Why was Pinball removed from Windows Vista? - <AUTHOR> http://blogs.msdn.com/b/oldnewthing/archive/2012/12/18/10378851.aspx <comment><USER3> The best part of this article is in the comments. An original programmer on the game explains the reason that the bug was occurring and also why the code was unreadable (hint: they did it in assembly)

 _Ah, the quantum tunneling pinball!

We ran into this while writing the original code at Cinematronics in 1994. Since the ball motion, physics, and coordinates were all in floating point, and the ball is constantly being pushed "down" the sloped table by the gravity vector in every frame, we found that floating point error would gradually accumulate until the ball's position was suddenly on the other side of the barrier!

(To simplify collision detection, the ball was reduced to a single point/vector and all barriers were inflated by the ball radius. So, if the mathematical point got too "close" to the mathematical line barrier, a tiny amount of floating point rounding or truncation error could push the point to the other side of the line)

To mitigate that, we added a tiny amount of extra bounce to push the ball away from the barrier when it was nearly at rest, to keep the floating point error accumulation at bay. This became known as the Brownian Motion solution.

Since much of the original code was written in x86 asm to hand tailor Pentium U/V pipelines and interleave FPU instructions, but wiki says Microsoft ported the code to C for non-Intel platforms, I'm sure the code had passed through many hands by the time it got to you. The Brownian Motion solution may have been refactored into oblivion._

[http://blogs.msdn.com/b/oldnewthing/archive/2012/12/18/10378...](http://blogs.msdn.com/b/oldnewthing/archive/2012/12/18/10378851.aspx#10379160)

<comment><USER4> I'm so happy you posted that - otherwise I would not read down more than a couple first comments and would miss this!

<comment><USER3> My procrastination from studying for finals says "you're welcome"

</comment></comment></comment><comment><USER5> This is an excellent example of why comments in code are so very useful, helpful and in my opinion, necessary.

 _... nobody at Microsoft ever understood how the code worked (much less still understood it), and that most of the code was completely uncommented, we simply couldn't figure out why the collision detector was not working. Heck, we couldn't even find the collision detector!_

To all those folks out there who keep finding reasons to try and be clever with their language, or omit comments from their code: now you can remember Pinball. It's very possible that with some minimal commenting about what functions did, or what the intentions of block of codes were, Pinball could have lived on. Heck, we could have even seen a Modern UI version of Pinball.

<comment><USER6> It's an argument for clear code that's readily understandable by other people. It's not an argument for any particular technique for achieving that goal. I've never seen any programmer seriously suggest that code should be deliberately made difficult to understand.

<comment><USER7> I can't agree with you emphatically enough about this. Cargo cult commenting is one of the easiest ways to damage the readability of a codebase.

Comments should be an edge-case solution for explaining unusual quirks, not the go-to approach for explaining the entire codebase. Using comments to explain what the code is up to is like using exceptions for flow of control. A large proportion of the comments I see should actually be function or method names for a more well factored version of the block of code that follows.

<comment><USER8> This point gets brought up a lot, but I'm not going to complain at all. In fact, just 5-6 months ago I used to be one of those programmers who would do

        # gets the xml
        def get_xml():

It took comments like this to help me realize just how silly the whole thing was. Now I write as much self-documenting code as I can, but comment as needed.

<comment><USER9> Sure.

Comment should be "why I did this", and code should be "how I did this", some people just write in "what did I do" and walk away thought they have comment

Code took from a project I'm working with:

      #End of package

<comment><USER10> I generally become aware that I should leave a comment whenever I write something that is less than trivial (but exactly less than trivial) to write/understand. Longish list comprehension? Summarize what it does. Nested function calls? Summarize why. Etc.

</comment></comment></comment></comment></comment></comment><comment><USER11> Too bad it wasn't open source, then someone would have fixed it for free.

<comment><USER12> Someone asked that in the comments, and he responded that it was licensed from a 3rd party company.

<comment><USER13> Take the argument a step further: Microsoft "should" have required the 3rd party to provide the code under an open-source license.

<comment><USER14> Open source wasn't exactly a huge priority for Microsoft in 1995 when the application came into existence. In fact I think it's a testament to their backwards compatibility that pinball survived for as long as it did with little or no maintenance.

<comment><USER15> Quite the opposite. In 1995, killing open source was one of Microsoft's top priorities. It isn't much lower on the list these days.

<comment><USER16> Indeed, and it was still on their agenda in 1998. Microsoft saw Linux as their worst enemy and developed business strategies to eradicate it (by means of 'de-commoditizing'). Then, the 'Halloween Documents' leaked. ESR writes:

 _"In the last week of October 1998, a confidential Microsoft memorandum on Redmond's strategy against Linux and Open Source software was leaked to me by a source who shall remain nameless."_ This document can be read at <http://www.catb.org/esr/halloween/halloween1.html>

Read more at <http://www.catb.org/esr/halloween/>

</comment></comment></comment></comment></comment></comment><comment><USER17> Apparently, you can just copy the folder across to an installation of the later versions of windows and it's "fully functional"

<http://mspinball.weebly.com/>

I can't try this right now, since I don't currently have access to a Windows machine, but can anyone confirm/deny this? Do you get the floating-point gravity bug?

<comment><USER18> I'm on 32-bit Windows 7, and it works fine. The plunger is a little sluggish to respond, but otherwise no sign of the gravity bug!

<comment><USER10> 64-bit Ubuntu works fine, too. The ball disappears in some frames, but it's no thing.

</comment></comment></comment><comment><USER19> argh

> The source code was licensed from another company. If you want the source > code, you have to go ask them.

Twice this mystery company is referenced, but never a name is mentioned.

<comment><USER20> Google to the rescue!

<http://en.wikipedia.org/wiki/Full_Tilt!_Pinball>

</comment></comment><comment><USER21> Heh, 's nice to read about that and as a pinball-enthusiast i'm a bit saddened for it to be gone, even if it is more for retro-reasons as opposed to it being special in some way...

Maybe MS should team up with someone who understands making (digital) pinballs, like the guys that created Zen Pinball?

</comment><comment><USER22> To me, the lesson is: _Do not duplicate code!_ and _keep it simple stupid_

When implementing Unicode, MS said "hey let's copy all of our API functions to new names". Now they have two problems.

When implementing 64-bit, MS said "hey let's have a completely different OS for 64-bit." Now they have four problems.

Compare this to Unix/Linux/MacOS where Unicode is just implemented as a standard way (UTF-8) of encoding characters into the existing API. And there need only be one shipping OS which supports both 32-bit and 64-bit process types equally since there are only a handful of kernel APIs compared to thousands for Windows.

<comment><USER23> Confusing the Linux kernel service API and the OS API is pretty misleading.

<comment><USER22> Nope. Windows does not distinguish between a kernel APIs versus other APIs. They are all "The Win{32,64} API"

<comment><USER23> Again, you are confused with user mode API (Win32/64) and kernel mode service API. Windows does have kernel mode service API. Just it's not well known since most people don't need to deal with them.

</comment></comment></comment></comment><comment><USER24> Apparently, someone has actually FIXED it and put it online. Although hard to know if the linked EXE isn't just a trojan. Anyone have a clean room they can test it in?

<http://mspinball.weebly.com/index.html>

See: [http://blogs.msdn.com/b/oldnewthing/archive/2012/12/18/10378...](http://blogs.msdn.com/b/oldnewthing/archive/2012/12/18/10378851.aspx#10379299)

</comment><comment><USER25> Wait, can't 64-bit windows run 32-bit programs?

<comment><USER26> Answer is in the article:

[That would have been even more work, because there was at the time no infrastructure in Setup for having 32-bit-only components. (And then automatically uninstalling it when WOW64 was disabled.) And besides, all the people who criticized Windows 96 as "not really a 32-bit operating system because it has some parts in 16-bit" would use the same logic to say that 64-bit Windows is "not really a 64-bit operating system." -Raymond]

<comment><USER27> Man, if that's the case, does using a BIOS mean I'm still running a 16-bit operating system?

If so, then I guess I've got to marvel at how popular "16-bit" Linux is - <USER2> can run 64-bit only applications, watch Flash, Netflix... whoever knew a 16-bit OS could be so powerful!

</comment></comment></comment><comment><USER28> > nobody at Microsoft ever understood how the code worked (much less still > understood it), and that most of the code was completely uncommented, we > simply couldn't figure out why the collision detector was not working. Heck, > we couldn't even find the collision detector!

This continues to be one of my pet peeves, particularly with code samples and a lot of what is posted on Github, even major libraries. Almost no comments, background or guidance on the intent and structure or the code.

No, I am not suggesting that something like this is necessary:

        // Iterate through all elements
        for(int i=0; i < count; i++
        {
            // Check that velocity isn't above threshold
            if(velocity[i] > THRESHOLD)
            {
             // Limit velocity
             velocity[i] = THRESHOLD;
             ...

That's ridiculous. However, something like this is useful:

        // Bounds-check velocities
        for(int i=0; i < count; i++
        {
            if(velocity[i] > THRESHOLD)
            {
             velocity[i] = THRESHOLD;
             ...

Anyhow, dumb example I pulled out of thin air.

I've heard some say "I just write self-documenting code". That's a myth but for the simplest of structures. Any non-trivial piece of work is far from being self-documenting. Code is self-documenting for the guy who wrote it. I guarantee you that anyone else reading it has to reconstruct a stack in their head to understand what the hell is going on. That's not self-documentation. I shouldn't have to think to understand what a chunk-o-code is doing. The same for functions and/or methods.

The myth of self-documenting code is easy to demonstrate if I show you a piece of code in a language you don't know. I am going to assume that most programmers these days don't know assembler, Forth or Lisp.

        (defun GetPolylineEndEntities ( plename / plends cvcenter cvsize oldcmdecho pt1 pt2 endss outlist)
            (setq plends (GetPolylineEnds plename))
            (setq cvcenter (getvar "viewctr")
                cvsize   (getvar "viewsize")
                oldcmdecho (getvar "CMDECHO")
            )
            (setvar "CMDECHO" 0)

            (foreach point plends
             (progn
                (setq pt1 (add2d point '(-0.0125 -0.0125)))
                (setq pt2 (add2d pt1 '(0.025 0.025)))
                (command "zoom" "c" point 2)
                (setq endss (ssdel plename (ssget "C" pt2 pt1)))
                (setq outlist (append outlist (list (ssname endss 0))))
             )
            )
            (command "zoom" "c" cvcenter cvsize)
            (setvar "CMDECHO" oldcmdecho)
            outlist
        )

I wrote this twenty years ago. Even if you understand Lisp you'd have to think it through. However, this is not how I wrote it. This is what I actually wrote:

        ;</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=====
        ; GetPolylineEndEntities
        ;
        ; Argument: Polyline entity name
        ; Return: Two element list containing the first (if any) entity found at the end of the polyline.
        ;         The polyline itself is excluded.
        ;         If nothing is found at a particular end, that element in the list is set to nil.
        ;
        (defun GetPolylineEndEntities ( plename / plends cvcenter cvsize oldcmdecho pt1 pt2 endss outlist)
            (setq plends (GetPolylineEnds plename))    ;Get the endpoints

            (setq cvcenter (getvar "viewctr")
                cvsize   (getvar "viewsize")
                oldcmdecho (getvar "CMDECHO")
            )
            (setvar "CMDECHO" 0)

            (foreach point plends
             (progn
                ;Examine what connects at each end
                (setq pt1 (add2d point '(-0.0125 -0.0125)))
                (setq pt2 (add2d pt1 '(0.025 0.025)))

                ;Zoom to the end being analyzed to have better selection accuracy
                ; **** Have to figure out a way to do this without zooming ****
                (command "zoom" "c" point 2)

                ;Eliminate the original cable from the resulting selection set
                (setq endss (ssdel plename (ssget "C" pt2 pt1)))

                ;Add the first entity found to the output list
                (setq outlist (append outlist (list (ssname endss 0))))
             )
            )
            (command "zoom" "c" cvcenter cvsize)
            (setvar "CMDECHO" oldcmdecho)
            outlist
        )

Even if you don't know Lisp you now have an idea of what this code is doing. My style has changed over the years. This isn't my best example, but it is here to drive a point home.

The use of an unfamiliar language serves to illustrate the point that the idea of self-documenting code is, again, a myth. I wrote that code myself and without the comments I'd have to mentally reconstruct every step to even begin to understand what's going on and what the intent was. I haven't touched Lisp in quite some time.

I've looked through so much code in Github without a single comment that it makes me wonder if this is what is being taught in schools these days. Accurate in-code documentation is, as far as I am concerned, part and parcel of becoming a professional programmer. It recognizes that the work represents a huge investment in time, money and intellectual effort and it ensures that this effort and expense doesn't have to be duplicated in order to maintain, evolve or migrate the product as the Microsoft example clearly demonstrates.

<comment><USER29> >That's ridiculous. However, something like this is useful:

> // Bounds-check velocities

No, that is an example of a comment of a region that should have been a separate method/function.

<comment><USER28> Not really.

If you throw methods and functions at everything all you are doing is adding the processing overhead of the entry and exit from the method or function. These are not magical entities. There's a time, a place and cost to using them.

Having come up from assembly and, in general, low level coding, one becomes very aware of what is being created behind the scenes. Unless something like this contrived bounds-check test will be used multiple times across a module or modules there's no reason whatsoever to add the overhead of entering and exiting a function for a simple couple of if/else-if/else statements.

I see this all the time. Everything has to be an object and everything has to be a class with a pile of properties and methods. No it doesn't. Massive projects --critical projects-- have been done over the years without any of that. Be careful not to engage in creating a monument to a coding paradigm rather than a tight, fast, practical and sensible solution to a problem.

<comment><USER29> Then tell your compiler to inline it - but don't bother doing it until you have measured it to actually have a measureable impact. Readability and rewriteability dominate that kind of unguided microoptimizations you seem to like all the time.

That doesn't mean to abstract for the sake of abstraction but to choose the right abstraction. Writing code so that it is easy to reach the right abstraction helps a lot.

</comment></comment></comment></comment><comment><USER30> They should include Xbill by default:

<http://xbill.org>

</comment><comment><USER31> I have a virtual machine running XP for testing installers of internal tools (many engineers at HP are still running XP).

Just played a round of pinball. Despite having used Windows since 2.0, I didn't even know Pinball existed before.

</comment><comment><USER32> Another good comment that's buried near the bottom, written by one of the authors of the game, regarding the ownership of the code: [http://blogs.msdn.com/b/oldnewthing/archive/2012/12/18/10378...](http://blogs.msdn.com/b/oldnewthing/archive/2012/12/18/10378851.aspx#10379245)

</comment><comment><USER33> Ahh gotta love Wine! Runs everything :) <http://i.imgur.com/ekhiY.jpg>

What ever you do DO NOT press F4 for fullscreen, it botches dual-monitors on Gnome. Took me 20 min. to get back up and running again.

BUT, Pinball works :)

</comment><comment><USER34> I used to play Pinball at school whenever I was in the Computer Lab. I also spent the bulk of my time in the computer lab at recess. Brings back old memories.

</comment><comment><USER35> Perhaps it would help to quickly find bugs - <http://www.viva64.com/en/viva64-tool/> :)

</comment><comment><USER36> So now we know how insecure XP was (is).</comment>


Show HN: OwnMyMusic – Finally you can own your own music - <AUTHOR> http://ownmymusic.uk/?first=true <comment><AUTHOR> It's always good to own your music, I've wanted to for along time (instead of relying on Spotify/Apple Music). You can download a list of your songs that are currently on music services using www.tunemymusic.com. Once you've got a list, copy and paste the names with arists (or just type a few manually) into the box below. Make sure each song/artist is on a new line.

When going travelling without a phone, or wanting to use a 100 hour battery life mp3 player, this the project I decided to do!

It is legal, just like other youtube converter sites.</comment>


Full Screen Color Tester - <AUTHOR> https://fscolor.space <comment><USER2> Tested my POCO F1 here. No issues found. :)

<comment><AUTHOR> do you think this site is ok, does it need something else?</comment></comment>


U.S. and China Got into a Trade War and Mexico Won - <AUTHOR> https://www.bloomberg.com/news/articles/2019-03-27/who-is-winning-trump-s-trade-war-with-china-so-far-it-s-mexico <comment><USER2> Trump's trade policies will make a fascinating case study by economists when this is all over.

</comment><comment><USER3> "Got into a Trade War". I know headlines have size limits, but they're not supposed to mislead, either.</comment>


Demand Media Will Be The First $1 Billion Tech IPO Since Google -- Here's Why - <AUTHOR> http://www.businessinsider.com/demand-media-will-be-the-first-1-billion-tech-ipo-since-google-heres-why-2010-4 <comment><USER2> > leveraging search data from the likes of Google and YouTube to understand > and then "produce content people demand".

How do they get this data from Google? Is there a data feed somewhere showing what people are searching for and not finding?</comment>


The habits of practically unhackable people - <AUTHOR> https://digitalsecurity.intel.com/5habits/ <comment><USER2> Wow. Looks trustworthy. "SHARE TO WIN", uses RC4 certificates, AddTrust CA, JS links, tracking cookies galore, no CSP...

Yeah, _definitely_ the people I want to talk to about security.

<comment><USER3> I thought the "Share for a chance to win*" button was a demo illustrating the kind of button not to click.

<comment><USER2> I'm not sure. I sure as heck wasn't going to click without spinning up a VM :)

</comment></comment></comment><comment><USER4> I honestly thought all those "Share for a chance to win*" buttons were going to scold you for clicking on them, but they're actually serious...

</comment><comment><USER5> _#2:Use HTTPS where it matters._

In Chrome "https" is red and struck out: digitalsecurity.intel.com Identity not verified

<comment><USER6> Firefox nigthly just refuses to connect. The reason is, that the site only accepts a RC4 cypher.

        $sslscan digitalsecurity.intel.com|grep -i acc
        Accepted  TLSv1  128 bits  RC4-SHA

<comment><USER7> If irony were made of strawberries, we'd be drinking a whole lot of smoothies right about now...

<comment><USER8> Make that cheesecake and I'm in.

No-one who runs a server which only accepts RC4 (!!) with no forward security, and SHA1 signatures, in _2015_ , should be _giving_ security advice.

My daily driver browser has RC4 entirely disabled. This is one of the more amusing won't-connect sites I've found.

</comment></comment></comment></comment><comment> java-man Unable to Connect Securely

Firefox cannot guarantee the safety of your data on digitalsecurity.intel.com because it uses SSLv3, a broken security protocol. Advanced info: ssl_error_no_cypher_overlap

For some reason, many sites, including amazon recommendations, fail to support 256 bit ciphers. I don't understand why.

<comment><USER9> > For some reason, many sites, including amazon recommendations, fail to > support 256 bit ciphers. I don't understand why.

I assume you mean AES-256 vs AES-128. If a site is preferring AES-128 ciphers (particularly in combination with other modern cipher suite choices (ECHDE, SHA2, etc)) that's actually a pretty good indication they know what they are doing.

AES-256 offers no practical advantage over AES-128. There are no known practical attacks against AES-128, and stretching the key to 256 bits just wastes CPU cycles.

In fact, most of the attacks out there that weaken AES to any meaningful degree are those that attack the key schedule used in the 192 and 256 bit versions.

tl;dr; Save the planet. Use AES-128.

</comment></comment><comment><USER10> It doesn't seem to matter much what I do when every company I interact with gets hacked.

I had to replace my debit card this week because somebody halfway across the country tried to use it to buy $400 in gas. They probably bought it from one of the usual black markets, who acquired it from Lowe's, or Jimmy John's, or Sony, or god knows who else got hacked this week.

</comment><comment><USER11> Is this part of an Intel content marketing campaign to promote awareness of how difficult operational security is for the layman? Perhaps in anticipation of their new security suite and attempt to "eliminate the password?"

Very nice if so!

</comment><comment><USER12> Firefox nightly / built from development source refuses to connect to this site because it fails the (experimental) stronger SSL/cert requirements. (The site forces RC4)

On the habits of practically unhackable people indeed.

</comment><comment><USER13> I sort of thought that https was sufficient for most things on unsecured connections, so a VPN wouldn't be necessary to prevent things like password sniffing. Or is that wrong?

<comment><USER14> At home TLS is fine. If you're connected to a public wifi using a VPN on top of that is a good idea because you only have to trust one VPN provider (or your own server) instead of every hotel chain, coffeeshop, etc.

> sufficient for most things on unsecured connections

WPA2 + good TLS encryption (i.e., good cyphers) should be.

<comment><USER15> Speaking of which, can anyone recommend a good VPN provider?

<comment><USER16> TorrentFreak has a regular round-up of VPNs:

[http://torrentfreak.com/which-vpn-services-take-your- anonymi...](http://torrentfreak.com/which-vpn-services-take-your-anonymity- seriously-2014-edition-140315/)

The comments are probably as useful as the main content.

Personally I use AirVPN. They're not expensive, the client is open source, and performance seems good enough for casual use.

I'm not sure I'd trust any of the usual VPNs if I needed Snowden-level security. But I don't, so casual use is fine.

</comment></comment></comment></comment><comment><USER17> Is there any advantage in using a password manager over authenticating with e.g. your google account through OpenID?

I usually use my google account to login to websites I care about (most sensitive websites I know provide this facility) and moderately strong but easy to remember passwords for non-critical websites that don't provide OpenID (e.g. a forum I never consult).

Of course I have 2FA on the google account and I feel rather safe.

Should I be worried?

<comment><USER18> I'm very sleepy today, so I'm going to try not to say anything stupid. If I do, I hope someone will correct me ;-)

The basic overview of how OpenID works is here: [http://openid.net/pres/protocolflow-1.1.png](http://openid.net/pres/protocolflow-1.1.png)

So if I understand this diagram correctly, you connect to the server that you want to log into. It determines whether or not you are authenticated (probably through cookies). If so, it redirects you to the OpenID server. The OpenID server checks your credentials and returns back to the original server. The diagram does not specify, but I'm guessing the OpenID server has a session cookie for your credentials so that you don't have to log in over and over again.

So what are the downsides?

1) The server you want to log in to knows about your OpenID. In other words they can potentially identify you and track you (possibly with the help of Google). 2) The OpenID server knows which sites you are going to and when you are logging into them. It can track all of your movements. I think it would be naive in the extreme to assume that Google does not do this ;-) 3) Without knowing more details I couldn't say, but I suppose it might open you up to Cross Site Request Forgery style attacks. My experience with Google code in this respect is that they are usually extremely thorough about this sort of thing, so I think this is unlikely on the OpenID side. In my sleepy state, I can't really think clearly enough to imagine whether or not there are ways to screw up the code in the server that uses OpenID, though.

My employer loves Google and we use a ton of Google services. I am lucky enough to have incredibly technically competent management and they understand the tradeoffs of having Google track everything we do. Because of that, I use OpenID for any other external service that my employer mandates/approves of. I'm pretty careful not to go to OpenID authenticated sites by clicking on links and open them directly, so I feel confident that I can avoid CSRF attacks even if they could be done.

I do not use OpenID for personal use. My employer may be happy to have me daily work activities tracked by Google, but as a private individual, I don't really want that. I use an offline password manager: [http://www.passwordstore.org/](http://www.passwordstore.org/)

</comment></comment><comment><USER19> #6 Disables JavaScript by default

<comment><USER20> I would say disable flash/javascript by default but I too was surprised they didn't have this. Nothing like knowing you shouldn't click on a link only to have some malicious javascript do it for you.

</comment></comment><comment><USER14> Anybody else clicked the "think before you click" thing right away?

<comment><USER7> I did, expecting something along of the lines of "Damn! What did we just tell you?". That was kind of a disappointment.

</comment></comment><comment><USER21> I'm not trusting any closed-source password management programs. I generate most of my passwords (different for each service) with

        from passlib.utils.pbkdf2 import pbkdf2

        def gen_password(master_password, domain, n = 0):
          thehash = pbkdf2((master_password + "/" + domain).encode('utf-8'), b'', 100000 + n, keylen = 16)
          return base64.b64encode(thehash)[0:12].decode('utf-8') + "$1Aa"

I welcome any comments on the security of this scheme.

<comment><USER22> That may look sane, but you're deriving all your passwords from a single master "key". Leak it once, for any reason, and all your passwords just became known. (Unless you provide unique value of 'n' for each site, which I doubt you do.) If you use a common login or email address as your user name across the sites you use, they all pop open at the same time.

My take on password generation is even more straightforward:

      % head -c 9 /dev/urandom | base64

Then whatever comes out, I store on an encrypted volume - so effectively I do have a master passphrase but none of the login credentials are derived from it. For sites that I think require even more entropy, I'll just bump up the number of bytes read. (9 _8 = 72 bits of entropy, 12_ 8 = 96 bits)

I haven't yet found a password manager I truly liked.

EDIT: you do realise you are capping the entropy of your per-site passwords at 72 bits? It's more than enough against all practical brute force attacks, but it also means that any entropy in your master key above 72 bits is effectively lost.

<comment><USER23> >more than enough against all practical brute force attacks

Source?

<comment><USER22> Math.

But to give some substance to the claim, the speed record for single-system password hashing in 2012 was ~350GH/s [0].

Let's assume that in 2015 a single system is capable of doing 1TH/s, or ~1000GH/s. So, 10^12 password attempts per second. An attacker, who is _not_ a nation state, should be expected to have access to maybe 400 such systems. But to make this conservative, let's assume they have 1000 such systems. So, the attackers should be able to reach 1000 TH/s, or 10^15 attempts per second.

10^15 =~ 2^(15/0.301) =~ 2^50.

Hence, a determined attacker with finite resources has to do, on average, 2^31 seconds of work to brute force a password with 72 bits of entropy. 2^31 seconds is roughly 68 years.

That in turn means that there are lot of lower hanging fruit to pick before even thinking of expending resources to brute force passwords with 72 bits of entropy.

On the other hand, the resource requirements _are_ getting awfully close to the realm of feasibility, so 72 bits might not be sufficient for long after all...

0: [http://hackaday.com/2012/12/06/25-gpus-brute- force-348-billi...](http://hackaday.com/2012/12/06/25-gpus-brute- force-348-billion-hashes-per-second-to-crack-your-passwords/)

<comment><USER21> I feel like it wouldn't be anywhere close to 10^15 if they use a slow hashing algorithm, which is what password stores _should_ be using (e.g. [http://en.wikipedia.org/wiki/PBKDF2](http://en.wikipedia.org/wiki/PBKDF2) )

<comment><USER22> Indeed :)

Every new sensible implementation of password store is using either bcrypt, pbkdf2 or scrypt.

I picked the lowest common denominator because it caters for the worst case scenario. Systems where passwords are improperly hashed are quite likely to have other security problems too. And as such are more likely to get breached, whereby their password store is lifted too.

</comment></comment></comment></comment></comment></comment><comment><USER24> Triva: _Intel Security Group_ , (previously _McAfee, Inc._ named after its founder named John McAfee, recently renamed because of the tainted brand): [http://en.wikipedia.org/wiki/McAfee](http://en.wikipedia.org/wiki/McAfee) , [http://money.cnn.com/2014/01/07/technology/security/intel- mc...](http://money.cnn.com/2014/01/07/technology/security/intel-mcafee/)

</comment><comment><USER25> Speaking of password managers, what are some suggestions for password managers for sharing passwords around groups of staff in small businesses? We're currently using passpack, but the UI is a little janky - as a result, it's hard to get colleagues to practice good password hygiene. It's not terrible, but it is a bit annoying to use.

</comment><comment><USER26> Intel does security really well. They set an example how all large companies should do it.

</comment><comment><USER27> two factor authentication: Things like this are probably the best argument for why I should get a phone, thought I still wouldn't have much use for it.

Also, it seems safer to write down your passwords. I mean, someone might physically take it, but that seems less likely than someone digitally taking it.

</comment><comment><USER28> How is using a VPN different/better than tunneling through your home ssh server? Honest q.

<comment><USER29> Using either is good. VPN offers misdirective pseudo-anonymization which might help.

</comment></comment><comment><USER30> Phew.. Great to know that I have those traits!

</comment><comment><USER31> A pragmatic one I like to say to non technical people like my mom and sister:

\- Have a dedicated email password that is different from every other password you use.

Let's be honest: You _should_ have different passwords for every site, and you should use strong passwords and a manager, but you don't because you're a normal person. At the very least, be pragmatic and have an email password that's separate from every other service password. The idea being, if your random-service-you-signed-up-for-once.com password gets hacked, and your username was your email address, the first thing an attacker will try to do is use that password on your email. So have a strong email password and trust that your gmail account is less likely to be hacked than your random-service account password.

<comment><USER32> I use LastPass and I can't recommend it enough. It's fantastic and I have different passwords for everything simply because I never bother making passwords. I just hit the random function on it.

I still have my email passwords memorized, though.

This is honestly the best service I've ever paid for. It has never failed me, and it substantially improves my life.

<comment><USER33> I use LastPass and think it's great as well. I've tried to recommend it to others though and the common reply is "that doesn't sound secure enough for company policy".

They don't seem to realise though that their usual approach of sharing passwords over email, using the same password for several logins so it's easy to remember and using easy to remember passwords in general is much more insecure.

Services like LastPass make it practical for you to use impossible to guess passwords, different passwords for every site and let you share passwords securely.

<comment><USER34> My key argument when I've convinced past employers to implement it: you already outsource all of the hard parts of your security. Antivirus, firewall, AD permissions, server config, all of it. They either bought a product to fit the need or hired a consultant to do the advanced stuff. $12/year is pretty cheap to hire a dedicated team of security wonks to safeguard your passwords, IMO.

<comment><USER33> It's not the cost that's the issue though, people don't like the idea of passwords being stored in a single place on a internet connected computer. I mention that you can secure password access behind two factor authentication but it doesn't get around the knee-jerk reaction often. Sharing lots of passwords when working with a team remotely is especially painful when password managers are not allowed...</comment></comment></comment></comment></comment>


Ditch Your Database for a Key-Value DB - <AUTHOR> https://blog.kvdb.io/2019/10/11/why-you-should-ditch-your-database-for-a-key-value-db <comment><USER2> no thanks. i'd much rather trust postgres to handle things like foreign keys, unique constraints, transactions, and other goodies than the application, which is is what ends up happening when you try to do this in a key:value store.

<comment><USER3> precisely. I feel like I'm becoming a grumpy old man, because it seems to me, at face value, the onslaught of 'developers' have brought with them, generally, an aversion to tried and true things...or, everything other than the programming language they've learned. Few of the people I encounter know anything about SQL, much less more advanced features or design. Same with Linux systems. Why care, just throw it in a container and kill it if it acts up. It's a real shame, because I think if more folks took the time to understand things, in this case relational databases, they'd realize how absolutely powerful they are, and why this is a terrible idea.

<comment><USER4> I feel this is more about IT departments lowering their bar to satisfy their staffing needs fueled by lowering the bar in the previous round. It's a vicious cycle and a well known one, even in other fields.

Because many "engineers" do not have a solid understanding of the field, companies have been exploiting that by using and promoting solutions that would have been otherwise dismissed with very annoyed faces. Even docker would have been dismissed, as "cool but it has safety issues, so go home and redo your implementation".

<comment><USER5> The docker comparison is apt. Red Hat _did_ take home dockers work and did their homework with Podman, as a result, you basically get a complete docker compatible workflow, but now your containers don't have to run as root and you don't need a daemon constantly running on the system. The organization who really knows Linux inside and out made the better implementation.

</comment></comment></comment></comment><comment><USER6> > Often times, we end up spending countless hours setting up databases, > schemas, and dealing with ORM systems, where we could simply treat data as > keys and values.

There is always a schema, whether you want your database to help you with it or not is your choice.

<comment><USER7> Completely agree, schema forces developers to be intentional about data design. "Don't worry about it" is an insane argument here.

</comment></comment><comment><USER8> Ouch, this smells like a 2019 reenactment of the MongoDB disaster that rightfully burned a generation of Devs and Ops.

I'll leave this here for posterity:

[https://www.vividcortex.com/blog/2015/02/24/schemaless- datab...](https://www.vividcortex.com/blog/2015/02/24/schemaless-databases- dont-exist/)

— Schemaless Databases Don't Exist

</comment><comment><USER9> SQL is not that hard. And the very slight amount of analytical rigor needed to atomize data, normalize data, and think about relationships between data, makes you smarter, gives you many more options for slicing & dicing the data, and if you have a a proper RDMS, it runs faster'n shit. Parsing/serializing/deserializing JSON blobs, not so much.

</comment><comment><USER10> Christ - what is with these Benjamin Button development fads? Dealing with the NoSQL silliness of the last few years was bad enough, but just wait until the next generation of devs discovers storing shit in flat files on the local filesystem...

</comment><comment><USER11> Ok, we all know how a key-value store is not competitive with the current SQL db's. But lets remember all of this NOSQL trend started with the SQL databases being a poor fit for a distributed environment back in the day.

By the way, what i would actually love to have, is a LINQ like API abstracted over a key-value store, and access to a SQL AST also in the language.. For me i think this is the desired middle ground, where you can scale and compose data over key-value, but also not to be stuck with SQL data mappings inside your codebase.

I mean, a relational algebra API that deal with any KV store, be it LINQ or the backend of something like Presto (or the DataFrame of Spark).

If you need something like a SQL interface somewhere, you could build it by stitching the SQL AST with the engine you use directly in the language.

</comment><comment><USER12> uch... what a headache when a user needs to change their email. The mania for "schema-less" KV stores is so puzzling to me. It just takes all the stuff that used to be handled natively and seamlessly by the DB engine and forces you to reimplement it in code, only with more bugs, less efficiency, and less flexibility. I fought this battle on my current team and lost, and we have been paying a steep price ever since.

</comment><comment><USER13> The OP's last 4 submissions have all be promoting this kvdb.io service.

</comment><comment><USER14> So, I heard that Amazon developed Dynamo because they realized that most of their table lookups were either:

* looking up an item by a key

* selecting a range of items

I would never choose a key-value DB for "scalability" reasons. It's very unlikely that I will be hitting the kind of scale where it would actually make a difference.

Where I have found it useful in my particular line of work is in a fairly narrow context: working in a microservice architecture where you create a single service between your system and a 3rd party system, and it's database is essentially a mapping of your own system's IDs to the ID's of the 3rd party.

Honestly, that plus one or two secondary indexes is all I've really needed. I've done that for 3 different integrations over the course of 2 years now, and it's worked out quite well so far. The fact that we have a strict policy of not sharing db access also means that I'm not to worried about other services trying to query the data in weird ways.

There are of course more fancy patterns for structuring your data in a key- value store, but at that point the main benefit of kv stores starts to diminish once you go down that path.

</comment><comment><USER7> alternate title: "Ditch your decades-old, stable technology that everybody in the industry knows for our product that makes absolutely no case for use beyond a basic user query."

</comment><comment><USER15> I agree that dynamism can be helpful for prototyping and rush-job applications, but I'd rather "dynamic relational" be implemented for such: [https://stackoverflow.com/questions/66385/dynamic- database-s...](https://stackoverflow.com/questions/66385/dynamic-database- schema#46202802) One can gradually add constraints to give it RDBMS-like strictness as the project matures. And you can use SQL on it, with minor modifications to assist in comparing dynamic (implied) types.</comment>


Moo.com - Social networks + Physical stuff = Sales? - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2007/06/16/BUGDGQG9KA1.DTL <comment><USER2> Some more bits on MOO:

A mention by Niall Kennedy: <http://www.niallkennedy.com/podcast/2007/03/moo- cards.html>

Suw Charman's notes on Richard Moross and Stefan Magdalinski's presentation at FOWA 07: <http://strange.corante.com/archives/2007/02/22/fowa_07_richard_moross_stefan_magdalinski_how_we_turn_virtual_stuff_on_the_web_into_beautiful_things_in_the_real_world.php>

FOWA's own page on Moross's appearance: <http://www.futureofwebapps.com/pastevents.html,> giving <http://media.libsyn.com/media/carsonsystems/Richard_Moross_and_Stefan_Magdalinski.mp3> or <http://www.futureofwebapps.com/presentations/richard_moross.pdf>

</comment><comment><AUTHOR> I thought this was interesting; it's always nice to see startups selling something other than advertising.</comment>


Inventor flames Reg, HP in memristor brouhaha - <AUTHOR> http://www.theregister.co.uk/2011/12/27/memristors_and_mouttet/

<comment><AUTHOR> The picture on page 2 ( <http://regmedia.co.uk/2011/12/22/memristor.jpg> ), taken from the Williams PDF also linked in the article, is worth a look.

Took me a bit to figure out that, in the waveforms, voltage is the grey line, with the resulting current color coded by device. I guess the mysterious little arrows point left and right to the correct word (and do not indicate some flux ;-)

Another pause for the resistor, which is shown non-linear; this is not the usual depiction, but of course it is the more general case, entirely possible and sometimes desirable.</comment>


The Secret to Better Social Media? Fewer Friends - <AUTHOR> https://www.wsj.com/articles/the-secret-to-better-social-media-fewer-friends-1523376444 <comment><USER2> This is one thing I think Google+ got right. I can have different types of "friends", each in their own categories, such as "sharaholic" or "meme poster" and only visit those circles occasionally.

The only problem is the unpopularity of G+.

<comment><USER3> _such as "sharaholic" or "meme poster" and only visit those circles occasionally._

But people don't fit neatly into those categories. You'll miss an important life event from "meme boy" or "share girl" if you've filed them neatly away like that. G+ is unpopular because their solution to organising your friends is _worse_ than the competition.

<comment><USER4> People can be in multiple circles, it's like a Venn diagram of sorts.

<comment><USER3> _People can be in multiple circles_

Sure, but how would you classify Meme Boy in circles so that you don't see his memes but you do see his important life events? Or Share Girl so you don't see what she had for lunch but do see important things?

<comment><USER5> I think the way it would naturally work on G+ is that Meme Boy will use circles this way. So if you get tired of his memes, you message him and ask him to make a Meme Circle and not include you in it.

But really, if Meme Boy enjoys posting memes, he likely already will have a Meme Circle. So you just ask him to remove you from the Meme Circle.

</comment></comment></comment></comment></comment><comment><USER6> I've found that casual chatrooms with a small group of friends is pretty effective at keeping in touch without the noise.

There are many common options like Slack, IRC, Keybase, and others. The hardest choice is finding a technology folks can agree upon; convenience and inertia go a long way towards maintaining a successful chatroom.

<comment><USER7> Why can't email do this? Serious question, I've never understood why people refuse to use email for chat. Everybody has email, we don't need to convince people to adopt it or agree on a provider. It should be perfect, and yet for some reason we don't use it for this. Does anybody have any thoughts on this?

<comment><USER8> Because so many other things come into email – marketing emails, notifications, work-related emails, etc. that people don't check it as often.

Texting and other chat applications are instant.

Email used to be a more instantaneous thing, but it has evolved into something that many people want to take a break from, so sending an email might mean that the recipient doesn't see it for hours or days.

<comment><USER9> Texting and chat applications being instant is a downside sometimes, in that people have questions that they want an answer to, but won't send an email because of the reasons you listed. Instead they send you an instant message, and the expectation is generally an instant response.

I'm trying really hard to get people to use email again for questions that they need answered but not _immediately_. But I seem to be losing that battle.

<comment><USER10> This is why I treat IM at work the same as email. I show up as unavailable and check a few times a day. If someone really needs me instantly they can come to my cube.

</comment></comment></comment></comment></comment><comment><USER11> Originally, I used facebook in some weird, dystopian and usually ineffective courtship ritual. Then I used it to keep in touch with distant friends, which is the stated use case, but actually isn't that interesting, but would have been well-served by curating my friends list.

Lately, I moved to San Francisco and started doing stand-up comedy. Facebook is the single best tool for self-promotion and for finding out where good open mics and shows are. Both goals are served by adding randomly every single person I meet, not by curating my list.

<comment><USER12> How's your stand-up career going?

<comment><USER11> It's in its infancy. I've done one showcase, but mostly just open mics.

I realize the above comment may have implied that comedy is my job - it's not, but it's the primary appeal Facebook has for me now.

</comment></comment></comment><comment><USER13> [http://archive.is/Z7uIq](http://archive.is/Z7uIq)

<comment><USER14> Blessed be

</comment></comment><comment><USER15> Private slacks, private google groups, private and close knit email lists will always make for better sharing and discussion. I suppose by their nature they're much smaller too.

The one thing social media _could_ do very well that these cannot, but still consistently fails at, for some reason, is discovery. How do I find the other literati nearby? How do I know who the next great addition to the secret slack might be?

<comment><USER16> > Private slacks, private google groups, private and close knit email lists > will always make for better sharing and discussion.

I found the same thing on usenet years ago, and it was much more discoverable compared to the private options you mention. But I did need to use some degree of client side filtering to handle the junk that would be posted.

</comment></comment><comment><USER17> Its true. I have no friends on hn and hn is my best "social media"

</comment><comment><USER18> There have been apps in the past that limit friends. I've thought a bout a 2 person network for you and your partner as well as one with maybe 20 friends. As well as one where you only see updates from friends who include you in their 20 as well. But it breaks the financial model of running targeted ads so it wont work.

<comment><USER19> I've thought a WhatsApp equivalent for just families or even for specific events (like a wedding) would be cool. In addition to the regular chat window, there would be shared photos and so on.

But I think the challenge is not the financial model, the problem is product/market fit. Path (founded by a former FB exec) tried for a few years to create an intimate social network but couldn't retain enough users to make the biz work.

<comment><USER20> Path, Peach, Vero, Ello, I don't think we need another one to remind everybody that "intimate social networks" are a failed experiment. If someone wants to communicate within a small group, they are inclined to use group chat. Forget monetizing, first it's difficult to get users to stay on these platforms because:

1\. Even if you get amazing press and hype, the churn rate can exceed your growth rate due to how limited the network effect is e.g. Peach and Vero.

2\. People can already choose to unfollow celebrities and limit their friend groups on any existing social platform. It's simply a matter of willpower or creating an alternate account ala how "Finstagrams".

3\. Celebrities and influencers are what drives growth to a platform. Donald brought Twitter tens of millions of new users. Hundreds of millions of guys use Instagram just to follow bikini models etc

<comment><USER21> There is no need to start as a social app. You could start as a to-do app. For example, if Todoist would add a persistent group chat to shared lists, it might replace the WhatsApp conversations with my wife.

There are apps that are used in intimate settings. They can be made "social".

<comment><USER22> I think it's very dangerous to add social to a non-social service.

Evernote tried adding a chat functionality they, for some reason, named "work chat".

No other Evernote user I know wasn't hostile towards this feature.

<comment><USER21> It is not intuitive to me why that would be bad. Care to elaborate?

</comment></comment></comment></comment></comment></comment><comment><USER23> Ehh I'm not convinced. I deleted my Facebook a long time ago (hard delete, not just a deactivation) and I've managed to replicate the same value I got from Facebook in Slacks and Discords - except it's just stuff I want, and people I want to hear from. When some congressmen asked Zuckerberg about monopoly, I thought this: I actually think there are plenty of alternatives. I derive _a lot_ more value from the Slack channels I'm on with friends who are now lawyers or tech gurus or thinking about doing a startup...and none of it is interrupted by ads or annoying posts from my parents and their friends. If the point here is "delete most of your 'friends'" then why keep Facebook at all?

<comment><USER24> > except it's just stuff I want, and people I want to hear from.

Part of the value of Facebook for me is the opposite of this -- stuff I don't want, sometimes from people I don't want to hear from. It pops the bubble (which I'm VERY much covered by as an expat in Japan) and keeps my mind flexible while reminding me that other people think/believe different things, usually for reasons that make a lot of sense to them.

Yes, I think a concentrated community like a Slack channel is a great way to stay in touch with people, but it's usually so ultra-focused that when I focus on communities like that, I can really see/feel my worldview and perspective narrowing to the one I use every day for communicating with them.

<comment><USER23> I agree with you, that concentrating your worldview can become a problem. But at least now I'm doing it intentionally, and I don't have Facebook's algorithm doing it for me. Or, in the opposite, exposing me to things I don't like just to get me to engage with it.

</comment></comment></comment><comment><USER25> It would also help if Facebook let you hide shit content - shared posts, tags, memories etc. But noooo you can only "see less of this" which doesn't really do anything.

I just ruthlessly unfollow people now. And ignore Facebook - WhatsApp has effectively replaced it.

</comment><comment><USER26> Many tech people want a better social network plan.

I'm asking for opinions and advice here:

[https://github.com/joelparkerhenderson/social_network_plan](https://github.com/joelparkerhenderson/social_network_plan)

The repo looks at issues of purpose, funding, audience, identity, topology, implementation, a MVP, and more.

<comment><USER27> As alternative to Fb, there's MeWe and Vero. Both of them will not display ads and mine user info.

<comment><USER22> Unless they gain traction. Which is the time they will start monetizing their users.

</comment></comment></comment><comment><USER28> I've unfollowed most real people on Facebook as it's all about the interest or location-oriented groups for me rather than pictures of people's kids or vacations. It's so much better this way.

<comment><USER29> So the accounts most likely to target you with ads? Sounds great!

<comment><USER28> No. Facebook groups are different to "pages" which do target you. They're relatively open, free for all discussion areas, a little akin to newsgroups back in the day if you're on the right ones.

</comment></comment></comment><comment><USER5> I'm way ahead of everyone. I'm on Diaspora, and I have 0 friends.

</comment><comment><USER30> We might stretch that to

The secret to better politics : fewer citizens.

Which is a little bleak.

<comment><USER31> Fewer ignorant citizens*

If you keep the ignorance distribution stable, then nothing changes.

<comment><USER30> My point is, a smaller system is a more easily managed system for everybody involved.

You don't even need to "educate" them. It might be enough to judge a prospective leader's character.

</comment></comment></comment><comment><USER32> The secret isn't fewer friends, it's only having actual friends on social media and not following/friending random people.

My facebook feed is usually things I care about as a result. Except for 1 guy, who is a great guy but I don't need to see another sad dog who needs a home or missing child article.

</comment><comment><USER33> How many are few? Because messaging apps work that way (chat groups) and most groups with over ~10 people is a tsunami of terrible jokes and fake news. What works though is creating temporary groups around events (trips, concerts etc.)

</comment><comment><USER34> Create a new Facebook and just add the people you've talked to recently and get message notifications from your old account sent to your e-mail. It's like getting a new phone number and only informing recent contacts.

</comment><comment><USER35> I think that ephemeral WhatsApp groups add a lot of value here. <plug> And if you'd like persistent, private photo/video sharing, a site like www.famipix.com fits the bill.</end plug)

</comment><comment><USER36> "Social _network_ " vs "Social _media_ "

It is arguable that the primary purpose of Facebook originally was to allow two friends to communicate over a third person's website. There was no "news feed".

Is this a "social network" or is it "social media"?

Later the website became a means to broadcast "news".

Is it a "social network" or is it "social media"?

Later the website became a means for third parties other than Facebook to broadcast advertisements to specific users of the "network".

Is it a "social network" or is it "social media"?

Why might this distinction matter?

This is a quote from Van Jacobsen's 30 August 2006 tech talk entitled "A new way to think about networking":

"The raison d'etre of today's networking, both circuit switched and TCP/IP, is to allow two machines to have a conversation.

The overwhelming use (>99% by most measurements) of today's networks is for a machine to acquire named chunks of data (like webpages or email messages).

Acquiring named chunks of data is not a conversation, it's a _dissemination_ (the computer equivalent of "Does anybody have the time?")"

What is Facebook?

Is it particular communications between two friends? Is it a "network"?

Is it _dissemination_? Is it "media"?

Is it both?

Does Facebook _communication between friends_ upset the traditional media? Does it "threaten democracy"?

Does Facebook _dissemination_ upset the traditional media? Does it "threaten democracy"?

The tech talk cited above discusses why in the case of dissemination the _data_ matters, not the supplier.

In the case of dissemination it is desirable that data being disseminated must be trustworthy. Once this is achieved it should not matter the source from which the reader obtains it (whether via a Facebook page being surveilled by Facebook, or via some random address elsewhere on the internet).

The talk describes how this might be accomplished.

</comment><comment><USER37> aka private group chats</comment>


BMW to mass produce electric cars, electrify Rolls-Royce - <AUTHOR> http://www.reuters.com/article/us-autoshow-frankfurt/bmw-to-mass-produce-electric-cars-electrify-rolls-royce-idUSKCN1BI1LM?utm_campaign=trueAnthem:+Trending+Content&utm_content=59b149de04d3012fde0665ea&utm_medium=trueAnthem&utm_source=twitter <comment><USER2> This is great news. Can't wait for the electric future. I love my e-Golf and can't imagine going back to a boom-boom engine.</comment>


Sodium-potassium alloy (liquid metal at room temperature)- Wikipedia - <AUTHOR> https://en.wikipedia.org/wiki/Sodium-potassium_alloy <comment><USER2> You have to be careful working with this stuff, like keep it under argon as a cover gas. It burns in carbon dioxide, burns in water, and even burns in 1-propanol -- in the last case the burning is gentle enough you can use 1-propanol to wash spent nuclear fuel elements that were used in NaK.</comment>


Clojure inventor Hickey now aims for Android - <AUTHOR> http://iwebguyblog.wordpress.com/2012/03/22/clojure-inventor-hickey-now-aims-for-android/

<comment><USER2> Minus the blog spam:

[http://www.infoworld.com/d/application- development/clojure-i...](http://www.infoworld.com/d/application- development/clojure-inventor-hickey-now-aims-android-189105?page=0,0)</comment>


NYT – Internet Explorer 8 No Longer Supported - <AUTHOR> http://www.nytimes.com/content/help/site/ie8-support.html

<comment><AUTHOR> After that Reed Emmons posts: "One day after the @nytimes IE8 deprecation notice, ⅓ of IE8 visitors found a different browser to use. Mostly Chrome."[1]

[1][https://twitter.com/remmons/status/476575878731034625](https://twitter.com/remmons/status/476575878731034625)</comment>


Ask HN: Struggling to get users. What is turning visitors away? - <AUTHOR> https://pennypledge.co

<comment><USER2> I cannot really figure out what it is you offer/sell. Give to what or whom? Why? The centerpiece of your homepage is a screenshot telling me to give some unrecognizable web page about 'ad-bombing' a penny. Your pitch has to be intuitively understandable and in some kind of context.

Also, I get that you've jumped on the infinite scroll bandwagon but you have an INSANE amount of white space that you could be using to get the point across. I think you're mistaking cleanliness for conciseness.

Hire a good copywriter and a designer who is actually into good design, stat!

<comment><USER3> I agree that you could use a bit more direction on what users should be giving money to. Very Cool idea though!

<comment><USER4> Thanks.</comment></comment></comment>


Rendering Backbone Collections with DocumentFragment - <AUTHOR> http://elving.me/post/48040344160/rendering-backbone-collections-with-documentfragment

<comment><USER2> You could render off-screen in a fragment or couldn't you just make an element using the view's "make" convenience function, append all objects to that, and then append that to the view? Does this require the same reflows?

<comment><USER3> Technically, even if you render outside the visible area you still incur reflows/repaints. A fragment isn't rendered at all, but lets you build the entire collection as HTML once then do just one reflow/repaint to add the whole fragment to the DOM.

<comment><USER4> What about using something like jquery detach? Then you could, when rendering, detach the element, render all the content, subviews, and re-append it. That shouldn't trigger reflows, right?

<comment><USER3> Correct. So far as I know, the way jQuery detach works is to remove it from the DOM and then return the individual element. The element could act as a fragment, because it can contain children, and then be reappended to the DOM.

</comment></comment></comment></comment><comment><USER5> If document reflow is an issue (which it certainly is for a large collection like the example), why not just render all the subview's el all at once: <http://jsfiddle.net/HbzbS/>

I'd be interested in how this method bencharks relative to the example, I suspect it _should_ perform better though.

<comment><USER6> I would like to point out that after visiting that link and allowing jsfiddle.net's scripts, my browser locked. Eventually I had to do a hard reset. This is on FF 20, Ubuntu 12.04.2 LTS.

Edit: This is reproducable, but this time I killed firefox pretty soon. How can javascript hang a browser?

<comment><USER5> Weird, I just tested it successfully under both FF 20 & Chrome 26.0.1410.43 (on os x). I've also used that technique in production code (but not with a list that large) and haven't had any problems with it thus far.

<comment><USER6> It works without problems in Chromium, on that same system.</comment></comment></comment></comment>


The growing data-driven component to computer science - <AUTHOR> http://groups.csail.mit.edu/haystack/blog/2010/03/22/data-driven-computer-science/

<comment><USER2> There's been a lot of talk here about the need for academic researchers to share their data. I'm interested what people's opinions are about this when it's corporations doing the researching.

<comment><USER3> The pressure to publish is so high, promotions et cetera all rely on it. Putting together large datasets can be can be costly and time consuming and the hope is often to get a few publications out of it. I think citations need to acknowledge datasets more, as do promotions otherwise people will have large incentives to "silo" vertically and not share. A big issue that has no excuse is public access to journals though. It's amazing that the public pays for the research and then pays for it again and again in every library's subscription to the vampire publishing houses who do nothing other than distribute a few hardcopies that nobody reads and then gatekeep the pdfs (the editing and review is all done by academics, so it's just copy and typesetting that's commanding this huge price). Maths, physics and comp sci are some of the better disciplines (masters of LaTeX) for making things available online, but everywhere else it's horrible.

<comment><USER4> I hope some of the system biologists are seeing the light. (But that's only because they are getting colonised by mathematicians.)

</comment></comment></comment><comment><USER5> Is CS becoming like particle physics?

They should also mention the very nice recent flow of ideas from theoretical physics into the field of probabilistic inference:

Many algorithms that make the analysis of these data sets possible either originate from or are widely used in [particle] physics. Examples include message-passing, mean-field methods, variational inference, monte-carlo methods, and many others.

</comment><comment><USER6> While earning my undergraduate degree in CS/Math there was not a single course in the CS department that had anything to do with databases. I had to teach myself. The MIS department had one course that taught some rudimentary stuff using Access. This was 1996-2000. Has it changed since? By that I mean is it still common to go to university for CS and not be offered any courses that teach the basics of RDBMS (or NoSQL)?

</comment><comment><USER7> A lot of this is science with computers, not computer science.

<comment><USER8> Out of curiosity, what is your definition of computer science?

<comment><USER9> "Computer science is a funny thing for what we do. It's not a science, and it's not about computers."

(I forget the author, but I believe it was someone at MIT)

<comment><USER10> I think it was either Hal Abelson or Jerry Sussman in one of the SICP lectures. <http://mitpress.mit.edu/sicp/></comment></comment></comment></comment>


Ask HN: Anyone interested in a Slack channel for hardware makers/hobbyists? - <AUTHOR> <comment><USER2> Is there any reason not to simply put the Slack invite link here directly?

<comment><AUTHOR> haven't really set anything up yet

</comment></comment><comment><USER3> I'd be interested!

</comment><comment><USER4> Yes!

<comment><AUTHOR> Awesome, send me a msg (mail can be found in my profile). Let's see if we can collect a few folks who want to join.

<comment><USER5> Your email is not visible in your HN profile. Don't confuse the publicly visible section with the bit that's only for the moderators. If in doubt, logout and then look at it.

It's empty.

<comment><AUTHOR> you're right. updated</comment></comment></comment></comment>


An analysis of iOS 5 OTA updates by innoying - <AUTHOR> http://blog.innoying.com/post/15553263626/an-analysis-of-ios-5-ota-updates-by-innoying

<comment><USER2> _As it turns out, it's just HTTP requests. The alarm bells should be going off now. So you're telling me that the part of the O.S. that runs as root and replaces system files is downloaded via unsecured, unauthenticated HTTP? Yup._

Well, I'm not sure it makes a difference. As he later points out, update packages are signed by Apple, so unless you have access to Apple's private key you can't make an update package that will actually be installed.

Using HTTPS instead of HTTP would be wise, but in the end it doesn't make a difference.

On the whole though, this is a fascinating exercise. Thanks!</comment>


Migrating From MongoDB To Riak At Bump - <AUTHOR> http://devblog.bu.mp/from-mongodb-to-riak

<comment><USER3> > During the migration, there were a number of fields that should have been > set in Mongo but were not

Imagine that...this fascination with schema-less datastores just baffles me:

[http://draconianoverlord.com/2012/05/08/whats-wrong-with- a-s...](http://draconianoverlord.com/2012/05/08/whats-wrong-with-a- schema.html)

I'm sure schema-less datastores are a huge win for your MVP release when it's all greenfield development, but from my days working for enterprises, it seems like you're just begging for data inconsistencies to sneak into your data.

Although, in the enterprise, data actually lives longer than 6 months--by which time I suppose most start ups are hoping to have been bought out.

(Yeah, I'm being snarky; none of this is targeted at bu.mp, they obviously understand pros/cons of schemas, having used pbuffers and mongo, I'm more just talking about how any datastore that's not relational these days touts the lack of a schema as an obvious win.)

<comment><AUTHOR> Yeah -- that's one of the huge benefits of marking a field as ``required'' in a protobuf. The ability to enforce a contract prevents a ton of unexpected and incomplete data making it on disk (and also, e.g., across the wire to clients). Having strict types represented in the serialization format is also handy; when one pulls out an int32 from a protobuf it's going to be an int32, and not an integer that somehow found its way into being a string.

<comment><USER4> Could you elaborate more on how you have used Protobuffs, as I'm not sure I fully understand. I've previously used Riak in Erlang and Ruby projects, so am fairly familiar with how it works. It exposes a HTTP and Protobuffs API which allows you to store objects of arbitrary types (JSON, Erlang binary terms, Images, Word Documents, etc). From the sounds of it you are serialising a Protobuffs packet and sending this as the content of the object. Why did you choose this, over say JSON, which MongoDB uses?

</comment></comment></comment><comment><USER5> I was reading along and nodding my head until I got to the 1000 line haskell program that handles issues stemming from a lack of consistency.

I'm not exactly a SQL fanboy, but maybe ACID is kinda useful in situations like this and having to write your own application land 1000 liners for stuff that got solved in SQL land decades ago isn't the best use of time?

<comment><USER6> MySQL is circa 1 _million_ lines of code.

I like SQL engines for moderate data sets that fit nicely on one machine and well within the normal performance envelope. But even there I will often have to try a few different incantations and cross my fingers that one of them will perform reasonably because that's easier than trying to figure out what that 1 MLOC engine is up to. And I don't know anybody who does very large MySQL setups without a lot more hassle than that.

For some things I'd much rather deal with 1KLOC that I had to write myself than the 1 MLOC that I'm scared to even start digging through.

<comment><USER5> The question isn't 1MLOC vs 1KLOC.

It's a stable, well understood DB vs an immature, not well understood DB AND 1KLOC to deal with not being consistent.

To be clear, I'm not saying any given DB is the OneTrueWay, just that people seem to be a bit cavalier in regards to some of this crap and chasing the newest shiny thing while rediscovering why some of the braindamage in those 1MLOC was put there in the first place.

<comment><USER6> Oh, I agree that some people are being a bit cavalier about the new shiny. These folks are migrating away from MongoDB for a reason.

On the other hand, even if half of that 1 MLOC is still relevant to new ways of building systems (and given that SQL databases are a 70s tech, I doubt it's that much), that still leaves half that isn't.

The only way we'll find out which part matters is for people to try different approaches. So I fully support experimentation like this. If we don't rediscover for ourselves the good parts in the tools we use, then we're just stuck honoring the traditions of our heavily bearded ancestors.

<comment><USER7> There is an awful lot of 70s tech that is still in constant operation, and is highly relevant to the types of work you're probably doing today. TCP, C, Pipes, etc.

<comment><USER6> Sure. But I think the problem space for databases has changed quite a bit in ways that aren't true for TCP, and are only partly true for C.

My dad was writing code at the time, and he saw the big benefit as allowing developers to manage larger amounts of data on disk (10s of megabytes!) without a lot of the manual shenanigans and heavy wizardry in laying out the data on disk and finding it again. Plus, the industry thought the obvious future was languages like COBOL, what with their friendly English-like syntax and ability for non-programmers to get things done directly.

So little of that is true anymore. For a lot of things that use databases, you're expected to have enough RAM for your data. We don't distribute and shard because we can't fit enough spinning rust in a box; we do it because we're limited on RAM or CPU. A lot more people have CS degrees, the field is much better understood, and developers get a lot more practice because hardware is now approximately free. And nobody really thinks the world needs another English-like language so that managers can build their own queries.

TCP, on the other hand, is solving pretty similar problems: the pipes have gotten faster and fatter, but surprisingly little has changed in the essentials.

C is somewhere in between. A small fraction of developers working these days spend much time coding in plain C, and many of its notions are irrelevant to most development work.

But unlike SQL databases, you could ignore C if you wanted to; there were other mainstream choices. That wasn't true for SQL until recently; the only question was Oracle or something else. I'm very glad that has changed.

<comment><USER7> My apologies for the rant here - it's not directed specifically at you, but toward a general attitude I see on HN and in the tech community.

I was more commenting on your phrase "if half of that 1 MLOC is still relevant to new ways of building systems (and given that SQL databases are a 70s tech, I doubt it's that much)".

There has been a TON of academic and industrial research on SQL databases since they were invented in the 70s. Calling them 70s tech is akin to calling LISP 50s tech. The basic ingredients haven't changed much (sets in SQL and lists in LISP), but the techniques on top have evolved by leaps and bounds.

To your point here - there are plenty of companies that have way more data in their databases than RAM available. The early users of Hadoop, etc. were primarily constrained by disk I/O on one machine, rather than constrained by RAM or CPU on one machine. It is certainly convenient that a distributed architecture can solve both sets of problems if the problem space lends itself to distributed computation.

I'm not a huge defender of SQL - I think it has some serious problems - <USER2> fundamental problem is lack of strong support for ordered data, and it can be a huge pain to distribute. I agree that having some options with distributed K/V stores is really nice, but you have to admit that much of it hasn't yet been proven in the field.

I, for one, DO think that the world needs something like an english-like language so that "managers" can write their own queries. Honestly, the roles of programmer and data analyst are often wholly different. I think it's a huge kludge that the only people capable of manipulating massive datasets are people with CS degrees or the equivalent. Programmers suck at statistics, and while they're generally smart folks, they often don't have the business/domain expertise to ask the right questions of their data. Software is about enabling people to solve problems faster - why should we be only allowing people with the right kind of academic background to solve a whole class of problems.

Finally, saying that you doubt SQL is relevant to building modern systems is borderline irresponsible. Experimentation with new tools is good - but you have to also keep in mind that people were smart way back in the 70s, too, and that their work may be perfectly relevant to the problems you're trying to solve today.

<comment><USER6> No need to apologize! You make excellent points.

There has indeed been a ton of research on SQL databases. But still, Stonebraker, one of their pioneers, said that they should all be thrown out:

"We conclude that the current RDBMS code lines, while attempting to be a "one size fits all" solution, in fact, excel at nothing. Hence, they are 25 year old legacy code lines that should be retired in favor of a collection of "from scratch" specialized engines. The DBMS vendors (and the research community) should start with a clean sheet of paper and design systems for tomorrow's requirements, not continue to push code lines and architectures designed for yesterday's needs." -- <http://nms.csail.mit.edu/~stavros/pubs/hstore.pdf>

I'm sure a lot of their intellectual work is indeed something I could learn from. But SQL databases are an artifact of a particular moment in technological and cultural history. The thing I really want to learn about isn't the residue of their thoughts as interpreted through 30 years of old code, it's their original insights and how to transfer those to today's world.

Hadoop is a fine example of Stonebraker's point. The original sweet spot of relational databases was easy queries across volumes of data too large to fit in RAM. But Google realized early on that they could do orders of magnitude better with a different approach.

I agree that these new approaches haven't been fully proven in the field, but I'm certainly glad that people are trying.

As a side note, I think the right way to solve the pseudo-English query language problem is by making the query language actual English. If you have a programmer and an analyst or other business person sit next to one another, you get much better results than either one working alone.

<comment><USER7> Stonebraker's research and commercial ventures the last several years have been focused on building specialized variants of existing database systems. Vertica (C-Store), VoltDB (H-Store), Streambase (Aurora), and SciDB are all specialized DBMS systems designed to overcome the one size fits all nature of things.

Further, he's been critical of NoSQL/MapReduce recently: <http://dl.acm.org/citation.cfm?doid=1721654.1721659>

Regardless, there's always going to be a balance between specialized systems and platforms, but my point is that we should be willing to trust the platforms that have proven themselves, avoid reinventing the wheel (poorly), and not be too quick to throw them out in favor of the new shiny.

I agree that programmer/analyst working together is a terrific pair, but the beauty of software is that we live in a world where we can have 1 programmer write a platform on which 10 programmers build 10 systems that 1000 users use to get their jobs done and make society that much more efficient.

<comment><USER6> Oh, I trust the current stable platforms to be the current stable platforms. My beef isn't with people who use them. It's with people who don't know how to do anything else, which was a plague on our industry for at least a decade. At least the people who get burnt on the latest fad will make new and interesting mistakes.

I agree that when we can find ways to let users serve themselves, that's best for everybody. I just don't think universal pseudo-English query languages are the way to do that, because the hard part isn't learning a little syntax, it's learning what the syntax represents in terms of machine operations.

Once the programmer and the analyst have found something stable enough to automate, by all means automate it. Reports, report builders, DSLs, data dumps, specialized analytic tools: all great in the right conditions. But people have been trying to build pseudo-English PHB-friendly tools for decades with near zero uptake from that audience. I think there's a reason for that.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> If you're thinking about using Riak, make sure you benchmark the write (put) throughput for a sustained period before you start coding. I got burnt with this.

I was using the LevelDB backend with Riak 1.1.2, as my keys are too big to fit in RAM.

I ran tests on a 5 node dedicated server cluster (fast CPU, 8GB ram, 15k RPM spinning drives), and after 10 hours Riak was only able to write 250 new objects per second.

Here's a graph showing the drop from 400/s to 300/s: <http://twitpic.com/9jtjmu/full>

The tests were done using Basho's own benchmarking tool, with the partitioned sequential integer key generator, and 250 byte values. I tried adjusting the ring_size (1024 and 128), and tried adjusting the LevelDB cache_size etc and it didn't help.

Be aware of the poor write throughput if you are going to use it.

<comment><USER9> Riak loves random read/writes, spinny discs do not, try things out with a SSD sometime and watch things go from a shoddy XXX ops/sec to XXXX(X) ops/sec.

As a simple remark on this, I've gotten 1000+ ops/sec on a single machine operating as 3 nodes (equating to about 3000 ops/sec per node) when using an SSD and a measly 150 ops/sec with a spinny disc in the same setup (equating to about 450 ops/sec per node)

<comment><USER10> While SSDs will undoubtedly be faster that spinning disk, LevelDB is designed to address slow random writes by batching and writing sequentially.

<comment><USER9> That would be true except each vnode (by default 64!) has its own backend database. That means with 4 physical nodes each one gets 16 leveldb/bitcask/whatever database backends.

LevelDB's write batching and caching is completely void when thats considered in many circumstances.

Its something that I think Basho should consider changing. Its a trade off of fault tolerance or performance, and I would personally love to see riak go a lot faster.

</comment></comment></comment></comment><comment><USER11> I find these kinds of stories interesting, but without some feel for the size of the data, they're not very useful/practical.

I've heard of Bump, and used it once or twice, but I don't actually know how big or popular it is. If we're talking about a database for a few million users, only a tiny percentage of which are actively "bumping" at any time, it's really hard for me to imagine this is an interesting scaling problem.

Ex. If I just read an article about a "data migration" who's scale is something a traditional DBMS would yawn at, the newsworthiness would have to be re-evaluated.

<comment><AUTHOR> I'm not sure what exactly qualifies as respectable scale, but the Mongo master was running out of space and IO capacity with 24 SSDs and 90 million user records, and was replaced by a sixteen-node Riak cluster.

I'll happily share any other statistics you're interested in.

Edit: the Riak cluster actually contains lots of other data (communications, object metadata, etc.); we didn't need sixteen boxes for the user records.

<comment><USER11> 90 million users is a great datapoint, yes! In my book that's more than respectable.

The only other stat that I'm curious about is the total size of the DB. Certainly databases with tens of millions of records can be held completely in RAM these days... but that also depends on how big each record is.

<comment><AUTHOR> All-told the users database when we started migration was about 600 GB on disk, so not the most easily stored database in RAM, but not impossible if you get enough large machines.

In fact, we use Redis a lot at Bump, although almost exclusively for queueing and transient state, and not as a persistent database. For a period of time we did store long-lasting metadata in Redis, and as we became more popular instead of throwing engineering effort at the problem we threw more memory, culminating with a handful of boxes with 192 GB of RAM each. We've since moved that entire database to Riak. :)

</comment></comment></comment></comment><comment><USER12> I have decided on wanting to use riak as well. I was wondering if anyone had examples of how they used it with their data model?

For example this article mentions "With appropriate logic (set unions, timestamps, etc) it is easy to resolve these conflicts" however timestamps are not an adequate way to do this due to distributed systems having partial ordering. The magicd may be serialising all requests to riak to mitigate this (essentially using the time reference of magicd) in which case they're losing out on the distributed nature of riak (magicd becomes a single point of failure / bottleneck).

Insight into how others have approached this would be awesome.

<comment><USER13> There are a several ways to approach this. The simplest is to just take last- write-wins, which is the only option some distributed databases give you. For cases where this isn't ideal, you resolve write-conflicts in a couple ways.

One way is to write domain-specific logic that knows how to resolve your values. For example, your models might have some state that only happen-after another state, so conflicts of this nature resolve to the 'later' state.

Another approach is to use data-structures or a library designed for this, like CRDTs. Some resources below:

A comprehensive study of Convergent and Commutative Replicated Data Types <http://hal.archives-ouvertes.fr/inria-00555588/>

<https://github.com/reiddraper/knockbox> <https://github.com/aphyr/meangirls> <https://github.com/ericmoritz/crdt> <https://github.com/mochi/statebox>

<comment><USER14> Are there any connector libs that provide "simple" last-write-wins out of the box?

<comment><USER15> Simple last-write-wins can be configured per-bucket, so client libs can be naïve: <http://wiki.basho.com/HTTP-Set-Bucket-Properties.html>

</comment></comment></comment></comment><comment><USER16> Would be interesting to see a follow up in 6 months or so..

It doesn't seem fair to compare [ _old tech_ ] with [ _new tech_ ] when you've felt all the pitfalls with one but not the other.

</comment><comment><USER17> Random thought on proto buffers: OP is advocating using the "required" modifier for fields and touting it as an advantage in comparison to JSON. I would move the field value verification logic to the client, because it can cause backwards compatibility problems if you un-require it.

</comment><comment><USER18> @timdoug, could you share specific problems with Mongo that made|forced you switch to Riak please? "Operational qualities" are little vague

<comment><AUTHOR> We experienced some significant difficulties with sharding; the automatic methods of doing so only seemed to shard a single-digit percentage of our data. We've also encountered some wildly unexpected issues with master/slave replication and related nomination procedures.

You're right that this post is vague with regard to those details; they would be a good candidate for a future blog post, but the desired takeaway from this one is that we're quite pleased with the performance and scalability that Riak provides.</comment></comment>


Last.fm Radio to be killed off in most countries next month - <AUTHOR> http://thenextweb.com/media/2012/12/13/last-fm-to-kill-its-radio-feature-in-many-countries-next-month-making-it-a-paid-feature-in-the-us-uk-and-germany/ <comment><USER2> Last.fm seems to be slowly buckling under pressure from record labels. At some point recently at the behest of the labels, they started limiting the number of skips you were allowed on each station, to something absurdly low like 5. Not even subscribers are allowed more. It's a shame to see CBS's legal team put its concerns ahead of Last.fm and its users.

<comment><USER3> Last.fm was great before CBS, I used to use it all the time. It had one of the better algorithms out there for suggesting music and it introduced me to a lot of great bands after I'd been out of listening to music for a while. Then, for whatever reasons I just stopped using it.

<comment><USER4> I still think it's by far the best "here's a band, give me more like it" music suggester. Some how it understands the essence of the band I love and finds lots of bands that are just as good. And many of those bands are so obscure I don't know how I would have found them otherwise.

<comment><USER3> I'd hate to see that technology lost given how poor the alternatives for this are right now. Genius, as a comparison is just terrible. Musicbrainz is pretty much impossible to use (and terrible).

</comment></comment></comment></comment><comment><USER5> I abandoned Last.fm when shortly after the CBS takeover they did a 180 and became the mouthpiece of the record labels instead of a disruptive force.

I didn't mind so much that they had to compromise, but the classic recording industry PR-speak they used to justify it was just offensive. Shortly afterwards they pretty much stopped communicating and innovating altogether.

A shame, because for discovery I still haven't found anything better than Last.fm's combination of "scrobbling" and community.

</comment><comment><USER6> The only reason I use last.fm is the scrobbling, I'd love it if they'd focus on music analytics more than radio. The moody pdf report in their playground is amazing.

<comment><USER7> <http://playground.last.fm/>

Same. I switched to spotify (and spotify radio, which is free) a while ago. But I still scrobble everything and it's cool to look back! Not to mention you can do a lot with the data.

<comment><USER8> > But I still scrobble everything and it's cool to look back!

Unclear what you mean. They both scrobble, do you aggregate them together someplace?

<comment><USER6> I do the same. You can fill in your last.fm username in Spotify. Spotify also has an last.fm app. The music you listen to scrobbles to facebook as well as last.fm. Edit: Oh I think he meant, scrobble in the sense of keeping track of what you listen to. You don't have to keep using the last.fm desktop client.

</comment></comment></comment></comment><comment><USER9> Is anyone else worried about their listening data? I've got music play tracking in there back to 2006. Does anyone else do what they do with tracking, and does tracking alone give last.fm a viable business model?

<comment><USER10> I've been worried about the same thing. A few months ago I scraped all my scrobble data from last.fm with a python script I found online: <http://encukou.github.com/lastscrape-gui/>

You can even move all your data to libre.fm. I didn't do this because a few of my music programs (ahem spotify) only support last.fm.

<comment><USER11> You should see this comment about changing your hosts file: <http://news.ycombinator.com/item?id=4917367>

</comment></comment></comment><comment><USER12> I hope there will be a way to export my listening data if they ever decide to stop offering their scrobbling service.

<comment><USER10> As I mentioned in another comment, I've used this script and it worked well. You can also migrate your data to libre.fm.

<http://encukou.github.com/lastscrape-gui/>

</comment></comment><comment><USER13> I've been using Last.fm since 2005 and the radio was always great because its been logging almost everything (aside from an occasional CD) I've ever listened to since then.

I have recently moved to Rdio and its great but I am sad to see this end.

</comment><comment><USER14> Last.fm used to be one of my favorite website, but after the CBS acquired they somehow stagnated, and I drifter away...

Stagnation like this seems to happen a lot when a fat and happy industry leader buys a young an innovative startup.

</comment><comment><USER15> I'm more interested in the stats/scrobble part than the radio but it's too bad they are not adding new features (More stats/graphs/...). It kind of feels like a dead project.

If there would be a site tracking your listening stats and giving decent recommendations based on your previous listening habits (Maybe even add last.fm import) i'd consider paying for it. This could work like trakt.tv where everyone is able to use the site but there are still some bonus features for paying members.

</comment><comment><USER16> This makes me sad. Last.fm was for years my favorite online radio service but somehow they missed to invent apps like spotify...

</comment><comment><USER17> So, both last.fm and Pandora are unavailable in Europe (for zero price, I mean). Anybody knows alternatives ?

<comment><USER18> Did you try spotify?

Also tehre are some other good radios/stations:

      https://ex.fm/
      http://www.earmilk.com/
      http://u2.fm/ (not sure why it's down atm?)
      http://grooveshark.com/

<comment><USER19> > <http://u2.fm/> (not sure why it's down atm?)

You might be thinking of <http://2u.fm>.

<comment><USER18> oh damn.. i thought i first tried 2u.fm and it didn't work for me either.. anyway.. oops

</comment></comment></comment></comment><comment><USER20> Hardly ever used the thing; still sorry to see it go.

</comment><comment><USER21> good to know, was breaking my head to figure out why the auto-dj feature from musicBee was not working (it shuffles your mp3s and adds some recommended streams from last.fm). it will be hard to replace, I know spotify does something similar but not as well.

</comment><comment><USER22> No shock really, they seem to have been completely stagnant for years now</comment>