Canvas: Notes for teams of nerds - <AUTHOR> https://usecanvas.com <comment><USER2> Instructure, the company behind Canvas LMS, is a pretty big company, and their software is used by many, many companies/educational institutions.

It could be argued that Canvas (the notes app here) is confusingly similar to Canvas LMS wiki pages. I hate being the guy to suggest a name change, but it may be something to consider before you get a lot of traction. I definitely understand the instinctive "fuck no" response to the suggestion that you change the name of something you clearly poured your heart and soul into, so please don't shoot the messenger here. Just wanted to bring it to your attention, in case you weren't aware.

EDIT BELOW:

Well, I'm pleased to say that this company did at least some kind of due diligence in this case. They applied for and received a trademark for the Service Mark (with the Standard Character Mark type) "CANVAS", covering "software as a service (SaaS) services featuring software used to allow collaboration between users for sharing information; software as a service (SaaS) services featuring software to create, structure, edit, access, integrate, manage, interpret and synchronize documents, content and data between users".

[http://tsdr.uspto.gov/#caseNumber=86642511&caseType=SERIAL_N...](http://tsdr.uspto.gov/#caseNumber=86642511&caseType=SERIAL_NO&searchType=statusSearch)

So, "Canvas Labs, Inc.", bravo!

Additional edit below:

Trademark was approved on March 26, 2016 to be published on May 3, 2016.

<comment><USER3> Yes, I thought this was going to be a repurposing of something in the LMS

<comment><USER4> Same

</comment></comment></comment><comment><USER5> Am super frustrated with how buggy Evernote is, and would be interested in an alternative, but...

"We currently only support your browser in read-only mode. Read more."

You don't support _firefox_!? It's not like it's some obscure browser.

Also the demo canvas on the landing page being slightly tilted to the left freaks me out.

<comment><USER6> Currently firefox is blocked by this, and some other related APIs: [https://developer.mozilla.org/en- US/docs/Web/Events/selectio...](https://developer.mozilla.org/en- US/docs/Web/Events/selectionchange)

Once dom.select_events.enabled defaults to true, we'll be able to polyfill most of the other missing APIs.

<comment><USER7> You built your project on an API that just became a working draft?

What do you do when it inevitably changes?

<comment><USER8> Like the "read more" link about FF support says, we plan on supporting it and IE10+ in the future.

This doesn't mean "we are waiting for them to fully support this working draft", but rather that we haven't implemented polyfills for the (relatively small) number of APIs missing, yet. When/if the spec changes significantly, these polyfills should carry us until we can change the non-polyfilled version of the code.

<comment><USER7> If that's the case, then why develop based on a browser that isn't even the most used browser anyway?

Especially devs have a quite equal share between Firefox and Chrome (due to the privacy implications of Chrome), so using private extensions that are non- standard, and, according to what you say, irrelevant for your product has to be quite an irrational move.

<comment><USER8> The overwhelming majority of the traffic we've seen so far has been Chrome and Safari, even from HN.

That being said, that wasn't necessarily the driving factor in the "use the fancy selection APIs" decision. There were many factors, but for one thing, choosing to use those APIs, while limiting our browser support (for a limited amount of time) helped us get to where we are now at a quicker pace than if we'd opted for much broader browser support from day 1.

One of the challenges here for Firefox is that there's not an API to determine when a user's selection changes. We need this in order for inline markdown to collapse/expand as the cursor comes within proximity of it. It's definitely possible to poly-fill this, we just haven't done it, yet :\ We could disable this for Firefox, but I'd rather ship Firefox support with the rad stuff that the other major browsers already get.

<comment><USER9> It is trivially easy to poll it in an animation loop.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> We've been beta testing Canvas on the Ember core team for a few months now and it has been _awesome_.

Markdown is the lingua franca of open source, but until Canvas, none of the online collaboration tools we used understood it. Not only does Canvas support Markdown, it supports programmer-flavored Markdown, with great support for things like checkboxes and code fencing. It's become an indispensable part of how we build open source software online.

Just a few of the ways we use Canvas:

1\. Writing feature proposals/documentation side by side with someone

2\. Taking collaborative meeting minutes during the weekly core team Google Hangout

3\. 12+ of us sitting around a couch, writing an agenda for our quarterly in- person meetings

Canvas is all about small details that continue to delight as you learn it. I think my favorite "hidden" feature is that you can add `.md` to the end of any document URL and it serves up a static Markdown file, making data export incredibly easy.

</comment><comment><USER11> This is going to sound silly but the crooked box at the bottom of the home page is so off putting.

<comment><USER12> It was hard for me to get past "we need a workbench for our [lightbulb]", but that crooked box sealed the deal.

<comment><USER13> Is that what it was? I am on a non-emoji environment so all I saw was "for our []".

</comment></comment></comment><comment><USER14> Hi HN. Canvas lays the foundation for some great long term plans. Long term is great, but why use Canvas today?

\- Focused on flow. Folding to merge preview and editing modes. Markdown to keep fingers on keys. \- Absurdly easy sharing. URLs are magic. Start up a meeting, share the URL in Slack \- Hackable. Make it easy to integrate into your workflows and systems. No lock in.

Love for you folks to try it, and give us feedback. The quickest way to get a feel is to hit the try button, share the URL to write with friends, then append .json to the URL and see what happens.

</comment><comment><USER15> It looks nice and works well, except for the few things I found:

Clicking into a link expands it making editing very easy. I think the same should happen for images. I click the example "boom" image and it just focuses it. I can remove it, but cannot edit (as far as I can tell).

Backspace over some text to remove it. Press ctrl-z. Nothing happens, except it does register something, because try backspacing again. You'll notice it doesn't actually remove the next character, almost as if it's removing something you cannot see. Press ctrl-z 5x in a row and then press backspace 5x, to see what I mean.

</comment><comment><USER16> If their team is wondering why mobile users are bouncing, it's because it takes 20s for the page to render anything:

[http://www.webpagetest.org/result/160329_KP_15JS/](http://www.webpagetest.org/result/160329_KP_15JS/)

</comment><comment><USER17> What's your data format? Good programmers will care as much about that as how your UI works.

I see you've got a formatting guide: [https://usecanvas.com/about/formatting- guide/0DZTK4lz2cWsqOn...](https://usecanvas.com/about/formatting- guide/0DZTK4lz2cWsqOnKzISLPq) Do you have a more formal specification for your format?

More importantly, how do you handle history? If I spend a year putting notes into Canvas and then have to switch for some reason (which might happen no matter how awesome Canvas is) what will I get when I export my notes?

<comment><USER8> If you're asking what we're storing in the database, that data is a plain string with some special delimiters in it denoting line types and metadata about the content.

At the application level, we're typically working with a version of that data that's structured a little bit more like this: [https://usecanvas.com/about/canvas/55h8GVkBfi5Lnr2Becv5tB.js...](https://usecanvas.com/about/canvas/55h8GVkBfi5Lnr2Becv5tB.json)

Currently, exporting your canvas will give you the format above, or `.markdown`, or `.html`. To answer your second question, we use operational transformation for the collaborative part of the platform, so we do have some history of operations on a canvas, but haven't quite decided for how long we'll be retaining that history and how we can best make it available to users.

<comment><USER17> Nice, that definitely answers my question. When you do decide on how to export history please write a blog post or something about it, I'm curious to see what you come up with.

</comment></comment></comment><comment><USER18> It feels a lot like Hackpad, which is great.

One of the main issues we had with Hackpad, though, was that the collaborative editing led to it being used for note-taking with third-parties, and it was really easy to inadvertently share a document by putting it into a space that was public or shared.

What are your plans with Canvas to make sharing easy within a team, and but less error prone for sharing outside?

<comment><USER14> Yes, giving you some better controls is on the list. love to hear more about your specific needs - drop me an email oren@usecanvas

</comment></comment><comment><USER19> From the name I expected some kind of whiteboard-drawing tool and was a bit disappointed, but probably only because I read about similar tools on another thread ([https://news.ycombinator.com/item?id=11381885](https://news.ycombinator.com/item?id=11381885)).

</comment><comment><USER20> Is there some place I've never been where technical workers enjoy being called nerds? If someone called me a nerd, I'd tell them where to shove it -- and I certainly wouldn't buy into their product! The Canvas people should seriously rethink their branding.

<comment><USER21> Have you been to San Francisco or the Silicon Valley?

It has been my experience in tech companies and social circles that the term nerd is often considered a badge of honor and is even used to refer to one's self and friends.

See also [https://vimeo.com/73589975](https://vimeo.com/73589975)

<comment><USER22> > the term nerd is often considered a badge of honor

N = 1, but in my experience this stopped being the case when being nerdy was deemed cool and anyone with glasses started proclaiming "I'm so nerdy".

I suppose this sort of makes me a hipster.

<comment><USER21> No, it makes you a second-wave nerd with hipster tendencies.

(I of course just made that up.)

</comment></comment></comment></comment><comment><USER23> Your tool looks interesting, congrats on your beta launch! I'd be interested in the technologies you used to build the editor, especially the real-time collaboration part. What libraries are you using or is it something custom built? I'm working on something similar ([https://www.nuclino.com](https://www.nuclino.com)) and we've been pretty happy with ProseMirror as the basis of our editor so far. Here's our HN post from a few weeks ago, if you're interested: [https://news.ycombinator.com/item?id=11211241](https://news.ycombinator.com/item?id=11211241)

</comment><comment><USER24> Facebook launched 'Canvas' today too

[https://canvas.facebook.com/](https://canvas.facebook.com/)

(`_´)ゞ

<comment><USER25> Yea that's gonna keep happening. Canvas is not an obscure metaphor in computing.

</comment></comment><comment><USER26> I've tried to switch from plain text to markdown for notes but the numbered lists drive me mad. A common process is that I want to insert a comment in the middle of a numbered to do list.

      1.. thing
      2.. another thing

        Please clarify this point

      3.. something
      4.. else

Took me a while to figure out how to break lists. I'd love it if there was some way to tell markdown to not renumber my lists too...

I know this is tricky in wysiwyg editors too but surely it's a fairly common task?

<comment><USER27> Obligatory "org-mode[1] does that very well".

Anyway if you put two spaces after "another thing" ("2\. another thing \nPlease clarify...") it should render the way you want.

1\. [http://orgmode.org/](http://orgmode.org/)

</comment></comment><comment><USER28> This looks awesome, been oscillating between Google Keep, OneNote, and Quiver, but never entirely satisfied.

To me, code highlighting and checkboxes that ident properly like an outline are key, and they seem to be well done here. Minor thing: tried ```javascript and it didn't work, doing ``` did engage the code editor but I can't seem to select the language.

Congrats on the launch, will be spending more time with this later...

<comment><USER29> I've been really happy with Dropbox Paper (invite only right now, [http://paper.dropbox.com](http://paper.dropbox.com), an article overviewing it: [http://www.techinsider.io/hands-on-with-dropbox- paper-2015-1...](http://www.techinsider.io/hands-on-with-dropbox- paper-2015-10)).

Canvas looks strikingly similar to this (almost exactly the same aesthetically), and I'm curious what the "killer feature(s)" are which give it an advantage over Paper, which is developed by a much larger company (Dropbox).

<comment><USER30> Came here to say the same thing. Extremely similar to Dropbox Paper.

I haven't been that happy with Dropbox Paper though. It doesn't handle basic things like bullets in indented blocks, or line/paragraph breaks in numbered lists. Hackpad (Dropbox acquisition) didn't look as nice, but had more functionality. Now Paper is replacing Hackpad.

I'll be giving Canvas a try.

<comment><USER8> Let me know how it goes! jonathan [at] usecanvas [dot] com

</comment></comment></comment></comment><comment><USER31> Whenever I see some new markdown thing, the first thing I do is check to see if math is supported, since most of my writing/collaboration uses math. Even my personal todo list needs math from time to time.

I think its pretty easy to add math support by adding MathJax to your HTML template (e.g. as used in the markdown implementations of StackExchange, Jupyter Notebook, Quiver and such.)

</comment><comment><USER32> Whats with the weird unicode characters on the homepage in firefox on windows? And not working in firefox?

</comment><comment><USER33> This is awesome! Just today I was looking for collaborative Markdown editor with nice previews/rendering.

There needs to be the ability to ability to add comments to documents, though. Without commenting, the "collaborative" aspect is severely limited.

</comment><comment><USER34> Who would want to take notes in a -1 degree angle?

</comment><comment><USER35> Canvas: Notes for teams of nerds not using FF.

</comment><comment><USER36> Confused about the positioning (or is targeting a better word?). Why only nerds? From the looks of it, anybody can use the app. Or only "nerds" know about Markdown?

</comment><comment><USER37> FYI:If anyone is interested in following along how markdown "conquers" the world of writing. You're invited to follow along on the world's first markdown news channel @manuscriptsnews -> [https://twitter.com/manuscriptsnews](https://twitter.com/manuscriptsnews) Cheers. Congrats to the canvas launch! All covered on @manuscriptsnews ;-)

</comment><comment><USER38> Some feedback: CTRL + space on Chrome 49 seems to be the hotkey for "We're still a bit buggy and hit a wall. We've reported the error and disabled the editor to prevent data loss.".

Actually now pretty much anything I do brings up that message plus: vendor-6d85b06….js:31 Uncaught Error: opAcknowledged called from a null state. This should never happen.

<comment><USER8> Weird...What OS are you on? Or email me at jonathan [at] usecanvas [dot] com, if you don't mind.

</comment></comment><comment><USER39> Loved trying it - been waiting for an cross-platform improvement on iA Writer's markdown editor - but tried to sign up and hit a 503 D:

Would love math support too, but I guess you've got plenty to do anyway for now.

<comment><USER39> Got it to work. Just waiting for mobile support now :D

</comment></comment><comment><USER40> I just wish some notetaking program besides OneNote had the feature that inserts the source URL when you paste text from the browser. Some Firefox extensions will add the URL when you're copying, but I haven't seen that on Chrome yet...

<comment><USER9> That's a hack from the site from which you're copying, not OneNote.

<comment><USER41> Uhm, no. When sites do that, OneNote has the URL twice. Evidently the source URL is part of the HTML clipboard format.

</comment></comment></comment><comment><USER42> This looks a lot like Wave, just within a single company, rather than federated. I'm wondering what has changed that would make this successful now vs. before.

</comment><comment><USER43> Whatever that big box at the bottom that is slightly tilted is, it hurts my head.

</comment><comment><USER44> Are you worried you'll get sued by Instructure/Blackboard?

<comment><USER45> Where do they overlap? Or is it the product name? In which case it seems far more likely that they'll ask for the name to be changed first, before moving to litigation.

</comment></comment><comment><USER46> ctrl + z doesn't undo ctrl + backspace up down end home doesn't do what you'd expect

</comment><comment><USER47> relevant: [https://www.youtube.com/watch?v=XJyMT4ZVQEc](https://www.youtube.com/watch?v=XJyMT4ZVQEc)</comment>


The Volfefe Index - <AUTHOR> https://en.wikipedia.org/wiki/Volfefe_index <comment><USER2> Given that JPM is publishing this I think we can draw one of two conclusions. Either this strategy used to work, but no longer works due to it becoming too popular. Or they never managed to actually get this strategy to work, so they're publishing it as a fun PR piece.

<comment><USER3> I would say it's a PR piece, because they named it "Volfefe" and because the Wikipedia article reads like it was written by a PR firm for JPM. (and if not that, it at least quotes a lot of PR articles)

</comment></comment><comment><USER4> I'm sure there are some quants reading this thread, so here's a real question: Can somebody explain the technical pipeline from tweet->execution?

I assume there's some low latency twitter API that you can pay big money to access? And then I guess that goes to some array of GPUs to run the NLP model as quickly as possible? And the NLP results get traded on by placing orders with an exchange?

Are there companies that roll up many low latency data feeds for purposes like this?

<comment><USER5> Disclaimer: not a quant but I've built a similar system.

>some low latency twitter API that you can pay big money to access

Yes. The twitter firehose is the big one, where you get a stream of _all_ tweets. Twitter doesn't publish the price, and one source claims $360k/y for half of the hose. [https://econsultancy.com/want-your-own-twitter-firehose- you-...](https://econsultancy.com/want-your-own-twitter-firehose-you-can-now- buy-it-for-a-price/)

>And then I guess that goes to some array of GPUs to run the NLP model as quickly as possible?

General speaking, trained models usually aren't so big that you need a cluster of GPUs, or even a single one. Sometimes running it on a CPU makes more sense because if it's small enough it's just easier and cheaper.

In particular, basic NLP and sentiment analysis is pretty easy, especially like in this case when you're dealing with a very limited vocabulary. A free CPU based library like [https://github.com/cjhutto/vaderSentiment](https://github.com/cjhutto/vaderSentiment) should be good enough.

> And the NLP results get traded on by placing orders with an exchange?

Yes. Doing this quickly is pretty tricky, but financial institutions like JPMorgan Chase would have access to an extremely fast and low cost (per trade) API to do this. And then they probably already have the tech to strategically place big orders, so the other bots don't realise what you're doing. Or just use a private exchange, aka a dark pool: [https://en.wikipedia.org/wiki/Dark_pool](https://en.wikipedia.org/wiki/Dark_pool)

<comment><USER6> Disclaimer: arguably a quant but definitely not this kind.

In this specific case you only need access to Trump his tweets, which you can get without parsing and evaluating the firehose (expensive to get and process).

> In particular, basic NLP and sentiment analysis is pretty easy, especially > like in this case when you're dealing with a very limited vocabulary.

Exactly. With Trump's tweets you can probably find easy correlations between sentiment (good or bad) and a select range of words as well as tweet times, whether he is in office or not, whether it was tweeted from his android[1] or not. Statistically speaking you can also look at his overall sentiment. Eg. simply always short the market whenever he tweets might be the profitable move 80% of the time.

[1]: [http://varianceexplained.org/r/trump- tweets/](http://varianceexplained.org/r/trump-tweets/)

</comment></comment></comment><comment><USER7> Carl Quintanilla (cnbc) had a thread with some of the charts on this: [https://twitter.com/carlquintanilla/status/11706934775769169...](https://twitter.com/carlquintanilla/status/1170693477576916992)

</comment><comment><USER8> Geeks were far faster to think of that:

[https://github.com/maxbbraun/trump2cash](https://github.com/maxbbraun/trump2cash)

<comment><USER9> Well companies like JPM only publish this stuff after the rest of the world discovers it and it stops making money. They don't publish actively profitable strategies.

</comment></comment><comment><USER10> I have traversed through every new article & none of them actually link to the mysterious report. Just copying each other blindly. All I found was the twitter thread with plots.

</comment><comment><USER11> Why is it called the Volfefe index and not the covfefe index?

<comment><USER12> Vol - for volatility as it usually results in a price change. Timings of tweets seem to coincide with market openings\closings.

edit:spelling

</comment></comment><comment><USER13> r/Wallstreetbets expertise discussion about this market index:

[https://www.reddit.com/r/wallstreetbets/comments/d1edm4/jpmo...](https://www.reddit.com/r/wallstreetbets/comments/d1edm4/jpmorgan_has_a_new_index_called_the_volfefe_index/)

</comment><comment><USER14> Similar to this, I think some people trade off the back of "woke" twitter storms. They buy stock at the peak of the outrage cycle and sell when everyone has moved on to the next.

EG Buy Papa John's Pizza on July 11th (when the CEO got fired for using the N-word). It's up $6 since then.

</comment><comment><USER15> Most 'research' articles are really just published for the entertainment of traders. JPM are probably just trying to drum up some notoriety by publishing this index.

</comment><comment><USER16> I'm looking for some API or scraping source to add it as a metric to my music app, anyone came across one?

<comment><USER17> Why would you need this for a music app at all?

</comment></comment><comment><USER18> Twitter-driven economy.

</comment><comment><USER19> Another candidate for covfefe?

<comment><USER20> I believe it means volatility of covfefe.</comment></comment>


Coinfork – easily access your Bitcoin Cash - <AUTHOR> https://www.coinfork.io/ <comment><USER2> This is by Jaspar Bryant-Greene.

I've spoken to him before, he's a decent bloke doing good work.

I can't vouch that he _certainly_ won't steal your money, but if he was planning to he should have posted it more anonymously than this.

It's still a bad idea to trust a service like this when you could just split your BCH yourself. But it's probably legitimate.

</comment><comment><USER3> this was bound to happen, go ahead, give him all your money</comment>


Ask HN: Is there any way to get GMail to lighten up on the SPAM filtering? - <AUTHOR> I was checking my SPAM folder in GSuite today  and I noticed a decent number of messages that don't belong there.  For example:
https://imgur.com/a/nzkMNDS
The message from Facebook in the screenshots is about as technically good as you can get AFAIK.  It passes SPF (hard fail record), DKIM, and DMARC (reject policy).  Is there a way I can tell GMail / GSuite that I don't want it to ever SPAM filter email that passes all those checks?
I understand SPAM filtering is hard, but I don't think there should be any question about messages from high value domains like facebookmail.com. <comment><USER2> Related, a description of the problem, but not a solution:

* Google Is Eating Our Mail

[https://news.ycombinator.com/item?id=19756125](https://news.ycombinator.com/item?id=19756125)

My personal mail server has all the industry-standard SPF, DKIM, and DMARC records. But Google still randomly eats my mail, and the system gives no explanation, sometimes it was my kernel patches submitted to the Linux maintainers, yikes! Weeks of time wasted.

<comment><USER3> I just read through the comment section of this article and, as someone who is planning to host my own email, it is really demotivating me.

Do you (or anyone) happen to know how the big players (AWS SES, SendGrid, Mandrill etc) work around this issue? I understand they offer dedicated IP address, but I suppose a considerable amount of their emails goes through the "shared pool".

Maybe a high volume of sends actually helps?

<comment><USER2> I believe they are simply "too big to fail". If you start blocking AWS, lots of people will have problems with Google. As a result, mail sending services are unlikely to be flagged.

> _as someone who is planning to host my own email, it is really demotivating > me._

The good thing is, I've hosted emails on my personal server for 4 years or so, and I don't have any issue so far, as long as it's not Google, but it's probably not so assuring to you because of this exact reason...

</comment></comment></comment><comment><USER4> Funnily enough, cert issuance notifications (not Let's Encrypt) and infos about upcoming maintenance from my hosting provider are pretty much the only things that end up in my GMail spam folder, too. I have serious doubt that many people flag "here's your cert" emails as spam, and you have to sign up for the maintenance emails, so I suspect it's mostly about "this email looks similar to many other emails".

I've marked them "not spam" many times, but they ignore that completely.

</comment><comment><USER5> This can also happen with shared email providers or email servers on shared IPs. If someone else is sending spam from that IP, you can get canned too</comment>


Is Threatening to Publish Nude/Lewd Photos of Jeff Bezos Criminal Blackmail? - <AUTHOR> http://reason.com/volokh/2019/02/08/blackmail-and-the-bezos-v-national-enqui <comment><USER2> Here's slate.com's take on the specific legal jepardy AMI is in: [https://slate.com/news-and-politics/2019/02/jeff-bezos- ameri...](https://slate.com/news-and-politics/2019/02/jeff-bezos-american- media-national-enquirer-blackmail.html)

<comment><USER3> Slate leaves off RICO, but with the multiple allegations of similar extortionate conduct within the required window, extortion being a RICO predicate offense, and an organized enterprise involved, there's RICO jeopardy, which involves both criminal and civil liability for everyone involved.

</comment></comment><comment><USER4> volokh is arguing points of law; bezos is playing the game of public opinion, which are two different things. In public opinion, threatining to public nude photos _is_ blackmail. Bezos didn't do this with the intent of filing a lawsuit, he's attacking president trump in this (as a response to trump attacking him through the NE).

</comment><comment><USER5> I'd certainly consider a threat to expose me to those pics as blackmail, yes.

<comment><USER6> How much would you pay not to see them?</comment></comment>


Seam Carving Demo in Flash - <AUTHOR> http://swieskowski.net/carve/ Don't worry, it's not another link to the (very cool) video. <comment><USER2> Nice! I was thinking about making something like this for DevHouseBoston.

<comment><USER3> Why don't you try to implement it nativeley for Firefox?

<comment><USER2> That's a good idea. I didn't think of it.</comment></comment></comment>


Unix System V Release 1 Programming Guide (1983) [pdf] - <AUTHOR> http://bitsavers.trailing-edge.com/pdf/att/unix/System_V_Release_1/341-930_Programming_Guide_UNIX_System_Jan83.pdf <comment><USER2> I had never heard of bitsavers [0] until just now. They've got two sections: documents and software.

I have so far found blueprints associated with the PDP-1 [1] in the documents portion, but mostly image files in the software section.

[0] = [http://bitsavers.trailing-edge.com/](http://bitsavers.trailing- edge.com/) [1] = [http://bitsavers.trailing- edge.com/pdf/dec/pdp1/blueprints/](http://bitsavers.trailing- edge.com/pdf/dec/pdp1/blueprints/)

<comment><USER3> JFYI, in public you should generally link to [http://bitsavers.org](http://bitsavers.org) to get one of several mirrors.

</comment></comment><comment><USER4> SVR1?

Remembers AT&T's early attempts to "professionalize" Unix.

Screams "The bugs! The bugs! They're all over me! Get them off!"

Huddles sobbing in corner.

<comment><USER5> The termcap/terminfo fiasco involving Mark Horton is fun too.

</comment></comment><comment><USER6> The other manuals that are referenced in the programming guide are also available on the same site:

[http://bitsavers.trailing- edge.com/pdf/att/unix/System_V_Rel...](http://bitsavers.trailing- edge.com/pdf/att/unix/System_V_Release_1/)

</comment><comment><USER7> What font is the index printed in?

<comment><USER8> You mean the TOC? That (plus headings) would be Futura. Copy is ITC Century, cover is Eurostile plus a little Helvetica.</comment></comment>


Ask HN: What would you finally learn if you had 3 uninterrupted days to do so? - <AUTHOR>

Me:<p>1. vim 2. Coffeescript 3. Lisp <comment><USER2> Write more tutorials for ChicagoBoss web framework. Write a RabbitMQ adapter for ChicagoBoss. Finish WebSocket support for ChicagoBoss.

</comment><comment><USER3> Statistics.</comment>


UK Schools ICT to be replaced by computer science programme - <AUTHOR> http://www.bbc.co.uk/news/education-16493929

<comment><USER2> I'm from England, I left school in 2008 with 3 GCSEs (which is considered _failing_ high school here) and the absolute biggest problem with education here in England is it's not _education_ it's just _doing work_ / remembering information -- not sure if this affects other countries, I would assume so but I've not experienced any other education system.

I had an absolutely fantastic IT teacher, he really cared about technology and teaching and he was the best teacher I've ever had but he was _very_ restricted by the curriculum. This was a teacher who enjoyed programming and could teach it, he could teach complex (relative to the classes intelligence level) computing things and teach it in a way we could understand, but the material he was forced to teach was awful, absolutely awful. For my entire last year of school my required work was (If I remember correctly (this is how awful it was, I do not remember it well today)) write an explanation / brief about a microsoft access database system, the extent of our freedom was to choose the subject (dvd store, grocery store etc) and this was an entire years worth of work.

What we need is two things, teachers who really care about teaching and providing a real education _and_ a good curriculum that promotes _learning_ not consumption (and subsequent regurgitation) of information. I left high school and in the last 4 years of it I really did not learn anything that is useful to me today, everything I need to know today is stuff I was taught early on, the last 4 years was being given information to consume, information that as soon as I left the classroom was absolutely worthless.

The IT teacher I had left the school after a year to teach in Switzerland, I think that's pretty telling. The system we have pushes good teachers away and the shitty ones who are just content reciting material stick around, I would also assume relevant to this point is a teacher I had of Spanish is still with the school, but he is such a bad teacher they re-assigned him after many years to "cooking". Someone the school deemed qualified and able enough to teach Spanish for many years is now using his full power to teach cooking?

<comment><USER3> My IT teacher was similarly skilled and equally wanted to teach usefully and interestingly, and he generally managed to get round the curriculum.

Part of this was that he managed to bend the curriculum to be more challenging and interesting (my GCSE project consisted of researching and then writing up methods of bypassing the school's internet filter system - those who preferred to could indeed do stuff like MS Access projects), and part was finding ways to achieve good grades quickly leaving plenty of free time for other areas.

Possibly the reason he was able to do this was that I went to a private school, I don't know if state schools would allow teachers this much flexibility? That said, my school was/is ranked very highly in GCSE/A-Level rankings tables, and took that very seriously, so as far as grades were concerned he was still on a very tight leash.

He was a very unusual (in a good way) teacher though, like none over I ever had or have ever heard of. In his office (connected to the IT rooms) he had a fully stocked minifridge, originally for himself but he also sold to his students at cost. He formerlly was a programmer for the Canadian air force, as well as a DJ, and would generally play techno music through classes (often loud enough for teachers above to take issue), and was regularly getting in trouble with the headmaster for wearing an ear-ring. Unconventional, but the best teacher any of us ever had.

<comment><USER4> Let me compare with the 1980s in England, because that's what I know ...

I sat 'O' levels (now replaced by GCSEs in 1981 and 'A' levels in 1983. There was _no_ IT teaching in my school at that time. A computer lab was installed in 1980, and they began running the 'O' level computer science exams in 1983 (too late for me) although I got to use the lab's Apple IIs and Systime 525 minicomputer during my 'A' level in general studies. Teaching focused on programming; there were _no_ office apps on those computers. The 'O' level in CS was recognizably about computer _science_ , albeit at an embryonic level, in those days.

In 1987 I began studying for an 'A' level in computer science at evening classes (I'd been at university from 1983-86). The focus was fairly hardcore programming, with some assembly language plus BBC Basic, plus boolean logic, binary and hexadecimal arithmetic, basic data structures (linked lists, trees, hash tables). Applications barely got a look in.

I bailed on the CS 'A' level as too pedestrian and instead went into a graduate-entry conversion degree in 1989. The then CS 'A' level was, I will concede, useful preparation for a CS degree back then.

The point is, the 1980s syllabi had zero content on application usage -- it was all about data processing and programming and the structure of computing machinery. The trend towards teaching IT seems to have cut in some time after 1988, and gone _way_ too far ...

</comment></comment></comment><comment><USER5> "Children are being forced to learn how to use applications, rather than to make them. They are becoming slaves to the user interface and are totally bored by it"

That's a remarkably smart thing for a politician to say about computing education.

<comment><USER6> Sadly, this will all be reversed in a couple of years by the next minister who will believe that "Children should be taught the essential workplace skills that employers are demanding in the 21st century. Driving schools don't teach their students how to build a car, but how to use one; and schools shouldn't teach their pupils how to build software, but how to use it."

[note: I don't believe this myself, just that the next minister will.]

<comment><USER7> But could anyone seriously claim that children are leaving school and not able to use computers?

I'd guess that the average teenager would be more capable with e-mail and office applications than students of 5 or 10 years ago. Even if they aren't using them regularly, they're at least familiar with most IT concepts.

<comment><USER8> > I'd guess that the average teenager would be more capable with e-mail ... > than students of 5 or 10 years ago.

I suspect the average teenager today hardly uses e-mail at all. Newer, more efficient methods of communication have developed, and e-mail in an anachronism to most young people in the era of texting, Facebook messaging, and tweets.

Whether swapping a powerful, flexible infrastructure for viewing the world in 140 characters or fewer is progress in a healthy direction is a different question.

Then again, we haven't managed to get secure e-mail standardised, solve the spam problem, or reliably prevent malware transmission over e-mail, despite having several decades to work on these problems. I don't think we in the older generations are in much of a position to lecture anyone on how to communicate effectively.

I'm hoping that if this is a genuine effort to teach some computing real skills to younger people, part of it will include some exposure to these sorts of issues so perhaps they can do a better job of it than we have.

<comment><USER9> _I suspect the average teenager today hardly uses e-mail at all._

Yes -- I was surprised (and somewhat weirded out) recently to discover that my younger sister, who's in her early twenties, thinks of email exclusively as a formal communications channel, and never emails her friends (she texts or Facebook-messages them instead).

<comment><USER7> I'd never heard it in quite those terms before, but that echoes the way that my generation might consider e-mail to be for talking to friends and physical letters to be "formal".

</comment></comment></comment></comment></comment></comment><comment><USER10> This is really great news. Lots of people in the UK have been pummeling on Michael Gove to make this change and it's good to see that it's happening. With Raspberry Pi and it being Alan Turing Year we can be hopeful about the future of computer education in the UK.

</comment><comment><USER11> This makes me slightly too happy. I lost less than 1% in Computing A-Level and am on track for a 1st at university, yet I barely scraped a B at GCSE ICT and have memories of writing ~sentence an hour. Hopefully this will increase university standards as well, the ability to program in the slightest is not a requirement at most UK universities because not every school even offers Computing A-Level.

I consider ICT a remnant of times when every-one didn't have their own computer, and teaching them just to use one was a genuine skill. And if I ever hear of hierarchical marking ever again I will murder some-one (you can't achieve the hard marks without first achieving the low ones).

<comment><USER12> Assuming you're studying computer science at university, then programming is also not a requirement because it's simply not necessary to know before you start the degree.

<comment><USER6> It isn't _currently_ a requirement, but I assume that this is largely because there isn't a significant supply of potential students who know the fundamentals at the moment.

Increase the supply, and some courses/universities have the option of making it a requirement.

<comment><USER13> Performance at A-Level mathematics is a better predictor of CS success than performance at A-Level Computing (which does involve programming), hence it's unlikely that universities will make it a requirement.

<comment><USER11> I see it as a failing of A-Level Computing more than anything. But I found about half the of first year was wasted on me, to break this down:

Com 1001 - Software Engineering Crossover Project UML, requirements, analysis, design etc. All covered in A-level computing.

Com1002 - Foundations of Computer Science Maths, not covered at A-level in any subject.

COM1003 - Java Programming I struggle to remember which concepts were covered in A-level and which I taught myself but sitting through lectures which taught what a variable was, then what classes and an objects are was painful. There were some golden parts that were enlightening but these were few and far between.

COM1004 - Web and Internet Technology: Cryptography - not taught at A-level. Ethics, law, piracy - taught at A-level.

COM1005 - Machines and Intelligence: The first semester of this was writing about AI because we 'didn't know how to program'. The second semester was learning systems which was very enjoyable and quite complicated.

COM1006 - Devices and Networks: Anything that was taught at A-Level (boolean logic etc) was extended on and there was little time spent on basic stuff.

If they had made Computing A-level a requirement I'd have gained just shy of 6 months education I reckon (£4500 for future years), and if Computing A-level was extended upon to improve it then they'd be able to teach even more interesting topics. I think the requirement of Mathematics (which was required at my university, but not all) just shows a general aptitude in the appropriate areas, and only had direct relevance to two modules (one during first year and one in second year).

Any course with too many applicants for its spaces (the top Universities) could require Computing A-Level if it became more mainstream and I believe this would increase the standard of education possible.

EDIT: To bring my point back round the article. This news makes me happy because a move from ICT towards Computing at GCSE would likely increase numbers taking Computing at A-level and definitely increase the quality of the A-Level. The number of people taking it and the quality of teaching at this level would hopefully remove some of the simpler concepts that Universities are having to teach.

<comment><USER14> The problem with making something like computing (or any non-standard) A level a requirement is that it immediately limits people who couldn't study it. Not all schools offer computing (or other less popular A levels), and by making it a requirement you're penalising those who had to attend them. In practice, that means rural and less-well-funded schools.

There obviously has to be some prerequisites. Perhaps the solution would be a summer school for students without A Level computing. Most universities offer a foundation year for people who want to study engineering or maths related subjects but don't have the A levels required. However, given that you only need to cover under 1 semester of work, you'd be pushed to convince people that because they didn't study a computing A level they have to add an entire year to their degree.

Probably the best option would just be to make it a strongly required subject, and cover the basics in less time. If you don't have computing A level, you need to work harder.

</comment></comment></comment></comment></comment></comment><comment><USER15> The HN title should be modified to reflect that this applies to _England_ not the UK as a whole.

[Apologies for, yet again, playing the role of the bad tempered Scot.]

<comment><USER16> This might interest you (if you haven't seen it already): [http://www.guardian.co.uk/education/2012/jan/10/computer- sci...](http://www.guardian.co.uk/education/2012/jan/10/computer-science-in- schools-scotland) :)

<comment><USER15> Have a look at a recent paper from the Scottish Computing Advanced Higher exam:

[http://www.sqa.org.uk/pastpapers/papers/papers/2011/AH_Compu...](http://www.sqa.org.uk/pastpapers/papers/papers/2011/AH_Computing_all_2011.pdf)

Looks pretty good to me - it has everything from Prolog down to assembly in it.

<comment><USER14> It's great in theory, less in practice.

The school I went to in Scotland only offered computing up to a level known as "Intermediate 2", which was somewhere between a GCSE and an AS level. We did some Java programming, and it was quite an interesting class that provided enough of a basis in basic programming concepts that I was able to continue learning, but that was it.

Higher computing? You had to get a 30 minute bus to a local adult-education type college. Advanced higer computer science? I wouldn't be surprised if fewer than 100 people a year actually sit that exam. I did advanced higher maths, and only 400 people sit the exam a year.

The Scottish curriculum is often quite good (AH maths taught me the first year and a half of my engineering degree's maths modules), but it suffers from a lack of students taking it. It's poorly recognised outside of Scotland (AH's are generally harder than A levels, yet are seen on the same level by most English universities), and the private schools that would give it some clout almost all use the English curriculum.

<comment><USER15> Sounds very much like the Sixth Year Studies courses I did in the early 80s - very few people did them.

</comment></comment></comment></comment></comment><comment><USER17> I have worked as the designated IT Tech at schools across several counties in the UK. In some junior schools the role of I.T co-ordinator is just given to the newest/youngest most unsuspecting teacher. Usually they have no specific ICT knowledge or interest in the subject. There is a vast difference in the quality of ICT teaching at the younger age it doesn't provide a standard foundation for this new curriculum to sit upon.

Students arriving at high school at 11 have such different experiences of ICT. The curriculum they need going forward needs to have flexibility to teach what's individually challenging & help those above average to excel & not get bored.

The schools that I've seen integrate ICT successfully separate the 'use' of IT day-to-day from the teaching about of the history, theory & application of the subject. For example groups in the class using laptops to type up a project vs sitting in the ICT suite to learn to write instructions to control robots/traffic light sequences etc.

It's not fair to consitute word processing, e-mail, or desktop publishing as learning ICT anymore. It's like providing a lesson on using the telephone, it's not needed now they're a universal method of communication.

Now sitting at a computer to do general work doesn't constitute ICT learning.

Integrating ICT into the classroom works well. You have no idea how long it takes to take 30+ excited pupils down to the ICT suite, to keep them calm, get them logged on with their own username & password and to start a lesson. The lesson is half over by then.

Had I been exposed to the world of programming in a structured way I would have jumped into it feet first & would no doubt have many years experience by now. I can vividly remember being around 12 and wishing to know how I could build websites & to learn how to code and not knowing where to start or who to ask. I assumed that it was for college/university level. College focused on building relational databases & the data protection act, Then at University I was thrown in with already proficient programmers.

Even though I had 16 years within the academic system I feel the majority of what resonates with me has all been self taught in the last few years since leaving University.

The new curriculum needs to show pupils exactly what's possible with the power & scope of CS skills and that it's accessible from a young age.

</comment><comment><USER18> Absolutely glad to see this, however, there are some serious concerns which are addressed at the bottom of the article

"There are, of course, significant challenges to overcome, specifically with the immediate shortage of computer science teachers."

When I was an ICT teacher I was the only teacher I met who had any programming experience whatsoever. A large number of these teachers would even struggle with GCSE level maths and I do find it difficult to see how to government could train all these teachers to be able to be at a level necessary to teach any programming skills. Unfortunately those people who are qualified very rarely enter teaching.

<comment><USER13> Anyone who's studied Maths/Physics/Engineering will have had some programming experience, so I'm guessing most Maths teachers will. Whether they want to teach it is another question though.

</comment></comment><comment><USER19> In case anyone from outside the UK is thinking "Wow, those brits are doing really well here, I wish my country could take such a sensible approach to computing education", well you're kind of right, it's an enormous improvement, but I feel it needs to be made clear just how bad the situation is right now, before the changes come into effect.

I'm a geek who now has a degree in CS, and at school IT lessons were pretty much my least favourite lesson apart from Games. We didn't _learn_ _anything_. That's not hyperbole, I really doubt anyone learned anything in those lessons. And it wasn't like I was so amazing I knew it all already, everyone knew it all already. I've been in lessons where I already know the content, and what happens is people get stuck and you can help them out. That never happened, everyone already knew what they were doing, because we already wrote our essays in Word, did our class presentations in Powerpoint and our experimental data collation in Excel. We knew it already and the exercises were just asinine.

Everything I knew about CS before I started my degree, I taught myself.

Also, the school I was at was officially an "IT/Maths specialist school" or something like that (edit: [https://en.wikipedia.org/wiki/Mathematics_and_Computing_Coll...](https://en.wikipedia.org/wiki/Mathematics_and_Computing_College)), and in the year I graduated it won The Sunday Times' State School of the Year award.

<comment> UK-Al05 Before I dropped ICT; a project in year 9 involved designing a database. It's usually taught in access, I did it in MySQL. I received low marks because of that.

<comment><USER12> As you should've done. MySQL wasn't being taught.

<comment> UK-Al05 It was meant to be about database design, tables and sql. Not access specifically. [http://www.guardian.co.uk/education/2012/jan/11/digital- lite...](http://www.guardian.co.uk/education/2012/jan/11/digital-literacy- case-study) has some more examples.

<comment><USER12> Yes, and I assume it was to be assessed with what the teacher, and the curriculum, were instructed to assess.

Just because you feel MySQL is better doesn't mean you should get bonus points.

I agree using Access to teach database design is stupid, but that's hopefully something that this will address. Going against the curriculum because you feel you're above the instructed way is a fantastic way to get low marks.

Fortunately when it comes to university there's usually flexibility if you want to go above and beyond the minimum, but you still have to tick the boxes of being able to meet their assessment criteria.

Edit: And what happened in that article is what should've happened, in my opinion. You don't get bonus points for being a smart arse. IT teaching is woefully poor, there's no way that teacher could assess a proper app when the original assignment proposed a mock-app in PowerPoint.

</comment></comment></comment></comment></comment><comment><USER20> I worked at a publicly funded inner city technology center in one of the larger UK cities whose mandate was to integrate technology into the curriculum of the surrounding schools. I can not tell you how much potential was wasted. Huge computer labs essentially used as annex class rooms. spyware installed to make sure kids weren't "googling bad things" or "speaking ill of their teachers in email". There were attempts to teach programming but the few kids that were interested had to come after hours and use notepad to write javascript to run in internet explorer from the desktop (not a bad way to learn just how easy it is really, I am just saying there was no official support/classes for such programs).

So in short: I really hope this is a sign of change but I also know that money thrown at these programs is often just squandered on projectors and digital white boards.

edit: upon reflection I think I feel guilty that I did not do more to make things the way I envisioned. I could have easily created a "programming class" image that we flashed the systems with to let them have linux, learn emacs, vim, apache etc. but I think I was too inexperienced to really be sure of myself. I'd love the opportunity now as I could offer a scratch/squeak course, a scheme course, web apps, lua/love for game programming. So many awesome free tools for every type of aptitude.

</comment><comment><USER21> All I can say is, why has it taken them so long? Both the problem and the solution have been obvious for /years/. However, I'm glad the gov't have finally obtained some clue on this issue.

<comment><USER22> The problem is mentioned: where to find enough qualified teachers?

<comment><USER21> I suspect that there are plenty of people qualified to teach programming, it's just that most people currently teaching ICT are not qualified to teach anything (if the idiots I was taught ICT by are at all representative). If the government dumped less shit on the head of teachers in general, perhaps they might be able to attract competent programmers away from industry and into the teaching rôle. (They would also attract competent people in general, instead of the current situation where about 5% of teachers are competent people who love teaching and haven't quite been driven away yet, and the rest are "those who can't, teach")

<comment><USER7> There are certainly people willing & able to teach programming, but most of them are not currently teachers, and many IT teachers would probably struggle to teach programming effectively. The article suggests that they want to make this change in the next academic year, so where are the teachers going to come from?

<comment><USER21> They could let those people become teachers without having to go through the rigmarole of largely useless training. The next academic year is nearly eight months away; that's /bags/ of time.

The barriers to entry to teaching are just another reason why so few good people go into teaching.

</comment></comment></comment></comment></comment><comment><USER23> I've found that ICT has had such a damaging effect on my generation's perception of what CS is and what the people that do it must be like. I'm really glad to see it go. It's great to know that people will get a chance to have some insight into a world which a lot of people would never encounter.

I'd like to think that this was a result of the e-petition started a few months ago too.

</comment><comment><USER24> Can't quite express how glad I am to see this news. For reasons I can't quite fathom it's genuinely cheered my day. Kudos to the DfE.

<comment><USER25> I feel the same! It's probably because we have a vested interest in this area, but putting that aside it's nice to see something coming from the government that I think is a genuinely good thing (for a change?).

</comment></comment><comment><USER26> I think this is a great move. Although it would be interesting to see how many people actually take the new subject.

The problem at the moment is as the article says, just get used to Microsoft GUIs and not know anything behind them. And what happens is people do other things in the lesson, as they get bored, or find it to easy so they don't even bother. The whole MS access stuff can be very dull.

They could even bring in sections of web development into the new course, ie setting up a LAMP environment and learning PHP. And not just learning to create table (shudders) based rubbish in Dreamweaver or the like.

Or on the comp sci/software dev side of things learn Java programming for Android. Although I would think that iOS dev would be a step too far at this stage - not sure?

Or maybe start teaching them a high level languages such as Python or Perl to help give them a good understanding of programming practises etc.

<comment><USER27> ICT is compulsory (as mentioned in the Guardian article, [http://www.guardian.co.uk/politics/2012/jan/11/michael- gove-...](http://www.guardian.co.uk/politics/2012/jan/11/michael-gove-boring- it-lessons) ) so I presume this will be too.

<comment><USER26> Sorry yes - I was thinking GCSE level and higher.

</comment></comment></comment><comment><USER28> This is great news. However just think of how hard it is to hire software developers. Now how the hell are schools (with fixed salary caps and a work environment filled with children) going to compete?

<comment><USER29> They can't, so just throw some mathy teacher in there and hopefully the students will more or less teach themselves, and if you're really lucky, each other. That's how every high school CS class I've ever taken has worked. It's not ideal, but it's better than no CS at all.

</comment></comment><comment><USER30> ICT is learning how to use computers efficiently, how to do a non-computer job like accounting on computers., basically how to use Office. Computer Science is different, and now that home computers are common enough could easily be done at the same time (school years) as ICT. This divide of using or creating goes on forever, my options of courses for next year are Business IT (supporting those people who are just using Office) or Programming (making programs, though possibly only in Java).

</comment><comment><USER31> Back in 1993 I was doing GCSE Computer Studies which included everything from desktop publishing to writing simple BASIC programs. But when I want to continue this into A-level, I had to personally convince the computer studies teacher to let me do it on my own since the school didn't offer it as an option. In the end, I did a mostly self-taught AS Computer Studies with some guidance from the teacher.

I was extremely lucky to have a well-resourced school and a flexible teacher

</comment><comment><USER32> This interview with Simon Peyton-Jones seems very relevant, the points made are so similar to what Michael Gove says here that it makes one wonder :)

relevant part starts at 19:19 [http://channel9.msdn.com/Blogs/Charles/YOW-2011-Simon- Peyton...](http://channel9.msdn.com/Blogs/Charles/YOW-2011-Simon-Peyton-Jones- Closer-to-Nirvana)

<comment><USER33> Simon has been doing a _ton_ of work behind the scenes getting a decent curriculum in place for computing in the UK, playing a major role in a group of educators tackling the issue. I would not be surprised if Michael's words were lifted directly from one of his reports :-)

</comment></comment><comment><USER34> I loved the picture's caption accompanying the article: "Schools will be free to use teaching resources that will equip pupils for the 21st Century". The picture then shows young pupils using aging CRTs. It made me smile :)

</comment><comment><USER35> The problem is that Google and a lot of newer companies fetishise CS ie computer science to an insane degree. What indistry realy wants and needs is some one who can take a problem and produce a suitable solution which is much more computer engineering.

What you don't want is more ivory tower geeks writing in lisp who obsesses about algorithmic purity and can produce noddy systems that work for some cases but will break badly in the real world.

One example from the 80's I was helping build billing systems for BT I also had to run the system and make sure it all worked properly. The first time we hit £1,000,000 in a month (about $5,000,000) in today's money ) we had a small celebration and I recall the CTO (one of Vints reports I believe) nudging me and saying "this had better be right or we are both out of a Job"

Its like saying we need more engineers like Ross Brawn I know lets train more physicists 10 years later you have 200 Brian Cox's and not 195 Ross Brawns and 5 Brian Cox's working at Cern

<comment><USER36> I don't see why CS can't "take a problem and produce a suitable solution." Understanding the essential underlying theory (complexity theory, etc.) is essential to solve these problems.

Furthermore, not all Computer Science degrees are purely theoretical course where all you do is esoteric logics and category theory. If anything, I think there's too _little_ theory in the UK's CS courses these days.

<comment><USER37> > If anything, I think there's too little theory in the UK's CS courses these > days.

This has been my experience with CS courses in the US as well.</comment></comment></comment>


I was turned down for a job at a tech startup because I'm male - <AUTHOR> https://medium.com/@stigmapseudonym/i-was-turned-down-for-a-job-at-a-tech-startup-because-im-male-c1ea6dc87733

<comment><USER2> This article has already been submitted 1 hour earlier: [https://news.ycombinator.com/item?id=8172047](https://news.ycombinator.com/item?id=8172047) .</comment>


Google unveils 5-year roadmap for strong authentication - <AUTHOR> http://www.zdnet.com/google-unveils-5-year-roadmap-for-strong-authentication-7000015147/

<comment><AUTHOR> Just how well will requiring two-factor auth for end-users go over for both gmail and especially google apps customers? I strongly believe in two-factor auth but what device do they think corporate users would want to act as the secondary auth?, their personal phones? Not likely. What ever happened to servicing the customer requirements... ie optional, not dictating?

<comment><USER2> Google's approach here does seem heavy-handed.

If they actually do it, will enough customers jump ship to represent an opportunity for competitors large and small? Or will Google be willing/able to change to a more conservative course if too many people don't like the changes? Or do people have high enough trust in Google (or high enough switching costs) that they'll grouse about this at first but eventually get used to it, and actual reductions in the customer base will be small?</comment></comment>


Best explanation of the banking crisis I've read - <AUTHOR> http://www.moneyweek.com/file/39172/how-banks-got-trapped-in-a-vicious-cycle.html

<comment><USER2> Anyone have a link that explains how to read those charts? They say "Total assets and gearing" but I don't know what 'gearing' is.

<comment><USER3> No clue on the chart, but you might try Investopedia:

<http://www.investopedia.com/search/results.aspx?q=gearing></comment></comment>


Show HN: 19 Tone Equal Temperament Piano in Web Audio - <AUTHOR> https://academo.org/demos/19-tet-keyboard/ <comment><USER2> This library and web audio demo has 3000+ tuning systems:

[https://github.com/abbernie/tune](https://github.com/abbernie/tune)

It's part of the proceedings of the 2nd Web Audio conference which are now available:

Abstract: [https://smartech.gatech.edu/handle/1853/54580](https://smartech.gatech.edu/handle/1853/54580)

Proceedings: [https://smartech.gatech.edu/handle/1853/54577/browse](https://smartech.gatech.edu/handle/1853/54577/browse)

</comment><comment><USER3> Is there something that makes 12 special? I am no expert in music theory, but I can imagine that it could be useful that 12 has many factors: 12 = 2x2x3. Since 19 is prime, would that be a bad choice?

<comment> s-phi-nl There are some mathematical reasons.

In particular, the two most consonant (best-sounding) intervals are the octave and the fifth. The frequencies of the two pitches in an octave have a ratio of 2.0, and the frequencies of the two pitches in a pure fifth have a ratio of 1.5.

We would like the pitches we obtain from powers of these two ratios (stacking these intervals on top of each other) to be the same. However, since the integers are a unique factorization domain, they will never be (except for 2^0 = 1 = 1.5^0, of course). [1]

Thus, we pick powers of the two that are 'close enough' and call those the same pitch. The following Python (3) code subtracts the log-base-two of the powers of 1.5 from the integer they round to in order to find the closest ones:

      from math import log

      fifth = log(3/2, 2.0)

      print(0, 0.0)

      minDist = 0.08
      for i in range(1,100):
          pow = i* fifth;
          dist = abs(pow - round(pow))
          if dist < minDist:
              minDist = dist
              print(i, pow, dist)

This has output:

      0 0.0
      5 2.924812503605781 0.07518749639421918
      12 7.019550008653875 0.019550008653874684
      41 23.983462529567404 0.01653747043259557
      53 31.003012538221277 0.003012538221277339

From this, you can see that 12 is the closest that the powers of 2.0 and of 1.5 come being equal until 41. This is a primary reason why we use a chromatic scale with 12 notes.

(As an aside, a scale with 5 notes is also common around the world, called the pentatonic scale [2])

[1] For an explanation of this, see [http://blogs.scientificamerican.com/roots-of-unity/the- sadde...](http://blogs.scientificamerican.com/roots-of-unity/the-saddest- thing-i-know-about-the-integers/)

[2] [https://en.wikipedia.org/wiki/Pentatonic_scale](https://en.wikipedia.org/wiki/Pentatonic_scale)

<comment><USER4> The TED video on the pentatonic scale by Bobby McFerrin is worth watching. Only 3 minutes long: [http://youtu.be/ne6tB2KiZuk](http://youtu.be/ne6tB2KiZuk)

</comment></comment></comment><comment><USER5> Very cool. You might consider adding a short (a few ms is enough) fade in/out when toggling notes to avoid clickiness.

<comment><USER6> A few _samples_ is enough, actually. Just enough to prevent the sudden change from high to low, which is what causes the click.

You don't even need to compute new samples. Merely repeat the last sample while lowering its volume until you reach zero.

</comment></comment><comment><USER7> Very clever and quite fun to poke around in, and educational with the whole math breakdown. Nicely done and glad to be able to play around with it. I'm tickled by the opportunities to play around with customary tones!

Z-R-V-Z-R-B-Z-R-N-Z-R-B-Z-R-V is a nifty little arrangement.

</comment><comment><USER8> Another interesting page in the site: [https://academo.org/demos/perlin- noise/](https://academo.org/demos/perlin-noise/)

Made me look it up: [https://en.wikipedia.org/wiki/Perlin_noise](https://en.wikipedia.org/wiki/Perlin_noise)

Smooth.

</comment><comment><USER9> I tried this on my phone (via Chrome for Android). The keys didn't do anything when I pressed them.

<comment><USER10> If you just want to play around, I wrote a keyboard that works in Chrome as well as Firefox on Android back in November.

[http://s.codepen.io/SeanMcBeth/debug/meaQvj](http://s.codepen.io/SeanMcBeth/debug/meaQvj)

</comment></comment><comment><USER11> There's a bug where if you mouse down and move the mouse out, the note plays indefinitely.

<comment><USER12> is that a bug? I was using that to hear chord, until I got to the bottom and saw I can also do it with my keyboard.

<comment><USER13> I agree, seemed like a feature to me.

</comment></comment></comment><comment><USER14> The tones in the piano don't have a lot of harmonic content (at least what I can hear from my ears), and if there are more harmonics the beating of the harmonics can be more easily heard. Just a suggestion.</comment>


Internet protocols are changing - <AUTHOR> https://blog.apnic.net/2017/12/12/internet-protocols-changing/ <comment><USER3> > When a protocol can't evolve because deployments 'freeze' its extensibility > points, we say it has ossified. TCP itself is a severe example of > ossification; so many middleboxes do so many things to TCP — whether it's > blocking packets with TCP options that aren't recognized, or 'optimizing' > congestion control.

> It's necessary to prevent ossification, to ensure that protocols can evolve > to meet the needs of the Internet in the future; otherwise, it would be a > 'tragedy of the commons' where the actions of some individual networks — > although well-intended — would affect the health of the Internet overall.

On the other hand, I've done a fair bit of work getting TCP based applications to behave properly over high latency high congestion (satellite or radio usually) links and QUIC makes me nervous. In the old days you could put a TCP proxy like SCPS in there and most apps would get an acceptable level of performance, but now I'm not so sure. It seems like everybody assumes you're on a big fat broadband pipe now and nobody else matters.

<comment><USER4> > It seems like everybody assumes you're on a big fat broadband pipe now and > nobody else matters.

This is intentional. The powers that be have an interest in moving everyone to faster networks, and they effectively control all new web standards, and so build their protocols to force the apps to require faster, bigger pipes. This way they are never to blame for the new requirements, yet they get the intended benefits of fatter pipes: the ability to shove more crap down your throat.

It's possible to cache static binary assets using encrypted connections, but I am not aware of a single RFC that seriously suggests its adoption. It is also to the advantage of the powers that be (who have the financial means to do this) to simply move content distribution closer to the users. As the powers that be don't provide internet services over satellite or microwave, they do not consider them when defining the standards.

<comment><USER5> There's a technical reason for this. The Internet2 project spent a lot of time and effort working on things like prioritized traffic to deal with congested links. They found that it was easier and more cost effective to just add more bandwidth than it was to design and roll out protocols that would deal with a lack of bandwidth.

For more info, read this: [https://www.webcitation.org/5shCiXna8](https://www.webcitation.org/5shCiXna8)

A noteworthy quote:

> In those few places where network upgrades are not practical, QoS deployment > is usually even harder (due to the high cost of QoS-capable routers and > clueful network engineers). In the very few cases where the demand, the > money, and the clue are present, but the bandwidth is lacking, ad hoc > approaches that prioritize one or two important applications over a single > congested link often work well. In this climate, the case for a global, > interdomain Premium service is dubious.

"Premium service" in this document refers, basically, to an upgraded Internet with additional rules to provide quality of service for congested links.

(I'm not personally claiming that all these conclusions are correct and that they still apply today, just that there's some backstory here.)

<comment><USER6> I think more bandwidth is better in every case except geostationary satellites due to their unavoidable latency. And in theory those satellites are going to be obsoleted by LEO ISPs.

</comment></comment></comment></comment><comment><USER7> Another interesting protocol, perhaps underused, is SCTP. It fixes many issues with TCP, in particular it has reliable datagrams with multiplexing and avoiding head-of-line blocking. I believe QUIC is supposed to be faster at connection (re)estabishment.

[https://en.wikipedia.org/wiki/Stream_Control_Transmission_Pr...](https://en.wikipedia.org/wiki/Stream_Control_Transmission_Protocol)

<comment><USER8> SCTP is a superior protocol, but it isn't implemented in many routers or firewalls. As long as Comcast / Verizon routers don't support it, no one will use it.

It may be built on top of IP, but TCP / UDP levels are important for NAT and such. Too few people use DMZ and other features of routers / firewalls. Its way easier to just put up with TCP / UDP issues to stay compatible with most home setups.

<comment><USER9> Why do the routers involve themselves at the transport layer? Can't they just route IP packets and leave the transport alone?

Firewalls -- whose firewalls are we talking about here? If a client (say, home user) tries to initiate an SCTP connection to a server somewhere, what step will fail?

<comment><USER10> > Why do the routers involve themselves at the transport layer? Can't they > just route IP packets and leave the transport alone?

Because they have to do NAT, at least on IPv4.

> Firewalls -- whose firewalls are we talking about here? If a client (say, > home user) tries to initiate an SCTP connection to a server somewhere, what > step will fail?

Because the connection tracking that's needed to even recognize whether a packets belongs to an outbound or an inbound connection needs to understand the protocol.

</comment></comment></comment></comment><comment><USER11> It seems that widely deploying TLS 1.3 and DOH can provide an effective technical end-around the dismantling of net neutrality. So we should be promoting and trying to deploy them as widely as possible.

Of course, they can still block or throttle by IP, so the next step is to increase deployment of content-centric networking systems.

<comment><USER12> It seems to me that all of the changes described in this story will contribute to thwarting intermediaries and their agendas. HTTP/2 and its "effective" encryption requirement are proof against things like Comcast's nasty JavaScript injection[1]. QUIC has mandatory encryption all the way down; even ACKs are encrypted, obviating some of the traditional throttling techniques. And as you say TLS 1.3 and DOH further protect traffic from analysis and manipulation by middlemen.

Perhaps our best weapon against Internet rent seekers and spooks is technical innovation.

It is astonishing to me that Google can invent QUIC, deploy it on their network+Chrome and boom! 7% of all Internet traffic is QUIC.

Traditional HTTP over TCP and traditional DNS are becoming a ghetto protocol stack; analysis of such traffic is sold to who knows whom, the content is subject to manipulation by your ISP, throttling is trivial and likely to become commonplace with Ajit Pai et al. Time to pull the plug on these grifters and protect all the traffic.

[1] [https://news.ycombinator.com/item?id=15890551](https://news.ycombinator.com/item?id=15890551)

<comment><USER13> But I, as an user, want to be able to block domains, inject scripts and see what Chrome is sending to Google on my own devices (which is what Google doesn't want me to do). That's why I can't support these protocols...

<comment><USER14> You, as a user, absolutely can. An ISP or network administrator who does not control the endpoints, on the other hand, cannot, by design. That's a feature.

<comment><USER15> What if I want to use my router to block telemetry domains? Or other malware sites? It's looking like the only way forward is running my own CA to mitm all encrypted traffic.

<comment><USER16> That seems superior anyway - you could keep blocking domains even when you're on the go.

<comment><USER17> Can I? On Android, apps now can decide if they want to accept user-installed CAs, or not.

So if an app is hostile (say, all the Google apps), then I have no way to intercept their traffic anymore.

<comment><USER18> You can decide to install the app or not.

And you can put your CA into the system CA store if you have root. (You can make an Android image, so technically the requirement is unlocked - <USER2> - bootloader.)

<comment><USER17> Unlocking the bootloader makes the device permanently fail the strictest SafetyNet category.

Apps can and will refuse to run in that situation.

Modifying /system will make every SafetyNet check fail, as result Netflix, Snapchat, Google Play Movies, and most banking apps will refuse to run.

I can decide to install the app or not? How do I go about replacing Google's system apps with my own, without preventing above mentioned apps from running? I can't. And I can't buy reasonable devices withou Google Android, due to the non-compete clause in the OEM contracts.

<comment><USER18> Then don't buy it. Or support efforts like Librem (and LineageOS and Magisk).

[http://www.androidpolice.com/2017/07/16/safetynet-can- detect...](http://www.androidpolice.com/2017/07/16/safetynet-can-detect- magisk-fix-works/)

You can walk into your bank and access the services. Or call them. Or use their browser based service, right?

Google and a lot of developers made the choice to restrict user freedom for more security.

I don't agree with it, but it's what it is. A trade off.

Of course, you can sign your own images and put the CA into the recovery DB and relock the bootloader on reasonable devices. ( [https://mjg59.dreamwidth.org/31765.html](https://mjg59.dreamwidth.org/31765.html) )

Or at least you used to be able to.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Let's just hope that future innovations (and, more perniciously, "innovations") reinforce the end-to-end principle. A major weakness of the 2017 Internet is its centralization.

The DNS-over-http discussion in this post mention that in passing, though I wonder if this treatment might not be worse than the disease.

<comment><USER20> The DOH example, in particular, only conveys it's benefits if centralized to something governments are hesitant to block. This is an example of "innovation" specifically designed to centralize. There's maybe a handful of companies with enough influence that countries would hesitate to block in order to block DOH.

</comment></comment><comment><USER21> "DOH" is not going to work very well as an anti-censorship protection unless they also fix the SNI problem in TLS.

</comment><comment><USER22> This is just depressing. Sure, sell us out to big corporations by not implementing proper features in protocols like HTTP/2 so we can get tracked for decades to come. Yet, represent freedom by yet another cool way to "fool" governments. When historians look back at what happened to the Internet, or even society, they are going to find that organizations like the IETF was to busy with romantic dreams of their own greatness to serve the public. It's like people leaned nothing from Snowden.

<comment><USER23> What features are missing that should be implemented?

<comment><USER24> Not the OP, but omitting support for SRV records in HTTP/2 was a terrible missed opportunity, as I've written about here before:

[https://news.ycombinator.com/item?id=8404788](https://news.ycombinator.com/item?id=8404788)

[https://news.ycombinator.com/item?id=8550133](https://news.ycombinator.com/item?id=8550133)

I quote myself: " _It really is no surprise that Google is not interested in this, since_ Google _does not suffer from any of those problems which using SRV records for HTTP would solve. It's only users which could more easily run their own web servers closer to the edges of the network which would benefit, not the large companies which has CDNs and BGP AS numbers to fix any shortcomings the hard way. Google has already done the hard work of solving this problem for themselves –_ of course _they want to keep the problem for everybody else._ "

<comment><USER25> I would also like to see SRV record support in HTTP/2 but IIRC Mozilla did some telemetry tests and found out that a significant amount of DNS requests for SRV records failed for no reason (or probably for reasons mentioned in this submission). Unfortunately I can't find a source link for that claim right now.

<comment><USER24> I know of two rather large users of SRV records already: Minecraft servers and (the big one) Microsoft Office 365. I'm less than convinced that resolution of SRV records is _that_ broken.

<comment><USER25> Do you mean accessing Office 365 via browser uses SRV records or something different?

<comment><USER26> o365 general services (lync skype, outlook, ... / exchange autodiscover) uses SRV a fair bit.

365 is not just the browser suite

<comment><USER25> Yeah but the services that you mentioned are used mostly by enterprises. It's still possible that SRV lookups are broken for large amount of consumers that are not enterprises.

<comment><USER24> And I wonder who that could be, if that is even true.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> > Finally, we are in the midst of a shift towards more use of encryption on > the Internet, first spurred by Edward Snowden's revelations in 2015.

Personally, I'd say it was first spurred by Firesheep back in 2010, but the idea of encrypting all websites, even content-only websites may have been Snowden related.

</comment><comment><USER28> the author is responsible for the 418 teapot incident in the early 2000's. though i am sure he is a swell guy :)

<comment><USER29> Indeed, he was great in web services standards back in the day, and still a good writer. ;-)

</comment></comment><comment><USER30> Regarding throughput, see UDT ([http://udt.sourceforge.net/](http://udt.sourceforge.net/)) which does reliable data transfer over UDP.

</comment><comment> g-clef I'm really struck by how hostile to enterprise security these proposals are. Yes, I know that the security folks will adapt (they'll have to), but it still feels like there's a lot of baby+bathwater throwing going on.

DNS over HTTP is a prime example: blocking outbound DNS for all but a few resolvers, and monitoring the hell out of the traffic on those resolvers is a big win for enterprise networks. What the RFC calls hostile "spoofing" of DNS responses enterprise defenders call "sinkholing" of malicious domains. Rather than trying to add a layer of validation to DNS to provide the end user with assurance that the DNS request they got really is the name they asked for (and, in theory, allow the enterprise to add their own key to sign sinkhole answers) instead DOH just throws the whole thing out...basically telling enterprise defenders "fuck your security controls, we hate Comcast too much to allow anyone to rewrite DNS answers."

"Fuck your security controls, we hate Comcast" is, I think, a bad philosophy for internet-wide protocols. (That's basically what the TLS 1.3 argument boils down to also...and that's a shame.)

<comment><USER31> As implemented, all these "enterprise security" things are mostly indistinguishable from malicious attacks. Of course they break when you start tightening security.

Forging DNS responses is a horrible idea (and already breaks with DNSSEC). I have a hard time to comprehend how this can be considered a reasonable security measure.

<comment> g-clef > I have a hard time to comprehend how this can be considered a reasonable > security measure.

OK, let's walk it through.

Task: block access to "attacker.com" and all it's subdomains. Reason: Maybe it's a malware command and control, maybe it's being used for DNS tunneling, whatever. Blocking a domain that's being used for malicious behavior is a reasonable thing for an enterprise to want to accomplish.

Option 1: Block by IP at the firewall. Problems: Attackers can simply point the domain to another IP, so you're constantly playing whack-a-mole and constantly behind the attacker. Also, if it's a DNS tunnel the DNS answer is what's interesting, not the traffic to the actual IP. Result: Fail, doesn't solve the problem.

Option 2: Block by DNS Name at the firewall. Problems: Requires the firewall to understand the protocols involved, which they have shown themselves to be inconsistent at, at the best of times. Also, doing regex on every DNS query packet(in order to find all subdomains) doesn't scale. Result: Fail, doesn't scale.

Option 3: Block with local agent. Problems: Tablets, phones, appliances, printers can't run a local agent. Result: Fail. Not complete coverage

Option 4: Block outbound DNS except for approved resolvers, give those resolvers an RPZ feed of malicious domains. Problem: Clients have to be configured to use those resolvers, but otherwise none. Result: Pass. It's standards compliant, and DNSSec isn't an issue since the resolver never asks for the attackers DNS answer, so they never get the chance to offer DNSSec.

That's why option 4 (or some variant of it) is popular in enterprises. It accomplishes the task in a standards-compliant way, and covers the entire enterprise in a way that scales well.

DOH blows this up. So, the question becomes: in a world with DOH, how is an enterprise supposed to completely and scalably block access to "attacker.com" and all its subdomains? So far, the answer has been "you don't." I think that is a really shitty answer to someone who's trying to accomplish something reasonable.

<comment><USER32> If the attacker can get new IPs, they can get new domains. Why is pure domain- blocking a goal in the first place?

The one-size-fits-all answer with DOH is the same as without it: Tell your devices to use/trust the MitM.

</comment></comment></comment></comment><comment><USER33> This reads less like "Internet protocols are changing" and more like "Google is changing the Internet to their own benefit".

<comment><USER34> Do these specific changes from Google impact negatively the community? Otherwise, IMHO good ideas, are good ideas regardless where they come from.

<comment><USER35> Yes, generally they're some combination of overly complicated technically, difficult to use without layers and layers of heavy dependencies, are poorly thought out, or solve Google-specific use cases.

<comment><USER10> Well, the complexity is a problem, but I don't really see that as Google's fault. The only chance to evolve the network is by building on stuff that works despite all the hostile middle boxes, and that necessarily requires quite a bit of complexity, unfortunately. In the long term, it seems to me like QUIC is a better idea than everyone individually having to work around idiocies all over the internet, as that is not exactly a zero-complexity game either.

</comment></comment></comment></comment><comment><USER36> I'm pretty excited about DNS over TLS. Ahaha no, that's so tacky, I meant DNS over QUIC of course. Sorry, I meant iQUIC. Ah no, it's not even there, but it will suck compared to DOH, DNS over HTTPS.

</comment><comment><USER37> No mention of BGP in the article?

</comment><comment><USER38> ELI5: Does DOH threaten the great firewall?

</comment><comment><USER39> Isn't ws:// also a new-ish protocol that is not supported yet by many browsers natively at least?

<comment><USER40> WebSockets leverages TCP and is based on/compatible with HTTP. Nothing new about it, at least in the sense the article is discussing.

</comment></comment><comment><USER41> good to see

</comment><comment><USER4> > For example, if Google was to deploy its public DNS service over DOH on > www.google.com and a user configures their browser to use it, a network that > wants (or is required) to stop it would have to effectively block all of > Google (thanks to how they host their services).

Which will result in all of Google being blocked by schools, businesses, and entire nations. Which, as Google is relied upon more and more, means less access to things like mail, documents, news, messaging, video content, the Android platform, etc.

Thanks.

<comment><USER42> Nah, many of them can't -- won't -- block Google over this.

A huge number of them are absolutely reliant on Google, for things like (org- wide) Google Mail, Google Docs, ChromeBook deployments, and so on -- not to mention basic Google search.

<comment><USER43> What about China or the EU? They can surely block Google?

<comment><USER44> China has, for many years. The EU is unlikely to.</comment></comment></comment></comment>


Virtual Tours and Experiences - <AUTHOR> http://toureaux.com <comment><AUTHOR> Toureaux is on a mission to connect travelers with local guides and experiences they'll never forget. In response to the COVID-19 pandemic, we have just launched virtual tours and experiences.</comment>


Hydroxychloroquine associated with less mortality in critical Covid-19 patients - <AUTHOR> https://www.medrxiv.org/content/10.1101/2020.04.27.20073379v1 <comment><USER2> Interesting, I'm bullish on Hydroxychloroquine (not because of any political reasons) but everything I've seen on it working has to do with using it as early as possible (so as close as the onset of symptoms). This study appears to have only administered it to critically ill patients which I would expect to have less of an effect.

That said I'm not going to be mad that it appears to have worked for the critically ill (something I have not seen anywhere else really). However, this NOT a randomized-double blind, they say at the end they still need to do one of those to be sure but a fatality rate of 18.8% (with HCQ) vs 45.8& (without) and a p<0.001 is very good news if proven true. Remember this is a pre-print, NOT peer reviewed.

It's interesting that we aren't seeing very many studies done with early HCQ dosing. Antivirals like Tamiflu (for the flu) only really help if administer very close to the start of symptoms showing up. We have seen a few Remdesivir that specifically break out when the onset of symptoms was, I wonder why we haven't seen the same for HCQ? Could it be the price difference between HCQ and Remdesivir?

<comment><USER3> (Disclaimer: I'm not a medical professional, and I don't lay any claim to being authoritative. This is mostly anecdotal.)

I suspect the difference in HCQ and remdesivir dosing studies mostly has to do with the classes of drugs those are. One's an antimalarial, and the other's an antiviral. There might be more of a priority to explore what existing antivirals could have an effect. There could also be a sheepishness in wanting to conduct those studies with HCQ given that we still largely don't understand how it works.

That said, apropos HCQ being associated with less mortality in advanced cases: As an antimalarial, it has some interesting immunosuppressive properties. Notably, it's used as a treatment for lupus in order to temper or moderate the kind of immune responses seen in those patients.

I imagine that there's possibly some sort of (fatal if left untended) immune response that manifests in advanced COVID-19 that HCQ happens to keep down. Writing as an asthmatic who's had his fair share of IV antibiotics to deal with some truly gnarly bouts of pneumonia, acute respiratory distress syndrome is no joke. Any little bit to keep folks off ventilators is truly helpful.

<comment><USER2> > There could also be a sheepishness in wanting to conduct those studies with > HCQ given that we still largely don't understand how it works.

How it works in what way? We have been using it since 1955 and people take it regularly. The risks are largely known. Remdesivir, on the other hand, is just over a decade old and is a drug in search of a problem (it was not useful in treating Ebola and I can't find any reference to it being used for other treatments). Maybe I should say it's an R&D budget in search of recouping the cost.

Look, I don't hate Gilead, in fact they make drugs to both treat and preventive HIV/AIDS. The latter being something I've taken before. But something about this all stinks.

<comment><USER4> joshstrange says> _" We have been using it since 1955 and people take it regularly. The risks are largely known."_<

This.

Actually "we" (the Western World) have been using it [quinine and variants] since the 17th century! And it is a fascinating story of political and medical intrigue and skill. Without quinine derived from the bark of the Peruvian cinchona tree, the British, Dutch et al could not have built their empires in malaria-infested regions of the world:

"The global history of quinine, the world's first anti-malaria drug":

[https://medium.com/@tcassauwers/the-global-history-of-the- wo...](https://medium.com/@tcassauwers/the-global-history-of-the-world-s- first-anti-malaria-drug-d1e11f0ba729)

There's are many books that discuss this history, among them:

"The Miraculous Fever-Tree: Malaria, Medicine and the Cure that Changed the World" by Fiammetta Rocco

[https://www.amazon.com/Miraculous-Fever-Tree-Malaria- Medicin...](https://www.amazon.com/Miraculous-Fever-Tree-Malaria-Medicine- Changed-ebook/dp/B0084WVECE)

"The Fever: How Malaria Has Ruled Humankind for 500,000 Years" by Sonia Shaw

[https://www.amazon.com/Fever-Malaria-Ruled-Humankind- Years-e...](https://www.amazon.com/Fever-Malaria-Ruled-Humankind-Years- ebook/dp/B003R0LBT4)

There was apparently as much anguish between rival groups (Roman Catholics vs. reformists) about cinchona bark (from which quinine was first extracted) in days gone by as there is today between Democrats and Republicans on the use of quinine's descendents, the sythetic drugs known as (hydroxy)chloroquines. It has been said that Oliver Cromwell's death of malaria in 1658 was a result of his refusal to take "Jesuit's bark" because of Protestant suspicion of anything associated with Roman Catholics. Similarly today, Democrats may choose to die refusing "the Trump cure" rather than accept the shame of admitting even the possibility that HCQ/CQ might actually work against Covid-19.

<comment><USER2> Wow, that is utterly fascinating, I might have to grab one of those books. It's not entirely surprising but I had not idea of all the history there. We really are doomed to repeat it.

> Similarly today, Democrats may choose to die refusing "the Trump cure" > rather than accept the shame of admitting even the possibility that HCQ/CQ > might actually work against Covid-19.

One of my biggest fears. Trump just latched on to any good news to try and rescue "the economy" but it just so happens it might turn out to be right. The longer they wait the worse the blowback and higher the death count. Swallow your pride and get more studies done on this! <he screamed into the void>

<comment><USER4> Problems that divide people politically and religiously have dominate man's history, often subsuming all topics of discussion and slowing the development of science. Note the reference to "the arrogance of sects [and] the hatred of the parties" in the following paper, titled

"Products of the Empire: Cinchona: a short history" (well worth reading) at:

[https://www.lib.cam.ac.uk/collections/departments/royal- comm...](https://www.lib.cam.ac.uk/collections/departments/royal-commonwealth- society/projects-exhibitions/products-empire-cinchona)

 _" Despite "the promptness of its effect and its infallibility" which "made it suspect for such a long time", according to Ignace Vincent Voullonne writing in the early 18th century, cinchona bark "finally triumphed over the multiple reproaches that were heaped upon it … by ignorance, prejudice, the arrogance of sects [and] the hatred of the parties." The use of this "Popish powder" had elicited considerable religious prejudice because of its association with the Jesuits. As demand grew, however, lack of experience of the bark, uneven consignments, incorrect identification, and the frequent and deliberate pollution of the product by adding the bark of other trees, all ensured the argument over its value was kept alive well into the 19th century."_

Does anyone else see significant parallels to today's discussions of what should be done, what is best, who is in charge, who supplies what, etc. in regard to Covid-19 and it's potential cures and treatments? One might think we have made little progress as a society in the intervening centuries!</comment></comment></comment></comment></comment></comment>


Show HN: Vectr – Tracking and reporting for information security activities - <AUTHOR> https://github.com/SecurityRiskAdvisors/VECTR <comment><AUTHOR> I work on the team developing VECTR at Security Risk Advisors. VECTR is a tracking and reporting tool for information security testing activities. It supports MITRE ATTACK Framework methodology plus additional industry metrics. From the heatmap to historical trending users have access to different views for analyzing the results of testing activities. The intended audience is mature organizations performing or contracting regular red team or purple team activities. However, it's flexible enough to work for smaller teams just getting started. I believe anyone seeking to measure their organization's defensive response over time can benefit from VECTR.

We have documentation here [https://docs.vectr.io/](https://docs.vectr.io/)</comment>


Jim Mattis: Duty, Democracy and the Threat of Tribalism - <AUTHOR> https://www.wsj.com/articles/jim-mattis-duty-democracy-and-the-threat-of-tribalism-11566984601?mod=rsswn <comment><AUTHOR> The text is also up on MSN without the paywall [https://www.msn.com/en- us/news/opinion/jim-mattis-duty-democ...](https://www.msn.com/en- us/news/opinion/jim-mattis-duty-democracy-and-the-threat-of-tribalism/ar- AAGrBMW)</comment>


Is Privacy Real?The CIA Is Jeopardizing America's Digital Security,Experts Warn - <AUTHOR> http://www.ibtimes.com/privacy-real-cia-jeopardizing-americas-digital-security-experts-warn-2514062 <comment><USER2> > The C.I.A.'s lack of a heads-up to corporations impacted by the exploits...

I am having some trouble understanding this. They don't just stumble across vulnerabilities by accident, they either purchase them or specifically look for them in a device's firmware, in order to implant the device of an intelligence target.

The article seems to indicate that CIA should be reporting vulnerabilities instead of using them. It does not address the fact that, with such a policy in place, there would no longer be a reason for them to spend time/cash seeking these vulnerabilities.

I am very interested in understanding a reasonable counterpoint to this.

<comment><USER3>
      It does not address the fact that, with such a policy in
      place, there would no longer be a reason for them to spend
      time/cash seeking these vulnerabilities.

If you are not looking for vulnerabilities then others will do and find them.</comment></comment>


Presto: An excellent way to quickly poll teams - <AUTHOR> https://presto.blackbookhr.com/

<comment><AUTHOR> By the way, it's free, so sign up and use it.</comment>