MIT Drake - <AUTHOR> https://drake.mit.edu/ <comment><USER2> Having taken Tedrake's underactuated robotics class which uses Drake's python bindings, it is an amazing collection of tools and examples of algorithms. Really great for learning.

I would say is very focused on research and quick prototyping, however.

MIT Driverless experimented with using Drake in 2018-19 race car, but we found that just implementing everything in eigen was more flexible, removed a dependency, and more transparent for tinkering.

<comment><USER3> Ah the classic problem. Someday we'll get our shit together in Haskell land and just blow away these awful protype/production dicotomies.

<comment><USER4> Not if the smalltalkers get there first

<comment><USER5> Not if CPU's are fast enough to do it in Julia :-)

<comment><USER3> Ah, Julia shares my goals, but I really don't like it's methods.

To be we absolutely need static types and super high level stuff to both:

\- keep the code closer to it's purpose

(e.g. do linear algebra and proof of why this program does the stats you want it to together)

\- be super architecture agnostic

(With lambda generalized to arbitrary categorizes we can just elaborate to Vect and fuse functional pipelines with matrix multiplication).

([https://ncatlab.org/nlab/show/Vect](https://ncatlab.org/nlab/show/Vect))

</comment></comment></comment></comment></comment><comment><USER6> "Model-based design and verification for robotics."

>Drake ("dragon" in Middle English) is a C++ toolbox started by the Robot Locomotion Group at the MIT Computer Science and Artificial Intelligence Lab (CSAIL).

</comment><comment><USER7> I thought this was going to be [https://www.factual.com/blog/introducing- drake-a-kind-of-mak...](https://www.factual.com/blog/introducing-drake-a-kind- of-make-for-data/)

</comment><comment><USER8> Cmake project that depends on a specific distribution to be built _from source_? I know, it's 2020, we have Docker and things, but but but that's not how it works folks!</comment>


My Engineyard Contest Odyssey - <AUTHOR> http://alan.dipert.org/post/146555473/my-engineyard-contest-odyssey

<comment><USER2> Looking at the C code, here are a few suggestions:

\- __builtin_popcount() and __builtin_popcountll() are great gcc builtins which perform bit population counts, useful for hamming distances (after the XOR operation, of course). [1]

\- avoid scanf(), which is costly. My approach was to generate a header file with the char * words[] array, and also a int words_len[] with, you guessed it, the pre-computed lengths. Then go for the memcpy() route and you're in a much better position.

\- speaking of memcpy, gcc provides one that should be optimal in most cases, but for really short words, it might be easiest to write your own. I came across a good article on it [2] but this is what I ended up using:

      void
      c_memcpy (char * dst, char * src, size_t len)
      {
        __builtin_prefetch(dst, 1, 3);
        while (len--) {
          *dst++ = *src++;
        }
      }

[1] [http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Other- Builtins.h...](http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Other- Builtins.html)

[2] <http://www.embedded.com/columns/technicalinsights/19205567>

<comment><AUTHOR> Thanks for the tips. gcc builtins are definitely the next level for me.

I'm curious about your scanf point though. I'm using scanf/strdup before the check loop to load the words into memory. Are subsequent memcpy calls on an implicitly loaded *char dict[] array faster on non-malloc'd memory for some reason?

<comment><USER2> Unfortunately, I have no empirical data or to support that hard-coding in a payload has an advantage over a dynamic allocation. As an aside, the Python dictionary (hash table for you rubyists/perlfaces) works this way, as it over- resizes to allow growth, unless you specify its maximum size (__slots__ I think?)

My hope and understanding are that the compiler's static analysis skills will best align the given data, whereas something like malloc() would try to allocate on the heap _as best it can_ with the open possibility of other data needing to be on the heap as well.

The point I was driving at, and what I tried to do, was to hard-code in as many known variables as possible such that the compiler could do its thing and try to be as efficient as it could with the given data. This includes the word list, the list of lengths, the target hash -- none of which has to be done by hand, but rather a higher-level script called before compilation.

Good times.

<comment><AUTHOR> That makes sense, I might test it sometime.

</comment></comment></comment></comment><comment><USER3> Great writeup, thanks! I'm confused by your conclusion, though: "I wish I would have identified Rackspace initially as the platform of choice."

From the results of the contest, I would have concluded that the platform of choice was CUDA. Do you think otherwise? Is there a reason you'd choose to use a flotilla of Rackspace servers for a problem like this rather than a graphics card? If you are going to be programming in C anyway, it seems like a much simpler approach.

<comment><AUTHOR> If I was using just my own machine, or spent a few grand to put together my own CUDA farm, CUDA would have been great.

I think using cloud resources was the way to go though, because it's easy to search for keys concurrently, and you can summon an effectively unlimited amount of computing power pretty cheaply. You can add as many cloud servers as you want to your cluster without worrying about locking or divvying up work, and the number of keys your cluster is able to check per second increases linearly with the number of machines.

The winning team, awesome guys with a cluster of 8 very powerful computers and a CUDA program, were able to check just over 400 million keys per second. If I would have used 400 Rackspace cloud servers, it would have cost me about $100 to run them for the duration of the contest and I would have been achieving similar speeds.

<comment><USER4> Looks like the winning team was able to generate more than 400 million keys per second.

"With all the machines running we got up to a total of 3079431974 hashes/second" (via <http://www.win.tue.nl/cccc/sha-1-challenge.html>)

<comment><AUTHOR> Uhoh - I missed decimal place. 3 billion/sec would mean about 3000 of the cheapest Rackspace cloud machines, which could have been operated for 18 hours for about $810. I'm not sure Rackspace lets you have that many though.

</comment></comment></comment></comment><comment><USER5> I'd like to see CUDA Cloud Hosting. The contest's result are showing that'd be an awesome solution for heavy computational problems.</comment>


DSS, a deterministic way to manage CSS - <AUTHOR> https://survivejs.com/blog/dss-interview <comment><USER2> What problem is this trying to solve? I don't see what benefit there is to generating a unique CSS class for each individual style; it just seems like a reimplementation of inline styles.

 _In addition to that with atomic CSS your application bundle size grows, i.e., at some point, you can keep adding CSS, but the file size of your CSS bundle won 't change (increase)._

It should be noted that this is absolutely not true if your application uses static rendering. Sure, you might be able to avoid multiple references to the same CSS rule in your stylesheet but now your compiled HTML is even more bloated. A button from any given CSS framework takes 5-12 CSS rules to look decent. Now imagine creating a unique class name for each rule and applying that to every button on the page.

There's also the issue of swapping styles in the browser to get a sense of how things look. I maintain an internal admin UI where the navbar is styled differently depending on the environment to avoid a developer accidentally affecting production data. It's a lot easier to swap `.dev` with `.prod` on an element than it is to swap out all of these class names or restart my web server, overriding the environment. DSS also means that your developers will have to sift through a lot of useless noise when inspecting the DOM; pull up [https://dss-lang.com/](https://dss-lang.com/) in your browser's DOM inspector and tell me if that's something you'd enjoy working with.

<comment><AUTHOR> > it just seems like a reimplementation of inline styles.

In a way it is but with some important differences:

\- You still write styles in regular files instead of inline. You then reference those in your templates and the library replaces them with the corresponding atomic CSS classes. \- See my reply to CGamesPlay.

> with atomic CSS your application bundle size grows, i.e., at some point

your application bundle size grows "logarithmically"! Probably "logarithmically" got accidentally deleted.

In a way CSS is an "append only" language (or at least that's how it ends up being used) and the more features you add the more your bundles grow. With atomic CSS classes this is not an issue.

> A button from any given CSS framework takes 5-12 CSS rules to look decent. > Now imagine creating a unique class name for each rule and applying that to > every button on the page.

Just to make sure that it is clear enough, you as developer don't generate/apply unique classes by hand. Instead you reference rules which map to sets of atomic classes.

> HTML is even more bloated

True, but I believe that this approach is fairly gzip friendly. So repetition is not an issue.

> There's also the issue of swapping styles in the browser to get a sense of > how things look.

Controlling things globally could be handy but it won't scale. I don't think that it is a deal breaker to toggle some state in your app and hit refresh.

> DSS also means that your developers will have to sift through a lot of > useless noise when inspecting the DOM

DSS already allows to include readable class names and I am planning to use those to add source maps.

-

All your concerns and comments are valid however atomic CSS has its benefits (companies like Linkedin, Facebook and Twitter use solutions that compile to those kind of classes).

The main feature of DSS is deterministic styles resolution anyway, atomic CSS classes are only the medium to achieve that with plain old static CSS.

<comment><USER2> _True, but I believe that this approach is fairly gzip friendly. So repetition is not an issue._

Ok, that's true. But what about browser caching? Using traditional CSS, users only have to visit one page and they've downloaded the stylesheet for the entire site. They can navigate to 100 other pages and never have to re- download the stylesheet because it's cached. With DSS, our CSS files are smaller but our HTML bodies are larger due to all of these class names. That means every time we load a new page, we're downloading thousands of bytes of class names that we already have. For static rendering this is a no-go, regardless of gzip.

 _Controlling things globally could be handy but it won 't scale. I don't think that it is a deal breaker to toggle some state in your app and hit refresh._

It's a deal breaker for me because my designer doesn't know Elixir. You act like toggling "some state" within an application is trivial. Maybe it is to you or me but it might not be to one of your team members who is only concerned with the CSS. I don't know what you mean by "won't scale". We're talking about changing styles in the browser. This is a developer workflow issue, not a technical issue.

 _The main feature of DSS is deterministic styles resolution anyway, atomic CSS classes are only the medium to achieve that with plain old static CSS._

Not true. There's another way to achieve that: good CSS.

<comment><AUTHOR> Typically this is a concern only for server side rendered and dynamic pages.

When you render on the client you don't have these kind of issues (only pros).

When pages are fully static (e.g. a landing page) you can configure your server (or proxy) to also send the right headers so that even the HTML is cached.

In the case of dynamic SSR pages instead you lose caching but that's not an issue imho. You should optimize for initial rendering and delivery a small amount of CSS (critical CSS) is a recognized best practice. Again gzipped the HTML is fine dss-lang.com's heaviest page is 6kb.

> It's a deal breaker for me because my designer doesn't know Elixir. You act > like toggling "some state" within an application is trivial. Maybe it is to > you or me but it might not be to one of your team members who is only > concerned with the CSS. I don't know what you mean by "won't scale". We're > talking about changing styles in the browser. This is a developer workflow > issue, not a technical issue.

As I said you can add readable class names and can tweak styles in the browser and then copy/paste to the .css file. I am also going to add source maps support.

If designers are authoring production or dev styles they should be able to control simple states like that (the same way they should be able to add a css class to an html element in your templates).

An escape hatch could be introducing a `:global` pseudo class like in css modules - it'd allow to add the dev and prod classes you are talking about but it would break deterministic styles resolution (unless everything is wrapped with one or the other).

> Not true. There's another way to achieve that: good CSS.

Define "good". Even if you have a reasonable definition, experience has taught me that it is very hard to do so (specially when you work in teams) see this thread: [https://twitter.com/giuseppegurgone/status/10285952078251868...](https://twitter.com/giuseppegurgone/status/1028595207825186816)

</comment></comment></comment></comment><comment><USER3> Why not just switch to inline style attributes? It seems like moving those styles into a CSS class is an unnecessary level of indirection.

<comment><AUTHOR> It is an option and some have tried that but eventually switched to a similar model as the one described in the article because inline styles were underperforming when compared to class names (I imagine that React could be also part of the problem). See [https://github.com/necolas/react-native- web/pull/283#issueco...](https://github.com/necolas/react-native- web/pull/283#issuecomment-266484275) for example.

Another cons of using inline styles is that you cannot use pseudo classes (eg :hover) and media queries.

<comment><USER3> Interesting, thanks for the response. How do you handle pseudo classes and media queries now? Does the pseudo class get transformed into a portion of the class name? If so, do pseudo classes override the determinism, or is it still done right-to-left?

<comment><AUTHOR> > Does the pseudo class get transformed into a portion of the class name?

Yes. I assume that a state eg .foo:hover { color: red } is always more specific than the idle state .foo {}

Atomic CSS classes are sorted so that states and media queries are at the bottom of the bundle and always override basic styles.

There is a comprehensive list of supported css features here [https://dss- lang.com/supported-css-features/](https://dss-lang.com/supported-css- features/)</comment></comment></comment></comment>


Apple kills off DRM for whole iTunes music catalog - <AUTHOR> http://www.crunchgear.com/2009/01/06/live-phil-schillers-macworld-2009-keynote/

<comment><USER2> This is very exciting. I've always bought MP3s from Amazon exclusively because I knew for sure that all Amazon's files are DRM free. With this move by iTunes, it's likely that I'll be picking up some albums on iTunes now if I can't get them in MP3 format from Amazon. Before, I would just live without the music, or buy the CD and rip it.

<comment><USER3> > With this move by iTunes, it's likely that I'll be picking up some albums on > iTunes now if I can't get them in MP3 format from Amazon.

And you won't be able to get them at iTunes either, they use a latter variant of the MPEG codec. (AAC, perhaps you heard of it.)

The good news is that AAC is gaining momentum as a player format. Both the Wii and PSP play it with some SanDisk players supporting. Heck, even the Zune supports it now...

</comment></comment><comment><USER4> The most important option IMO:

        * MacBook Pro 17-inch Hi-Resolution Glossy Widescreen Display
        * MacBook Pro 17-inch Hi-Resolution Antiglare Widescreen Display [Add $50.00]

<comment><USER5> I still don't understand people's problems with glossy.

I have glossy and it is just fine inside, outside, at home, at the coffee shop, etc. I have had to once or twice tilt my screen to avoid some glare.

Do you really have a lot of glare all the time? Do you wear a spelunking hat at work? :)

<comment><USER4> Glare is one problem, but I find seeing my reflection in the screen extremely distracting. Something about that human face keeps pulling me out of the "zone" while I try to code.

PS: I don't know of a better word than "zone" so I hereby name that state Zem, it's like Meditation with the added creativity of Rem sleep. Feel free to start using it in everyday speech.

<comment><USER6> ...wait a minute. You guys actually use the laptop screen rather than an external?

<comment><USER7> ...yeah, because that way you can carry your _lap_ top computer around.

<comment><USER5> Hmm...yes but at home I dock it and use an external keyboard + monitor. It isn't that crazy, that is probably 30% of my laptop usage.

<comment><USER4> So 70% of the time your using the laptop screen.

<comment><USER8> *you're

<comment><USER9> From the default index.html that is placed in a user's Sites folder on Leopard:

"Open System Preferences and click Sharing, then select Web Sharing.

Your _done_. Your site is now available on your private network at home or work."

What, what's that about my done?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Did not see that one coming.

<comment><USER10> They had a part of their library drm-free for a while now. I find it more surprising that they changed their position on their pricing scheme. Didn't they even cancel their deal with NBC because they were not willing to allow flexible pricing on their videos last year?

<comment><AUTHOR> The DRM-free portion of the iTunes library cost extra money, and most tracks didn't have that option.

My uneducated guess is that the 1.69 pricing tier is a trade for stripping DRM off the backcatalogue.

<comment><USER11> DRM free tracks have not cost money for the last year.

<comment><AUTHOR> I-did-not-know-that. (Stop upvoting me for being an idiot!)

</comment></comment></comment></comment></comment><comment><USER12> Is the DRM gone for movies and tv shows too?

<comment><USER13> No. Some music videos are though ($.60 upgrade fee according to the conversion page.)

</comment></comment><comment><USER14> Cool. Does that mean we can have a linux client now?

<comment><USER15> Amazon mp3 supports Linux. It added full album downloads via Linux a few months ago.

<comment><USER16> They are not in Europe yet, though, or are they?

<comment><USER17> They're in the UK at least.

<comment><USER16> So it is only Germany still missing out :-(

<comment><USER18> You forgot Poland.

<comment><USER16> And maybe france and so on... OK, sorry ;-) I only use Amazon.de

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> To upgrade your library go to the iTunes Store. On the right side you'll see iTunes Plus (x). Go there and you can upgrade.

I'm not terribly excited about paying again for the same music, but I hate DRM enough to make this 1-time upgrade.

It looks like we might be in the middle of a pricing war between Amazon and iTunes:

iTunes: $.99 + DRM

Amazon: $.89 + No DRM

iTunes: $.69 + No DRM

Anyone care to guess how low online music will go?

<comment><AUTHOR> $0.30 a song. A significant amount of money for me (and it doesn't detect most of my tracks; I've run one too many ruby scripts on my iTunes Library file). Not worth it.

<comment><USER20> Honestly, if you don't think a piece of music is worth 30¢, you don't really deserve to listen to it.

<comment><AUTHOR> I thought it was worth 99c when I bought it. I don't think it's going to be worth $570 just to strip off a DRM feature that doesn't actually bother me.

<comment><USER20> Ah, I thought you were replying with regard to the question _"Anyone care to guess how low online music will go?"_

In the case of upgrading, I don't disagree. Sorry for the wrongful callout, it just drives me nuts when people have thousands of songs and listen to music all the time and say "it isn't worth paying for."

<comment><AUTHOR> Holy living fuck, I just did the math on how much that upgrade price means I spent on music over the last few years.

<comment><USER21> Seriously!

You saved some time by downloading from iTunes rather than via bittorrent. Was that time worth thousands of dollars?

<comment><AUTHOR> I also think it's wrong to take music without paying for it.

<comment><USER21> s/take/copy/

<comment><AUTHOR> You see, I carefully didn't use the word "steal" to avoid the copyfight pedantry, but that wasn't enough for you. "Copying" commercial music that you didn't pay for is unethical, just like "copying" a typeface family, "copying" a website design, or "copying" and black-labeling a GPL'd software package.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> I don't see .69 songs yet? When does that take effect, I wonder.

<comment><USER10> End of Q1

</comment></comment><comment><USER16> Does DRM-free mean that they don't even encode the name of the buyer into the files?

</comment><comment><USER23> such grand news!!

Tonight at the super table, think about being the hackers on the opposite side of this, trying to make a company around viable DRM technology. Gotta pour a little drink out for them... :)

<comment><AUTHOR> A really good friend of mine works on Blu-Ray BD+. I don't get the feeling he needs any of my sympathy.

</comment></comment><comment><USER24> -10 evil point for apple!

<comment><USER25> +10 evil for apple asking me to pay more money to "upgrade" my DRM tracks to iTunes+

Net: 0

<comment><USER26> How it that evil? You're getting something other than what you originally paid for.

<comment><USER25> I know I paid for a DRM track; its just bittersweet that I'd have to pay for the same song again to not have DRM. That nets Apple 0 good/evil points in my book.

<comment><USER26> You don't have to have it without DRM, and you don't have to pay if you want it to not have DRM. What you're paying less than full price for is a completely different bitstream that happens to be encoded from the same original source. It's not unlike getting a credit toward a CD because you happened to own a tape of the same music, which I think you can agree is a rather novel concept.

<comment><USER27> I can't agree with the novel concept angle here.

There is no need for analogy here. This is precisely getting a new version of software, which is not in any way novel.

A better physical analogy is paying shipping and handling for mailing in a DRM'd CD that won't play on some of the players you own for a DRM-less CD.

</comment></comment></comment></comment></comment></comment><comment><USER28> Well I just voted with my dollars and upgraded my whole library. It finished surprisingly fast considering their servers must be getting hammered right now.

<comment><USER25> Do none of you find it annoying that you have to pay to remove DRM from music that you already paid for? I think this is ludicrous.

<comment><USER7> When you bought the music, you bought it under the DRM agreement. By paying for it, you said you thought it was worth it. And your payment paid for Apple's servers as this happened.

Yeah, it stinks that you have to upgrade. But they aren't forcing it. I'm keeping my DRMed tracks the same until I have a reason to remove the DRM. It's not costing me anything. And I know this is a one-time deal, that I'll never have to pay extra for future tunes.

Annoying? Yes. Ludicrous? No.

<comment><USER25> I'm not paying to upgrade because I know it will cost Apple more $$$ to support my DRM tracks. I figure at some point they'll want to turn off their DRM servers and I can only hope they will have a free upgrade path to iTunes+.

<comment><USER7> What do you expect? They're letting you _re_ download songs that you already bought. They've sold how many million DRM tracks? So now they just turn on their servers and, without charging, let you redownload every song you've ever bought from them? That would kill their server. I doubt even iTunes could support that all at once.

The pricing helps Apple in two ways: it keeps their server going, and, by adding a charge, it discourages everybody from doing it at once, which means iTunes doesn't break. I understand your frustration, but Apple's doing a good thing by making this available. Complaining is fine, but don't act like Apple's the villain for negotiating an end to DRM in the largest store on the planet.

<comment><USER25> You're speculating about Apple throwing up prices to prevent their servers from getting "killed". Why do you think they distribute iTunes media on a CDN?

You're also being a bit presumptuous on your accusations of me thinking Apple is "Evil".

</comment></comment></comment></comment></comment></comment><comment><USER29> Awesome so any good music recommendations, I have never bought from iTunes and I can now, so what should I get?

<comment><USER29> Hmmm really voting with your wallet to not buy DRM music and then supporting the release of not DRM music is a bad thing?

<comment><USER30> Hacker News is not about music recommendations. Read <http://ycombinator.com/newsguidelines.html>

<comment><USER29> That is the guidelines for news submissions, it doesn't say that discussion and comments on submissions can't discuss any topic users find interesting. I think it was related and on topic to the thread.

There has been several threads on HN about what music people listen to while programming.

</comment></comment></comment></comment><comment><USER31> What a phenomenal gesture towards the interest of consumers.</comment>


Facebook Considers Adding a 'Sympathize' Button - <AUTHOR> http://www.theatlantic.com/technology/archive/2013/12/facebook-considers-adding-a-sympathize-button/282126/ <comment><USER2> The "like" button is currently a catch-all. Adding a "sympathize" button will end up with a bunch of unintended hilarity.

<comment><USER3> Yeah, but when one of your friends writes that he's just had his dog put down, another announces that an old venerable club has sadly had to shut down, and a third announces the premature death of a friend of 25 years, you really, really don't want to "like" those posts (all of these examples are in my feed this week, for example).

<comment><USER2> I think that people have unintentionally been conditioned to create posts in order for it to be liked. Instead of just saying their grandparent died, they will instead say what a great person they were and how much they will be missed. The addition of another button only complicates things.

You know, as opposed to: "Me and my baby have been together for 3 months now"... and someone clicking sympathize when they meant like.... and the following shitstorm that would ensue.

</comment></comment></comment><comment><USER4> Should be called the "feel" button</comment>


Why consumers won't buy tablets - <AUTHOR> http://news.cnet.com/8301-19882_3-10303158-250.html?part=rss&subj=news&tag=2547-1_3-0-5

<comment><USER2> I suspect he is right. A year or so my SO wanted a new computer. She's an artist so I suggested a tablet PC so she could draw directly on the screen. No way. She wanted a big honking server class machine, 8 gigabytes, 4 cores that could handle gigabyte Photoshop images, with a big monitor to show all the detail And, oh yes, a Wacom tablet so she could draw pictures. I admit it's not Granny's email laptop, but I suspect Granny doesnt want a tablet either.

<comment><USER3> I agree. But Granny would be fine with a tablet with 17'' screen and full size keyboard.

</comment></comment><comment><USER4> I just got a new computer.

I switched from a tablet that I've had for around a year. I thought the idea of a tablet was neat, I could draw on it, watch movies in bed without the keyboard getting in the way, use it as a book to read PDF's, etc. In reality, however, I never used the tablet functionality, and just used it as a normal PC. So I switched back.

</comment><comment><USER5> These are some of the same arguments that people made to 'prove' an iPhone wouldn't work. Then once they actually see the product they are the first in line to pick one up.</comment>


Ask HN: How can a company build the culture of embracing criticism? - <AUTHOR> What top management can do to change the culture within the organization so the employees embrace criticism instead of avoiding it?<p>UPDATE: I mean the criticism in all directions but above all across employees (horizontal) and from employees to their managers (bottom up). <comment><USER2> Ha. Do you mean that _anyone_ in the company (including top management) should embrace criticism from _anyone_ else in the company (including the employees)? Or do you mean only that the workers should embrace criticism from their bosses?

If the former, then top management should provide live examples of themselves changing their mind based on feedback received from employees. Only then will the employees believe that management means it about creating a culture where people embrace criticism.

If the acceptance of criticism is only intended to go in one direction, from top to bottom, then simply use the standard management tools of reward and punishment.

<comment><AUTHOR> I mean the criticism in all directions but above all across employees (horizontal) and from employees to bosses (bottom up).

</comment></comment><comment><USER3> Have managers at every level read Business @ The Speed of Thought by Bill Gates.</comment>


Ask HN: I need to develop an educational game that is rpg - <AUTHOR>

I need to develop an educational game that is rpg
I'm a web developer, I have no experience in game development but I need to play roles in mobiles and web browser.
that could be used to develop engine? (fast)
thank you very much <comment><USER2> I have just made something like that. Contact me at: daniel_salazar @ hotmail</comment>


You'll never get what you want. - <AUTHOR> http://blog.elliottkember.com/posts/7-Youllnevergetwhatyouwant

<comment><USER2> If what I wanted was to read this article, I'd say that's an accurate title...

"App failed to start

(Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) README Rakefile app config db doc features heroku_env.yml lib log public script test tmp vendor"

</comment><comment><USER3> dupe: <http://news.ycombinator.com/item?id=966412></comment>


Ask HN: Is this the first time Google has run ads in Chrome Browser? - <AUTHOR>

Today I started noticing this when I opened up a new Tab in Google Chrome:
http://i.imgur.com/LotyD.png
There is an ad for their Chrome Notebooks. I don't mind the Chrome Notebook, and I certainly don't mind Google placing ads in their services like Gmail, Search and so on.
However I find it a little different when they place ads within the context of application specific pages.
They built the browser, I got it for free. I understand that. However I find this very unnerving, distasteful, and down-right cheap.
Is this common and I've only just noticed it?
(Seeing it on Chrome 5.0.874.120 and 5.0.874.121 on OSX, but not 17.0.945.0 canary and 17.0.946.0 canary) <comment><USER2> This violates Google's own Software Principles: [http://www.google.com/about/corporate/company/software_princ...](http://www.google.com/about/corporate/company/software_principles.html)

"""

Upfront disclosure

When an application is installed or enabled, it should inform you of its principal and significant functions. And if the application makes money by showing you advertising, it should clearly and conspicuously explain this. This information should be presented in a way that a typical user will see and understand – not buried in small print that requires you to scroll. For example, if the application is paid for by serving pop-up ads or sending your personal data to a third party, that should be made clear to you.

"""

<comment><USER3> I'm not so sure. I mean, you could read it that way if you were determined to do so, but I don't think that's the only reasonable way to read it. This isn't an application making money by showing us advertising — it's Google announcing their new Chromebooks to Chrome fans. That is, it's just a note about something new with Chrome. This doesn't look like the start of in-browser ads as a major monetization strategy for Chrome.

</comment></comment><comment><USER4> The first Chromebook was advertised the same way in the Canary builds. The one that shipped to my zip code did not end up at my house. :)

The ad doesn't show up during apps - at least not that I ever saw, but, only on the app selection page or bookmark page.

It has been used very sparingly and I'm not sure I've seen it more than a handful of times since switching to Canary as my primary browser ages ago.

</comment><comment><USER5> I'm using version 15.0.874.121 on Windows (the "up to date" version as of two minutes ago), it doesn't show anything.

So to add insult to injury, is it possible that this ad is somehow contextual or targeted?

<comment><USER6> Yes, it seems to be targeted. We don't see it from Russia

</comment></comment><comment><USER7> I might be totally lying here but I think I remember seeing something like that promoting Angry Birds for Chrome. My memory's not great so it might've been somewhere else.

</comment><comment><USER8> I remember a similar styled ad notification about a year ago for the cr-48 test in chrome & chromium dev channels.</comment>


Apple Pays No Tax on Much of Its Overseas Income, Senate Panel Finds - <AUTHOR> http://online.wsj.com/article/SB10001424127887324787004578495250424727708.html?mod=WSJ_hpp_LEFTTopStories <comment><USER2> > "What they often leave out is the second part of the story, that Apple is > one of the largest tax avoiders," said Sen. John McCain (R., Ariz.), who > described Apple as the "most egregious offender" among U.S. corporations > trying to avoid tax bills.

That's ludicrous. Apple followed the byzantine tax rules that Congress put in place to benefit their friends and punish their enemies. The correct interpretation of McCain's statement is that Apple is the best at obeying the law in a way most favorable to themselves.

I don't think anyone has a moral obligation to pay more taxes than the law says they owe. If the tax codes are poorly written - as ours most obviously are - then fix those instead of blaming the entities who are working within that framework.

</comment><comment><USER3> Somewhat relevant talk by Milton Friedman that I found enlightening when thinking about these tax matters (economics of tax shelters, tax cuts being the "product" politicians "sell", etc.): <http://www.youtube.com/watch?v=TruCIPy79w8> (I strongly recommend watching all of it, but around 5:50 in he talks about why the tax system will remain complicated if you have an internet attention span).

</comment><comment><USER4> It may be hard to legally define which companies should pay U.S. taxes on products made in Taiwan and sold in Japan.

</comment><comment><USER5> Apple dodged all the taxes they could, and saved $1.9 trillion overseas. When they got called out on it, they hit it right back and said "go right on ahead, fix the loopholes we're using, tax us more, let us help."

<comment><USER6> But then GE would have to pay those taxes too. And with the campaign contributions they make, we can't be having that.

<comment><USER7> right. let's not start pointing fingers.

Google, Microsoft, GE, etc.

"General Electric Paid No Federal Taxes in 2010"

<http://abcnews.go.com/m/story?id=13224558>

"GE's CEO, Jeff Immelt Heads Obama's Council On Jobs And Competitiveness"

[http://www.huffingtonpost.com/mobileweb/2011/01/21/jeffrey-i...](http://www.huffingtonpost.com/mobileweb/2011/01/21/jeffrey- immelt-council-on-jobs-and-competitiveness_n_812005.html)

"Former Google Exec Turns Whistleblower On Company's Tax Avoidance Machinations In The UK"

[http://techcrunch.com/2013/05/19/former-google-exec-turns- wh...](http://techcrunch.com/2013/05/19/former-google-exec-turns-wh..).

</comment></comment></comment><comment><USER8> Stupid headline, well, duh, it's overseas. They pay 7 Billion here.

<comment><USER9> While Apple likely isn't breaking the law (at least not seriously) what you seem to be missing is that as an American, you are liable to pay income tax regardless of where in the world you earn it. 'Technicalities' are allowing Apple (and many many many other companies) to avoid a large amount of the income tax fairness suggests they ought to pay. The article states that Apple pays little to no income tax to _any_ foreign government.

<comment><USER2> But those "technicalities" are the law, as it was written. The rules say "if you meet these conditions, then use this algorithm to calculate your tax bill". The inevitable result is that every company with a halfway competent accounting department pores over the tax code to find the algorithm that results in the lowest tax bill, then figures out how to meet the necessary requirements to use it.

Please note that in no way do I think this is a _good_ thing to do, or that I'm remotely in favor of the current situation. It sucks and I'm not. But Congress _made_ that game, and they completely lack the moral authority to complain about others playing it.

Put this in coding terms, where each tax code requirement is a conditional branch in a `calculateTax()` function. If you write a function with 50,000 conditionals, you simply can't be surprised that someone figures out a way to call the function with arguments that give the best possible output for them. Even worse, _you can't close those loopholes by adding more conditionals_. By definition, you're only creating more optimization paths for them to choose from.

<comment><USER9> I'm not sure what point you're trying to make.

Should Congress not try to fix structural problems in the tax code which allow plenty of corporations avoid tax obligations?

<comment><USER2> Yes, and that's only possible by removing many exemptions, deductions, special cases, etc. Congress should absolutely reform the tax code, and it must be by reducing the number of ways it can be worked around.

</comment></comment></comment></comment></comment><comment><USER10> When your tax rate is high enough, it pays to optimize your cash flows to avoid taxes. If tax rates were more reasonable it wouldn't make sense.</comment>


Introducing RSS 0.99 - <AUTHOR>

See comments in DTD for details, tl;dr there was no RSS with proper DTD (which means that entities were illegal) so i forked RSS 0.91 and created DTD with entities taken from HTML 4.01. I made it mainly for my own use, but it's free to use for everyone.<p>DTD address: http://xenu.cc/rss/rss-0.99.dtd <comment><USER2> Which RSS 0.91 did you fork? Netscape RSS 0.91 or Userland RSS 0.91?

This means, I assume, that there are now _ten_ incompatible versions of RSS, not just nine: <http://diveintomark.org/archives/2004/02/04/incompatible-rss>

Who uses RSS for anything any more? Why wouldn't you just use Atom?

<comment><AUTHOR> It has DTD so obviously I forked it from Netscape RSS. Also, RSS 0.92 is compatible with RSS 0.91 :)</comment></comment>


Ask HN: How to get a Scala graduate position? - <AUTHOR> I've recently been getting increasingly into Scala, slowly going from 'writing Java in a more terse syntax' to 'programming functionally in Scala', playing with Akka actors/streams, and exploring ways of implementing CQRS/Event-sourcing on top of these. Dropped the familiar Spring Boot and its 10 second startup time in favour of Akka HTTP (since all I needed is a REST API anyway).
What I'm getting at is: after the initial pain period, these frameworks fill me with a sense of "oh wow, I really like how this is done". I can't help but love Scala and the ecosystem, I want to explore it further, dig deeper down the FP rabbit-hole, work with actors in the real-world.
I'm now determined to work with Scala when I graduate. The problem is that I'm not seeing Scala Developer openings aimed at graduates. They all seem to be targeting experienced developers. I did some searches on indeed for 'java' and 'scala' in various cities and London's ratio is the most favourable so I'm already searching in the right market.
My current plan is to try to find the time to put out a portfolio piece in Scala and apply for Scala positions, regardless of whether they're taking on graduates. But even then, what can I do to convince this company to take on a Scala newbie without an appropriate graduate program in place, when they could hire an experienced one instead? <comment><USER2> As someone who has to screen way too many "Scala Developer"s, just being able write idiomatic Scala to solve FizzBuzz level problems already puts you head and shoulders above the competition. It's frustrating how often candidates write more or less Java and try to pass it off as Scala.

Scala devs are already quite difficult to find, and we're more than willing to dedicate months of training to get someone up to speed on Scala. I suspect other shops might be the same, so any demonstration of decrease in training time is a huge plus.

<comment><USER3> I wish every Scala house had this attitude.

I'm a .NET developer by day (for the moment, I'm moving jobs soon), and I applied for a handful of Scala roles, and I didn't even get as far as the interview stage for all but one of them. One of them was nice enough to tell me that they wouldn't be continuing with the process because they're looking for the finished article, rather than having to train someone to use Scala. Since the job advert is still coming up on SO Careers I would assume that they're still looking...

</comment></comment><comment><USER4> The best advice I can give is to stop attaching yourself to a specific language. Having expertise in a language can be great, but you are going to be better served by demonstrating the ability to ramp up on any language that is needed. Scala is a solid language, but is plagued with functional purists and a love of domain specific languages. Take the skills and patterns you've learned from Scala and apply them to other jobs.

</comment><comment><USER5> It may just be my experience, but as someone who works with Scala in London the market for Scala jobs is poor. I keep my eye on the market and every now and then get int touch with some company / do an interview, but usually it doesn't go anywhere. I get constantly pestered by recruiters about exact same positions for years now, so it looks like either those companies have a high turnaround or they are super picky and never give anyone a chance.

</comment><comment><USER6> If you are interested in living in the U.S. (Boston area), CiBO Technologies (precision agriculture) is hiring entry-level developers for our Cambridge, MA and St. Louis, MO offices and we are passionate about Scala and functional programming. See cibotechnologies.com for more info on the company. Email me at walter underscore gillett at hotmail dot com (don't want to post my work address here due to spam worries, happy to share via email).

</comment><comment><USER7> Email me (email in profile.)

We're hiring for Scala developers and we're based in Amsterdam. I'll be in London early next year if you want to get coffee.

<comment><AUTHOR> What you're doing sounds so cool, will do!

</comment></comment><comment><USER8> Are you willing to move to Lisbon, Portugal? I know of a few companies using Scala, including my current employer, Feedzai ([https://feedzai.com/](https://feedzai.com/)) - a company that uses ML to detect and prevent fraud on e-commerce

</comment><comment><USER9> supply of scala developers to demand is so unbalanced that you are sure to do fine.

A portfolio that shows that you can complete all facets of a large project (tests, documentation, builds, artifact publishing) will get you hired fine, don't sweat it.

<comment><USER10> Is the demand really all that high? As a scala dev myself, when I look around it always seems like the trend is heading in the wrong direction in terms of the job market.

<comment><USER5> My thoughts exactly. I am at the point of considering switching to another language, because job opportunities with Scala are just abysmal.

<comment><USER11> Just more anecdata; most of the Scala positions I've seen are data engineering roles with Spark. I need to look harder for Scala roles without Spark.

<comment><USER12> Initially that was my experience too but over the past 2 years I've found that more and more places are switching to Java or Python for Spark Data Engineering actually, it might only be in my local market though.

<comment><USER11> Thanks, I will keep that in mind. Additionally, I've been told recently that Scala is losing ground to Go for things not related to data engineering.

</comment></comment></comment></comment></comment></comment><comment><USER13> Here's a few recruiters I've seen that have functional jobs. No affiliation.

[https://functional.works-hub.com/](https://functional.works-hub.com/)

[https://www.signifytechnology.com/job- search](https://www.signifytechnology.com/job-search)

</comment><comment><USER14> Well, there's this (in London):

[https://www.ovoenergy.com/careers/vacancies?gh_jid=903885](https://www.ovoenergy.com/careers/vacancies?gh_jid=903885)

</comment><comment><USER15> If you're in London, hit me up! I work for a mid-large company that is full of Scalia devs. We'd be more than happy to give you an interview :)

<comment><USER13> Can you add an email or website to your profile?

</comment></comment><comment><USER16> Show me you are willing to put in the work! Seriously in need more scala/jvm developers.</comment>


Left Alone by Its Owner, Reddit Soars - <AUTHOR> http://www.nytimes.com/2012/09/03/business/media/reddit-thrives-after-advance-publications-let-it-sink-or-swim.html?hp <comment><USER2> "Steve Newhouse, the chairman of Advance.net, decided very early on that his company would not be the blob that ate Reddit, and for the most part, left well enough alone. "We had some ideas about what would be good, but it might not have worked," Mr. Newhouse said. "We paid attention to the community instead.""

I may be remembering stuff wrong, but wasn't there more tension + conflict during the period right after the acquisition? Didn't Reddit struggle to pay for basic infrastructure stuff due to their new parent company's skepticism about its viability and perception of its value?

<http://blog.reddit.com/2010/07/reddit-needs-help.html>

And it was a long while until it got spun out. (<http://venturebeat.com/2011/09/06/reddit-break-conde-nast/>)

Not that there's anything crazy in any of this. Just that the NYT story paints it like right away they 1) knew Reddit's worth and 2) knew to have a hands-off approach.

I'm far from a Reddit power user, happy to hear other perspectives.

<comment><USER3> Conde rightly gloats about how, during The Sarah Chubb Years, they were hands- off about meddling with reddit as a site, but they're eliding over how, during that same time, they were extremely hands- _on_ about preventing us from hiring people or buying decent computer hardware.

<comment><USER4> This may have been a good thing. Digg didn't have any constraints on buying new hardware and hiring new people, and we can see how that ended (they bought too much, hired too many people, and collapsed)!

<comment><USER3> We weren't asking for unlimited hardware and headcount. We would have been thrilled with a rule that every time traffic doubles, we get to hire one person.

As for hardware, all we wanted was a team printer that didn't jam, an SSD for ketralnis's workstation, and the right for our engineers to substitute an equal-cost laptop of their choice for the IT-approved MacBook.

</comment></comment></comment></comment><comment><USER5> "On Thursday, President Obama signed up for an "Ask Me Anything" (A.M.A. in geekspeak) session at Reddit, a vast social site that is a staple of digital life for the young and connected, but less well known among grown-ups."

How patronizing.

<comment><USER6> Indeed. Reminds me of when people say that IT work should be cheap because "you're just pushing some buttons." Gee, I sure am glad President Obama took some time to join us kiddies in playing with our computers!

<comment><USER7> Pushing buttons does nothing, it's the order in which those buttons are pushed that requires intelligence, skill and experience.

<comment><USER4> Yeah. You're preaching to the choir, though!

</comment></comment></comment></comment><comment><USER8> "If the leader of the free world stops by" - sorry, he's what?

<comment><USER9> This is a pretty common expression for the President of the US: [http://en.wikipedia.org/wiki/Free_World#.22Leader_of_the_Fre...](http://en.wikipedia.org/wiki/Free_World#.22Leader_of_the_Free_World.22)

<comment><USER8> Which goes on to say that it has fallen out of use. It's a ridiculous title.

</comment></comment></comment><comment><USER10> "Strategically, what they have done should be a model of how to create and support a virtual start-up within a larger corporation,' said Anil Dash, a writer and entrepreneur in digital realms."

Well, strategically, they might eventually want to think about making some return on investment for the acquiring investors with actual cash profit. Otherwise, they will eventually be shed at a loss (is anyone else here old enough to remember AOL and Time Warner?).

Strategically, they may also be serving as a cautionary example of why start- ups without a secure revenue model shouldn't be acquired at all, unless there is financial upside for the investors. After all, the article further reports, "Reddit is not an exception to every rule in the digital world. Like many digital media companies, it has a big audience and minuscule revenue."

<comment><USER11> They bought them for 20mil, that's pretty cheap given their userbase. I bet Conde can sell them for more than that now.

</comment></comment><comment><USER12> I'm sorry but the first sentence made me laugh:

"There are many ways to measure the traction of a social media platform: [3 ways, to be exact]"

</comment><comment><USER13> I think it's a shame that Reddit sold so early but at the same time they can think of the users (Until Conde Nast gets involved). There's no question about their valuation and how they'll monetize. They as a company can work on that and build a great product but there aren't daily blogposts on TechCrunch about it.

<comment><USER14> Looking for Techcrunch endorsements is so 2009ish. People who know and can reddit, are doing fine because it is possibly one of the last few places on the Internet where pseudonym and trolling is still alive. You feel gratified by people answering your comment given that you have most likely trolled at first. You eventually get a peace later on because the community kept you alive and kicking. Hence it has all the right ingredients of what social- network should be like on the Internet: free, open and anonymous.

<comment><USER15> A while back I deleted my Reddit account and just recently I've created a new one under my real name. I decided that if I was going to post, I would do so as myself and not hide behind an anonymous name. I hadn't really done any trolling in the past, but I'd participated in discussions I certainly wouldn't have participated in if they could have readily been tracked back to me.

But for better or worse, I decided to go the real name route this time.

The result is that I end up commenting on a lot less time-wasting content (and subsequently reading less because I know I won't participate in the discussion and reading often opinionated comments without participating will just frustrate me), and putting more thought into the responses I do post.

That's not to say that I think there's anything necessarily wrong with the anonymity. Sometimes it's nice to give voice to something you otherwise wouldn't because your opinion is controversial or unpopular (and doing business online, one has to protect one's online reputation and what ends up in the search engines). For me, though, it's translated to less time spent on useless AMA/AskReddit posts, more time spent on meaningful discussion, and less time on the site overall. All of these are good things.

<comment><USER14> Well, that's not a bad decision if it works for you well. But anonymity doesn't necessarily equal to the poster wasting time. I use reddit with pseudonym and I don't troll.

My pseudonym is my authentic identity on Reddit, just as it is here on HN. A while ago I was using one identity here on HN and for one reason or another, some people didn't like what I had to say (even though personally I was very authentic) so they down-voted me so much that my score went in to negative, and I ended up deleting my account and recreating a new one. I have still not given up on being authentic under pseudonym.

The point is that you have to believe in the conversation - gaining and imparting knowledge - and not worry about the fluff and the other distraction of the Internet. The trend to have real names on the Internet, the trend to have face on the Internet....these are all distractions as far as I am concerned.

As long as we are typing and reading each other through letters and words, we don't need to see each others' names and pictures. It would be a different matter when we converse through video and audio.

<comment><USER15> Oh, I agree with you. You don't have to be an ass, just because you're anonymous. I didn't troll, either, but I did find that I felt more free to comment on things I otherwise wouldn't for a variety of reasons.

That's certainly both good and bad.

The negatives, in my case, were that I would end up getting into discussions over trivial topics, or would end up reading tons of comments, some good, some bad, and comment on them just because I could.... For example, if I disagreed with you, I would tell you, event hough most of the time it was over things that just weren't worth the time and effort of getting into a debate with a random stranger over.

On the other hand, posting anonymously also gave me freedom to talk at length about things that matter to me but maybe aren't the best things to go talking about using my real name when everything is indexed in a search engine (politics, religion, etc.). I'll certainly stand up for what I believe in, but in cases like a potential client who may be looking me up on Google, my religious views, for instance, shouldn't be the first thing they find. It's just irrelevant in a work relationship 99% of the time.

So making the switch to my real name, I did lose some of that freedom, and one could argue that this is a bad thing, but for me, the constraints it places on the types of discussions I'm willing to have means better time management and (overall) more thoughtful responses when I do respond. I suppose if there was a real hot-button issue that I felt compelled to comment on, I would create a throw away account and do so, but sticking with my real identity forces me to think and evaluate those situations more closely before doing so.

<comment><USER14> I think I have gone through a similar transformation and understanding as yours and I can totally relate to the experience and dynamics you describe. However, my conclusion was that it is better to be 100% authentic in a small and controlled confines than it is to be in public. And slowly I have adopted the approach of only speaking online what I could backup offline, that is with or without anonymity.

So upon that realization, I kept using the platforms where pseudo-identities are welcome and not frowned upon and I can be transparent where I feel comfortable. It is similar to being in an environment where I can speak on any matter on my own terms and not anyone else'. So when I acquire an avatar/identity for a site, I make sure that I use that avatar/identity with full honesty.

The people who use pseudo-identity to gratify their egos and to be abusive towards their freedom of anonymity, are basically being dishonest with themselves and everyone else. I think one can be anonymous and still be authentic. Each one of us have multiple compartments from which we operate and live our lives and we are always evolving and changing as person. Google Plus team and Mark Zuckerburgs would wrongly want you to believe otherwise.

It is just so that Internet as a whole is not a trust-worthy place so you have to pick and choose how and where you participate, and we have to be able to do it on our terms.

</comment></comment></comment></comment></comment></comment><comment><USER16> There's a good interview from Mark Suster with Advance Publications recently. They talk Reddit here: <http://youtu.be/iXES4ITy7W8?t=22m>

A little surprising to hear him dismiss the role Digg 4 played in Reddit's success, but overall, gives a good perspective on how they keep it hands-off.

</comment><comment><USER17> Keep in mind that when Reddit got acquired, Reddit gold doesn't exist yet. So they were losing (more) money every month.

<comment><USER18> reddit gold may never have worked if it was sold without understanding that reddit was in trouble and couldn't grow without the support of it's users. If it had been an out of the blue proposal to slap charges for features then people might have kicked up a fuss.

<comment><USER19> Another theory was that the owners (Conde Nast?) were very old media and used to thinking of magazine subscriptions. So they invented subscriptions for reddit, to show that, yes even by magazine standards, reddit is a good business.

</comment></comment></comment><comment><USER20> Can someone explain to me how PG funded Reddit when it was more like a HN clone?

<comment><USER21> I might get a few details wrong; but HN certainly was inspired by reddit.

Reddit was originally written in Lisp. Paul Graham had actually written an article about how Lisp was his secret weapon when building his Yahoo-acquired Viacom. Reddit was one of the first YC companies so I assume their language choice was inspired by this.

Soon after launch reddit had performance issues and was rewritten in Python. This improved the site stability but angered one of reddit's original user base of Lisp fans. Around the same time Paul Graham started hyping a new Lisp dialect he was writting called arc [1]. It's what powers HN.

Arc stores the stack and a set of continuations for each possible client action in memory on the server. These are referenced on the client by a fnid. This is actually the source of the next-page errors you'll see here; continuations are purged in least recently used fashion so as HN outgrows its single server the lack of memory makes sessions expire more quickly.

I believe both HN and reddit (which had a second Python-based rewrite) are now open source. There is nothing stopping Paul Graham from using reddit's source code; but I believe the arc code is leaner. HN runs on a single piece of hardware to this day.

1\. <http://en.wikipedia.org/wiki/Arc_(programming_language)>

<comment> johnx123-up I always wonder how HN works without cookies. Can you share some insights on that?

<comment><USER22> HN does actually use a cookie called "user" when you login to keep you logged in. But for page to page state it uses an id in the url. That's why a lot of the internal links have a "fnid" in them and why you can't share those urls.</comment></comment></comment></comment>


Project Zero disclose multiple Win32 kernel vulnerabilities - <AUTHOR> https://bugs.chromium.org/p/project-zero/issues/detail?id=1307 <comment><USER2> That looks like a single leak of four bytes of kernel stack, not multiple vulnerabilities.</comment>


BTC $141 USD - <AUTHOR> https://mtgox.com/#

<comment><USER2> How are people still actually using it to _buy_ things?

My problem with this rate of change is that it makes it harder to use it as a means of buying things.

If I see an item for sale for 2.5BTC then it can take me an hour to translate my GBP into BTC. Then I carry out the exchange, and then they have to transfer it back to their currency (if they want to spend it on most things).

If the value has gone up 15% in that time then what price should they be charging me?

Should a shopfront be updating its prices on an hourly basis?

I'm all for BTC being valuable, but it needs to have _some_ stability to be used as a method of value exchange.

<comment><USER3> I bought a domain at Namecheap. That sent me over to BitPay which I gave the current USD price in BitCoins and an hour later Namecheap had accepted the payment.

<comment><USER4> And two days later you regretted not hoarding the bitcoin instead.

<comment><USER3> I don't, the price was good and the amount was tiny. Sure it would have been better today but I needed it yesterday.

That wasn't the point though, the point is yes, you can buy stuff and it's simple. Apart from the hour it takes to confirm the transaction (this is done by the BitCoin network, nothing any user or particular party needs to do) it was much less of a hassle than paying with a credit card... at least if you already have the BitCoins.

</comment></comment></comment></comment><comment><USER5> A currency which changes in value by around 40% in a 24 hour period is completely useless for the transactions I mostly deal with. We worry about a few percent change over weeks and insist on hedges.

Imagine saying to someone - I'll put 1000 BTC into your venture when you reach the next milestone in two months. What's that going to be? USD 100,000? USD 50,000? USD 1.50?

<comment><AUTHOR> "A currency which changes in value by around 40% in a 24 hour period is completely useless for the transactions I mostly deal with"

1\. IIRC Silk road uses some average price rather than the spot price

2\. Does anyone provide BTC hedging? Seems like a pretty useful and profitable service.

<comment><USER6> To enable hedging, someone would have to take a forward position in USD/BTC .. and at the moment, the market is in contango ( see <http://en.wikipedia.org/wiki/Contango> ) which means that the sentiment is that the price will continue to increase for the near term ... ie you'd have to be very brave indeed in order to put a limit on the expected BTC price.

<comment><AUTHOR> "you'd have to be very brave indeed in order to put a limit on the expected BTC price."

Or quote a fairly aggressive price (so that the hedger pays a significant premium for the service)

Also, how are you getting futures/forward prices on USDBTC?

</comment></comment></comment></comment><comment><USER7> Standard bubble advice applies here.

1) the market can stay irrational longer than you can stay solvent. (Keynes)

2) a bird in the hand is worth two in the bush. Bank your profits. It turns exponential gains into linear gains, throwing away a huge amount of potential profits. But a small amount of real profit is worth more than a huge amount of potential profit.

<comment><USER8> Just sold my BTC for about 75% profit within a few weeks, still probably gonna bite myself in the ass if Bitcoin ever hits 1000 USD

<comment><USER9> 75% profit within few weeks seems EXTREMELY good to me. I can't really see the problem (yes, I know for a emotional point of view. Just think about 75% in a few weeks)

</comment></comment></comment><comment><USER10> But it's still not a bubble, no sir, the bitcoin economy has just really kicked in to the tune of 40% growth in the last 24 hours...

</comment><comment><USER11> The latest price is always here:

<http://bitcoinity.org/markets>.

I'm not sure that a new submission is required every day.

<comment><USER12> I'm sure they are not required and they are annoying even. Especially when the submission adds absolutely nothing. And as a bonus links to a page that is not valid few minutes after posting.

</comment></comment><comment><USER13> I'm surprised that someone hasn't started another Bitcoin yet. Is it harder than just changing some initial seed? Because the artificial scarcity of digital currency is what's allowing for these high prices.

Then all you need is intermediary parties that will exchange your V2 Bitcoins for V1 Bitcoins (which will currently have the highest acceptance for buying things). Over time, V2, V3 etc. may even become accepted directly by merchants, if they become big enough.

UPDATE: Thanks for the info on additional ones. This is getting really interesting. So my initial scarcity hypothesis was wrong, which means it's just pure herd mentality. Hopefully over time the availability of multiple currencies will lead to some sort of equilibrium though.

<comment><USER14> Litecoin. Namecoin. Ixcoin. Ppcoin. Terracoin. Devcoin.

</comment></comment><comment> mkr-hn That's a lot of tulips.

</comment><comment><USER15> _cough_ sell now _cough_

<comment><USER14> Yet people aren't. Apparently there's still enough belief to warrant this kind of growth.

(..getting ready to eat my own words, real soon..)

</comment></comment><comment><USER16> Surely this madness has to end soon?

Also seriously regretting not buying it when it was "expensive" at <$5 :(

<comment><USER17> Some of us bought ours around $.85 and sold when there was _no way_ it could go any higher around $30.

<comment><AUTHOR> "Some of us bought ours around $.85 and sold when there was no way it could go any higher around $30."

Picking tops and bottoms is a fool's game.

</comment></comment></comment><comment><USER18> Not being fluent in the ins and outs of bitcoin: what is driving this? Is it pure speculation? Are more people trying to get in on the BTC wagon (riding the Cyprus wave)?

<comment><USER10> Speculation.

There doesn't seem to be any evidence that (in the world of BTC) the Cyprus situation has triggered anything other than rampant speculation by non-cypriot libertarians who already distrust central banks and now have a boogeyman to point at.

</comment></comment><comment><USER19> It makes impossible for a developer to charge BT on any service. Tell me how you do it without being overpriced the next day.

<comment><USER20> Calculate the exchange rate automatically? This is not 1900.

<comment><USER19> Really? I wasn't my point. I was talking about make use of the bitcoin value as a statement. Of course I can charge in Yens and convert it on the fly to dollars or pounds, but that wasn't the point.

It's really to make Btc popular on a website when every refresh can bring you a new value. It's horrible for business. Btc right now is only useful for trade than for other low end business operations as paying one month of hosting or buying a toy.

</comment></comment></comment><comment><USER21> I cannot ----ing believe it. I thought there would be a bump when it hit $100, but not this much. It's just insane, I was calling it a bubble since $30, and it's doubled again and again..

I wonder how low the crash will go? I'm guessing it won't be below $30.

<comment><USER10> Depends how many people get badly burned by this I would have thought. It could pretty easily drop to almost nothing if confidence is completely bust, as the 'fundamentals' supporting the price of BTC are far from obvious.

</comment></comment><comment><USER22> My 2¢ is that it's gonna crash like it did a couple years back. Then would be the best time to buy, since it will probably do this crazy business once again.

<comment><USER23> Of course, it's not going to crash very far if enough people are thinking this.

</comment></comment><comment><USER24> I guess the y-axis should be logarithmic at his point.

</comment><comment><USER25> I still don't understand how a nonexistent coin could be worth anything. No really. How does solving an algorithm translate into value?

<comment><AUTHOR> Value, be it in gold or silver or USD or EUR or bitcoin or cars or art, is a perceived phenomenon. Something has value because others are willing to trade it for goods and services (or for other forms of value). Gold and silver are trusted stores of value because they have been used in that capacity for centuries (and for a very long time, USD were silver certificates so there was real metal backing the paper)

The underlying value of BTC, IMO, is the anonymity feature (the ability to conduct commerce without a clear centralized record identifying you by name). Once that is compromised, it's not clear what value BTC will have.

<comment><USER6> Anonymity is not really the selling feature of bitcoin - in fact it really only offers pseudo-anonymity.

The fact that no-one else can just "print" bitcoins, and that you can transfer funds at internet speed to anybody else anywhere in the world and that (after a short time), the transaction cannot be reversed are the main utilities.

<comment><USER9> Yes, I think it is possible, in the long run, to figure out who's behind a wallet, assuming that the Bitcoin use is frequent and convenient (meaning no- super-high-inconvenient-counter-measures are used, but a regular use of currency)

In that case, my concern is that I think it will be possible to determine ALL the transactions of that wallet. Making it even less anonymous than regular currencies.

I could be missing something, but if confirmed, that could be a problem for using Bitcoin as a regular currency

<comment><USER10> There are various laundering schemes, and there's nothing stopping you using new wallets constantly.

But yes, in effect, every transaction is traceable and public, AFAICT.

<comment><USER9> Yes, I understand that there are things that you can do. But, as those are in the way of convenience, we can assume that not everyone will take the extra effort to create constantly new wallets, etc.

So, in case someone can trace you to a wallet, that someone can know all your transactions (of course, only the transactions for that wallet), which is a huge potential privacy risk.

</comment></comment></comment></comment></comment></comment><comment><USER26> It's like in Germany in the 30's.

<comment><USER27> I was thinking that as well, but it's actually the opposite. Germany experienced hyperinflation, where the value of the Mark decreased rapidly. This is the currency increasing in value, so "hyperdeflation" I guess.</comment></comment>


Ask YC:  Beyond Twitter:  Why not broadcast your web surfing live but only for shared links/domains? - <AUTHOR>

The idea is to that you would specify a list of URLs and/or domains that are shared and any time you browse a shared web page, your friends would see it.
By broadcast, I mean just show the URLs and possibly also their titles (without URL get parameters), not the actual screen contents.
Of course, people might use this data in some unexpected ways. For example, they might use your web surfing habits as a way to estimate your IQ. <comment><USER2> So a more watered down and limited friendfeed?

I don't use friendfeed all that much now, so your proposal isn't that appealing to me.

<comment><AUTHOR> The idea applies to any site -- not just social ones. So it's not a subset of friendfeed. For example, you might want to broadcast your browsing of cnn.com.

One might even approve all urls to be broadcast live for a given domain. For example, this would allow you to see what your friend is reading on reddit in real-time. But of course, you probably don't want to activate this feature for your banking site, stock trading site, etc.

<comment><USER2> I get the gist of your idea, from your other comments, now.

People surf the internet at an incredibly rapid and random rate. It'd be more than annoying to see link after link posted by the millisecond. I'd also bet that most of the time, sites where your friends contribute are sites that will probably appeal the most to you and have some sort of value. Even if you limit to specific sites, sure that's narrowing it down, but you're narrowing it down from millions of sites to hundreds, which is still pretty inconvenient for me to follow, considering I am an extremely extremely popular person and have an innumerable amount of friends. You get the point.

<comment><AUTHOR> You could rank URLs higher that have been browsed by more of your friends in the last 30 minutes, etc.

<comment><USER2> That doesn't necessarily mean that those links are of more value. Say I got rickrolled, and my friend sees that in my history, and clicks through only to be rickrolled, and so forth. Next thing you know, I've ultimately rickrolled my entire social circle (I'd love that). Replace rickroll with porn and you get a worse (or better) situation. Trust in your links will wane.

<comment><AUTHOR> Your friends would learn to avoid certain URLs after a while. Also, the title of the web page should probably be displayed along with the URL.

<comment><AUTHOR> Also, you could make it so that a URL is ranked higher if more time was spent checking it out.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> Reminds me somewhat of <http://me.dium.com/>

</comment><comment><USER4> WebMynd has close to this functionality.

<comment><AUTHOR> Really? How so?

<comment><USER4> <http://news.ycombinator.com/item?id=167657>

<comment><AUTHOR> Making it real-time and friend-based would make this potentially compelling, especially if you use the ranking heuristics mentioned elsewhere in this discussion.

</comment></comment></comment></comment><comment><USER5> this is done in friendfeed

<comment><AUTHOR> I think you misunderstood my proposal.

<comment><USER6> You might want to help explain the differences between your proposal and friendfeed, so he can better understand.

<comment><AUTHOR> This isn't about tracking contributions to social sites.

It's about showing people what web page you are currently looking at, even if you are not contributing any content.

<comment><USER6> I see what you're saying. My initial thoughts are that there would be serious quality control issues. For example, I know that 90% of the content I look at on a daily basis is of little interest to someone else, and probably a sizable percentage of that is not even really relevant for me.

How would the content be filtered, if at all?

I'm not knocking your idea; I'm just trying to imagine the value of such a tool.

<comment><AUTHOR> You would specify which domains/URLs you would like to broadcast. So if something is obviously of little interest to others, you might want to keep it private.

Also, as mentioned elsewhere, you could make it so that a URL would rank higher if more of your friends looked at it in the last 30 minutes, etc.

<comment><USER7> Why don't you just put it out there and see if people like it?

<comment><AUTHOR> Well, for a start, it's not easy for me to build since I have no idea how to build browser plugins...

There's also a privacy issue. Maybe people would not trust my implementation really does what I claim it does.

<comment><USER7> Just do it. What happened to the LCD numbrosia you were going to do? I was thinking about that; pretty good idea. You wouldn't even need lcd's just an array of digital bar displays.

<comment><AUTHOR> That touch screen puzzle device was just an idea I had. It wasn't something I had the expertise to build.

In any case, I later found out that it has already been done:

[http://gizmodo.com/338502/magic-cube-heralds-the-future- of-g...](http://gizmodo.com/338502/magic-cube-heralds-the-future-of-gaming- and-human-interfaces)

<comment><USER7> I don't see numbrosia on those things! You can still do it. Every idea is already implemented in some form or another anyway. Team up with a hardware EE, a good undergrad could do it. You have the code already. Start her up.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Bob Moog Intros the Fairlight CMI - <AUTHOR> http://www.youtube.com/watch?v=gno7xqWR9fg&feature=related

<comment><AUTHOR> Parts one [1], two [2], three [3], and four [4]. And the whole story [5].

\----

[1]: [http://www.youtube.com/watch?v=rf3Ich9lT2w&feature=relat...](http://www.youtube.com/watch?v=rf3Ich9lT2w&feature=related)

[2]: [http://www.youtube.com/watch?v=ydxFc6o64WA&feature=relat...](http://www.youtube.com/watch?v=ydxFc6o64WA&feature=related)

[3]: [http://www.youtube.com/watch?v=YO8bwRd64_g&feature=relat...](http://www.youtube.com/watch?v=YO8bwRd64_g&feature=related)

[4]: [http://www.youtube.com/watch?v=kOwNncaGH4c&feature=relat...](http://www.youtube.com/watch?v=kOwNncaGH4c&feature=related)

[5]: <http://www.anerd.com/fairlight/fairlightstory.htm></comment>


Ask HN: Do you have a side project you want to sell? - <AUTHOR>

This seems to be asked each year - so thought I would ask for 2015! <comment><USER2> Yes, I have a product www.qrunched.com which I would like to sell.

Thanks</comment>


How a bug in Skype prevented our users from using our app - <AUTHOR> https://medium.com/@verrier/how-a-bug-in-skype-prevented-our-users-using-our-application-f30901df5c6

<comment><USER2> Whoah, talk about burying the lede! TFA says that the root cause of the bug is Skype is adding tens of thousands of certs to the Trusted CA store on certain Windows boxen. Not sure what's worse, if it turns out that's a Skype bug or if it's by design...

</comment><comment><USER3> On my machine I have, well had, one. What is going on here? Is adding a trusted CA cert (with the key) really a good idea?</comment>


Start with Kindling - <AUTHOR> http://evhead.com/2011/10/start-with-kindling.html <comment><USER2> This was a good article about starting fires, but it is very incomplete. I was expecting a comparison of various kinds of kindling, like paper vs. twigs. Instead it was a simple description of how kindling is used to start a fire.

It appears to be discussing the merits of transitioning to slow burning wood but does not mention how to get the right distribution of hot coals, or how to clean up the ashes.

What is it Evan, propane or charcoal?

All in all I think the author needs to learn more ways to make fire.

(As an extended metaphor, this article isn't.)

<comment><USER3> Paper is tinder, not kindling.

</comment></comment><comment><USER4> Waiting for the sequel: Finish with the relevant part of the metaphor.

</comment><comment><USER3> Start with tinder. Then add kindling.</comment>


JOY.js – make happy little programs - <AUTHOR> http://ncase.me/joy-demo/ <comment><AUTHOR> Nicky continues producing amazing work. It's like Bret Victor's[1] dreams come true. Check the non-linear demo [2].

[1] [http://worrydream.com/](http://worrydream.com/)

[2] [http://ncase.me/joy-demo/nonlinear/?model=waves](http://ncase.me/joy- demo/nonlinear/?model=waves)</comment>


Ask HN: What are the first steps to starting a startup? - <AUTHOR> Hey Hacker News, I'm looking for some advice. I'm not entirely sure this is the right place to ask, but here goes anyway.
I feel like I've been doing a whole lot of learning about entrepreneurship, yet I never take the plunge and actually act, and I really don't know how to get started.
A little bit about me: I graduated with a CS degree from a very strong engineering university in May, and I'm now a software engineer at a major tech company. I took lots of elective classes in school about entrepreneurship, from idea generation, to funding, to legal aspects of startups. I've been to plenty of talks and ask questions whenever I can at them, from people like Max Levchin (PayPal), Roger Dickey (Gigster), and Jess Lee (Sequoia Capital). At times I feel like I'm being quite proactive towards my goal of one day starting a startup...
And then I realize that I don't output anything. I know backend and frontend web dev, infrastructure, some machine learning, and other odds and ends, but the most I find myself actually doing is writing little scripts to save myself a couple minutes here or there. I find myself so enthralled by consumer tech, and I have plenty of ideas, but I find it very hard to actually act on them. Any time I start to work on a project, I end up getting caught up trying to brainstorm how to build the perfect application, or I'll start programming it but I'll just keep adding more and more complexity before I even get an MVP. And the result is probably 15-20 projects that are all only between 5 and 30% done.
Some of you guys have experience taking a vision you have, and making it a reality. You juggle creating a product, marketing and selling it, iterating, coming up with a decent business model, and a hundred other things. Can you offer me any advice on what I should do first? Because I can't keep sitting on my couch reading Paul Graham essays.
A huge thank you to anybody who's willing to give me some pointers. <comment><USER2> Try to figure out a problem you yourself face on a regular basis. That you have a certain depth in understanding your users who will also be facing the similar problem.

Don't worry if the problem seems to general at first. Just keep thinking about it and you will come to something specific, and soon you will have an idea for a product.

Creating something that solves your own problem is generally a good way to start a start-up.

Good luck! :)

</comment><comment><USER3> Buy a domain, put a single page with a description of your project with a delivery date on it. Add a short bio with a photo and an email address.

Now you're committed.

</comment><comment><USER4> Instead of build, launch the landing page and do it concierge, by focusing on the skill set you have (building) you'll likely miss out on the most important first step - seeing if there's a market and learning how to make sales.

Right now, sounds like you're focusing on the solution. Just look for interesting problems and go from there.</comment>


The Only Operating System That Has Never Been Infected - <AUTHOR> https://www.linkedin.com/pulse/only-operating-system-has-never-been-infected-virus-mark-e-s- <comment><AUTHOR> Interesting article. I'm not much of an OS guy, anyone can shed more light into the subject? Why the object oriented operating systems was integral to the OS's ability to withstand intrusion?

<comment><USER2> I can't comment on the "never been infected" claim, but the AS/400 does have an unusual architecture based on something called "capabilities" that provide support for objects and protection in the hardware (actually, the microcode). Then the OS is built on that. There is a detailed explanation of how this works in the AS/400 ancestor System/38 in chapter 8 in this book:

[http://homes.cs.washington.edu/~levy/capabook/](http://homes.cs.washington.edu/~levy/capabook/)

PS - According to the Wikipedia article on System/38, IBM removed the capability-based addressing from the AS/400.</comment></comment>


Excessive load on NTP servers - <AUTHOR> https://news.ntppool.org/2016/12/load/ <comment><USER2> Wait.. they are saying the app itself is making NTP requests?

> _Confirmed - starting up the iOS Snapchat app does a lookup to the domains > you listed, and then sends NTP to every unique IP. Around 35-60 different > IPs._

Hmm. Is that a fraud prevention thing or something? No way on earth a user app should be getting its own time

<comment><USER3> Snapchat have a lot of "fraud protection" in the form of time sensitive tokens hashed with secret keys generated by strange .so libraries. This is used to keep third party apps from using their API, obviously a lot of user's devices have incorrect clocks, so when they reduced the secret token time frame lots of users probably started getting API errors, so this is their attempt at a solution.

<comment><USER4> Thank you! This is the most reasonable answer I've seen in the thread so far.

</comment></comment></comment><comment><USER5> Why on earth would you do that?

If you want to prevent users from altering their time use your server and do a time compare with your server.

NTP can be easily intercepted and altered so it would make a lot more sense to do this via a encrypted certificate pinned communication path increasing my work load drastically to alter the time.

I snapchat going to pay for the DDOS they created?

<comment><USER6> Stupid decision by SC for sure, but is there a reason there is no rate- limiting on the NTP servers? I'm not up to date on their structure. Maybe it's just not feasible because they don't synchronize clients?

<comment><USER7> Even without thinking about storing some context, replying to NTP request is probably similarly expensive as evaluating whether it should be rate limited.

<comment><USER8> Yeah exactly this. Rate limiting isn't free. It's almost certainly more expensive to rate limit than to statelessly respond with the time.

<comment><USER9> NTP does store context for a limited number of clients (600 by default). [https://www.eecis.udel.edu/~mills/ntp/html/miscopt.html](https://www.eecis.udel.edu/~mills/ntp/html/miscopt.html)

</comment></comment></comment></comment></comment><comment><USER10> For whatever reason, ntppool.org is blocked at my work.

And of course, you don't get the page that states why when the website is served via https. Not that I need to see the page to know it was either blocked for "hacking" or "entertainment", and I'm guessing it's not entertainment.

Edit: This probably explains why our clocks have been off by 45 minutes since Monday. I guess it will be entertaining to see how long it takes for IT to figure this one out.

<comment><USER11> > I guess it will be entertaining to see how long it takes for IT to figure > this one out.

Why not just tell them. What have you got to lose? Hell, blame your charitable spirit on the holiday season if you must.

<comment><USER10> I got told off for diagnosing issues in the past. The IT director is a megalomaniac and interprets it as a challenge to his power. The only time I offer suggestions now is when one of his employees specifically asks me for help.

Edit: I realize "got told off" didn't really capture what happened. I came in early one day and noticed we were having a dns issue. I manually refreshed my DNS cache and it started to work. I sent him an email to let him know that the DNS cache was expired. He told me I was out of line and complained to HR.

I had to go meet with HR, which was pointless since they think he is on a power trip as well. Anyways he added a line to the IT policy that specifically prohibits "performing a diagnosis on the network or any of IT managed systems."

<comment><USER12> I encountered a similar IT manager in high school. I kept telling him that netsend wasn't locked down and that any user could run a .bat.

He told me I was wrong. So, I wrote a .bat with a netsend command and emailed it to all staff. Multiple staff clicked on the attachment.

Once they figured out it was me, they made me start a computer club with the IT manager as the supervisor of the club. First order of business was locking down .bat execution.

<comment><USER13> Im endlessly glad that my high school was extremely tolerant of us exploring the system and messing with things as long as we didn't try to cause harm (eg, deleting one file is okay, trashing a whole network drive is not) and reported what we found to the school IT manager. Most of us ended up as techs for the school and district as a student job. Several of those students went on to be whitehats. (Who knows where careers would've gone if they'd been discouraged and come to view the system as the enemy.)

They also were way cooler than they had to be about the several times we took down the network or broke the porn filters, or the time we port-scanned a district tech's machine, or had a whole collection of malware on the network drive, or....

I just worry about how students like me would fare in schools these days.

<comment><USER14> Me and my buddy in like 2010 ended up being questioned by police, then he caught some charges. No fun. All we did was spoof some emails.

</comment></comment></comment></comment></comment></comment><comment><USER15> According to the forum, the pattern matched this third-party library:

[https://github.com/jbenet/ios-ntp](https://github.com/jbenet/ios-ntp)

Specifically, all the servers(!) from here are contacted: [https://github.com/jbenet/ios-ntp/blob/master/ios-ntp- lib/Ne...](https://github.com/jbenet/ios-ntp/blob/master/ios-ntp- lib/NetworkClock.m#L121)

Note that the library author wrote:

"ios-ntp is often (mostly?) used to make sure someone hasn't fiddled with the system clock. The complications involved in using multiple servers and averaging time offsets is overkill for this purpose. The following skeleton code is all that is needed to check the time."

And that "skeleton" contacts just "time.apple.com"

But the library really has the default possibility of contacting a lot of the ntp.org servers from a big list ("createAssociations" with no parameters!) and it's bad.

As we know, the developers like to just "copy-paste" whatever is where. Or use any defaults. "Hey it works."

<comment><USER16> This is a really weird comment format. It almost suggests a lack of syntax highlighting.

        /*┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
          │ Prepare a sort-descriptor to sort associations based on their dispersion, and then create an     │
          │ empty array for associations to fill ..                                                          │
          └──────────────────────────────────────────────────────────────────────────────────────────────────┘*/

<comment><USER17> Nope, I guess it's just that the developer _really_ likes comment boxes. See e.g. here:

[https://github.com/jbenet/ios-ntp/blob/master/ios-ntp- lib/Ne...](https://github.com/jbenet/ios-ntp/blob/master/ios-ntp- lib/NetworkClock.m)

for use of two different styles of boxes, + some additional typographic experiments.

I actually kind of like it. Not enough to start using it yet, but then again, in Lisp code I make a judicious use[0] of ^L characters and form-feed-mode. Form feed character seems to be a forgotten but pretty neat invention.

[0] - [http://i.imgur.com/5pnDZmJ.png](http://i.imgur.com/5pnDZmJ.png)

</comment></comment></comment><comment><USER18> FWIW my teenage daughter has been complaining about this latest Snapchat update for iOS the past couple days. It constantly crashes and causes the phone to reboot itself. Looking at Twitter, there's tons and tons of people reporting the same issue, so it seems pretty widespread. Wonder if it's related to this NTP issue.

<comment><USER19> Can apps cause iOS to _reboot_? That's a bit shocking.

I don't own an iPhone.

<comment><USER20> It's not isolated to iOS. Snapchat does something funky in userland.

I think on the Nexus 4, Snapchat _still_ ships with a warning that it doesn't work properly.

Mine would reboot about every second time I took a picture.

<comment><USER21> I haven't investigated the issue, but I've heard that it was indeed a bug with the Nexus 4 drivers that caused the crash.

Still, I've got to wonder, what are they doing that's so different than other camera apps that seem to work fine?

<comment><USER22> Not using the Camera API for starters, last I checked they still took a screenshot of the viewfinder on Android.

<comment><USER23> lolwut

</comment></comment></comment></comment></comment></comment><comment><USER24> It is interesting to read through the whole thread in a chronological order starting from the first message: [http://mailman.nanog.org/pipermail/nanog/2016-December/08952...](http://mailman.nanog.org/pipermail/nanog/2016-December/089525.html)

It took 4 days, to zero on the root cause. As is usual in a complex scenario like this there are a few false positives, some suspects abusing the protocol and alas final redemption. Amazing work by a dedicated group of technical folks in coordinating (just via emails, I suppose) and tracing the root cause.

</comment><comment><USER25> Worst part is that they did not bother to use a vendor zone.

<comment><USER26> Indeed. This is a pretty clear misuse of the NTP pool.

> You __must absolutely not use the default pool.ntp.org zone names __as the > default configuration in your application or appliance.

\- [http://www.pool.ntp.org/en/vendors.html#vendor- zone](http://www.pool.ntp.org/en/vendors.html#vendor-zone)

Hopefully they were just unaware of the vendor zone policy.

<comment><USER15> > Hopefully they were just unaware of the vendor zone policy.

It seems they didn't know, or didn't care, how both the third party iOS library they used and the NTP worked, see my other posts here.

They surely didn't need ntp.org pool at all.

</comment></comment></comment><comment> mark-r This happens often enough that Wikipedia has a page devoted to it: [https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse](https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse)

The first one I had heard of was Netgear vs. UW-Madison.

</comment><comment><USER27> For all of Apple's App Store vetting one would think this kind of behavior would have thrown up a flag at some point no?

<comment><USER28> App Store vetting varies wildly and tends to trend towards more close introspection on smaller apps. Well known apps such as Facebook Messenger and Snapchat for example can get an update reviewed and pushed out faster than a standalone developer.

<comment><USER29> I think Apple should require app vendors to just submit source code and build instructions and have Apple just build it.

It'd be harder to pull off on Google Play Store but I think Apple could make this happen if they wanted to.

<comment><USER30> As a developer, I'd rather they build it and sign it for me. The key signing stuff always seems difficult.

<comment><USER31> I would hate that. How could ever be sure Apple (or anyone else) hasn't added/modified my code without consent?

I wouldn't ever stake my reputation on signed code which hasn't been signed by myself!

<comment><USER32> Apple owns the hardware, OS and distribution, they can do whatever they want. Your signature is neither here nor there.

The only thing it can do do is show Apple you compiled the code.

There's no way you as the dev or the end user can verify the installed software really originated from you.

</comment></comment></comment></comment></comment></comment><comment><USER33> And to think that SC's engineering is praised among college kids is laughable.

<comment><USER34> On my device, at various points, Snapchat and Uber have both been completely nonfunctional for days on end. I didn't think building phone apps could be so difficult for these large companies.

</comment></comment><comment><USER35> I wondered why I was seeing so much packet loss on my IP: [http://mrtg.vi- di.fr/krootservers.ping.html](http://mrtg.vi-di.fr/krootservers.ping.html)

Guess I know why now..

</comment><comment><USER36> Yeah, it's been really hit and miss here in AU for a few people I know.

</comment><comment><USER37> I do some work for the Network Time Foundation and we were not contacted by snapchat as far as I know. Anyone have a contact there, they probably need our help.

<comment><USER38> People from the NTP Pool community were talking to them (including myself, briefly). Given the available information I'm not sure why you think they need help from NTF ...

</comment></comment><comment><USER39> I for one am shocked - shocked! - that Snapchat would be the kind of company to be cavalier about this kind of thing.

</comment><comment><USER40> Captcha should fix it</comment>