Obama likely to expand a foreign-student pipeline the high-tech industry loves - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2014/11/20/obama-likely-to-expand-a-foreign-student-pipeline-the-high-tech-industry-loves/ <comment><USER3> If Obama's drive for immigration reform uses the logic of "STEM SHORTAGE!!!" as a basis for expanding OPT, it means that hyperbole has won, and we here at HN will suffer lower wages and a more competitive job market as a result. I'm not actually sure that this is what the rhetoric is going to look like, but the rest of my comment assumes that it will look that way as it pertains to the expansion of OPT.

There is no STEM shortage; tons and tons of STEM workers work outside their field because they can't get a (typically very competitive) job in their field. If there were a STEM shortage, STEM wages would be skyrocketing, which they are not. Many people with PhDs in the sciences are underemployed and underpaid.

More STEM workers means lower pressure for wages to rise, thus saving money for companies in addition to allowing them to be more picky about who they hire. Increasing the pool of STEM workers is an easy way to please the tech companies (who appear to be coming into their own as political juggernauts) and seeming to make progress on "immigration reform" while circumspectly fucking over the employees of the most advanced sector of the economy in the name of progress.

<comment><USER4> It's a bit sad that you see competition on a global scale as "being fucked over". If someone else can do the same job just as well as you, you think employers should be forced to hire you instead just because you happened to be born in the right country? That's just selfishness that harms everyone else.

<comment><USER5> People are entitled to their self-interest, and it is in peoples' self- interest to avoid the race to the bottom that results from globalization. Furthermore, governments exist to serve their specific constituents, not to hew to abstract humanist principles.

Also, even within the context of abstract humanist principles, immigration isn't wholly positive. My family and I are immigrants to the U.S. It's been great for us, not so great for the country we came from that sees all its bright and ambitious people leave never to return.

<comment><USER4> A race to the bottom means a race towards efficiency. This is a net benefit to society. Sure, selfish people might stand in its way, and if you sympathize with them, that's your choice, but don't pretend it's something admirable.

<comment><USER5> "Efficiency" usually just means more of the wealth of society accumulating to capital holders. Nothing admirable about that.

<comment><USER4> Why not? The alternative isn't a more equal distribution of wealth, it's less total wealth.

</comment></comment></comment></comment></comment></comment><comment><USER6> My hunch is this is what 'immigration reform' is really all about behind closed doors, expanding foreign worker visas for "high tech" professions. It appears that is the whole basis behind Zuckerbergs fwd.us campaign.

If you are a tech company you are foolish to not take advantage of the OPT program. Unfortunately it has a negative feedback loop on actually getting enough qualified and trained citizens in to these positions. It basically drives up the cost of such an education displacing citizens from the classroom. However, from the tech industry point of view it's a positive feedback loop.

One little anecdote on something I thought was pretty telling and a bit funny was when I recently heard an interview with Joe Kennedy where a member of the business community asked him about his thoughts on immigration reform. He gave a pretty canned response about hard working people, family ties, deserving a chance etc. Before he could finish the person asking the question chimed in '...and what about H1Bs?" and it was as if somebody snapped their fingers and Joe Kennedy stood up straight, changed to a more serious tone and replied very quickly with 'Oh yes, we MUST expand the H1B program'.

</comment><comment><USER7> So who exactly is this helping? Ok, I know it helps out foreign students, but I am asking strictly from an American perspective. First and foremost, the governments job is to serve the American people. How does this specific action of Obama's immigration proposal help the American people as a whole?

It's a 100% possibility that I have this wrong but I see two groups who this helps. The first group is foreigners who live in the US and the second group is big businesses who can most likely hire lower wage workers.

Don't get me wrong, I am all for improving the STEM sectors in the US but I just feel like it might be a little more useful to invest in our own schools and our own workers instead of invest in foreigners living in the US. Can someone explain what I am missing or what I don't understand?

<comment><USER8> Without foreign born workers, half of Silicon Valley wouldn't have existed. Is that a good enough reason?

<comment><USER9> No. The important question is not how many jobs there are, but how many - <USER2> at what price - and how does that price translate into a standard of living in the country where you live.

To protect US citizens there are laws in place. That however can be chipped away piece by piece. If tech companies had their way that would end.

There is a real concern about the (at least perceived) decline in the US standard of living for low/middle income folks, that is not necessarily anti- immigrant. You can't deny, immigrants built the country. However, America is going to have to deal with this problem of preserving the very ability of its citizens to be upwardly mobile. I'm not sure how much of the fear is real, but its out there.

</comment></comment></comment><comment><USER10> 48 month OPT/STEM extension will be huge for international students here - great move! Since OPT has few limitations and allows internationals to become self-employed, hopefully more international students will end up on the entrepreneurial path. And for those in "regular employment", more chances to apply for H1B and more time to figure out other, more permanent options (if needed). Lastly, hopefully, more smart graduates will decide to stay in this country and contribute to the economy & innovation, instead of contributing somewhere else. Win-win-win situation. Looking forward to the update tonight.

</comment><comment><USER11> The tech companies who lately focus on "diversity" should publish the number of 20 - 40 old workers they have, versus 40 - 60 year old.

There is no need for tech companies to mine youthful, foreign, easily exploited labor pools ("pipelines") when plenty of well trained, well qualified, and seasoned professionals exist that they refuse to hire.

</comment><comment><USER12> That's a juicy bit of politics: give the tech industry its guest workers _and_ bail out the universities by shovelling more fuel onto the college bonfire, both at the same time.

</comment><comment><USER13> But will it be any easier for them to get permanently residency after? There's no point in doubling the number of people going through college and working on OPT if there's a hard cap on the number which can convert those to H-1Bs or (eventually) into green cards.

</comment><comment><USER14> I think it is obvious and we can all agree that this decision would help foreign students, and American tech corporations. We can probably also agree this decisions is similar to globalization in that it causes an increase in global utility. But given that policy is usually measured against what utility it provides for it's current citizens. One big open question in economics is will this lead to an increase in the utility of current Americans. I think this is the interesting question. Does the increase in talent from around the world spill over enough to offset the reduction in wages from the increase in labor supply?

</comment><comment><USER15> Because US students under piles of debt need more job competition. Not.

<comment><USER3> You're right, but I doubt this is even part of the decision making process.

It's unfortunate, but it looks as though the US government is eagerly trashing the future of the citizenry for the sake of the wills of their political donors.

</comment></comment><comment><USER16> As a US citizen, this is awesome. If I understand this correctly it means students from anywhere can apply for jobs while studying in the US and continue working in the US after graduation. This just means better products, better ideas, and more innovation you know those common things that spawn from a more competitive marketplace. I just wish other countries would take up the same initiative, for instance in Germany you still have to select german and eu citizens over foreign borns.

Does anyone know of other countries where its very easy to move and start working as a foreigner?

<comment><USER17> Funny, isn't it, how all the other countries don't want those better products, better ideas, and more innovation?

</comment></comment><comment><USER18> This is horrendously bad journalism. It is a "news" article making claims about likely future events that cites only "those closely involved in the immigration debate" \-- not, particularly, anyone who is, even anyone _anonymously attributed in a way which suggests that they are_ , in any position to know what the President is actually planning to do.

</comment><comment><USER19> Would the world not be a better place if there was no borders at all? That people from all over the world could work wherever they wanted to, irrespective of where they were born?

</comment><comment><USER20> Fuck.</comment>


Tell HN: Using Twitter for irc style chat - <AUTHOR> http://www.geekybuddha.org/twitterchat/index.php

<comment><USER2> Why would I not use IRC for IRC style chat? :-)</comment>


Skypeopensource2 – Skype client based on reversing Skype 5.5 - <AUTHOR> https://github.com/skypeopensource/skypeopensource2 <comment><USER2> I haven't spent much time browsing through the source but the code quality and security is pretty dismal so far. Not to mention the confusing project structure.

Magic numbers, ... and strings, all over the place [0]. Memory leak galore (debug code?) [1]. Probably buffer overflows all over the place, here's one I noticed [2]. I suspect others given the proliferation of opaque pointers and memcpy usage.

[0] [https://github.com/skypeopensource/skypeopensource2/blob/mas...](https://github.com/skypeopensource/skypeopensource2/blob/master/skycontact4_dll/skycontact4_dll/skype_login.c)

[1] [https://github.com/skypeopensource/skypeopensource2/blob/mas...](https://github.com/skypeopensource/skypeopensource2/blob/master/goodsendrelay3/goodsendrelay3/tcp_recv.c#L500)

[2] [https://github.com/skypeopensource/skypeopensource2/blob/mas...](https://github.com/skypeopensource/skypeopensource2/blob/master/skyauth4_dll/skyauth4_dll/skype_login.c#L260)

<comment><USER3> "How dare you show your project when it has flaws!"

<comment><USER2> "How dare you comment on the flaws found in someone's project!"

If issues are never brought to light then it's very unlikely they will ever be fixed. Would you rather everyone just stayed silent?

I have great respect for someone that can put in the time and effort to reverse engineer Skype, and brave Microsoft's legal team in doing so, but in its current state this code can't be used safely and is far from easy to understand either.

<comment><AUTHOR> I believe that the best way to bring issues to light is pull request. Second best is the issue. Comment on Hacker News is somewhere down the list

</comment></comment></comment></comment><comment><USER4> As a reminder: [https://github.com/mumble- voip/mumble](https://github.com/mumble-voip/mumble)

[https://en.wikipedia.org/wiki/Mumble_(software)](https://en.wikipedia.org/wiki/Mumble_\(software\))

I'm surprised the gaming chat programs don't get more crossover use. Well, I'm not surprised that a commercial project has a larger userbase than something that requires you to find a server.

But I am surprised when, say, podcast hosts make jokes about lag or call quality on their Skype connections with guests. There are other applications that solve some of these problems, and I'd think if your main creative product relies on call quality for guests, you might look a few steps beneath the most ubiquitous option. (ie, If you're at the level where you're buying an uncommon specialist's mic, you could probably benefit from comparison shopping for voip implementations.)

<comment><USER5> I try to push Mumble over Skype, the main issue with Mumble is that it's not as easy to get into. You spend too much time configuring your client, finding a server, etc. Things that should be fairly trivial. Then you may spend more time figuring out why you're not being heard, or why nobody's hearing you. Mumble is great but there's too much friction involved. I prefer Discord[0] because it's so easy to use by comparison, to test it you don't even need an account, you just run it from your browser. I just wish Discord had a Linux Client.

[0]: [https://discordapp.com/](https://discordapp.com/)

<comment><USER6> Discord is just another centralized, closed platform.

<comment><USER7> Right. And furthermore, Discord is free and totally propped up by investor money. Which means the day will come when the experience is totally ruined in an attempt to make money, as fast as possible.

Of course, I still willingly use Discord despite this - because it generally just works (even in browser) and has an extensive feature set, and is relatively easy to use. (this is among friends who aren't technical, so ease- of-use is a large factor). Previously I used Mumble, but indeed, it's a bit of a fickle beast for things that should be fairly automated (like configuring your voice inputs, etc).

</comment></comment></comment></comment><comment><USER8> My guess at the origins of this project...

Firm somewhere far away where Microsoft's lawyers cannot reach (China?) wanted Skype capability in their product and paid this smart Russian guy to reverse- engineer the Skype client.

Smart guy gets permission to open source it and publishes it with commercial license option with hopes of finding more such clients.

Personally I'd not touch this with a 3-meter bargepole, because I live in a country where people use copyright and trademark law to take people to court, yet it's an interesting project.

<comment><USER9> > Personally I'd not touch this with a 3-meter bargepole, because I live in a > country where people use copyright and trademark law to take people to > court, yet it's an interesting project.

You feel using it would open you up to a copyright claim?

<comment><USER8> If I used this in a commercial product, it would be trivial (absolutely trivial) for the owner of the original product to take me to court for illegal distribution of their copyrighted works, based on the argument that the code I was distributing (for profit!) was written by someone who (by own admission in public) had reverse-engineered the original product.

IANAL but I'd be willing to bet money on this.

The only questions would be (a) is the original product one that matters enough to protect in such a way and (b) does the owner of that original product have the money and lawyers to start such legal actions.

This isn't some random app. This is one of Microsoft's crown jewels we're talking about.

<comment><USER10> As long as you didn't use any of the original Skype code, you have nothing to fear (if you're based in Europe)

<comment><USER11> > As long as you didn't use any of the original Skype code, you have nothing > to fear (if you're based in Europe)

The original Skype code is clearly not available to anyone outside the original Skype team or some team inside Microsoft. What is publicly available is a binary that is produced from this code.

</comment></comment></comment></comment></comment><comment><USER12> Big problem, the code includes stuff ripped straight out of the original Skype client:

[https://github.com/skypeopensource/skypeopensource2/issues/2](https://github.com/skypeopensource/skypeopensource2/issues/2)

</comment><comment><USER13> >> whether or not it is a clean-room reverse-engineered code, like Wine/ReactOS

> No. Not clean room, not chinese wall.

If it's not clean room, then there's probably copyright violations. For reference: [https://en.wikipedia.org/wiki/Clean_room_design](https://en.wikipedia.org/wiki/Clean_room_design)

Also, offering commercial licensing? That's a good way to get a lot worse than just a DMCA takedown.

<comment><USER11> > If it's not clean room, then there's probably copyright violations.

This is the law in the United States. From the links given in the readme file the authors are probably from Russia.

<comment><USER14> As a non-US citizen, I can't wait to see a world where a whole IT industry will exist without caring much about merchandability in the US.

<comment><USER15> Copyright extends beyond the US, due to certain treaties.

But yes, Antigua's IT industry could get very interesting if they get to keep the whole copyright haven thing going.

</comment></comment></comment></comment><comment><USER16> For more context and commentary:

[https://news.ycombinator.com/item?id=2611299](https://news.ycombinator.com/item?id=2611299)

</comment><comment><USER17> I do hope that the Skype people see it as an opportunity to improve product rather than threat / opportunity to sue the hell out of this project. WhatsApp would not have been necessary if they had gotten their act together. But at the time they were seemingly too busy sorting out technical and political ramifications of the MS acquisition and overlap with Lync. A more open approach to clients could save it, especially in the light that people are looking for alternatives after facebook is now starting to monetize WhatsApp.

</comment><comment><USER18> "Commercial license also avaiable (sic) on request."

Seriously?

<comment><USER19> I see absolutely nothing wrong with wanting to profit from this. You're not being forced to use a commercial license, and the LGPL is adequate for most open source use cases.

<comment><USER20> Reversing in the first place is almost certainly illegal if you were to check the Skype ToS. Making a profit off it is just asking for trouble. I could be wrong though.

<comment><USER21> I suppose it depends on where you are. IIRC some countries explicitly allow reverse engineering for interoperability. Which is arguably the case here.

(Side note: That any kind of reversing is illegal anywhere at all is by itself a testament of the sad state most legislatures are in.)

<comment><USER22> Reverse engineering yes, straight reusing of the reversed code (as the code author did in some cases, by his own admission) no.

You can't take a piece of someone's code, decompile it, use it in your own project and then claim you own a copyright on it.

</comment></comment></comment></comment></comment><comment><USER23> Developer is Efim Bushmanov, here an old interview about his first skupeopensource release: [http://www.ewdn.com/2011/06/05/ewdn-exclusive-an- interview-w...](http://www.ewdn.com/2011/06/05/ewdn-exclusive-an-interview- with-efim-bushmanov/)

</comment><comment><USER24> IANAL but author should doublr check to stay clear of trademark infringements.

<comment><USER25> They should rename it to Sky.peOple

</comment></comment><comment><USER26> I remember seeing an earlier incarnation of this around five years ago; I'm very impressed with the author's dedication to this project.

I don't know if it is still the case now, but I recall that earlier versions of Skype were quite heavily obfuscated and contained anti-debugging mechanisms. So it would have been quite an intricate reversing effort to get past these, on top of figuring out the protocol.

Over time, Microsoft has changed the Skype protocol significantly since version 5.5 so I do wonder how applicable this work is to the current crop of clients.

<comment><USER27> > I remember seeing an earlier incarnation of this around five years ago

[https://github.com/skypeopensource/skypeopensource](https://github.com/skypeopensource/skypeopensource)

<comment><USER26> The site I recall was Blogspot rather than Github: [https://web.archive.org/web/20110602182718/http://skype- open...](https://web.archive.org/web/20110602182718/http://skype-open- source.blogspot.com/)

<comment><USER28> [http://skype-open-source2.blogspot.ru/2016/09/first-in- world...](http://skype-open-source2.blogspot.ru/2016/09/first-in-world-skype- network-compatible.html)

</comment></comment></comment></comment><comment><USER29> Totally not negative on this but I'm not a Skype user so can someone please explain to me why anyone would want to go to all the effort to reverse engineer it? I get that its closed and should be open, I get that its security is in question but if you want a more secure communications platform I can't imagine Skype is the only way forward and must be reverse engineered. Why not contribute to an existing open source project?

</comment><comment><USER30> I Hope this is better than the web version of Skype: it doesn't do the only thing it is supposed to do: phone calls.

</comment><comment><USER31> Interesting.

Any code commonalities with the pidgin skypeweb plugin?

</comment><comment><USER32> Downloading before M$ lawyers get to it

<comment><USER33> IRC is leaking again...</comment></comment>


Ask HN: Could the HN model help cause an informed citizenry regarding politics? - <AUTHOR>

It's 4th of July and as I write this it looks like Lessig's MayDay PAC[0] is going to fly.  This is an exciting time that has me hopeful for the future of political participation by broader masses, and has me thinking even I could be more engaged than my usual generally voting along party lines for lack of familiarity with candidates (who can be bothered to research them all, right?).
Like I imagine for other regulars here, HN has done wonders for connecting me to so much of what's going on in the world, at least in the topics carried.  I'm wondering if some take on the model of crowd-sourced consensus of what's true/interesting/important plus community discussion could cause a genuinely informed (and even engaged) citizenry in politics, just like HN does for tech.
A thorough understanding of politics (including a wide range issues, back stories, pro-and-con arguments, voting records, who's funded by who, and so on) requires so much sifting and winnowing, and it seems like the views you have are so largely determined by which sources you draw from (for example, I as a Daily Show fan see things way differently from the Fox News watching members of my family).  This makes giving a shit hard, reduces it for many (myself included) to "too much work, can't be bothered".
In an age where well-funded PR campaigns can obscure, distort or outright bury the truth, I get excited to think of a source in which truth, thoughtful essays, and important stories bubble up to prominence in the very democratized[1] manner in which they do here on HN.  Doubly so as we enter a mid-term election cycle: to tune into what matters as crowd-chosen by a mindful community who dukes it out in the comment section seems like a much better way to keep informed and play a part.
Does anyone feel the same?  Does such a thing exist?  Anyone wanna build it if not? :)
[0] https://mayday.us/ [1] Read: hard to hijack. <comment><USER3> No.

If you (being sufficiently motivated to read here and write this query) are still voting along party lines, why do you think it would change anything among your Daily Show / Fox News watching family.

So you make a site, and the first article says this: "Raising the minimum wage helps working families and is good for the economy." and the second article says this: "Raising the minimum wage destroys jobs and is bad for the economy." What, exactly, has been accomplished?

You can go find countless examples of such articles on the 'net already - <USER2> for the reading. And most still vote along party lines.

I frequently read articles that argue a different position than the one I hold. They're occasionally interesting, but rarely even make me think, much less change my mind.

If you want to improve politics here in the US, it appears the only solution is some form of balkanization ... not another useless website.

And even if MayDay PAC does "fly", all that really means is that they got some crowdsourced money - this does not mean they will have any influence at all on US elections. Color me skeptical. Perhaps they will, but worrying only about how campaigns are financed strikes me as rearranging the deck chairs on the titanic - it's debatable whether that is even in the top ten of our list of dire problems.

</comment><comment><USER4> A big part of the problem is the limited choice of issues that come up and how they are framed.

For instance, "pro-family" organizations oppose abortion, but don't oppose any of the many social changes that destroy families, such as divorce.

Organized feminism, such as NOW, sticks to "pro-choice" as the only "pro- women" policy that their members can agree upon.

So long as an irreconcilable issue like this exists, politicians don't need to talk about anything else.

Republicans back the Keystone XL pipeline because it proves they are "good for business" and the democrats are not.

Democrats oppose the Keystone XL pipeline because it prove they are "good for the environment" and the republicans are not.

In reality, either having or not having the Keystone XL pipeline is the end of the world. But while politicians are pretending it is, they can appear "legitimate" without having to deliver anything at all in terms of promoting business or protecting the environment.</comment>


If one day you can live forever in computer - <AUTHOR> https://996.one/p/if-one-day-you-can-live-forever-in-computer <comment><USER2> Would I be any smarter than I am now? Because I'd hate to be useless and live forever.

<comment><USER3> No, you will be dead, but your twin the copy may benefit.

Also, it says "Let's not consider ethics for now, at least this virtual person can indeed do creative work 24 hours a day, which is currently irreplaceable by robots that only repeat tasks."

Humans require sleep and down time, so either you edit the virtual human copy into something else, or it too will need the down time.

Other things to think about, who owns the computer? Who runs the computer? Who maintains the computer?</comment></comment>


May's call for more control of internet misleading and misguided - <AUTHOR> https://www.irishtimes.com/business/technology/may-s-call-for-more-control-of-internet-misleading-and-misguided-1.3107695 <comment><USER2> A lot of discussion from the earlier Independent article here

[https://news.ycombinator.com/item?id=14480758](https://news.ycombinator.com/item?id=14480758)

</comment><comment><USER2> Another related article here

[https://news.ycombinator.com/item?id=14483350](https://news.ycombinator.com/item?id=14483350)</comment>


Accessing GMail through Python - <AUTHOR> http://users.physik.fu-berlin.de/~mgoerz/blog/2009/11/accessing-gmail-through-python/

<comment><USER2> This reminds me of a problem I've been wanting to solve for a long time.

A lot of web apps use email to deliver notifications and other data like reports. I want to take these emails and process them whenever a new email arrives. A few qualifications: _The email server and the processing server are separate._ Need to access any attached files as well as the message body and other headers. *Ideally, I don't want to deal with any email related libraries at all i.e. want to use something like a Rest API or even FTP (like in the libgmail library linked to in this post). This would make it usable from any language without needing a special email library.

Example Use Case: Your web analytics software sends you a daily report with an attached CSV file. You want to grab the data from the CSV and put it in a database so you can create a nice dashboard for your site.

Would love to hear from anyone that has had experience with a system like this and could point me in the right direction.

<comment><USER3> Selectively forward the email to an account connected to Google App Engine: [http://code.google.com/appengine/docs/python/mail/receivingm...](http://code.google.com/appengine/docs/python/mail/receivingmail.html)

Then you can write a handler that basically treats the email as if it had been a web request. (This amazing new feature was just added about a month ago!)

Let me know how it went.

<comment><USER2> Thanks. This does look amazing. I'll try it out and post my results back here. Interested to hear what kind of things you you or others use it for. It really gets you thinking about new possibilities.

</comment></comment></comment><comment><USER4> For a hacker, what is the compelling reason to even use gmail? The web interface? Isn't there a way to run your own email server with a web interface?

<comment><USER5> Amount of time saved using an existing, established service like Gmail versus running your own and fighting the never-ending fight with spam.

You can take that free time to hack something up ;-)

<comment><USER6> the gmail spam filter is one of the best i've seen ... they have a far larger corpus of training data than any individual hacker could ever access ;)</comment></comment></comment>


Writing code with A.I - <AUTHOR> https://crane.ai/ <comment><USER2> This is pretty interesting, what languages does it use?</comment>


Classic Sega Rally Arcade machine meets RC cars using Arduinos - <AUTHOR> http://www.artica.cc/blog/2012/11/21/segarallychampionship/ <comment><USER2> Amazing. Anybody want to get together and build a full-on robot arcade? I can see this being the future of 'virtual reality' gaming -- reality from a non- human perspective.

Battling drone fleets, tiny warhammer-style robots causing real destruction on a miniature scale, high-speed chases through scale sized representations of real-life courses...

Alas like so many good ideas, perhaps this is already happening somewhere...

<comment><AUTHOR> Hey! And you'll always get the physics engine built-in for free! :-P

</comment></comment><comment><USER3> I used to love Sega Rally. The amount of cash I dropped down those machines while racing friends. I think my ultimate games room would have a Sega Rally machine in the corner.

</comment><comment><USER4> Weirdly, I did a project like this at uni, except we used an Xbox 360 controller to control the car, and I think more interestingly, we used MiWi (PIC chip wireless subset) to communicate with the car.

Whereas other teams sent a packet every time they did an "update" (they were using keyboard not 360 controllers), this meant there was a lot of lag as the link was limited to 500 bytes/sec, and sending a package irregularly meant lots of overhead.

What I did instead was I engineered it so we constantly sent (and received) a packet 40x a second, and this meant our updates were far less laggy and much more consistent. We just had a couple of bytes for the steering, a couple of bytes for the acceleration, and some other "flag" bits to determine what data should be sent back (reading off all the sensors at once leads to blocking).

We also had an accelerometer in the RC car, which I mapped (roughly) onto the 360 pad's force feedback, so you could "feel" what the RC was feeling.

The fact that we used miwi meant that we could control the thing over IP which was cool.

Great fun, we won too! I'm just sad that because our code was in a Dropbox shared folder, some idiot has deleted it.

</comment><comment><USER5> That's very cool, and I'm surprised RC cars aren't being used in more Arduino projects. I wish it actually was a detailed post, because I'd love to learn more about the Arduino setup in there -- if he's using the Motor shield, how the batteries are hooked up, etc. And how much did the materials cost -- xbee radios are around $100 each I believe...

<comment><USER6> xbee radios are ~20$ although there are some more expensive ones if you need 40 mile range.

<comment><USER5> The only ones I've been able to find are around $100~$300.

<comment><USER7> Some kits may be over the $100 mark, but individual radios are usually in the $20-$30 mark.

[https://www.sparkfun.com/search/results?term=xbee&what=p...](https://www.sparkfun.com/search/results?term=xbee&what=products)

[https://www.adafruit.com/index.php?main_page=adasearch&q...](https://www.adafruit.com/index.php?main_page=adasearch&q=xbee)

</comment></comment></comment></comment><comment><USER8> It's really wonderful to start to see this wave of Arduino, Raspberry Pi, and other super inexpensive but plenty powerful enough for a range of applications type devices.

More and more are popping up on Reddit and HN every day and it looks to be ushering a little hobbyist "golden age". I can't wait to see where it takes us.

<comment><USER9> It's not that wonderful; because the Arduino and Raspberry Pi are so popular they keep getting used for projects which they're really not the best choice for like this one. Pretty much any old PC would've been able to drive the original arcade monitors, but because the Pi can't they wound up having to rip them out and replace them with TVs that are probably of worse quality, losing some of the original feel of the machine in the process. (Even if the Pi had a VGA out it still wouldn't work because the Pi has a closed source graphics driver that doesn't allow you to set non-standard modes.)

Sadly driving stuff off old PCs isn't nearly as fashionable as the Raspberry Pi.

<comment><USER10> An old PC consumes about 90W of power, a Raspberry Pi consumes 2.5W. That's a _36x_ difference. And you would still need something to interface the PC with the rest of the electronics, just as you need something to interface the Raspberry Pi's video output with these "non-standard" CRTs.

As for the quality of TVs... these were showing video from the cars transmitted over RF, hardly high-quality. And you overestimate the quality of CRTs in arcade machines... Most of the arcades on display had not-so-good CRTs (either by design or because of years of burn-in).

</comment></comment></comment><comment><USER11> Very impressive! There does seem to be quite a bit of lag between the steering movements and the rc car response.

<comment><USER12> I tested the machine at Codebits and I had that same first impression. But after a while I got it: it was the pedal tuning and not some communication delay.</comment></comment>


A weekly newsletter about security - <AUTHOR> https://securitynewsletter.co/ <comment><AUTHOR> Disclaimer: this is a self-post. I started this newsletter a few weeks ago, because I had a hard time finding existing ones that I liked. I thought I'd share it here for those interested. Feedback welcome.</comment>


Deep Learning in Clojure from Scratch to GPU: Weight Decay - <AUTHOR> https://dragan.rocks/articles/19/Deep-Learning-in-Clojure-From-Scratch-to-GPU-15-Weight-Decay <comment><AUTHOR> Based on an open source library Neanderthal:

[https://neanderthal.uncomplicate.org](https://neanderthal.uncomplicate.org)

[https://github.com/uncomplicate/neanderthal](https://github.com/uncomplicate/neanderthal)</comment>


Strange sun phenomenon recorded in Nigeria [video] - <AUTHOR> https://m.lindaikejisblog.com/2017/10/virgin-mary-reportedly-appears-in-benin-city-during-the-national-marian-congress-video.html <comment><USER2> There is an interesting comment in this page:

 _" Well, the issue is that the headlines doesn't actually portray what happened. Mary didn't appear it was just signs that signified her presence. While people were adoring Lord God almighty the sun started to display different colours from blue to white, red and green."_

In this context, one might find interesting that there were also strange colors the same day in western Europe skies, because of Sahara sands in upper atmosphere.

</comment><comment><USER3> What did I just saw?</comment>


Nerd Merit Badges: 01 - Contribute to an Open Source Project - <AUTHOR> http://nerdmeritbadges.com/

<comment><USER2> I think this is a lovely idea!

Ok, bit of a tangent, but I was discussing this the other day with a friend...

Sometime around the late 70's/early 80's something happened in America. People started working longer hours, watching more TV, and generally socializing less. Membership in the Elks, Scouts, Rotary Club, Shriners, Knights of Columbus, etc., etc. all declined. The statistic that I think sums it up the best is this: The average number of picnics attended by Americans has dropped 60% since 1975!

What does this have to do with anything? Well, it used to be that social groups formed primarily based on proximity, and secondarily based on similar interests. What I see happening now, with social networks and such, is that being flipped on it's head a bit. Still, I think we're beginning to see an upswing in the picnic rate, as it were. (The Obama campaign was, I think, a potent indicator of this...)

This is one of the reasons that I love GitHub so much. Forget the git vs. hg vs. bzr vs. etc arguments. GitHub is a coder's social network! It seems only natural that someone should start formally organizing around this idea...

(also, see Zed's <http://freehackersunion.org/> for more of the same idea)

<comment><USER3> It sounds like your friend may have heard of and/or read this book: "Bowling Alone: The Collapse and Revival of American Community". It's on my ever- growing to-read queue.

"In a groundbreaking book based on vast new data, Putnam shows how we have become increasingly disconnected from family, friends, neighbors, and our democratic structures-- and how we may reconnect.

Putnam warns that our stock of social capital - the very fabric of our connections with each other, has plummeted, impoverishing our lives and communities.

Putnam draws on evidence including nearly 500,000 interviews over the last quarter century to show that we sign fewer petitions, belong to fewer organizations that meet, know our neighbors less, meet with friends less frequently, and even socialize with our families less often. We're even bowling alone. More Americans are bowling than ever before, but they are not bowling in leagues."

<http://www.bowlingalone.com/>

</comment></comment><comment><USER4> I'm an avid scouter (currently an assistant scoutmaster for a troop in Arizona) and I'd been trying to think of some iteration of "Hacker scouts" that would make sense. I think this is a great -launch the simplest thing that works and iterate- way to go about it.

It would be interesting to have levels of badges so level one is getting a commit, level three might be hit X downloads or something like that.

Also, I'm going to go try to propose "Make asteroids in scratch" as badge number two.

</comment><comment><AUTHOR> I realize this may come across as an advertisement, but I'm not affiliated with them. I just thought it was a clever idea.

<comment><USER5> I agree. Very clever, but I don't particularly understand why they chose a cat for open source projects. Someone care to fill me in?

<comment><AUTHOR> It's the GitHub.com logo. And it's an Octocat ;)

</comment></comment></comment><comment><USER6> You've overlooked an important detail: how will I manage to look nerdy while wearing a _sash?_

</comment><comment><USER7> There should be a vendor / company neutral symbol.

<comment><USER8> You're right, there probably should, but we just liked the octocat. It's friendly, it's dripping, it's an abomination against nature.

Just so we don't seem like we're spamming the board, I'll add: * We're VERY interested in "buffs" and levels. Girl scout badges sometimes have little gold doohickeys that attach to a main badge with a chain. We think that would be cool. Also, we think that meaningful border-colors would be awesome. So far, we're thinking of black-bordered DEmerit badges: "Destroyed non-backed-up data." God, I've earned that one.

Your suggestions are absolutely welcomed. Twitter us at @nerdmeritbadges. Right now, we're working on the Regular Expressions merit badge.

Oh, and the best place for a sash? Your laptop lid, naturally! :)

<comment><USER9> What about a kernel hacker badge? For getting a patch accepted into an open source operating system kernel. One step up from the OSS badge.

</comment></comment></comment><comment><USER10> This reminds me of [http://www.scq.ubc.ca/order-of-the-science-scouts-of- exempla...](http://www.scq.ubc.ca/order-of-the-science-scouts-of-exemplary- repute-and-above-average-physique/)

</comment><comment><USER11> I love Github as much as the next rails nerd, but they need to improve public project discovery. There is no pagination on the projects when you sort by followers, this is a huge error they need to fix.

</comment><comment><USER12> If this is 01 what is 00? Learning to count with arrays?

</comment><comment><USER13> What is the picture on the badge?

<comment><USER2> Octocat!

(see: <http://github.com>)</comment></comment>


Ask HN: Good ways to find local talent in small town? - <AUTHOR>

We're in Northern California about three hours outside San Francisco in the Sierra Foothills. I think overall this proximity to the Bay Area is a positive thing, but sometimes I get the feeling it creates a bit of a talent vacuum. The best of the best end up in the Bay Area, and because this area isn't terribly exciting most young people end up leaving when they finish high school anyway.<p>I'm curious if anyone else is in a similar situation and has any ideas. We've tried recruiters, Craig's List, and even help run a local tech group for some outreach. We've also experimented with remote team members with varying results. For now we're focused on finding someone local. Any other ideas or guidance? <comment><USER2> I once read an interesting solution to this specific problem on the old Joel on Software forum. In addition to offering a competitive salary for people to work at an odd location, you could offer a relocation bonus for people to leave. This assuages a large concern that some folks might have: that they'd love to work at your company, but if things go sour, they'd be stuck in Pigs Knuckle, Arkansas without any other job opportunities. I'm sure there are wrinkles to iron out, but that would directly target a mostly unrealized objection to relocating to a less desirable area.

<comment><USER3> "Stuck in Lodi again."

I don't remember who wrote this but an artist once wrote "If I was going to get out of Lodi I was going to have to paint my way out."

</comment></comment><comment><USER4> > For now we're focused on finding someone local. Any other ideas or guidance?

Read up on Growing Your Own Talent. Your looking for diamonds in the rough-- young, non-degreed types, with a mix of attitude, aptitude, and potential. Create a learning program with a solid growth path. Build-in the costs to pay them during this process. Everywhere you go, be on the look out for the kid who hustles, works hard, and demonstrates good people skills. Network with local Educators, Coaches, Religious leaders for referrals. Here's an Inc article on the subject> [http://www.inc.com/jeff-haden/talent-grow-your-own- or-hire-f...](http://www.inc.com/jeff-haden/talent-grow-your-own-or-hire-from- outside.html)

<comment><AUTHOR> Thanks for this great idea. I will be reaching out to the local community college today and may follow up with the local high school as well.

</comment></comment><comment><USER5> I once spent a long day interviewing in Lufkin Texas for a job in College Station. At some point someone observed, "Nobody moves to Lufkin unless their from Lufkin." I wasn't the best of the best, but I was good enough that they paid my way out for the interview, and when they didn't offer me the job in College Station but one in Lufkin instead, the observation was in fact astute.

If the young are leaving, I'd suggest focusing on finding someone older who is more amenable to the lifestyle. If there aren't any old developers locally, then there won't be any really good young one's. But you might get an older developer to relocate to a place without any action.

Good luck.

<comment><AUTHOR> Thanks very much for the insight. This is definitely the approach we've taken up until now. Average age in our group is right around 40 and we're all family people who love the area and lifestyle it affords. The age thing isn't really the issue, just the number of applicants with relevant skills applying. I know they are around, maybe just a little more entrenched in their current roles. It is a lot of older people around, and I think because of that a lot of them (us) are already in a long term role or have moved on to consulting/contracting.

<comment><USER5> One strategy: Figure out what would entice your team to move from their entrenched roles, then figure out a way to offer that...both to your current staff and to prospective candidates.

Another is just to identify a local you want to bring on board and do what it takes to land that person.

As an aside, if you are doing remote, Scott Hanselman's 30 tips have some ideas if you have not seen them: [http://www.hanselman.com/blog/30TipsForSuccessfulCommunicati...](http://www.hanselman.com/blog/30TipsForSuccessfulCommunicationAsARemoteWorker.aspx)

</comment></comment></comment><comment><USER6> I'm in the Calif. Foothills, I usually find most things on Craigslist,or the CA Jobs site.

Either you must not be near me, or it isn't the technologies I'm interested in, or I wans't what you were looking for.

I can offer that up in the hills you aren't going to have a diverse skills environment. Either you will get some home-grown techs (like me), not very many of them, they usually move to SV or somewhere more tech friendly; or transplants from other places. So the more specific you are in what you want the less chance of finding talent. If you are willing to entertain other skillsets (if you are locked-in, maybe add in training option for highly skilled people in other platforms) you might have better luck.

Good luck

<comment><AUTHOR> Thanks for the reply! We've done just this with our most recent hire. He had a lot of relevant experience but with a totally different tech stack. In the end we decided we'd rather have someone who has been there and done that with different tools than someone who has less overall experience but more comfort with our current setup. So far it looks like it has been a good decision!

We're in Nevada County building SAAS web and mobile apps. How about you?

<comment><USER6> Calaveras County, 90 Miles south.

Working on a better community directory and more web-app ( doplaces.com ), other than that spent the past couple decades working on applications for a non-profit (data collection, management and reporting) so developing an architecture (wouldn't call it a framework) along those lines; SAAS is something I've been thinking of - more for managing more wide-ranging distributed updates. you can see a few of the things I mess with at larrymade.com and portcommodore.com

</comment></comment></comment><comment><USER7> Lot of unanswered questions:

How do other employers (not necessarily tech) motivate candidates to move there? Any natural attractions? Lots of outdoorsy people move to places like Colorado, Montana, Wyoming for hiking, camping, etc.

Is your salary competitive? If it's high compared to the cost of living, do you demonstrate that?

Is this just a job or a genuine opportunity? If the latter, how are you demonstrating that?

If it's really just a job (and that's OK), I'd figure out how to make remote developers work out. You have a lot of developers who already live in small towns with low cost of living, but it's _their_ town and they don't want to move to yours. If you can leverage that, it's a win/win.

<comment><AUTHOR> Thanks for the response. To be honest I am fairly new on the hiring side of things and also relatively new to this specific part of the area. I don't have a solid response to most of your questions. Tech salaries seem to be all over the place. I would say given our location, job requirements, and company culture the salary range we offer is very competitive. That hasn't been an issue with anyone we've talked with yet. Being so close to SV does confuse things sometimes though.

I'm not sure I fully understand the difference between a job and a genuine opportunity. With a small team every member has a pretty large say in how things are done so everyone has the potential to really make a difference. It's definitely more than just getting work put in front of you. On the money side this is a mature bootstrapped company, so someone looking to gamble on stock options probably wouldn't be interested.

The area is generally pretty desirable. Beautiful surroundings, nice weather, lots of options for schools, interesting history, lots of great local food, relatively decent music scene, close to hiking, biking, skiing, rivers, and Tahoe. This is actually an area where a lot of tech people retire or semi- retire and open a satellite office. There's a lot of cool tech history with the Atari 2600 and a lot of broadcast video equipment being invented here. Not nearly as much web or software history though.

I've had a lot of this on my mind but I don't know I've done a very good job of communicating in any of our listings. We may try remote again, but will probably give local a little longer before we go that route. Thanks again, clearly this has me thinking and I'm hoping it will improve our future listings.

<comment><USER7> Yes, a lot of this will be internal and external polling/analysis to determine what's great about your company, position, and location and use that effectively in advertising and outreach.

Job vs. opportunity: it's about growth. You know the old saw about 5 years experience vs 1 year 5 times over. Good developers avoid the latter, so you have to show a clear path to growth. Isn't that what you wanted?

Good job descriptions are hard to write, but Lever does a good job with them. I recommend looking at theirs for inspiration: [https://lever.co/jobs.html](https://lever.co/jobs.html)

Also, I'm sure you didn't want to look like you were trying to get free advertising here, but it would have been helpful to get links to your company and jobs for reference.

</comment></comment></comment><comment><USER3> Mail your homepage to email@example.com and I'll give you an entry at [http://www.warplife.com/jobs/computer/](http://www.warplife.com/jobs/computer/)

No charge, no time limit.

<comment><AUTHOR> Sent! Thanks very much!</comment></comment>


Why your New Year's Resolution has already failed. - <AUTHOR> http://kanebennett.wordpress.com/2011/01/07/why-your-new-years-resolution-has-already-failed/

<comment><USER2> A good post. Terse, to the point. It's true, most people have a hard time just starting, though many fail to see that even the smallest movement would bring you closer to your goal. Thanks for the post!

</comment><comment><AUTHOR> I'd love to hear your thoughts on the post, and on my blog in general!

<comment><USER3> Humorous. Well written but a bit content light(This post anyway). The rest of the blog seems to be just as well written but sort of hit and miss as far as my attention goes.

Personally I believe that new years resolutions fail because they are new years resolutions. If it was something you were actually willing to do you would have started it before new year's day. That is to say making it a new years resolution makes is a delaying tactic for something you have no intention of doing anyway. I guess that goes back to your get started now point.</comment></comment>


Rspected HN-"Who's hiring" posters - <AUTHOR>

With the same token that you (the OP of "Dear HN "Who's Hiring" responders"...likewise other posters) say HN hiring-thread is not a CraigsList , when an HN-responder puts an effort in going through their product and writing a personal note inquiring about a possible opportunity at their company, posters should take a minute to respond to the responder acknowledging that in-spite of their good/bad profile they can't hire him/her.
I am a graduating student who have applied to many startups that interested me with a personal-note and list of projects I have done with clickable-links. While about 10% of posters responded saying that they did like my profile but can't take it further because of visa, remaining 90% never responded.
While I am not the best engineer, when my detailed and clear personal application doesn't get an acknowledgement reply, I can imagine why responders are just sending one-liners. If posters want to hire, they will hire from one-liners. No point of detailed-personal application.The loss is on both of us.
I know these two advices are from me to you and you to me. All the remaining folks who have been one-liners will continue to be so. <comment><USER2> Just a suggestion -perhaps feature other projects on your résumé besides hacking your school network. Many companies may not appreciate hacking their network, movie or music pirating. Even though it may have been a creative solution, it might not be best to present yourself with a potentially controversial project.

If you were looking for work in a security-related field it might be helpful, though.

<comment><AUTHOR> Thanks for the insight :)

It's a project I am really proud of. I will try to repharse it.

<comment><USER2> You could just write that you created a music sharing solution over SSH, or whatever description is best. Then leave out the part about circumventing the school security ;-)

</comment></comment></comment><comment><AUTHOR> On a side note, my profile with links to projects is <https://gist.github.com/sravfeyn/13534c67812183235a2c/> . I am hunting for an engineering position at a start-up with product-innovation.</comment>


Fake moos: Plant-based meat could create a radically different food chain - <AUTHOR> https://www.economist.com/international/2019/10/12/plant-based-meat-could-create-a-radically-different-food-chain <comment><USER2> "plant-based" implies there is NO meat. The title makes no sense ¯\\_(ツ)_/¯</comment>


William Gibson's cyberpunk classic 'Neuromancer' may finally get to screens - <AUTHOR> http://latimesblogs.latimes.com/jacketcopy/2011/05/william-gibsons-cyberpunk-classic-neuromancer-may-finally-get-to-screens.html <comment><USER2> It's almost certainly too much to hope for, but my impossible dream is that this gets done up like it's the 1980s with circa-2012 CGI. A bold kind of retrofuturism we haven't seen yet in film.

Thing is, you can't take Neuromancer out of the '80s. The newness of computer networks, the ascendancy of Japan, the _aesthetics_ of computer hardware -- boxy, whirring things with stark, green CRTs spewing masses of indecipherable alphanumeric incantations, big clunky cables, heavy briefcase-size mobile units; it's all there. And the mash-up of digital and analog technologies is no less integral than Gibson's opening lines to the book, comparing a halogen- hazed night sky to the analog noise of TV transmission.

Neuromancer didn't arrive into a world comfortable with computer technology like ours today. The book stands as a fantastic trip back into a time when technology could be dark, dangerous, and foreign, a zeitgeist Gibson leverages to dazzling effect. "Updating" Neuromancer would bring its entire shadowy world out into the unthreatening, mid-day sun.

<comment><USER3> Gibson has apologized several times, and notably in the preface to the 25 year anniversary edition of _Neuromancer_, for the utter lack of cell phones.

In an earlier interview he mentioned the scene with Case walking down the length of a row of pay phones, each ringing exactly once as he passes, as one of the first things he wanted to write for the book. I don't remember the last time I saw a row of phones in the U.S.

<comment><USER4> You could have the phones belonging to passers-by ring instead, might even make the scary location tracking stuff more obvious?

<comment><USER5> Part of the "spookiness" was that he was so easily found. Not so easy in the 80s. Nowadays? Meh.

</comment></comment></comment></comment><comment><USER6> After Johnny Mnemonic, I'm kinda shocked that he'd allow this. Granted film effects have come a long way, but it'll take a hell of a screen writer and director to bring that to the screen.

Edit: Guess the point is, even if it is really good, I'm not sure it could live up to expectations.

<comment><USER7> On top of that, can you imagine how tiresome the repeated "what a Matrix rip- off" claims are going to be?

<comment><USER8> The sad thing is you're most likely right :-(

<comment><USER9> It will however give an opportunity for Eldernerds to post a link to this:

<http://www.penny-arcade.com/comic/2006/04/10/>

</comment></comment></comment></comment><comment><USER3> Probably too complex to make it to the screen even remotely intact.

When I read it (in one evening, quite a rush) I remember thinking that Molly was kind of cool, as I imagined her. A few years later I saw a Neuromancer comic book, and her glasses made her look freaky and insectoid. Maybe a different artist would have done a better job . . . but some things just don't translate to the screen.

<comment><USER10> It will probably come out similar to Aeon Flux meets swordfish

<comment><USER11> This is a very plausible prediction. I don't like it. Frankly, more than a little bit of me hopes that this gets bogged down in development hell. If it comes out, I'll go see it, but I can't imagine it living up to the book.

</comment></comment></comment><comment><USER12> I'm getting old, because Hollywood has let me down so many times that I no longer have even a hint of hope for this movie. It will take Los Angeles execs about fifteen minutes to start pushing Jaden Smith, likable characters, a happy ending, Natalie f-ing Portman, and product placements.

</comment><comment><USER13> I'd prefer if they did Snow Crash. That book was fantastic!

<comment><USER14> First 2/3 of the book -- very good.

Ridiculously weak ending, though.

<comment><USER15> Amen.

Neal Stephenson develops excellent worlds, creates characters that draw emotion out of readers, and then the endings fizzle. Every single time.

<comment><USER16> But but but... Zodiac!

</comment></comment></comment></comment><comment><USER17> The only person I'd really been excited about directing Neuromancer was Chris Cunningham[1], but that fell through for reasons unknown.

[1] [https://secure.wikimedia.org/wikipedia/en/wiki/Chris_Cunning...](https://secure.wikimedia.org/wikipedia/en/wiki/Chris_Cunningham)

<comment><USER18> I would have been quite excited if Stanley Kubrick had directed it.

One of the few directors that could take a masterpiece of a book, and make an even better film from it.

</comment></comment><comment><USER9> I remember reading a bootleg draft of Gibson's screenplay a while back and thinking "this is terrible".

What I remember about _Neuromancer_ was that after my first reading I thought "wow, that was cool". But it took a few more re-readings to work out, with any confidence, what in blazes was actually going on.

That said, with careful pruning and a big budget for effects, I think it could work on the big screen. I just hope they stay true to the 80s cyberpunk vibe.

</comment><comment><USER19> Neuromancer and Chernobyl are intertwined for me, probably because I remember talking about it to a colleague one day when the fallout may have been drifting over the UK. Awesome book, I'd read it again but I doubt it would live up to my memories.

On the subject of adaptations, many years ago I bought a Neuromancer graphic novel which was entitled part 1. I have never seen the others, did I miss them?, do I have a rarity?

</comment><comment><USER20> I can't wait to see this movie and then complain about it on the Internet!

</comment><comment><USER21> This has been bugging me since I read the book: Does anyone know what could be the secret name, three syllables that 3Jane speaks as a password?

<comment><USER22> I believe gibson has likened it to a bird call -- just 3 syllables of noise, not words.

</comment></comment><comment><USER23> If you love _Neuromancer_ , I think you should read James Tiptree Jr.'s (actually Alice Sheldon) short story _The Girl Who Was Plugged In_ (<http://en.wikipedia.org/wiki/The_Girl_Who_Was_Plugged_In>), which Gibson said he was influenced by.

Tiptree is pure genius!

</comment><comment><USER24> Curious that the article states both "Vincenzo Natali will direct the film" and "Visual-effects work already has begun."

Don't mean to be pedantic, but it implies art direction has commenced prior to the director actually starting, which surely must be inaccurate. (Enjoyed Natali's Cube.)

</comment><comment><USER25> I think they should go for an intentionally retro feel to keep true to the style and the origins of the book. If they set it in the "modern" conception of the future, it would seem as incongruous as the Atlas Shrugged film featuring modern day railroad magnates.

</comment><comment><USER26> I found the original ad that has had me waiting for the theatrical release for the past two decades.

<http://www.flickr.com/photos/thwarted/5742024292/>

Jan 1989. "Soon to be a major motion picture".

</comment><comment><USER17> BBC Radio 4 produced a two-part radio adaptation of Neuromancer around the turn of the century. It's pretty good, if (understandably) heavily abridged. I'd not going to host it, but there are torrents around if you Google.

</comment><comment><USER27> This could be a beautiful film if done by a small production house without a lot of interference "for marketing purposes" and if it limits the use of CGI to internal representations of the matrix.

</comment><comment><USER28> If it happens I'll watch it, but only because of my william gibson fanboy loyalty. My first thought when I saw the headline was how bad the Dune movie turned out.

</comment><comment><USER29> I can't believe it's taken this long. I hope they do a good job of it.

</comment><comment><USER30> Let's hope it is as good as Johnny Mnemonic

no, wait, that movie really sucked</comment>


HackerNews (and jasonlbaptiste) on The Economist - <AUTHOR> http://www.economist.com/blogs/freeexchange/2010/04/opportunity_costs <comment><USER2> "But without those white earbuds, how would you have signalled your trendiness?"

I know this is tongue-in-cheek, but I'm a bit tired of comments like this, implying that Apple is successful mostly because people are blindly buying its products to be "in" and signal how cool they are.

<comment><USER3> That's very true. They make great products that are very well thought of down to the last pixel-perfect detail. They draw on many years of experience and hard work to make the products they do.

<comment><USER4> I was made acutely aware of this the other day when out with my girlfriend to pick up: a replacement iPod for her and a cordless phone. After playing with an iPod nano for a couple of minutes while settling on colour/features etc, we then went to look at the cordless phones...

The contrast in design choice just left me depressed. All the phones were crappy, ugly things, with user interfaces that were just awful. Maybe they had really good features but I didn't care, because it looked to me as though the designers didn't care about their product. And this was something I was going to bring into my home and use everyday!

The whole experience left me bummed. I left with just the iPod.

<comment><USER5> You do realise your story essentially supports the notion that your purchase was based on fashion and signalling right? I mean "Maybe they had really good features but I didn't care" actually typifies my view of an Apple fan.

<comment><USER3> No, it was based on product quality, not fashion. There's a huge difference between the two.

<comment><USER5> "Product quality" that doesn't relate to functionality is fashion in my view. Think about it.

</comment></comment></comment></comment></comment></comment><comment><USER6> I've always loved using this quote to give perspective to how much Apple's grown.

<comment><USER7> How did this comment end up on The Economist?

<comment><USER6> i have absolutely no clue. i was browsing hn as normal and saw my name on the front page, so I did a double take thinking i was on a comment/threads page.

</comment></comment></comment><comment><USER8> if i could go back in time and cherrypick what to invest in, no shit i'd be rich!

</comment><comment><USER9> What on earth does this have to do with hacker news?

EDIT: what I meant is: The title says hacker news on the economist, yet the page has no mention of hacker news anywhere. A better title might be: it is smart to invest in good stock.

<comment><USER10> At the top it says _"JASON BAPTISTE notes:"_

If you click on 'notes' it links to the comment on HN

<comment><USER11> I, for one, welcome our new hypermedia overlords.

</comment></comment></comment><comment><USER3> _"The site is currently not available due to technical problems. Please try again later. Thank you for your understanding."_

:-(

<comment><USER12> _Guru Meditation: XID: 294194655_

Classy hat-tip to Amiga.

<comment><USER13> From Varnish Cache.</comment></comment></comment>


What Is an API and How Does It Work? - Bella-Xiang https://towardsdatascience.com/what-is-an-api-and-how-does-it-work-1dccd7a8219e <comment> Bella-Xiang Such a plain and comprehensive explanation really makes the API be understand easily.</comment>


Some analysis of the 1M most popular sites on the web - <AUTHOR> http://jacquesmattheij.com/one-million-websites <comment><USER3> Likely culprits are "performance analyzers" that grade a website and report an "F" (failing) grade for not using CDN-hosted common libraries.

This is a red herring: this idea that the user will already have a cached copy of CDN-hosted jQuery is bogus. Even for a common library like jQuery: the number of versions of jQuery that are in use is likely above 50, and the number of popular CDNs that host jQuery is surely above 10. So we are hoping that the user will have a cached copy of that exact jQuery version from that exact CDN.

This is somewhat similar to the situation we have with operating systems: we created shared libraries to save disk space and memory. These days using them is pretty much pointless and incurs a performance penalty, yet everybody still uses them.

For JavaScript, a much better approach is to a) make code Google Closure- compatible, b) compile everything using advanced mode into a single JavaScript file. That way you get an optimized subset of all the code that the site _actually uses_ (this works wonders for ClojureScript apps). Most sites probably use less than 10% of jQuery, so why include all of it?

<comment><USER4> > These days using them is pretty much pointless and incurs a performance > penalty, yet everybody still uses them.

Would you rather than when (e.g.) there is a security patch for OpenSSL, that you have to wait for _all_ software using OpenSSL to deploy updates? Or would you rather that one update to OpenSSL (likely from your OS vendor) fixes all of the software depending on it?

Edit: People seem to be commenting to this through the lense of CDNs and JavaScript, but the sentence previous to the one I quoted was:

> This is somewhat similar to the situation we have with operating systems: we > created shared libraries to save disk space and memory.

Which is _not_ talking about CDNs and JavaScript, but shared libraries on your desktop. I'm not saying that all usage of shared libraries is valid. I'm just saying that to toss out the concept as entirely useless (and having no redeeming value) in a modern setting varies from the truth.

<comment><USER5> Google doesn't back-port fixes to JQuery.

You _can_ link without specifying the version number, but then you don't get full caching, so it's not common in practice.

<comment><USER6> You get pretty close to full caching... often better than using your own copy. The reason it isn't a common practice is more about potential bugs caused by newer versions.

</comment></comment></comment></comment><comment><USER7> I wonder what's considered external though. If I compile / minify my javascript and CSS and then use a CDN to cache or host it -- is this considered external?? If so, how is it different from trusting my hosting provider to host my site in the first place, or my domain provider for resolving for me? How can this analysis know whether or not the resource is external? based on dns records alone? because I can still use *.my-domain.com but point it to an external resource...

The concerns raised are valid, but I'd like to see the methodology for analyzing the data because it can definitely skew results.

<comment><AUTHOR> If the url used to fetch the file is not related to the domain the original html comes from then that would be counted as external.

You can point *.my-domain.com to an external resource but it would see that resource as still under your control.

I will post the code soon.

<comment><USER8> It is pretty standard practice to host assets on a "cookieless" domain you control, but _not_ on the same domain as the original site. For example, www.example.com has all the html, but all of the images are hosted at www.images-example.com. That would skew the results considerably.

<comment><USER9> Why use another domain and not a sub-domain? I assume something to do with the cookie-less comment - but not clear what?

<comment><USER8> The main reason is sometimes you have *.domain.com authentication cookies for single sign in across a suite of sites, however you do not want those authentication cookies sent to domains that do not need authentication.

</comment></comment></comment></comment></comment><comment><USER10> i have always been irked by the fact that _my bank_ and most websites behind an https connection (especially after login) have ANY external resources. this is a major flaw on numerous levels; how such a thing is still allowed by browser vendors is IMO borderline voluntary negligence. all such sites, if they must host external resources, should do so only within an iframe w/sandbox [1]. the fact that the external resource is also "https" [on some foreign property] is completely and utterly meaningless.

[1] [http://www.w3schools.com/tags/att_iframe_sandbox.asp](http://www.w3schools.com/tags/att_iframe_sandbox.asp)

<comment><AUTHOR> My bank (ABN/Amro in NL) is even worse, they not only include external resources, they include external resources that are critical for their site to function, in other words, if I disable the various trackers and analytics elements on their page the site simply no longer works. You'd expect the opposite!

<comment><USER10> wow! i think there should be a place on the internet for publicly naming and shaming such practices. like a Darwin Award or Razzies [1] of webdev.

[1] [https://en.wikipedia.org/wiki/Golden_Raspberry_Awards](https://en.wikipedia.org/wiki/Golden_Raspberry_Awards)

<comment><AUTHOR> That's one of the things I'm considering right now. To re-write the top 1000 or so with annotations and then to sort them by category as well as an example of a site that is 'clean' in the same category.

There are a ton of offenders and some of them are very well known.

One of the interesting things you find when you look at this data is that the bigger sites really do have their stuff set up better (for instance, by using in-house analytics) but there are lots and lots of exceptions and some of them are quite shocking. For instance, I've found two major car brands that include evercookies on their corporate websites in Eastern Europe, a thing that no respectable company should ever do. I suspect an ad agency is the cause of this so I'm still digging away at that.

<comment><USER11> If you want a never ending list of shocking offenders, be sure to check out most airline sites. They really are abysmal.

</comment></comment></comment></comment></comment><comment><USER12> [http://www.w3.org/TR/SRI/](http://www.w3.org/TR/SRI/)

<comment><AUTHOR> Indeed. I can't wait until that is implemented across the board. It still leaves the privacy issues.

</comment></comment><comment><USER13> One thing in this context is that it is basically impossible for a website to check the integrity of an external (js) resource without loading it. This is a consequence of the web security model.

Its basically impossible to get the contents of a .js file without executing it, say for checksum verification (at least without CORS, and even with, you might trigger an additional download, I haven't tested it). But it's trivially easy to include an external .js in the page, with the same access rights as directly embedded script (including access to credentials).

That's what we're used to, but it seems completely backwards to me. I would be much better IMO if a script could make arbitrary HTTP requests to other sites - but without having access to those sites' credentials. (Remember in the 2000s when "mashups" were all the rage? I spent a weekend parsing some data source in javascript to display it on a map, just to realize that what worked locally didn't work over http. Imagine the disappointment.)

What's also missing is a way to run an external script sandboxed, or in a sub- interpreter. There ought to be a way to restrict what banner ads or font loaders can do to my page.

<comment><USER14> Look SRI up on this very page.

Web pages can make requests to other origins (GET image, script, XHR, POST to iframe, XHR). CORS allows you to read the response. But what you're asking would probably be hard to transition the whole web to without too much spam and DOS'ing.

The sandboxing for an external script you want already is feasible with an iframe with a different origin.

</comment></comment><comment><USER15> Subresource Integrity hashes [1] should let sites get the caching and CDN benefit of using shared resources like jquery without letting 3rd parties have the ability to XSS them. Basically, you can specify a hash of what the url should point to, and if it doesn't match then the load is blocked.

This isn't quite out yet: it's in Chrome trunk [2] and still under review in Firefox [3].

[1] [https://w3c.github.io/webappsec/specs/subresourceintegrity/](https://w3c.github.io/webappsec/specs/subresourceintegrity/)

[2] [https://code.google.com/p/chromium/issues/detail?id=355467](https://code.google.com/p/chromium/issues/detail?id=355467)

[3] [https://bugzilla.mozilla.org/show_bug.cgi?id=992096](https://bugzilla.mozilla.org/show_bug.cgi?id=992096)

</comment><comment><USER16> We offload a ton of our scripts to S3 buckets on random unrelated domains and it's a pretty common practice. Did this take that into account?

<comment><AUTHOR> No, it did not. It would have to tie in the whois data to make that match (and even then it might not). The analysis is URL based, but I don't think changing that to account for those sites that use random domains to store chunks of their site would make a huge difference, but it's a valid criticism.

</comment></comment><comment><USER15> It seems like you're marking sites down for using a cookiless domain for resources, even though that's faster and no less secure? For example, you'd mark google down for referencing gstatic.com or facebook down for referencing fbcdn.com.

I realize there's no publicly available way to tell that yahoo.com and yimg.com are the same entity, but it would be good to at least note this as an issue with the analysis.

<comment><AUTHOR> I'll do so.

Edit: done.

<comment><USER15> thanks!

</comment></comment></comment><comment><USER17> I agree re not using externally-hosted Javascript. In fact I seem to remember a year ago Google Code having connectivity issues and jQuery all over the place failing to load. I was glad on that day that I always host my own jQuery.

Re tracking, I ran into this embedded in some webfonts CSS a project was using (downloaded from one of those font websites):

        /* @import must be at top of file, otherwise CSS will not work */
        @import url("//elided.example.com/count/35d82f");

        @font-face {font-family: 'Foo'; font-weight: 300; src: url('/webfonts/foo.eot');.....}

That @import returns nothing. It is just part of their tracking/licensing. And it was really slow! And I love the lying comment they included.

<comment><USER18> Well, the @import itself only works if it precedes other statements.

</comment></comment><comment><USER19> Evercookies sound terrifying. Not that I'm doing anything that I really worry about hiding, but I can't stand invasion of privacy like this.

Are there effective protections against them? If not, I wonder why the EFF hasn't taken up the charge to fight them?

<comment><USER20> Too many battles to wage for one fairly small organization

<comment><USER19> Then should the rest of us not step up? Or is it that there's no effective way to combat it without making major changes to browsers we have little control over? At the very least, someone could have a website which listed steps you can take to protect yourself.

<comment><USER21> You can get some benefits from EFF's Privacy Badger and from Mozilla's Tracking Protection feature.

[https://support.mozilla.org/en-US/kb/tracking-protection- fir...](https://support.mozilla.org/en-US/kb/tracking-protection-firefox)

[https://www.eff.org/privacybadger](https://www.eff.org/privacybadger)

Both of these tools are focused on cross-site ("third-party") tracking, rather than cross-session tracking by an individual site ("first-party"). Third-party tracking is technically easier to try to detect, and some people regard it as more intrusive.

As I mentioned upthread, EFF's own research on browser fingerprinting shows that it's hard to stop all user tracking (because your browser and OS and device might be different enough from others to be unique in a population in ways that could be observable by a remote site). Tor Browser is doing great work on this

[https://www.torproject.org/projects/torbrowser/design/#finge...](https://www.torproject.org/projects/torbrowser/design/#fingerprinting- linkability)

and I think they've made concrete progress. (I think the Tor Browser developers might say that the privacy benefits of using their changes _without Tor_ are unclear because you could also so easily be tracked by IP address. But it's possible that some of their changes will find their way into mainline Firefox, at least as options.)

</comment></comment></comment></comment><comment><USER9> So, as someone who has never really bothered with blockers of any sort, what would be the ideal blocker to install / write? (I am thinking iOS as sadly that is my primary medium these days)

\- able to prevent download of any third party hosted assets \- able to hash the above assets and allow user to approve their use (ie can approve jquery v1.5 from cdn.google.com) \- is this whitelist approach going to work? Does ghostery or similar already do this?

I vastly prefer a whitelist approach - but if 2/3 of the web will break I am at a loss ...

</comment><comment><USER22> What about services like npm that distribute code? Are these analogous or do they have additional security in place?

<comment><AUTHOR> Isn't that server side?

<comment><USER22> Yes, but the same attack could happen if an attacker gains control of an npm module. Users without tight control over their modules could unwittingly pull in malicious code.

</comment></comment></comment><comment><USER9> some relatively serious questions on the methodology:

\- how did you define third party assets vs domain-managed assets? Is anything not hosted under example.com automatically third party? What about Twitter.com and t.co? I know this one is picky but would like a feel for the figures.

\- how deep did you scrape the (million!) sites? If it's front page or similar Inwould not be surprised to see figures revised upwards significantly - <USER2> off the beaten track of even major sites the number of "let this one slide" decisions spikes a lot.

\- how long did polling a million sites take?! What was the setup you used - very interested even if it has nothing to do with methodology :-)

Thank you - you have at least made me rethink my lack of blockers

<comment><AUTHOR> I will release code + data for bootstrapping but until then here are my answers to your questions:

> how did you define third party assets vs domain-managed assets? Is anything > not hosted under example.com automatically third party? What about > Twitter.com and t.co? I know this one is picky but would like a feel for the > figures.

That's based on the hosting domain being the same or a superset of the domain that the page originally came from.

> how deep did you scrape the (million!) sites?

Just the homepage.

> If it's front page or similar Inwould not be surprised to see figures > revised upwards significantly - once off the beaten track of even major > sites the number of "let this one slide" decisions spikes a lot.

That's true.

> how long did polling a million sites take?!

20 days. About 50K sites per day which significantly cramped my ability to do other work here.

> What was the setup you used - very interested even if it has nothing to do > with methodology :-)

A simple laptop with 16G of ram and a regular (spinning) drive on a 200/20 cable connection. 40 worker threads concurrently with a simple php script to supervise the crawler and another script to do the analysis.

Most of the data was discarded right after crawling a page, only the URLS that were loaded as a result of loading the homepage were kept as well as the mime type of the result.

<comment><USER9> Thanks!

Two things leap out. Firstly I love the way you chose to do 1 million sites. I would have gone, hmm, maybe top thousand, and called it a representative sample :-) The scale of the modern world is still something I am grappling with.

Secondly, is that 200 Mbps down / 20 mbps up? I think the UK has some broadband access lessons to learn if that's true. My wet piece of string is getting threadbare.

<comment><AUTHOR> It's maybe overkill to do it on the whole set instead of just a sample, probably the numbers would not change all that much.

The 200/20 is indeed 200 Mbps down and 20 up, this little trick saturated the line pretty good though. I probably could have saved some time and bandwidth by letting phantomjs abort on image content but I was lazy.

<comment><USER9> I'm slap bang in the commuter belt round London - and broadband availability is having an actual effect on house prices and decisions to move out of the area.

It's surprisingly low on the political agenda nationwide.

I'm about to get all English Middle class over this Sinai will stop now :-)

<comment><AUTHOR> Code has been released to: [https://github.com/jacquesmattheij/remoteresources](https://github.com/jacquesmattheij/remoteresources) have fun.

</comment></comment></comment></comment></comment></comment><comment><USER23> Are modern updated browsers resilient against those "evercookies" or not so much?

To be more specific: I have my Firefox configured to delete cookies on exit. Does that deal with "evercookies"? I must admit, never heard about them before...

<comment><AUTHOR> Evercookies go a lot further than the regular cookies that you can delete per session.

</comment></comment><comment><USER24> > The request for the code contains a referring url which tells the entity > hosting the script who is visiting your pages and which pages they are > visiting (this goes for _all_ externally hosted content (fonts, images etc), > not just javascript)

This can now be mitigated thanks to Referrer Policy [0]:

"The simplest policy is No Referrer, which specifies that no referrer information is to be sent along with requests made from a particular settings object to any origin. The header will be omitted entirely."

Voilà:

      <meta name="referrer" content="no-referrer">

It's a W3C draft, but it's supported by latest FF/Chrome/Safari, _and_ Microsoft Edge [1], although currently, with Edge, you'll want to use the legacy keyword "never" instead. (AFAIK "never" works with all the aforementioned browsers.)

> Google analytics junkies in particular will have to weigh whether they feel > their users privacy is more important to them than their ability to analyze > their users movements on the site.

There's a nice alternative - Piwik [2]. It's very much like GA, but GPL and self-hosted, and with various options for privacy [3]. You can even use it without cookies, if you don't mind the somewhat reduced accuracy and functionality.

Regarding fonts from Google Fonts, it's super-easy to host them yourself. There's a nice bash script [4] that downloads the font you want in all its formats/weights and generates the proper CSS. There's also the google- webfonts-helper service [5], and Font Squirrel has a webfont generator [6].

[0] [https://w3c.github.io/webappsec/specs/referrer- policy/](https://w3c.github.io/webappsec/specs/referrer-policy/)

[1] [https://msdn.microsoft.com/en- us/library/dn904194%28v=vs.85%...](https://msdn.microsoft.com/en- us/library/dn904194%28v=vs.85%29.aspx)

[2] [https://piwik.org/](https://piwik.org/)

[3] [https://piwik.org/docs/privacy/](https://piwik.org/docs/privacy/)

[4] [https://github.com/neverpanic/google-font- download](https://github.com/neverpanic/google-font-download)

[5] [https://github.com/majodev/google-webfonts- helper](https://github.com/majodev/google-webfonts-helper)

[6] [http://www.fontsquirrel.com/tools/webfont- generator](http://www.fontsquirrel.com/tools/webfont-generator)

<comment><USER25> Im impressed with the amount of browser support this has already. Thanks for the info.

</comment></comment><comment><USER26> jacquesm, maybe you didn't want to wade into the details too much, but you didn't mention a major attack vector on third party scripts, namely, the transparent caches run by nearly all ISPs. Also, unless a third party script is served over HTTPS to users, regularly verifying the scripts is useless since _your_ ISP will give you _their_ cached copy, and similar is true for all site users. Transparent CDN's are another consideration for related caching problem.

<comment><AUTHOR> The examples given were just examples, I can see a lot more possibilities beyond the ones mentioned in the article but to be honest I had not thought about the ISP caches.

</comment></comment><comment><USER27> > Flash seems to be very rapidly on the way out, less than 1% of the domains I > looked at still contained flash content

What exactly did you look at? Homepages?

<comment><AUTHOR> Yes, homepages and all the content subsequently loaded (directly or indirectly through multiple layers of scripting or iframes). Essentially what you'd get if you were to visit each and every homepage on the top list and logged the urls that were loaded as a consequence of that.

<comment><USER27> As much as I hate Flash, I don't think you can infer that then. Does your analytics consider [https://www.youtube.com/](https://www.youtube.com/) using Flash? I see no Flash on it here.

<comment><AUTHOR> If it's not on the homepage then it would not consider it using flash. The analysis was run on the homepages, _not_ on all the pages in those websites. (And that would require a lot more work on my part and likely would not change the results all that much).

I believe overall flash usage on the web is now about 10%, but larger sites are generally much better at keeping their sites up-to-date and to follow trends.

Advertising is another good indicator. The typical trick nowadays is to check if flash is installed using some javascript or header inspection and only to serve it up if support has been detected.

Websites that categorically include flash are the ones that were detected.

That's a good point though, I should update the text to that effect.

edit: ok, updated the text to be much more precise about flash usage and the conditions of the crawl which will lead to under-representation of flash.

</comment></comment></comment></comment><comment><USER14> How deep did you crawl? I would have guessed the flash usage to be higher.

How big is the dataset? How long did it take? Which tools did you use besides phantomjs?

Nice job!

<comment><AUTHOR> > How deep did you crawl?

Front pages only.

> I would have guessed the flash usage to be higher.

When adding all the pages in a site it no doubt will be. I'll update the article to clarify this.

> How big is the dataset?

In flight: huge, but after culling and keeping only the bits that I needed it was a lot smaller, about 20G.

> How long did it take?

About 10 days.

> Which tools did you use besides phantomjs?

Just some php glue scripts, nothing fancy, about 500 lines.

</comment></comment><comment><USER28> This is very interesting. Will you release the data and code at some point?

<comment><AUTHOR> Yes, I will definitely release the code and the dataset required to bootstrap the rest. It takes a long long time to run and you'll need a good bit of bandwidth. I won't be releasing the raw data because there is simply too much of it.

<comment><USER28> Sorry for bugging you. Did you store results from the _response_ ¹ metadata object for every domain and process it later or use Regex to parse the HTML content?

I crawl large-ish websites (most recently [https://code.google.com](https://code.google.com) with 1.8MM repos) often and am really looking forward to your dataset & code.

[1] [http://phantomjs.org/api/webpage/handler/on-resource- receive...](http://phantomjs.org/api/webpage/handler/on-resource- received.html)

<comment><AUTHOR> > Did you store results from the response¹ metadata object for every domain > and process it later or use Regex to parse the HTML content?

That would have constrained throughput too much so I opted for culling it during the crawl to just content-type and url, this was then processed to extract the various bits of information. I did use the 'resource received' trick you linked above. Very useful.

</comment></comment></comment></comment><comment><USER29> Run it against Coinkite.com specially on Signed in pages.

</comment><comment><USER30> >> "50% of the domains contained advertising of some form."

That's much lower than I would have expected

</comment><comment><USER31> This article should be read as ranty research, not practical advice. It'd be fine to fix these issues, but not at the website developer level.

 _" If you have to use externally hosted resources such as javascript libraries then at a minimum you should verify regularly that the code has not changed "_

No, you shouldn't. You should focus on stuff that matters to users, not existential internet security holes. Let someone else fix this problem for you, when it stops being existential.

 _By far the safest approach for website owners that care about their users and their users privacy is to simply not include anything at all from other people's servers._

FTFY "A safe, but impractical and productivity-destroying aproach..."

<comment><USER32> Agree the advice is well intentioned and is correct (in theory according to what I read) but not entirely practical. For example:

"then at a minimum you should verify regularly that the code has not changed (you have to hope that you are looking at the same code that your users see)"

Who exactly is the "you" in the above statement and who pays the "you" money to fix this and keep on top of it on an ongoing basis? And for how long?

In the physical world the different between ideal and practical can be described by my experience with production machinery. The machinery came with guards to protect the operators from getting their hands caught or cut off. The guards also came with switches to prevent the machines from running when the covers were taken off. But what would happen is the operators would want to oil or tweak the machines so they would take the covers off and disable the sensors so that the machine would run bare. Of course you would tell them not to do this, but they would still forget to put the covers back on or be lazy quite often and there was little you could do about it. You had production to get done under deadline and weren't likely to fire someone even though you knew there was a small safety risk in doing this type of thing (older machines of course came with no safety guards at all, operators just had to be careful at their own peril. (And good operators were impossible to find anyway so once you had someone they became a primadonna ..

<comment><AUTHOR> Regularly pulling a hash for the libraries you include and alerting you when a hash changes unexpectedly is no work at all.

And if you need to be paid money to fix it then you have a problem anyway so one would assume that you'd be paid just as much to fix it when you're being alerted to it by a cron job as you would be paid to when you're alerted by a horde of users.

As for machines without guards: I've worked (extensively) in the metal working industry and the number of people missing digits and limbs has decreased steadily ever since tampering with guards, safety-interlocks and lock-outs became a firing offense so I don't think that's a very good example.

<comment><USER32> Machines: Yes this was the 80's (sorry I didn't point that out my mistake) and things have changed. However to that point if you have your golden machine operator turning out good work (and he is only 1 of 2 on a particular line) and it's not easy to hire a replacement, let alone a good replacement, you tend to get a bit lax.

Security: I am primarily a business guy (who does some light programming and knows Unix since the 80's) so I hire others to do work for me. I am just thinking that for the people that I have hired in the past how would anyone know if any of this is happening (other than code audits) and what is the mechanism to make sure the right thing happens even if you know what the right thing is? It's kind of a version of the advice "make backups but make sure that you test your backups as well".

<comment><AUTHOR> The motto is 'trust but verify', and indeed that goes for your backups as well. And incidentally that's one of the most failed items during the dd's I've done and after verification several companies turned out to have lived without backups at all.

It usually takes two things to go wrong for a disaster to happen: some $0.05 part that fails _and_ a procedural error.

And the consequences can be just about anything.

<comment><USER32> One of the first books that I read talked about the story of the backup tapes on the car seat that were erased when someone in Sweden (?) with heated seats drove home. (urban legend iirc).

<comment><AUTHOR> Iirc Saab pioneered heated seats because one of their engineers had colon cancer and Saabs are pretty common in Sweden, but I'd still wager that's an urban legend because the heating is done with DC current and to reliably alter the contents of a tape you'd need a lot more of magnetic field to overcome the resistance of the magnetic particles to change direction (remanence) and you'd want that field to alternate.</comment></comment></comment></comment></comment></comment></comment>


Big Data meet flash - <AUTHOR> http://www.princeton.edu/main/news/archive/S34/22/11E01/index.xml?section=topstories

<comment><USER2> How much energy can a normal data center save?</comment>