For a lower climate footprint, vegetarian diet beats local - <AUTHOR> https://www.sciencedaily.com/releases/2018/10/181023110627.htm <comment><USER2> Did a new years resolution to try and do what I can to lessen climate change. Calculated carbon foot print with a calculator. Concluded main changes needed was to changes required eat less red meat and drive and ride cars less. Try and consume less new things, prefer buying used things. Buying quality items that lasts long instead of cheap buy and throw.

Changing to vegetarian diet and driving less had the biggest impact.

<comment><USER3> For me it was air travel. That was more than diet even though I didn't travel much. Home heating was also a lot in my cold city.

Also, reduce then reuse then recycle in that order.

</comment></comment><comment><USER4> Btw it's not really necessary to consume >only< vegetarian / vegan food. Since couple of months I try and eat vegan meals for one day per week and reduce eating meat to at most 2 times per week. I can gladly say that this is manageable, not a big deal for all of us and doesn't require so much strictness ( IMO ). Nevertheless the benefit for the environment is not as big than being a vegan / vegetarian, but still bigger than eating meat 7 days per week.

Side topic, but meat these days is quite expensive if you really take it from a quality manufacturer ( Bio meat in Germany costs 3 times more than the "regular" one ). You can imagine what kind of meat you get if you don't have to dig deep into your pocket for a meal.

</comment><comment><USER5> As a cooking enthusiast I struggle with finding vegetarian recipes that are appealing to me, my wife and kids, even if we'd like to eat more vegetables.

As a "carnivore" or at least omnivore, most dishes feel like they're either missing some part (i.e. "dinner is just a salad") or trying to imitate a meat product.

<comment><USER6> Cold turkey could be hard. Try transitioning slowly. As a start, just cook more veggies and load up your plate with them. Roasted broccoli, cauliflower, brussel sprouts, etc., can be amazing. You can also substitute less-bad meats (turkey burgers instead of cow, etc.) or try out some of the veg. substitutes.

<comment><USER7> Going slowly would be my recommendation as well. I transitioned to lacto-ovo vegetarian over the course of somewhere between 2-3 years. First was red meat, then poultry, and then fish. Even there, I had tiny goals -- I started with, "I won't buy this at a supermarket, but I'll eat it if I'm offered, or at a restaurant."

I'm also a really picky eater, and it took about that amount of time for my palette to start to change, to the point where I now really enjoy salads, mushrooms, tofu, and well-cooked veggies.

Changing a pallet is hard, it's OK to do it gradually, and it's OK to experiment and find setups that work for just you. I'm still working on softer veggies like baked beans; everyone says they're really healthy, but I saute about 90% of the veggies I eat. There's something about steamed or boiled veggies that just grosses me out.

But there were other foods I thought I'd never like before, and it's been really interesting especially over the last 4-5 months to go back and try foods that I dismissed before and discover that I suddenly like them a lot more.

</comment></comment></comment><comment><USER8> The biggest takeaway I get from the article is that the average annual food- sourced CO2 emissions is equivalent to driving 6000km. Average car owners in North America do quite a bit more than that annually (and likely in a vehicle that produces much more CO2 per km than the europe-based study would use)

<comment><USER9> Oh wow, I just did the calculation myself (3.22 trillion miles and 330 million people) to see the 9800 miles _per capita_ driven in the USA.

What a waste. I hope that at least most of it is long haul trucking or something with personal value like a vacation, rather than just commuting.

<comment><USER10> The average American commute takes 26.9 minutes: [https://www.npr.org/2018/09/20/650061560/stuck-in-traffic- yo...](https://www.npr.org/2018/09/20/650061560/stuck-in-traffic-youre-not- alone-new-data-show-american-commute-times-are-longer)

9800 per capita should be completely unsurprising to any American. If all you did was drive to work, it'd be a mere 40 miles per workday (5 days a week, 50 weeks).

Non-Americans might be surprised about it. But let me be clear: driving is the backbone of American society. Always has been. The classic video game Oregon Trail is about Americans making one long commute across the entire country, so they could find better jobs. Which honestly explains a lot about Californians: our ancestors traveled the whole of the United States to get here, what's a short 2 hour commute to work on the 405 every day?

Our country is HUGE, almost all of it is habitable, and we have a sprawling road system. We have the option to work where it's most profitable, and live where it's most comfortable. And boy do we take advantage of that.

Good or bad, that's the U.S., so I hope people aren't too surprised when they learn that we've been burning a lot of gasoline in our cars. And also perhaps why we have such a pro-oil/coal culture.

</comment></comment></comment><comment><USER11> This isn't really why people like to eat "local", though. Local food is popular primarily because it tastes better since it's fresher.

</comment><comment><USER12> Greenhouse emissions from meat/dairy production (the all chain) in highly efficient meat industries of 1st world countries, are negligible when compared to to other sources. [1]

Even when looking at the global numbers and taking into account countries with less efficient systems, the global total is still less than 15% of all greenhouse emissions. [2]

[1] [https://ourworldindata.org/co2-and-other-greenhouse-gas- emis...](https://ourworldindata.org/co2-and-other-greenhouse-gas-emissions)

[2] [https://en.m.wikipedia.org/wiki/Environmental_impact_of_meat...](https://en.m.wikipedia.org/wiki/Environmental_impact_of_meat_production)

</comment><comment><USER13> Makes sense, cows are bad for the environment, no matter how far away they live from you.

<comment><USER14> But a chicken or fish near you is far more environmentally friendly than vegetarian food from father places. So the title is a bit misleading.

<comment><USER15> Are they? The study left out fish, so I didn't see that conclusion in there. Also, the title is pretty much the conclusion of the study: eating vegetarian has a greater environmental impact than eating local.

<comment><USER14> So why are they generalizing their claims when they have left out whole category of foods? And they consider dairy as not vegetarian that's not accurate either.</comment></comment></comment></comment>


Linus Torvalds: 'I'll never be cuddly but I can be more polite' - <AUTHOR> https://www.bbc.com/news/technology-45664640 <comment><USER2> Previous submission (same article, different TLD):

[https://www.bbc.co.uk/news/technology-45664640](https://www.bbc.co.uk/news/technology-45664640)

<comment><USER3> So this is not the denouement, he's still on hiatus, the situation is not resolved. It's a real shame that Linus thinks that mouthing off at people is the same as being a Nazi. I feel sure his daughter had something to do with it.</comment></comment>


Microsoft's Surface Pro Tablet Sold Out, But ... - <AUTHOR> http://www.businessinsider.com/microsoft-surface-pro-sold-out-2013-2

<comment><USER2> I hope it's not another "walled garden". Are there only "Approved Windows Apps"? Will it run any old windows program? There's too much lockdown with Apple and Google tablets. Microsoft got its start supporting the essentially open IBM PC. It'd be nice seeing them return to their roots now that they're facing serious competitioin.

I wonder if I can install Mint/Ubuntu/Debian on it ?

Specs are here : [http://www.microsoft.com/Surface/en-US/surface-with- windows-...](http://www.microsoft.com/Surface/en-US/surface-with- windows-8-pro/specifications)

It does have intel CPU and 4GB ram. It does have USB port so I guess some one can install a real keyboard. That keyboard looks like fashion designers modified a security control panel. It does not look friendly to people that have to pound on the the qwerty all day.

</comment><comment><AUTHOR> Essentially,

"But the question remains how many units were available to begin with."</comment>


Misconceptions about the Khan Academy - <AUTHOR> http://shipordie.com/post/4003361706/lets-clear-some-things-up-5-misconceptions-about-the

<comment><USER2> To most people, teachers are authority figures first and employees second. Having worked on educational software for several years now I can tell you that, while most teachers are smart enough not to talk about it, they're all very aware of this fact.

So the worry probably isn't that teachers will be replaced by software. It's that availability of teaching software that's _almost_ as good as _some_ teachers will erode the social prestige held by _all_ teachers.

That prestige has been a central feature of the American political landscape over the last few decades. From a survey I happend to have on my desktop, taken during the Wisconsin Union Thing a few weeks ago [1] [2].

        What's your overall opinion of:

        Teachers           73% pos  10% neg
        Teachers' Unions   47% pos  30% neg
        Other Unions       38% pos  35% neg
        Barack Obama       49% pos  35% neg

As a group, teachers enjoyed a 63-point spread between favorables and unfavorables _during a coordinated attack in the national spotlight that went on for 3 weeks._ Maybe a president enjoys that kind of popularity for a little while, right after winning a war, but not always.

If I were a teacher, I think a slogan like "[We] aim to make the world bad teacher-proof" would sound very ominous.

[1] [http://msnbcmedia.msn.com/i/MSNBC/Sections/NEWS/A_Politics/_...](http://msnbcmedia.msn.com/i/MSNBC/Sections/NEWS/A_Politics/___Politics_Today_Stories_Teases/2-24-28-11.pdf)

[2] This is a good time to point out that I'm trying to make this post politically neutral, because politics is first in the official list of topics best avoided on HN:

<http://ycombinator.com/newsguidelines.html>

<comment><USER3> I think I understand what you're trying to say here, but the comment about presidents in war time is really throwing me off. A president is an actual person who has done "things". My opinion of the president is informed by my knowledge of those things, so, when asked my opinion of the president, I can answer. The survey question you compare it to is essentially the equivalent of asking "Do you like the idea of teachers?" If you were to ask people about the teachers in their district or their child's teachers, you would likely get a very different spread.

That's not to say that teachers don't enjoy a good deal of prestige, but I think it is safe to say that the survey you are using here may overstate your case for just how popular actual individual teachers are with their respective communities.

<comment><USER2> I think we're probably in agreement here. I wanted to use the president-in- wartime reference to parallel the fuzzy attitudes about teaching that you're objecting to. We'll rally around the flag regardless of who the president goes to war with, and if you ask people about teaching, and they'll tell you they _love_ teachers because teachers _love_ their children... while the reality is that teachers are just as human (and yes, just as venal) as everybody else.

There is one angle I'm not probably not seeing. I don't have kids myself, so I don't know what it's like to leave a child in the care of strangers for seven hours a day. You might _have to_ ascribe positive motivations to those people to keep from going crazy. But then I think about how much unhappiness one incompetent teacher can inflict on a child, and that really gets my hackles up.

</comment></comment></comment><comment><USER4> In South Africa, teaching quality and outcomes remain extremely uneven despite the huge sums of money thrown at education by the state (lazy incompetent unionised teachers being the primary reason [I won't go into the historical reasons for these teachers' chronic incompetence, since there are Apartheid apologists on HN, and I don't want to detract from the main point]).

To deal with this problem, the sort of instruction provided by the Khan Acdemy has been around in South Africa for more than 20 years. The per topic videos, as well as call in tv shows provided by these organisations are extremely important to thousands of students.

The pioneers of this sort of learning in South Africa were the Learning Channel (<http://learn.co.za/LC/index.php>), and a newer competitor called Mindset(<http://www.mindset.co.za/learn/>).

Mindset uses Creative Commons licensing, but downloading their content or viewing online seems impossible, while the excellent (in my opinion superior) Learning Channel charges large fees for their content on DVD (although some used to be broadcast for free on state television).

My friends and I used Learning Channel VHS tapes to pass our school-leaving exams 13 years ago, as we didn't have teachers for many of our subjects. Unfortunately, because of the price, I could only purchase a limited number of topics.

It is a pity that massive repositories of Learning Channel content (some of it probably unused because of South Africa's recent ill-advised, and soon to be reversed curriculum changes) are hidden behind a 20th century paywall.

South Africa, despite expensive and limited bandwidth, has a long tradition of students actively using this sort of instruction (via vhs/dvd and tv broadcasts). Distributing Khan Academy videos and Mindset Learn, and especially freeing and distributing Learning Channel videos could make a huge difference to education here. If someone has a philanthropic need to save millions of children in a third world country from chronic unemployability, those would be the first easy steps to take.

<comment><USER5> >there are Apartheid apologists on HN

that's absolutely deplorable! I'm clearly missing whole genres of conversation on this forum. So as to avoid charges of libel, let me encourage you to provide examples. Can you cite examples?

<comment><USER6> I'm guessing he means things like this:

<http://news.ycombinator.com/item?id=797920>

<http://news.ycombinator.com/item?id=1563941>

<http://news.ycombinator.com/item?id=1062454>

SearchYC is always your friend. Literally a treasure trove.

<comment><USER4> And <http://news.ycombinator.com/item?id=1662581> An entire thread of apartheid being defended.

And this: <http://news.ycombinator.com/item?id=1565298>

</comment></comment></comment></comment><comment><USER7> I just wanted to say that I like the way the article refers to "great teachers" in the plural, and to "the one" bad teacher in the singular.

Also, to misconception #4, I just finished reading Gowers' "Mathematics: A Very Short Introduction", where he tangentially makes the point that sometimes putting too much effort into trying to get students to understand "the meaning" behind some piece of mathematical technique may be misguided, in part because a given piece of math can represent multiple meanings (he uses the example of x __a + x __b = x __(a+b), which can perhaps be taught more easily axiomatically, instead of teaching "exponentiation is really repeated multiplication").

<comment><USER8> In mathematics you don't understand things. You just get used to them. -- John von Neumann

</comment></comment><comment><USER9> We home educate and the Khan Academy has been absolutely fantastic for supplementing the math curriculum we use (Saxon). Saxon is great, and the kids use it as a self-study device with great success for years, but watching Sal do his thing is a great way to get some humanity into the maths.

<comment><USER10> _supplementing the math curriculum we use (Saxon)_

For homeschooling, I much prefer Miquon Math

<http://www.keypress.com/x6252.xml>

for starting out my children, and then the Singapore Primary Mathematics materials (which now have an edition aligned to United States curriculums standards)

[http://www.singaporemath.com/Primary_Mathematics_Stds_Ed_s/1...](http://www.singaporemath.com/Primary_Mathematics_Stds_Ed_s/134.htm)

followed up by the Gelfand textbooks

<http://www.amazon.com/Algebra-Israel-M-Gelfand/dp/0817636773>

[http://www.amazon.com/Method-Coordinates-I-M- Gelfand/dp/0817...](http://www.amazon.com/Method-Coordinates-I-M- Gelfand/dp/0817635335/)

[http://www.amazon.com/Functions-Graphs-Dover-Books- Mathemati...](http://www.amazon.com/Functions-Graphs-Dover-Books- Mathematics/dp/0486425649/)

[http://www.amazon.com/Trigonometry-I-M- Gelfand/dp/0817639144...](http://www.amazon.com/Trigonometry-I-M- Gelfand/dp/0817639144/)

appropriately supplemented by ALEKS

<http://www.aleks.com>

and EPGY

<http://epgy.stanford.edu/district/info.html>

<comment><USER9> Hey, thanks for all the great links.

</comment></comment></comment><comment><USER11> Just today I used Kahn Academy in what the article seems to consider the "intended" way.

My wife's sister is in high school, taking chemistry this year. From time to time she'll get stuck on something, and I'll tutor her a bit. Earlier today she called and asked if I could help her out with "kinetics." I told her to go to Kahn Academy, watch the intro to kinetics video, and that I'd stop by on my way home from work. Later on, I stopped by and we went through a few pages of exercises together. There obviously were still a few gaps in her understanding, but all the basic hurdles (terminology, etc) were out of the way. We were able to just work on a handful of sticking points.

KA is great for handling the "busy work" of teaching.

</comment><comment><USER12> there must be some conceptions before notion of misconceptions may arise.

<comment><USER13> I forwarded his recent TED Talk to several of my teacher friends, and many immediately thought this was supposed to be their replacement. So, I'm assuming the first (mis)conception is valid at the very least.

<comment><USER14> It would certainly be beneficial if we could reduce our needs for human teachers by means of a tool like Khan Academy.

As a nation, we spend more one education than the military ($972B as of 2007 according to wikipedia, vs about $725B for the military including wars). A 1% increase in efficiency would save a little less than $10 billion, and a 16% increase in efficiency (using 2007 numbers) would be sufficient to balance the federal budget deficit [1].

If the Khan Academy is not striving to reduce our need for human teachers, we should create an organization that will.

[1] Edit: I should note that education is paid for primarily by the state and local governments, so it wouldn't be directly possible to reduce the federal budget by such savings. I was solely trying to make an order of magnitude comparison.

<comment><USER15> >As a nation, we spend more on education than the military

That's an incredibly misleading claim. Consider this graph:

<http://www.johnstonsarchive.net/policy/edgraph.html>

So we see that funding for public k-12 is roughly the same as defense, but let's consider the funding sources. IIRC, defense spending is funded solely by the federal government, whereas public school spending is sourced from federal, state, and local-- property taxes taking a big chunk out of it.

So if we compare apples to apples-- which is federal spending between the two, we see a very wide disparity. This of course is exacerbated by the military occupations currently taking place by the US gov't.

I could also argue how spending in education will have a better effect on GDP relative to defense spending, but I'm a little tired of googling things.

[edit] Here's a much clearer picture of the spending distribution: [http://www.usgovernmentspending.com/us_education_spending_20...](http://www.usgovernmentspending.com/us_education_spending_20.html)

Compare edu to defense and you'll see my point.

<comment><USER14> Why is it misleading to look at total cost or total government cost rather than simply federal government cost? What makes the federal government special?

Now, as for my numbers: 2007, $972B total, the government portion of it was $809B. If you restrict to K-12, it is indeed slightly less than the military ($493B vs $653B). Government expenditures on education are still $150B more than the military as of 2007, the year I originally cited (including higher education and "education not definable by level").

For 2009 (the last year for which full data is available), the gap between government spending on the military and education is $50B (in favor of education).

Regardless of whether spending on education is better for GDP than defense spending, it would be better still to provide the same education for less money. When you spend this much money, small gains multiplied systemwide yield huge gains. A 1% increase in efficiency saves you $8.5B in gov spending and $9.7B in total spending.

Or, to put it another way, every teacher we replace saves $50-150k/year directly and removes a massive unfunded liability (their pension/future health care costs) from the government balance sheet. If Khan Academy isn't ambitious enough to try to do this, hopefully someone will step up and do so.

<comment><USER16> >every teacher we replace saves $50-150k/year directly and removes a massive unfunded liability (their pension/future health care costs) from the government balance sheet

Who looks after the children?

If parents are working then, even if children are learning through a computerised system, children still need to be cared for.

Are you going to do away with teaching staff altogether? So no one to monitor and encourage the students, to watch that they're not going lord-of-the-flies and building a bonfire out of the learning terminals or are you going to mandate that parents look after their kids and take responsibility for what is currently [often] school based learning.

Don't get me wrong, teachers are not solely childcare professionals. But, children still need care without teachers.

Presumably non-teaching child care staff in a school like environment still need to be paid wages and pensions and have their health costs paid - did you account for that in your savings?

Are you planning on Khan Academy sorting out emotional education, social education, etc. too?

<comment><USER14> The fact that we can't replace every single human does not mean we shouldn't try to replace some of them.

Is it your assertion that with 16% less adult supervision (to borrow a number from my first post), schools would degenerate into "lord of the flies"?

If anything, I expect the situation would improve. Rather than having 1 teacher trying to do double duty (lecture and impose discipline), we could have cheaper discipline-only employees handle the discipline side and leave the lecturing to Khan.

<comment><USER16> I guess what I'm wondering is how're you implementing it beyond just telling about 1 in 5 teachers not to come in to school next term?

It sounds like you're planning on having a "person with a big stick" in a room of 35 kids playing a video on a screen. Or possibly in a room of 35 computers with kids at each one.

For sure, have a room of 1000 computers and one person with a machine gun ... sorted!??

<comment><USER17> You hire new teachers slower than old teachers retire.

<comment><USER16> OK, in most schools where I am that won't work (for example if there are 2 teachers for 1 year of pupils, one retires you then have a 60+ student class and classrooms designed for about 24) but that's not what I'm trying to get at.

What I want to know is how you're integrating Khan Academy (or similar) use into a pupils learning experience - eg give them a terminal to interact with for all their learning?

Also he seemed to be suggesting that we get rid of people in the role of teachers and have some form of child/youth minder. What's their actual role, what setting are they working in, how do they relate to the kids, are we shouldering kids/youth with the entire responsibility for their own education, is this the ultimate pupil-led learning or something else?

<comment><USER14> _What's their actual role,_

Preventing violence and hooliganism.

 _what setting are they working in,_

The video lecture portion of the educational experience.

 _are we shouldering kids/youth with the entire responsibility for their own education,_

In another post I suggested a model of 2 hours of video lecture, 1 hour of recitation with a human teacher. Thus, you allow 1 teacher to do the work of 3. The youth police would devote their full attention to overseeing the video lecture area and preventing hooliganism (as opposed to 50% on police work, 50% lecturing like a traditional teacher). Thus, the youth police would be lower skilled (and hence cheaper) and we would probably need fewer of them than teachers.

This is one possible model. I'm sure if you devoted 30 seconds of thought to it, you could come up with other possible ways (not just straw men) of doing it. I'm not proposing a solution, I'm asking why Khan Academy isn't trying to come up with one.

<comment><USER16> See, police in my country earn more than teachers.

>"I'm not proposing a solution"

It pretty much sounds like you are, just a partial one.

The problem as I see it in implementing such a system is that basically you have to experiment with a whole load of people and if the experiment doesn't work then it's "oh dear we messed up your education, nevermind there are plenty more people to experiment on".

The least impacting way to trial this that I can think of would possibly be in a situation similar to that in Australia where some kids/youth in the interior belong to "schools of the air" and interact with teachers by webcam (eg <http://www.emerge.net.au/~kalsota/information.htm>, <http://www.outbackwriter.com/education.htm>). Having kids able to use video lectures to supplement in this sort of scenario seems less impacting and more easily trialled as the kids are using a computer in a similar way already - perhaps they've been doing such a thing, not sure. What is different about schools of the air is that they appear to be largely home-tutoring with support.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


$99 TouchPad a hit, as Ubuntu and Android ports emerge - <AUTHOR> http://www.linuxfordevices.com/c/a/News/Touchpad-discounted-gains-ports/?kc=rss <comment><USER4> I'm sure selling something for 1/3 the cost to make it is attractive to buyers... But of course, HP can't afford such a thing indefinitely. It was merely an attempt to get rid of this embarrassment as quickly as possible.

And it worked, too... I couldn't get my hands on one.

<comment><USER5> And yet, now they have this sizable user base waiting to be monetized. It's like selling razors for cheap and making real profit in selling the blades. If only HP had "blades" to sell on top of the touch pad.

<comment><USER6> They do... they have an official stand thingy that incorporates wireless charging (I think it's called the touchstone). It's a nice accessory and one that I wish was available for my iPad.

</comment></comment></comment><comment><USER7> webOS is based on Linux, only tailored beautifully for a finger/touch based interface, so why bother replacing it with a variant of Linux that is not?

<comment><USER8> I'd assume because webOS will not be receiving updates.

<comment><USER9> Yes, it is. Heck, a new version of webOS was pushed out yesterday.

<comment><USER10> An update pushed out yesterday was prepared entirely before HP made their big announcement, though. Will there be any WebOS updates for the TouchPad now that HP has discontinued it and is exiting that space entirely? Seems highly doubtful.

</comment></comment></comment></comment><comment><USER11> I was - sad. I'm a WebOS fanboy, watched live streams of the HP revelations in the beginning of the year? What? 'Available in Summer?'

The price reduction was amazing, but the servers didn't hold out. And - <USER2> this is where I'm really unhappy - lots of people I heard about used this as a business chance. 'Hey, let's order six of these devices and sell them for profit on eBay'..

Bah. I own a Palm Pre Plus, really looked forward to buy Pre 3 & Touchpad. After waiting and waiting and waiting I gave in and upgraded my phone with an Android device. The price reduction would've been a nice chance to grab at least one current WebOS device (and look into tablet use cases), but 'entrepeneurs' like those above ruined it. Really, I spent all in all ~10~ hours of manual refreshing and checking if I can get one. Meh.

<comment><USER12> It has been disappointing. I spent more time than I probably should have trying (and failing) to snag one. All of the scalpers will probably saturate the market though and when people realize that it is now a dead ecosystem, the aftermarket price might be acceptable to you.

</comment></comment><comment><USER13> Looks like eBay and craigslist are stabilizing the 16 gb version around 250-300, but there will probably be a drift downward as time wears on and this story falls off the news. What I'd hate is to be pricing Chromebooks at $429 right now.

</comment><comment><USER14> Several $99 tabs have emerged in India. I am yet to get my hands on them but I suspect Indian companies have simply imported some cheap Chinese low quality stuff and branded as their own.

<comment><USER15> All of the cheap tablets are using resistive touchscreens. After 5 minutes of using one you'll want to throw it out the window. They're impossible to stay calibrated, they can't do more than one-point touch, and if you're lucky you'll remember where the stylus is for the first few days before it's gone forever.

<comment><USER16> Funny; I used a Palm III then a Psion 5 for several years in the past. Both were resistive touch screens, both were accurate, I didn't lose either stylus. In fact, I found the resistive screen _more_ accurate than my current capacitative on my phone, because I quickly realised I could use the end of a fingernail as a very precise makeshift stylus - which is obviously out with capacitative.

Is there a specific reason these are _that_ much worse than 12-13 year old devices?

<comment><USER15> My hypothesis is that the larger the screen, the harder it is to keep the resistance within tolerance for the price.

Don't get me wrong, there _are_ large-format resistive screens that work well. You can see them on a lot of commercial and industrial products (ask any waiter or waitress working with a Micros system).

But I think what is being put on the $99 tablets are very cheap films with loose tolerances and cheap knockoff controller chips. You can literally feel the film floating off the cover lens on some of these tablets. I tried one chinese Android tablet, SuperPad III, and you could feel the film _moving_.

</comment></comment></comment></comment><comment><USER17> Insight still had tablets available this morning for $99 (16gig) and $149 (32gig). The site seems to be down now, but the links were

[https://www.insight.com/search/ppp.web?materialId=FB356UT%23...](https://www.insight.com/search/ppp.web?materialId=FB356UT%23ABA) [https://www.insight.com/search/ppp.web?materialId=FB454UT%23...](https://www.insight.com/search/ppp.web?materialId=FB454UT%23ABA)

<comment><USER18> I just called and they're out of stock now.

</comment></comment><comment><USER19> Would have been interesting if they'd discounted it to this level _before_ canning the ecosystem. Might have given it the shot in the arm it needed?

<comment><USER20> Come on, the BOM alone on these things is more than $200 and there is no console-like way to make your money after.

<comment><USER21> You mean like the billions of dollars Apple makes from their App Store ?

<comment><USER22> Apple CFO Peter Oppenheimer stated that "We run the App Store just a little over breakeven" during a shareholder meeting earlier this year. An analyst from Citibank estimated that the App Store would account for $2B in yearly revenue for 2011. Compare that to the $24.67B revenue that Apple had in Q2 of 2011 alone, and that puts the App Store at approximately 2% of Apple's yearly gross revenue. Also, a Trefis analysis of $AAPL puts iTunes and iOS Apps at a combined 4.3% share of the stock's perceived value. While the App Store does provide the ecosystem that allows the iPhone and iPad to thrive, it does not act as a significant revenue source for Apple.

<comment><USER21> I don't see how that invalidates my point in anyway, yes Apple doesn't make a significant proportion of their revenues from their app store, but that doesn't mean that $2 billion dollars of revenue is insignificant in absolute terms.

<comment><USER23> It is when you are trying to recoup losses form selling hardware below cost. I think App Store revenue last quarter was 1.4 billion. Take out content providers share and you are left with 420 million. This is for the entire store mind you.

HP's fire sale will cost them something like 100 million and it is not as popular as the iPad. Not even Apple could pull something like this off.

</comment></comment></comment></comment></comment></comment><comment><USER24> Whether or not this helps HP, this is probably going to turn out to be huge for the future of tablets. Millions of people who would not have bought one for years will very soon take tablets for granted.

<comment><USER25> And buy an iPad.

</comment></comment><comment><USER26> Can you still find them for 99$ somewhere?

<comment><USER27> Check <http://slickdeals.net>. Occasionally someone will find a store with more stock. It's rumored that HP will have more in about a month, and/or we'll see these again around Black Friday (post-Thanksgiving sales in the U.S.).

<comment><USER28> Is HP ceasing production of these yet?

<comment><USER29> Yep.

@BrynaAtHP: "K getting of Twitter for a bit for dins dins. For the record: New inventory coming is from a warehouse, not being manufactured. #justsayin"

<https://twitter.com/#!/BrynaAtHP/status/105823537037717504>

<comment><USER28> Man, I wish she stopped talking in that tone. "#staycoolmybabies" _shudder_

</comment></comment></comment></comment></comment><comment><USER30> at my work the devs have ordered like 2-3 each and 6 for other employees, so £90 for an android tablet is brilliant, the ubuntu port is news to me though, but all the better

<comment><USER31> I've been trying all day to get my hands on one, and yeah £90 is fantastic.

Tell your devs that I hate them, everywhere in the UK is now out of stock and we have only rumours to go on.

</comment></comment><comment><USER32> reminds about the IBM's "strategic mistake" of allowing BIOS clones that triggered the PC revolution.

<comment><USER15> Huh? IBM couldn't stop BIOS clones after they lost the Compaq lawsuit.

<comment><USER32> Their publication of BIOS source allowed for successful "clean room" <http://en.wikipedia.org/wiki/Phoenix_Technologies#History>

Interesting history to compare with discussed in another thread Google's Java API "infringement".

<comment><USER15> The publication of the _API_ allowed for clean room engineering of BIOS clones, but the publication of the IBM BIOS source was a defensive move to taint the pool of engineers that would be trying to write clones.

<comment><USER33> The publication of the source code was not a defensive move. It predated the clones - it was a time in which it was customary to include schematics with manuals (I still have an "XT Technical Reference" at home which includes full schematics and commented bios source code.

<comment><USER15> Sure. Apple did it too. I still have the original ][+ Monitor ROM listing somewhere. Apple listed theirs to aid hobbyists. Did IBM do the same? I would think to IBM it had more to do with copyright than aiding hackers.

<comment><USER33> They didn't do it to aid hobbyists or hackers per se. It was just standard practice at the time. Televisions, radio receivers, amplifiers, washing machines -- almost everything came with schematics.

Also, at the time, IBM did not consider the PC a "serious" business - <USER3> just did the minimum possible to not lose out on a possible new market. The original PC (PC-g) and even the PC-XT were basically not much more than Intel's reference 8086 / 8088 design with not a lot of modifications -- I don't think anyone at the time (1982) thought there was much IP there anyway.</comment></comment></comment></comment></comment></comment></comment>


The Vexing Legacy of Lewis Terman (2000) - <AUTHOR> http://alumni.stanford.edu/get/page/magazine/article/?article_id=40678

<comment><USER2> TL; DR.

The writings of a haphazard intelligence researcher from _1928_ reveal his belief in the program of eugenics.

Wow, what a shocker.

<comment><USER3> Eugenics has transmogrified and implanted itself in many aspects of popular culture, so this is actually quite important to those of us who are trying to make the world a better place. The fight against discrimination and hatred is a viable means of increasing _everyones_ intelligence, and not just the lucky few with time on their hands to navel gaze. If you work in the modern social world and don't see eugenics-influenced cultural attitudes in play, you're not looking - or working - hard enough to recognize it. That's why this story is important - even still today. Just because we made it to another century doesn't mean we're not still holding on - rather desperately in some cases - to an antiquated view of our civilization.</comment></comment>


Unleashing use-before-initialization vulnerabilities in the Linux kernel [pdf] - <AUTHOR> http://www.cc.gatech.edu/~klu38/publications/ubi-ndss17.pdf <comment><USER2> I used to think only crazy ivory-tower research project proposed rebuilding our operating systems from the ground up using sound methods, proved correctness in the inner parts, and better languages: a nice idea, but a bit crazy, and unlikely to succeed outside of academia.

The more time goes by, and the more ubiquitous our computing devices become, the crazier it seems _not_ to take this approach. It sounds like Fuchsia is (might be?) a step in the right direction… I'm excited to see what happens there.

<comment><USER3> But when it's trivial to try QUADRILLION fuzzing operations (sixteen four gigahertz cores do this many operations every 4.1 hours) do you really need formal correctness? Can't you brute-force correctness, by literally trying each and every possible input and output, and literally trying every possible state?

We have so much power it's obscene. We're producing SHA-1 collisions without damaging or analyzing the algorithm, just using brute force. Why not take that approach to kernel security?

I'd sooner trust code whose quintillion input and output states have been exhaustively brute-forced over a few months (so that literally every possible path and value that code can take has ACTUALLY been run), than code which has been formally proven to be correct but without having been subject to such a test.

<comment><USER4> _Can 't you brute-force correctness, by literally trying each and every possible input and output, and literally trying every possible state?_

No.

Take a simple function that has two 64-bit numbers as input and one output; your sixteen 4Ghz cores would take over 11 billion times the current age of the universe to verify it.

You can, instead, do things like symbolic execution... and it turns out, that kind of thing is often a big part of "formally proven correct".

<comment><USER3> What do fuzzers do in practice? (I am not up on the state of the art)? They try to explore edge cases, but how do they know what is likely to be an edge case? Or how do they try to get coverage of their fuzzing?

<comment><USER5> They no longer just try out random combinations or cover the input space exhaustively (which is not feasible anyway).

Nowadays they use instrumentation in the fuzzed/tested code to have guidance in what direction the input should be modified to get more cases the code covered.

Good example: [http://lcamtuf.coredump.cx/afl/](http://lcamtuf.coredump.cx/afl/)

</comment></comment></comment></comment></comment><comment><USER6> _In particular, widely used systems such as OpenSSL explicitly use uninitialized data for the generation of entropy._

Uh oh. Another OpenSSL bug.

If you're running OpenSSL in a container or VM, there's a good chance of repeatability.

<comment><USER7> AFAIK it's not the only source of entropy, but gets mixed in with all the other entropy sources its RNG uses.

</comment></comment><comment><USER8> Given all the process, code reviewing and so many eyes on linux, I find it amazing to think there are so many issues with this.

<comment><USER9> It's statistically inevitable: many eyes also means many fingers, and you'd need a _lot_ of nines on programmer perfection to avoid any use-after-frees in a project as big and frequently-changing as Linux. This is why people are so hype about memory safety recently--get a computer to do something perfectly, rather than trying to push every human up the asymptotic slope to perfection (when they have much more important things to spend their time on!).

<comment><USER10> Except compilers are also big MLOC+ projects with their own bugs, and every compiler bug is a potential source of memory errors.

Plus (at least in Rust) in order to ever do anything useful, you have to use unsafe anyway, usually in the most complex bits of code that have the most potential for subtle memory errors. Personally that's the biggest problem I have with it: it seems like it helps avoid issues a lot, but only in the easy cases where I'm very confident I can avoid them anyway. In the really tricky subtle cases (or even fairly basic things like cyclic data structures, which are _not_ niche) the compiler throws up its hands. Those, honestly, are the cases where I want compiler help.

That's not to say I don't think it's useful. In fact, making all the easy cases trivial does mean you can focus your effort, analysis, thought, design, whiteboard space, etc. on the trickier cases. But it's not anywhere near as useful as it is sometimes claimed to be.

<comment><USER11> The easy cases... Like 99% of your entire project including checking for data races?

Until we have perfect AI writing all our code, it's going to be pretty difficult to fix the other cases. That's what code reviews and extensive unit tests are for.

<comment><USER10> If you're going to respond to my post with such trivial rubbish I'm not going to respond to yours with anything other than this comment.

<comment><USER12> Hang on. That's not ideal.

Could you possibly go into further detail?

I feel that Rust is envisioned by its followers as the just-unveiled never- before-known perfect solution to memory safety and related problems, when in reality C and other languages continue to have similar issues _because the issues themselves are not solved problems_. So I'm holding Rust at arm's length until someone can thoroughly and objectively debunk the views that I have.

But I'd love to be able to argue effectively. I agree with all the statements you made two levels up. Can you provide further detail to counter the parent comment?

<comment><USER9> I think the problem you see in Rust evangelism is a conflation of overall program correctness (aka "security"; any bug can be considered a security bug in a contrived-enough threat model) with memory safety.

The C programs I encounter in the wild tend to be both insecure and not memory-safe. The difference between regular bugs in memory-safe programs and memory-safety bugs is that with a regular bug your program is still evaluating the code you wrote; perhaps you forgot a permission check, or you made a silly mistake in code that you didn't think was security-relevant but which a user might be using to keep their house doors locked. These are frustrating, but can usually be understood once found by established debugging techniques like bisecting a codebase with a test case.

With a memory-safety bug, your program runs the buggy code and, if you're unlucky, will diverge from the semantics you associate with its source code. Whereas a C programmer thinks of "x->name = foo;" as making an assignment of a struct field, if "x" is an invalid pointer, this code might write to an unrelated integer variable, modify 4 or 8 bytes of a string buffer, cause a segfault (this is nice, since we find out our program is buggy), alter a function pointer (to produce a segfault muuch later in code which is itself correct), or have any number of other effects.

This is much more hard to debug, and it's effectively impossible to mitigate the impact on _your_ code of memory safety bugs _outside_ your code. If you're working in a memory-safe language and call a function which you do not know to be implemented correctly, the worst thing it can do is issue an unexpected system call, which shows up very quickly in debugging. It can't mangle unrelated variables to make the program crash in correct, bug-free portions of code.

As noted, Rust is not, as a whole, memory-safe. Unsafe code can set up bombs that will cause segfaults and other mischief in safe code, just like the situation in C if we substitute 'unsafe' for 'incorrect' and 'safe' for correct. But, in Rust, if you see misbehavior you do not have to audit your entire codebase. You only need to audit the code explicitly marked as unsafe. The vast majority of computation in Rust is outside of unsafe blocks, and using unsafe in the middle of a complicated, subtle algorithm raises big warning bells in code review.

With respect to "C and other languages [having] similar issues", I don't think this is the case. Remote native code execution is a security issue only present in memory-unsafe programs. We do see remote (high-level) code execution vulnerabilities in programming languages with "eval"-like faculties, but it's not hard to audit your code and all its dependencies for calls to the built-in "eval", whereas auditing C code for memory safety is incredibly difficult.

All of this is in some sense a consequence of the principle of least privilege: we want to make the world more secure by avoiding having an omnipresent "do absolutely anything" escape hatch, so that we can trust modules in proportion to the privileges they need. Rust and memory safety aren't a silver bullet, but I believe they're a cost-effective step toward correctness.

The other half of Rust is that having algrebraic datatypes and a good typesystem _helps you help yourself_ avoid many logic mistakes, and having an expressive language with generics helps you write less code (which correlates with having fewer bugs). This is why Haskell programmers like to claim they see fewer bugs than other languages. It's much harder to make an objective argument here, because availability of tools for preventing bugs isn't the same as lack of bugs. There are C codebases with fewer bugs than Haskell codebases; pure bug count depends on a multitude of factors in the development process and only formal verification can prove your program to be correct relative to its specification.

And then your specification still might not mean what you wanted it to mean! There aren't any silver bullets, but Rust is a useful tool that you should consider making part of your toolkit, and there's been a lot of work to try to make it able to do all the things people do in C.

<comment><USER12> Thanks very much for this.

(Some bits have been elided for brevity and to avoid the HN comment length limit; do note I understand the points you've made in spite of shortening some parts)

> _The difference between regular bugs in memory-safe programs and memory- > safety bugs is that with a regular bug your program is still evaluating the > code you wrote; (...) [t]hese are frustrating, but can usually be understood > once found by established debugging techniques like bisecting a codebase > with a test case._

Right. (It's sad the only truly generic way to apply this approach is with fuzzing.)

> _With a memory-safety bug, (...) it 's effectively impossible to mitigate > the impact on your code of memory safety bugs outside your code._

Ooohh. I _see_ \- faulty image parsing letting you break out of Chrome, or faulty font parsing letting you run amok in the NT kernel (yay!).

> _As noted, Rust is not, as a whole, memory-safe. (...) But, in Rust, if you > see misbehavior you do not have to audit your entire codebase. You only need > to audit the code explicitly marked as unsafe. The vast majority of > computation in Rust is outside of unsafe blocks, and using unsafe in the > middle of a complicated, subtle algorithm raises big warning bells in code > review._

That makes sense.

> _With respect to "C and other languages [having] similar issues", I don't > think this is the case. Remote native code execution is a security issue > only present in memory-unsafe programs._

It's so sad the Burroughs-style architecture ([https://news.ycombinator.com/item?id=14073079](https://news.ycombinator.com/item?id=14073079)) fizzled out :(

> _We do see remote (high-level) code execution vulnerabilities in programming > languages with "eval"-like faculties, but it's not hard to audit your code > and all its dependencies for calls to the built-in "eval", whereas auditing > C code for memory safety is incredibly difficult._

Unless it's JavaScript - [https://news.ycombinator.com/item?id=14013155](https://news.ycombinator.com/item?id=14013155)

(Related: [http://stackoverflow.com/questions/42776357/can-i- effectivel...](http://stackoverflow.com/questions/42776357/can-i-effectively- use-transpilation-code-tokenzation-regeneration-a-vm-or-a-si))

> _All of this is in some sense a consequence of the principle of least > privilege: we want to make the world more secure by avoiding having an > omnipresent "do absolutely anything" escape hatch, so that we can trust > modules in proportion to the privileges they need. (...)_

Right. On the one hand that [escape hatch mentality] gets you Symbolics Lisp; on the other hand those Lisp machines never ran banks or multiuser systems :P

> _The other half of Rust is that having algrebraic datatypes and a good > typesystem helps you help yourself avoid many logic mistakes, and having an > expressive language with generics helps you write less code (which > correlates with having fewer bugs)._

The only problem there is that the verbosity of the code can cause oldschool hackers to flounder: [http://esr.ibiblio.org/?p=7294](http://esr.ibiblio.org/?p=7294)

> _This is why Haskell programmers like to claim they see fewer bugs than > other languages. It 's much harder to make an objective argument here, > because availability of tools for preventing bugs isn't the same as lack of > bugs._

Can't disagree there. Objectivity FTW.

> _There are C codebases with fewer bugs than Haskell codebases; pure bug > count depends on a multitude of factors in the development process and only > formal verification can prove your program to be correct relative to its > specification._

> _And then your specification still might not mean what you wanted it to > mean! There aren 't any silver bullets, but Rust is a useful tool that you > should consider making part of your toolkit, and there's been a lot of work > to try to make it able to do all the things people do in C._

Thanks for this, it was an interesting read.

If anything, Rust badly needs a rockstar _documentation_ team who can canonically communicate "the state of _4 minutes ago!_ " and keep everyone updated in real time. A herculean effort, most definitely, but it would ensure people had correct ideas about the language from the start, which would be cool.

I also think I have a theory as to why the parent commentator ("Except compilers are also...") has the views they have.

Rust requires you to be extremely verbose in describing every last iota of abstraction (and you have to have the right number of levels) - you can't just start banging around in the kitchen with random bits of hardware like you can in C, or hammer strings together like you can in Perl, or do Python's "executable pseudocode" thing, etc. You have to be neurotically specific (it feels like it when coming from the familiarity of another language that most _decidedly_ does not feel like that).

I think that oldschool people encountering this see it as "too much work", because for the level of effort required, they expect the compiler to do more work for them than it's doing (for example, wrangling cyclic data structures). And so they go "I have to do _all this_?! And I only get _that_ as a result?!" and throw their hands up in the air and find it hard not to criticise.

So this folds back into the documentation problem - people are collectively memoizing the "Rust is awesome!" from all the impressionable foghorn types. The foghorns need to be turned down a little and the nuance made a little clearer.

PS. I must admit that when I saw your "x->name" my brain immediately went "wait, what's _x_ 's current value?" \- I'm still learning C (I understand the basics, but I'm still slow with it in many areas), and I'm happy I instinctively reacted like that :)

<comment><USER9> Related to "Unless it's JavaScript", what I mean by "not hard" is that a conservative static analysis can determine whether your code can possibly reference the built-in eval function. A static analysis can't tell whether a eval will be _run_ if it is present (halting problem, and there are escape- hatches like filesystem+exec()) but I think it's very reasonable to expect people to forbid them outright in high-assurance code.

Anecdotally, I've rewritten fair amounts of code from Go to Rust and it seems like Rust takes about 60% the lines of Go, which is mostly due to library reuse for control-flow constructs (higher-order functions rely heavily on generics to be usable and not merely confusing footguns) and simplified error handling. The biggest pain point when porting is usage of goroutines, because these dictate the threading and communication architecture of your Rust code, and unlike goroutines it isn't cheap to spawn large numbers of real threads. This would be better with a coroutine library, but I haven't tried that approach in a ported codebase.

I do think explaining the language clearly and precisely is a big challenge and hope we can make it happen.

It's true that Rust forces you to be explicit and precise in many places C doesn't, but coming from a long time of programming C I loved to see that Rust was enforcing universally the guidelines that C projects slowly develop after years of developer experience: explicitly state memory ownership (in comments, in C), explicitly state which shared memory is protected by which locks (again, in comments or variable names in C), call destructor functions for all live local variables before returning from a function (done automatically by the Rust compiler), and so on. Rust is, in many ways, shorthand for well- written C. It makes you jump through hoops to express many sloppy C practices.

If you're just learning C, after you understand the basics I think the most important thing to understand is the abstract machine around which the language is defined; that's how you learn to reason about UB and which optimizations and transformations compilers will or won't do, along with how to guide the compiler to the translation you want. C isn't defined against a single huge byte array of memory, and pointers aren't indices into such!

<comment><USER12> Sorry this reply took a bit long (if you see it at all) - had a bit of a notification failure.

> _Related to "Unless it's JavaScript", what I mean by "not hard" is that a > conservative static analysis can determine whether your code can possibly > reference the built-in eval function. (...)

Oooh, like _that _. I get what you mean now.

> _Anecdotally, I've rewritten fair amounts of code from Go to Rust and it > seems like Rust takes about 60% the lines of Go, which is mostly due to > library reuse for control-flow constructs (higher-order functions rely > heavily on generics to be usable and not merely confusing footguns) and > simplified error handling.

Hmm.

> The biggest pain point when porting is usage of goroutines, because these > dictate the threading and communication architecture of your Rust code, and > unlike goroutines it isn't cheap to spawn large numbers of real threads. > This would be better with a coroutine library, but I haven't tried that > approach in a ported codebase.

I'm curious if this is because there's no consensus on _which_ coroutine library to use yet. The example I linked last message ([http://esr.ibiblio.org/?p=7294](http://esr.ibiblio.org/?p=7294)) also whined about Rust not having a select() primitive or equivalent functionality in the core language - [https://github.com/rust- lang/rust/issues/27800](https://github.com/rust-lang/rust/issues/27800) remains open since Aug 2015 as of my writing this comment, but I don't know if there are any standardized (ideally stdlib-level) solutions known outside of this communication channel.

> I do think explaining the language clearly and precisely is a big challenge > and hope we can make it happen.

Cool :D

> It's true that Rust forces you to be explicit and precise in many places C > doesn't, but coming from a long time of programming C I loved to see that > Rust was enforcing universally the guidelines that C projects slowly develop > after years of developer experience: explicitly state memory ownership (in > comments, in C), explicitly state which shared memory is protected by which > locks (again, in comments or variable names in C), call destructor functions > for all live local variables before returning from a function (done > automatically by the Rust compiler), and so on.

That's fair. I get the impression Rust's vision is to be the go-to language for low-level enterprise-scale (ie, long-term) stuff, while also being accessible and suitable for hobbyist scripting. I can completely appreciate that.

> Rust is, in many ways, shorthand for well-written C. It makes you jump > through hoops to express many sloppy C practices.

That's pretty cool. :>

> If you're just learning C, after you understand the basics I think the most > important thing to understand is the abstract machine around which the > language is defined; that's how you learn to reason about UB and which > optimizations and transformations compilers will or won't do, along with how > to guide the compiler to the translation you want.

I've only very recently started to notice this and grasp the importance of the difference between the hardware and what C abstracts that hardware as; thanks very much for the recommendation, I'll focus more closely on it. On that note, I find it remarkable how platform-agnostic yet hardware-accessible the C abstract machine _is_ ; I'm not sure whether to be mildly scared at the engineering ingenuity of the language or merely duly impressed that the developers just happened to stumble upon a really good design :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I think I'm gonna drop by here more often. Interesting pdf.

</comment><comment><USER14> There always has to be a core group of knowledgeable people either developing or maintaining submissions to them. It's just the nature of the game for highest quality/reliability/security. So far, this has produced almost entirely proprietary or academic solutions with the FOSS ones not receiving nearly the contributions they need. You can't just scratch an itch and improve something that's nearly NSA-proof most of the time.</comment>


My top learning resources that helped me in my career - <AUTHOR> https://davorminchorov.com/blog/my-top-learning-resources-that-helped-me-in-my-career <comment><AUTHOR> A list of top learning resources for PHP and Laravel developers and my personal journey of discovering them over the years.</comment>


Show HN: Extension-blocking domains removed by threat from other blacklists - <AUTHOR> https://github.com/paulgb/BarbBlock <comment><USER2> As the author notes, the Streisand effect at work. But more importantly, I am quite happy that someone actually decided to stand their ground and call the bluff of future malware distributors (sorry, _advertising companies_ ). I've seen the chilling effects the DMCA has had on reasonable discourse in the YouTube community, but it extending it to what people can block in their browsers is absolute insanity.

<comment><USER3> Youtube's setup, where anyone can claim any video, and the first line of defense creators have is to plead innocent to the same party making the claim, is the most user hostile (creator hostile?) thing I've ever seen.

<comment><USER4> I've always found it funny that piracy still totally exists on youtube, but the pirates just add obfuscation techniques to prevent immediate takedowns.

Then you watch the "Important Videos" playlist ([https://www.youtube.com/playlist?list=PL7XlqX4npddfrdpMCxBnN...](https://www.youtube.com/playlist?list=PL7XlqX4npddfrdpMCxBnNZXg2GFll7t5y)) and half the videos are taken down because the account had too many strikes. It's really sad.

<comment><USER5> Funny in a terrible sort of way. The legacy copyright industry follows the same logic as various drug war participants - winning means a loss of leverage to ask for more power.

<comment><USER6> Same discrepancy between reality and rhetoric. Stated goal: eliminate all of a thing for moral reasons. Actual goal: eliminate the easiest majority of a thing for economic reasons.

</comment></comment></comment></comment></comment><comment><USER7> I'm a fan of "Code as protest", but it seems like the more practical solution would be to simply have a separately maintained domain list that could be easily integrated into the adblockers that already used EasyList.

<comment><AUTHOR> I'm not sure how that would be done but I'm open to pull requests!

<comment><USER8> You just publish a set of rules like [https://easylist- downloads.adblockplus.org/easylist.txt](https://easylist- downloads.adblockplus.org/easylist.txt)

<comment><AUTHOR> Does this work for you? [https://raw.githubusercontent.com/paulgb/BarbBlock/master/Ba...](https://raw.githubusercontent.com/paulgb/BarbBlock/master/BarbBlock.txt)

<comment><USER9> That should work, you might want to add a link to "abp:subscribe?location=h||ps://raw.githubusercontent.com/paulgb/BarbBlock/master/BarbBlock.txt&title=BarbBlock" in your readme to allow people to easily install the list by clicking that link.

Edit: replaced https with h||ps to prevent it from showing up as a link (which are apparently cut off if they're too long).

<comment><AUTHOR> Thanks, will do ([https://github.com/paulgb/BarbBlock/issues/15](https://github.com/paulgb/BarbBlock/issues/15))

</comment></comment></comment></comment></comment></comment><comment><USER10> FYI there appear to be a much longer set of Domains owned by this company, all of the same format of nonsensical word pairings.

[https://www.google.com/amp/s/amp.reddit.com/r/uBlockOrigin/c...](https://www.google.com/amp/s/amp.reddit.com/r/uBlockOrigin/comments/6swfvi/ad_domain_taken_down_from_easylist_due_to_dmca/)

<comment><USER11> Direct link:

[https://www.reddit.com/r/uBlockOrigin/comments/6swfvi/ad_dom...](https://www.reddit.com/r/uBlockOrigin/comments/6swfvi/ad_domain_taken_down_from_easylist_due_to_dmca/)

</comment></comment><comment><USER12> As a legal fine point: the list I want isn't just "sites which have used DMCA takedowns to force removal from other blacklists," but more like "sites which allege that they are legally required to be loaded if embedded in other sites."

This would include all Admiral-owned domains (including those that haven't been included in DMCA takedowns yet), and all domains owned by any other companies that believe there is some legal obligation to load their trackers. It's an important list to have.

Echoing other comments, this list should be in a standard .txt form so it can be included by other extensions, so I can pick an extension that does what I want when it encounters such a site (e.g., decline to visit the page that embeds the site).

<comment><USER13> "sites which allege that they are legally required to be loaded if embedded in other sites."

In that case, maybe the best technical and legal solution is to block any sites that _contain_ their domains completely. I.e. boycott anyone who does business with these people, without "violating" someone's interpretation of DMCA.

</comment></comment><comment><USER14> Next step is to just build a script that parses the DMCA takedown notices here[1] and automatically builds a block list out of those domains. [https://github.com/github/dmca](https://github.com/github/dmca)

<comment><USER15> you'd have to differentiation between a legitimate DMCA takedown vs a false claim...may be some NLP on the work being taken down to see if it falls under fair use?

<comment><USER16> I don't think this needs to be that complicated. If I'm understanding correctly, the DMCA takedowns in this case are against pages blocked by EasyList. You would just have to correlate DMCA takedowns with historical EasyList filters.

</comment></comment></comment><comment><USER17> Firefox also supports webextensions.

Please consider publishing a version at addons.mozilla.org too.

The tool web-ext makes this almost effortless.

[https://github.com/mozilla/web-ext](https://github.com/mozilla/web-ext)

<comment><AUTHOR> Thanks, I plan to, the main reason I targeted Chrome at first is that I've heard the review period is in months for Firefox.

<comment><USER17> That's FUD. It's automated and takes minutes at tops.

Edit: in my experience.

<comment><USER18> As far as I can see it takes over 5 days at least 50% of the time: [https://discourse.mozilla.org/t/queue-weekly- status-2017-08-...](https://discourse.mozilla.org/t/queue-weekly- status-2017-08-11/17992)

(E: and that's currently; go back a few months and it's nearly 90% taking over 10 days. Possibly well over 10 days. [https://discourse.mozilla.org/t/queue- weekly-status-2017-05-...](https://discourse.mozilla.org/t/queue-weekly- status-2017-05-12/15564))

<comment><USER17> I'm curious. Does this statistic mix old XUL based add-ons with the new web extension standard addins?

As far as I can see the new web extensions based approached has much better tooling with automatic analysis and reviewing.

</comment></comment></comment></comment></comment><comment><USER19> Can we go one step further and block websites which serve contents from these domains? This would be good first step towards eliminating toxic advertisements.

We'll give up a bit first but may win eventually.

<comment><USER20> I've put together a list of sites using Admiral's services (the domains this extension blocks) here: [https://gist.github.com/daumiller/114989e6967eb0d4c54b9ab9ff...](https://gist.github.com/daumiller/114989e6967eb0d4c54b9ab9ffe63bb5) .

I do not know how complete it may be. It was interesting putting the list together to see how most (but not all) of the users appear just as sleezy as Admiral itself.

(Blocking these sites automatically should be done based on requests pointing to the original list, rather than this derived one, but it's here for reference.)

</comment></comment><comment><USER21> Why not just distribute a list, like easylist, that can be added to existing extensions like uBlock Origin?

</comment><comment><USER22> I wonder, why is it an extension for a specific browser instead of a blacklist that can be used in any browser that has a blocker?

</comment><comment><USER23> > used DMCA takedowns to force removal from other blacklists

Could a hashed tld blacklist help? Each person downloads a unique hashed tld blacklist. Browser would calculate tld against list of hashes (or bloomfilters for what's worth)

> > [https://github.com/easylist/easylist/commit/a4d380ad1a3b33a0...](https://github.com/easylist/easylist/commit/a4d380ad1a3b33a0fab679a1a8c5a791321622b3)

In this case, what if a rule says

\- domain starts with "functio"

\- domain ends with "onalclam.com"

\- domain is no longer than 18 bytes.

Instead of cleartext?

<comment><USER24> As the claim is regarding circumventing access control, I doubt the specific technical means by which it is blocked is relevant - Admiral's interpretation of the DMCA considers the outcome (the domain is blocked), not that the list includes a domain which they own.

<comment><USER23> How about split the blacklist into multiple entities (like Shamir's Secret Sharing) with absolute no affiliation with each other.

Each one downloaded can not block anything

But if a user combines some of the data, certain website gets blocked.

<comment><USER25> This time I really don't understand why you've been downvoted. Now it feels like some powerful users know something I don't, but they won't tell

<comment><USER26> Because it was a response to a statement that the result matters more than the implementation details that consisted of achieving the same effect by cleverly modifying the implementation..

<comment><USER25> Result matters, but who's to attack when it's in fact the user who mixes some theoretically unrelated things to achieve such result? Sadly I know it wouldn't work in practice, but that's how I understood that comment

<comment><USER26> Three separate services, each hosting segments of a file that have to be put back together in some way. Either those three sites will have information on how to rebuild the file (revealing the reason they're hosting it in the first place), or there'll be a 4th party involved that provides the information. It starts looking like an organized conspiracy, if a court ends up looking at it. And that's the answer: The target companies file suit against whatever sites seem to be involved in the conspiracy.

Either that, or it ends up being so obscure that the target company(ies) never notice.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> Hosting such a project on Github, a US-based company which responds to DMCA requests, is perhaps not the most sensible choice.

<comment><USER28> Are there any good non-US Git hosting companies?

<comment><USER29> Self hosted gitlab?

<comment><USER30> gitea

</comment></comment></comment></comment><comment><USER31> What if Samsung issues another bogus DMCA? Would you dare blacklist Samsung? If the inconvenience level is high enough, almost nobody would use the blacklist. This only works for small players.

<comment><USER32> Its not the businesses primary website that would normally be the target of blacklists. Its domains serving undesirable content like ads.

For samsung.com to be added to the list first an ad-blocker would have to list samsung.com THEN Samsung would have to use legal shenanigans to get samsung.com removed from blacklists THEN it would get added.

It seems pretty unlikely. Its likely in fact that if samsung had content worthy of blocking it would be served in a way that would be easy to block without blocking samsung.com. Example nonsense.samsung.com or samsung.com/whatever.

</comment></comment><comment><USER33> This seems to be a list of other admiral-owned domains: [https://pgl.yoyo.org/adservers/admiral- domains.txt](https://pgl.yoyo.org/adservers/admiral-domains.txt)

<comment><USER34> As I note in the Github for this project, that list is woefully incomplete.

See my analysis at the Anti-Adblock Killer repo for more detail - [https://github.com/reek/anti-adblock- killer/pull/2502#issuec...](https://github.com/reek/anti-adblock- killer/pull/2502#issuecomment-277863986)

Admiral has thousands of domains across Google Cloud and AWS hosts.

<comment><USER35> Presumably they don't all point to unique IP addresses, so would blocking their IPs be more effective?

</comment></comment></comment><comment><USER36> This is one of the many situations where website owners,content creators and individuals being intimidated by using DMCA take down notice. Sometimes there are even fake notices as in here([https://www.eff.org/deeplinks/2016/10/samsung-sets-its- reput...](https://www.eff.org/deeplinks/2016/10/samsung-sets-its-reputation- fire-bogus-dmca-takedown-notices?page=174)).There should be proper checks to avoid misuse of DMCA take down notice.

</comment><comment><USER37> the original DCMA take-down was against a uBlock Origin list.

why make an entirely new plugin when you can simply make a new list? As cool as your idea is, I don't need two browser extensions to manage when the first one will happily incorporate your list.

<comment><AUTHOR> To be honest? Because I was on a plane without internet, and I didn't know how to create a blacklist but I had another extension I'd created to use as reference :)

I'm not opposed to doing both, once I have an hour to sit down and figure out what is actually involved. There's an issue to track it here: [https://github.com/paulgb/BarbBlock/issues/5](https://github.com/paulgb/BarbBlock/issues/5)

<comment><USER37> congratulations on using your flight so productively :) Thanks for filing the issue! I considered it, but didn't want to be pushy.

<comment><AUTHOR> Someone has now contributed a list: [https://raw.githubusercontent.com/paulgb/BarbBlock/master/Ba...](https://raw.githubusercontent.com/paulgb/BarbBlock/master/BarbBlock.txt)

</comment></comment></comment></comment><comment><USER38> DMCA is targeted at service provider. Unless the code is self hosted, there's a risk that GitHub can take it down to avoid lawsuits.

<comment><AUTHOR> Yep, but I can file a counter-takedown. I know the process from past experience.

<comment><USER15> awesome - it would be good to publicize this process, and also to post about those experiences. Far too many are intimidated into compliance without knowing their rights.

<comment><USER39> [https://news.ycombinator.com/item?id=14992858](https://news.ycombinator.com/item?id=14992858)

I'm rather shocked HN is not well versed in this.

</comment></comment></comment></comment><comment><USER40> This seems to beg an important question: are people who use legal means to remedy their inclusion on a blocklist necessarily doing so for nefarious reasons? Not everyone who's used a cease-and-desist or the DMCA process is a bad actor.

This extension isn't necessarily bad---if its purpose is simply to ensure that DMCA takedowns and cease-and-desist orders are properly supported and enforced only with good cause, then that seems valuable. If it ends up as a tool that starts making people who are legitimately trying to protect their livelihood or interests give up by making their legal remedies unenforceable or too onerous to undertake, then maybe we need something a little less cavalier.

<comment><USER41> You would only use a DMCA takedown on a blacklist if you want to force your content to be viewed by others. That is bad acting. DMCA is to protect the rights of content owners from their content being spread maliciously, not for it to be blocked from viewing in an individual's private home or device.

<comment><USER40> Fair enough. But I was just accepting the OP's conflation of DMCA takedowns and cease-and-desist orders. The concern remains valid in the latter case (I'm not sure the DMCA could even legitimately be used in this rather odd, inverted way, and agree that it's hard to imagine a valid use). My point is that nothing I do to a blacklist could "force" anyone to view my content---but I might have a legitimate interest in correcting a blacklist's mischaracterization or miscategorization of my content.

</comment></comment></comment><comment><USER42> Why not just switch to something like md5 for matching some domains that do this

<comment><USER43> The argument is not "they are spreading our trademark" but "they are circumventing our copy protection" and that would happen regardless of the way it is technologically done.

This is a huge attack on the way we all consume the web, because in the end it leads to a society where we are forced to consume ads to participate in the society.

</comment></comment><comment><USER44> Kudos to the author for this. I wonder what the reaction of Admiral will be.

<comment><USER45> "Well, s __t. "

<comment><USER11> I think your comment fell victim to an asterisk eating monster.

<comment><USER45> Well, st.

</comment></comment></comment></comment><comment><USER46> Besides web browser extensions, this sort of thing works nicely in firewalls that support DNSBL (DNS block lists). I've got pfSense running pfBlockerNG, and it whacks both incoming (known malicious) and outbound requests. As a result, anyone on my home network gets the same ad-blocking and other protection, including guests on the Wi-Fi. Nobody has to do anything special, it Just Works.

</comment><comment><USER47> I take it as a good sign a player in the online ad industry is starting to squirm.

</comment><comment><USER48> A much easier solution is to just add those domains to your hosts file. Then it'll work across any program or browser you use.

</comment><comment><USER49> They tried to use DMCA to censor non-copyright-able information such as this? Ridiculous.

</comment><comment><USER50> Thank you good Sir.

</comment><comment><USER11> > This is not my first DMCA-takedown rodeo

What's the story?

<comment><AUTHOR> tl;dr I found a major ticketing vendor was vulnerable to data interception because of a faulty HTTPS setup. They issued a DMCA takedown of a private video I had sent them. I fought it and they threatened to sue but they backed down after the EFF sent a response on my behalf.

<comment><USER51> Things like this is why I continue to give to the EFF.

</comment></comment></comment><comment><USER52> doesn't stuff like privacy badger generate these lists on the fly locally?

<comment><USER53> I'm a privacy badger user and I just checked my list, I don't see this domain listed.

Privacy badger will only block a domain if it appears that it's tracking you. Sites linking to this JS, that don't try to send tracking info will not be blocked.

</comment></comment><comment><USER54> What is functionalclam?

<comment> lost-theory It looks like an anti-adblock measure:

[https://github.com/reek/anti-adblock- killer/pull/2502](https://github.com/reek/anti-adblock-killer/pull/2502)

> after the page finished loading. It removed the real page content and > replaced it with a box asking me to whitelist the site.

The reason why they're using so many domains is to circumvent blacklisting, and then the DMCA takedowns are another layer of circumvention on top of that.

</comment></comment><comment><USER55> Not first time, it's stupid how GitHub accepts anything as DMCA request.

<comment><AUTHOR> Don't blame GitHub, blame the DMCA!

<comment><USER55> I blame both. Even without any copyright violation GitHub takes the DMCA request.

<comment><USER56> You have to take the DMCA request or else you lose safe harbor.

<comment><USER15> the problem is when the safe-harbour entity doesn't actually try to protect their content creators, but blindly accepts any takedown. Youtube is notoriously obedient - to the point where it can threaten content creator's livelihood (see [https://www.youtube.com/watch?v=QfgoDDh4kE0](https://www.youtube.com/watch?v=QfgoDDh4kE0) for a famous one).

<comment><USER56> Doesn't matter - they have to accept the requests and sort it out later to retain safe harbor. That's just the way the law was set up. The whole point is that they claim neutrality - they are the carrier of the information, not screeners or judges of it. The legal back and forth is between the the entity posting the content and the entity submitting the DMCA takedown. After the fact, YouTube to Github can and should and sometimes do help fight back against abuse.

</comment></comment></comment></comment></comment></comment><comment><USER57> Wouldn't put those domains in a blockchain be the proper answer? It could not be "took down", then (if it's a solid one, like btc or eth).

<comment><USER58> That's a stupid idea. What if you ever wanted to start a revocation list, when a domain is added genuinely by mistake? You'd have to use the same priv key for signing those as well, at which point you might as well have a single text file with provenance (aka git)

<comment><USER57> Well, maybe that if it sounds stupid to you, you didn't think about it enough (that's usually the case).

Make a address which creates transactions containing the domains blocked. To find the list, check the transactions from this address. If an error is made, then you can just use an other address to build the list again without the domains you want to remove, and make adblocks look for transactions from this address. The adblockers only reference an address so they have no illegal content. Domains can't be removed from transactions. Adblockers can use an other address as basis if they agree too.

<comment><USER51> I wonder if there's ever been a better real-world illustration of Maslow's hammer at work.

<comment><USER59> So is your use of the term "Maslow's hammer". Using the block chain for maintaining a list of domains that is not subject to the whims of DMCA seems like a good use of the technology to me.</comment></comment></comment></comment></comment>


Ask HN: HN Holiday Theme - <AUTHOR> Happy holidays!<p>Is this the first time HN's been themed, @dang? <comment><USER2> No, pg created that many years ago.

[https://web.archive.org/web/20071225140214/http://news.ycomb...](https://web.archive.org/web/20071225140214/http://news.ycombinator.com/)</comment>


Graphics Programming Black Book (2001) - <AUTHOR> http://www.drdobbs.com/parallel/graphics-programming-black-book/184404919 <comment><USER2> Awesome book, I actually bought a hardcopy for $150ish dollars a couple years ago because I wanted the tactile feel to go with the brilliant words.

For electronic consumption there's an excellent project on github that was mentioned here on hacker news earlier in the year / last year. You can find that here [https://github.com/jagregory/abrash-black- book/releases](https://github.com/jagregory/abrash-black-book/releases) and it is the contents of the extreme edition formatted for modern e-readers.

<comment><USER3> If anyone else wants a hardcopy: [http://www.abebooks.com/servlet/SearchResults?sts=t&tn=graph...](http://www.abebooks.com/servlet/SearchResults?sts=t&tn=graphics+programming+black+book)

</comment></comment><comment><USER4> I thought I'd have a quick look at a couple of the pages online to see if there was anything of interest. Several hours later... I've read most of the later chapters and a few of the earlier ones and already learned more about graphics programming and low-level code optimisation than I imagined possible. What an incredible book!

</comment><comment><USER5> If anybody's wondering who this mysterious and brilliant Kennedy person is on page 171, it is I.

</comment><comment><USER6> I'll never throw away my hardcopy. Abrash wrote in a wonderfully accessible way.

</comment><comment><USER7> I loved these articles in the 1990s. I implemented most algorithms.</comment>


Ask HN: Is it OK to scrape data to gain affiliate membership? - <AUTHOR> Is it OK to scrape data to gain affiliate membership?
I want to start a price comparison website in order to get commission by being a partner/affiliate to the products I am comparing prices with.
I am trying to be an affiliate but the requirement for me to be an affiliate is by having a working website with good content. I don't have good content because I don't have data on the products. To get good data, I need to be an affiliate. I see this problem sort of like the scenario where I need to have work experience in order to get my first job...
A work around I thought of was to create a scrapper but I am a bit worried that once I have a working website with scrapped data, the company I am applying for affiliate membership would void my application due to me scrapping their product data.
This is my first attempt at a business. I was wondering if anyone could chime in with some tips/suggestions/advice in this field. Thanks! <comment><USER2> Most affiliate networks provide product data feeds for a lot of their members.

Nearly all affiliates I've seen prevent scraping in their terms and conditions of affiliation.. they will also have a limit of the types of marketing you can do, which may exclude comparison sites.

Alternatively, write a few blog articles on some of the products you are comparing and add some links to them, then you have content.

</comment><comment><USER3> Just talk to the affiliate manager and ask permission to do this. E.g. give you a 3 month trial affiliate membership then get them to review the site after 3 months.

Or maybe they can give you an example csv file in the meantime to demonstrate what the file will look like, and you swap in the real data once you are approved.

</comment><comment><USER4> scrapp -> scrape

And no, I wouldn't say that's OK. Morally, for one, but also probably illegal.

<comment><USER5> Illegal how so? Maybe I'm misinterpreting what he is saying, but isn't he just getting publicly displayed product information from multiple companies, and then comparing it?

This is the sort of site I'm imagining: [http://www.logicalincrements.com/](http://www.logicalincrements.com/)

<comment><AUTHOR> Yes, this is more or less what I am trying to do. I am considering added images as well

<comment><USER5> I can't speak to the legality of it, but I don't believe that this is immoral in any sense, especially because it sounds that you have to be approved as an affiliate by the company that displays the data you're scraping.</comment></comment></comment></comment>


Flickr Takes Another Sad Turn, Gets Bought by Something Called SmugMug - <AUTHOR> https://gizmodo.com/flickr-takes-another-sad-turn-gets-bought-by-something-1825432997 <comment><USER2> The headline is rude.

 _Users who do nothing will automatically opt-in to SmugMug's terms._

That's not what opt-in means.</comment>


Ask HN: Are 3rd party browsers banned by Apple App Store Guidelines? - <AUTHOR> The guidelines say
Apple's current say
> ### 4.7 HTML5 Games, Bots, etc. > > Apps may contain or run code that is not embedded in the binary (e.g. HTML5-based games, bots, etc.), as long as code distribution isn't the main purpose of the app, the code is not offered in a store or store-like interface, and provided that the software (1) is free or purchased using in-app purchase; (2) only uses capabilities available in a standard WebKit view (e.g. it must open and run natively in Safari without modifications or additional software); your app must use WebKit and JavaScript Core to run third-party software and should not attempt to extend or expose native platform APIs to third-party software; (3) is offered by developers that have joined the Apple Developer Program and signed the Apple Developer Program License Agreement; (4) does not provide access to real money gaming, lotteries, or charitable donations; (5) adheres to the terms of these App Review Guidelines (e.g. does not include objectionable content); and (6) does not offer digital goods or services for sale. Upon request, you must provide an index of software and metadata available in your app. It must include Apple Developer Program Team IDs for the providers of the software along with a URL which App Review can use to confirm that the software complies with the requirements above.
That sounds like all 3rd party browsers are banned. Breaking it down
> Apps may contain or run code that is not embedded in the binary
> ... provided that the software ...
> (3) is offered by developers that have joined the Apple Developer Program and signed the Apple Developer Program License Agreement
Which means downloading random webpages that run software from users and sites that are not in Apple's Developer Programs is against that rules.
That would mean all 3rd party browsers are banned. What am I missing?
https://developer.apple.com/app-store/review/guidelines/#third-party-software <comment><USER2> Sadly you are required to use their browser rendering engine. This has been their stance since the start, horrible for developers, great for their dominance.

<comment><AUTHOR> you're missing the point.

According to the rules above you're not allow to use their browser engine to build a browser. Every piece of software that run in your WebView has to be supplied by Apple licensed developers. So a browser would be banned because the websites visited are not by apple licensed developers.

</comment></comment><comment><USER3> I'm not an iOS developer, but the way Firefox and Chrome get around it is by using Safari internally. In addition, JITed code is not allowed, but interpreted is.

<comment><AUTHOR> Please read the rules above.

It doesn't matter that Firefox and Chrome use Safari internally. The rules above say all code run in that internal Safari must be written by Apple licensed developers.

<comment><USER4> No, they don't. They say "the software" must be from licensed developers. Not the code itself. All those numbered sentences have "the software" as the subject.

</comment></comment></comment><comment><USER5> By that logic, no app could show a website anywhere. Clearly, Apple doesn't consider websites to be "code" in the sense of that section.

</comment><comment><USER6> What is your point? Apple is not bound by these guidelines, they can approve whatever they want. There's no use in trying to find gotchas.

</comment><comment><USER7> What are you considering building?</comment>