Self hosted C – breakdown - <AUTHOR> http://achacompilers.blogspot.com/2015/12/self-hosted-c-breakdown.html <comment><USER2> It's always great to see more people writing their own compilers - a "proof by example" that compilers do _not_ have to be magical and mysterious special software that only few experts can write. The theory may be deep, but in practice getting a basic working compiler doesn't require all that much.

I notice you're using a recursive-descent parser, which I think is a good idea because it can actually reduce complexity over one made with parser- generators; in fact it's simple enough that even beginners who have just grasped recursion should be able to understand and write one. Once you have a basic parser that can evaluate arithmetic expressions, extending that to generating AST nodes and parse a (mostly) simple language like C is not so difficult. If I remember correctly, at least one college has an expression evaluator as a first-year CS assignment related to recursion. It's interesting that one of the sections of K&R, on reading and writing C declarations, even contains a simple parser for them --- I'm not aware of any introductory books for other languages which contain small pieces of their implementation.

That said, you can use the "precedence climbing" technique[1] to collapse many of the recursive functions for most of the expression operators into one function with a succinct loop and a table, making your parser even simpler and faster. C4[2] is an example of this technique but with a series of if-else in the body of the function instead of a table, and I think is worth some careful study just for its _mindblowingly awesome ridiculous simplicity_.

[1] [https://www.engr.mun.ca/~theo/Misc/exp_parsing.htm#climbing](https://www.engr.mun.ca/~theo/Misc/exp_parsing.htm#climbing)

[2] [https://news.ycombinator.com/item?id=8558822](https://news.ycombinator.com/item?id=8558822)

<comment> david-given C is notoriously painful to parse with a parser generator because it's not context free --- consider this statement:

        foo * bar;

It can't be parsed until you know whether foo is a type or a variable --- indeed, depending on the implementation, it can't even be tokenised correctly. So you need hooks from the symbol table back into the tokeniser/parser. I'm not at all surprised that the author's using a hand-written parser, as it reduces the problem space considerably.

(There's a really good article which I've been trying to find which goes into details about all the weird parsing edge cases due to the rules about exactly when a word goes into the symbol table which I've been completely unable to find...)

<comment><USER3> As far as I know C _is_ context-free. If C's grammar is ambiguous, that just makes it an ambiguous context-free grammar [1].

[1]: [https://en.wikipedia.org/wiki/Ambiguous_grammar](https://en.wikipedia.org/wiki/Ambiguous_grammar)

<comment><USER4> The context-free terminology doesn't apply to C because the ambiguity rests in not knowing what is the _lexical_ category of foo in "foo * bar". That information comes from semantics.

A language whose semantics you have to understand to understand its syntax is outside of the entire formal language realm inside which we formally recognize a "context-free" category. That formal language realm is purely syntactic: the terminal symbols are just "dumb" and stand for themselves. They are subject to rules which indicate how those symbols are combined.

C is "quasi context free" in that if we resolve what the raw tokens mean (which one is a type and which one isn't), then the resulting language is context-free. In fact stronger than context free: amenable not only to LALR(1) parsing approaches but to recursive descent, with a suitable refactoring of the left-recursive rules given in the standard.

<comment><USER3> Your post doesn't really agree with what I was taught.

> the ambiguity rests in not knowing what is the lexical category of foo in > "foo * bar".

Right, so there are 2 possible parse trees. Being able to disambiguate them with more information doesn't mean it's not context-free. Given just a CFG, you were still able to determine that you have a syntactically valid C program.

> A language whose semantics you have to understand to understand its syntax > is outside of the entire formal language realm inside which we formally > recognize a "context-free" category.

A formal language is just the set of strings that belong to it. That's it. An absurd example might be "the set of strings corresponding to valid C programs that do not terminate". To recognize such a language, you would not only have to understand the semantics of C, you would even need to solve the halting problem, but that doesn't make it "outside of the entire formal language realm".

<comment><USER4> > _Right, so there are 2 possible parse trees._

Not with the same symbols, though.

> _A formal language is just the set of strings that belong to it. That 's > it._

That is correct, and in that framework, we cannot reason about the meaning of "foo"; that if it's a type apply this rule otherwise that rule.

If we do that reasoning, what we're really doing is replacing "foo" with one of two other symbols, and then parsing those; then we have different _strings_ (so of course the parse trees cannot be the same, no matter what).

<comment><USER3> We don't need to decide to apply this rule sometimes but other times that rule. When we come to an ambiguous string, we apply both rules nondeterministically. Here's a pseudo-grammar that I think describes both possibilities.

      Statement -> Type Op Var ";"
      Statement -> Var Op Var ";"
      Op -> "*"

I think the disconnect here is that most lexers would insist on feeding a different token to the parser depending on whether "foo" is a Type or a Var, and choosing one or the other means the lexer might feed it bad information. The pragmatic way to implement this in a real compiler is to add some logic to the lexer so that it's working with more information than just the syntax. Theoretically though, all that really matters is that both possibilities are syntactically valid. So another way to implement it would be to pass on both possibilities, letting the parser eliminate the one that doesn't compile.

<comment><USER4> Indeed. There is a rule that Type generates Identifier, which can generate an example like foo. Likewise, Var generates Identifier, which generates foo. But these generations are not purely grammar rules; Type can only generate foo if there exists a declaration in the semantic space. If we regard it as purely a grammar rule, then we have a straightforward ambiguity in a context-free language. It is context-free simply because the rules are all of the form one_sym -> zero_or_more_syms.

If C were parsed this way, nondeterministically, ultimately the ambiguity would be resolved by looking up the type info anyway. (The interesting possibility exists, though, that in some cases the type info could be inferred, based on how the declared identifier is used.)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Can somebody point me at some introductionary material (or approachable code base) to writing an _optimizing_ compiler?

There seem to be a lot of very good tutorials on writing a simple compiler, like [http://scheme2006.cs.uchicago.edu/11-ghuloum.pdf](http://scheme2006.cs.uchicago.edu/11-ghuloum.pdf) [http://compilers.iecc.com/crenshaw/](http://compilers.iecc.com/crenshaw/)

There are also readable code bases like tinyc or this one.

However these always use a simple template based approach to code generation and stop there.

Of course there are real world compiler (lvm, gcc, ...). However because of their size and complexity it's hard to learn from them.

What I am interested in would be going from: "I have an AST and for this node type I output this assembly." to "I translate the AST to an IR. Transform an the IR in multiple passes and finally output decent asm."

That is, something that talks about CFG analysis, register scheduling or maybe SSA form? I have read papers on SSA and Sea-of-Nodes IRs, but these of course always assume that you know how and why to use them. A more approachable text/github-repo that shows how to take the step from template base code gen to more advanced techniques would be great.

(I hope it is ok to ask this here. Did not want to hijack the thread.)

<comment><USER6> This one is very readable: [http://www.amazon.com/Engineering-Compiler-Second- Edition-Co...](http://www.amazon.com/Engineering-Compiler-Second-Edition- Cooper/dp/012088478X).

Corresponding lecture notes: [https://www.clear.rice.edu/comp412/Lectures](https://www.clear.rice.edu/comp412/Lectures).

<comment><USER5> The slides look great. Thanks a lot.

</comment></comment></comment><comment><USER7> Thanks for providing the links that compare your for loop parser to existing implementations, it's interesting:

\- Gcc is unreadable;

\- Clang is "advanced", but not readable;

\- yours and tcc are clean... But you know it's always a risk to compare yourself to Fabrice Bellard :)

<comment> david-given Just to continue the catalogue:

pcc is simple, but very old school and a bit contorted.

libfirm is small and clean and generates excellent code. (Despite the name, it's a complete ANSI C compiler, as well as being a LLVM-light.)

The ACK is easy to port and is a complete standalone toolchain including compilers, assemblers and linkers, but (at least on modern processors) produces code so bad that it will make you want to stab yourself in the eyes to make the pain go away.

There's a look-but-don't-touch licensed compiler called vbcc which is by far the best C compiler I've ever seen; small, easy to understand, easy to port, and produces excellent code... but the author doesn't want to release it under an open source license.

Any others?

<comment><AUTHOR> libfirm doesn't really classify as small to me, it is currently 132,638 lines of code. The cparser alone is 11k lines of code (5 times the size of my c parser).

<comment><USER8> Does your cparser cover the entire c spec?

<comment><AUTHOR> Not currently, but it covers probably more than 80 percent. Part of the problem is support gcc extensions which take some more work.

<comment><USER2> The GCC extensions are just that - they're not part of the standard. You can claim 100% standards conformance without implementing a single one of them.

That said, in practice a large amount of C code out there is not pure standard C so if you want to be able to compile something "interesting" like e.g. a Linux kernel you'll need to implement some.

</comment></comment></comment></comment></comment></comment><comment><USER9> It's cute how he compares his "for loop parser" that handles C for-loops with Clang's, that handles C++ stuff including range loops - to show how his code is simpler :) Silly silly Clang developers for making their code too complex!

<comment><AUTHOR> You felt the need to make this comment and that shows you don't have confidence average people will be able to work that out just from looking at the code, which was my point all along.

Of course I know clang handles more, it is also designed as a library for other tools. The fact that clang mixes C and C++ parsing is not a merit, more like a necessary evil. This doesn't contradict my point on code clarity at all.

</comment></comment><comment><USER10> Holub's 'Compiler Design in C' is out of print, so he gives it away for free: www.holub.com/software/compilerDesignInC.pdf

Probably not exactly what you're asking for, but hey, free book.

</comment><comment><USER4> > _It gives me a funny sense of pride that my compiler can now be used to > improve itself._

Only with difficulty, because your compiler is written in a language that is poorly suited for writing compilers.

How about using nice high level language whose implementation is partially written in C to write a C compiler _in_ that nice high level language which then compiles that partially-written-in-C component of the implementation of that high level language.

<comment><AUTHOR> You would be surprised how the logic for a c compiler is pretty densely compressed, even in C code. You don't actually gain too much by switching to haskell or ocaml (I have done experiments).</comment></comment>


Show HN: Hvr, a Social Browser - <AUTHOR> https://hvr.world/?referrerId=58 <comment><AUTHOR> Post directly on a page for the rest of the community to see. Share privately or publicly, reply, like, mention your friends, hashstag your interests.

Mobile app built in Flutter, backend with python+postgres+redis

Your public posts get showcased on a board like this: [https://prod.hvr.world/profile?referrerId=58&u=Andreud&inten...](https://prod.hvr.world/profile?referrerId=58&u=Andreud&intent=https://pubhvr.page.link/MsK1LQagUydWtxkv7&event=shareProfile&userId=58)

</comment><comment><USER2> What's the business model for this product? Although I like the idea of social browsing, I'm extremely hesitant to give a closed-source product full access to my browsing history out of fear that my data will be sold or handled carelessly.

<comment><AUTHOR> Eventually ads but, as the head of tech of this venture, we have no plans to sell browsing history. Also, we've taken care to never expose your email address. Deleting a post genuinely deletes the data from our database, unless the post has been reported as violating standards. What other privacy concerns would you like to see addressed?

</comment></comment><comment><USER3> Reminds me a lot of StumbleUpon from back in the day.

<comment><AUTHOR> I'll take that as a compliment! Thanks.

<comment><USER3> It's certainly not an insult, more of an everything old is new again type thing.

Universal commenting has always made a lot of sense to me. As applied to casual web-surfing, the concept reminds me of the logbooks I used to see hiking the Trail and whatnot. They get a little noisy after awhile would be my one comment.</comment></comment></comment>


Selling my online project, and why you should too - <AUTHOR> http://blog.ralxz.com/post/36981367089/selling-my-online-project-and-why-you-should-too

<comment><USER2> Literally listening to it right now. That's awesome. Good luck with the sale!

<comment><USER2> #AngelHackPaloAlto</comment></comment>


Ask HN: How to run anonymous services? - <AUTHOR> Recently we've built anonymous service for tracking and reporting petty bribery around the world [Web http://bribespot.com , Android http://bit.ly/11dCsIh ].
Our contributors mostly come from developing countries, and since law-enforcement agencies in some of those countries are corrupt, we designed our service to provide maximum anonymity for our contributors, e.g. no personal details are collected and no open IP logging taking place (IP addresses associated with submissions are stored in the DB in an encrypted format).
The problem is that anonymity opens the door to all sorts of nasty surprises - from spam and abuse to fake reports and blackmail campaigns.
How are you guys coping with problems that arise from running anonymous services? Anyone wants to share their experience? <comment><USER3> You might look to something like the silkroad for a case study; the guy(?) who runs that site is pretty active on the forums and would likely give you some time if he agreed with your mission (he has a strong anarcho leaning, I suspect he would, in this case).

Spam can be relatively easily avoided with some captchas; but I don't know how you can avoid fake reports; or how being anonymous even helps or hinders the likliehood that reports would be fake.

I agree with other posters that recommending, teaching, or even requiring them to use Tor is a good idea. tormail for example is reachable from the clearnet, but to actually use their _service_ you are required to connect to their hidden service, which has the added benefit that they are basically impossible to shut down; even if they get your clearnet server (which really just has instructions and metainfo on it); the actual server doing the work is nearly impossible to find, and if it is found but the key is kept safe you can just pop it up again.

It's worth considering protecting not only your clients but your selves; running as a Tor hidden service can go a long way toward this.

</comment><comment><USER4> For a start, you could remove the 6 or so 3rd party scripts from the homepage that record IP address and other personally identifiable information. The social media scripts may be useful for spreading word of mouth but unfavorable to true anonymity.

<comment><AUTHOR> thanks for a tip. we'll do that.

</comment></comment><comment><USER5> While it doesn't directly answer your question, keep in mind the best thing you can do for maintaining your client's security is teaching them to use Tor. Nothing server-side will protect them because you may make mistakes, you may be compromised, or they may be MITMed.

</comment><comment><USER6> Why do you log ip addresses at all? What happens when you get a subpoena, you have to turn it all over, right? Wouldn't it be safer not to store that info at all?

</comment><comment><USER7> Protect your sources by all means necessary if you want to built trust, the technology is in place to do this, the legal footing on the other hand can be tricky. You should host your servers in a country that has a solid legal framework in place to protect your data, Iceland for example. Honestly consult a lawyer who specializes in this, it is a legal issue and not a tech one.

The real problem is vetting your material, you will need to analyse and verify submissions before posting using _real people_ , there is really no alternative when lives are at stake. This is the reason wikileaks collaborates with researchers and journalists, and there is an entire approval process. I must stress this point, you MUST have due diligence on your sources or else don't even bother.

Also keep in mind that several countries make anonymous services very difficult to use and even so they still might be monitored, you need to enable multiple avenues of submission and do a really good job at informing your user base on which is best.

You should have a very solid and dynamic server setup that can withstand attacks/DDos and domain name/ISP related takedowns.

tl;dr Learn from all the issues wikileaks had with tech and submissions and how they overcame these challenges.

<comment><USER8> The problem is that you can't really "vet" stuff like "Official Mr. XYZ demanded payment of US$ 20 so that I can get the permit faster".

Vetting a leak is easy. Vetting an accusation of bribery is next to impossible unless you're an undercover policeman and catch the bribed person red-handed (or, the building/exchange place is under CCTV surveillance).

<comment><USER9> The point is to identify officials who would do it ordinarily: his service can respond that no one else has mentioned that official, and encourage their users to ask a friend to testify too. More than establish a proof that could be legally binding for local institutions (a long shot) it will encourage people to consider how many friends are influenced, and would be ready to do something. Just talking about filling in a form, no matter how empty that process can be, sets them in a changing path. What the original comment was pointing out is to set up process to avoid adversaries of his service to discredit him by posting fake accusation, and 'showing' how wrong his service is; 'vetting' it indeed hard, but you don't need hard proof to fight endemic corruption.

</comment></comment></comment><comment><USER10> > no open IP logging taking place (IP addresses associated with submissions > are stored in the DB in an encrypted format).

Given how small the IP space is, does that actually add anything?

<comment><USER11> With a random IV and CBC, is it actually not secure? Assuming you have the encrypted entries, and can even create more on-demand, what can you do besides brute force the key? Plus, almost any 4-byte result is a valid result.

<comment><USER10> I'm not sure, but OP didn't mention using random IVs or CBC.

</comment></comment></comment><comment><USER12> Try instituting an expiration policy on your logs. Have addresses expire after some set amount of time. It might be a few hours, days, or weeks - <USER2> you determine to be the necessary time to prevent abuse.

</comment><comment><AUTHOR> Regarding the IP addresses, we use bcrypt algorithm, obviously with salt, to obfuscate IPs and since we're hosted in Germany, gettings hands on these entries the legal way is a long process.

To address the problem of spam, we have already implemented a combination of selective captchas and Akismet filter running in the background.

We also use name entity extraction algorithm to obfuscate any names we identify in the submitted reports. It takes a couple of minutes and is not 100% proof, but at least reduces the risk of names being called.

The major problem that we are thinking about, however, is how do we structure the "vetting", given that reports are sometimes hard to verify without first hand knowledge of situation.

So far we tried to analyze how one goes about these things in real life and recreate natural constraints in the virtual space. The fact that we require every report to be geo-tagged works to our advantage in this situation.

As a practical example, ordinary people usually do not have access to president's palace, so if someone claims to be paying a petty bribe there, it is obviously a fake and we would automatically suspend such report.

</comment><comment><USER13> The real way to solve this problem is to make it distributed so that everyone can contribute and anyone can read all of the posts from a single node. Then there is no single way to get a list of IP addresses

<comment><USER14> There is network called Freenet just for this purpose.

</comment></comment><comment><USER8> When you're dealing with bribery, you can't prevent blackmailing/fake reports at all.

What you can do, though, is to provide HTTP, HTTPS and TOR access to your webservice to allow everyone to submit stuff at his/her own security choice.

If possible, change your IP address(es) and domain names on random intervals; you can use free domains like .de.vu and friends to have reliable "entry points" (an example is canna.cu.to).

If you have an android app anyway, try building a "distributed" service like BitTorrent or Bitcoin for information exchange.

<comment><AUTHOR> Having spent some time interviewing typical users I can say that this would work only if we put the distributed service bits under the hood, while leaving service with all the trappings of a normal website.

Regular users often times find it difficult to use regular apps, not to mention things like TOR access. And since we want as many users as possible being able to use it, we cannot just waive them off saying "go learn Internet" :)

</comment></comment><comment><USER15> It seems to me, that for your particular problem domain, the solution is simply to be hosted in a country that is unlikely to serve you a subpeona for the kind of information you're dealing with - ie. most western European countries and the US. Iceland seems to be on a data protection binge lately. You "no names" policy further protects you in this regard.

</comment><comment><USER16> Here is some tutorial about how to run Tor's Onion hidden service inside Linux VPS: [http://torforum.org/viewtopic.php?f=5&t=18268](http://torforum.org/viewtopic.php?f=5&t=18268)

Both you and your visitors will always stay anonymous. Not your hoster nor their ISP's will never have a chance to reveal someones identity.

</comment><comment><USER17> Possibly relevant. I wrote this few months ago regarding some of the challenges with crowdsourcing crime reporting in the Mexican Drug War: [http://readwrite.com/2012/08/14/the-problem-with- crowdsourci...](http://readwrite.com/2012/08/14/the-problem-with- crowdsourcing-crime-reporting-in-the-mexican-drug-war)</comment>


Android-Powered Lego Robot Solves Rubik's Cube in 12.5 Second - <AUTHOR> http://www.extremetech.com/article2/0,2845,2372596,00.asp

<comment><USER2> For my undergrad robotics project I created a lego robot which played blackjack - you fed it a card and it moved a light sensor over all possible 'pip' positions on the card to determine which card it was given, then it twisted until it reached a total of over 17. I wish I'd taken videos of it.

</comment><comment><USER3> What a beauty, That is true computer science</comment>


Minecraft Creator Notch Says EA is Destroying Gaming  - <AUTHOR> http://www.tomshardware.com/news/Mojang-Notch-EA-Indie-Minecraft,15546.html#xtor=RSS-998

<comment><USER2> Destroying according to who? The "Indie" gaming community, of which Notch is a part? EA has been getting even more flak recently with their "Indie" bundle.

All the flak is irrelevant. People will pick with their wallets. If EA is destroying "gaming", then "gamers" sure don't seem to care all that much. They definitely like what EA is peddling to them.</comment>


Young 'to be poorer than parents at every stage of life' - <AUTHOR> http://www.bbc.com/news/business-34858997 <comment><USER2> This is interesting to me because (as a 30 year old) it never occurred to me that I would be more prosperous than my parents. I'd _like_ to be, of course, but it seems alien to me that there was an era where that was all but guaranteed. It doesn't matter, except that it explains where a lot of this older generation's resentment of "the youth" comes from - they haven't faced the situation we face, so the only way they can make sense of us not succeeding is that we're simply not trying. When that generation is a large voting bloc, that poses a problem.

(That said, I suspect most of us HN readers will _not_ be poorer than their parents. Tech is an area of boom in an economy of bust, after all, so factor that in when reading responses on here)

<comment><USER3> I'm 40 and way poorer than my babyboomer parents. My savings got wiped out in a housing market crash in 2008, they have made over half a million euro in their lives just from their houses becoming worth more over time.

They've also both had work most of their adult life, and their pensions funds have always done well on the stock market, whereas my wife has been without a job since the financial crisis hit and government in the Netherlands went in austerity mode.

<comment><USER4> Similar story here. I cashed out a lot of stocks to make a down payment on a house. Then I had to move to a different city to find work, and lost _everything I ever put into the house_. I timed the market just right to lose everything, because my other options were to lose more than that.

I have had more employers in 15 years of work than both of my parents accumulated over a combined total of nearly 80 years. I have never, ever been promoted within the same company, but I have been summarily tossed to the curb for no individually-attributable reason--along with several of my office-mates --a total of four times.

I have a lot of envy for what the Baby Boomer generation already got, and in combination with the condescending attitude they have (in aggregate) towards the younger generations, it fuels a lot of resentment.

Their formula of education plus hard work equals success has not been even remotely accurate for me. Education plus hard work equals screw you, buddy, because I already got mine. Enjoy your layoffs and unaffordable housing and tuition increases well in excess of inflation and slashed employer-granted benefits and mountains of political debt, because your parents have decided to sell their house at 20x what they paid for it, buy a plush RV, and split their well-funded retirement between any convenient US state and Snowbirdland, Mexico.

And what really kills me is that I have never seen anyone from my parents' generation working particularly hard. Maybe they did all that before I was born, and just coasted along afterward? Maybe I don't really know what hard work looks like?

Well, anyway, thanks for all the inter-generational tension, Boomers. We'll air it out by having Thanksgiving dinner at your house again this year, because none of your kids can afford homes big enough to hold everyone.

<comment><USER5> Genuine question: why not rent out the house whilst you were in the other city? That would have probably covered the mortgage and got you out of the dip until you could either move back, or the market had picked up again and you could sell without loss.

</comment></comment></comment></comment><comment><USER6> What do they mean by "to be poorer"? The current generation already _is_ poorer than previous generations. Income has not kept up with inflation and the income gap has widened tremendously. That previous generations could afford a single-family house with 1 person working and with multiple kids. Now, a double income is almost required, even with renting and not owning, and the rate of couples without children is rising too.

How can anyone be surprised that a candidate who decries all these things is having such success? Everyone in the newer generations know that they're getting the short stick and that we gave it to them. Bernie Sanders is just pointing out the obvious.

[http://www.dol.gov/wb/factsheets/Qf- ESWM07.htm](http://www.dol.gov/wb/factsheets/Qf-ESWM07.htm) [http://www.bls.gov/news.release/famee.nr0.htm](http://www.bls.gov/news.release/famee.nr0.htm)

<comment><USER7> With two programmer incomes we can't buy a home 35 miles away from Boston. So pathetic.

<comment><USER6> Sadly it's not surprising. As it was said once on The Wire, "We used to make things in this country, build things. Now we just put our hand in the next guy's pocket." That's the economy that the previous generations left us and that we're perpetuating for our children.

<comment><USER8> I feel like there is a lot of context lost in this quote without pointing out that it's being said by a union dock worker to a lobbyist he has been paying to bribe politicians with money earned from smuggling prostitutes and heroin into Baltimore for an international crime syndicate.

<comment><USER6> I agree. The irony of that statement was huge. But it also brings it back to a "chicken or the egg" scenario. That's what I didn't really want to get into. Is the dock worker's union struggling because he's been paying the lobbyists or are they struggling because everyone else was?

</comment></comment></comment></comment></comment><comment><USER9> The article mentions pensions at the end... what's a pension?

Joking aside, I haven't seen outward bitterness regarding their poor lot from the current young generation so much as doubling-down on the rat race in an attempt to still top their parents somehow. It's pretty bad for their mental health, and not very effective so far, but may pay off in the long run.

<comment><USER10> A pension is something companies used to provide to their employees. Employees used to be able to stay their entire career with one company and amass a pretty decent retirement pension with said company.

Then Wall Street got corrupt. They demanded ever more from companies. Each quarter had to show more profit from the last otherwise they punished the company. Wall Street found ways of funneling any profits directly to investors instead of investing in the company (and, more importantly, it's employees). Pensions took a hit. Companies stopped offering them. Some companies 'borrowed' from pensions and lost it all. The employees did suffer. Employee loyalty dropped. Companies took that as an opportunity to treat employees as temporary; replacing them regularly with cheaper ones.

You'll have to wait until tomorrow night to hear the rest of the story. G'Night.

<comment><USER11> This is a BBC article and in the UK, pensions are still very much alive.

We receive a state pension at retirement that is dependent on national insurance contributions over the course of your working life.

You can also contribute to (and have recently probably been automatically opted into) private workplace pensions that your employer will probably match (up to a point).

<comment><USER12> This is true in the US, where the state pension is called social security. Except that conservatives have somehow rebranded this "entitlement" (to which you are entitled because you pay contributions over your working life) to something whiny "entitled" workers are unfairly demanding from the government.

</comment></comment></comment></comment><comment><USER13> How does one define poorer?

If you were given the choice to go back in time and live in your parents generation INSTEAD of the present, your life expectancy is lower, you dont have the Internet for information.

Overseas Phone Calls were a luxury back then, so was airplane travel. It seems to me inn absolute terms, the vast majority is better off vs if they were the same age in the 1980's

<comment> rm_-rf_slash I think a lot of us would trade long distance calling and Internet access for the ability to go to college without being indebted for life, find a job that didn't make you work at home after hours or on the weekends, and be able to afford a house to maintain and leave for their children.

Being able to afford a new iPhone every other year is not prosperity.

<comment><USER14> Obviously just one anecdote but my parents both had work/on-call in the evenings and weekends, always had a substantial mortgage on the house which they had to sell when they split up. I will get zero inheritance. They are both college educated, smart, hard working people. I made more at 20 years old, then they both made put together at that same time.

<comment><USER15> I grew up on a farm, limited income but lots of personal freedom. Six of us kids: 5 Engineers and a Nurse. After 1000 generations of dirt farmers, it was a good change. No inheritance except the opportunity to personally succeed. Folks like us were launched by their parents.

But there are others who stayed about where they started (or rather their parents) who can't see much improvement in the last 20 years.

<comment><USER16> When (if) you retire, that farmland will probably be worth more than your income over your entire career.

<comment><USER15> Very likely. The $40,000 acreage next to me just sold for $400,000. That would make mine worth $1M right now!

</comment></comment></comment></comment></comment></comment><comment><USER17> My grandfather was a carpenter working in a factory that made piano benches. He worked there his entire career.

He was in his early fifties when he retired and was actually retired longer than he worked in terms of time, and when he died he still had 6 digits in assets (not including his house.) He didn't do anything special except live modestly, save, and buy stocks.

Who can say they'll have the same experience working a blue collar job today?

<comment><USER18> I think as a rule of thumb anybody working a blue collar job today is in trouble.

</comment></comment><comment><USER19> It's probably related to the relative maturity of an economy.

In a growing economy, the odds of offspring doing better than parents is a function of the economy as many new avenues to prosperity open up. On the one hand is China where children have more opportunity than parents, on the other hand is Japan, a mature economy where growth has plateaued so there aren't massive opportunities for newer generations.

Also, after a certain level of achievement, there isn't much more to be had. So the progress would be incremental, on average, rather than tectonic, after the plateauing.

In other words, it's not expected that in large diversified economies there is the possibility for everyone to become a magnate.

</comment><comment><USER20> The caveat is that it's only true in certain developed nations. Maybe real life proof that free trade is not Pareto optimal.

<comment><USER21> How do you reach that conclusion? Doesn't it seem more likely, that rapidly expanding population in the face of scarce resources leaves a decreasing share of a smaller pie for the newcomers?

<comment><USER22> If the problem is that the pie is smaller, shouldn't we see how the GDP per capita goes down?

[https://www.google.fr/publicdata/explore?ds=d5bncppjof8f9_&m...](https://www.google.fr/publicdata/explore?ds=d5bncppjof8f9_&met_y=ny_gdp_pcap_cd&idim=country:USA:GBR:CAN&hl=en&dl=en)

</comment></comment></comment><comment><USER23> I make more than my parents combined ever did, even if you count for inflation. Though they seemed to have a higher quality of life. I suspect this has to do with other factors, mostly my own short commings.

<comment><USER24> People eat out quite a bit more than their parents did. This is probably the single biggest cost difference between this generation and their parents. $20 a plate at Applebees versus $3 a plate at home.

<comment><USER25> Factor in time spent cooking. $3 a plate would either mean cooking up a large batch or eating mac&cheese. You couldn't drag me into an Applebees...

<comment><USER26> But what do you do with the time if you don't cook? Do you sit in front of the TV, searching for something worth watching so that you're not bored? If so, then taking the time to cook is free, because you're essentially valuing your time at zero.

<comment><USER24> You sit at a table waiting an hour for your food to arrive. I cook a majority of the meals for my family, and they are healthy, cheap, and never take me more than 30 minutes, and most of that is waiting for water to boil or stirring something occasionally.

</comment></comment></comment></comment></comment><comment><USER27> Here's a post with some actual charts and numbers: [http://www.forbes.com/sites/ashleaebeling/2013/03/15/gen- x-a...](http://www.forbes.com/sites/ashleaebeling/2013/03/15/gen-x-and-gen-y- wealth-stagnates/). The conclusions looks like:

1) People in the age range 29-37 (cherry-picked?) are less wealthy than the previous generation. The Great Recession explains a lot of the difference.

2) All other age groups are wealthier than the previous generation, but the gain is much smaller than it has been in the past.

</comment><comment><USER28> this is so dependent on the macro economy in which you live, its almost completely independent of you

[http://www.theatlantic.com/photo/2013/08/26-years-of- growth-...](http://www.theatlantic.com/photo/2013/08/26-years-of-growth- shanghai-then-and-now/100569/)

can you imagine having been a 10 year old in Shanghai in 1987?

</comment><comment><USER13> Just a quick informal poll if its allowed.

For users/people who think you are "worse off" vs back then, could you let us know which country you are in?

For users who grew up in Asia/developing countries, I would think the young nowadays have a lot more opportunities/chances to strike it rich.

What seems to be occurring at this stage = there used to be a income/price discrepancy for work done, solely because most work had to be performed by locals. The main change now is a lot more of this work can be given/outsourced to employees who have lower wages in developing countries.

It would be interesting to see the results of the poll.

<comment><USER29> Ireland here. Peaked maybe two or three decades later than the US did, but yes, my countrymen seem determined to import all the systemic corruption and waste and follow the Americans on their downward spiral, so unless that changes, we are now at the stage where each generation is fewer and in real terms poorer than the last.

</comment></comment><comment><USER30> Makes sense. More people fighting over the same finite amount of resources, leads to less per person.

Eventually, no matter how imaginary money is, it's used to buy non-imaginary resources.

<comment><USER31> That makes no sense. Resources are fixed but incomes have grow by what? 5 fold in the last 100 years? Lots more people now than then!

<comment><USER30> In the last 100 years, the advance of science and technology has enabled us to make better use of those resources, making people wealthier. Population growth seems to be catching up with the advance now, leaving less resources per capita.

Or maybe it's just slower times before the next big breakthrough. Infinite energy from fusion, and AI doing all our work would certainly allow us to truly fill up the world.

</comment></comment></comment><comment><USER32> Houses are bigger, cars are safer, faster and more efficient, medicines are more prevalent, entertainment options have increased incalculably.

I guess I don't feel poorer.

</comment><comment><USER33> The Great Intergenerational War has been a one-way fight thus far.

How do you do, fellow kids?

[https://media4.giphy.com/media/ifxLK48cnyDDi/200_s.gif](https://media4.giphy.com/media/ifxLK48cnyDDi/200_s.gif)

Gen X stands ready to assume out natural leadership position in the counterrevolution. Our cynicism coupled with your enthusiasm...

[https://www.youtube.com/watch?v=bBQVrCflZ_E](https://www.youtube.com/watch?v=bBQVrCflZ_E)</comment>


Ask HN: What automator scripts have you written to make your life easier? - <AUTHOR> <comment><USER2> Not sure what fits the bill here but I'm proud to have a Windows XP Minecraft server that starts on power-on and shuts down on /stop. Thanks, Batch.

Also not much of a script but in XMouse I've mapped my two side buttons on my Logitech M510 to: \- close and reopen tabs (Firefox/Chrome/Edge) \- undo/redo (image and video editing) \- the grenade and knife button (any FPS) \- back and next (file explorers) and a lot more.

</comment><comment><USER3> I mapped CMD-G to copy the full path of whatever I have highlighted in a finder window.

So if I am using the terminal and I want to give the full path to a file or folder I use this and then paste it into the finder.

<comment><USER2> Damn, that sounds really useful. Any source? :)

</comment></comment><comment><USER4> I made some autohotkey scripts to open/log in to VM's through putty. Instead of opening/logging in to 10+ windows I can just hit a few keys. I still think the workflow is a flawed one but it's good enough.

</comment><comment><USER5> I code a google apps script to send me a text message every time I receive an email from specific address.

</comment><comment><USER6> My PC cycles through the different symbols in my stock trading account.

It turns on at 7 am and turns off at 4:30.

All my applications launch and fill up the screens automatically using AHK.</comment>


OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f - <AUTHOR> https://www.openssl.org/news/secadv/20200421.txt <comment><USER2> > This issue was found by Bernd Edlinger and reported to OpenSSL on 7th April > 2020\. It was found using the new static analysis pass being implemented in > GCC, -fanalyzer.

2 week turnaround time, not bad I guess, for something found by a static analyzer.

</comment><comment><USER3> At least it's just DOS and not anything like heartbleed.

</comment><comment><USER4> What popular software contain these vulnerable versions of the OpenSSL library?

<comment><USER5> This is a good question. Also important to remember is that for many Linux distributions dynamically linked OpenSSL artifacts are what end up getting used by the vast majority of binaries.

<comment><USER6> Yeah, I was thinking by all of the binaries. I had forgotten that there's software that bundle it independently of the distro's library. Another comment mentioned docker images, and I've remembered that ruby also bundles it for its own use.

</comment></comment></comment><comment><USER7> Checking out packages.ubuntu.com, it looks like the only version impacted is "focal;" the other versions are too old.

<comment><USER8> Is there a reason why something as important as openssl is not being backported to keep up with the most recent versions?

<comment><USER9> Compatibility with other libraries and testing effort. You end up back porting everything.

Ubuntu backports the fixes them instead (i.e. Ubuntu's 1.0.2 will be patch with CVE fixes going forward instead of backporting 1.1 wholesale).

<comment><USER10> Also stability of APIs/ABIs: within a major Ubuntu/Debian version, there is an implicit contract in most cases that if you build something against a library/software provided by the distribution, it will not break after an upgrade of said library/software.

To enforce that, a policy of version freeze+backport of bug/security fixes is almost always necessary as very few upstream projects will maintain separate branches and have a clear policy about API/ABI breakages.

(OpenSSL is actually somewhat of an exception in that regard).

<comment><USER11> OpenSSL actually did a breaking API change as recent as 1.1.1e (reverted in 1.1.1f to be fair):

[https://bugs.python.org/issue40018](https://bugs.python.org/issue40018)

And broke the ABI in 1.0.2g:

[https://bugzilla.redhat.com/show_bug.cgi?id=1313509](https://bugzilla.redhat.com/show_bug.cgi?id=1313509)

I don't mean to bash on OpenSSL here and agree they generally do an exceptional job at keeping the public interface stable. Just offering some context. These things are difficult.

<comment><USER12> To be fair "these things are difficult" if your ABI is terribly designed.

If you've used modern libpng you can thank people like me for the fact you don't need to recompile or even sometimes rewrite code after every micro version release.

Example of something libpng did before we "gently" explained that it's stupid: re-order the public data structures in a "bug fix" release. Because the old order looked untidy see, and so long as every program is recompiled with the new version of the library it won't break...

</comment></comment></comment></comment></comment></comment><comment><USER13> Now I know why arch pushed a new version this afternoon.

</comment><comment><USER14> Is BoringSSL affected?

<comment><USER15> or LibreSSL?

<comment><USER16> No. LibreSSL fork predates the issue, and has its own TLS 1.3 implementation. I'd expect the situation to be similar with Google's BoringSSL, but I don't how closely they track OpenSSL, if at all.

</comment></comment></comment><comment><USER17> So how widely TLS 1.3 is

a) used

b) enabled in either client or server?

</comment><comment><USER4> OpenSSL vulnerabilities: The gift that keeps on giving.

<comment><USER18> I suppose so, but this bug only allows to crash the application. No doubt OpenSSL is buggy, but its problem is that a lot of applications depend on it as well.

I'm hoping it will eventually reach status of bind or sendmail, they had also very bad track record, but vulnerabilities now are quite rare.

<comment><USER4> The article says: "may crash due to a NULL pointer dereference". But in C, dereferencing a null pointer is undefined behavior. Crashing is only one possible outcome, and arguably the best outcome.

The compiler and optimizer is entitled to elide certain checks or simplify code under the assumption that a pointer being dereferenced should not be null, and this could lead to dangerous things.

Here's an artificial example:

      int x = 0;
      int *p;
      if (...some condition...)
          p = &x;
      else
          p = NULL;
      print(*p);

The compiler is allowed to simplify the code to:

      int x = 0;
      int *p;
      p = &x;
      print(*p);

It's because the 'else' branch must cause a null pointer dereference, so that case can be legally ignored.

<comment><USER18> I would imagine that if a compiler would be able to make this kind of optimization it would also be able to warn that this is an error. Also optimizers supposed to replace code with a simpler equivalent ones, in your example actually the if statement should block the optimization i.e. if there was no "if", the x would be used directly, and the pointer was ignored.

Here's the bug: [https://svnweb.freebsd.org/base/releng/12.1/crypto/openssl/s...](https://svnweb.freebsd.org/base/releng/12.1/crypto/openssl/ssl/t1_lib.c?r1=352546&r2=360150&pathrev=360150)

Value NULL is generally (void *)0 (could be different on different architectures, but it supposed to point to invalid value in memory, so when that memory address is accessed it will trigger segmentation fault.

</comment></comment></comment></comment><comment><USER19> This would primarily affect web servers exposing SSH access to the public right? I suppose it also affects internally accessible servers as well but to a lesser degree in terms of priority.

<comment><USER20> SSH != SSL. EDIT: Expect web servers running HTTPS in modern configurations to be affected, and other TLS based protocols. SSH is fine.

<comment> chupa-chups Both SSH and SSL base on TLS. The leak in question has a problem

> during or after a TLS 1.3 handshake

Sure, openSSL is not SSH, but it is not unreasonable to assume this leak may affect web servers as well (e.g. by being based on the same underlying TLS implementation).

"SSH != SSL" is a bit short to invalidate the assumption of the OP. I'd not be so sure this problem does not affect "web server X".

[https://en.wikipedia.org/wiki/Transport_Layer_Security](https://en.wikipedia.org/wiki/Transport_Layer_Security)

OK, learnt something new today: [https://crypto.stackexchange.com/questions/60255/why- doesnt-...](https://crypto.stackexchange.com/questions/60255/why-doesnt-ssh- use-tls)

[https://xkcd.com/1053/](https://xkcd.com/1053/)

Thanks! :)

<comment><USER21> > Both SSH and SSL base on TLS

No.

</comment></comment></comment></comment><comment><USER22> OpenSSL is the culprit of a MacPort installation issue (vde2) for which there is no maintainer. It exposes operational vulnerability to unmaintained open source software.

<comment><USER23> Just to make sure I understand - you're saying that because OpenSSL is under active maintenance and vde2 is not, OpenSSL is in the wrong?

If you want to use unmaintained software, you know OpenSSL 1.0 still exists in this world, right?

</comment></comment><comment><USER24> Sure, let's continue to reward incompetence by further funding openssl.

In a sane world, everybody would have switched to libressl ages ago.

<comment><USER25> The few who switched to LibreSSL actually switched back to OpenSSL (Alpine, HardenedBSD).

Void is considering switching back too: [https://github.com/void-linux/void- packages/issues/20935](https://github.com/void-linux/void- packages/issues/20935)

<comment><USER15> Their logic is a bit weird to me, I would definitely choose a fork from professional that re-write everything with a security perspective, over a bad library trying to be hardened .

<comment><USER26> The Void conundrum is that most software does not support LibreSSL's APIs, and that is especially rough because Void is rolling release. OpenBSD does not write patches for the latest Qt release, so people with little crypto experience have to write those patches.

<comment><USER16> Which is a bizarre statement, all ports development happens on the OpenBSD -current branch, which is effectively a rolling release for developers/users running snapshots.

All of those projects that switched were simply expecting LibreSSL/OpenBSD to upstream support, when it hasn't got nearly the same numbers of developers.

Also, there were other problems with updating Qt on OpenBSD, but that was resolved. It is maintained by a single developer.

[https://marc.info/?l=openbsd-ports- cvs&m=158411843726544&w=2](https://marc.info/?l=openbsd-ports- cvs&m=158411843726544&w=2)

<comment><USER26> >rolling release for developers/users running snapshots

Well Void is far more on edge than OpenBSD -current.

>there were other problems with updating Qt on OpenBSD, but that was resolved

They are still trailing us.

[https://github.com/void-linux/void- packages/pull/15310](https://github.com/void-linux/void-packages/pull/15310)</comment></comment></comment></comment></comment></comment>


Bank Of England To Monitor Social Networks - <AUTHOR> http://news.sky.com/story/1397985/bank-of-england-to-monitor-social-networks

<comment><USER2> Url changed from [http://www.engadget.com/2014/12/29/bank-of-england-social- ec...](http://www.engadget.com/2014/12/29/bank-of-england-social-economy/), which points to this.</comment>


iRedMail – Free, Open Source Email Server Solution - <AUTHOR> http://iredmail.org/

<comment><USER2> To provide some details that might not be immediately obvious, this is a piece of software that takes care of installing and setting up the various pieces one would use to run (in my opinion) the ideal mail system: Postfix, Dovecot, MySQL/PostgreSQL, OpenLDAP, spam filtering, webmail, etc.

All of the software is, of course, open-source/free software but the iRedMail- Pro "management" application is what you are paying for (there is also a free version w/ less features). You can certainly implement everything yourself from scratch without paying for it.

I'm not a customer and have not used it although I did look into it a while back. The few people I asked who had used it were satisfied with what they received for the price. YMMV.

</comment><comment><USER3> Note: someone claiming to be the developer of this project left a comment on this thread, but has a new account apparently spam: his comment is dead. (Always browse with showdead turned on.)

<comment><USER4> I'm not sure why it's dead, but here's the subject comment from user 'zhb:'

Interesting. I'm author of iRedMail project (Zhang Huangbin), and i'm a HN fan. :)

* iRedMail is a free, open source, mature, high quality mail server solution.

* It's under active development.

* We listen to our users, and respond quickly in our online support forum: [http://www.iredmail.org/forum/](http://www.iredmail.org/forum/)

Yes, it does make our customers satisfied.

<comment><USER5> Would you be able to start signing your packages? I realise it doesn't provide any real protection, but it would make me feel a little better.

<comment><USER6> Will try it later, but no promise. We will try to use all packages provided by upstream.

</comment></comment></comment></comment><comment><USER6> Interesting. I'm author of iRedMail project (Zhang Huangbin), and i'm a HN fan. :)

* iRedMail is a free, open source, mature, high quality mail server solution.

* It's under active development.

* We listen to our users, and respond quickly in our online support forum: [http://www.iredmail.org/forum/](http://www.iredmail.org/forum/)

Yes, it does make our customers satisfied.</comment>


Is a boat still a boat if it can't float? - <AUTHOR> http://ninjasandrobots.com/is-a-boat-a-boat-if-it-cant-float

<comment><USER2> These aren't much in the way of examples. Optical drives have been dropping in importance and 'memory slots' have never been important. Food and assigned seats have nothing to do with transport. A _lot_ of restaurants don't take reservations at all, compared to a system which is just transferable reservations.

A boat that doesn't float is an extreme change, because that is the primary purpose. Even if you largely use floating to get isolation.</comment>


Sell Yourself, Sell Your Work - <AUTHOR> https://www.solipsys.co.uk/new/SellYourselfSellYourWork.html?te20hn <comment><USER4> > ... it is not sufficient to do a job, you have to sell it. "Selling" to a > scientist is an awkward thing to do. It's very ugly; you shouldn't have to > do it. The world is supposed to be waiting, and when you do something great, > they should rush out and welcome it.

Took me very long to get this, and, if I'm being completely honest, I still struggle with it.

Being smart and humble is a pretty terrible combination. I met _so many_ brilliant people at UCLA and in my professional career that had this twinge of impostor syndrome. What ended up happening is their less-brilliant but much- louder colleagues always got the promotions and always got the funding.

<comment><USER5> It helps to reframe the issue. "Selling" yourself is distasteful for many, because it smacks not only of loudness & brashness, but of straight up lying.

Look at this instead as a problem of knowledge distribution. In the extreme case, you do absolutely brilliant work, but tell nobody - how would people in charge of promotions/funding _know_ you did that work?

That's the first step. You need to let people know your work exists, otherwise they really can't reward/recognize it. (Or really, in the extreme, you need to let them know _you_ exist as the very first precondition).

The next step is the fact that you are the person who has likely spent by far the most time on the problem. You intuitively understand why this is an incredibly important problem, and why the solution is really, really good. I guarantee you that the people around you don't. How would they? They've spent much less time on it than you have.

And so part 2 becomes educating others on the problem and on the solution.

So, no, you don't "sell" yourself. You publicize and educate. It's still incredibly hard, but it captures the core of what's actually necessary much better. There's no need to be loud & brash, to paint everything in the brightest possible colors, but there's a need to communicate.

If Einstein hadn't written a paper on special relativity, he would (obviously) not have been recognized for it. And if he hand't communicated his insights very clearly and crisply, he wouldn't have been recognized, either - <USER2> people before him spelled out some of the insights, but in a much less clear manner.

So, don't "sell", just let people clearly know what you do,and why you do it. Looking at it from that angle has helped me tremendously getting over the "selling is gauche" issue.

<comment><USER6> > It helps to reframe the issue. "Selling" yourself is distasteful for many, > because it smacks not only of loudness & brashness, but of straight up > lying.

But a lot of people who get the promotions and funding are straight up lying. Selling yourself is distasteful because you can't compete with the dishonest, you don't want to play that game.

<comment><USER7> I rarely see lying, but you can get pretty much the same result with selective word choice and hand waving.

Going from 500 words to 30 means a loss of resolution. Just make more of the words positive and you can greatly mislead.

<comment><USER6> Greatly misleading or lying by omission isn't much better than lying directly.

<comment><USER8> Exactly. This kind of lying is like return-oriented programming attack. Technically you didn't lie to them, didn't inject them with malicious payload straight up - you just crafted your input to guarantee their mental process generates the malicious payload (the lie) for them.

</comment></comment></comment></comment></comment></comment><comment><USER9> This article doesn't resonate with me. We live our lives as if they were a business enterprise with a balance sheet, always selling, always advertising, always figuring out how to put our personality on display, always judging our human worth by our successes or failures, always weighing the _benefits_ of everything we do. This is the root of many of our modern sociological problems. We attempt to "justify our existence" by our relationship with work. Part of exploring the life of the mind is keeping some ideas, maybe even your most fulfilling work, close to the chest. Life is not all about _selling yourself_.

<comment><USER10> > Life is not all about selling yourself.

Since we are social creatures, it pretty much is. Social mores and niceties, for example.

<comment><USER11> Yep. People may not _want_ life to be about selling yourself, but that's the way it is.

Anyone is free to reject it. And that person is likely to live their life without their work being recognized, their ideas being appreciated, or their ingenuity to find the hands of those whom it would benefit.

I wonder how fulfilling that feels?

<comment><USER10> No friends and no spouse, either.

<comment><USER12> I have friends and i have a spouse, i never sold myself to them and they never sold themselves to me. Quite frankly the idea of it is disgusting.

<comment><USER10> So, you never do things just to please them? You have no filters on what you say to them? You're not on your best behavior on a first date? You only bathe when medically necessary? You dress only for comfort? When you have a photo taken you don't try to smile and stand up straight?

I'm not buying it.

</comment></comment></comment></comment></comment></comment><comment><USER13> > It seems crazy to require that technically talented people should be forced > to spend time doing something - report writing - at which they're not > gifted, but how else can the world benefit from their brilliance? Without > communicating their ideas, their work is lost and might never have been.

Peter Thiel has an interesting take on sales in his book _Zero to One_. He makes the case that good selling and good teaching are pretty much the same thing.

The best teachers know how to sell the topic they teach. K-12 teachers in particular know in their bones how crucial a sales perspective is to getting an important message across.

The best salespeople sell in a way that doesn't seem like selling. Thiel gives the example Steve Jobs. It almost seems strange to call what he did sales, but that's essentially what he did when he got on stage. Another example, is Elon Musk, who gets his message across without seeming very much like a salesperson. It's probably no coincidence that both figured out good ways to inspire their audiences.

So if the word "sell" makes you want to run for the door, consider the more or less equivalent form: communicate. Or, maybe "educate." If you think salespeople are all liars, focus your "sales" efforts on conveying facts in the most compelling way possible - without lying. I find that from this perspective, the idea doesn't seem nearly as bad. It also presents a much more actionable path forward.

<comment><USER14> The element people are ignoring is money. You can communicate, teach, etc. without money coming into the picture. Sales is about money. You can claim you're "selling" an idea, but the implication is that you're still doing it for your own benefit or advantage. That doesn't mean it has to be a one-sided transaction. You may really believe that what you're doing is beneficial for the other party. But your own interest is an inextricable element of sales.

If your own advantage isn't a factor, there are a hundred words with more relevant connotations to describe what you're doing.

</comment></comment><comment><USER15> > _If you lock yourself in a room and do the most marvellous work but don 't > tell anyone, then no one will know, no one will benefit, and the work will > be lost. You may as well not have bothered._

That's a questionable premise and an entitled perspective from "the world" in my opinion. If one decides that they don't really give a fuck about the "impact" of the work on the world and doing it for its own sake, the "world" has no right to push them to release/advertise for their benefit. The premise also implies all entertainment is completely useless. Devil's advocate might argue it's quite the opposite: everything else in the world exists for you to focus on joy and entertainment and not be bothered with the bullshit the world brings on to you :)

<comment><USER16> The thing I find about this quote is, barring the existence of a deity or secular equivalent, all work is, in the end, lost, everything comes down to nothing as the universe is overcome by entropy and heat death or the big crunch. As the song goes: It all returns to nothing, it all comes tumbling down. Which, of course, leads right back to the foundational existential question: free of the perceived delusion of eternity, why do anything? Or why not do everything? Or why, just, why?

<comment><USER17> IMO only most of the things come to nothing.

A good way to deal with existential crises in my life has been to ask myself this question:

"If somebody were to objectively reduce my life to several deeds only and say that those were my most important actions, which ones would they be?"

This question also helps me put my energy expenditures in perspective. Is what I'm doing really important to me?

So yes, probably 99% of what we'll ever do will amount to nothing. Makes it all the more crucial to focus on that important 1%.

</comment></comment></comment><comment><USER18> Einstein is the ultimate example of selling yourself. Yes, he was brilliant but brilliant is not enough. He was constantly open to interviews and made sure the media knew what he was doing. He was so successful that even after his death most of us know about him even if we don't really understand what he was famous for. BTW, he did not earn his Nobel Price for his work on relativity but for the discovery of the law of the photoelectric effect.

I bet if he was alive today, he would be all over social media -similar to Musk.

<comment><USER19> That implies some form of narcissism in the equation. Is this the trait one of the special sauces?

<comment><USER20> No, I think I show forms of narcissism, but I'm nowhere near successful as I would imagine. It gives you the drive, but it doesn't give you a vehicle.

What I've observed is that the special trait is being a "people's person", great conversationalist, communicator and likeable.

<comment><USER18> There are people that can turn all those qualities on and off. I worked with a manager that was extremely good at it in public and people could not get enough of her but in private she was plain nasty. She was hired to layoff staff that were not making the mark and bring in new talent. She was very good at it.

</comment></comment></comment></comment><comment><USER21> There are very few channels to "sell" your work or yourself. We need more of those channels and more "connected" people willing to browse those channels and trampoline things that are interesting.

Nobody cares about your work, they care about what other people care about. It's a chicken-and-egg problem. It can only be bootstrapped by some clever social hack, money, or with someone more connected putting in the work to help connect people. Someone who is producing high quality work 150% of the time cannot be expected to spend another 150% effort to required to rise above the cacophony of other people doing the same thing.

That said, I have done some thinking on this subject, and I'm curious: would there be any interest in a QVC-for-software-demos livestream? It would be somewhere where anyone could go on, on a schedule, and show a demo of something they've made or like to use. It could be for paid software or for fun projects, and it would be live, warts and all. Does this sound interesting to anyone?

EDIT>> If you're interested, as either a presenter or a viewer, add your name and email to this google sheet: [https://docs.google.com/spreadsheets/d/1VX1H8wsW- Do2NflC3__y...](https://docs.google.com/spreadsheets/d/1VX1H8wsW- Do2NflC3__y71lNkreq7Z_xzMA1YECZgF8/edit#gid=0)

<comment><USER22> I built something like this for Shopify. Than Facebook sorta copied my idea with this storefront news. Anyway, I think this niche is very small and your better going for lower hanging fruit then starting with a live stream for software products. There have been businesses like this that were great like criticue.com but surprisingly they went under due to lack of interest and adoption. I personally really liked the service. It was better then a livestream, it was a group of software reviewers giving you feedback.

</comment></comment><comment><USER7> It is accurate but disappointing.

Just before university admissions, I learned to be a self-promotional person, so I am guilty of this.

Firstly, you spend a ton of time doing that selling. It takes away from actually doing work. It is also just distasteful. I hate constantly fiddling with my bio.

Second, you end up altering the work you are willing to do simply because some work is easier to sell than other work.

I completely get why people do this as I do it as well, but what is all this costing society?

<comment><USER23> Absolutely true, absolutely a valid criticism, but it's sort of a 'first level selling'. If you look into people who are REALLY good at what they do, things start to look real different and the value system you're concerned about goes out the window.

Read some of Guy Kawasaki's stuff. That guy is stupidly good at selling, had much to do with introducing the Macintosh back in the day, but it is anything but a burden to him, and if he found he was grinding away selling junk because it was easier, he'd jump out the window.

There is NO substitute for being able to try and convey your excitement about something you're REALLY good at and REALLY care about, and when you are able to bring that to bear, everything is different. I make my living on Patreon 'selling' open source audio stuff I make, and one of my PRIMARY arguments there is, 'this is amazing! Because it is completely liberating! Getting paid this way I get to make weird stuff that maybe only one person will like better than anything, because I NEVER have to hold back and alter things to fit in with what I think the market will bear!"

And it's true… but there is also a market for people who want stuff off the beaten path. I never spend anything on advertising or marketing, and it costs me quite a lot in discoverability, but there is also a market for people who want someone that will not SELL to them in the normal sense, who seems to be out there just doing, and never comes knocking expecting to make 'a sale' or hyping their latest nonsense.

It's not as big a market as the mainstream. But the mainstream simply does not serve everybody.

The bottom line is, if you expect to sell stuff, the most enduring way to do that is to be yourself and then hope like hell there's a market for YOU… because you can fake it, but you can't really get away from who you are. But, if you're prepared to just go full tilt and be consistently who you are, the connections you build are not disposable and don't require trickery to maintain.

When everybody got hit with coronavirus lockdown and were facing great financial risk and the loss of their livelihoods, I worked out an arrangement where I declared that I cut the price of everything more than half, and told all my people on patreon that they should cut back or cancel what they were giving. And I braced myself, certain that I could withstand it: I'd run the numbers and I'd be able to tough it out.

And of course they all did the opposite and gave more, and I got upset and had to be told to allow people to be generous when they wanted to. Because I'd really meant it, it wasn't a 'bit'. And because that was who I really was… yeah. So I got the opposite of hurt, and had the opposite of being out of work. And now I'm trying not to overwork like a madman, knowing that people cared, but also that they wanted me to be well.

If you can be yourself as hard as you can, and it's a self worth being, the idea of 'selling yourself' seems pretty ridiculous ;)

</comment></comment><comment><USER24> I've seen this pushed before. Unfortunately, the more you focus on advertising the less you focus on technical knowledge.

Let the two be separate, because the world has enough 'leaders'/'advertisers'. What it needs now is technical knowledge.

<comment><USER25> Everyone who has the deep technical knowledge also needs to be able to communicate with others who don't have it. There's a difference between being an Internet personality who can code and being a programmer who can write English.

Even if locking yourself in a room for months is a requirement to coming up with new science (which I highly doubt), solving problems for the intellectual gratification is useless on its own unless the new knowledge is shared. Writing is simply the highest-bandwidth medium for distributing technical knowledge to a wide group of people, so even the most in-the-trenches technical people need to be good at it.

<comment><USER24> It's really not as you say in practice. Semantically yes it never becomes released, but eventually excellent work spreads naturally.

In the current internet setup it is hard to grow organically, but that's a result of this same mentality. It reinforces politics and showmanship, which is why those skills dictate the market and coincidentally the internet.

<comment><USER26> But how does excellent work spread naturally? If I publish some truly wonderful language or package on GitHub, would anyone notice without me promoting it? Or if I find some surprising result from an experiment, write it up, put it on my blog that I don't promote, will anyone see it? And if so, how?

</comment></comment></comment></comment><comment><USER27> >Doing technically brilliant work may be enough for your personal gratification, but you should never think it's enough. If you lock yourself in a room and do the most marvellous work but don't tell anyone, then no one will know, no one will benefit, and the work will be lost. You may as well not have bothered. For the world to benefit from your work, and therefore for you to benefit fully from your work, you have to make it known.

no kidding. but the other possibility is that you tell the world but no one cares,which is likely the most probable outcome. Look at all

>But you still have to sell! You now have to sell your company's product or service, you now have to get known so that people will start to use your product or service, or people will constantly visit your website, which then attracts advertising. Whatever, you need to sell! A company lives and dies by what it sells.

>Some people say that the sole purpose of a company is to make money. Others are more idealistic and say that it's to make the world better, or to make their employees' lives better, or some other goal. But without making money, everything else is moot.

Some of the biggest acquisitions and valuations have been in companies that make little to no money or lose money.

<comment><USER28> >no kidding. but the other possibility is that you tell the world but no one cares,which is likely the most probable outcome.

Well, there are 3 components to it:

A) Find a relevant problem to solve. I.e. market research.

B) Solve the problem. I.e. engineering.

C) Convince your audience to try your solution. I.e. marketing/sales.

A successful business requires all 3.

>Some of the biggest acquisitions and valuations have been in companies that make little to no money or lose money.

Because their actual product is the expectation of future profits, and their customers are the investors. Ethics aside, it's the same pipeline, really.

</comment></comment><comment><USER29> If you replace 'sell' with _communicate_ and 'advertise' with _inform_ , I think everybody's going to agree.

Clear, concise communication is important in any human relationship - <USER3> doesn't matter what line of work you're in, unless you're living in isolation somewhere :)

These mythical creatures who create incredible work but fail to communicate it - really? I wouldn't call Linus Torvalds a communication genius and yet when you create something other people want, word gets around and your software gets used.

We could all use a reality check - most of these mythical undiscovered gems are doing above average work that wouldn't benefit that much from better communication, hence it doesn't happen. The cost of re-learning your communication patterns to better match others' expectations is high and yet the reward is often that others will find you a little less stand-offish.

</comment><comment><USER30> The missing piece here is: How do you sell it? How do people find out about your work?

These days (especially in a quarantine world) that means SEO, writing to the search engine, and to an extent, social media.

So while I don't love it, either, I'm increasingly learning to see _sophisticated_ social media usage & SEO as part of my work.

<comment><USER31> Any chance of going into more detail about what you see as sophisticated social media usage? A link would be good.

<comment><USER30> I'm still early in the learning process, and I wouldn't feel confident going beyond the most basic google search results, right now.

But clearly, having an audience on Twitter, and possibly a good relationship with online publications or reporters who can help get your message out, where you can guest blog or become known as an expert, is good for business.

And if there's some way that your work can become a product that translates into sales that can be reached through Instagram, Pinterest, etc., then it helps to know that too. Sounds weird, but I worked at a tooling startup that advertised on Instagram and apparently got good results from it.

</comment></comment></comment><comment><USER32> After reading this article I scrolled down the list of other blog posts by Colin Wright and I found one at the very bottom, from 2011, entitled "Withdrawing from Hacker News": [https://www.solipsys.co.uk/new/WithdrawingFromHackerNews.htm...](https://www.solipsys.co.uk/new/WithdrawingFromHackerNews.html)

There was a comment thread from that article here: [https://news.ycombinator.com/item?id=2402730](https://news.ycombinator.com/item?id=2402730)

I wonder if Colin has decided to re-join Hacker News, and if so, would he care to comment on the changes to Hacker News since 2011 that prompted him to change his mind.

<comment><AUTHOR> I went away for quite some time. In response to the HN discussion you quote, quite a lot of people got in touch, and as a result I ended up making a few quite good friends, and many more contacts.

After a while I submitted a few things, and commented on a few things I was pointed at, but I didn't ever come back and read in the same way that I had been doing.

And it remains thus. I submit things I think the community might be interested in, and I dip in occasionally. But my participation is not as it once was. During "lock down" I've been commenting about once a day, I look at the "Front Page" most days, and "newest" most days, but I don't comment much. Looking at the trends and what the community usually finds interesting, and especially looking at the responses to some of the comments I make, I don't feel that I have a lot to contribute.

<comment><USER33> Hi Colin, you gave your juggling talk at my high school sometime before 2009. I already considered myself both a juggler and a programmer, but your talk inspired me on both counts, and taught me something about being cross- disciplinary in the things we enjoy and pursue. I've been a professional software dev for 8 years but I still think about your talk, your software, and your website. Thanks for encouraging young people like me.

<comment><AUTHOR> Hi there ...

That's a lovely comment ... thank you. Feel free to email me and we could perhaps arrange to meet and have a coffee sometime. Contact details in my profile.

But equally, feel free to stay anonymous if you prefer!

</comment></comment></comment></comment><comment><USER34> This is an unfortunate truth. People aren't waiting to cheer you on as soon as you release a work.

<comment><USER35> Something about academia too, which doesn't really prepare us for the 'selling' part of life/coding. Every term/semester is nice and discrete, with a culminating project/exam, and then the next one is suddenly ... complete. The only required external attention was either the prof who did the grades (who's paid to view your work) or your parents who want to see your accomplishments.

</comment></comment><comment><USER10> Ironically, everyone posting in this thread is trying to sell their opinion on it!

</comment><comment><USER36> >>Selling" to a scientist is an awkward thing to do. It's very ugly; you shouldn't have to do it. The world is supposed to be waiting, and when you do something great, they should rush out and welcome it.

Half of what I did as 'public engagement' was basically selling people the idea that they should take time and care about these animals we were researching and in fact money should be spent protecting them.

Most of grant proposal writing is very much selling the idea of your study or project to the government or organization that's willing to give you money.

</comment><comment><USER37> > If you lock yourself in a room and do the most marvellous work but don't > tell anyone, then no one will know, no one will benefit, and the work will > be lost. You may as well not have bothered.

Maybe this article should be called "I sell, therefore I am".

The quote from the article, to me, sounds ridiculous. I don't lock myself in a room and do marvelous work for other people, so that they know it exists, or so that it will last longer than I do -- and I suspect many other creators feel similarly.

</comment><comment><USER38> Dont sell yourself.

Be honest. Be modest.

Work hard for your own satisfaction.

If you make a modest living doing something you enjoy, consider yourself lucky.

Unless you want to be rich and famous. In which case, kiss arse and big yourself up all the time.

<comment><USER39> Yeah son, but doing it that way wont get you accepted in YCombinator with all the cool kids here. Dont tell me you dont want to be the next Lizzie Holmes.

<comment><USER38> I think there are a few grey beards lurking :)

</comment></comment></comment><comment><USER40> This Hamming quote is gold. I like the way it tells how to put "know your audience" into practice:

... ask why you read some articles and not others. You had better write your report so when it is published ... as the readers are turning the pages they won't just turn your pages but they will stop and read yours. If they don't stop and read it, you won't get credit.

</comment><comment><USER41> One other thing is that if you don't sell your work, someone else might take it, rebrand it, and sell it for his own profit.

<comment><USER42> Sadly I agree. I've seen this a few times in Silicon Valley. You take an open source project from here, take another one from there, take some code from someone's Github, forget about the licenses (because who is going to figure it out?), and you put it all together overlaid with some nice graphics and you've got the start of a business/startup. Take that, show it to investors, and go raise a bunch of money.

<comment><USER43> Does that really happen often in Silicon Valley? Any offenders that you know of or just a hunch?

<comment><USER44> Don't think anyone would "turn someone in" in particular to answer you but it happens all the time. Commercial software businesses thrive on open source, and even of the successful ones only _very_ few concern themselves with giving back to the individuals whose work they used or the open-source world in any way. (edit) I'm not against it per se, but it's sad how it's only take, take, and take.

<comment><USER43> Yeah I feel you, but think about it from the other perspective. We use PostgreSQL but may not have the expertise or budget (since man hours = cost) to contribute to the project. Open Source is and can only thrive by the amazing volunteers that contribute to them, it can never been an obligation; specially for appearances sake.

</comment></comment></comment></comment></comment><comment><USER45> >> then no one will know, no one will benefit, and the work will be lost. You may as well not have bothered.

This runs counter to a lot of great works. They were completed, known by and benefited first and foremost their creator. The fact that the rest of us know about them is just a nice side effect, not necessary.

</comment><comment><USER46> If you don't advertise your work there is no point in even having done it. Perfect way to sum up our pr/advertising world. Not the way I value things, or my own work. There is more value to things than people 'perception' imo.

</comment><comment><USER47> "... you can either do it in such a fashion that people can indeed build on what you've done, or you can do it in such a fashion that the next person has to essentially duplicate again what you've done ..."

I like these words

</comment><comment><USER48> >then no one will know, no one will benefit, and the work will be lost. You may as well not have bothered.

The same is true if you expand your perspective into timescales just slightly larger than the usual human one.</comment>


Chinese Coup Rumors Run Wild Online, Then Disappear - <AUTHOR> http://www.bloomberg.com/news/2012-03-21/chinese-coup-rumors-run-wild-online-then-disappear-adam-minter.html <comment><USER2> Really bad journalism and reporting. No fact-checking, no reliable sources, just pure speculations based on random "tweets" (from the Chinese clone of Twitter named Sina Weibo).

TL;DR:

1\. A high-profile politician was relieved of duty.

2\. A famous businessman tweeted a cryptic message about the censorship about this event on Sina Weibo.

3\. Someone tweeted that there was police and military vehicles in front of the central government and thought it might be a coup.

4\. Someone else tweeted that s/he heard gunshot.

5\. Someone claimed it was actually fireworks (which was actually banned in inner parts of Beijing except for a few days during the Spring Festival).

6\. The term "coup" was then put into the censorship list of Sina Weibo and thus became unsearchable.

7\. A spokesman of the Foreign Ministry denied rumors of the coup.

Seriously, what's the point of this kind of stuff?

<comment><USER3> When censorship doesn't allow proper journalism, speculation is better than nothing.

<comment><USER4> Living in China, I was going to reply the same way. Without factual information, all you have are rumors. The opacity of the CCP necessarily leads to crap like this.

Bloomberg was meta-reporting on the rumor, where it is factually verifiable that the rumor has arisen. In the absence of real information rumors are very important to our daily life; e.g., if chinadaily explicitly refutes a rumor, it gains some possibility of actually being true since otherwise they probably would not have taken the effort to refute it. I can understand why Bloomberg would take the presence of a rumor as news, not claiming any truth to the rumor as fact.

We are still on edge with the Wang Lijun Chengdu consulate incident. What the heck was that all about (we still don't have any clue)? Something is up, and since this year is a leadership change, there is a lot of power jockeying going on, really anything could happen. Its going to be a very interesting year to say the least.

</comment></comment></comment><comment><USER5> Here we see the folly of censorship. If one farts in a vacuum, the fart quickly spreads to occupy the entire area.

<comment><USER6> It spreads so far and wide it disappears very quickly too.

<comment><USER4> The rumor was only censored, it wasn't obliterated. The weibo crowd will just start using code words to keep talking about it.

<comment><USER7> Nothing regarding this has surfaced on the deep web. I doubt there is much truth to the rumor.

</comment></comment></comment></comment><comment><USER8> > Regarding last night's internet rumors that loud noises in Beijing were > caused by gunfire … actually the citizens of Beijing welcome the news that > oil prices will rise and spontaneously gather in the streets to set off > fireworks and celebrate. Don't worry about a coup!

Actually, I've heard several fireworks in Shenzhen today (even heard one while writing this comment). I'm surprised anyone would assume a gunshot when fireworks are so common (at least, in the area where I live).</comment>