Schemastore.org – schemas for all commonly known JSON file formats - <AUTHOR> https://www.schemastore.org/json/ <comment><USER2> Jetbrains uses this in their IDEs [https://www.jetbrains.com/help/idea/json.html#ws_json_schema...](https://www.jetbrains.com/help/idea/json.html#ws_json_schema_store_enable_auto_download)

It's how it autocompletes JSON / YAML files automatically

<comment><USER3> The Manifold JSON compiler plugin[1] pairs nicely with IntelliJ's JSON support. It's the only type-safe, truly schema-first framework I've encountered (that's also fully integrated into an IDE).

[1] [https://github.com/manifold- systems/manifold/tree/master/man...](https://github.com/manifold- systems/manifold/tree/master/manifold-deps-parent/manifold-json)

</comment></comment><comment><USER4> I love structured repositories of knowledge and documentation like this because it opens a lot of doors for automating some broader software engineering talent.

This could be a really cool opportunity to programatically find common subsets of fields/operations that are sent together in many APIs and see if there's a way to build libraries and tooling across a bunch of languages to handle operations on those fields.

<comment><USER5> OpenAPI?

<comment><USER6> I haven't heard of anyone reverse engineering common schemas / parameters from existing APIs (I doubt the commonalities are really there) but there are projects like this one [0] which express schema.org types as JSON Schema objects suitable for use in OpenAPI.

[0] [https://github.com/tandfgroup/schema- oas](https://github.com/tandfgroup/schema-oas)

<comment><USER7> That's awesome! One more step towards the semantic web.

</comment></comment></comment></comment><comment><USER8> Anybody else get bummed out that many times that we create a lightweight thing to compensate for something overcooked (like XML) the new thing eventually ends up overcooked in much the same way?

<comment><USER9> In all fairness, JSON itself continues to be as simple a format as it ever was. Having schemas is an important adjuct because it frees devs up from constantly translating specs into ad-hoc validation routines that all too often miss something or make mistakes. Validation up front saves a tremendous amount of pain dealing with a key error deep in a call stack when the moment a config file was read its omissions or mistakes could have been identified.

Moreover, and on a related note, in many ways, JSON is great as an exchange format, but stifling as a config language. There is a lot if room between JSON and XML to work with.

<comment><USER10> One of the best representations of the 'simpleness' is the way you can draw it in a graphical loop diagram as they do on the json.org site.

When you can make your 'format' in to a not-too-big diagram like that it makes it far easier for anyone interested to 'get it' and encompass the whole thing in their mind to work with.

<comment><USER11> SQLite is the place that (to my knowledge) was the first to do these "railroad diagrams". Here are all of theirs (though they're also available inside the documentation): [https://sqlite.org/syntaxdiagrams.html](https://sqlite.org/syntaxdiagrams.html)

<comment><USER12> As far as I know, they were originally introduced by Niklaus Wirth to describe Pascal's syntax. See the last pages in this manual from 1973: [https://www.research- collection.ethz.ch/bitstream/handle/20....](https://www.research- collection.ethz.ch/bitstream/handle/20.500.11850/68910/eth-3059-01.pdf)

<comment><USER13> They even go back to Algol 68: [http://www.softwarepreservation.org/projects/ALGOL/book/Lind...](http://www.softwarepreservation.org/projects/ALGOL/book/Lindsey_van_der_Meulen- IItA68-Revised-SyntaxOnly.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER14> Here's how to use them in VSCode [https://code.visualstudio.com/docs/languages/json#_json- sche...](https://code.visualstudio.com/docs/languages/json#_json-schemas-and- settings)

</comment><comment><USER15> In a similar vein, apis.guru has a f __*ton of OpenAPI definitions (550)[https://apis.guru/openapi-directory/](https://apis.guru/openapi- directory/) (I am not affiliated, just a fan)

<comment><USER6> The count is sadly out of date. We now have over 3000 OpenAPI definitions! (Maintainer)

</comment></comment><comment><USER16> Aaaaaand now we're back to XML, but with less readable syntax and implementation consistency. Sounds like a win for everyone.

<comment><USER17> We're nowhere close to xml.

Namespaces, externally defined entities, CDATA, oh my!

</comment></comment><comment><USER18> I just swapped from doing JSON schema to using TypeScript Interfaces for schema I'm working on. [https://github.com/ellisgl/keyboard- schema](https://github.com/ellisgl/keyboard-schema)

</comment><comment><USER19> Wow that's impressive. It's awesome to be able to see how complex some of these are like cloudformation.

<comment><USER20> Given that AWS publishes a pseudo-schema[1], in JSON, I don't for the life of me understand why they don't use an actual JSON-Schema spec, saving the world a ton of trouble instead of building a separate project[2] to try and reverse engineer their spec into a standard schema :-(

1 = [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn- resource-specification.html)

2 = [https://github.com/aws-cloudformation/aws-cloudformation- tem...](https://github.com/aws-cloudformation/aws-cloudformation-template- schema)

<comment><USER21> Might find these interesting if you haven't seen them yet:

[https://github.com/aws-cloudformation/aws-cloudformation- res...](https://github.com/aws-cloudformation/aws-cloudformation-resource- schema)

[https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource- type-schemas.html)

(Released this year: [https://aws.amazon.com/blogs/aws/cloudformation-update- cli-t...](https://aws.amazon.com/blogs/aws/cloudformation-update-cli-third- party-resource-support-registry/))

</comment></comment></comment><comment><USER22> Now just someone has to build a converter (like pandoc) for these formats and yaml and dhall and xml and ini and gron/greppabblejson/mozilla format and we finally can use any format we want

and two other questions:

* is there a comparable site for xml?

* is there a python module for each format? :D

</comment><comment><USER7> Are there any tools which can parse a JSON document and its schema definition to construct a queryable graph? The ability to see and traverse relationships in particularly complex JSON documents (like an OpenAPI definition) could come in handy.

</comment><comment><USER23> For those that enjoy a bit of historical perspective, it is interesting to note that similar schema repositories existed also for XML (for both DTD and XML Schema). They were, however, all behind paywalls or registration forms.

It is impressive to see how much and how quickly the world has switched to "open-first" when it comes to schemas, documentation and software in general.

Examples:

* BizTalk (by Microsoft) [https://web.archive.org/web/20000301195519/http://www.biztal...](https://web.archive.org/web/20000301195519/http://www.biztalk.org/Library/library.asp)

* [https://web.archive.org/web/20000511095737/http://www.openap...](https://web.archive.org/web/20000511095737/http://www.openapplications.org/xml/loadform.htm)

Bonus: A review of XML schema repositories: [https://www.xmltwig.org/article/bw/bw_04-schema_repositories...](https://www.xmltwig.org/article/bw/bw_04-schema_repositories.html)

</comment><comment><USER24> Has someone made a version of this but as a type definition for Typescript? I'd find that interesting and wouldn't mind contributing to a Github repo.

<comment><USER25> Should be technically possible, though I don't know how strictly they map to/from each other.

JSON schema to TypeScript - [https://github.com/bcherny/json-schema-to- typescript](https://github.com/bcherny/json-schema-to-typescript)

TypeScript to JSON schema - [https://github.com/YousefED/typescript-json- schema](https://github.com/YousefED/typescript-json-schema)

</comment></comment><comment><USER26> With version 1.0 of TOML it is JSON compatible AFAIK, so it should be possible to check it against json schemas as well.

</comment><comment><USER27> Interesting. Is there documentation on how to programmatically validate Jason against a schema?

<comment><USER28> There's some nice python packages to natively use it. [https://pypi.org/project/jsonschema/](https://pypi.org/project/jsonschema/)

We use it at Uclusion to make sure our front end is passing the right arguments, by having it be the first thing our lambdas do with the request body:

      from jsonschema import validate as validate_schema
      def validate_syntax(self, event):
            """
            Subclasses are expected to override this to handle any syntactical validation different from here
            :param event: the request event object
            :return:
            """
            schema = self.get_schema() # implemented by individual validator objects
            validate_schema(event, schema)

</comment></comment><comment><USER29> Are there any vim or emacs plugins that utilize these?</comment>


One does not simply learn to code - <AUTHOR> https://medium.freecodecamp.com/one-does-not-simply-learn-to-code-f25bacdc5b62 <comment><USER2> Coding IS hard. But I don't think a modicum of programming literacy and logical thinking should be hard. The problem I see in all his examples is the idea of expectations for the person learning to code, because people who don't code don't have the ability to know how hard a given software endeavor is. Games are the canonical example of something that beginner programmers would want to jump into, but game programming is notoriously tricky and you'd be drowning quickly as someone just getting started. This is exacerbated by the "coding is easy!" marketing mentioned, because they're missing the first two words of the statement. It should read "Getting into coding is easy!".

I think people should be able to do basic data manipulation from reading files. I think people should be able read and write simple code in at least one language. I think people should be able to do simple database manipulation. And most importantly, II think people should be able to look at their own lives and recognize when there is something that seems like it should be automated, even if they themselves don't know how they would do it. I don't think that's unreasonable to ask.

</comment><comment><USER3> People here are talking about whether coding is hard, without defining "hard".

Is coding something anyone can learn? Most probably.

Is it going to take a long time? Yes.

Can it be taught with immediate feedback, so people don't get frustrated and quit mid-way? Yes.

Are there any such tutorials? Not that I know of.

Maybe I should write one. The bigger problem is that people are motivated by different things, and if someone is excited by learning how to write a web server and serve their own webpage step by step, someone else may be completely bored by it.

<comment><USER4> I think you can talk of things being hard or easy in absolute terms. I mean, to delve fully into the most intricate details of anything is hard, whether it be programming, painting, music etc. But you can't say that, for example, music is hard. Anyone can pick up a guitar, strum 2 or 3 chords and sing along. But writing a symphony is very very hard and requires not only talent but many years of study. The same things applies for coding. Anyone can write a couple of cute programs in Python, so coding isn't necessarily "hard". Programming at a more advanced level certainly is, though.

<comment><USER3> But that isn't a very useful metric. The question of how hard something is is pretty much equivalent to "how much time can I expect to spend on this before I learn it?". You're saying that there's coding you can do without spending too much time, and coding you can do only after spending years. Sure, but you can be reasonably effective early on, and there's an easy path to mastery (build more and more complex things).

Ultimately, it's a matter of learning curves and outcomes at each point.

</comment></comment></comment><comment><AUTHOR> Based on my experience, a common problem is the ability to translate logic into code. It's not uncommon to see an algorithm not being able implemented correctly due to poor logic.

Other obvious issue is the choice of underlying data types and structures. Constructs specific to the programming language in question follow.

Yes, coding is NOT simple. However, I feel that it has become relatively (although only slightly) easier than it was perhaps a decade back. With numerous open source projects in almost every programming language out there, one can learn a lot by studying those. Of course, this wouldn't apply to a beginner.

</comment><comment><USER5> I think learning to code is easy, and it's not because I'm so smart--plenty of my friends learned how to "code" in HTML by simply (there's that word!) reverse engineering MySpace or Xanga layouts back in the day.

However, _engineering_ is a discipline, and as with any discipline, it is difficult to master. It takes hard work, dedication, and of course, discipline, to learn what to do, who to talk to when you don't know what to do, where to go to find out who to talk to, etc, etc.

I thought front-end development was some sort of wizardry. I thought it was just write an HTML page, then write a JavaScript script, then write a CSS sheet, put it all in the same folder and put it onto Github pages. I'm a front-end developer!

Then I learned about build tools, frameworks, architectures (MVX), and I was like, why's this so complicated??

Once all the pieces clicked and I understood how everything worked _together_ (not necessarily individually, looking at you Webpack), it became incredibly easy and rewarding to learn. Not necessarily easy to _do_ , but certainly easy to learn.

</comment><comment><USER6> I can buy that many marketers and instructors lead students to believe coding feels easier than it "really" does.

I find it hard to believe that the word "simply" is a giveaway. But I could be convinced. I can't remember coming across the word simply to often in tutorials.

</comment><comment><USER7> This is fairly old and I believe it was already posted by Quincy himself.

<comment><USER5> Well, two weeks is pretty old in Internet terms.

</comment></comment><comment><USER8> Nice chrome extension ! :))</comment>


Heimcontrol.js - Home automation in Node.js with Raspberry PI and Arduino - <AUTHOR> http://ni-c.github.io/heimcontrol.js/ <comment><USER2> This is cool, and I hope there's a lot more in this space. I get the feeling that home automation is going to grow over the next few years.

I started something similar a while back with Go -- a simple RESTful interface to various bits and bobs in my home. Go was a good fit due to its speed -- it's _fast_ on the RPi, and cross-compiling for ARM is straightforward. Coupled with the LimitlessLED bulbs (cheap!), it currently runs my alarm clock, and makes the lighting in my room react to various situations.

I never finished it, or made a proper interface (I just consumed the services from some Python scripts elsewhere in my network); I should probably pick it up again.

</comment><comment><USER3> > MongoDB

I really hope they took a lot of effort to lock that down, or a lot of homeowners are going to find their homes remote-controlled without their consent.

<comment><USER4> Can you suggest a good article about this or walkthrough about how to secure it? Is it more difficult than other databases?

<comment><USER3> I haven't checked recently if they changed it, but MongoDB by default will, to my knowledge, bind to all network devices it can find, allow connections from all possible sources, and allow any connection to it full write access to everything in it.

So, uh, make sure your firewall let's ONLY known machines through to it, and check the manual how to enable authorization. Or better yet: Use a database that isn't designed to be goatse by default.

</comment></comment></comment><comment><USER5> Looks good. I really like the Wake-on-LAN and ping functions.

Another option for prototyping IO is a Gertboard (if you don't mind a bit of soldering).

</comment><comment><USER6> Looks good, I make something similar but the server is in the cloud. www.domothings.com will open beta in September-October.

</comment><comment><USER7> this is really awsome!! I am thinking of making a locker monitor/controller with this

</comment><comment><USER8> Why the arduino? It servers no purpose apart from an overly complex GPIO expander - whereas not only does the RPi have a whole bunch of GPIO, if you need even more you can get a dirt cheap I2C expander that is way more reliable.

This is what you get when people whose main idea for a home automation system is "a responsive design" start creating hardware products...

<comment><USER9> Alright seriously, what the hell. Is this some sort of HN parody comment? Is it meant to be ironic in the sense of "look what happens on _hack_ er news when you submit a cool _hack_ \- you get shat all over by the first poster!"? Here's a re-write for you:

Neat! You could actually do the same thing entirely without the Arduino by using the GPIO built into the RPi, and pick up a dirt cheap I2C expander if you need more.

<comment><USER10> I didn't make the comment, and don't necessarily support it, but I think I understand it.

I think it's the result of hobby programming/hardware converging with professional programming/hardware. The hacker scene collides with KickStarter.

People used to have to carefully write assembler to get programmable electronics to do things and had to fit it inside a 1K EEPROM. Suddenly machines exist with literally a million times more memory for prices an order of magnitude less and reference points are suddenly thrown right off.

I'm not that old (not yet 30) but for people >= a certain generation, I can understand why this all seems very very alien.</comment></comment></comment>


Troublesome quarter for Yahoo again - Portal's executives say they will address company weaknesses - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2007/07/18/BUGOSR22R01.DTL <comment><USER2> How about if Yahoo stopped trying to compete with the likes of USA Today and the Kansas City Star?

Here's the most important item on Yahoo's front page as of this comment:

"Can he talk to the geese? The "Goose Whisperer" clears parks of the pesky birds by making friends with the fowl. >> His unique methods"

Wow. I'm so inspired. Somebody sell me some Yahoo stock.</comment>


Crowd Sourcing Business Development - <AUTHOR> http://www.trottercashion.com/2010/10/26/crowd-sourcing-business-development.html

<comment><USER2> It'd be interesting to hear if this works out, i've tried this model before myself as i hate looking for work, unfortunately i got no where, but thats probably because i didnt know the right people.</comment>


Australian Government goes to war with Google over net censorship - <AUTHOR> http://www.theage.com.au/technology/technology-news/government-goes-to-war-with-google-over-net-censorship-20100330-r9bp.html <comment><USER3> "Senator Conroy has conceded that greater transparency is needed in terms of how content ends up on the blacklist, but last night he again refused to make the blacklist itself public, saying it would provide people instant access to the banned material."

This was the most interesting quote in the whole article for me. There is a parallel with the taboo on swearing, it being impossible to perpetuate the taboo on swearing without breaking it.

The difference is that the taboo on swearing has always been there. People just work around it. My feeling is that this law will end up the same way - <USER2> more useful than any other irritating quirk.

I'm skeptical that it will impede political speech, or free trade or whatever in any significant way. This doesn't mean I'm in favour of the law, though - it strikes me as a complete waste of time.

<comment><USER4> The government has been using existing powers to try and block political opposition and the current ban list does ban sites on issues like euthanasia and gay rights. On top of that I am told that the technology, depending on how it is implemented, may compromise SSL. These seems significant impediments to freedom of speech and potentially trade.

<comment><USER3> My logic there is that impeding political speech makes the law vulnerable to legal challenge. My opinion is that such a challenge would succeed, hence my view that, one way or another, it will stay out of areas like trade and political speech.

<comment><USER4> Only if those provisions are explicitly protected by the text of the constitution. Since the Engineer's case (<http://en.wikipedia.org/wiki/Engineers_Case>) the High Court has favoured a literal interpretation of the constitution. Having said that, cases in the early 1990s established an implied but limited right to freedom of political communication so hopefully you're right.

<comment><USER3> Yeah, I think someone will do the obvious thing with this law: find some obviously-political thing on the blacklist and ask the courts to apply the test from Lange/Coleman v Power (which build on the early-90s cases you mention).

So yeah, here's hoping their argument gets up.

</comment></comment></comment></comment></comment><comment><USER4> I'm not sure how more unaware Conroy can get. He is or has been at particular stages "unaware" that the internet is different from traditional media like books, "unaware" that the proposed ban list includes topics like euthanasia or gay rights, "unaware" that the proposed filter would devastatingly slow internet, "unaware" that the proposed filter is trivially bypassed by criminals, "unaware" that he spoke with the US state department who appear critical of the plan, "unaware" that Google has maintained a pretty strong stance on user privacy and "unaware" that the Australian people do not want this.</comment>


Mixmatic – discover new SoundCloud mixes – no login required - <AUTHOR> http://www.mixmatic.io/ <comment><USER2> Nice!

Just wanted to say I wish more services would have "no login required" as a prominent feature.

<comment><AUTHOR> Thanks we agree to!</comment></comment>


Supermicro boards were so bug ridden, why would hackers ever need implants? - <AUTHOR> https://arstechnica.com/information-technology/2018/10/supermicro-boards-were-so-bug-ridden-why-would-hackers-ever-need-implants/ <comment><USER2> I feel like this article reflects some significant technical confusion. The BMC is supposed to be on a trusted network inaccessible from the outside. I've always viewed authentication on the BMC as being like the numeric lock on luggage--it's designed to keep honest people honest, not for real security. Being able to bypass the BMC security is really not a big deal. What the Bloomberg article says about the hardware exploit is much worse:

> > The rogue instructions, Bloomberg reported, caused the BMCs to download > malicious code from attacker-controlled computers and have it executed by > the server's operating system.

It's using the fact that the BMC has unfettered access to the rest of the machine to compromise the code running on the server itself. That's valuable even if the BMC itself is on a private network inaccessible to the attacker.

<comment><USER3> BMCs like DRAC or iLO are invaluable when you have hundreds or thousands of fresh servers with no OS. The BMC lets you mount an OS or hypervisor ISO in a way reminiscent of DaemonTools _et al._ , and update bios and other firmware from a shared network folder. I'm pretty sure there's even an API to develop against.

<comment><USER2> BMC's are great--all my home builds have them because I'm too old to be fiddling around trying to figure out why a computer won't boot an installer from a USB key. But even on my home network the BMC's are on a separate switch on a subnet that doesn't have internet access except through a VPN gateway.

<comment><USER4> > except

There's your problem.

<comment><USER5> I think the parent meant, you have them on a subnet with no default route, but have a vpn / management system with one interface pointing in to the management network. You can get in via the vpn but they can't get out.

It's a pretty common configuration.

</comment></comment></comment></comment></comment><comment><USER6> If Supermicro boards are bug-ridden, then I'd expect other manufacturer's boards to be equally bad or worse. I don't have a reason to defend Supermicro or some such, but where else in retail do you get specialized server boards like Supermicro sells? When Opteron was relatively new in 2004, I bought a two-socket board from Supermicro as the alternatives from well-known Taiwan manufacturers (ASUS, MSI, etc.) weren't as sophisticated (hadn't the PSUs and PSU connectors, power ratings, and rack-mount/tower convertible enclosures).

</comment><comment><USER7> >Supermicro boards were so bug ridden, why would hackers ever need implants?

Ummm, because if you need your hack to be reliable, you can't rely on someone else's bugs to be there when you need them. You never know when they'll be fixed, or just replaced by new bugs.

A long time ago when setting up computers and networks was driver version hell, we had a short list of manufacturers' computers that we'd do setup included in the price instead of on-the-clock. This came about when a shipment of about 20 Dell computers, all supposedly of the exact same model# and revision, required about about 11 different setups, because the various chips on the board were different. They were clearly just using the chip-of-the- week>from whatever supplier was cheapest -- great for their price points, but every variant required a different driver for some subsystem. So the list was created and Dell was not on it (it was IBM, Compaq, HP, DEC, to show when this was).

That's solved now by hiding it with the much more automated OS and networking setups, but it is easy to see how the Chinese spies would be in the same situation -- some buggy boards are wonderfully exploitable, but how do you tell that the version going to your target wasn't changed by some revision that wasn't even noted in the Rev- listings? Better to insert your own bug if you want to actually get the job done.

</comment><comment><USER8> I don't really see why everyone is calling this implausible. Modchips have been around for at least 15 years. The idea of the clipper chip is 25 years old. At every hacker conference there are people "hacking" devices by various buses or interfaces.

If there is anything working against the Bloomberg story it is that it is too plausible. Often reality clashes with imagination, but the Bloomberg story contains almost everything you could imagine happening.

<comment><USER9> It isn't implausible because of it being difficult and expensive, its implausible because there _already exist_ much easier, cheaper, and (arguably) harder to detect ways of subverting SuperMicro motherboards.

As a bonus, subverting the BMC firmware is much harder to trace to the source since it could be injected by in so many ways by so many different people.

Why use a thermonuclear device when a hand grenade accomplishes the goal?

<comment><USER8> I just don't think the relationship between those two things you are describing exists. If the Chinese government approaches a Chinese manufacturer with the goal of compromising US software companies adding some sort of chip that reconfigured the hardware would be the most straight forward thing for them to do.

If anything I think the idea that a Chinese manufacturer with complete access to the hardware having to execute some exploit towards the web interface to get access is far fetched. So is that you could pretend to update the firmware (surely no one is going to notice that the new version doesn't have the features you wanted?) and that dumping the firmware would be inconvenient (it would be the first thing you did if you suspected something).

<comment><USER9> The "chip that reconfigured the hardware" is already built in; it's the BMC.

All the Chinese government has to do is go to the factory and tell them "flash the BMC firmware with this image" where the image is subverted (but operationally indistinguishable) BMC firmware. It doesn't get much more straight forward than that.

<comment><USER10> There are attacks where flashing a malicious firmware on to the device prevents real firmware flashing (just updates version numbers, re-infects the flashing payload on write, etc). However, those attacks can be mitigated by physically connecting to the flash module and writing to the device directly through SPI. If you've got a chip between the BMC and the flash memory as the report suggests, it can re-infect the memory even when you're done. You could even read the contents of the flash memory directly and find no evidence of the attacker, as the attack code might never actually write to the memory and may only load when the BMC boots and attempts to read from the flash memory.

</comment></comment></comment></comment></comment><comment><USER11> Okay, crazy tinfoil hat time: what if this story is a plant from a particular part of the Chinese government (like PLA Unit 61398), designed to give the impression of the ability to disrupt global supply chains and to build respect through fear?

If all of these unnamed sources are unnamed because they were adversarial members impersonating government officials, then that would make a little more sense why current government bodies are not just staying mum, but actually denying knowledge of the story.

With the software attacks being much more feasible as the Ars article points out than a hardware attack, then it would also make it so that the vehement denials from affected companies would be true as well. The whole thing could be a large disinformation campaign to strike at the very core of what many would otherwise consider reasonable security.

<comment><USER12> No need for that much tinfoil, this came in parts straight from the Pentagon [0] and Bloomberg's "specialist", Tavis Ormandy, turned out to have a vested interest in selling "cyber security" related products aimed at supposedly fixing exactly these kinds of supply chain problems [1].

Imho The Register also points out some interesting details about this whole thing [2]

It's not really that surprising, fits perfectly into Trump's narrative of "They took our manufacturing, it's time to take it back to the US!". Gotta start somewhere, telling everybody China is selling a lot of bad apples seems like a simple enough start.

[0] [https://s3.amazonaws.com/static.militarytimes.com/assets/eo-...](https://s3.amazonaws.com/static.militarytimes.com/assets/eo-13806-report- final.pdf)

[1] [https://web.archive.org/web/20170721190725/http://www.sepio....](https://web.archive.org/web/20170721190725/http://www.sepio.systems/assets/Sepio_Data_Sheet.pdf)

[2] [https://www.theregister.co.uk/2018/10/04/supermicro_bloomber...](https://www.theregister.co.uk/2018/10/04/supermicro_bloomberg/)

<comment><USER13> Do you mean someone else rather than Tavis Ormandy? As someone else has already pointed out, he's at Google Project Zero (which isn't in the business you describe) and I don't think he's ever worked for the company whose brochure you linked to, and so far as I can see he's been pretty rude about the Bloomberg story.

</comment></comment></comment><comment><USER14> One researcher criticizes this type of hardware attack, saying:

 _Once discovered, such an attack would be burned for every affected board as people would replace them._

But this article also points out a case where, even after SuperMicro had published a patch to a serious BMC firmware vulnerability, 32,000 servers in the wild had not been updated _a year later._

So, if software updates aren't always speedily/reliably deployed in the wild by customers, can we really expect hardware to be speedily replaced?

</comment><comment><USER15> While I don't think Bloomberg's story looks very plausible, perhaps one motivation for cryptic hardware modification at a time when firmware weaknesses were being discovered might be precisely because the easier-to- exploit firmware weaknesses were being discovered, and so might not be exploitable much longer? It might not have seemed plausible that the vulnerabilities would be discovered but then not fixed to the extent that, it turns out, they were not.

</comment><comment><USER16> _"There are so many far easier ways to do the same job. It makes no sense—from a capability, cost, complexity, reliability, repudiability perspective—to do it as described in the article."_

Considering the US went to the trouble of wiring the North Atlantic for sound to catch Russian submarines during the cold war, and tapped undersea cables using divers and submarines, this is so implausible for a nation state? Large state actors specialize in activities for national defense that make "no sense—from a capability, cost, complexity, reliability, repudiability[sic] perspective".

<comment><USER17> There are even more recent examples with software: Stuxnet

</comment></comment><comment><USER18> While it's ultimately going to help to shame vendors regarding their poor security practices, it's really irritating and unfortunate this is all being framed as a Supermicro issue. How about the other companies in the same market space, like Tyan, that I'm sure are no better? For that matter how about the "Tier 1" OEMs like Dell and HP - how well-written are their BMC firmwares?

</comment><comment><USER19> Not saying I believe in one side or the other, but from a standpoint of avoiding detection I think firmware hacking goes out the window.

A deep-pocketed attacker isn't going to risk flashing the firmware with a non- oem one on a brand new board leaving the factory. That probably gets quality inspected somehow later on anyway whereas a visual inspection is just a rubber stamp (IE: OK if the box isn't crushed or wet).

Not to mention a customer in the field who experiences problems is likely to report their firmware version to Supermicro support, whose poking around could expose the entire project.

There was an article recently about how hardware is "magic" and the IT world mostly takes it for granted. Putting an extra chip on the board but making it completely transparent to software debugging techniques is the best way to go. The board is almost certainly going to be flashed at least once and probably audited several times in it's lifespan by IT, but the hardware is never going to get more than some compressed air blown on it. Nobody repairs these things at the component level on a scale that matches how frequently firmware gets flashed or checked out.

<comment><USER20> Maybe for smaller companies, but Apple is very paranoid and AIUI does indeed inspect the hardware to make sure it hasn't been tampered with. I know less about Amazon in this regard but I would expect Amazon to do at least some level of hardware inspection to detect tampering as well.

<comment><USER21> They also do extensive code reviews, including of imported open source, yet their software is hardly bug free. Bugs can linger for years, often fixed only because someone stumbled upon odd behavior.

Spotting a tiny chip sitting on the SPI bus that looks identical to a bunch of other chips? That doesn't do anything unless it's tickled in just the right way? If you believe Amazon and Apple are even remotely capable of protecting against that....

The solution to these problems is to put critical code and critical secrets on discrete, _simple_ SoCs where you actually have a chance of defending both hardware and software attacks. Apple and Amazon understand this because they already do it. The difficulty is building your software systems (firmware, kernel, etc) to make use of these secure elements, not to mention making them available for ad hoc application software. It's an extremely difficult integration problem, and even when you succeed you haven't.

For example, AFAIU Amazon's servers have secure elements to perform attestation of the box; it's utilized by their hypervisors to authenticate VMs for things like KMS. But it can't actually protect the data in the VM itself, such as the secrets obtained by dint of the attestation. It can't even prevent taking control of the hypervisor. All it does is help Amazon define a fixed security parameter--that you can't impersonate their hardware nodes on the network. That's extremely useful, but ultimately extremely limited.

<comment><USER20> Code reviews for bugs is very different than security reviews to look for malicious tampering. Apple may have bugs that linger for years, but I'm not aware of any documented case of someone managing to slip a backdoor into Apple software via an open source package.

> _Spotting a tiny chip sitting on the SPI bus that looks identical to a bunch > of other chips? That doesn 't do anything unless it's tickled in just the > right way? If you believe Amazon and Apple are even remotely capable of > protecting against that...._

Why not? X-raying every board, inspecting every single component, making sure it matches up with the documented specs and perhaps with a proven-good board... if you're replacing a component with a different one, or adding a component that wasn't there before (which is the case in this alleged attack), even if the component _looks_ harmless and even if it's tiny, it can still be revealed by a detailed comparison of the board against specs. A component that's the size of a grain of rice is still a component that can be detected.

<comment><USER21> So are you saying that they x-ray every board now?

</comment></comment></comment></comment></comment><comment><USER22> Very fair article. Raises doubt in a very productive way, not the he-said she- said of previous rebuttals.

I'd go further to say it isn't just about the accuracy of the bloomberg piece, but implies bad things about their journalistic integrity. I mean, get real, Ars doesn't have an investigative journalism team. The one-sidedness of the bloomberg article becomes very apparent.

</comment><comment><USER23> It depends on what you want to do. If you want to extract information from a specific network. maybe custom firmware is a good option.

If you want to just disable a very large number of machines to create economic damage or cripple infrastructure, a hardware implant would do just fine. And you wouldn't need to be very careful as to where it ends - if you make enough of them, they'll be everywhere.

If 1% of all MacBooks have a similar backdoor, there are about a dozen at my building.

</comment><comment><USER24> BMC bug story time: I was working on automating health checks, and I needed some information from a BMC. The information was provided in XML format... fixed width. It's like something produced the document, and then output it to console, then copied from console to web service output.

</comment><comment><USER25> I would guess that large companies are refreshing with known good firmware before deploying servers? So while described approach is easier prob will not get attacker as much.

<comment><USER10> Most BMC updates are handled in software on the BMC. You're giving the BMC a new image file to write and trusting the BMC to actually write it. Who's to say the BMC is dutifully writing that image to the flash memory? Who's to say it doesn't re-infect the image before writing?

Even if you do directly connect to the flash module and directly write to it through SPI, if the attack is being loaded by an additional module between the flash memory and the BMC, it could still inject additional data into the BMC's boot. If you're not physically listening to the SPI data being transmitted or knew what to look for in the final environment of the BMC, you wouldn't know it had happened.

</comment></comment><comment> xkcd-sucks Okay, crazier lead-foil hat time: what if this story is a crappy hoax intended to discredit/prevent from publication a real story with similar details?

<comment><USER26> I don't follow. If anything it makes the parallel story easier to publish as a sort of "me too" (no disrespect.)

Maybe it takes away from the firmware hacking version of the story because now folks are looking at components as being the source of hacks and not the firmware on the components, leading to a false sense of security when they invest mightily in analyzing components with X-rays? I could see that outcome as being plausible. If the ultimate outcome is simply to change corporate priority towards futile component verification and away from firmware verification then indeed the firmware verification vector remains safe for the attacker.

<comment> xkcd-sucks More like "Oh look, another story about extra components inserted by a big state actor. Bloomberg just got burned for this, I'm not going to risk my/my organization's reputation on the slight chance that this one is real"

Or, "Extra chips on the motherboard? You're about a month behind the news cycle and didn't you hear it was all BS anyway"

But the false sense of security interpretation is plausible too.

I wonder who holds conferences on the cutting edge research of manipulating media

</comment></comment></comment><comment><USER27> > a binary file that stored administrator passwords in plaintext.

I understand what they mean, but that sentence still hurts to read.

</comment><comment><USER28> The purpose of this whole thing was to manipulate the market. Super Micro stock fell 50% and still has not recovered since October 4th. Before the report its trading volume was invisible. After the report the volume experienced almost 2 orders of magnitude increase.</comment>


Man builds his own carbon-fibre, Windows based tablet PC - <AUTHOR> http://carbontablet.blogspot.com/

<comment><USER2> Carbon tablet? Hasn't updated to Cocoa yet? =)

</comment><comment><USER3> Having laid up carbon fiber . . . respect. And keeping the natural epoxy finish is good industrial design, not to mention opening a whole new au- natural style for tablets. I want this with <favorite-OS> on board.

<comment><USER4> If 1.5kg and 2 hours battery life is acceptable, just buy a tc1100. It's industrial design of a different philosophy, but on a part with Apple. The form factor is from 2001, and is still competitive. Oh, and you'd have to use a stylus.

</comment></comment><comment><USER5> This is a preview of the Win 7 tablets that will eventually be coming out after everyone gets over being scared shitless of the iPad. If 'some guy' can hack together a tablet as impressive as this, it makes me wonder what HP has been doing this whole time and gets me excited about how awesome Dell's version of this (even running Android) will be.

</comment><comment><USER6> What? No built-in webcam!? :P

<comment><USER7> It's called, plug in a USB camera . . . oh look, you can't do that with the iPad and its raped OS.

<comment><USER8> You also can't do it with a mobile phone, DSLR, cisco desk phone, UPS, fridge, Palmpilot, firewall...

The "IT HAS A CPU THEREFORE IT MUST DO ANYTHING ANY DESKTOP LINUX COMPUTER CAN DO" attitude is ridiculous.

</comment></comment></comment><comment><USER9> I wonder, how much do you think this cost him? (Just the materials, not time spent and what-not)

<comment><USER10> As he says in the descrip of his YT demo <[http://www.youtube.com/watch?v=c7W_AuspKls>](http://www.youtube.com/watch?v=c7W_AuspKls>):

This is a project I have been working on in my spare time for the last few months. I wanted a Windows 7 touchscreen tablet with a large screen that could handle HD video and wasn't too thick or power hungry. The build cost for this was around _$600-700._

</comment></comment><comment><USER11> Impressing handcraft / engineering work, although with weight of ~1.5 kg it's not particularly lightweight (twice iPad's weight). What about battery life? I'm surprised if more than 2 hours.

Personally I don't understand what's the big deal to have exactly 1280x720 pixels in handheld device.

Yes, in theory you will get wider field of view compared to e.g. iPad's 1024x768 resolution, assuming you adjust your watching distance accordingly (to keep visible pixel size same), but it's not that big difference, given that tablet watching (close-distance) is always big compromise compared to big screen watching, due to fact that eye is relaxed when focused to infinity.

<comment><USER12> > All I have left to do is complete the new battery pack, which should boost > the battery life to around 8 - 10 hours. I'm hoping to have that done in the > next couple of weeks.

<comment><USER13> If this is an external battery pack, don't forget to add its weight when comparing the iPad to his device. I think it's an amazing hobby project, but it's quite clear that getting ten hours of battery life out of a tablet is a tricky proposition involving tradeoffs from top to bottom of the hardware and software stack.

e.g. Flash, pre-emptive multi-tasking :-)

</comment></comment></comment><comment><USER14> Cool project, but way too heavy to be used as a tablet. Even iPad is a bit too heavy at 680g (1.5lbs) and has to be rested on something after a few minutes of use.

I used to own a HP TC4400 (2kg) and an older Progear tablet (1.5kg) and that range is just not usable in the same way as iPads or Kindles are. Kindle at 290g is about the optimum, weighing the same as a typical book and easy to hold for extended periods of time.

<comment><USER15> I'm 6'3/190 so the weight doesn't trouble me, the only thing I don't understand is why windows.........

<comment><USER16> Probably because it's a full blown OS ;p

<comment><USER15> lol src on features windows has but not linux? inb4 directx

</comment></comment></comment></comment><comment><USER17> Damn, that's pretty nice. I would use it around the house for sure. Very nice specs for the size and weight.

</comment><comment> doc-film man that's a man after my own heart.

what you need now is a howto and a components kit sold in radioshack for the consumer boffins and we will soon see another sinclar / apple / Microsoft in the making.

<comment><USER4> Hmm, one thing Apple could do is to seed a company that does this, but only for Intel x86 chips. This would be a great way to attack the margins of their competitors while ensuring their own iPad is immune.

</comment></comment><comment><USER18> ;World asks "Why?"

<comment><USER19> Because he can.

<comment><USER20> To me, because he wanted to is even higher on the list.</comment></comment></comment>


To play Diablo 3 you need to be online all the time - <AUTHOR> http://multiplayerblog.mtv.com/2011/08/04/blizzard-vp-surprised-over-fan-reaction-to-diablo-3-online-requirements/

<comment><AUTHOR> Same thing here: [http://www.tomshardware.com/news/Diablo-PC-Gaming-action- rpg...](http://www.tomshardware.com/news/Diablo-PC-Gaming-action-rpg- battle.net-Robert-Bridenbecker,13187.html)</comment>


Google now article - celljunk-e

There was recently an article about someone who went from iphone to android because of google now and explained the benefits of google now for travelers.  I wanted to read it later, but sadly fell asleep and now I can't find it.  If anyone can help please do link me to it.
Thanks! <comment><AUTHOR> Is it this one: <http://news.ycombinator.com/item?id=5006967> ?

<comment> celljunk-e No, not that one. The one I am seeking was mainly focused around the power of Google Now

</comment></comment><comment><USER2> <http://tomdale.net/2013/01/my-ios-7-wishlist/>

His iOS 7 wishlist: Google Now.

<comment> celljunk-e That's it!!!!!! Thanks dude!</comment></comment>


Injured Adult Neurons Regress to an Embryonic Transcriptional Growth State - <AUTHOR> https://www.nature.com/articles/s41586-020-2200-5 <comment><AUTHOR> The university's press release covering this research: [https://ucsdnews.ucsd.edu/pressrelease/when-damaged-the- adul...](https://ucsdnews.ucsd.edu/pressrelease/when-damaged-the-adult-brain- repairs-itself-by-going-back-to-the-beginning)</comment>


Why did the AK-47 become so popular? - <AUTHOR> http://www.economist.com/blogs/economist-explains/2014/01/economist-explains-4 <comment><USER2> During my mandatory army service (Bulgaria) I was given AK-47. I had to be responsible for the gun for the whole 1997, but shot only few times, since the country was going through hard period, and we were not allowed much ammo. Also had to make sure that I shoot on manual, or was it semi-automatic. From what I remember I had to get used to my weapon, as each one was uniquely biased, so you had to understand yourself how it shoots. Had to clean it every day at 2:00pm, and had to cover disassembling and assembling it for some relatively short time (actual times escape me, but was somewhere in the dozen of seconds to a minute).

Losing the gun was punishable by 7 years military prison (or at least that's what they've told us). Also while guarding and if someone was approaching you should first fire an alert bullet (if that's the right name) up in the air, and then shoot at place (if the object keeps moving).

I did not even cared about it. Later I was supposed to be with RPG-9, but since the major and the captain of the brigade discovered my typing and computer skills I was put in an "ad-hoc" position - sleeping in the same room with all drivers, cooks, etc, while just doing computer stuff and delivering the mail from the city (along with starting the wood stove, and some cleaning).

<comment><USER3> >alert bullet

Warning shot.

<comment><USER2> Thanks for the correction!

</comment></comment></comment><comment><USER4> The article does a somewhat poor job of explaining the success of the AK47 in the context of the time it proliferated. Because the discussion of such things tends to be dominated by fanbois of one military rifle or another, the good and bad of the weapons tends to be overstated.

One of the biggest advantages of the AK47 is that it could be manufactured en masse with relatively simple manufacturing equipment that was widely available and inexpensive in the middle of the 20th century. Consequently, it could be produced even in marginally developed countries as a matter of both technical ability and economics. Contrary to popular rumor, a number of countries produced AK47s with relatively tight tolerances so lack of precision machining was not intrinsic to its success.

By contrast, and many people forget this, when the AR15 family of rifles was first produced, only a handful of industrialized countries had the ability to fabricate the precision aluminum parts used in the rifle en masse. When the design was exported, the US often exported precision aluminum foundry and machining technology at the same time. That limited adoption as a practical matter.

All that said, the reputation of both the AK47 and AR15 suffer from relatively isolated instances of defective implementation. A well-made AK47 has perfectly serviceable accuracy, comparable to many European assault rifles. However, its operational ergonomics are atrocious. By the same token, the AR15 functions far better in filthy environments than popular mythology suggests; most infamous incidents of documented systemic failure were ultimately traced back to out-of-spec components. An AR15 will not take quite as much abuse as an AK47, but it makes up for it by being one of the most highly optimized assault rifles in the hands of a skilled operator due to the unusual operating design.

In short, both the AK47 and AR15 offered compelling economics because they were designed for and used by disjoint markets with very different priorities.

<comment><USER5> _However, its operational ergonomics are atrocious_

I had to read that twice and I'm still not sure. You mean economics, right?

<comment><USER4> Nope, I meant ergonomics.

All of the operational mechanics (safety, trigger, magazines, bolt, etc) are very poorly designed for efficient user operation. A number of AK47 clones produced by countries attempt to at least partial rectify that situation. Also, the AK47 has terrible rapid fire characteristics; even a well-trained operator will have a hard time putting bullets on target.

By comparison, the M16 has a well-deserved reputation for being one of the most effective rapid-fire actions ever designed, and with excellent user ergonomics. Even in "spray and pray" mode, an M16 will put a lot more lead on or near the target than an AK47.

<comment><USER5> Thanks for clarifying.

</comment></comment></comment></comment><comment><USER6> >The gun is nothing special. Its controls are unsophisticated; it is not even particularly accurate. But this simplicity is a reason for its success. Compared with other assault rifles, the AK-47 has generous clearance between its moving parts. That is bad for accuracy, but it means that the mechanism is unlikely to jam, no matter how clogged it gets with Sudanese sand or Nicaraguan mud. Designed to be operated by Soviet soldiers wearing thick winter gloves, it is simple enough for untrained recruits (including children) to use.

 _Worse is better._

>Correctness The design must be correct in all observable aspects. _It is slightly better to be simple than correct._

[http://en.wikipedia.org/wiki/Worse_is_better](http://en.wikipedia.org/wiki/Worse_is_better)

<comment><USER7> I'll see your Wikipedia link and raise you one:

[http://en.wikipedia.org/wiki/Eight_dimensions_of_quality](http://en.wikipedia.org/wiki/Eight_dimensions_of_quality)

When you're getting shot at and your life depends on being able to shoot back, reliability trumps all other metrics.

<comment><USER8> I submit that availability trumps even that. In many cases, you would not _have_ a gun if it wasn't as simple and cheap to make as the AK-47.

</comment></comment></comment><comment><USER9> > The gun is nothing special. Its controls are unsophisticated;

That is main feature though. Nothing special _is_ what is special.

When you write code, try to remember the AK-47. Keep it simple, loose components, try to make it fault tolerant if you can. Make it not just easy to use, but also easy to disassemble, inspect and rebuild (design grey boxes not just black boxes).

Is there an AK-47 design pattern, or are they called "stories" these day, anyway I feel like there should be one.

Well, and then of course convince a mega-corporation to buy 100m units of it ;-)

<comment><USER10> "Easy to use" is most often the opposite of "simple, loose components".

Building stuff out of simple components, means to break the problem space into multiple smaller parts. By definition, you'll have more components to deal with. It will also take more time to build something usable. Simplicity is actually hard.

In the case of the AK-47, this is an actual example of simplifying the problem and getting the priorities straight. Such works are so rare because people don't think too much before starting to work on stuff.

</comment></comment><comment><USER11> When experts say that AK47 is not "particularly accurate", it's a bit misleading, because in a battle you don't shoot for bullseye, usually any shot within the inner 30cm (12inches) circle on the target is considered as a hit. Ak47 is certainly not the most accurate weapon, but in a real life situation and within its fire range of about 350 - 400 meters it's accurate enough. In my experience with the Yugoslav version m70 it's really hard to miss anything under 200m and when shooting further than that (because it doesn't have optics in the standard setup) your eyes are a bigger problem than the gun itself.

<comment><USER12> Most people who say that the AK-47 is "not accurate" are just parroting conventional wisdom and have never actually shot one. Poorly made AK-47s might not be accurate, but anything that is poorly made might not be accurate, regardless of the design. Well made AK's are plenty accurate out to hundreds of meters and could easily be used as sniper rifles with a scope. And by "well made" I don't mean a small batch made by a boutique manufacturer, there are millions of rifles made by various companies/countries that are fairly high quality. One of the problems of talking about the "AK-47" in general is that it's actually a family of rifles produced by a huge variety of folks. For example, the actual "AK-47" is fairly rare, most rifles of the type are the AKM model, or some regional variant of the AKM. Meanwhile, you have countries ranging from Bulgaria to Ethiopia to Vietnam all manufacturing their own models, with a very high degree of variation in quality.

</comment></comment><comment><USER13> This post stopped well short of describing the advantages and disadvantages of both AK-47s and M-16s in favor of emphasizing how bad weapons are. The Wikipedia entry is much more informative: [http://en.wikipedia.org/wiki/Comparison_of_the_AK-47_and_M16](http://en.wikipedia.org/wiki/Comparison_of_the_AK-47_and_M16)

</comment><comment><USER14> I think this was well explained in the intro to Lord of War. An amazing movie that asks interesting questions about success as a motivator.

<comment><USER15> Amazing movie? I'll call it pretty solid. Interesting questions? No...

<comment><USER14> Well, it appears we have different opinions. I think that's probably on net an ok thing.

</comment></comment></comment><comment><USER16> everyone with any interest in the AK-47 should read [http://cjchivers.com/aboutthegun](http://cjchivers.com/aboutthegun) (The Gun, by CJ Chivers). Although it spends a lot of time examining historical contexts for machine guns, and assault rifles in general - the AK-47 stuff is great.

The comparison with the M-16 in particular is pretty brutal.

</comment><comment><USER17> Fluff piece, unfortunately.

</comment><comment><USER18> Not to forget, it is pretty easy to copy the AK47 design. The Register once called it The Open Source gun that took the world by storm[0] - it's actually a much better article than the Economist's

[0][http://www.theregister.co.uk/2007/08/03/ak_47_60_years/](http://www.theregister.co.uk/2007/08/03/ak_47_60_years/)

</comment><comment><USER19> Tl;dr

It's a "good enough" gun that the Soviets and licensees made over 100m of. Guns, parts and ammo are available anywhere.

<comment><USER20> In my mind that is the only reason, because the USSR made a whole lot of them, and then shipped them out to every third-world country.

It is for a similar reason AR-15s are so popular here in the USA, because the US Military mostly uses M16s ,which are almost the same, and therefore they are the "cool, I'm almost-for-really a soldier now" gun.

<comment><USER21> The popularity of the AR-15 is related to the popularity of the M16, but the "pretend you're a soldier" aspect isn't the main reason. A more complete explanation includes:

\- Lots of manufacturers

\- Reliable action (depending on manufacturer)

\- 5.56mm NATO and/or .223 Remington ammo is (or, before late 2012, was) relatively cheap

\- Light recoil

\- Tons of accessories available

\- Relatively accurate

\- Fun to shoot

And also, among gun guys, there's at least a little bit of the feeling that by owning one, you're giving the middle finger to people who want to ban them.

<comment><USER22> The AR pattern of rifles has also evolved into something highly modular in the past 20 years. The same lower receiver can be swapped into an upper receiver set up for anything from long distance precision target shooting to close- quarters room clearing.

Saying someone owns an AR is sort of like (loosely) saying they own a PC - that could mean anything from an Intel NUC to a Xeon workstation in a huge case. There's a common architecture, but it's the flexibility of the architecture that makes it popular.

</comment></comment></comment></comment><comment><USER23> A perfect example of the K.I.S.S. Principle.

</comment><comment><USER24> Okay, I get that the AK is the most popular military rifle in the world, but there are many superior rifles that are just as reliable. I happen to own an AK and \- the gun looks/feels flimsy, \- muzzle flip results in a nasty cheek slap, \- the receiver looks like folded sheet metal, \- safety is hard to engage/disengage and leaves a nasty scratch on the receiver, \- the magazine doesn't fit right in (must insert the lip first at an awkward angle), \- field stripping is easy but reassembly is a pain in the a$$.

The M1A... now that's a solid reliable/accurate rifle.

<comment><USER25> The safety was one of the few obviously 'wrong' aspects of the AK design; not only is it on the wrong side of the receiver for right-handed operators, requiring them to reach-over to engage, but it also makes a distinctive CLACK noise that resulted in many of its users being detected and killed. Rhodesian forces developed 'cover shooting' as a technique for responding to this noise, controlled firing into any clumps of vegetation capable of hiding the shooter.

Pedantry on the title: the AK-47 was never popular, it was heavy and expensive. It was issued only to selected Soviet troops whilst the remainder used the semi-automatic SKS rifle. It was the AKM of the 1950s that became a runaway success.

<comment><USER26> Also ironically, it was AKM that moved from milled receiver to stamped, making it both lighter and less expensive, but giving garage experts a reason to complain about.

</comment></comment></comment><comment><USER27> So simple even a chimp can operate?

[http://youtu.be/GhxqIITtTtU](http://youtu.be/GhxqIITtTtU)

</comment><comment><USER28> Unlike the ar* and generally americans weapons, it can shoot in 'sandy' situations.

</comment><comment><USER29> Simple, and easy to use UI; Robust and reliable; Extensible design; Massively scalable

</comment><comment><USER30> Because it is simple and good-enough.)</comment>


What's the best health insurance company for catastrophic coverage?  Kaiser?  BC/Tonik?  State Farm? - <AUTHOR>

<comment><AUTHOR> Paul Buchheit just linked to Tonik from his blog. Anyone have any experience with BC/Tonik? Are they any good? How about Kaiser? Someone mentioned State Farm as well. Kaiser's cheapest CA plan is $109 a month for a $1500 deductible, Tonik is around $89 for a $3k deductible. Is there a good link to reviews of these plans?

<comment><USER2> Definitely not a fan of Kaiser. They're really restrictive and extremely good at avoiding proper treatment from what I've seen. With most normal HMOs you can at least see a variety of somewhat-independent doctors and some quite- independent specialists. It's easy to move around. I hate to recommend any insurance company but Blue Shield of California did okay for me.</comment></comment>


Video Stabilization on YouTube - <AUTHOR> http://googleresearch.blogspot.in/2012/05/video-stabilization-on-youtube.html <comment><USER2> Seems to work well- I just tried it on a tiger cub vid, which I've had for years and was taken with an el-cheapo digital camera: Shaky version: <http://youtu.be/g5P9WwHdOSI> Stabilised version <http://youtu.be/wXfbRUk_1Bg>

There is some motion blur (around 24 seconds, when the momma tiger lies down) which is a bit puzzling once the image has been stabilised. But hey, it's better than it was before.

<comment><USER3> The motion blur was there in the first place, you just don't notice it because there's also _motion_. When you remove the motion (shaking, jerking the camera), you're left with just the blur.

<comment><USER2> Yes, I know. But the viewer won't know that, because they don't know where the motion was before it was stabilised.

</comment></comment></comment><comment><USER4> As mentioned in the blogpost, the rolling-shutter version of this won the best paper prize at the International Conference on Computation Photography (ICCP), which was held last weekend in Seattle. This is a fairly new but very high quality conference. In many respects, I prefer it to the standard-bearing vision conferences like CVPR, ICCV, or ECCV -- although of course, ICCP is more narrowly focused on computational imaging and photography applications.

In their talk, the authors of this work showed many more video results and they were all quite impressive. In fact, they were good enough to fall into an "uncanny valley of motion", similar to the "uncanny valley" of faces or humans [1] that most people are familiar with. I.e., the motion correction was _almost_ perfect, but just enough off that something felt vaguely surreal about the results. Nevertheless, it's a nice step forward.

Also, as others have pointed out, this is a fully uncalibrated method -- requiring no knowledge of how the video was captured. If you do have some knowledge, then you can often exploit it to do better. But the authors mentioned that most videos uploaded to youtube have either no calibration information, or if present, it's often incorrect. As such, it made sense for them to focus on the uncalibrated case.

Finally, I should point out that rolling shutter, standard on most mobile cameras, is causing all sorts of problems for traditional image and video analysis algorithms, which often make the assumption, sometimes implicitly, that the entire frame was captured at a single instance in time. This is not true anymore, and can lead to gross errors in many methods. Hence the many recent papers on correcting for, and in some cases exploiting, rolling shutter effects.

A recent interesting work along these lines from my former lab at Columbia University is "coded rolling shutter photography: flexible space-time photography" [2]. This paper takes advantage of the fact that different rows in an image are seeing the world at slightly different instances in time to do things like high-speed photography, HDR imaging, etc.

[1] <http://en.wikipedia.org/wiki/Uncanny_valley>

[2] <http://www.cs.columbia.edu/CAVE/projects/crsp/>

<comment><USER5> > Finally, I should point out that rolling shutter, standard on most mobile > cameras, is causing all sorts of problems for traditional image and video > analysis algorithms, which often make the assumption, sometimes implicitly, > that the entire frame was captured at a single instance in time. This is not > true anymore, and can lead to gross errors in many methods. Hence the many > recent papers on correcting for, and in some cases exploiting, rolling > shutter effects.

This is not just true of mobile phones, but of any current CMOS-sensored imaging device (most of them on the market). Compact cameras and SLR's included.

</comment></comment><comment><USER6> You can try something similar on linux using transcode with these two lines:

        transcode -J stabilize --mplayer_probe -i $infile
        transcode -J transform --mplayer_probe -i $infile -y xvid4 -o $outfile

I found this blog post with more info: <http://kevin.deldycke.com/tag/transcode/>

<comment><USER7> Just as a note for anyone using this, you'll want to read some of the options as well. The amount of smoothing is hard to get right automatically, and you will want different values for different effects.

Having said that, my results with this tool have been excellent in the past.

</comment></comment><comment><USER8> I really hope this keeps being optional because otherwise a lot of the authentic value of the videos will be lost. Also, the demo they showed looked like it was algorithmically deteriorated to make the change more noticeable. There's shaky hands and then there's parkinsons-level shaking which was what the demo showed...

<comment><USER9> "...algorithmically deteriorated..."

Or the person holding the camera was shaking like mad to demonstrate the abilities of the algorithm. Artistically speaking, shake removal is also authenticity removal. But most times, personal videos are shot by people with no eye for framing and stability. And most times, artistic (and professionals) videos _are_ shot with an eye toward these things.

I can't foresee a reason not to keep this feature as an option rather than enforcing it on all uploads.

<comment><USER10> If you look carefully, the shakes appear too uniform to be a person shaking the camera. It looks like the camera always "shakes" in a circular motion around the center of the original camera location.

<comment><USER11> Probably a staged setup, inducing a regular shaking pattern, but I think generating rolling shutter algorithmicly would be a stretch for them, so I call physical but maybe voluntary shake.

<comment><USER12> Or maybe it's due to the 'rolling' shutter causing shear stretching as mentioned in the article

<comment><USER11> But the point is that if they faked shaking algorithmically then the original signal would be shear-free right ?

</comment></comment></comment></comment></comment></comment><comment><USER13> That video demo was quite impressive.

I've used video stabilizer filters on virtualdub but I doubt they could fix as much as was done in that demo.

Another interesting stabilization demo <http://www.youtube.com/watch?v=_Pr_fpbAok8>

</comment><comment><USER14> I'd like to see this come in Android so you can automatically shoot and record videos without the shaking in them. It would be a great selling point in my opinion.

<comment><USER15> You should already start to see that working its way out: the iPhone 4S does video stabilisation, I am sure high-end Android phones do or will start to do the same.

The algorithm being discussed here is specifically designed for when information about the camera or environment is _not_ available: there are much better ways of carrying out digital image stabilisation on the device itself, such as using the accelerometer data to compensate, or in significantly advanced cameras (DSLRs, for example) compensating by moving the lens itself.

<comment><USER16> The iPhone 4S algorithm is far less aggressive than YouTube's.

</comment></comment></comment><comment><USER17> I wonder when will we get this quality <http://pages.cs.wisc.edu/~fliu/project/3dstab.htm>

<comment><USER18> Have you tried it? I have and I'd say the quality is pretty close if not the same. The much bigger problem to solve now is that shaky videos shot in less- than-perfect lighting contain motion blur, which is extremely hard to remove. You'll notice that all of these demo videos were conveniently shot outside in direct sunlight and contain no motion blur at all.

<comment><USER17> I have only tried the one offered by YouTube, and not recently. I don't know if they have improved the algorithm in this respect, but for what I've seen in the past, the filter often creates a very eerie wobbly effect on the video, an effect that makes it look fake, like being underwater or drunk. It is slightly visible in the demo video if you observe the borders. This strange effect is totally absent on the link I posted, which I believe it's on a different level of quality. But I imagine it's computationally very expensive and can't be offered to millions of users for free.

<comment><USER18> An eerie wobbly effect is definitely visible to me in the videos from that paper.

</comment></comment></comment></comment><comment><USER19> They should apply this during movie fighting scenes. Then we might actually see the fight instead of the blur caused by "exciting cameras".

<comment><USER13> I wish my tv/movie playback devices had a "de-lensflare" filter.

<comment><USER20> Are you referring to JJ Abrams recent flirts with anisotropic lenses?

</comment></comment></comment><comment><USER21> Protip: add ?m=1 to the end of blogger urls to remove the pointless javascript bloat.

</comment><comment><USER22> Isn't quality inherently lost because the same video has to be reencoded again but without the shakes? Also, I just tested on a video and it looked slightly smudgy. OK, so if I am filming driving down a dirt road or after half a bottle of Jack Daniel's (or both) then it'd be good, otherwise it does more harm than good.

<comment><USER23> As I understand it the motion blur is a product of lossy compression (CCD has very short pixel-local exposure times; the shearing the article refers to appears when sweeping the whole image); which means that yes, stabilisation algorithms would work best with source data that hasn't been compressed using a perceptual model of motion blur.

</comment></comment><comment><USER24> What's the next step? Include accelerometer data from the camera, synced with the video, to use as support for stabilizing algorithms.

<comment><USER25> that's a really good idea actually. Maybe the video container format could add that metadata support.

</comment></comment><comment><USER26> Submitting video to a streaming service makes your content look _better_.

Shows how far we are in this whole cloud era.

</comment><comment><USER27> Automatically?

 _sigh_</comment>


Man coughed up an intact blood clot shaped like a lung passage - <AUTHOR> https://www.theatlantic.com/health/archive/2018/12/bronchial-blood-clot/577480/ <comment><USER2> A _36-year-old_ with end-stage heart failure?</comment>


Mark Zuckerberg Explaining the Internet to US Senators - <AUTHOR> https://dms.licdn.com/playback/C5105AQF63ZugEUGMTQ/a6a7f3898b0f439daf3c6a282aef1693/feedshare-mp4_500/1479932728445-v0ch3x?e=1523970000&v=beta&t=Cxobbi9AzbXKdWu73p1UCAHm80vxFbNK0McgBJq-56Q <comment><USER2> Question # 3 about FB tracking people who have logged off the platform seems valid. Ads re-targeting via Facebook pixel is a thing.

But Cnet has included it in the video as a joke. So, I guess you can't trust even "tech" sites to know their stuff?

</comment><comment><USER3> Boy he did a good job of containing the WTF.

Reminds me of helping my mom with computer stuff, but he's way more composed.

</comment><comment><USER4> Putting aside the silly music, there is a serious discussion about how we allow such ill-qualified people to question people in this sort of setup.

<comment><USER5> Old people vote, old people don't care about these issues. Seems pretty straightforward to me.</comment></comment>


Ask PG: Would you consider open sourcing your new DMCA copy? - <AUTHOR>

Maybe similar to Automattic's Privacy Policy: http://automattic.com/privacy/
I think there's a real need amongst startups for decent DMCA notice boilerplate.
Edit: As pbhjpbhj points out below, I'm asking if PG would "allow people to use the contents of this page, https://news.ycombinator.com/dmca.html, [suitably adapted] on their own websites." <comment><USER2> In case it's not clear wikiburner means allow people to use the contents of this page, <https://news.ycombinator.com/dmca.html>, [suitably adapted] on their own websites.</comment>


Tell HN: 2 weeks ago, I didnt know programming. I just wrote a web scraper. - <AUTHOR>

Feeling really chuffed and had to share. Great way to end the year.
To all business MBA guys learning to code: you can do it! just get started!!
Happy New Year guys :)
P.S It was in C# in case anyone is wondering. <comment><USER2> > _To all business MBA guys learning to code: you can do it! just get > started!!_

No, all of you can't. But it's not a bad idea to try and see if you think you'd like it!

I am reminded of the half-joking book title: "Learn to Program in 21 Years".

<comment><USER3> "Teach Yourself Programming in Ten Years"

<http://norvig.com/21-days.html>

</comment></comment><comment><USER4> Congrats. Programming is made out to be a hard thing and for people who don't think logically it is. But to a logically thinking person it's like the greatest game you'll ever discover.

<comment><AUTHOR> I was intimidated for the longest time about picking it up. Partly because I wasn't spectacular at math or algebra or statistics and all the arcane calculus.

Part of the perfectionist in me was also trying to understand everything that happened. Like what actually happens when I enter Console.WriteLine("Hello world");? That is always going to be a losing better so I've since subscribed to the "I know how to drive but I don't know how a car operates" school of thought.

Somewhere along the way, I realised programming isnt about hardcore math but more like just grouping actions together in a logical manner.

<comment><USER5> Perhaps programming doesn't resemble your perception of the maths you've been exposed to, but honestly all of maths is grouping together actions in a logical way. Programming is very much a certain kind of mathematics (though if it helps to think of them as distinct, by all means do so!).

I relate very much to your perfectionist statement. Keep in mind that each thing you learn about how the underlying machine operates will make you a more effective programmer. Learn about the craft of programming (patterns of design, abstraction, etc.), but don't lose sight of the fact that programs run on physical machines, and our bound by the properties of those machines.

</comment></comment></comment><comment><USER6> Way to go. Now make sure you save your code and take a look at it in a year. That's when you'll really see how far you've come.

</comment><comment><USER7> Congrats, glad to hear you had success. I'm curious as to why you started with C#. Most people these days are steered the way of Python or Ruby it seems. Care you elaborate on your goals?

<comment><AUTHOR> My cofounders were C# guys. One new benefit I thought of recently was that C# is similar to Java and thats what mobile apps are coded apart from Objective-C. Who says the MVP has to be a webapp? :)

In anycase, my thinking was just get started first. Im probably going to dabble in Python or Ruby (probably Python) just to see what its like at some point. But for the time being, just getting my head down and writing code and asking really n00b questions on stackoverflow is definitely the way to go.

<comment><USER8> If you're interested in web scraping, take a look at Mechanize (it's available for Perl, Python, and Ruby, at least, though I prefer Ruby) - it makes web scraping _trivial_.

<comment><AUTHOR> Im not interested in web scraping per se but in my previous gig, I was doing erm some 'marketing' through social networks and I was frustrated at not being able to contribute more actively to the process. The marketing work was essentially a programmers job.

So its nice to be able to look under the hood now and see whats going on!

</comment></comment></comment></comment><comment><USER9> I would venture to say that you knew programming, you just didn't know _coding_. Organizing a good program is not all that different from organizing a good business.

<comment><USER10> I want to say you're totally wrong and ignorant, but in case you have a good point, please explain. How is organizing a business like organizing a program, practically speaking?

<comment><USER9> I was trying to keep my comment succinct, but what I mean is that at the fundamental level, programming is problem solving, and so is running a business. The ins and outs of particular businesses and particular programming languages or computing platforms may vary, but if you're skilled at problem solving (and it is a skill) then that skill is equally applicable in both arenas.

</comment></comment></comment><comment><USER11> I did almost this exact same thing back in 2005. I had not programmed anything in YEARS and I had to help write part of a system that performed DB queries, screen scraped, file transfers, etc.

In a 24 period I tried Java, Perl and Python and in the end Python won by miles and miles. I now use Python daily for all sorts of tasks. I love it.

<comment><AUTHOR> You mean in 24 hours? I think its gonna take me at least a few days lol

</comment></comment><comment><USER12> Good for you. Personal development never ends.

</comment><comment><USER13> Yeah, that was what I did when I didn't know anything about programming, too.

The next step is to learn why web scraping is discouraged, and how to use public APIs instead.

<comment><USER14> > The next step is to learn why web scraping is discouraged, and how to use > public APIs instead.

Right, just like google uses public api's to access all those sites. Web scraping is responsible for a very large portion of all the traffic on port 80 and the number of sites that have published APIs is extremely small compared to the total.

<comment><USER13> I know, it's odd how some people act like all web scraping is a terrible thing, when people have built such large businesses based on it. Companies try very hard to get scraped by Google, and don't like being scraped by other random entities so much - I suppose it depends on your intent. Poorly written spiders are a problem for system admins.

If a resource does have a public API, some very positive things about using that instead are that not only is it less resource intensive for them, it is much easier for you to create and maintain. If you're relying on scraping to get specific info from a site, it's a huge Odin when changes to their HTML break your code.

</comment></comment></comment><comment><USER15> Well done! If you write a detailed account of how you did it, you are bound to inspire a lot more people to try it out.

</comment><comment><USER16> Your next step on the path to being a hacker is to share your work. Where can we see your "web scraper" in action?

<comment><AUTHOR> I don't know where can I post it? Probably post it to my blog once I've commented it up. Heading out for dinner with the gf so check later! FYI, it looks like a thing of beauty to me but it probably looks like dogshit to the pros. lol.

<comment><USER16> You will learn a great deal by posting your work for others to see. At first it will feel uncomfortable. You will be concerned that others will mock your work (and they might). But, by the 3rd or 4th time you post your work you will start to feel comfortable with it. The important point is that others will benefit from your experience. Karma.

<comment><AUTHOR> What a nice thought. Someday someone is going to benefit from the code I wrote. LOL!

I feel like 10,000 miles away from that right now.

</comment></comment></comment></comment><comment><USER8> If you'll permit me to be annoyingly geeky, "That's good. You have taken your first step into a larger world." :)

<comment><AUTHOR> Achievement unlocked! Startup Padawan ranked attained!

</comment></comment><comment><AUTHOR> Thanks for the support and positive comments guys :)

</comment><comment><USER17> Well done!

</comment><comment><USER18> Congratulations.</comment>


MacOS Sierra Removes Option to Install Apps from Anywhere - <AUTHOR> https://www.onthewire.io/apple-upgrades-security-for-ios-and-macos/ <comment><USER2> Misleading headline, IMO - they didn't remove the option, they removed the option AS A DEFAULT.</comment>


Executive Summary: 'The vast majority only have one online subscription' - <AUTHOR> http://www.digitalnewsreport.org/survey/2019/overview-key-findings-2019/ <comment><USER2> Everything new is old. It would be more funny if it wasn't so frustrating.

 _News organisations are increasingly looking to subscription and membership or other forms of reader contribution to pay the bills in a so-called 'pivot to paid'._

Right, so just the way newspapers were forever. There was a brief few years where all the online newspapers had a good old fashioned Mexican standoff about who would put their content behind a paywall first. Now they they've all taken the plunge, we are back to the 1950s.

 _Platforms are rethinking their responsibilities in the face of events (Christchurch attacks, Molly Russell suicide) and regulatory threats, with Facebook rebalancing its business towards messaging apps and groups – the so- called 'pivot to private'._

Right, a communication medium where people send messages to each other one-on- one or to select groups.

 _Meanwhile audiences continue to embrace on-demand formats with new excitement around podcasts (New York Times, Guardian) and voice technologies – the so-called 'pivot to audio'._

Audio? Imagine that. My grandparents next to their big honkin' living room radio would laugh their heads off.</comment>


Show HN: Keep your page's timestamps up to date (weekend project) - <AUTHOR> http://prezjordan.github.io/uptodate/

<comment><USER2> I wrote something similar a while back (in 2005, apparently). It's not quite how I'd write it now, but I'm not too embarrassed by my code from eight years ago!

<http://po-ru.com/clock.js></comment>