi/abs/10.1086/700070)

Does someone know where it can be found?

<comment><USER5> Sci-Hub probably has it. Try searching for the DOI (10.1086/700070).</comment></comment>


Backer of the Day: Should Thinkful teach a class on Angular? - <AUTHOR> https://backer.app.net/thinkful

<comment><USER2> I took the front-end and Python courses. These guys delivered a lot of value for me with those. Not only that, but I'm also interested in Angular. I'd likely be all over this if not for personal economic scarcity. ;-)

</comment><comment><USER3> This is the course I voted for! Awesome to see it coming together.

</comment><comment><USER4> heck yes, took their front end course/python course, learned more than I ever did just reading/going thru the docs.

DO IT.</comment>


PHP Weekly News - 4th July - <AUTHOR> http://www.phpweekly.com/archive/2013-07-04.html

<comment><USER2> I found this one really helpful, especially 'Amazon Beanstalk PHP Hosting & Database Versioning for SaaS' article as I'm working in this field at the moment. Thanks for the link and good work!

</comment><comment><AUTHOR> Just a quick one here - Hacker News was great in helping us 'shape' what we do, but we are looking for more ideas about what people may wish to see. We're getting a lot of requests for adding jobs in here, but was wondering what people think</comment>


CDC Food Safety Alert: E. Coli Outbreak Linked to Romaine Lettuce - <AUTHOR> https://www.cdc.gov/media/releases/2018/s1120-ecoli-romain-lettuce.html <comment><USER2> It seems like no one learned anything after the last one 5 months ago: [https://www.cdc.gov/ecoli/2018/o157h7-04-18/index.html](https://www.cdc.gov/ecoli/2018/o157h7-04-18/index.html)

IIRC the first outbreak was from farmers in Yuma watering their fields with water that had been contaminated by runoff from a large cattle farm upstream.

(The article says the two aren't related, but it seems like more than a coincidence unless romaine lettuce is more succeptible to contracting and retaining e. coli somehow..)

<comment><USER3> Consumer Reports had a more thorough article than the short write up by the CDC. I find it frustrating the CDC blanket points the fjnger at lettuce without disclosing root cause. People confuse the fact that plants are not the source, animal feces is (most likely in this case). Just as s it was last time...

[https://www.consumerreports.org/food-safety/what-growers- are...](https://www.consumerreports.org/food-safety/what-growers-are-doing-to- keep-romaine-lettuce-safe-to-eat/)

<comment> village-idiot But it's still correct to be wary of plants, the fact that you typically eat them raw makes them the most common source of infection.

<comment><USER3> Growing lettuce in your garden bears very few risks. Buying lettuce from a store also carriers very free risks if you know the source. Plants are significantly less risk than any red meat or white meat.

The way the CDC presents this makes it appear, to the uniformed, that this is a plant borne illness - of which it is not. It's almost certain it is human created through misuse of fecal matter disposal or fertilizer.

<comment><USER4> I am pretty much always going to throw a cut of meat on the grill or in a pan on the stove. This action brings the food up to a temperature where it tends to kill/denature a lot of the bad bugs in the food.

I'm likely to just rinse off an apple or lettuce, which may or may not successfully clean the food.

<comment><USER5> _This action brings the food up to a temperature where it tends to kill /denature a lot of the bad bugs in the food._

Unfortunately that's not enough, because cooking temperatures don't always denature the _toxins_ that the bugs produce, which is what the real problems come from.

<comment><USER6> > Unfortunately that's not enough, because cooking temperatures don't always > denature the toxins that the bugs produce, which is what the real problems > come from.

Isn't the problem that the "bugs" produce the toxins while thriving _inside_ your body? If you kill them through cooking, they won't be producing anything while inside you when dead.

<comment><USER7> This problem is most commonly found in rice.

Cooking the rice doesn't kiil the bugs. Not chilling the rice quickly enough allows the bugs to produce toxins. Reheating the rice doesn't destroy the toxin.

[https://www.nhs.uk/common-health-questions/food-and- diet/can...](https://www.nhs.uk/common-health-questions/food-and-diet/can- reheating-rice-cause-food-poisoning/)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Planet Money just did an episode on this issue which ended with the opinion that it was highly likely to happen again, guess they were right.

[https://www.npr.org/sections/money/2018/08/24/641739640/epis...](https://www.npr.org/sections/money/2018/08/24/641739640/episode-861-food- scare-squad)

</comment><comment><USER9> The other day, my wife introduced me to yet another difference between Chinese cuisine and US cuisine: She cooked the Romaine lettuce she got from her coworker. She just cooked it like you'd cook Bok Choy. It was quite good!

My wife also rinses _everything_ we get from the store. No one is to be trusted with your family's food. Absolutely everything is rinsed, including things most Americans would really rather not. One day, I had to work a bit to convince her to not rinse the steel cut oats!

<comment><USER10> Many restaurants in China serve cooked lettuce as a side, I found it quite odd at first but it's really tasty and with some soy sauce easy to eat by itself. Cooking lettuce in the western world will probably raise a few eyebrows.

<comment><USER11> I've gone to a few restaurants in the US that do a cooked version of a caesar salad that's quite good. I've made it myself, too. Grill whole heads of romaine until they're blackened and wilting, then dress and shave parmesean on them.

Well ... don't do that now, I guess. But once the red alert is over, it's pretty tasty.

<comment><USER12> Gordon Ramsay has something to say about cooked salads, and it's hilarious.

</comment></comment></comment></comment><comment><USER13> Reminder that if you're getting your lettuce from a local farm at the farmers market, you probably don't have to worry about this. This outbreak is from some industrial romaine lettuce growing and processing operation.

(Yes, it's possible for local produce to be contaminated with E. coli as well. I have no idea if it's more or less likely on average. But it shouldn't be involved in this outbreak, so go ahead and make your salad.)

<comment><USER14> Be sure you actually know this local farm is real. Lots of stalls at farmer's markets are just buying the same produce as grocery stores and selling it at a higher price while lying about where it came from.

[http://www.tampabay.com/projects/2016/food/farm-to- fable/far...](http://www.tampabay.com/projects/2016/food/farm-to- fable/farmers-markets/)

[https://www.cbc.ca/news/business/farmers-markets-lies- market...](https://www.cbc.ca/news/business/farmers-markets-lies- marketplace-1.4306231)

</comment></comment><comment><USER15> If people are wondering why vegetables can be infected with something like E. Coli, the reason is that animal waste is often used as fertilizer, or animals live near the crop's water supply and then gets sprayed all over the vegetable crops.

<comment><USER16> It's not just animal waste. [http://time.com/3974244/cilantro- feces/](http://time.com/3974244/cilantro-feces/)

<comment><USER17> To be fair, humans are animals. But yes, waste from human and non-human animals have contaminated crops throughout history.

</comment></comment></comment><comment><USER18> It seems like this happens all the time. I really wonder what the implications of this will be to companies like Chipotle, who use Romaine Lettuce exclusively. Personally, I am more of a fan of Iceberg, but it just makes me wonder why E. Coli is much more common in Romaine than in Iceberg. Any thoughts?

<comment><USER19> Forcing workers to drag a "porta potty" through lettuce fields so farmers don't have to pay for the restroom breaks could be causing this.

[http://crownservicesco.com/wp-content/uploads/2016/09/Ag- and...](http://crownservicesco.com/wp-content/uploads/2016/09/Ag-and- construction-porta-potty-2-700x536.jpg)

<comment><USER20> If I was a farm worker I wouldn't be too upset about not having to go perhaps a long ways to use a restroom and be able to clean my hands afterwards.

<comment><USER21> If you were a farm worker who was paid piece rates rather than hourly, you might be less happy about that

<comment><USER14> Why? Not having to walk across a field saves them time, so they can spend more time harvesting, so they make more money.

</comment></comment></comment></comment></comment><comment><USER22> Lettuce grows outdoors, in the soil. Animals have access to it for weeks or months. Dust happens around it. It is quite likely sprayed with fertilizer or pesticide at some point. Then it is cut by hand. Then it goes to the store where it is fondled by employees and the passing public.

So it's a good idea to wash it (and all produce) very thoroughly and not depend on some process to clean if for you. That means in the case of lettuce separating the leaves. It might be overkill but I usually put a drop or two of bleach in wash water, dunk chopped greens, rinse them well in clean water, then spin them in a centrifugal spinner. Something like this (these things are great) [https://www.amazon.com/OXO-Good-Grips-Salad- Spinner/dp/B0000...](https://www.amazon.com/OXO-Good-Grips-Salad- Spinner/dp/B00004OCKR)

Also they sell specific vegetable washes although a little bleach or hydrogen peroxide works well enough for me. Generally I don't eat raw produce at restaurants.

For the record, I worked on a lettuce farm years ago and food safety is very important, but it's a mass produced out door farm operation with manual handling of product. To say nothing of transport and retail. It's better to wash things yourself and be sure. I think in many parts of the world this is better understood, but for some reason in the US we have this disembodied view of where food comes from.

</comment><comment><USER23> Tens of millions of people shouldn't eat Romaine lettuce because 30 people got sick in October?

<comment><USER24> Well you can if you want

<comment><USER25> Not really. Just got back from some holiday grocery shopping and in all 3 stores I've been to the clerks were removing the romaine from the shelves. That's how I found out about this.

<comment><USER26> I had the unfortunate luck of reading the breaking news as I was eating a caesar salad at a restaurant. The restaurant didn't seem to be aware of the news.

</comment></comment></comment></comment><comment><USER27> The offending strain in both the current outbreak, and a major outbreak in June, is E. coli O157:H7, which is a less common strain typically associated with cattle or other livestock.[1] CDC analysis (also helpfully linked by craftyguy) of the previous outbreak of this strain, which hospitalized or killed people in 36 states, found that the source was contaminated canal water used for irrigation near Yuma AZ.[2] A large CAFO (Confined Animal Feeding Operation) exists upstream nearby.[3] You can see it from space in satellite imagery. It is interesting to view the orientation of this CAFO to Gila River, and to zoom in to the level of individual cattle to get a sense of it's scale and topographic orientation.

Determining the source of water contamination is outside of the scope of office of CDC. EPA is responsible for this, but I can find no evidence of investigation of the source canal contamination. Perhaps EPA is becoming more "business friendly."

[1] [https://en.wikipedia.org](https://en.wikipedia.org) /wiki/Escherichia_coli_O157:H7#Natural_habitat

[2] [https://www.cdc.gov/ecoli/2018/o157h7-04-18/index.html](https://www.cdc.gov/ecoli/2018/o157h7-04-18/index.html)

[3] [https://www.google.com/maps/place/McElhaney+Cattle+Company/@...](https://firstname.lastname@example.com,-114.0872687,16308m/data=!3m1!1e3!4m5!3m4!1s0x80d67cf24fd3037b:0xed7aa673e0848208!8m2!3d32.6917931!4d-114.0578097)

Edit: FDA published an environmental assessment on Nov. 1. They also attributed contaminated canal water as a possible cause. That assessment included "limited" samples (I can't figure out what kind of samples) from the CAFO, which found no matching e coli strain. The authors state that the assessment occurred several weeks after the growing season ended.

"It is uncertain how the outbreak strain of E. coli O157:H7 was introduced into this 3.5-mile stretch of irrigation canal water. The first illnesses in this outbreak occurred in March 2018, and therefore the outbreak strain may have been present in the irrigation canal months before the EA team collected the positive samples, or the outbreak strain may have been repeatedly introduced into the irrigation canal. A large concentrated animal feeding operation (CAFO) is located adjacent to this stretch of the irrigation canal. The EA team did not identify an obvious route for contamination of the irrigation canal from this facility; in addition, the limited number of samples collected at the CAFO also did not yield the outbreak strain. Other possible explanations for how the irrigation canal became contaminated are possible, but the EA team found no evidence in support of alternative explanations.

Growers suggested weather events in the Yuma growing region may have contributed to crop contamination. The EA team considered the possibility that leaf freeze damage and dew on romaine leaves created conditions favorable for windborne contamination of the crop with dust carrying the outbreak strain of E. coli O157:H7. While this type of STEC contamination has been demonstrated (Berry et. al, 2015), it does not explain the presence of the outbreak strain in a free-flowing irrigation canal months later when there was little wind in the region."

[https://www.fda.gov/Food/RecallsOutbreaksEmergencies/Outbrea...](https://www.fda.gov/Food/RecallsOutbreaksEmergencies/Outbreaks/ucm624546.htm#IV)

<comment><USER28> Long to short, the "pollution" from large scale factory animal farming is poisoning the downstream vegetable farming. Is that it?

Given the disconnect between the FDA and the EPA can't the CDC step in? Is there no authority at the state level?

<comment><USER27> I don't know. Evidence is inconclusive, but suggestive.

I'm throwing out my lettuce like CDC told me to, but I woundn't go pointing fingers on twitter just yet. :)

<comment><USER28> Well, we do know that in this case shit __doesn't__ just happen. The sources has to be from somewhere. And we do know factory animal farms have plenty of unsavoury byproducts.

I agree. Can't jump to conclusions. Even so, if feels like a preventable accident that's eventually going to happen (if it hasn't done so already). The ag industry is a strong lobby. Given that those animals need feed there's a clear incentive for all involved to keep the truth from coming out.

</comment></comment></comment></comment><comment><USER6> We really need a way to quickly test if a sample of anything is contaminated with these common pathogens prior to raw consumption at home.

</comment><comment><USER29> Wash (obviously) discard any damaged leaves, use plenty of vinegar in dressing, vinegar is quite effective at killing bacteria, balsamic is best, salt, sugar, lemon juice also kill em.

</comment><comment><USER30> Romaine lettuce is less nutritious, more expensive and make you fart more than spinach. The last part is what made me stop buying Romaine for good.

</comment><comment><USER31> Its always the lettuce!

</comment><comment><USER32> Again?

</comment><comment><USER33> just soak your fresh vegies in 10% bleach and you will be fine</comment>


A Grad Student Found Spyware That Could Control Anybody's iPhone - <AUTHOR> http://www.vanityfair.com/news/2016/11/how-bill-marczak-spyware-can-control-the-iphone <comment><USER2> "nearly 1,400 lines of multicolored commands in seemingly random order, tossed about like a salad." oh geez, really?

<comment><USER3> Yep, and then:

"Suddenly lines of colorful computer code began manically unspooling down his screen: a view of the alien code invading the phone."

Orson Welles and his War of the Worlds was a kid in comparison.

<comment><USER4> One part hollywood, two parts liberal arts major...

</comment></comment></comment><comment><USER5> Such a software already exists! I personally installed [https://www.refog.com/](https://www.refog.com/) on my son's iPhone. Now I can be sure he doesn't websites containing adult or otherwise inappropriate content.

</comment><comment><USER6> Long winded prose. Description of beards and an attempt to give the whole thing a 007 spin.

Tldr; suspected government grade spyware originating from Israeli company NSO used to trap dissidents in Arab countries, targeting the iPhone (iOS 9) and utilising 2 or 3 zero days to jailbreak the device and snoop on everything it can.

Would have been nice to read some technical details but there are none, and the piece goes on forever, needlessly.

<comment><USER7> there you go: [http://info.lookout.com/rs/051-ESQ-475/images/lookout- pegasu...](http://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus- technical-analysis.pdf)

<comment><USER8> Maybe a mod could change the article link to this?

<comment><USER9> Yeah, this wasn't written for the nerds.

Original Link

[http://www.vanityfair.com/news/2016/11/how-bill-marczak- spyw...](http://www.vanityfair.com/news/2016/11/how-bill-marczak-spyware-can- control-the-iphone)</comment></comment></comment></comment>


It took me 2 years to get a 5-month visa (to the US) - <AUTHOR> http://denoyel.com/post/107533757898/it-took-me-2-years-to-get-a-5-months-visa

<comment><USER2> nice idea! wait for reviews!</comment>


TReGo Bike Trolley - <AUTHOR> http://trego-trolley.com/ <comment><USER2> It looks kind of useful but the price in insane! I paid 50€ for my bicycle trailer.</comment>


Twitter knew about onmouseover flaw a month ago - <AUTHOR> http://github.com/mzsanford/twitter-text-rb/commit/cffce8e60b7557e9945fc0e8b4383e5a66b1558f

<comment><USER2> "We discovered and patched this issue last month. However, a recent site update (unrelated to new Twitter) unknowingly resurfaced it. "

<http://news.ycombinator.com/item?id=1713391>

<comment><USER3> That's the second major bug in 24 hours that simple regression testing would have found.

What's the root cause of these issues? Did older test sets somehow get recovered or something like that?

<comment><USER4> It depends why it regressed. Even if the text processor library didn't regress, the dependency may have reverted to an older version somehow.

</comment></comment></comment><comment><USER5> Knew and published publicly without fixing? Oops.

I'm taking this at face value admittedly, since I don't know the provenance behind this github account or even whether it is related to production code.

<comment><USER6> The code in that github account is linked directly from the Twitter open source page:

<http://twitter.com/about/opensource>

twitter-text.gem - Text processing routines for Tweets.

Since twitter does contribute to open source software, it is highly likely that the source is related closely to production code.

</comment></comment><comment><USER7> Actually maybe the attacker was watching commits in github and spotted an XSS fix :) Free vulnerability!

</comment><comment><USER8> Made me wonder about a similar fix 2 weeks earlier:

[http://github.com/mzsanford/twitter-text- rb/commit/c5bb5d45f...](http://github.com/mzsanford/twitter-text- rb/commit/c5bb5d45fbf5f17c6788334af4346a7ce5e0c719)

It seems they fixed it by now so I can't check.

</comment><comment><USER9> They were also told about this a while back:

[http://www.davidnaylor.co.uk/massive-twitter-cross-site- scri...](http://www.davidnaylor.co.uk/massive-twitter-cross-site-scripting- vulnerability.html)

Not quite the same flaw but very similar - caused by unescaped URLs

</comment><comment><USER10> I wonder to what extent not fixing it in the production version was a "conscious" business decision, and to what extent it was just overlooked.

And my extremely cynical side would like to point out that that by many measures this incident benefits twitter as a company; they get free headlines, they are seen publicly fixing a problem in a timely manner, and they get more loyal followers. Not that there is some machiavellian plan at work, but there may be reasons beyond time poverty and careless software engineering that explain why something like this might not have been fixed even though some people may have been aware it was broken.

<comment><USER11> I'd bet against this being a strategic decision to allow this exploit to remain in the wild. They've already managed to build a popular business around convincing people to trust clicking obfuscated URLs from people they don't necessarily know. I highly doubt they'd trade free press in exchange for unleashing a self-propagating JavaScript exploit on their own network.

<comment><USER10> I don't think it's that conscious, it's just that the cost of preventing such incidents is perceived to be greater than the cost of responding to them after the fact. It's worked quite well for Microsoft, Oracle and others to be reactive rather than preventive. And as I pointed out above, there are incentives for that sort of behavior that do exist.</comment></comment></comment>