Stupid security question on Rails - <AUTHOR>

Is there a way to secure a Rails-deployed app without exposing the source code? <comment><USER2> In terms of deploying an app for a customer without giving the customer source-code level access, then what you need to do is structure in terms of Software as a Service, where the customer is only able to access the application and not the server itself.

As others have pointed out, it might seem like an idea to "obfuscate" the source code, but really this does nothing to protect your application. For one, any obfuscation trick, no matter how obscure, is usually easily undone. Secondly, since Rails depends heavily on the use of eval(), there will be large chunks of raw code in your application even if, theoretically, it could be compiled.

Keep in mind you still have a lot of latitude in how you deploy Software as a Service. You can give your client DB dumps, you can run off your client's DB platform, if they want their data "in house" and not at some untrusted facility.

</comment><comment><USER3> Can you be more specific about the word "secure"?

If you mean, "can I ship customers a Rails app that they themselves run, either on their own servers or an appliance, while keeping them from seeing the source code?", then the answer is "no".

You should be aware that the same answer applies to Python, Perl, Tcl, Java, and C#. Bytecode is trivially decompiled back to readable source code.

<comment><USER4> I think there are pretty good obfuscation tools to provide some degree of protection to C# or Java apps (although I don't remember if they are free). But if you have some proprietary code that you don't want anyone to see the best solution is to run it on your own server and just expose an interface to code that runs on customer machines.

<comment><USER3> Bytecode obfuscation is a speed bump. We do more raw X86 than .NET, and compared to X86 --- which every security consultancy worth its bill rate can handle now --- obfuscated .NET bytecode is a dream. And that's as mature as we get now.

</comment></comment></comment><comment><USER5> Five runs developed a system for packaging and deploy ruby/rails apps without exposing the source. Bruce Williams presented on it at RubyConf2007: <http://rubyconf2007.confreaks.com/d2t2p2_desktop_apps.html>

I don't know what the state of the project is, but it looks like what you wanted.

<comment><USER3> FiveRuns deploys berkdb's with AES-encrypted compressed Ruby source. I have no idea what the point of the encryption is here, because it's a speed bump to someone who wants the source code; the "player" needs the key to run the code, the key sits in memory, as does the decoded source code.

This system looks even easier to deal with than a typical J2EE app; at least with J2EE, I have to fix up all the JAD artifacts.

Beware of systems that offer packaged solutions to hard problems, like the software protection problem.

</comment></comment><comment><USER6> No. If someone has only 15 seconds to get the source code, you might be able to try the encryption mentioned below. Otherwise, it's not possible; if the computer can run the code, the attacker can read the source code.

It's better to just host the application yourself.

</comment><comment><USER7> Well, put it like this. If they're looking at your source code it means they're already _in_ your production server, and they can do pretty much whatever the hell they want anyway :)</comment>


CERN wants to preserve the first website and the experience of surfing it - <AUTHOR> http://www.itworld.com/cloud-computing/374423/cern-wants-us-surf-it-s-1990

<comment><USER2> I remember seeing the web for the first time in a command-line browser. I didn't realize at the time what was about to happen.

<comment><USER3> It seemed like a slick new iteration of Gopher with the capability of inline images (that no one really had yet)

<comment><USER4> That was my reaction, too. What's the big deal? It's just Gopher with graphics.

<comment><USER5> ... and a bit of LaTeX mixed in for good measure.

It'll never catch on.

</comment></comment></comment></comment><comment><USER6> On values at CERN:

"The cost [...] has been evaluated, taking into account realistic labor prices in different countries. The total cost is X (with a western equivalent value of Y)" [where Y>X]

source: LHCb calorimeters : Technical Design Report

ISBN: 9290831693 [http://cdsweb.cern.ch/record/494264](http://cdsweb.cern.ch/record/494264)

Long PR story short: RPC was prevalent, that is how you control(led) your stuff remotely. Like Tim. Today, if you'd ask for a NeXT-like toy, you'd be denied were you an average Eastern (western equivalent). But real westerner asked for it and got one, and put the gopher link address ptr in the reserved field of the text font properties (where things like bold and italics properties are stored) and voilà. You can also hire a cheap student to actually write the web client to be cross platform (its true virtue/value). Thanks to Nicola Pellow, of whom almost nobody knows about. Would the "web" have just ran on NeXT, it would be long extinct, let alone take off. Clicking on text is how you used Oberon or even Genera Document Examiner (perhaps even over the network).

On linking and hypertext: all post-war era stuff is spin. The real stuff comes from Belgium:

For ADD-ers: [http://www.youtube.com/watch?v=qwRN5m64I7Y](http://www.youtube.com/watch?v=qwRN5m64I7Y)

The story: [http://www.archive.org/details/paulotlet](http://www.archive.org/details/paulotlet)

[http://www.boxesandarrows.com/view/forgotten_forefather_paul...](http://www.boxesandarrows.com/view/forgotten_forefather_paul_otlet)

"How should we make it attractive for them [young people] to spend 5,6,7 years in our field, be satisfied, learn about excitement, but finally be qualified to find other possibilities?" \-- H. Schopper

<comment><USER7> _Today, if you 'd ask for a NeXT-like toy, you'd be denied were you an average Eastern (western equivalent)._

What does this phrase mean? I'm a non-native speaker, and I'm honestly struggling to understand what you wrote.

<comment><USER8> This is either very incoherently written, automatically generated or pastiche word salad. It doesn't make any sense to me.

<comment><USER9> It appears to be a copy/paste of word salad from 423 days ago by the same user...

[https://news.ycombinator.com/item?id=4304832](https://news.ycombinator.com/item?id=4304832)

...and 527 days ago...

[https://news.ycombinator.com/item?id=3842382](https://news.ycombinator.com/item?id=3842382)

This user obviously believes this is something very important to communicate. Amazing that it hasn't been edited & improved in that time.

<comment><USER5> Hexapodia as the key insight!

</comment></comment></comment></comment></comment><comment><USER10> Few things on the web MUST be preserved and I think this is one of them. Kudos to CERN for doing whatever they can to make this happen.

<comment><USER6> don't worry, they are doing whatever they can: it is their propaganda lifeline to preserve the narrative.

</comment></comment><comment><USER11> Gotta enjoy the HTTP2 as put forth in [http://info.cern.ch/hypertext/WWW/Protocols/HTTP/HTTP2.html](http://info.cern.ch/hypertext/WWW/Protocols/HTTP/HTTP2.html) and can't help but smirk at the never-ending discussions on DOCTYPE: [http://info.cern.ch/hypertext/WWW/Architecture/Letter_1.html](http://info.cern.ch/hypertext/WWW/Architecture/Letter_1.html)

</comment><comment><USER12> That's how _I_ want to surf, too!

</comment><comment><USER13> Wait, They are trying to remake Lynx?</comment>


Being a first time entrepreneur is like looking for your first job - <AUTHOR> http://getvouched.wordpress.com/

<comment><USER2> How is this different from LinkedIn?

<comment><AUTHOR> LinkedIn is an online rolodex with a job board thrown in. How many people have you recommended on Linked In? How many have recommended you?

The numbers are low, it is a unused feature, it doesn't work.

Vouched has a spin on this feature to make sure it gets used. Sign up and I'll send you an e-mail as soon as we're ready.</comment></comment>


Ask HN: What should I consider as I move into freelancing? - <AUTHOR>

I've never freelanced before but would like to very shortly. There are three things I'm really curious about.
1. How do I set my rate? I assume I consider how good I am and what skills I know, how much I want, and the market rate but I have no clue what those things might amount to.
2. How to get started. I'm assuming I'll get started with Elance, freelancer.com, or a similar site but I really don't know the negatives and positives of each. How else do I go about starting to get work?
3. Everything else. I know there are a lot of things I don't know about this space that are completely unknown to me. I'm more curious about the first two items but I'm fully aware that I'm naive in this sense so open to any thoughts you have to offer here. <comment><USER3> I started freelancing 6 months ago and I'm doing ok. I've made the same amount of money I would have made working a regular job but I only have worked 1/8th the time (billable work anyways).

To answer your questions

1\. Popular opinion here on HN is to charge by day or per project (considering what value you bring to the table). I found it hard to implement so I found a rate that was reasonable for the kind of lifestyle I wanted. This is an exercise you have to do it yourself. For me I figured out what was my necessary expenditure (bills + insurance, what was enough for me to keep myself happy (books,movies,outdoor day/weekend trips etc.). However as soon as I get my head around actually implementing popular HN advice I'm going to follow it.

2\. I started with oDesk and so far have only got 1 project out of it. It was only 3 weeks effort. There is too much competition there and it is hard to stand out AND get good rate. Rest of the work I found through my network. I let everyone know I was freelancing, reached out to everyone I knew and asked if they have any project or any of their friends needed any help.

3\. Following things helped

a. My spouse was working until recently so it was comforting to know we will at least have food on the table and pay mortgage. If you don't have any support I suggest build at least 6 months savings first before jumping in or get a contract first.

b. When I was not working I was either constantly searching for work or working on side projects.

c. I had a pretty good previous work experience to bank on but if you don't have any make sure you have some sort of portfolio to showcase your skillset.

</comment><comment><USER4> 1\. Charge by the hour. Your rate is not high enough. IMO, start at around $100/hour and see where that gets you. Don't fall into the trap of trying to calculate your expenses and divide them down into 40 hours/wk, etc - <USER2> simply doesn't work. What has worked really well for me is asking the question: "How much would I want to get paid to not spend the next hour with my family/dog/whatever is important to you?"

2\. Stay away from oDesk, elance, Freelancer.com, etc. You won't get quality clients that way, and you'll constantly be competing with some guy that only charges $8/hr for "expert" level web development. Gun.io has been very nice for me, and going to networking type events in your area could help too. The majority of my business comes from people that I've met in person at an event like this.

3\. Make absolutely sure that you bill for each and every hour you work. No freebies. You're running a business, not a charity. Get paid before you deliver the final product. Always have a contract. ALWAYS have a contract. In most cases, don't let your clients dictate technical solutions to their problems. They're the client, but you're the expert.

Regarding a contract, you don't necessarily need to know legalese. Putting the terms in writing is adequate. See [https://github.com/cweagans/Contract](https://github.com/cweagans/Contract) for an example. IANAL, YMMV, etc.

<comment><AUTHOR> All great information. I'd have no idea where to start with a contract so thank you for that. And for my rate, I really appreciate that as well. There's no way I'd ever start as "high" as $100 before I read what was said here so that's really good to know.

</comment></comment><comment><USER5> I've been freelancing on-and-off for about 10 years now. It's been a great ride, but you're smart to ask about the pitfalls.

To your questions:

1\. The market sets your rate. For better or worse. You can argue a little up, and a little down. But at the end of the day you can only charge what the market will bear. In many cases however, that might be higher than you expect.

2\. Build your own projects first. Spend a few weeks cranking out side projects and throw them up into a portfolio. Once that's done, start networking. The marketplaces are too commoditized (lowest-bidder type stuff), I'd stay away from there. Just go to business functions, social functions, etc and make sure people know what you do and that you're available. Tell your friends to refer _their_ friends to you. Once you get rolling on your first client, your sales pipeline should be almost entirely referral based. Focus on doing such an amazing job with your first client that they run out and tell 10 people, which gets you 10 more jobs.

3\. It's feast and famine. You'll have 6-figure months, you'll have 0-figure months. You'll need to learn to budget differently than someone on a w2. Save up a lot of "runway" (I'd recommend a year's worth of living expenses). Otherwise you'll find yourself in "salesman" mode when you're not even done with the last client's project yet.

I think the biggest mistake new freelancers make is to just take on any client who shows up. It pays to be picky. You need to "qualify" the lead, just as much as they need to vet you. Only take on clients who have demonstrable ability to pay, are a joy to be around, and see eye-to-eye with you on project direction.

</comment><comment><USER6> My comments are assuming you are U.S. based.

Get clients through friends, co-workers, previous employers and by going out and meeting people and companies. Start a blog or contribute to open source projects etc. That always helps your credibility and also helps you get recognized over time, but it doesn't happen overnight.

1\. In the U.S. most contract placement agencies will charge between $75 and $135/hr per person, except in some of the higher cost locals where it will be more. You are competing against them regardless of what people say, simply because companies will talk to these agencies when looking at projects only requiring one or two people to do over a short period. You compete against them not by lowering your rate, but by offering a solution not a warm body. Overall, I see rates typically from $100-$185/hr in the South East, some try to get $225-250 but reality is I see those people losing deals and/or constantly discounting their rate to get work. Your rate should constantly be going up as you get more experience and successful projects behind you that you can point to, but you'll find the point which it is in balance with the market. Also, discounting your rate is generally a bad idea, don't do it if you can avoid it. A couple of clients have told me before that they think a discounted rate means you know you are overpriced and are just looking for a sucker. Not sure I totally agree, but I don't discount my rate because I never really have a fixed rate, I will vary it by the job, duration etc.

2\. Avoid these sites, unless you are outside the US in a low cost nation where you can live on $1-2k USD/month. Use friends, co-workers and previous employers as a first start and go out and talk to people and companies. We have found work on Craigslist a number of times where companies were looking for a "coder" to write their project. I don't get turned off by poorly written ads, or obviously non-technical people seeking help and will call them up and discuss their needs. I have walked away with $40-70k deals this way when some friends looked at the same ad and said it was a waste of their time to call. Fuck it, call them the worse you find out is the job isn't worth your time but you can still use practice on your sales pitch and interviewing potential clients. I have a client right now that I found on Craigslist and called up, that contract ended up being roughly $60k over the next few months, not bad for less than an hours work searching craigslist and calling him up. Of course it took a couple of weeks to get the contract in place etc, but well worth my time.

3\. There are a ton of things you need to know, get yourself insured, always have a contract with clients, get paid by the hour, day or week. Demand payments be timely and stop working when they aren't. Small clients I make pay weekly or at worst NET 10, medium clients I go NET 10 and up to NET 30 the larger they get. Accept you will get screwed over a few times with clients not paying or paying slow, just learn from it and try not to repeat those mistakes. Set expectations clearly, and avoid clients you feel are going to have unrealistic expectations, no matter how desperate you are. Don't take on more then you can do, it will just piss people off (rightfully), at the same time, don't turn down work, just schedule it for the future when possible. Don't let small clients drag out the project or let scope creep in. Every client will try, but small businesses seem to be the worst, they will call/email you constantly and always want more for free. Don't let people devalue your time by getting your time for free, you don't have to be rude, but make them respect that your time is worth money.</comment>


This Typeface's Letters Are the Average of the World's Handwriting - <AUTHOR> http://www.wired.com/2014/07/this-typefaces-letters-are-the-average-of-the-worlds-handwriting/ <comment><USER2> Why would you have an image with "The quick brown fox" without "jumps over the lazy dog"? The whole point of the phrase is to use every letter.

<comment><USER3> Something suggests it's an attempt to keep the font from being appropriated. Though if it's used, that won't last long. And letterforms _aren 't_ copyright-protected (though the software by which they're derived may be: the basis of font copyrights in software).

</comment></comment><comment><USER4> Reminds me of Averia, a font made by averaging fonts. [http://iotic.com/averia/](http://iotic.com/averia/) [https://news.ycombinator.com/item?id=3877025](https://news.ycombinator.com/item?id=3877025)

<comment><USER5> That's actually a surprisingly-good-looking font.

<comment><USER6> Meh, it looks pretty average.

<comment><USER5> _badum TSSH_

</comment></comment></comment></comment><comment><USER7> With my own handwriting, once described in school as "bovine diarrhea committed to paper" (a rough translation) I have come to admire people's handwriting in a sort of wistful way.

I think a discussion around this post would be incomplete without reference to the font made from Dijkstra's beautiful and clear hand writing. [http://lucacardelli.name/indexartifacts.html](http://lucacardelli.name/indexartifacts.html) (search for Dijkstra) or if you prefer a pdf preview [http://lucacardelli.name/Artifacts/Fonts/Dijkstra.pdf](http://lucacardelli.name/Artifacts/Fonts/Dijkstra.pdf)

I wonder if Ramanujam's handwriting has received similar treatment.

A sidenote: while searching for Dijkstra's font on Google had an experience that had but disappeared from my memory. It has been a while since I have been in a situation where I am unable to google to the the page that I know exists on the web. This is the second time in the week that I felt this, something afoot ? In any case wanted to find the letter to Dijkstra asking for permission to use his handwriting for a font.

<comment><USER8> I wonder how many misunderstandings and frustrations occurred because of that "z" which looks like a "2". Any of my math professors would have marked anything with that 2 wrong.

</comment></comment><comment><USER9> Weirdly, it's only capitals, no numbers or punctuation. Not sure what I would do with such a typeface! Also it's more like an average of the world's finger- painting styles, since you have to draw the letters super big and on a touchscreen. Still, everyone does have their own style, and there are some interesting stats on the "left" of that nearly un-navigable website, letter averages by country or profession and such.

<comment><USER10> Limited typefaces can still be useful for logos or titles/headers. For instance, it's very common for stylized Japanese typefaces to only support a small fraction of common characters.

<comment><USER9> Certainly true. In this case it seems like since it's meant to be an "everyman" font it would be more useful to have it be in lowercase too, and include numerals etc.

I'm guessing they decided writing 26 letters was about the limit of the average attention span online - having to do it twice, along with 0-9 and a basket full of symbols probably would result in lots of incomplete forms.

</comment></comment></comment><comment><USER11> the link to the experiment: [http://theuniversaltypeface.com/home](http://theuniversaltypeface.com/home) \- a download apparently follows in august

</comment><comment><USER12> Does anyone know what kind of algorithm they'd be using to "average" all of the letters? If you look at the I's and J's, you can see that though some people use horizontal crosses, they aren't included in the universal letter. Anyone have any insight here?

<comment><USER13> I haven't seen anything specific about how they are doing it, but I can give you a few guesses as to what common approaches would be.

The most straightforward way to model the shapes themselves is to put some points on each letter in corresponding locations on each letter. Every sample of each letter would need the same number of points, and each point would need to be in roughly the same spatial location on the letter (so, for a letter S, the first point in every sample would be at one end, the last at the other, and the ones between at some kind of identifying landmarks).

Given these collections of sampled curves, the simplest thing to do is to just compute the Euclidean mean, treating each of them as a point in a high- dimensional space. You could go farther and do PCA, giving you not only a mean but modes of variation. Using this you could examine the most common ways in which each letter varies in the population, which can be an interesting thing to study.

What I've described is building a statistical shape model from a boundary point distribution model (PDM) of an object. This is typically done in the context where you want to fit your model to new instances of the object, not just for finding a mean, and are known as Active Shape Models. You can check it out on wikipedia (en.wikipedia.org/wiki/Active_shape_model). Here is one (among many possible choices) describing generally how this is done:

[http://tinyurl.com/nxjwygn](http://tinyurl.com/nxjwygn)

There are other techniques for representing the shapes or computing statistics that can produce better models, both from theoretical and practical points of view, but this is generally the most common and would be my first choice if I was going to do something like this. Of course, they could be doing something much simpler like a simple averaging of the images (assuming the letters are all in roughly the same place) as well.

</comment></comment><comment><USER14> I'm reminded of Kevan Davis' "Smaller Picture" web experiment that has been running since 2002. Using a grid of random bits, readers could choose to vote to flip a bit forming a given letter or picture. You can also view a time- lapse animation. Unfortunately, the letters ("Typophile") are no longer online. :(

[http://kevan.org/smaller.cgi](http://kevan.org/smaller.cgi)

</comment><comment><USER15> It uses your finger though, not the right source material.

</comment><comment><USER16> Wouldn't most people using the Latin alphabet be using cursive?

<comment><USER17> In the US (no clue about the rest of the world) cursive has gone out of style. Some schools don't even teach it anymore.

</comment></comment><comment><USER18> Does this average include all the 6 year olds of the world?

</comment><comment><USER19> Like my buddy Leo, I write in mirror image. Should I...

<comment><USER20> Oh, neat. Are you left handed by any chance? Have you written about that decision/habit anywhere that I could read? It sounds somewhat interesting. e.g. Has it been inconvenient in many situations? Should I assume that that implies that you can read mirror image just as well? Why/at what point did you decide to start doing that?

Sorry if this sounds nosy, but I'm curious as to whether that would help avoid smudging more easily for people who are left handed (which I think I've heard can lead to avoiding certain types of pens?). (I personally am not left handed)

Of course, don't feel obligated to answer.</comment></comment>


Framehole: PageSpeed 6.0 loophole for easy perfect score - <AUTHOR> https://buzz.swarmify.com/how-to-get-a-100-score-on-lighthouse-pagespeed-in-one-easy-step/ <comment><USER2> Actual user metrics will likely negate this in search scoring.

<comment><USER3> Maybe for PageRank. But as long as the Lighthouse score is gameable, we're going to see a lot of web shops use these techniques to appease clients.

<comment><USER2> That's likely. But even an idiot would likely notice the frames loading.

But this will likely not game PageRank unless for very unpopular sites (which don't have enough actual user metrics).

<comment><USER3> Google posted an update saying that the problem is restricted to their local tools, and not PageRank, so that's good.

But many places still use PageSpeed, and I wouldn't bet anything vital on clients noticing iframes.

</comment></comment></comment></comment><comment><AUTHOR> As Google pushes forward with their new Web Vitals, they left one giant hole in how those are being calculated.

</comment><comment><USER3> I'm surprised Google allowed this hack. I wonder how long until they fix it?</comment>


Ask HN: We need a way to discuss political articles here - <AUTHOR> For the first time, I am spending more time on 'New' than on 'Top' here on HN, because there are dozens of very insightful political essays and articles being submitted which are flagged and dead in moments.
I understand we are trying to keep HN tech-centered, but things have reached a point where we all care deeply and wish to discuss ongoing events. I do not wish to see HN continue to exclude politics.
I would prefer to be able to tag those posts as Political, and give users the option to stick to old-fashioned pure HN, tech only, or to include political content for those of us who wish to engage with it. <comment><USER2> I really like the fact, personally, that HN is a place I can come and escape politics. I purposely do not read the mainstream news and havn't for years.

<comment><USER3> Agreed. There are plenty of forums where politics can be discussed. I like that I can come to HN when I want to avoid all of that.

(I'm drawing a line between tech-centered / tech-related "politics" to be different than "general politics". Political issues that directly affect / relate to the tech industry are ("may be") relevant here.)

</comment></comment><comment><USER4> I sort of agree - but on the other hand, the level of politics around right now is overwhelming, and it's nice, going on necessary, to have somewhere that isn't all Trump, all the time. So I wouldn't be particularly happy with just lifting the old-school HN politics discouragement.

A separated HN-for-politics area would seem like a good idea at this point, though. "Show | Ask | Politics | Jobs"?

<comment><USER4> Second thought on this: outrage fatigue, empathy fatigue, and activism fatigue are all real things.

Having places that _aren 't_ politicised may be very important in keeping up resistance to horrible politics and policies beyond a month or so.

</comment></comment><comment><USER5> > I understand we are trying to keep HN tech-centered

A minor nit, but I don't believe that's the intent. I believe the intent is to focus on things that are deeply interesting, rather than things that are likely to trigger flame wars.

</comment><comment><USER6> The problem with mixing politics and business is that you get what Nassim Taleb is calling a 'dictatorship of the most intolerant'. If someone foolishly thinks it's safe to express a mainstream opinion, a minority of radicals will attack relentlessly with intent to destroy that person's career. Conservatives and Christians in academia and Silicon Valley have first-hand experience with this. Like Brendan Eich, we know that we can lose our jobs if we identify our political views. Not because we're in the minority, but because radicals make more noise, and most employers are cowards.

Therefore when liberals, who know their jobs aren't at risk, repeatedly ask that we all talk about politics in a professional forum, it comes across as a _dare_.

</comment><comment><USER7> I think the separation between HN and politics is intentional. In fact, not too long ago they strictly banned _any_ political submissions for a week (although they cancelled it early because nobody could agree on the definition of political).

I think your best bet in the short term is to create a custom subreddit, invite a bunch of people from HN, and see how that goes. Since you have the early momentum from the audience you want you can set up the mods early and set the tone for the future. Later on you can create your own website if reddit becomes problematic.

</comment><comment><USER8> I am very sympathetic to the idea, but the reason the "Show HN" and "Ask HN" sections are valuable is that these posts are overwhelemed in the main view, rather than vice-versa.

An explicit "Politics" section even if excluded from the main feed or included with a large penalty (Like "Jobs") would probably suck the air out of the rest of the site.

A better option might be a separate politics-oriented site, perhaps hosted by a nonpartisan policy-recommending organization (in itself a tall order).

</comment><comment><USER9> Please no politics here. Don't bring dirt here. Please.</comment>


Nginx HTTP Push Module - <AUTHOR> http://pushmodule.slact.net

<comment><USER2> Beep. I wrote this. Questions, comments -- ask away.

<comment><USER3> This looks fantastic. Thanks for writing it.

How would you go about restricting access to channels to a specific user or users? My first take would be to issue an unguessable id upon successful authentication and use this id as the channel id -- a shared secret. Only those who should know the id do know it.

I don't see support for streaming; the connection to the long-polling client is closed after consuming. Are you planning on adding support for streaming new messages as they are published?

<comment><USER3> I just had some time to scan your repository on GitHub and noticed this: [http://github.com/slact/nginx_http_push_module/commit/6823f7...](http://github.com/slact/nginx_http_push_module/commit/6823f7080c29db22f5b3178631031179ee383142)

Though it just looks like a stub for now.

Also, I read the following here: [http://github.com/slact/nginx_http_push_module/issues/unread...](http://github.com/slact/nginx_http_push_module/issues/unreads#issue/20/comment/68601)

"Meanwhile, you can use your application to do the authenticating, and generate ids for already-authenticated clients from a large enough (> 2^128) keyspace for security."

So, there, I did my homework.

</comment></comment></comment><comment><USER4> This blog post explains it better : [http://www.igvita.com/2009/10/21/nginx- comet-low-latency-ser...](http://www.igvita.com/2009/10/21/nginx-comet-low- latency-server-push/)

</comment><comment><USER5> did anyone already do performance tests? I'm especially interested in memory and cpu usage. Any limitations?

<comment><USER2> Everything is pretty much as efficient as vanilla nginx. There are some O(log(n)) lookups, but i've not noticed CPU usage hit anything even remotely suspicious (fixed bugs aside).

Memory usage for long-polling requests is regular nginx usage ("2.5MB for 10K idle connections"), + around a hundred bytes or so per ling-polling requests. A channel eats up about a dozen bytes.

The only limitation that one might run into is the maximum memory allotted for shared messages -- but that's a configurable value.

</comment></comment><comment><USER6> Site isn't working for me, but the github url is <http://github.com/slact/nginx_http_push_module>

</comment><comment><USER6> Site isn't working for me, but the github url is <http://github.com/slact/nginx_http_push_module></comment>


Go and Rust – objects without class - <AUTHOR> https://lwn.net/SubscriberLink/548560/26d15e832d21a483/ <comment><AUTHOR> I've been developing medium-to-large projects in mostly C# over the past two years. One thing about my style that has changed over that course of time is that I almost never use inheritance anymore. When I was in school, it was my primary tool for code reuse, but now I find it conflates solutions to different problems, as well as hampering readability.

My style now is small classes with a few, small methods each and lots of composition. I find it easier to reason about code, separate functionality, and reuse pieces. Also, placing unrelated state in separate classes really discourages a lot of the common mistakes with OOP.

Admittedly I don't do as much reading on the subject as I should. I am probably discovering things that were common knowledge 25 years ago. Maybe this is a common road that developers take. That's fine with me.

Rust's and Go's OOP style appeals to me quite a bit. I have only written small things in those languages, so I'm not exactly well-versed in what larger projects look like. Before reading this article, I wasn't able to put into words what bothered me about the style of inheritance in languages I've used up until now.

<comment><USER2> Same here. I used to look for places to use inheritance but now only inherit from abstract classes, seal everything else by default, and mark all of my fields readonly.

</comment></comment><comment><USER3> The value of Go and Rust, I think, is that they are object-oriented languages that try to avoid conflating classes with types.

If you think of a type as a set of possible values, then a subclass is actually a supertype—a superset of the possible values of its parent class—and likewise a superclass is a subtype. The "is-a" relationship is saying "for all instances I of X, I is an instance of Y" which is essentially the definition of superset. That is what the Liskov Substitution Principle is about.

In C++ and other languages with support for object-oriented programming, a subclass is not necessarily a supertype: virtual functions can throw "I don't make sense in this derived class". And a supertype is not necessarily a subclass: templates offer the benefit of the doubt when it comes to static interfaces.

This mismatch leads, in my experience, to interfaces that are ill-specified at best and buggy at worst—so it's nice to see those issues addressed.

<comment><USER4> I am not sure the issue of "I don't make sense in this derived class" is solved by decoupling types and inheritance.

For example, given the article's GO code:

        type file interface {
    	Read(b Buffer) bool
    	Write(b Buffer) bool
    	Close()
        }

my first thought was: wait, not all files are writable, that interface is ill specified.

I do think subtyping and subclassing should be different things, but it's not a panacea against bad specifications.

<comment><USER5> I think this points to a seperate issue as well: Often times we have a choice to express the same thing through types or through state. As the influence of functional languages grows, we tend to choose types more often.

It wouldn't be surprising to have a ReadOnlyFile type and a ReadWriteFile type. This can easily be justified because an individual file object doesn't need to change its read/write property after it has been created. But conceptually, files can be written to, just not always.

Another example makes that clearer. Adults can do things that minors can't. So, for instance, a signContract() method would have to go on the Adult type not on the Person type. But people grow older, so at any point in time some objects conceputally change their type from Minor to Adult.

Technically this is not a difficult problem to solve. But it shows the disconnect between our natural language concepts and the ever more type centered way of modelling we use in modern software design.

<comment><USER6> > As the influence of functional languages grows, we tend to choose types more > often.

FP does not imply static types. See Lisp and its dialects. Don't confuse the Haskell way of doing things with FP in general.

<comment><USER5> My point isn't a formal one but rather an observation about software design trends.

More imporantly though, what FP does in both its dynamically and statically typed incarnations is to prefer (and sometimes enforce) immutability.

Immutable objects support a much more type centered view of the world. Theoretically, you could have something like a VehicleAtFullSpeed type (dynamic or static) because the speed attribute of an individual object never changes.

</comment></comment></comment></comment></comment><comment><USER7> I've been recently watching Structure and Interpretation of Computer programs, where it is demonstrated that first class functions and assignment operator with nested scope are enough to implement object oriented system.

The simplest example given is a Counter object. Translated from Lisp to Javascript it goes like this:

          function make_counter() {
            var val = 0;
            function get() {
              return val;
            }
            function inc() {
              val += 1;
            }
            return [get, inc]
          }

          function get_count(counter) {
            return counter[0]();
          }

          function inc_count(counter) {
            counter[1]();
          }

          var counter = make_counter();
          console.log(get_count(counter).toString());
          inc_count(counter);
          inc_count(counter);
          console.log(get_count(counter).toString());

This gives polymorphism (you can define make_fast_counter() that increases by 2 and still use get_count() and inc_count() with it) and encapsulation (you can not decrease the count).

<comment><USER8> From [http://people.csail.mit.edu/gregs/ll1-discuss-archive- html/m...](http://people.csail.mit.edu/gregs/ll1-discuss-archive- html/msg03277.html):

The venerable master Qc Na was walking with his student, Anton. Hoping to prompt the master into a discussion, Anton said "Master, I have heard that objects are a very good thing - is this true?" Qc Na looked pityingly at his student and replied, "Foolish pupil - objects are merely a poor man's closures."

Chastised, Anton took his leave from his master and returned to his cell, intent on studying closures. He carefully read the entire "Lambda: The Ultimate..." series of papers and its cousins, and implemented a small Scheme interpreter with a closure-based object system. He learned much, and looked forward to informing his master of his progress.

On his next walk with Qc Na, Anton attempted to impress his master by saying "Master, I have diligently studied the matter, and now understand that objects are truly a poor man's closures." Qc Na responded by hitting Anton with his stick, saying "When will you learn? Closures are a poor man's object." At that moment, Anton became enlightened.

</comment></comment><comment><USER9> From a high level programming in Go looks to me to be very like programming with Microsoft's COM. It's interface oriented, no inheritance. You could say that this is the purest form of OO if you take Alan Kay's viewpoint that the emphasis should be on the messages and not the object. In COM you have QueryInterface and in Go you have interface matching and casting. QueryInterface or an interface cast is like a hinge between dynamic and static typing. You get great flexibility but still preserve your abstractions in that you never depend on an implementation. Of course you can do this in, say, java by using instanceof to match against an interface but the difference with COM and Go is that it is a primary mechanism and so the code written in the language tends to use this pattern a lot. i.e. It's encouraged.

See this example from Russ Cox:

<https://groups.google.com/forum/#!msg/golang-> nuts/Rj5t1h_ztxI/Fgs6HfLqMHAJ

</comment><comment><USER10> I interpreted the title 'Go and Rust' as in 'go and make some iron-oxide' evidence that I am a mechanical engineer and programming is just a hobby.

</comment><comment><USER11> This is a good article, although I'm not sure its appropriate to post a subscriber link.

<comment><USER12> It seems like it's allowed explicitly by LWN: "The following subscription-only content has been made available to you by an LWN subscriber. Thousands of subscribers depend on LWN for the best news from the Linux and free software communities. If you enjoy this article, please consider accepting the trial offer on the right. Thank you for visiting LWN.net!"

<comment><USER13> "Where is it appropriate to post a subscriber link? Almost anywhere. Private mail, messages to project mailing lists, and blog entries are all appropriate. As long as people do not use subscriber links as a way to defeat our attempts to gain subscribers, we are happy to see them shared."

\-- <https://lwn.net/op/FAQ.lwn#slinks>

<comment><USER14> It is probably preferable to the free link being posted a week later as it makes people aware of the subscription.</comment></comment></comment></comment>


Effect of Informations on decisions - <AUTHOR> http://www.istarter.it/blog/item/56-what-decisions-could-you-make-if-you-had-all-the-information-you-need?

<comment><USER2> Up! HIPPO is a great acronym

<comment><AUTHOR> It is, but should not be the way things are run.

Not in favor of committees either, but sometimes data IS available, you just have to look at it.</comment></comment>


Archaeologists discover 3,500-year-old settlement in Egyptian desert - <AUTHOR> http://www.nytimes.com/2010/09/07/science/07archeo.html

<comment><USER2> Please don't post links to the NY Times paywall, such as this link.

<comment><USER3> What is the reason for your objection to paid content? I don't see how charging money for content is wrong in any way. Said content could easily be deserving of links from HN, I know of no guideline or informal rule that would discourage such practice.

<comment><USER4> Nothing wrong with charging money for content.

Just don't expect to get on news aggregators if you do.

<comment><USER3> Don't expect to be very popular, that much I can agree with. But I don't think there should be an outright ban.</comment></comment></comment></comment>


Show HN: Encrypto – Beautiful File Encryption (Mac/Windows) - <AUTHOR> http://macpaw.com/encrypto <comment><USER2> How the file format structured? The reason being is that if I ever receive, file format that requires special app just for it, I'd hit reply and have the sender 7z with password which would be as secure, but in a format understood by wider range of tools...

</comment><comment><USER3> The bigger version of this, Hider, scrambled filenames in a still guessable manner. I wouldn't want to trust something like that.

</comment><comment><USER4> Where's the source code?</comment>


Don't Fall Asleep at the Wheel: Successful Entrepreneurs Have Lives - <AUTHOR> http://www.good.is/posts/don-t-fall-asleep-at-the-wheel-successful-entrepreneurs-have-lives/ <comment><USER2> I almost wish now that I hadn't cut this footnote from Startup = Growth:

       Failure to distinguish between startups and ordinary
       companies is the source of the news stories we see
       every six months or so announcing the discovery that,
       contrary to popular belief, most entrepreneurs are in
       their forties.

<comment><USER3> While I can appreciate the difference in definition between a made-to-scale startup and a more traditional business, I disagree that the former is "an entrepreneur" and the latter isn't. In fact, I'd argue that, if anything, it's the opposite. An entrepreneur builds a sustainable business. A "startup founder" is trying to strike oil.

These are very different things with different skills required, but, as the startup founder is the new thing here, it should get a new word instead of trying to force an existing, understood term to have a new meaning and just causing a lot of confusion as a result.

<comment><USER4> He never said the latter isn't an entrepreneur.

<comment><USER5> If ordinary company founders are not excluded, then distinguishing between startups and ordinary companies would not change the fact that most entrepreneurs are in their forties. If it's a distinction without a difference, why distinguish?

<comment><USER4> I'm not sure I understand you correctly, but he's saying that startup founders tend to be young, probably due to the risk profile of startups vs small businesses. Entrepreneurs as a whole (a much larger group) may well be in their forties on average, though.

Edit: Does anyone happen to know the success rate (for some definition of success) for restaurants?

<comment><USER6> According to this[1] Bloomberg article, failure rate is roughly 60%. Failure rate is defined as changing ownership within three years of founding.

Pretty low failure rate, compared to a startup.

[1] [http://www.businessweek.com/stories/2007-04-16/the- restauran...](http://www.businessweek.com/stories/2007-04-16/the-restaurant- failure-mythbusinessweek-business-news-stock-market-and-financial-advice)

<comment><USER4> Funny that ownership change is usually considered a startup success.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Long hours != Productivity

There's a huge myth about Japan in that many people believe that salary men work insane hours out of dedication to their jobs. In reality, there is very little productivity in Japanese corporate offices. While the salaryman might stay for 12 to 13 hours a day, only 4 or 5 is spent actually working -- the other half is spent dicking around. They stay out of a social contract, a culture of not being the first to leave.

I think the kind of startups that we talk about here have a lot in common with the traditional Japanese corporate office culture.

<comment><USER8> "I think the kind of startups that we talk about here have a lot in common with the traditional Japanese corporate office culture."

You think the startup founders working 18 hour days are dicking around for most of that time? I'd say you're almost certainly wrong.

I'm not saying the post is wrong either, a good work/life balance might be the path to success. But the people who don't have that are not playing WoW all day at work.

<comment><USER9> The data doesn't support this. RescueTime did a study on the time that their YCombinator class spent "actually working" (their software tracks which window on your computer screen has focus, and how much time you spend interacting with it):

<http://news.ycombinator.com/item?id=209195>

Barely anybody hit 10 hour days of solid productivity; typically, people can manage about 7ish hours of actual work, only 3-4 of which is coding or other heavily intellectually demanding tasks. This squares with several worker- productivity studies done around WW2 (when major corporations were deciding whether to move to the 8-hour workday; the standard at the turn of the century was 14 hours), which found that productivity _decreases_ after 8 hours, and the time spent dealing with mistakes eats up any marginal increase in output. Having worked in one startup where much of the eng team seemed to work 12-14 hour days, I can anecdotally confirm that.

It's not that they're dicking around, it's more that they are probably staring at their computer screen cursing or berating themselves. Or feeling despondent and miserable about their chance of ever shipping product. Or writing code, but writing _the wrong_ code which will just have to be ripped out once they think about the product again.

<comment><USER10> I have wondered if the 5 hours of heavy coding maximum is psychological or physiological. Does productivity drop because your mind rebels against itself? Prolonged mental focus is an unnatural thing to do in the scheme of evolution. There might be some mental mechanism that automatically triggers feelings of despondency in order to make you do something else. Alternatively, hitting the wall might be an actual physical problem - the brain might be overheating, or have some build of chemicals, or something, that requires a recovery time.

<comment><USER9> I suspect that when you're dealing with the brain there's little difference between physical and psychological: if the brain's hitting a wall physically it will unconsciously invent some explanation. I suspect that's what's happening with these startup founders who think they are working 18 hour days; anecdotally, when I've pushed myself to work 12-14 hour days, I haven't felt unproductive, I suspect my brain just shut down so that it couldn't register all the time I was wasting. If I look at my actual changelist history, I'd find that the first 3 changes of the day would take a total of about 3-4 hours and then the last one would take 7+.

There's been a lot of research done into "ego depletion" - basically, 100+ studies have found evidence that the ability to focus and make yourself get things done is an exhaustible resource, and then recent studies by Carol Dweck have indicated that your abilities to do so, in some sense, depend upon your mindset going in and whether you embrace the task to begin with. The logical place to answer this would be with an fMRI study, and the first such study was just published a week and a half ago. The abstract indicates they found something, but the article itself is paywalled:

[http://scan.oxfordjournals.org/content/early/2012/09/20/scan...](http://scan.oxfordjournals.org/content/early/2012/09/20/scan.nss111.abstract)

<comment><USER10> If the phenomena was purely psychological, then it might be possible to overcome it. Possibly, rotating the specific task you are working on, or changing locations, or taking shorter but very intensive breaks (like playing street hocky for 30 minutes), might be enough to prevent the brain from switching into despondency mode and allow a few more hours of high productivity. But if the limit is physical, then switching locations or activities won't help much, the brain simply needs to rest (although perhaps a cooling helmet would work - [http://www.news-gazette.com/news/health/health- care/2011-03-...](http://www.news-gazette.com/news/health/health- care/2011-03-27/doctors-move-forward-research-brain-cooling.html) \- I can't wait for magazine articles with trendy startup engineers at their standing desks all wearing brain cooling headgear).

<comment><USER9> I think recent science is discovering that even physical problems with the brain can be overcome. Depression is a chemical imbalance in the brain, but talk therapy has been shown to be effective for it. The act of thinking certain thoughts changes the brain's chemistry in ways that can be either positive or negative.

Say that we find that ego depletion comes from a shortage of blood glucose in the brain. If that's the case, the cure could be as simple as stocking the microkitchens with M&Ms (man, maybe Craig Silverstein had the right idea 14 years ago). It's also known that certain stimulants like caffeine and amphetamines help you overcome your normal mental fatigue limits - the problem is that they often tend to create dependency and lose their effect if you chronically overuse them. The reason for looking into the physical mechanism is that we might then be able to find simple solutions that work and don't have long-term side-effects.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> "venture capitalists and the tech media began to debate whether there is an optimal age for an entrepreneur to start a company .... The pundits proposed the mid-20s as the optimal age to start a company"

May I point out that this is the best age -FOR- venture capitalists to fund and -FOR- the tech media to write about but not for entrepreneurship in general. VC and the tech media focus on the same thing... businesses that are in essence experimental rocketships. Most will implode fantastically but there will always be a few that go to the moon. Thats only one form of venture - even in tech.

</comment><comment><USER12> It is really difficult to look into the tea leaves and find an answer to why things happen.

After spending the entirety of my twenties working on failed startup after failed startup I finally reached something that actually is turning a profit.

Now that I'm well past my twenties I no longer have interest in working those extreme hours but I'm not sure if I would have had enough experience to make some of the decisions I do today had I not invested all that time in failed businesses. It's a catch-22. I feel that my time spent against the grindstone was beneficial in my experience but I'm loathe to suggest anyone else go through the same process.

I think the only advice that is worthwhile is "you need a rock outside your company" you need something that isn't subject to the whims of the market that you can rely on. If the company is your rock then failure is going to hit you very hard; you'll be cleaning up your office with nothing - no life, no family, no friends.

Everything else is subject to how you operate.

</comment><comment><USER13> If you weight companies by their market value, rather than a binary successful vs. unsuccessful[1] outcome, you'll come to a different conclusion. This is just a rationalization to avoid working hard.

[1] What's a "successful" company, by the standards of this and similar article? I don't want to inform my decisions with a study that considers Dropbox, on the one hand, and any sustainable small business, on the other, to be equally successful. There'll always be more of the latter.

<comment><USER14> Seems to me that you don't fully understand the point of this article. The author is suggesting that taking some time for yourself personally will make you more productive, not less. Pushing yourself to the breaking point just so you can say that you worked as hard as you could is a losing strategy. Let's not look to give ourselves a convenient excuse for when things don't work out. Instead, let's try to make it work out :)

</comment></comment><comment><USER15> One other way to look at this. When you think you'll do a 12-14 hour day you often waste a lot of time during the that day. Why? Because you don't treat time like a valued resource. Tell yourself you're leaving at 4pm no matter what and you'll find you get almost as much done.

</comment><comment><USER16> "The Kauffman Foundation surveyed 550 successful entrepreneurs across multiple sectors, determined by profitability and being named a "high-valued" business by their peers. Their data suggests that most successful founders are in their mid-30s and married with children."

Why are these entrepreneurs named "high-valued" by their peers? Because they worked their butts off in their 20s and early 30s. Being named "high-valued" is a reverse-looking statement based on the entrepreneur's past achievements.

</comment><comment><USER17> I spent my teens and 20s building business after business (and failed for the most part). I had _no_ life. Now that I am older and do have a life (family), I succesfully run one business, and am working on building another. Less time to work on things means I have to produce higher quality. So the waste in process factor is reduced significantly. Before I would just amass a bunch of stuff to test. Now, I do quick/short tests and move on. No sense to waste anytime. After all, I only have so many heart beats left.

</comment><comment><USER18> I assume articles covered by a popover are not worth my time and just click back.

<comment><USER8> Fortune does this too and their articles are typically quite good, as was this one. People gotta monetize somehow.

</comment></comment><comment><USER19> This may be an entrepreneurial Freudian slip, but the sentence "It is okay to spend people you love." should probably be revised.

<comment><USER20> If I could monetize them I would!!

</comment></comment><comment><USER21> Good article, thanks. I just want to make a caveat.

In my job, if I worked as efficiently and quickly as possible, I would not be able to go out to lunch with coworkers, chat with people around the office about if we're getting iphone 5, etc,, or take time to go to the tap room on Thursday afternoons for a quick beer break and chat with coworkers. So I would essentially be more boring than the computer I sit at. When I first started working, I would eat at my desk, bringing all my food from home, not go out for coffee breaks, so that I could have time to go the gym after work, talk to my family, etc. When my friend called me a monk I started to reconsider the value of being social and "wasting time."

I guess all I'm saying is that if working insanely long hours is partly due to comraderie-building or "messing around," boosting morale for all, laughing, than I think that sort of activity is worth it.

<comment><USER22> I would consider that effective downtime. It doesn't HAVE to be going home to kids or whatever, but I think the point is that there is no value sitting at your monitor for 12 hours half-zoning out staring at code when your tank is empty.

</comment></comment><comment><AUTHOR> Most significant quote for me:

"Founders tended to be middle-aged—40 years old on average—when they started their first companies. Nearly 70 percent were married when they became entrepreneurs, and nearly 60 percent had at least one child, challenging the stereotype of the entrepreneurial workaholic with no time for a family."

</comment><comment><USER23> >On average, these [violin] masters practiced in 90-minute spurts, three times a week

There must be a lot of context missing from this statistic, or it is simply untrue. The suggestion that one can master a classical instrument with only 4.5 hours of focused practice a week is absurd.

I've spent most of my life playing the Violin, alongside many different levels of professional musicians. Low- Mid-level professionals _start_ at 3 hours a day of solo practice, not including group rehearsals. Most prodigies, those that go on to be soloists, are practicing 6-10 hours a day by their teen years. Without fail, the people that put in more effort, both in focus and in hours, are better players.

Maybe Pinkus Zuckerman or Itzahk Perlman only practice 4.5 hours a week these days, but they certainly didn't in their prime.

<comment><USER9> He misquoted. The linked article says:

"The best typically worked in stretches of no longer than 90 minutes, three times daily."

So 4.5 hours a _day_ , not 4.5 hours a _week_. That makes a lot more sense.

(Interestingly, this is about the same as the amount of focused coding time I can get in a day, and I structure it similarly: 3 intense periods of about 90 minutes.)

</comment></comment><comment><USER24> By all means do your heavy startup/entrepreneur stuff when you're as young as possible. In your 20's you can work hard and play hard. Most people have little or nothing to lose at that age. It's easy to end up in an ordinary job with a boss that's just as demanding anyway. In a startup, with hard work and a healthy dose of luck, later (which will arrive sooner than you think) by the time you have children you'll be set up well enough financially to do less intensive work and be able to be present and be a successful spouse/parent. You really can't ace both a career and family at the same time. Starting in your 40's sounds like the worst possible time to me.

<comment><USER25> >>Most people have little or nothing to lose at that age.

This is no longer true. A couple of years ago, college seniors graduated with an average of $25,000 in debt. And that number is growing. What this means is that the percentage of people who have "nothing to lose" in their 20s is shrinking rapidly. Instead people are seeking "safe" corporate jobs in order to be able to pay off their debts. Working in a risky startup is not a realistic option for them.

<comment><USER9> A safe corporate job in a high-wage field can easily pay off $25K in debt in a couple years.

<comment><USER24> I tend to agree - $25K is only about the cost of a very average new vehicle. Don't ruin your 20's obsessing on that amount of money. (I'm aware that "new" cars provide less utility for your money than 3-5 y/o cars.) Bottom line is that keeping your overhead low gives you more freedom. Generally speaking your overhead will probably never again be as low as it is in your 20's and you may have a lot more people who need your time later too.</comment></comment></comment></comment>


Should Facebook charge for privacy? - <AUTHOR> http://www.itworld.com/internet/111698/should-facebook-charge-privacy <comment><USER2> > "We have open APIs that permit applications to export this information. > However, we don't allow exporting of content that is created by others > because it doesn'trespect the decisions users make on Facebook about how to > sharetheirdata."

Pot, have you met my friend kettle?</comment>


jasondb, a RESTful database - <AUTHOR> http://www.jasondb.com/jasondb/jasondb.html

<comment><USER2> So this is not a database, per-se, but a document base? If I have to wrap every data element in a file, doesn't that add overhead? Honestly, what's the benefit to me of this over say, SVN+HTTPS with 10 minutes of config?

</comment><comment><USER3> Interesting idea, since most websites at the start rely almost entirely on simple CRUD operations. However, this is extreme lockin of an application's foundation, which is why I would never consider it.

</comment><comment><USER4> How is this any different / better then using CouchDB and hosted CouchDBs at CouchOne?

</comment><comment><USER5> the least important or interesting parts of a db are its api and storage format

<comment><USER6> What is a database, if not an API for a storage format?

<comment><USER5> the stuff between the two is pretty important

<comment><USER6> I was hoping for something more specific; am example might be "the query optimizer". Seriously: most everything about a database solution is determined by its storage format, whether it be how it handles concurrency, how it scales, how it handles catastrophic events like power loss, or how expensive it is with regard to memory, disk, and I/O between.

Sitting down and really thinking about what is in, for example, PostgreSQL, that isn't defined by its storage format, the one thing I've come up with so far is query optimization, which I will agree is important, but certainly not /more/ important than the storage format (especially given how many people, even on this site, seem to want to bypass the optimizer, given comments on a recent thread here).

(For a commercial solution I could also see "licensing costs", and generally I could also see "engineering build quality", but that latter notion is unlikely to ever be self reported as "poor, our engineers suck, and we fully expect there to be numerous race conditions in our concurrency code: buyer beware".)</comment></comment></comment></comment>


Eric Schmidt says Microsoft isn't a leader anymore - <AUTHOR> http://blogs.forbes.com/frederickallen/2011/06/01/eric-schmidt-admits-screw-up-identifes-the-big-four-of-the-internet/

<comment><USER2> > _"What did he have to say about Microsoft? It "is not driving the consumer > revolution in the minds of consumers," he remarked."_

Consumers are not Microsoft's primary focus - businesses are and have been since they made their first big deal with IBM (International Business Machines). Microsoft has always had a primary strategy of developing business software and then packaging the relevant pieces for the consumer market, e.g. Microsoft bundles virtualization (Windows Virtual PC) with OS's sold on commodity computers in BestBuy. Even though it can flow the other way, to the degree that our workplaces set consumers' expectations for computers, Microsoft is the clear leader.

</comment><comment><USER3> I appreciate how Google stopped pursuing face recognition technology. Even for the tech-savvy, technology can sometimes become scary. Nice way of sticking to the _"Don't be evil."_

</comment><comment><USER4> A friend of mine at Novell in the late 90's once heard Schmidt say, "Novell is a fish. Microsoft is the ocean." How times have changed since then!</comment>


Using DTrace to observe the SQL statements on a live running MySQL database - <AUTHOR> http://blogs.sun.com/angelo/entry/observing_mysql_sql_statements_in

<comment><USER2> I generally use <http://iank.org/querysniffer/mysqlsniff-0.10.html> to get real queries. Works even on remote databases you don't have access to turn on query logging. Not to say DTrace isn't freaking awesome. (Check out Instruments in the Developer Tools on Leopard if you want to see DTrace but through a GUI).

</comment><comment><USER3> One thing this is useful for: security testing. Get your web application up and running under OpenSolaris, OS X or FreeBSD, then run a "web fuzzer" like Burp Suite or WebScarab against it, while watching the queries in the backend. It'll give you a quick and dirty way to see how user inputs are being passed through to the database.

</comment><comment><USER4> It's not the greatest example (since there are various ways to get SQL queries from a live mysql db - tcpdump/ngrep, query logging or strace from a client - you could strace the server but mysql appears to die when you strace it - dunno why).

Everyone who I know who has used dtrace loves it - so it seems likely to me that it is great+useful tech - but can someone come up with a real-world example of info it can give you that you can't get with tcpdump/strace?

</comment><comment><USER5> This looks really cool. Anybody know about DTrace support for Linux (specifically, Debian)?

<comment><USER2> There's a lot of debate about its license CDDL, versus the GPL.

Either way there's a port being developed currently: <http://www.crisp.demon.co.uk/blog/index.html>

<comment><USER6> It's not so much as a debate as the maintainers and legal people saying "hell no, their code is incompatible. you'll have to do a clean-room implementation for it to land", and some people saying "but we really want it." Plus, there are the usual "GPL is bad" trolls.

</comment></comment></comment><comment><USER7> instruments in Xcode is based on top of dtrace and is awesome.</comment>


How Samsung Just Screwed Over About 10 Million Of Its Android Phone Customers - <AUTHOR> http://www.businessinsider.com/samsung-galaxy-s-phones-ice-cream-sandwich-update-2011-12

<comment><USER2> This is one of the main reasons I dumped my HTC Android phone (to buy an iPhone). It became painfully clear that the OS was _never_ going to be updated, and the value of a market of apps becomes very low when they all stop supporting your OS.

</comment><comment><USER3> The Android team needs to take this to heart:

"The Paradox of Choice"

[http://www.amazon.com/Paradox-Choice-Why-More- Less/dp/006000...](http://www.amazon.com/Paradox-Choice-Why-More- Less/dp/0060005696/)

All the more so when the eventual implications of a decision remain hidden and indeterminate.</comment>


AMD Ryzen 3000 Post-Review BIOS Update Recap: Larger ST Gains, Some Gains/Losses - <AUTHOR> https://www.anandtech.com/show/14632/amd-ryzen-3000-review-bios-update-recap <comment><USER2> I'd just like to say for anyone considering one of these new processors, there are some downsides I wasn't expecting. Overall I'm fine with them, but knowledge is power so here you go:

1\. RDRAND returns -1 (and sets the carry bit meaning it thinks -1 is a random number). Supposedly this will be fixed in a BIOS update (which makes me think it's an intended mode wrongly turned on... a backdoor?)

2\. On linux, CPU monitoring (e.g. temperature) is not available as AMD hasn't published the specs on that yet

3\. While it has spectre "mitigations" (stibp, ibpb, ssbd), spectre is not yet dead (spectre_v1, spectre_v2, spec_store_bypass).

4\. There is a bug/oddity in how it deals with %fs: [https://www.phoronix.com/scan.php?page=news_item&px=DragonFl...](https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD)

5\. PSP/SEV ccp driver calls hang (on my machine at least, might be the mobo) but luckily linux only waits a few seconds before giving up and continuing the boot process.

6\. There have been reports of high idle voltages, but under linux w/o monitoring I have no idea if I'm affected or if the issue is real or significant.

For most use cases all of the above are minor and don't overshadow the price- performance success of these processors.

<comment><USER3> > _1\. RDRAND returns -1 (and sets the carry bit meaning it thinks -1 is a > random number). Supposedly this will be fixed in a BIOS update (which makes > me think it 's an intended mode wrongly turned on... a backdoor?)_

Yet more evidence not to trust hardware random number generators.

<comment><USER4> I'm very surprised that something like that even makes it into production. You'd think processor manufacturers would have an extensive set of test cases, at least one for each instruction...

I remember reading somewhere that, for a long time, Intel's "test cases" basically consisted of all the operating systems they could find, going back to MS-DOS 1.0 and including some more obscured ones, as well as tons of other third-party software.

Unfortunately it seems this new generation no longer follows the "NEVER break backwards compatibility" principle that made the PC such a great platform, and as a result we're seeing hardware/software/firmware that's increasingly buggy and divergent. It used to be the case that if a new processor couldn't run existing software (even that which depended on undocumented but constant behaviour) unmodified, it was a fatal flaw.

<comment><USER5> Everything on a CPU is subject to heavy validation .. but I bet the random number generator is exempt, because by definition it's not deterministic. It's more like a peripheral "listening" to randomness.

[https://www.amd.com/system/files/TechDocs/amd-random- number-...](https://www.amd.com/system/files/TechDocs/amd-random-number- generator.pdf)

> "The RNG uses 16 separate ring oscillator chains as a noise source. Each > chain consists of a different prime number of inverters in a free-running > configuration which capture natural clock jitter"

So it's (deliberately) dependent on natural manufacturing variation in the silicon, and in any deterministic simulator won't produce random numbers. It also takes a while to start; it's possible that the startup conditions are bad such that "a while" turns out to be "forever".

<comment><USER6> Probably still worth checking that it doesn't return -1 every time.

<comment><USER7> Infinity of -1's is a valid random sequence, just saying.

</comment></comment></comment></comment></comment></comment><comment><USER8> Those are significant single thread gains. It is concerning to me that BIOS firmware has such a large influence over CPU performance. Buy from motherboard manufacturers that are known to emphasize BIOS quality and performance.

There was also more performance left on the table in the initial AnandTech tests on 7/7; conservative DDR-3200 JEDEC memory timing was used throughout. More aggressive memory profiles will improve performance and AMD CPUs are known to benefit greatly from better RAM performance.

So despite the already good results of Ryzen Gen 3 we can expect better performance as the platform is optimized.

<comment><USER9> > Buy from motherboard manufacturers that are known to emphasize BIOS quality > and performance.

Any suggestions, and reasoning why?

<comment><USER10> They just wrote the reasoning why: because the firmware affects the system so much.

As for the suggestion, that's what I've been struggling with too. The gaming motherboards popular for self assembly seem to be getting better at updating the bios, but the manuals I've read still recommend against updating the firmware. Which makes me guess you'd want to wait for the PlayStation 5 or the next Xbox, or a PC vendor that is associated with fwupd, as that's likely a good indicator that they care about firmware.

<comment><USER9> Sorry, by reasoning I meant the reason why you consider a particular vendor worthy of being associated with quality and performance. The internet currently seems lacking in anything approaching a longitudinal study of hardware vendors - it's all a sea of opinions.

</comment></comment></comment></comment><comment><USER11> Eagerly awaiting 3-rd gen Threadripper. That CPU will completely obliterate Intel in the HEDT/Workstation market. Best I can tell, short of moving AVX512 (along with, e.g. VNNI) into their HEDT chips (which is not going to happen), Intel has nothing to counter this threat.

<comment><USER12> Skylake-X already has AVX512 and Cascade Lake-X will have VNNI. Few workstation apps use them, though.

<comment><USER11> Looks like you're right. The pricing on those chips is pretty outrageous at the moment though.

MKL and MKL-DNN take advantage of AVX512 and VNNI automatically, if available. Lots of scientific software (basically all of it that cares about CPU perf) use MKL and MKL-DNN.

<comment><USER13> Simply having AVX512 support doesn't really tell you the whole story, though. You'd want to actually benchmark it and see how much it's helping and then how it compares to the competition. AVX512 comes with an insane clock speed penalty, so while it can still put up some really impressive numbers, mixed workloads can also end up not any faster (or even slower).

<comment><USER14> Yep I've heard this as well. More often than not it's faster to avoid AVX512 on recent Xeons. I don't think the same is true for Xeon Phi but those are going away.

</comment></comment></comment></comment></comment><comment><USER15> What's with all that crap they stuck on the board. You can practically get a epileptic fit from it.

<comment><USER16> It's practically impossible to get a consumer motherboard without LEDs and huge chunks of milled aluminium on it. Don't get it either...

<comment><USER17> Was looking into building a new computer today, after 5 years with my current one... Saw that even the ram sticks comes with leds. I don't want a single light anywhere but that's not going to happen ¯\\_(ツ)_/¯

<comment><USER18> Why do you care? Those lights are inside case. If you don't get case with glass, you won't ever see it.

<comment><USER16> It's a waste of metal, plastic, and electricity. Useless on _every single_ aspect you can think of, except for the hardcore gamer pandering bullshit.

<comment><USER19> I mean, it's not wasting that much of any of those. It's probably less wasteful to just put LEDs on all those motherboards than create separate product lines with and without the flair - if some decent majority of the kinds of people that build their own PCs (gamers) want them, then it's easier to save on all the tooling and design and so on to create a new "pro" line of motherboards just for the people that don't want LEDs when they can just use an opaque case.

<comment><USER20> It wastes a lot! Unintuitively, for the things that do all the heavy lifting, chips are incredibly power-efficient. The stuff on the side, anything that glows or moves (LEDs and fans) takes up a disproportionate ton of power.

I don't like that X570 needs a chipset fan, but at least cooling's useful. I can't have as much charity toward LEDs. Although I do like 'em. The æsthetic is sick. Although not this one: [https://smile.amazon.com/G-Skill- Trident-3600Mhz-PC4-28800-C...](https://smile.amazon.com/G-Skill- Trident-3600Mhz- PC4-28800-Channel/dp/B07M8YGCMV/ref=sr_1_2?keywords=Trident-Z+Royal+DDR4-3600&qid=1562984282&s=gateway&sr=8-2)

<comment><USER13> > It wastes a lot! Unintuitively, for the things that do all the heavy > lifting, chips are incredibly power-efficient. The stuff on the side, > anything that glows or moves (LEDs and fans) takes up a disproportionate ton > of power.

Not at all true. It's around 0.1-0.2 watt per LED. A RAM stick is going to have maybe a dozen at most, so that's an extra 1-2 watts. Similar for a motherboard. Maybe a fully binged out build is burning 10-20 watts on RGB, give or take.

That's comparable to the power usage of just the VRMs or the X570 chipset (which is 10-15w), to say nothing of the CPU or GPU itself (both of which commonly blow past 100W under loads)

LEDs are very, very efficient. They do not take a "disproportionate ton of power."

<comment><USER21> 2W is a power budget for an entire single borad computer I can run a desktop on. So it's quite a lot in absolute terms for a led inside the case that I'll never see.

10-20W is 10-40% of idle power consumption, perhaps, for a workstation. So it wastes a lot even in relative terms.

<comment><USER13> > So it's quite a lot in absolute terms for a led inside the case that I'll > never see.

Then turn them off? The whole point of RGB lighting is it's controllable. That includes setting it to off.

<comment><USER21> Eh, point is 10-20W for a few blinkies is not efficient by any means.

<comment><USER13> You missed the "fully blinged out" part. If you just get RGB on the motherboard and RAM, the harder ones to avoid, it's going to well under 5W. More like 2W. This is a power cost that basically doesn't exist in the context of the entire system.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> How's the ECC RAM support with the 3000 series?

<comment><USER13> Like previous Ryzen lineups the entire line has unbuffered ECC support. Whether or not it's officially supported will depend most on the motherboard & bios and if they tested & validated it.

At this point the Asus Pro WS X570-Ace ( [https://www.asus.com/Motherboards/Pro- WS-X570-ACE/](https://www.asus.com/Motherboards/Pro-WS-X570-ACE/) ) appears to be the only x570 board with certified ECC support.

<comment><USER23> How long will Asus keep updating that board with firwmare updates? In my experience Asus is horrible about releasing updates after a couple of years.

<comment><USER13> Asus is generally pretty good at updating the BIOS. My Asus X370-F gaming has already been updated with support for Ryzen 3rd gen.

<comment><USER23> I have multiple Kaby Lake boards which haven't received any BIOS updates in > a year. It depends upon the model line and as far as I can tell they will not tell you how long support is before you buy one.

<comment><USER13> What are you expecting an updated BIOS to do for that platform? Kaby Lake was the last CPU line for that chipset series since Coffee Lake shuffled some pins around. So what are you wanting updated that Asus hasn't provided?

<comment><USER23> There are issues with the BIOS on on of the systems randomly changing the m.2 PCIe speed between 4x and 2x. It only exists in the most current version of the BIOS but doesn't happen on older version.

Their are also other issues that should be fixed but haven't.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> They are just firmwares today, not BIOSes, right?

I'm still waiting for the fix to be pushed for rdrand issue that breaks systemd.

</comment><comment><USER25> the thing I'd like to see: implementations in "ispc vs asm vs intrinsics_msvc vs intrinsics_clang vs intrinsics_gcc" on Intel and AMD CPUs. those "quake has now 300 FPS" things tell me exactly nothing. (read: i am more interrested in testing new features)

</comment><comment><USER26> What's the inter thread latency, ie between cores on these beasts?

<comment><USER27> Here's an inter-core latency chart that includes both the 8 and 12 core Zen 2's as well as a comparison a comparison w/ Zen+ and Intel's latest (CFL-R): [https://www.reddit.com/r/Amd/comments/calue1/intercore_data_...](https://www.reddit.com/r/Amd/comments/calue1/intercore_data_latency/)

Intra-CCX latency is now awesome, and all inter-CCX (including intra-CCD) latency is not bad (and goes through IF) - what's interesting is that intra vs inter-CCD latency seems to be within a ns or two. Pretty impressive (considering it needs to bounce through the cIOD)!

<comment><USER26> Thank you kindly!</comment></comment></comment>


License finder for Node.js - <AUTHOR> https://github.com/iandotkelly/gulp-license-finder

<comment><USER2> This is actually a Gulp plugin for nlf.

[https://www.npmjs.org/package/nlf](https://www.npmjs.org/package/nlf)

</comment><comment><USER3> Can someone explain why not simply use "grep -ri license ." ?

<comment><USER4> Having built something similar [1], the reason I didn't use "grep -ri license" is that I wanted to generate the list of licenses for both my project and all of its dependencies. Using grep would still require matching up each project to its own license.

Another problem is that the license file doesn't necessarily state the name of the license, which is often what you're looking for. (My package compares the text of the license to saved copies of common licenses, and picks the closest match, assuming any are a good match.)

[1] [https://github.com/mwilliamson/node-license- sniffer](https://github.com/mwilliamson/node-license-sniffer)</comment></comment>


Show HN: Promotion Platform - <AUTHOR> Well this would have to be my shortest to develop yet most used and praised application yet.
[link redacted]
I just gave it to my list a little over a week ago, to test and see if it would be something they would enjoy (ugliest website in the world with very little functionality). The result, just under 100 users in a few days. So I decided to go ahead with this one and developed it properly. (just finished tonight)
Essentially it is a platform that allows you to run contests / promotions and use facebook likes as votes (yes it's within Facebooks policies)
I would love the opinion of the tech/business related people (i.e you :) )
How does this app rate and any pointers on getting it out there and possible business models? I am using the freemium model, the plans going on top of that though are what I need to solidify. Any feedback welcome.
Thanks [name redacted] <comment><USER2> Letter B in [name redacted] logo looks very similar to vkontakte.ru logo, don't you think so?

<comment><AUTHOR> Not that close. Anyway I have never heard of vkontakte.ru before and it is the logo I have used since last year.

How long has vkontakte.ru been running?

<comment><USER2> May be 5-6 years. It' the largest Facebook competitor in Russia having millions of users.</comment></comment></comment>


Comeback Kid: America's economy is once again reinventing itself - <AUTHOR> http://www.economist.com/node/21558576

<comment><USER2> Summary:

1: America's houses are now among the world's most undervalued: 19% below fair value 2: The Treasury and other regulators chose to confront the rot in their financial system quickly 3: American capital ratios are among the world's highest 4: Consumers have cut back: debts are now 114% of income 5: The weaker dollar 6: The growth of a consuming class in emerging markets 7: Growing "app economy" 8: American manufacturers are recapturing some markets once lost to imports, and pioneering new processes (such as 3D printing) 10: Net imports of oil this year are on track to be the lowest since 1995 11: America leads in exploiting shale gas, in Europe shale gas has been locked in by green rules and limited property rights 12: Because the companies leading the process are so productive, they pay high wages but do not employ many people. They may thus do little to reduce unemployment, while aggravating inequality.

Some of these facts sound a bit strange. I for one thought Wall Street was not really 'confronted' with regulation. Also I wonder what we would see if the government had not changed the way they measure the economy, see: <http://www.shadowstats.com/></comment>


How to use Flurry for split testing and engagement metrics - <AUTHOR> http://www.hoista.net/post/15940961373/how-to-use-flurry-for-split-testing-and-engagement

<comment><AUTHOR> Let me know if there are any errors to correct etc. or if there are other resources that would be useful to add to this.</comment>


Electric unicycle unveiled in Japan - <AUTHOR> http://news.bbc.co.uk/1/hi/technology/8272485.stm

<comment><AUTHOR> Even if I can ride a regular unicycle (which I can) I still want one of these ...</comment>


Lethal aggression in chimpanzees is better explained by adaptive strategies - <AUTHOR> https://www.nature.com/articles/nature13727 <comment><USER2> When I glanced at the title I thought it was about mailchimp and github commits.

</comment><comment><USER3> Remarkably close to the statistics for humans: [https://en.wikipedia.org/wiki/Homicide_statistics_by_gender](https://en.wikipedia.org/wiki/Homicide_statistics_by_gender)

<comment> cup-of-tea Wow, humans are even more extreme.

</comment></comment><comment><USER4> This is a highly editorialized title which does not reflect the main point of the paper, whose actual title is _Lethal aggression in_ Pan _is better explained by adaptive strategies than human impacts_.

<comment> cup-of-tea But note that it's up to the community to decide what the interesting points of a study are, not necessarily the authors.

<comment><USER4> [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment><comment><USER5> chimpicide

<comment> cup-of-tea Shouldn't it be _panicide_?</comment></comment>


Tesla Plans to Open Car Doors to All Hackers This Summer - <AUTHOR> http://www.forbes.com/sites/thomasbrewster/2015/04/28/tesla-opening-car-to-hackers/

<comment><USER2> I expect that remote key amplifier attacks work against Tesla like they do against other cars. I wish automakers weren't in denial about this problem.

<comment><USER3> Is there anything car manufacturers can do against this attack while still keeping all functionality of the key fob?

<comment><USER4> It's hard to see how it could be fixed. Fundamentally, what is different about a local key fob, and a relay connected to a remote key fob? It seems fundamentally impossible to tell the difference.

The one thing that I could see working in theory would be detecting the roundtrip transmission time with a strict ceiling on it. No matter how good your relay is, it can't relay data faster than the speed of light, so you can enforce the fob being close by only listening to it if it responds fast enough.

The problem with this is that light moves pretty fast, and internal delays within the fob will dominate. If you want to put the range limit at, say, 30ft, that means your response time ceiling is a mere 60ns. Can you build a fob that responds anywhere close to that fast?

Edit: one other possibility is if the fob knows where it is. A GPS receiver on the fob, for example, would allow the fob and the car to securely confirm proximity (absent GPS spoofing). Getting a GPS receiver to run on a wireless fob's battery is left as an exercise for the reader.

<comment><USER5> I think this is an easy problem to fix, no?

Why not just make the keys responsible for starting the car again?

We've traded too much security for convenience and it's time to take a step back.

You can still start the car with the push of a button.. only now that button is on the key.

Problem solved.

<comment><USER4> The implied context here was "while keeping wireless keyfobs."

Yes, the problem becomes substantially easier if you require a direct physical connection, but that's not such an interesting problem.

Also, given that modern cars are _vastly_ more difficult to steal, I object to your characterization of "traded too much security for convenience." If the current state is too insecure, then you must think that cars from 20+ years ago are absolutely appalling.

<comment><USER6> Can you explain to me why older cars are easier to steal? I'm not familiar with auto theft/security and I'm curious.

<comment><USER4> Really old cars have very simple electronics. Even after computers started showing up in cars, they were pretty simple and didn't interact much with the security aspect of things. When you start a car like this, you're just making a connection between two wires to power up the electronics, and briefly making a connection between another two wires to run the starter motor. The only security in the whole system is provided by the fact that the connection is made by a switch that requires a key to turn it. If you don't have the right key, you can't turn the switch, and that means you can't connect the wires.

The trouble is that the wires must be fairly exposed to the occupants of the car, since the switch has to be accessible. That means you can just bypass the switch entirely by removing the appropriate covers and attacking the wires directly. This is "hotwiring."

Physical locks are also not all that difficult to defeat directly. You can pick an ignition switch much like you might pick any other lock.

Starting around the late 90s or so, car manufacturers started adding more robust security measures. These include things simple like locking the steering column when the ignition switch is off (thus preventing you from driving the car after hotwiring it), all the way up to authenticating the key with a relatively sophisticated protocol, and having the engine computer refuse to run the car unless it can sense a real key.

As a result of these changes, the list of most stolen car models is _still_ topped by cars manufactured in the late 90s. Low-end Hondas from around 1998 are right at the top of the list, because they occupy a sweet spot of being relatively valuable and still fairly easy to steal. Modern cars are stolen literally orders of magnitude less frequently; about 100,000 older Hondas stolen per year in the US, whereas new cars are stolen at a rate of hundreds per model per year at worst. Also as a natural result of these changes, car theft is _way_ down in the US. About 700,000 cars were stolen in the US in 2013, compared to almost 1.7 million in 1991. Pretty much the only way to steal a newer car is to either tow it away or steal the owner's keys. (A common scenario for car thefts is a burglary turned into auto theft when the burglars find car keys in the house.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I don't need more reasons to own a Tesla.

<comment><USER8> just more money?

<comment><USER9> GP and your comment - Exactly the thought process I go through every time I see something about Tesla. "Look Elon, you already got me, there's really no point in continuing to rub it in over and over again!"

</comment></comment></comment><comment><USER10> The automotive industry certainly has some interesting times ahead with regard to security. Audi's proposed plan for allowing deliveries to be placed in the boot of a locked car [0] certainly seems like it could be ripe for exploitation.

How seriously are car manufacturers going to take security though? Is it going to be like the numerous router manufacturers that don't seem bothered? Perhaps some kind of regulatory body will need to intervene to make automotive manufacturers take security seriously.

[0] [http://www.bbc.co.uk/news/technology-32431301](http://www.bbc.co.uk/news/technology-32431301)

<comment><USER11> Currently many deliveries are just left on people's doorstep, and people "Pre- Sign" for expensive things so they don't risk missing the delivery (Apple offers this option). I fail to see why someone would go through the effort of trying to get into a trunk when you can easily target the non-Audi owners with packages out in the open?

<comment><USER12> The Audi delivery thing is tested in Germany and basically all packages require signature. I can't recall any site where I was able to "presign".

If you miss your package, it'll get taken to a nearby store where you can collect it with an ID or it'll be given to your neighbour.

<comment><USER11> In the US USPS/UPS/Fedex usually will usually just leave it on the porch/in front of the door. If it's a package that you need to sign for you can print out a "Pre-Sign" form that you leave on the door and they will just leave the package.

</comment></comment></comment></comment><comment><USER13> I worked at a process automation firm in the early 00's that had micro- controller software written in ASM and C that was in sore need of standardization; we referenced MISRA C [0] in researching a sound way to improve that code. After all, those instruments were headed for nuclear refineries and submarines.

Per EETimes [1]: MISRA C is a subset of the C language. In particular, it is based on the ISO/IEC 9899:1990 C standard, which is identical to the ANSI X3.159-1989 standard, often called C '89. Thus every MISRA C program is a valid C program. The MISRA C subset is defined by 141 rules that constrain the C language. Correspondingly, MISRA C++ is a subset of the ISO/IEC 14882:2003 C++ standard. MISRA C++ is based on 228 rules, many of which are refinements of the MISRA C rules to deal with the additional realities of C++.

I did a quick search for Tesla programming jobs and they do command a familiarity with MISRA C, so somewhere it is being used by Tesla in their firmware. That standard is supposed to ensure security and reliability in firmware programming for critical devices, such as motor vehicles. I wonder if this knowledge expands upon this challenge and other avenues for hacking Tesla, and also I wonder if MISRA C practices extend to outlying modules in the vehicle...

[0] MISRA C: [http://www.misra-c.com/](http://www.misra-c.com/) [1] [http://www.eetimes.com/document.asp?doc_id=1279810](http://www.eetimes.com/document.asp?doc_id=1279810)

</comment><comment><USER14> From the title I thought they were opening an API for the car ;-)

<comment><USER15> I too thought the same thing and got really excited (not that I own a Tesla or have any chance of owning one any time soon). Tesla just gives me hope for the future of automobiles.

</comment></comment><comment><USER15> Obligatory: HACKERS CAN TURN YOUR _CAR_ INTO A BOMB [0]

But on a more serious note this is pretty cool to see not only Tesla but GM and BMW reaching out to these groups. We saw an article or two here on HN not to long about about, IIRC, car makers trying to use DMCA to prevent people from modifying the software in their cars [1] (I know there was another article about tractors as well [2]). I'd be interested to know Tesla/GM/BMW's stance on that issue. They are opening up to hackers to find issues but that doesn't mean they are on board with making it easy for people to modify software in their cars.

[0] [http://www.homelandsecureit.com/wp- content/uploads/2012/10/C...](http://www.homelandsecureit.com/wp- content/uploads/2012/10/Computer_bomb.jpg)

[1] [https://www.eff.org/deeplinks/2015/04/automakers-say-you- don...](https://www.eff.org/deeplinks/2015/04/automakers-say-you-dont-really- own-your-car)

[2] [https://news.ycombinator.com/item?id=9414211](https://news.ycombinator.com/item?id=9414211)

</comment><comment><USER16> So do I have to tie both hands behind my back to find a problem before Tesla will acknowledge their error or award a bounty?

What if there is an intractable design flaw that is costly to fix? Will it get swept under the rug as they get litigious with those who attempt to expose it?

The assumption usually is if the bounty is less than the expected reward from exploiting a system, then you're really not doing anything other than a PR stunt.

I don't see a mention of a bounty. I do see a mention of them keeping track of those trying to exploit their system at Defcon. Not sure of what the supposed benefit to those that attempt to break their system is.

It makes a nice headline though.

</comment><comment><USER17> It's interesting reading this about a car maker, when I work for a home device maker and fight tooth and nail to open up API control of home security/thermostats.

People find a way in either way, whether you want them to or not.

<comment><USER18> Sounds like in your case, they want customers locked in to their products

</comment></comment><comment><USER19> We can only hope this becomes a more widely adopted practice. Vehicle computer security, especially when it relates to self driving Autos, needs way more attention to operational security than it has been given.

</comment><comment><USER20> Can we get a test car as part of the dev kit?</comment>


Polar is joining Google - <AUTHOR> http://www.polarb.com

<comment><USER2> And joining the Google+ team? I guess I have to admire that Google is still pushing on this rope.</comment>