Securing Firefox with WebAssembly - <AUTHOR> https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/ <comment><USER2> It's really great to see this work. Cutting down the amount of memory-unsafe code in the browser is an important ongoing goal.

I'd love to do the same for our contenteditable implementation. The hard part here is to implement a DOM abstraction, because that code currently pokes at DOM objects directly and you can't safely do that across a wasm barrier. Once we've done that, though, Firefox's contenteditable implementation would become a cross-browser library, which opens up some interesting opportunities. We could use it in Servo, and authors could ship it on their Web pages if they want to ensure a consistent contenteditable experience across browsers.

<comment><USER3> How would this work? Isn't the content editable attribute magic so far as web code is concerned. You can't currently implement contenteditable in userspace, can you?

I guess maybe you could make an attribute which just enables a flashing cursor, and then everything else could be done with DOM apis...

<comment><USER4> Well Google Docs editing is fully custom, including the selection and caret. So it must be possible.

<comment><USER3> I believe Google Docs implements it's own text layout entirely from scratch. Sure, you can do that, but that's a lot of work, and it doesn't perform particularly well.

<comment><USER5> I've implemented text editing on top of contenteditable, and directly via key events etc. The latter is far less work. contenteditable gets you 60% of the way there but is so buggy and inconsistent that you have to override all its behavior anyway.

<comment><USER6> As a user I bet I'd prefer the contenteditable approach. I find that _absolutely consistently_ the cleverer a web rich text editing widget tries to be, the worse the experience is, and the more it breaks my model of how such things work on the native platform. Dropbox Paper's is atrocious (I've reported several _super_ -annoying bugs, and never had even a response). Slack's new widget is abysmal (I haven't even bothered filing bugs with them, because everyone else has already complained about the same things—most of all, its caret handling is quite insane). Google Docs I haven't edited with for many years, so I can't fairly remark on it. I can think vaguely of a couple of tech demos of not using contenteditable at all from a few years back, and at that time they were awful on desktop and entirely unusable on mobile. I don't know if the situation has improved _at all_ from that, but I'm sceptical.

Do you happen to have either or both implementations on the public internet? If so, I could see just how many seconds it takes me to be infuriated by them, especially by the non-contenteditable text editor. If I fail, I will gladly eat my metaphorical hat, but presently I would assign odds of well under 0.1% of that happening.

Sure, contenteditable has many bugs and inconsistencies, and Chrome's implementation especially is a toy as regards functionality (e.g. poor table and image handling, difficulty with distinguishing a caret inside the end of one node from one after the end of that node), but much of the 60% that it gets you is stuff you _can't get at all_ any other way, especially insofar as it varies by platform, mostly deliberately.

pcwalton's proposal interests me because it would actually _concretely_ examine what can and can't be done, and definitely identify the shortcomings. It would have a chance of actually being good.

<comment><USER3> > I find that absolutely consistently the cleverer a web rich text editing > widget tries to be, the worse the experience is

I don't know about this. Google Docs isn't great (I haven't used Paper), but CodeMirror ([https://codemirror.net/](https://codemirror.net/)) is _excellent_. Performance is flawless. All the platform shortcuts + extra niceties like multiple cursors.

<comment><USER6> I should have clarified that I'm specifically speaking of _rich text_ editors. CodeMirror is a plain text editor, which removes most of the difficult-to- implement-without-contenteditable stuff. It uses a textarea, not any contenteditable or contenteditable-like thing.

CodeMirror is rather good as such things go. Last time I tried it it had _serious_ issues with some keyboards on Android (regardless of browser, I believe), but that looks to be working well now. Well, either that or the new Firefox for Android has worked around the input problems; could be either, I don't have a URL that I know was broken and hasn't been updated recently.

But even so, it still has problems, some niggling and some major. Navigation keys don't behave natively (e.g. on Windows, select a range and then press Up or Down and it should go up or down one line from where the caret is, but instead Up takes you to the start of the selection and Down to the end). I can't get a caret thumb on Firefox on Windows, and it seems very hit-and-miss on Android, and the Samsung keyboard on Android is going _crazy_ with its suggestions as you move the caret around the document—and that'll be basically because of my next point.

Perhaps most seriously, it's _completely_ unusable from the perspective of accessibility tech. And most damningly, guess what the solution to that is? They're working on CodeMirror 6, and concerning accessibility [https://codemirror.net/6/](https://codemirror.net/6/) says:

> _This version leaves more to the browser, instead of "faking" the editing > process in JavaScript. This makes it more transparent to screen readers and > other accessibility tools._

You know what "leaving more to the browser" means?

contenteditable.

Yep.

It still interferes with various native user agent functionality (e.g. navigation keys are still wrong and it's still interfering with caret thumb and long press on at least Windows), but it's distinctly better because it reduces the amount of the important type of cleverness.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> > but we're performing the wasm to native code translation ahead of time, when > Firefox itself is built.

This might be an advantage for startup performance, but it's also a disadvantage performance wise as then you can't use all available features of the CPU. That's one of the advantages that wasm gives you.

> we were often asked, "why do you even need this step? You could distribute > the wasm code and compile it on-the-fly on the user's machine when Firefox > starts." We could have done that, but that method requires the wasm code to > be freshly compiled for every sandbox instance. Per-sandbox compiled code is > unnecessary duplication in a world where every origin resides in a separate > process.

Android keeps an on-disk cache, performing native compilation at installation time, or at first startup after an OS update. One could have a similar cache for Firefox as well.

Anyways, this stuff can be improved in the future as well. This doesn't change the fact a bit that it's an amazing and really great idea to improve safety of the browser. I love it!

<comment><USER6> > Android keeps an on-disk cache, performing native compilation at > installation time, or at first startup after an OS update.

If you're describing what I think you're describing, that was a Dalvik thing (Android 4.4 and earlier), which ART (Android 5 onwards) doesn't do. I also found it a pain, because from time to time even when there hadn't been an OS update or any other such change my phone would take three or four minutes longer to boot up as it decided it had to optimise all its packages. No idea whether that was a typical experience.

<comment><USER7> The compile target of ART's dex2oat tool is actually native ELF code while Dalvik's dex2opt only created odex files, so the on-disk cache still exists. I've found sources that this is still done on app installation. On whether it's still done on OS updates, I couldn't find sources, but I guess your experiences mean that now OS updates don't trigger recompilations any more. Thanks for the pointer!

<comment><USER8> It still happens, except now the recompilation is done _before_ the reboot for the upgrade, so that it doesn't create a massive downtime for upgrades. But if you manually upgrade, you can still see one (very long) step called "Optimizing Apps".

</comment></comment></comment></comment><comment><USER9> if parts of the web browser start being shipped as wasm code, we will eventually reach the point where the web browser shipped to the user is only a wasm vm, and all the rest will be shipped as optional libraries or even downloaded on the fly. Even stuff like the html engine, the css, and the javascript. In that world, using the messy web standards evolved over time would be optional. The web browser would then become the universal virtual machine that the world seems to want it to be, instead of a browser. The web would be the app distribution system. One could for example, decide to write their site using tcl/tk.

Implementing the wasm vm and its basic apis would be simpler in a new operating system. Because the way it is now, the web browser itself is more complex that writing a simple operating system. That hinders innovation in the Operating System space.

<comment><USER10> All I can see is people wanting to use web-technologies to develop applications. So I would place my bet on the DOM/CSS evolving further and swallowing everything. JavaScript might get some contenders.

<comment><USER11> 50 years later the mainframes have won.

Language environments and containers.

<comment><USER12> They have been "winning" since they started losing. Our PCs are much more similar to 80's mainframes than to 80's PCs.

</comment></comment></comment></comment><comment><USER13> Looks like eventually Wasm will become JVM and Firefox will become HotJava[0] :-P

[0] [https://en.wikipedia.org/wiki/HotJava](https://en.wikipedia.org/wiki/HotJava)

<comment><USER14> Every single day I am thinking how the JVM could actually be a platform that is worth using in many situations. That day may come but certainly not within the next decade. No matter how well you optimize your code the JVM will ruin it and make it slower and consume more memory than necessary. Of course none of this matters in a world where your internal dashboard with single digit user counts is set to use 4GB RAM just "to be sure".

<comment><USER15> > No matter how well you optimize your code the JVM will ruin it and make it > slower and consume more memory than necessary.

Maybe you are really good at this.

But for a good chunk of software engineers AFAIK compiling Java to bytecode and running it on the JVM easily outperforms their optimized code performance wise in most cases.

JVM and JDK writers (and the same people on the Dotnet side) aren't dimwits and their efforts over the last two decades are being applied every time we compile and run software on their platforms.

</comment></comment></comment><comment><USER16> This is kind of neat but it's not clear how to think about what WebAssembly is doing, since the output is native code. I guess it's essentially a safe compiler for C++ code?

For a language whose compiler already outputs safe binaries, this step would be redundant.

It's not that easy to write a safe compiler though. Would a compile toolchain that uses WebAssembly for all compilation be useful?

<comment><USER17> It's not a safe compiler for C/C++, the compiled wasm code can still be compromised, it just cannot touch the rest of the process except indirectly via returned values.

<comment><USER18> And, to be clear, people could still do bad stuff with compromised WASM.

The big difference is that the WASM sandbox significantly reduces the surface area of what bad stuff can be done.

Today, a compromise in the browser means the attacker can do whatever the browser can do (which is usually a LOT). With the sandbox, a compromise can only really affect what the sandbox has available to it. That means, if your sandbox only exposes a single method which takes in a string and returns a string, the worst thing an attacker can do is return a malformed string.

Of course, if you mishandle that returned string then bad stuff will happen but it's a far cry from the input string being able to potentially cause arbitrary code execution which installs a virus on your machine.

To really do something evil you have to not only compromise the code running in WASM, you have to find a way to break out of WASM. That's a lot harder to do.

</comment></comment></comment><comment><USER19> Is there any reason to continue using process-level sandboxing if this approach is available? It sounds like WASI adds an extra layer of security even beyond process-level sandboxing by being able to limit access to system resources. Or is access to system resources really not the concern here / can you do that just as easily with process-level sandboxing?

And you can pass callback functions to sandboxes, which IDK if you can do with separate processes. Does process-level sandboxing provide any advantages WASI doesn't?

</comment><comment><USER19> The docs list WASI as currently experimental[1] and has missing features[2]. I understand how the sandboxing approach can add security, but if using experimental technology to enable this, doesn't it potentially open up more new holes than it closes? I'd love to hear more detail about what exact parts of WASI are used here, and what happens if you compile C code that targets a "rough edge" or "missing feature" of WASI by accident?

[1] [https://github.com/bytecodealliance/wasmtime/blob/master/doc...](https://github.com/bytecodealliance/wasmtime/blob/master/docs/WASI- overview.md)

[2] [https://github.com/bytecodealliance/wasmtime/blob/master/doc...](https://github.com/bytecodealliance/wasmtime/blob/master/docs/WASI- intro.md)

<comment><USER20> External experimental tools are different than internal experimental tools. It would not be a good idea to do the same using a tool they have little control over, but in this case they have full control over cranelift (up to even feeling secure in using a different version)

</comment></comment><comment><USER21> The sandbox architecture model makes me think of cell membranes.

[https://plsyssec.github.io/rlbox_sandboxing_api/sphinx/](https://plsyssec.github.io/rlbox_sandboxing_api/sphinx/)

</comment><comment><USER22> It's very impressive that they can do it with existing libraries properly.

Personally, if I had to design a solution for this problem, I would use the io_uring model - which would allow every part to reside in its own process and memory space.

</comment><comment><USER23> This kind of technique could also be applied to the parts of Firefox built with Rust, correct?

<comment><USER24> It could but Rust already solves the issues this is aiming to solve but with fewer steps. I don't know what Mozilla's policy is on adding Rust vs C++ for new features.

<comment><USER18> I somewhat disagree.

Safe rust solves the memory safety problem. However, there is still the possibility of a logic bug causing rust to touch something it shouldn't.

The sandbox approach is about adding a second level for malicious code to bypass. You now not only need to find a way to get past the code, you also need to find a way out of the sandbox.

It's a little like running your apps on a server with highly restricted permissions. You do that so the app compromise limits what is exposed.

</comment></comment></comment><comment><USER25> I wonder how this would compare to compiling the sandboxed code with ASan and UBSan on

<comment><USER26> Afaik those make for a 2x performance hit. And they don't necessarily protect against buffer overflows; if you overflow out of data addressable from one pointer, but into data that's legally addressable from another pointer, that's still an issue, but it won't be caught.

<comment><USER25> But WASM has the same buffer overflow problem, and at least that bad of a perf hit.

<comment><USER26> WASM has less of a perf hit.

</comment></comment></comment></comment><comment><USER27> I'm still waiting for better toolchains.

WASM is really the greatest thing, but it's lacking proper support from compilers. Binaryen seems like a beast to use. I don't really understand why WASM is not just supported natively directly by clang or gcc.

<comment><USER28> The WASI tutorial for compiling C/Rust to wasm and running it has some useful information on this front: [https://github.com/bytecodealliance/wasmtime/blob/master/doc...](https://github.com/bytecodealliance/wasmtime/blob/master/docs/WASI- tutorial.md)

We wouldn't have been able to put wasm in Firefox like this if there wasn't decent compiler/runtime support via the clang ecosystem.

<comment><USER29> That C code has a bug where the inner write loop writes the same portion of the buffer after a short write.

The Rust code, by contrast, slurps up the entire file contents into a buffer before writing it out. If someone is going to write code that way why even bother with a low-level language? (This "memory is infinite" mentality is something I've noticed in other Rust projects, even major ones like mio.)

<comment><USER30> Good catch on that bug! I'll fix that.

Beyond that, that file is just a simple example for showing how to work with the toolchain and the sandbox.</comment></comment></comment></comment>


Ask HN: Which E-mail hosting and CRM do you use for your startup? - <AUTHOR> I'm looking for stable E-mail hosting provider for small business/startup. If you have any suggestions, let me know. <comment><USER2> Webfaction. Most of the cases it does all: Create multiple mailbox with multiple addresses, email redirections, multiple users, and with no users/alias limit. Other mail hosting only services, are to much for what you normally need. If it's just about receive and setting up accounts, Webfaction is more than enough.

If you are going to send transactional or marketing email, use Amazon SES, or Mandrill if you don't want to deal with setting up AWS SES. I had lost lot of my time trying to use the same email hosting for marketing purpose, don't recommend that to anyone.

For CRM, I really like [https://insightly.com](https://insightly.com) when I used it really helps me to get back on contacting users quickly, however if I have a bigger team in the future, I will try [http://pipedrive.com](http://pipedrive.com).

But being real, 60% of the cases and spreadsheet and a share contact folder in Google using the Delegation option had been my day to day tool.

</comment><comment><USER3> Google Apps (now called "G Suite"). $5/month, stable, "just works," and via Google Docs/Drive you have a CRM solution.

Alternatively Office 365 Business Premium. $12.50/month (12 month minimum commitment). Only reason you'd consider this is that it includes Email, Office Desktop Suite (Outlook, Word, Excel, etc), and CRM. Essentially you'd merge a couple of bills into one bill.

Both are alright support, good uptime, great vendor support, good scaling, and migration strategies (in and out).

PS - Yes, this is the "boring" and "obvious" answer but sometimes things are "boring" and "obvious" for a good reason.

</comment><comment><USER4> I use Zoho for email. It is free for up to 5 users and has never given me any issues. I haven't used a CRM yet as I need customers before I can use a CRM

</comment><comment><USER5> Gsuite, or the like. Don't spend too much time on this decision

</comment><comment><USER6> I use G Suite, I know it and lately it's been always up - Google wrote the book on System Reliability Engineering.

I use Streak CRM as it integrates with gmail.

<comment><USER7> Founder of Streak here, happy to answer any questions but in my highly biased opinion Gmail/Inbox/Gsuite is the way to go. Pace of innovation is fast, good APIs, ecosystem of products (like Streak) is getting stronger by the day.

</comment></comment><comment><USER8> G Suite (ex Google Apps) for emails/calendar/documents. NetHunt CRM as a CRM for G Suite.

</comment><comment><USER9> Use HubSpot, I find they've worked incredibly well at scale. Plus it's free to get going.

</comment><comment><USER10> CRM: Close.io

Email: Gmail / Amazon SES

Automation: DripEmails.com (I'm the founder)

</comment><comment><USER11> For general purpose email: GMail

For transactional email: Amazon SES

CRM: self-hosted SugarCRM

</comment><comment><USER12> Yandex is free and close to google suite.

</comment><comment><USER13> I just forward emails to my gmail account.

</comment><comment><USER14> I've no doubts [https://www.servermx.com/en/index.html](https://www.servermx.com/en/index.html)

It isn't the cheaper but only the customer service worth it

They provvide also a good email sending limits (check it here [http://docs.mailpoet.com/article/49-lists-of-hosts-and- their...](http://docs.mailpoet.com/article/49-lists-of-hosts-and-their- sending-limits) )

"Multiple domain Backup MX mail server IMAP allows Real-time synchronization RoundCube, SquirrelMail and SOGo Web mail with support for languages right-to- left layout Anti-spam Spamassassin and Anti-virus ClamAV Contacts, Calendars and Tasks with CalDAV and CardDAV support Catch All, Alias, Forward, autoresponder, Sieve Filters Reliable and secure email hosting for companies, organizations, and individuals featuring WebMail, POP, IMAP and SMTP @ Contacts, Calendars and Tasks with CalDAV and CardDAV support @ Multiple domain hosting under the same account with no limitations @ Web-Administration area dedicated to individual user mailbox @ Anti-spam protections settings with per-user configuration"

At the moment there are some special servermx offers here : [http://www.webhostingtalk.com/showthread.php?t=1621853](http://www.webhostingtalk.com/showthread.php?t=1621853)

1 month of free trial cheers Max</comment>


Creating Game AI in Stadia Using Mostly English - <AUTHOR> https://stadia.dev/blog/creating-game-ai-using-mostly-english/ <comment><USER2> The Three Robots game linked in the article is also interesting. [https://github.com/google/mysteryofthreebots](https://github.com/google/mysteryofthreebots)</comment>


Perl-5.22.0 is now available - <AUTHOR> http://www.nntp.perl.org/group/perl.perl5.porters/2015/06/msg228300.html

<comment><USER2> Here's what's changed

[https://metacpan.org/pod/release/RJBS/perl-5.22.0/pod/perlde...](https://metacpan.org/pod/release/RJBS/perl-5.22.0/pod/perldelta.pod)

</comment><comment><AUTHOR> "....thanks to a vibrant community of users and developers."</comment>


An Example of Forensic Science at Its Worst: US v. Brig. Gen. Jeffrey Sinclair - <AUTHOR> http://www.zdziarski.com/blog/?p=3717 <comment><USER2> Ironically, the amount of pressure from the top involved in this (and related) cases caused several prosecutions of sexual misconduct in the military to be _dismissed_. You read that right. There's a doctrine called "unlawful command influence" where, if the posture of the Commander on Chief on down suggests that there is a "right verdict" independent of the facts, then the military courts should dismiss cases rather than having military officers be, essentially, ordered to convict.

A certain US president who is a Constitutional law scholar has run into this at least three times and professes to be really surprised every time it happens.

see generally: [http://www.nytimes.com/2013/07/14/us/obama-remark-is- complic...](http://www.nytimes.com/2013/07/14/us/obama-remark-is-complicating- military-trials.html?pagewanted=all&_r=0)

<comment><USER3> We have something similar going on in the UK with Cameron making commentary and publicly taking sides on court proceedings.

[http://www.bbc.co.uk/news/uk-england- london-25350419](http://www.bbc.co.uk/news/uk-england-london-25350419)

[http://www.bbc.co.uk/news/uk-politics-28014035](http://www.bbc.co.uk/news/uk- politics-28014035)

<comment><USER4> While that's not good, it's very different thing. Those two examples were of normal, civilian courts, proceeding of an independent judiciary; a President or Prime Minister has the "power of the bully pulpit", but no formal power. Our minimalist Constitution goes so far as to say Federal judge compensation " _shall not be diminished during their Continuance in Office_ ", i.e. the other branches of government can't dock their pay.

In military courts, the judges and jury are in the chain of command, so as patio11 put it, " _the military courts should dismiss cases rather than having military officers be, essentially,_ ordered _to convict._ " Hence the formal name "unlawful _command_ influence".

</comment></comment></comment><comment><USER5> What this really highlights is that lay people trust computer forensics people to be experts, and often that trust is misplaced. Unfortunately, this isn't the only example of misplaced trust. In several places, Zdziarski laments that computer forensics doesn't live up to the standards of proper "science." Yet, his trust in the rest of forensic "science" is also misplaced. Pretty much everything besides DNA forensics, maybe fingerprints, is junk: [http://lst.law.asu.edu/FS09/pdfs/Koehler4_3.pdf](http://lst.law.asu.edu/FS09/pdfs/Koehler4_3.pdf) (page 4).

Indeed, the National Science Foundation has been looking into the field and has been shocked by how unfounded it is: [http://www.nsf.gov/pubs/2013/nsf13120/nsf13120.jsp](http://www.nsf.gov/pubs/2013/nsf13120/nsf13120.jsp) ("While the report acknowledges that 'the forensic science disciplines have produced valuable evidence that has contributed to the successful prosecution and conviction of criminals as well as to the exoneration of innocent people,' it cites a need for systematic research to validate the various disciplines' underlying assumptions and methodologies, adding that the 'forensic science ... communities will be improved by opportunities to collaborate with the broader science and engineering communities.')

All that is just a polite way of saying: "holy shit your techniques lack real scientific foundations; you guys need to hire real scientists."

<comment><USER6> On top of the junky aspects of forensic "science" are many bad practices. 1600+ cases in Massachusetts were called into question due to a crime lab employee who told police and prosecutors what they wanted to hear. She was a hero until she wasn't.

She was convicted of a crime and got a short prison term. The investigation found she "acted alone."

Is she an outlier?

</comment></comment><comment><USER7> A sad read on many levels.

 _" I investigated a little. As it turns out, this particular manufacturer first copies the iOS file system onto the Windows partition that their software is running on, and then pulls the timestamp information off of the copy of the data."_

 _" Irresponsible, to say the least. But this is the quality of the forensics software assisting our government and military. Poorly written, over-priced assumptionware."_

Also, the OP's professional frustration is endearing -- typical woes of an expert who "knows and cares", observing snakeoil barons become rich on bullshit :-)

<comment><USER8> I think you should understand that America's economy has a long an illustrious history of "snakeoil barons becoming rich on bullshit". It's kind of the very basis of our whole system.

</comment></comment><comment><USER9> _"...This, and many other types of artifacts are often either completely overlooked by numerous commercially sold, expensive-as-hell tools, or in the case of at least one tool – seemingly made up data. All of these came into play in this case and would later play a role in its outcome..."_

So -- prosecutors and investigators don't understand the tools they use to search phones, judges give them wide leeway in reporting such "evidence", AND some commercial tools make up data to return?

Does this not deeply concern anybody in any of the branches of the government? I hope I'm not being alarmist, but that statement, if true, seems to me to be incredibly damming of the entire criminal justice system. It's like saying the prosecutors determine who's guilty simply by selecting them for trial. The rest of the work is simply acquiring and configuring the appropriate "tools" (Note that it doesn't say they do this on purpose. I guess that's something.)

</comment><comment><USER10> I wonder if anyone has ever been wrongfully convicted because of poor forensic software. Those programmers are incredibly unethical people.

I'm familiar with the food-on-the-table argument, but wow, possibly getting innocent people locked up just because you don't know what you're doing is something. It can't feel good to receive the double whammy of knowing you're incompetent and that you're incompetent enough to ruin lives.

Would I do it? I don't know. Through good fortune, I've never been, as a programmer, in the situation where I worried about losing my job and being unable to find one. So maybe those of us who feel we would never do something like this (work on critical health software while ignorant, or on forensic software while clueless) just don't know that it is easy when your livelihood is threatened. Still really unethical, though.

<comment> FLUX-YOU >work on critical health software while ignorant

This struck a nerve because that's how I feel in my position. I really had no idea what went into the products that I'm not working on. I feel ignorant, but someone's giving my code the okay and occasionally throwing some back, so I must be doing something right. Someone said, "He looks like he can handle this job" and here I am with no prior experience in this particular field (I did have some programming experience). I wonder how many juniors these forensic software companies employ?

On one hand, mission-critical companies should only hire people who are both experts in programming, experts in safe and reliable programming, and experts in the domain that they programming in. (note: actual experts, not "i've-done- it-once-or-twice-so-i'm-the-department-expert-because-no-one-else-is-really- working-on-it" expert)

On the other hand, it's incredibly hard to find all three of those things in sufficient numbers to staff a team capable of handling large and complicated software. With employees in general changing positions more often (sometimes on whim alone, nevermind what the world needs), it's even harder to cultivate 5+ year employees who really know their way around the software and the business.

There is just a huge volume of information and practice required to become that individual, and you really run into daily practical concerns if we were to only hire these experts. You have to be fed challenges that teach you so you can eventually become a real expert, but you need competent oversight -- a mentor, really. And sometimes you just don't have the luxury of tackling problems that are 'small enough'. Sometimes your mentor really doesn't have time to teach to the level of detail needed because let's face it, there's still a business behind all of this. And then they should be competent in security, performance, and a host of other skills because software is just so connected and reliant on the other parts of the system.

So now you need someone with all of those previous skills and the ability to teach people well. These newly minted experts will have to pass down the knowledge as well.

How do you cultivate experts without also creating a little danger to your customers and their customers and maybe even the general population? At some point, that trainee is going to have to make change and implement things without a safety net behind him. He's got to do this enough until he becomes that actual expert, but that takes a really fucking long time, and I don't think the market is really motivating people to take that route ("Why not just make some websites for 80k a year and save myself all of that stress and an early death?").

If someone else makes a big mistake, most of that time you spent to become better becomes worthless when your firm hits the front page. Now you're associated with someone else's problem and that's going to affect your chances of a job. So not only do you have to watch out for your own mistakes, but also your peers' mistakes as well. While you may not have to resort to flipping burgers, you probably won't be able to get a job in a critical environment for a while.

<comment><USER11> Not to diminish the _difficulty_ of accomplishing this, but there is a good answer to your question: it requires both a strong _culture_ of quality assurance (this is what you're talking about with mentors and watching each others' backs), and a strong _specialization_ of quality assurance, made up of the experts. Unfortunately, many software organizations treat the specialization like a joke of a useless roadblock and only pay lip service to the culture. I think this may be because lots of software truly doesn't need to be very high quality, while other software truly does, and determining which kind you're making and justifying the additional cost of quality (which is enormous) is not straightforward.

In the case of this specific article, I find it odd that the blame is laid at the non-forensic-expert software engineers, rather than the companies that employ them, seemingly without the support of a tightly integrated set of experts. There is nothing wrong with dividing labor between creating software and defining and verifying what the software does. Both jobs are difficult in specialized ways. It seems that, in the opinion of one expert at least, these companies are just doing a poor job of QA.

</comment></comment></comment><comment><USER12> So, I read through the article and could not find what was concretely wrong, technically, with the data. Does he state that any where? Thanks.

<comment><USER13> The details are of course confidential. He says:

"There are reasons I'm not going to dig into the details of the case. Certain people that were involved could easily be pinpointed by revealing technical details that could be pieced together with news reports, and help build a story in your mind that would probably be inaccurate. The details aren't so important as the errors that were made. All you need to know from a technical perspective is right here: some of the types of information that these commercial tools were (and likey still are) misreporting is significant. Evidence and timestamps of a device erasure event. Evidence of a backup restore event. Application usage dates. Application deletion events and timestamps. File access times. This, and many other types of artifacts are often either completely overlooked by numerous commercially sold, expensive- as-hell tools, or in the case of at least one tool – seemingly made up data. All of these came into play in this case and would later play a role in its outcome."

<comment><USER14> _" The details are of course confidential. He says:"_

I kept having to skip paragraphs to get to the juicy bits. Eventually, I gave up and closed the tab. I don't much like this guy's writing style, as it constantly goes off on tangents that don't really add anything to the story, much less the baity title.

</comment></comment></comment><comment><USER15> Sadly, forensic science can actually be a lot worse than the example here.

[http://www.huffingtonpost.com/2011/09/01/michael-west- fabric...](http://www.huffingtonpost.com/2011/09/01/michael-west-fabricating- bite-marks_n_944228.html)

</comment><comment><USER16> An Example of Pathetically Self-Aggrandizing Twaddle, Nearly at Its Worst.

<comment><USER12> You seem to have called a spade a spade and some folks don't seem to like that. Yes, that page (the article and the byline) does seem a little anxious to establish the author's credentials. But that should be taken separately from the content.

I'm surprised that the article got so many up-votes considering it has so little technical detail.

</comment></comment><comment><USER17> Jeffery Sinclair is the name of the first commander of Babylon 5. I had to check that it was a real name, but it seems that it is also the name of a real brigadier general.

</comment><comment><USER18> This article makes me wonder: does forensic software undergo any kind of 3rd party testing for accuracy? Or are we literally just taking someone's word that it is producing accurate results?

<comment><USER19> There's some, but it's far too little to be comprehensive. Some law enforcement labs have entire QA departments dedicated to validating internal procedures, including how particular tools should be used.

</comment></comment><comment><USER20> the courts and their interaction with science has always been tenuous, the story of arson investigators, fire science and criminal justice is similarly terrifying [http://www.newyorker.com/magazine/2009/09/07/trial-by- fire](http://www.newyorker.com/magazine/2009/09/07/trial-by-fire)

</comment><comment><USER21> TLDR; "computer says no" all over again.

</comment><comment><USER22> The OP should start hacking:

[http://www.sleuthkit.org/](http://www.sleuthkit.org/)

</comment><comment><USER23> The author states they were shocked at how Sinclair seemed to get off easy, with just a slap on the wrist. I'm not sure why that's shocking.

It's been painfully obvious for more than a decade that there exists a certain class of people in the US who are above the law, e.g. James Clapper.

<comment><USER24> Well, it looked like the powers-that-be wanted to make an example out of him. So I could see it be surprising that he got a slap on the wrist after having those "guns" pointed at him.</comment></comment>


Those Knowing History May Find It's Time to Invest - <AUTHOR> http://www.nytimes.com/2008/10/12/business/12stox.html?hp <comment><USER2> I agree, it's a great time to invest, but remember - the market can stay irrational longer then you can stay solvent.

It may take 15-30 years for the market to "recover", can you wait it out long enough without being forced to withdraw money from the market at a bad time?

<comment><USER3> So there is a New York Times article saying now might be a buying opportunity, and you readily find posts here in the same vein. This STRONGLY indicates the bottom is a LONG way away. At true secular bottoms nobody mainstream is even asking if the bottom is in; they're too scared off the asset class.

Think of the mirror image: the top. In 2000 and 2007 did you repeatedly hear the press and random normal people debate if the top is in and things were set to plunge? No, you didn't. That's just not how mass market psychology works.

<comment><USER4> I see where your coming from, but this NYTimes article is far from the "mass" opinion of the press or the average stockholder.

The simple fact is that people who have enough wealth/capital to take risks during a recession, generally do very well when the economy recovers.

<comment><USER3> > is far from the "mass" opinion of the press or the average stockholder

I think it is very much the mass opinion. People are expecting some sort of rebound next year or the year after. Surveys show most home owners continue to think their houses will appreciate substantially over the next three years. The contrarian buy-time is WAY off.

</comment></comment></comment></comment><comment><USER5> Hm, the prices might eventually rise again. On the other hand, they might continue to fall even lower.

Information gained: zero

</comment><comment><USER6> They may also find themselves poorer in the future, which is an indication that they need to understand more about the present to successfully invest.

</comment><comment><USER7> I still don't think I feel comfortable about putting money back into the stock markets. Or even into stock markets altogether. The stock market, at least in its current design, is by nature going to go through bubbles.

I'd almost rather take the money and invest it into something I know I have control over, such as a side project or a startup of some sort.

<comment><USER8> People are not feeling comfortable with the stock market - it may be a good sign to get back in.

(Disclaimer: As a poor student I do not have enough disposable assets, yet, to practise what I preach.)

</comment></comment><comment><USER9> Whatever you do, just do it slowly and mostly in dividend issuing companies/money market funds/cash generating investments. World diversified dollar cost averaging portfolios are hard to beat.

</comment><comment><USER10> aka "be opportunistic"

</comment><comment><USER11> Not yet, I predict the dow to hit rock bottom around 5k in the next couple of weeks, then rebound. Be alert, then buy.</comment>


Neil deGrasse Tyson: "Audacious Visions" - <AUTHOR> http://www.youtube.com/watch?v=WlGemHL5vLY <comment><USER2> The only two big things the US can do anymore is momentum and war. We might start new things, but they'll be dismantled with every reverse of Congressional control.</comment>


Fighting AI with AI - <AUTHOR> https://medium.com/fighting-ai-with-ai/fighting-ai-with-ai-5ab7a20401d5 <comment><USER2> Overwriting the EXIF geo headers of an image file ([https://en.wikipedia.org/wiki/Exif#Geolocation](https://en.wikipedia.org/wiki/Exif#Geolocation)) is hardly AI.</comment>


What skills are most crucial for running small internet companies? - <AUTHOR> https://www.indiehackers.com/post/what-skills-do-founders-find-most-crucial-for-running-their-businesses-e95d99d9ff <comment><USER2> I'm running Savio[1], which is my fourth small internet company I've run since 2007 (the previous three were sold).

At the risk of sounding cliche, the three skills that have been most valuable are:

1\. The ability to build software that meaningfully solves a customer's problem

2\. The ability to reach people who have the problem my software solves

3\. The persistence to grind until we have a decent product and can regularly reach people who have our problem.

The above may seem like they're outcomes. But understanding problems and building solutions is a skill. Finding and reaching people is a skill. Grinding effectively is a skill.

Every other skill (writing well, communicating well, selling the visions, giving good demos and customer service) is in service of the above.

[1] - [https://www.savio.io](https://www.savio.io)

<comment><USER3> You may have listed in no particular order, but, if you did, I would argue #2 as the most important.

<comment><USER4> I disagree, and this is the mistake I made earlier in my career. Having the market is most important. I have built great products that flopped and ok products that were incredibly successful.

Quoting Andy Rachleff: If your startup addresses a market that really wants your product, you can screw almost everything up and still likely be successful. On the flip side, if you are really good at execution, but the "dogs aren't eating the dog food", you have no chance at winning.

"When a great team meets a lousy market, market wins. When a lousy team meets a great market, market wins. When a great team meets a great market, something special happens."

<comment><USER3> It sounds more like we agree. "Having a market" and "The ability to reach people who have the problem my software solves" aren't so different.

But while "people who have a problem" equals a market, it's nothing if you cannot reach them.

</comment></comment></comment></comment><comment><USER5> Here's what NOT to do, from my experience in the first decade of this millennium:

1\. What came first: More work or more developers? Don't stress your development team for ages without hiring new employees. They'll burn out and hate working for you.

2\. Don't focus all your energy on outward appearance. Your work should speak for itself, not your amazing expensive new car and tailored suits.

3\. Don't stop innovating. The developers who were there since day 1 who refuse to adopt new tech? Yeah, get rid of them. They're pulling the rest down to their level.

4\. Seniority isn't a guarantee for superior knowledge; and being junior doesn't mean their opinion is invalid. Don't fall victim to playing favourites. If you hire people, then they're equal.

5\. If you are one of two founders: Don't have sexual intercourse with the wife of the other founder of the company. He will find out and because you have 50/50 shares in the company, everyone needs to pick a side. This destroys the company.

6\. And that also means you can no longer afford to lease that $1400/month luxury off road SUV that you only drive in a town without even a single hill in a 100 mile radius.

I was just an employee for this company, I was in my teens when I started working there, and I thought these 30-something owners of the company knew what they were doing. They didn't.

<comment><USER6> > 3\. Don't stop innovating. The developers who were there since day 1 who > refuse to adopt new tech? Yeah, get rid of them. They're pulling the rest > down to their level.

Sorry, but adopting new tech isn't innovating. Building new tech is. Adopting new tech may make it easier. Or it might just be that your developers are bored and need something to entertain themselves.

<comment><USER7> Re-read the first sentence.

</comment></comment></comment><comment><USER8> Flexibility. Humility. Optimism.

Flexibility means you're willing to do any task needed, whether it's filling out some spreadsheet or going to a conference or figuring out how to come up with an intelligent database schema. Flexibility also means you don't need to build everything perfectly, that you have the flexibility to leave some things a little less-than-perfect.

Humility to admit you don't know what the best route is, because everything is in the primordial state. It may involve a company-wide pivot, it may involve something much simpler and easier, but admitting you might not know everything is crucial.

Optimism helps you ensure all the things stewing about you don't totally get you down, and that you will find a way out. Some pragmatic thoughts and realism are needed, too, but optimism in the early stages means "sure, I think I can do that" comes to mind rather than "oh gosh that sounds really hard, I think we shouldn't even try."

<comment><USER9> Well said. Being humble is incredibly important. I think of it in the context of having a beginners mind: having an attitude of openness, eagerness, and lack of preconceptions.

I try to remind myself that every person I meet has something to teach me if I'm willing to listen.

</comment></comment><comment><USER10> _A Willingness to Hire Fast and Fire Faster_

I think you need to be really careful with this. Treating employees like fungible commodities doesn't really foster any particular sense of commitment or a strong team. It's okay, I suppose, if you're a solo founder (or a couple of co-founders) and you just hire an endless stream of Upwork freelancers to do various tasks and then dismiss them when they're done (or if they're not performing well enough) - but if you scale beyond that, you actually need to treat people like they're humans.

I'm sure it's well-intentioned by the author, but I've seen people really take this to extremes and behave like total bastards - and they didn't start out being bastards, they just began their journey down the slippery slope of sacrificing common decency to pursue the goal of doing what was, they thought, necessary for their startup to succeed. (When you fire someone on the last day before Christmas because "it was a tough decision, but we're a startup, and we have to make tough decisions", you know you've reached the bottom of that slope.)

<comment><USER11> Yep - _A willingness to hire slower and fire earlier_ would be much better advice.

<comment><USER12> Part of the issue is that there isn't a single correct way to hire somebody. Your hiring process must be able to adapt to a given candidate's circumstances.

For example, say that you met somebody who is already working somewhere, and through the course of networking you understand that they're not happy where they currently are but they're not actively looking for new work either. If you decide that you'd like to poach them, then you must necessarily take a slower approach, since they're not being actively pursued by other companies (since nobody knows that they're on the market) and you want to make sure that they'll be happy at your company and everything else that's an essential part of recruiting.

On the other hand, take a senior engineer who left their last startup because the startup went out of business, and whose skills will be in high demand by many competitors. You have less latitude as to how much time you can take during your hiring process before they get hired out from under you by a competitor. Committing to never hiring quickly is a recipe for filling your ranks with mediocre talent.

<comment><USER11> Common advice is you only have to be good at _either_ hiring slowly _or_ firing early.

Google, for example, was apparently very good at hiring (slowly) - at least in their early days. So it didn't matter that they were (are?) terrible at firing.

Facebook was the opposite AFAIK. It didn't matter that they hired too soon and too many of the 'wrong' people - because they were good at letting them go before it did too much damage to the business.

On balance, I'd rather be good at hiring than firing, as it seems to be much more fair on employees.

</comment></comment></comment></comment><comment><USER13> As someone who works for a small company, but doesn't run it, I'd say resiliency is very important.

The smaller you are, the more you need to be able to ride the waves and expect that things are going to shift out from under you very quickly.

Think Kayak vs Ocean liner.

</comment><comment><USER14> Do such checkpoints really help in the long term? An athlete begins to learn by doing and then watching others. There's no playbook there, he just begins by playing an abridged version of the pro. A highly successful athlete is the one understands his game on his own and not following what the sporting greats before him did. I believe ambitious journeys are a process of self-discovery. If there is anything that helps is learning from the mistakes of successful ones, learning from one's own mistakes and doing one's own best each day. It's a deliberate practice.

<comment><USER15> Have to have checkpoints and goals. Everything you're doing is an experiment to increase revenue/velocity. So measure, frequently and correct.

<comment><USER14> You are right but one doesn't need a checklist or a threshold for skills to be an entrepreneur. My argument on comparison with athletes was that we all learn on the go - no one is perfectly fit for any job until one starts doing it.

</comment></comment></comment><comment><USER16> Its been said time and time again but its being able to get things done, and at a minimum being able to google the right thing. It gets harder from there, but at least thats a start.

<comment> at-fates-hands Agreed.

The one thing where smaller companies can excel is shipping a viable product. Most people I know are willing to give smaller companies a break on a polished product if they know they will see updates in a timely manner. This is something smaller companies can outmatch their larger competitors and will also get them more loyalty from their users.

Shipping a viable product, with timely, dependable updates is crucial.

</comment></comment><comment><USER17> Marketing and sales.

As awful as that sounds to many people it just isn't enough to build an amazing product, write great code, or design something beautiful. You need to be able to get out there and tell people it exists in order to succeed. Without that ability your startup _will_ fail. In fact, in my experience at least, far more companies fail because they couldn't reach customers than fail because they couldn't build something. Building something is the easy bit.

<comment><USER18> I'm a marketer here. If you want some help, reply. I'm happy to grab coffee in the Bay Area and help give early direction to your startup.

<comment><USER19> Hey man, would like to pick ur brain some regarding saas sales, sadly I am not based in the valley or US for that matter, mind if I email you, quick question what is the fastest no bullshit way to validating ur saas idea and seeing if people needed it, I was thinking of driving google ad words traffic to a landing page will that be sufficient?

<comment><USER9> Google AdWords campaign is good way to gauge market demand. Key is to identify granular high intent keywords in your market and setup your campaign to only target those keywords. If you are able to capture a decent amount of exact keyword search impression you can work backwards to get an idea of overall traffic/demand for your product. Keep in mind if you run a short campaign you will have to take into consideration seasonality - you can likely extrapolate this info by analyzing monthly search volume in AdWords keyword tool.

The other important factor is validating keyword intent. You need identify some action that indicates the likelihood of a user paying for your service. If you can measure that and combine this data with search volume, you will be in a good position to assess your products feasibility.

<comment><USER20> I've just run a nice unsuccessful Adwords campaign, and I think my lack of knowledge on how to correctly use Adwords, alongside Analytics is where I'm going wrong. Any chance you know of some decent resources / quick-start guides to help understand Adwords and how to use it?

</comment></comment></comment></comment></comment><comment><USER21> I think "undo" is the wrong metaphor for decision making. It's "safe to fail" or "acceptable risk" or "acceptable loss." You always lose time and opportunity at a minimum, but in exchange for new information if you are willing to pay attention.

</comment><comment><USER22> The obvious one that people seem to forget is persistance. The ability to get from 0 to a company that serves a purpose takes a lot of work and grit.

I think that ultimately a true believe that you can do it is what gets you there. A few people are able to believe that of themself, we see it as eragance, but I think that over time we can build our confidante by building bigger and bigger projects successfully. We can then use those past accomplishment as inspiration every time we have dought about where we are going in the future.

</comment><comment><USER23> Definitely sales, marketing and having understanding of design, tech stacks, etc. I tend to cover all of these areas in my business at Bairmail ([https://bairmail.com](https://bairmail.com))

</comment><comment><USER24> Empathy and listening.

You'll need those customers.

You'll need those for employees.

Get them wrong and you could end up trying to solve the wrong problem(s); perhaps with a team that is not team at all.

Other than that, making realistic sales projections, especially as it relates to your burn rate.

</comment><comment><USER25> A strong sense of ethics.

</comment><comment><USER26> I actually just wrote a bit about this on an interview at brandfetch with regards to browserless.io ([https://blog.brandfetch.io/automating-browsers- with-browserl...](https://blog.brandfetch.io/automating-browsers-with- browserless/), wish I could deeplink the section that's relevant). The TL;DR here is get really good at both your written and verbal communication. You're nothing if you can't properly articulate what you're building, for whom, and respond to critical feedback. This lone skill helps immediately in just about every aspect of running a business: programming, sales, and more. You need to be able to interact with your audience in a way that is concise and clear, and communication skills are how you do that.

Write, speak, blog and keep on doing it!

</comment><comment><USER27> If you are running it you are sales first, management second, tech is third.

You are running a business not a tech company. You better be hustling and filling in the tech gaps later

</comment><comment><USER28> Thanks ChanningAllen for the great work with indiehackers. This kind of content is my favourite to read :)

</comment><comment><USER29> You can learn in two ways, somebody can communicate( share, tell, write) the truth to you, or you can do an experiment. People in a Capitalistic society are rarely taught to do experiments, because what is learned by experiment cannot be controlled. Knowing how, when and why to do the experiment is what separates those who can create from the group that can only do what they are told.

</comment><comment><USER30> Surprisingly, no accounting...

<comment><USER31> The accounting profession exists, precisely because you need to get it right and successful founders don't have the time to be wasting their time on it.

Trust me on this: don't think you can survive the tax system on your own. Hire an accountant or bookkeeper.

</comment></comment><comment><USER32> Ministry of Testing link has the wrong url.

</comment><comment><USER32> Ministry of Testing has the wrong url.

</comment><comment><USER33> the skill of shamelessly shilling for yourself on HN, Reddit, Twitter, IH and PH all day long, everyday until you make it.

<comment><USER34> > the skill of shamelessly shilling ... all day long, everyday until you make > it.

It's one of the most important comments in the thread.

Not only is it an acquired skill (selling), it's bonded to an extraordinarily valuable character trait: perseverance.

A lot of people can't do the necessary sales to drive their product/platform/service because they either can't absorb the hits from doors being constantly shut in their face (hearing _no_ all day long, or worse), or they feel shame from pushing the thing on other people (most of whom do not care and don't want to hear it and do not want you wasting their time, and certainly initially that will all be true).

Promoting is selling. Selling is promoting.

The best sales people are shameless. Not in the sense that they're abusive, rather, in the sense that they'll push their offering to every corner of the globe as necessary, getting 99 no answers to get to that one yes answer. Being told no a thousand times feels very shameful, low and hurtful to most people and they can't handle it.

Promoting your thing, is always about selling. Shilling is nothing more than the task of selling being categorized as a disparaged craft.

<comment><USER35> This reply resonates so much with me. I think it takes years of experience to understand something like this (at least it took me a long time).

I too started from this thinking that promoting is shilling, but it's not. Every successful company in the world does it and there is absolutely nothing wrong with promoting your product or yourself as long as you're not breaking the rules.

I think it's the part of geek culture that misunderstands selling as shilling, which is probably the reason why so many good but small startups fail. They just don't sell enough.

It's the same ideology that charging for a product or service is bad somehow. I remember that a blog that reviewed a website of mine (a movie making software in 2007) was all gaga over the product but as soon as we went from free to paid, it put us in a special section called "website hall of shame". Just because we decided to charge something for a product which users were making money off.

I takes a lot of skill to sell, get rejected and hear 99 Nos for that single Yes and sometimes that's the only thing missing between a win and a loss.

</comment></comment></comment><comment><USER36> Money.</comment>


Women at Facebook were ordered not to wear 'distracting' clothing, says book - <AUTHOR> http://www.telegraph.co.uk/technology/2016/07/01/women-at-facebook-were-ordered-not-to-wear-distracting-clothing/ <comment><USER2> Wow this article is a mess. Launching into speeches about clothing is probably a bad idea. If done on a regular basis, it can make people feel self-conscious and judged all the time. But pulling an individual aside for "almost laughably inappropriate" clothes seems like a reasonable thing to do.

I have to say I don't understand the kitten thing. Is it just that the pun was in bad taste?

It doesn't say which incident prompted the vandalism complaints, but I remember people crossing out "Black Lives Matter" which is, let's say, questionable. This post was flagged dead on HN [https://techcrunch.com/2016/02/25/mark-zuckerberg-asks- emplo...](https://techcrunch.com/2016/02/25/mark-zuckerberg-asks-employees-to- stop-crossing-out-black-lives-matter-on-facebooks-walls/?ncid=rss) Even if it wasn't that incident, I find it very plausible that they were vandalized on other occasions. It's also possible that Zuck overreacted, but the article doesn't really support that.

</comment><comment><USER3> Let's pause on the details, look at the language. "Distracting" clothing? This is the definition of victim blaming. "I can't work because she is making me stare at her butt, and it is her choice to wear that outfit." "She was asking for it."

If you're a dude or a bro, before you down-vote this, ask yourself whether you would applaud or criticize the same person for wearing that outfit to Wholefoods.

The tech industry is perpetually patting itself on the back for have such innovative workplace policies. Many actions or dispositions condoned or encouraged by these policies would get you fired at a Wall Street bank. So, one can not claim that one should know better than to wear these outfits. The entire point of this "new workplace", which is by definition and design not well defined, is to _not dictate the individual_ in so far a his or her personal choices, but simply to create an atmosphere where each individual is productive.

You ever tried working in an office with a full bar on tap, twenty feet away? How about in an office that has two ping pong tables nearby in the open space floor plan? _That_ is distracting. That is also stereotypical Silicon Valley. But hey, I put on headphones, ignored my strong desire to get bent, and was productive.

If you're a woman, please chime in here. This is, to my ears, victim blaming. And this comment will no doubt instantly begin garnering many, many down- votes. So, please, risk a few karma. But, I'm a guy, so what do I know?

I know that tomorrow I can go into work in shorts small enough to show a bit of butt and people will think it's funny, and we'll all sit down at our screens and get back to work. Because, in our culture, I'm not objectified sexually, I am the patriarch, and I control all thing, except that thing in my drawers.

<comment><USER4> > ask yourself whether you would applaud or criticize the same person for > wearing that outfit to Wholefoods.

My criticism would persist because presumably the same person wears that outfit to Wholefoods for the same reason: garnering attention.

Wearing baggy cotton trousers and a grubby, loose t-shirt looks scruffy in the workplace or Wholefoods but has a purpose: comfort.

Wearing Daisy Duke shorts to the workplace or Wholefoods has a purpose: garnering attention.

Anything that is designed or intended to attract attention is by definition a distraction. That's where the differentiation arises. It's irrelevant whether that attention is inappropriate due to objectification, the point is that the mental effort to overcome the context-shift is distractive.

<comment><USER2> I think you're overestimating how much women are doing for other people (especially men) and what they are doing just because they like it.

</comment></comment></comment><comment><USER5> So kittens are a metaphor for women? I never knew that. I know sushi in German sounds a little like pussy [Muschi/Sushi], so maybe next time don't use kittens, use pictures of sushi -not many will get it. I mean, if they'd chosen flowers, or dogs, almost anything, one can put alternate meanings to them.

But really, who'd make that connection, given the kitten meme? I think it was over thinking on her part.

That said, maybe have everyone adopt an Asian style ethic and dress drab for work. It's work, it's not impress your high school friends with new clothes at the beginning of the school year.

<comment><USER2> Rubenstein knew about the pun, and confirmed it once Sandberg called him out on it. Seems working with his team, she was able to understand how their minds worked and knew exactly what they had done.

<comment><USER5> I get it, but the thing is almost anything can be a stand in for penises or vaginas. So it's kind of fruitless to try and abate these things.

<comment><USER6> Well, you could just use random photos instead of falling back on locker room euphemisms.

But maybe that's expecting too much.

That said, I have trouble believing this kind of behavior is unique to Facebook, or even unique to tech.

<comment><USER2> I think the real issue was not having any women on the team, which allows this kind of behavior to continue constatnly and in the open. And you can't use random photos - the tech has to learn some kind of category of thing to recognize.

[Edit: I mean if it was a one-off thing it could have been funny, but if it's yet another reminder that the company is basically a locker room, that's insulting.]

<comment><USER5> No women is an issue --but being on a team with women, I know they have similar tendencies to men. They also like puns and also have a sense of bathroom humor too --not that that kind of humor is something one might like to leak into the work environment, but that's what we get from today's culture

In addition, in some way, this kind behavior, whether man or woman, can be a kind of subversive way to exert self and flaunt power --i.e. "I can get away with this childishness." and "I can get away with reprimanding/shaming you". Aka territorial pissings.

</comment></comment></comment></comment></comment></comment><comment><USER7> What other people wear shouldn't affect your performance. Now if they haven't showered in a month it becomes a different story.

</comment><comment><USER8> Being talked to / disciplined for booty shorts and leaking upcoming features seems fairly appropriate.

<comment><USER9> Thank FSM I work at home. I can wear booty shorts that match my beard to work every day.

<comment><USER10> Wait, you wear clothes while working remotely? I only put on a shirt for video conferencing.</comment></comment></comment>


Attack of the vapor tablet « Observatory - <AUTHOR> http://kensegall.com/blog/2011/01/attack-of-the-vapor-tablet/ <comment><USER2> This vapour marketing campaign feels like it is being steered by committee. Every single decision seems to be the outcome of a negotiation between various factions in marketing, corporate sales, consumer products, engineering, and so on, right down to the OS being a placeholder and the name being MIA.

This is anything but an Apple product.</comment>


Maybe It's Not YouTube's Algorithm That Radicalizes People - <AUTHOR> https://www.wired.com/story/not-youtubes-algorithm-radicalizes-people/ <comment><USER2> The article does not define radicalization.

If kids have the same opinions on social issues like immigration, race, gender, etc. as their grandfathers or great-grandfathers, is it really radicalization? Or just a political cycle swinging back? The same logic applies across space as well: are you a radical, if your opinion on those same topics is roughly the same as the ~7 billion people in the world who are not yuppies living in western metropolitan areas?

</comment><comment><USER3> Wouldn't be surprising if it was demand related. There's a bit of a divide between younger conservatives/media and the main conservative media when it comes to what values they support, and the values of the former often aren't accepted by the latter.

So for the former, a YouTuber whose politics involve both right wing views on things like immigration and more libertarian views on things like drugs and media censorship is likely more attractive than something like Fox News or the Daily Mail, which appeals very heavily to old school 'family values' moral crusaders and religious folk.</comment>


Ask YC: What do you spend on health insurance? - <AUTHOR>

I'm on Aetna's individual plan. They seem to increase premiums around $50/month every 6mos. I don't think I should be spending $300/month on health insurance (I haven't been to see a doc in over a year, no other issues, etc).<p>Q: Is this high/low?
Q: Who do you use and what do you pay? <comment><USER2> i recently stopped paying for health insurance, for me, it was $1800 a year. $5k deductible, and I got the healthy living discount.

In one of my first jobs out of college I worked for a medical billing company, here is what we learned, while writing the software.

I am not sure on the math, but I think you are more likely to come out ahead when you buy blackjack insurance, than you are in the US when you buy health insurance. HSA's are great and on average most Americans would come out ahead over their life expectancy. And I am almost positive, that if more than 50% of the US paid for healthcare without going through an insurance company, health care would become much more affordable.

The health insurance industry is broken in this country, more than 50% of claims do not get paid, so doctors jack up the rates 50% to cover the failed claims process. Not to mention the frivolous law suits, and hospitals adding crazy crap to the bill of better insurance companies to pay for care. The whole system is more corrupt than the Mob.

HSA's offer the advantage to save and invest that money tax free, so that you can put the buying power back in your hands. Since its your money and you want to save it for old age, you will have the option to opt out of care that is extra. If you feel fine, you go home. Hospitals will need to get better at explaining your risks, and the decision are put in your hands.

Did you know that if you talk to a doc, most will give you a discount on the procedure if you pay for it out of pocket and up front? We saw bills go through that were at 25% of a docs normal billing rate when people paid out of pocket and up front. An example, might be if you had a broken arm, instead of your insurance company paying $1200 for casting, and x-rays, you could walk in and pay $300-600 if you payed up front. The down side to this, for people who do this and have insurance, come in that it does not go against their deductible, so a future incident that year would need to be covered again out of pocket.

In a previous company I started, I set up a $5k HSA for each of my employees, and then they only had a $5k deductible. It was up to them to control costs, and health insurance with a $5k is pretty cheap, if you know how to shop for it.

</comment><comment><USER3> I pay nothing, and never have.

Of course I don't live in the US. And btw. I think you should get your health system fixed over there, it's broken.

<comment><USER4> So you don't pay taxes?

<comment><USER3> Per capita health expenditure in the US is $5711, in Denmark (where I'm from) it's $2743. And the healthcare here is excellent.

Source: OECD

<comment><USER5> Interestingly, in a different post here I compute our (Massachusetts, USA) family's per-capita expenditure for health insurance as $5142. That's exclusive of the percentage of our income that goes toward health care via taxes: 6.6% of every dollar of income, for Massachusetts families in the 25% federal bracket.

Sometimes it's almost eerie how well statistics work.

Moral: Believe the OECD -- Our health care is _incredibly expensive._

<comment><USER6> Massachusetts now has student, employee, employer, self-employed, and low income earner insurance for free or at large subsidy, between the Commonwealth Connector and the Insurance Partnership programs.

</comment></comment></comment></comment></comment><comment><USER7> I joke that I have "American Health Insurance": don't get sick, and damn-sure don't get hurt.

No health insurance, can't afford it now. Tend to be pretty healthy and heal well, so so far the gamble is working out.

That said, the financial issues surrounding health care in the U.S. are disgraceful, and I don't understand how anyone in an industrialized first- world country could look at it and say, "Yep, looks fine to me."

</comment><comment><USER8> "Nothing": I live in Austria.

Well, clearly it's paid for somehow, but I don't pay for it directly. It is important to understand that it's not "free". All told though, I'm happier than with the system in the US.

Indeed, I went to the doctor today, had to wait 15 minutes, and got some antibiotics and other stuff to clear up my cold, all for 18 Euro.

</comment><comment><USER9> We pay about $270/mo for the three of us on an HSA plan (in Texas). $5k deductible, 100% coinsurance after that, HSA approved.

<comment><AUTHOR> ah, HSA = Health Savings Account (<http://en.wikipedia.org/wiki/Health_savings_account>)

</comment></comment><comment><USER10> We got our health insurance through the National Association of Self-Employed <http://nase.org/> \- paying approx $300/month for my wife and myself.

</comment><comment><USER11> 150 for aetna in texas

whats your deductable.. I think mine is 1k

I think rates also vary depending on location / age

<comment><USER12> Quick Disclaimer, I work tangentially in the health insurance industry. That being said, I know what variables factor in to a rate:

1\. Deductible

2\. Age

3\. Whether or not you use tobacco - This includes chew.

4\. Your gender makes a difference.

5\. Occasionally, your BMI makes a difference. But most often, it's age + tobacco use that makes the largest difference.

Insurance rates will also change by your location. Say you had a twin who lived 1 city over; you may get different rates depending on your location.

Occasionally, a rate quote will be different due to the time of year that you're asking for your effective date. That seems to differ between carriers, and not a lot of carriers do this type of discounting or loading.

Hope that helps.

</comment></comment><comment><USER13> In South Africa I'm paying R850, which is roughly $100. This is only for what is called a "hospital plan," which means that if I'm in an accident that requires hospitalisation that I'll be taken to a private hospital and not exposed to the national health care system. Which is rather scary.

</comment><comment><USER14> About half of the US population is currently getting govt healthcare at a per- capita cost that is basically the same as the per-capita cost of the folks getting private healthcare.

If govt healthcare in the US will be cheaper than private, why isn't it now?

Note to single-payer advocates. Nothing is stopping you from fixing the existing US govt healthcare system to provide the promised benefits. When you do, then all you have to do to kill the private system is open up the fixed public system at cost. Of course, that assumes that you can actually make govt healthcare work as you've asserted, but surely that's no big deal....

</comment><comment><USER15> When I was living in Seattle and self-employed, I was paying $155 / mo for Regence Blue Shield's best plan ($500 deductible & 80% coverage) [this was Jan 2007]

After a year, it increased $50. I left the insurance a few months ago, so no clue what will happen next year.

Before Regence, I was paying for COBRA, which was incredibly expensive ($430 / mo) -- this was because I was traveling abroad in places with weird diseases, and I didn't feel like taking a chance. I only did this for 6 months or so.

EDIT: Forgot to mention. I am/was 28, healthy, non-smoker. No kids.

</comment><comment><USER16> I pay $486/mo for myself to be covered under the most comprehensive plan available from BC/BS. Is it worth it? Not really, but co-pays are cheap and prescriptions are almost free.

</comment><comment><USER17> $120/month with an HSA and a $1800 max out of pocket every year. found it through <http://www.ehealthinsurance.com>

</comment><comment><USER18> I pay around $700-800/month for health/vision/dental. My employer takes care of around $400 of it, so out of pocket I pay around $300-400. BTW this is for me and my wife.

</comment><comment><USER19> $172 per month (single person coverage) with a $2000 deductible (routine physicals, dental, eye care covered with small co-pay).

I'm in Massachusetts and use FCHP. The premiums for me have been going down a few dollars every year, which, come to think of it, is pretty remarkable. :-)

</comment><comment><USER20> Healthy 20yr Old M.

115/mo + 1500 deductible. It's an HSA plan, with 100% covered after the deductible.

</comment><comment><USER21> Between the employer and my own contributions (about 50/50) costs are 5k USD/year for health and dental. I have a 1200 deductible that is paid by my employer 100%. I see a couple of specialists and can see anyone at any time. That embodies my appreciation for the US system.

</comment><comment><USER22> Just get high deductible health care with an HSA, I pay about $80/mo and then however much I want to put in my account(which I keep!). Plus this does not keep me chained to a particular employer and I am free to change jobs without fear of losing health care coverage

</comment><comment><USER23> I pay $1232 per month, which includes wife and 2 kids, for pretty top end Blue Cross insurance in Massachusetts. No dental. I'm self-employed and this is through COBRA from a previous job. I suspect I could save by shopping around and going for a high deductible.

</comment><comment><USER24> I spend $125 a month on aetna's individual plan, low copays / deductibles

</comment><comment><USER25> I live in the USA. My employer provides my health insurance free of charge. I pay $12 / week for my spouse though.</comment>


The Bash Hackers Wiki - <AUTHOR> https://wiki.bash-hackers.org/ <comment><USER2> Bash was the first scripting language I ever got "good" with.

(I put "good" in quotes because while I could get basically anything done, I promise that it was not good looking).

However, I feel like it left me a bit brain damaged, I still think in terms of quotation quirks and "sub-shells" even in proper languages such as python or rust.

It also left me a bit weird when thinking about concurrency, because I never consider IPC, I just think in terms of jobs+join so my code ends up performing as a series of bottlenecks as everything rejoins the main thread.

That said; getting good with bash has helped my career a lot as a sysadmin; but maybe this is part of why sysadmins struggle with real programming.

<comment><USER3> I've come to use more and more Python for tasks I would have used Shell in the past. Because of weird syntax with anything but simple variables or endless fiddling with quoting.

You can get a lot done quite easily and concise in Python 3, for instance with the pathlib module that has methods for recursive globbing and stuff like that.

[https://docs.python.org/3.7/library/pathlib.html](https://docs.python.org/3.7/library/pathlib.html)

<comment><USER4> The nice thing about Bash which can obviously not be said about Python is that Bash scripts will keep working (assuming whatever they call is also there of course) since Bash goes out of its way to preserve backwards compatibility. Considering its legacy, Bash can run scripts more than a decade before Python even existed.

The only other scripting language i know of that has similar backwards compatibility is Tcl. Perhaps Perl too (ignoring Perl 6 that was renamed to something else again due to it being practically a different language).

<comment><USER5> I guess it's the trade off between backwards compatibility and readability/correctness/maintainability. Both languages will have technical debt overtime. In my opinion, I would much rather have to rarely update python scripts in exchange to for peace of mind that I can fix/update the script as need be. In my experience, *sh scripts can be fragile and hard to ensure correctness.

<comment><USER6> Having migrated something recently from python2 to python3, I'll take bash. I actually ported two of the three scripts to bash, and the third one I reluctantly moved to python3 (I needed python-pil). String handling in python3 in my opinion is a tire fire compared to bash.

</comment></comment></comment></comment></comment><comment><USER7> It would be remiss to talk of bash and not bring up Greg's Bash Wiki ([https://mywiki.wooledge.org/BashFAQ](https://mywiki.wooledge.org/BashFAQ))

<comment><USER8> This and the bash man page are all I need in general.

</comment></comment><comment><USER9> Another great reference is [https://github.com/dylanaraps/pure-bash- bible](https://github.com/dylanaraps/pure-bash-bible)

</comment><comment><USER10> I recently came across this static site generator written in Bash: [https://github.com/hmngwy/jenny](https://github.com/hmngwy/jenny)

It's kind of cool, but what makes it really nice is that it's going to work on any computer I use, there are no concerns about dependencies, and no concerns about future compatibility. (Obviously not 100%, but I'm not worried in the least.)

</comment><comment><USER11> It seems like there is potential for making bash faster.

1\. JIT compilation, caching and invalidating on updated source files

3\. Rearchitecting similar a-la busybox all of coreutils, sharutils, grep, awk and sed as internal components to avoid forking as much as possible. Tool symlinks back to itself for compatibility.

4\. Rearchitecting to simulate sub-shells with threads and local contexts, rather than globals/singular locals. With formally-proven safety methodologies, there only needs to be one "shell" process running, a server. All other invocations become thread children if called directly or interact as a client if exec()ed. Subshells become just lightweight threads with Copy-On- Write contexts. No more shell fork-bombs, scripts get crazy fast and reduce first PID.

<comment><USER12> If you really care about speed, you probably shouldn't be using Bash.

<comment><USER13> Also true of Python, but I almost never hear people say that. Strange.

<comment><USER12> Python's a bit faster than Bash.

<comment><USER14> For what? Is it faster than (g)awk? How about sed? How about dd? How about any of the thousands of tools in userspace that you wrap in bash and are faster than python at the same task? Use the right tool is being lost in the 'you are too stupid to make a good decision, do it this way' generation.

<comment><USER12> It depends, of course! But usually the issue with shell scripts is that they create many new processes, which has high overhead. In the instances you're spending more time in dd than bash, in Python you're probably inside an in- process memcpy.

</comment></comment></comment></comment></comment></comment><comment><USER15> I like bash, but I sort of have a rule...

If I am thinking of using advanced features of bash, or I'm over-using grep/sed/awk within the script.... switch to python (formerly perl)

Mostly it's a win with respect to quoting, path manipulation and proper data structures.

<comment><USER16> Python's major glaring problem as a systems language is dealing with processes. It is just verbose, ticky and annoying.

I have my other issues with it as a systems language that are more idiosyncratic, but for replacing bash, process management is just way too much hassle.

<comment><USER17> 99.9% of all process management can be done with oneliner subprocess.check_output. Not verbose at all and much safer.

Biggest mistake people do is bringing bash idioms into python, like trying to pipe the output through head/cut/tail/grep/sed instead of just using string operators like endswith/in/startswith/re. If you do that then process managment will be more verbose, but it is in bash also unless you ignore decent error handling like $PIPEFAIL[0] which many many scripts actually do unknowingly. For those other 0.1% of the places where you actually need a pipe then just accept that you have to write 4 lines instead of 2, you will save thousands of lines in other places. For parallel running processes &, jobs, nohup and wait in bash isn't exactly convenient either if you are interested in the results, so there it's a tie vs POpen if i'm being generous.

<comment><USER14> Do you really think the python popen() workalike with optional shell inclusion is better than running in a shell? More secure perhaps? Easier to read? I forced a developer from my team who would not stop using subprocess calls (including $SHELL) in random new python scripts with hard coded arguments instead of writing a single shell script that could be reused. subprocess is a tarpit and is more misused than any other python function.

</comment></comment></comment></comment><comment><USER18> Clicking around, I am glad to see portability to non-bash shells covered in some topics, despite the name of the site.

It seems to me like sometime in the last 10-15 years, what we used to call "shell scripting" became "bash" in popular discourse. I myself learned to write shell scripts in times and places where bash was the most popular default, but I never thought of it as writing intentional bashisms, but a set of skills applicable to multiple possible implementations, so I find that shift in jargon a little disappointing or incorrect.

<comment><USER19> An even more important point since the two mainstream desktop Unixen (Mac OS and Ubuntu) ship with zsh and dash, resp., by default.

<comment><USER20> dash is shipped as a replacement for the Bourne shell, not bash. Thus Ubuntu does also ship bash too.

Alpine doesn't have bash installed. It alsonpretty common not to have bash as part of the base image on non-Linux systems too. You've already mentioned macOS but the same is true for many of the BSDs.

</comment></comment></comment><comment><USER21> This, Greg's wiki and #bash@freenode is how I became a bash nazi to my peers.

Just hanging out in #bash@freenode you learn so much best practice. Like sub- shell quotation, variable capitalization, parameter expansion, read usage and much more.

</comment><comment><USER22> I clicked the config article and it reminded me of 2 major pet peeves:

1) No good way to store config values, nor ones that can be shared with other languages. I might have a set of python applications running in the cloud and a shell script to deploy them, and guess what, I'd like them to share the same config, so I don't have to keep to update resource names in 2 places.

2) No simple way of templating files. A script that would replace {var} with value of $var in a file seems like an obvious thing for shell to do for you, but I haven't found a good way of doing it.

<comment><USER20> 1) There's a few ways you could skin this proverbial cat:

option 1:

A bit python specific but you can use python-dotenv[1] for Python; and `source` that file in bash for shell support.

option 2:

Alternatively you could just pass environmental variables between applications (that's kind of the point of them).

option 3:

You could still use a dot env file and import that in other languages as TOML. This is a really nasty hacky way of doing things though because you'd need to read that file in, then prefix a key at the start of the file (eg "[vars]") to adhere to the TOML standard before you could run it through a TOML parser. I wouldn't personally recommend this approach but it would work as a lazy solution.

2) Sure there is, `envsubst`[2]

hello.tmpl:

        This is an exmaple
        Hello, ${HELLO_NAME}!

hello.env:

        HELLO_NAME="wodenokoto"

hello.sh:

        #!/bin/sh

        source hello.env
        envsubst < hello.tmpl > hello.txt

Run hello.sh and it will create a file called hello.txt:

        This is an exmaple
        Hello, wodenokoto!

One caveat is that this is part of the gettext package which doesn't always ship with every distro. But it's a pretty small package (small enough that I don't have any issue installing it into a docker container for one CI pipeline).

[1] [https://pypi.org/project/python-dotenv/](https://pypi.org/project/python- dotenv/)

[2] [https://linux.die.net/man/1/envsubst](https://linux.die.net/man/1/envsubst)

<comment><USER22> > just pass environmental variables between applications

That would require me to 1) somehow ensure that shell is sourcing the the environment variables from a file, and 2) we are back to all the hackery mentioned in the article [1]

[1] [https://wiki.bash-hackers.org/howto/conffile](https://wiki.bash- hackers.org/howto/conffile)

<comment><USER20> You don't need a shell script to initialise an application with specific environmental variables. systemd and docker will both do this (and both supports the same env file too). AWS lambda supports environmental variables, so does most CI/CD solutions. It's a pretty standard way to do things in UNIX/Linux. In fact if you're having to resort to "hacks" to get environmental variables loaded then that might be a symptom of a bigger problem with your orchestration rather than an issue with Bash / Python.

Also that was just one of three options I listed; and there will be a plethora of other alternatives I've not mentioned too.

<comment><USER22> Thank you for your patience in answering my woes.

You've given me a lot of food for thought and some good ideas on how to attack some of my problems.

</comment></comment></comment></comment></comment><comment><USER23> This website has been my go-to reference when hacking together Bash scripts. I can never remember the exact syntax of parameter substitution, and how do I do arithmetic substitution again? What's all the 'set -o' options?

I've since switched to Zsh, and while its documentation is extensive, it's basically one fat book and is far from being as accessible or navigable at this excellent wiki.

</comment><comment><USER24> [https://xkcd.com/927](https://xkcd.com/927)

Is there room for a lightweight scriptable language that takes the place of, say, bash/zsh/korn/fish shell scripts?

Please don't say perl/python or sed/awk.

<comment><USER25> That's what Oil is, except it also runs bash scripts and lets you upgrade seamlessly.

That is, bin/oil is the same as bin/osh with a bunch of shell options on, including 'shopt -s simple_word_eval' which eliminates a lot of the quoting hassles.

You can try it now, but some things will be cut out after optimizing the prototype interpreter (in the name of time):

 _You Can Now Try the Oil Language_ [http://www.oilshell.org/blog/2019/10/04.html](http://www.oilshell.org/blog/2019/10/04.html)

I'm looking for help too: [http://www.oilshell.org/blog/2019/12/09.html#help- wanted](http://www.oilshell.org/blog/2019/12/09.html#help-wanted)

\----

Also, I think there is more room than ever, because both Python 3 and Perl 6/Raku are worse for shell-like tasks than their predecessors! Mainly because of startup time and the string abstaction.

We discussed that a couple weeks ago here, and I think it's on the blog somewhere too:

[https://news.ycombinator.com/item?id=22156151](https://news.ycombinator.com/item?id=22156151)

<comment><USER26> > Python 3 and Perl 6/Raku are worse for shell-like tasks than their > predecessors! Mainly because of startup time and the string abstaction

Startup time can always be better, agree. But full support for Unicode _is_ needed in this day and age, and that brings overhead, whichever way you do that, and especially so if you want to do it 100% correctly. If you're still living in an ASCII world, then by all means, go for it.

Additionally, in this world of source version control, and virtually unlimited diskspace for source-code, I think using scripts, rather than one-liners, will help better in maintainability rather than using one-liners.

<comment><USER25> Oil has better Unicode support than Python 2 or 3 for shell-like tasks, because of the way file systems, libc, and the kernel work.

Explained here:

[http://www.oilshell.org/blog/2018/03/04.html#faq](http://www.oilshell.org/blog/2018/03/04.html#faq)

which links:

[http://lucumr.pocoo.org/2014/1/9/ucs-vs- utf8/](http://lucumr.pocoo.org/2014/1/9/ucs-vs-utf8/) (by Armin Ronacher)

The summary is that there are two kinds of Unicode support:

\- UTF-8 based: Go, Rust, and Oil (and Perl 5 it seems, not sure about Raku)

\- array-of-codepoint based: bash/zsh/libc, Python, Java, JavaScript, Windows (JavaScript notably requires surrogate pairs, Python used to have build time configuration, now has complex storage heuristics, etc.)

This isn't a theoretical problem -- the Unicode problems in the other comment thread I linked are real and show up in practice.

<comment><USER27> Perl (5) is array-of-codepoint based, at the logical level. Those codepoints might be internally stored as their encoded-to-UTF-8-bytes, or they might not, but this does not affect the usage of the string.

Many don't really understand the string model (because many don't really understand character encoding) but it comes down to: all input and output is going to be bytes, which by default is stored as the codepoints sharing the ordinals of those bytes, and there are several mechanisms by which you can manually or automatically decode/encode those byte ordinals to the represented characters; for most text processing, you do this on STDIN and STDOUT.</comment></comment></comment></comment></comment>


GNU Compiler Collection 4.6.0 released with Go programming language support - <AUTHOR> http://gcc.gnu.org/gcc-4.6/

<comment><USER3> Since Go is still in development and with updates being released regularly, does this mean that the GCC GO compiler implements a specific version of Go and will be out of date soon?

<comment><USER4> > does this mean that the GCC GO compiler implements a specific version of Go > and will be out of date soon?

Unless the gcc team is prescient, I don't see how any other conclusion can be drawn.

</comment></comment><comment> old-gregg Does this mean that Go will finally support shared libraries as a compilation target?

</comment><comment><USER5> From the GCC 4.6.0 release notes:

 _> Support for the Go programming language has been added to GCC. It is not enabled by default when you build GCC; use the --enable-languages configure option to build it. The driver program for compiling Go code is gccgo.

>Go is currently known to work on GNU/Linux and RTEMS. Solaris support is in progress. It may or may not work on other platforms._

</comment><comment><USER6> Anyone know if goroutines are still implemented as native POSIX threads in gccgo?

<comment><USER7> Yes and no. They do use a thread pool of OS threads, but they don't map 1-to-1 to goroutines.

<comment><USER8> That's true for the gc compilers, but not for gccgo (yet, anyway). Each go statement in gccgo creates a pthread.

</comment></comment></comment><comment><USER9> The link-time optimizations seem useful - not only can the output code run faster, but the compilation is in parallel. Has anyone tried it? g++ is a fast compiler and it's easy to parallelize on files, but making the linker faster/parallel sounds like a big deal.

<comment><USER10> That's not what LTO is about. Most optimisations up to this point do not cross function boundaries, or file boundaries if you are lucky. This does better, allowing optimisations to be applied across the whole program.

<comment><USER11> Alternatively you can go "amalgated" (luajit, juce, and other projects do it). It's also called "unity" build (in game developer slang).

It's not the same, because two .cpp files concatenated into one should work as they were before being split (so careful on reusing static variable names, macro defines, etc.)

Also "amalgated", "unity" builds tend to make the compiler use way more memory, and reduces the possibility of spreading the compilation across many processes. Granted that latter thing is a bit of a problem by itself - <USER2> example MSVC's LTCG (Link-Time Code Generation - a whole program optimization) just produces some intermediate code in the .obj files, and maybe produces it way faster than generating real cpu code.... Then the linker takes it all and has to produce it (significantly slower linker times).

With amalgated builds, at least you can divide your big project into 8 or 16 files, that compile on 8-16 processes.

(JUCE splits it in four for example)

</comment></comment></comment><comment><USER12> I wonder if this opens a path for Windows support for Go (if only through Cygwin). I'd love to try Go out but the projects I have in mind need to be able to run (somehow) on Windows.

</comment><comment><USER13> > _A number of Objective-C 2.0 features and extensions are now supported by > GCC. These features are enabled by default; you can disable them by using > the new -fobjc-std=objc1 command-line option._

This seems like a much more important announcement. Apple had been maintaining these features in their own branch of GCC for years and years, so it's noteworthy to see them finally merged/added to the official GCC distribution.

<comment><USER14> Meanwhile Apple is moving away to LLVM and Clang.

<comment><USER15> So far I've had nothing but positive experiences with the LLVM and Clang integration in XCode 4.0. After almost ten years of relying on GCC this feels almost like cheating on a spouse.</comment></comment></comment>


China President Xi Jinping extols the virtues of blockchain technology - <AUTHOR> https://decrypt.co/10751/china-president-xi-jinping-extols-the-virtues-of-blockchain-technology <comment><USER2> My money's on China. After Libra hearings, they don't stand a chance.

</comment><comment><USER3> Come on U.S.A - pull your finger out.</comment>


Harold "Doc" Edgerton - <AUTHOR> http://edgerton-digital-collections.org/

<comment><AUTHOR> From the home page of the site: The Edgerton Digital Collections project celebrates the spirit of a great pioneer, Harold "Doc" Edgerton, inventor, entrepreneur, explorer and beloved MIT professor. This site is for all who share Doc Edgerton's philosophy of "Work hard. Tell everyone everything you know. Close a deal with a handshake. Have fun!"

The site includes access to all of Doc Edgerton's notebooks, scanned in as PDF's.</comment>


Assholes on Demand - <AUTHOR> http://www.assholesondemand.com

<comment><USER2> I don't like this name, but I could see where this could be very helpful to a shy person. It needs some branding help because it took me too long to figure out what it was.</comment>