How to Track Sleep on Android - <AUTHOR> https://hackernoon.com/how-to-track-sleep-android-edition-af9348457d33 <comment><USER2> This is basically an ad for a horribly invasive app (from a privacy standpoint). Check out the permissions it demands before installing this ridiculous privacy suck. I use the free Sleep Cycle app, but there are many less-invasive options.

(Even all _Contacts_? Seriously?)</comment>


OpenAVL - an AVL Open Source project (I) - <AUTHOR> http://dev.emcelettronica.com/openavl-avl-open-source-project-i <comment><USER2> And here I thought that they were talking about AVL trees.

</comment><comment><AUTHOR> OpenAVL, an AVL Open Source project that tracks you down.</comment>


Full Stack Fest 2015: Ruby 3.0, by Yukihiro Matsumoto - <AUTHOR> https://www.youtube.com/watch?v=48iKjUcENRE <comment><AUTHOR> This guy has a serious talent for pragmatism. We've already witnessed it in Ruby so many times, for example in method naming, just to quote the most obvious.

Here we witness it once again: the way he wants to tackle in Ruby 3.0 the features the community has always been asking for (mainly speed and concurrency) is just so convenient and right. Also, to top it off, after seeing Ruby issues with switching from 1.8 to 1.9 he is always keeping one eye open on retro compatibility. A perfect example of a lesson learned case at work. Hopefully the final equation will be wisdom + love = Ruby.</comment>


Ninite: Install and Update All Your Programs at Once - <AUTHOR> http://ninite.com/

<comment><USER2> Nice to see this here, have been using it for several years. Saves a ton of time and money compared to alternatives and always retrieves the latest versions of the software in question.</comment>


Shellshock bug is another blow to open source http://bit.ly/1mGnkBm - <AUTHOR>

Straight at the heart of open source software http://www.straight.com/blogra/739401/homeless-vancouver-shellshock-bug-another-blow-open-source <comment><USER2> the actual article... [http://www.straight.com/blogra/739401/homeless- vancouver-she...](http://www.straight.com/blogra/739401/homeless-vancouver- shellshock-bug-another-blow-open-source)

</comment><comment><USER3> so does every bug in Windows equate to the death knell for Microsoft?

Dumb article, dumb analysis and conclusion.

</comment><comment><USER4> Empty linkbait headlines, only one of which actually leads to an article.

The Shellshock bug detection and remedy proves that _open source works_.

If a person is diagnosed with a disease and successfully treated, does this:

1\. Prove that medicine is a _success_.

2\. Prove that medicine is a _failure_.

Pick one, and think before you do.

<comment><USER5> Open source can (and does) work, but questions can be asked about whether legacy open source code is receiving necessary scrutiny - and if not, why not.

Not every criticism of open source is whether or not it works. In this case, is it working well enough, given the coverage and criticality of some of the software in the wild?

Bear in mind, this particular patient has been in the waiting room for decades. Asking why a doctor hasn't shown up until now is at least reasonable.</comment></comment>


Counterstrike: Murdoch, DeWolfe Announce MySpace Platform and New Privacy Controls - <AUTHOR> http://www.techcrunch.com/2007/10/17/counterstrike-murdoch-dewolfe-annouce-myspace-platform-and-new-privacy-controls/ <comment><USER2> They seem to be playing catch-up--there's nothing in this announcement that's above and beyond what Facebook is doing.

<comment><USER3> Yeah but Myspace has a totally different demo and 2x facebooks traffic.

Anyone else here have plans for Myspace?

<comment><USER2> Obviously MySpace is doing fine now, but time is unkind to companies that coast. Until MySpace does something very new, they're coasting. Of course they'll be around in 2008. I'm talking about whether they'll be around in 2015.

</comment></comment></comment><comment><USER3> Amazing timing! I'm very excited!</comment>


GoodbyeDPI – Passive Deep Packet Inspection Blocker / Circumvention Utility - <AUTHOR> https://github.com/ValdikSS/GoodbyeDPI <comment><USER2> So... this is basically fragrouter? [1]

If so, this is a very old idea (I, uh, co-invented it?). A lot of DPI gear isn't built for serious security, but rather best effort, and I'm sure basic TCP tricks like this will bypass those. But you should be aware that serious, modern middleboxes were very definitely built with knowledge of fragrouter- type tricks (and of evasion more generally), and you're better off using a VPN than relying on stuff like this if your evasion actually matters from an opsec perspective.

[1]: [https://www.monkey.org/~dugsong/fragroute/](https://www.monkey.org/~dugsong/fragroute/)

<comment><USER3> I think DPIs might also be used to detect VPNs. I'm not familiar with VPN traffic patterns situation but I doubt that it's too chaotic or masquerades as something else, since VPNs weren't invented with DPI in mind.

Not to imply that GoodbyeDPI assuages all my doubts, either.

<comment><USER2> DPI can certainly be used to detect VPNs, but my broader point is, if you want real assurance, you need to get a VPN working; you can't rely on TCP/IP reassembly glitches, because they're largely addressable by the serious DPI vendors.

<comment><USER4> I think it's right to say you can't rely on those older methods, but there has been a lot of research that's gone into DPI bypass. The HTTP Evader work that's been done is particularly good [0]. In some cases the guarantee of operating a VPN over a hostile network isn't guaranteed, especially something like IPsec. So it's good that the simplistic fragmentation methods of tools like fragrouter have been expanded on.

[0] [https://noxxi.de/research/http- evader.html](https://noxxi.de/research/http-evader.html)

<comment><USER2> The stuff HTTP Evader is doing is simpler still than the stuff fragrouter (and this tool) does. Middlebox evasion is a cat and mouse game. I'm fine with people playing that game, but not with their lives; if real opsec is on the line, you need a VPN.

<comment><USER5> Sorry, n00b here, but a friend was telling me about a new version of Internet Protocol that fixes man in the middle attacks, like deep packet inspection. Is that realistically coming anytime soon?

<comment><USER6> It is an impossibility. Protocols are layered and so at one layer you can add features to detect possible MITM (eg. IPSec, SSL etc.) but cannot always be eliminated.

I suggest you consult a book like "The TCP/IP Guide" to get an overview of the main data protocols and how they work. In this day and age, everybody ought to know something about the basic protocols which form the bedrock of our networked society.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7>
        TCP-level fragmentation for first data packet
        TCP-level fragmentation for persistent (keep-alive) HTTP sessions
        Replacing Host header with hoSt
        Removing space between header name and value in Host header
        Adding additional space between HTTP Method (GET, POST etc) and URI
        Mixing case of Host header value

Very interesting. This is, of course, depending on the DPI-blocking application to be pretty poorly engineered, but I wouldn't be surprised. I'd be interested to see which national DPI solutions (GFC, Russia) this successfully circumvents, not just commercial products.

<comment><USER3> I'd also be quite interested in knowing which queries are detected and whether different tools have any effect, but pretty sure that it's a black-box situation where something can be surmised only if the DPI is in the binary mode of 'block/pass.' IMO in fact there might be a gray zone of 'mark this dude as suspicious' with an unpleasant prospect of future non-digital trouble.

<comment><USER8> >I'd also be quite interested in knowing which queries are detected and whether different tools have any effect

For that, I wrote Blockcheck utility to check whether censorship circumvention techniques could be applied on this ISP or not.

[https://github.com/ValdikSS/blockcheck](https://github.com/ValdikSS/blockcheck)

</comment></comment></comment><comment><USER9> This is Windows-only. The code claims to be userland but relies on kernel middleware. That is interesting, because the driver seems to be signed. If you've never looked at Windows kernel stuff, you'd probably be surprised at:

1) How much it looks like *nix. 2) How hard it is to actually use your own code.

> Windows Server 2016 systems must have secure boot disabled.

That's no good.

<comment><USER10> > How hard it is to actually use your own code.

What do you mean by this? It's easy enough with test-signing. Just use _SignTool sign_ to sign your binary. Then _sc create_ to create the service for the driver, and _sc start_ to start it as usual.

> How much it looks like 'nix.

Also not sure what you mean by this either... to me there's a world of difference between Windows and 'nix kernel development.

<comment><USER9> Test signing isn't meant to be used on a real system. You're intended to have an entirely separate test cluster or at least test machine. There are usability downsides to this, many of them cosmetic, but one major one is you need to disable secure boot. In some cases (this may have changed) you could only enable test signing _for the next boot_ meaning you had to constantly keep re-enabling it.

Overall very user hostile, and it leaves one with the impression they don't want you to run your own code or let other people run your code without paying protection money.

For the other part... go look at the driver documentation. The names are different but the patterns are all the same except for a few places.

<comment><USER10> Okay then I don't get it. What even is the point of secure boot when your entire goal is to run arbitrary kernel mode code? You're effectively _always_ running in test-signing mode on Linux -- your entire goal is to be able to run your own modules, which is what test-signing mode does. And if you want to be in that situation, you can permanently enable it with bcdedit; there's no need to constantly toggle it.

If your complaint is that you have to cough up $$$ to have your driver be trusted by other users' machines, yeah, I'm happy to rant about that issue, but that's not an issue with the "difficulty" of the process. That's like saying it's hard to use a Lamborghini because it's too expensive.

As for the names and patterns... idk, it's hard for me to see what's similar, except that both systems have file systems, both have handles/descriptors, etc... which is hardly an interesting point. Everything from the way you hook I/O to the way syscalls are handled to the quality of the documentation is vastly different on each system.

<comment><USER9> > What even is the point of secure boot when your entire goal is to run > arbitrary kernel mode code?

Err, it's code I wrote, or code I am likely to be familiar with? My issue isn't with the feature of driver signing but its application. I can choose to be in test signing mode on Linux or not, and if I am, it doesn't gimp the system in arbitrary ways.

Look again, Windows is like a black box over a rewritten Unix kernel. It's kind of funny. It took a while for it to click.

<comment><USER10> > My issue isn't with the feature of driver signing but its application. I can > choose to be in test signing mode on Linux or not, and if I am, it doesn't > gimp the system in arbitrary ways.

I don't know what "gimp the system in arbitrary ways" means. I've been running Windows in test-signing mode for _years_ with no problem. Microsoft doesn't officially bless it, but that doesn't exactly matter in any material way.

</comment></comment></comment></comment></comment></comment><comment><USER11> [https://github.com/bol-van/zapret](https://github.com/bol-van/zapret) has a linux version

<comment><USER12> Just installed it a couple days ago. I'm surprised that it still works in Russia.

</comment></comment><comment><USER13> Having worked on a library that was often used in DPI (security systems, not national-level censorship stuff, although after open-sourcing we lost the power to discriminate) I would not imagine that simple fragmentation, insertion of spaces nor mixed-case would do all that much to slow down a well- written DPI system.

I suspect more elaborate evasions might necessary - e.g. tcp fragmentation with inconsistent fragments where the understanding of which final 'reassembly' the target gets is necessary to understand what the DPI system is seeing. This might also ring alarm bells at the intermediate firewall, though. The problem is with the censorship firewalls is that they can just throw stuff on the floor if they feel a bit suspicious about it; they can be inherently 'worse' in their liveness guarantees than, say, a corporate DPI product.

<comment><USER8> In Russia, DPI systems which are used for censorship generally prevent accessing only blocked domain names or exact HTTP URLs. There's no proxy or VPN censorship in place, so unknown protocols are not getting discarded.

We still don't have national-wide firewall like that in China, each ISP (and we have 1000+ of them) performs censorship using either dumb IP blackholing (breaks a lot of legitimate stuff), on-path DPI (I call it "passive" in GoodbyeDPI, DPI which receive mirrored traffic and can only inject something but not prevent the connectivity per se), in-path DPI (DPI as a router/bridge).

Most DPI systems in Russia were specifically created for Russian censorship (i.e. capable only for HTTP URL and TLS SNI introspection), from scratch. Some ISP have their own in-house DPI systems. These systems were just not designed to handle packets fragmented on TCP or IP level at the beginning, because it's rarely the case in the real world.

If you want to learn more, visit internet censorship forum I created. I write about different DPI systems there and trying to document internet censorship in Russia as a whole. [https://ntc.party/c/internet-censorship-all-around-the- world...](https://ntc.party/c/internet-censorship-all-around-the-world/russia)

</comment></comment><comment><USER14> So, can this be used in conjunction with OpenVPN? My phone carrier has silently started block my VPN connection when tethering.

<comment><USER15> It it a national carrier? Name and shame, please!

<comment><USER14> AT&T. Stopped in January of this year for apparently no reason. I can even ssh into my home computer, but my work vpn just hangs.

<comment><USER16> Thanks. We need to know this type of information!

</comment></comment></comment></comment><comment><USER17> This is a specific technique, designed to confound a specific DPI method. It is not a generic blocker, or circumvention, as I understand IPSEC or IP in IP or IP over ICMP or IP over DNS or any of a number of tunnelling and encryption mechanisms.

The name is misleading: its a shield, for one weapon. Its not armour against all weapons

</comment><comment><USER18> Just out of curiosity, can anyone from China verify if it works? (for now)

Edit: my concern is that the engineers at GFW might quickly upgrade their system to target it.

<comment><USER19> Most Chinese use VPN or other tunnel protocols these days. Once GFW finds out you are using a VPN or tunnel, it will block the TCP/UDP connection by dropping packets. And it does can identify any protocol that is widely used, even those claim to have obfuscation ability, like shadowsocks.

Anyway, the TCP/HTTP tricks discussed here may work for some time or not, but we really do not expect much from that.

</comment></comment><comment><USER20> Isn't it better to just use a VPN? The Chinese have been doing that for years.

<comment><USER21> > Isn't it better to just use a VPN? The Chinese have been doing that for > years.

Isn't DPI used to block VPNs?

<comment><USER20> Yes, but the Chinese have also been fighting it for about as long --- [https://en.wikipedia.org/wiki/Shadowsocks](https://en.wikipedia.org/wiki/Shadowsocks) and obfsproxy being the two that immediately come to mind.</comment></comment></comment>


Lego announces layoffs after reporting an unexpected drop in sales and profit - <AUTHOR> https://qz.com/1069520/lego-announces-layoffs-after-reporting-an-unexpected-drop-in-sales-and-profit/ <comment><USER2> I wonder if charging $80 for a set is causing a lag in sales. These little plastic bricks can't cost nearly that much to produce, even at their tight tolerances.

<comment><USER3> I suspect that licensing fees are to blame. Having two children, there's rarely (if ever) a time I go to the Lego section of a store and not see at least one kit for every property my children (or I) enjoy.</comment></comment>


In School Systems, Slow Progress for Open-Source Textbooks - <AUTHOR> http://www.nytimes.com/2010/08/01/technology/01ping.html?_r=1&hpw

<comment><USER2> The website (relying on a modified version of XWiki[1]) is a bit difficult to use and read. I didn't try contribution or to register but compared to Wikibooks (<http://en.wikibooks.org/>) where navigation is easy and contributing is much more easy. This could be factor for the slow progress.

[1] Please note the use of Java...

</comment><comment><USER3> Few kids in grade school pay for their own texts. They are provided by the district, and new sets aren't purchased every year. Cost is a less salient issue than politics and changes to the curriculum.

The 'solution' to expensive textbooks for university students is, increasingly, piracy. I'm surprised anyone is still buying books these days. Almost any undergrad text is easily pirated.

</comment><comment><USER4> Nice to see McNealy doing something constructive with his time. It's not like this idea hasn't been around for some time but it's never taken off, for numerable reasons.

<comment><USER5> Could you enumerate the reasons? I'd like to know why "open books" hasn't taken off.

<comment><USER6> As a high school student, here's what I've found:

Most students in public school systems don't actually pay for books, so the students couldn't really care less about who makes the books they use let alone the licensing, cost, etc.

Parents aren't aware enough to demand it of their school systems.

Teachers are extremely skeptical of wiki-style operations from the start, even if there is solid editing.

Marketing open-source textbooks is difficult since it doesn't necessarily generate a whole lot of revenue. Organizations, especially schools, buy stuff that's marketed to them.

Most curricula (especially International Baccalaureate/Advanced Placement) is designed with specific topics in mind. Since there aren't as many open books, there isn't as much selection. Books sometimes miss important topics.

Even though teachers aren't _allowed_ to photocopy regular textbooks, they do. Who's going to file a lawsuit?

There's more, but these aren't necessarily _drawbacks_ to open books, but reasons why they're not really being considered as much.

</comment></comment></comment><comment><USER7> This is completely off topic.. but how do you name your son "Dakota"? Poor boy ...</comment>


1 in 200 of men alive today are direct descendants of Genghis Khan - <AUTHOR> http://blogs.discovermagazine.com/gnxp/2010/08/1-in-200-men-direct-descendants-of-genghis-khan/

<comment><USER2> "DNA evidence - The Ian Ashworth Effect"

[http://en.wikipedia.org/wiki/Descent_from_Genghis_Khan#DNA_e...](http://en.wikipedia.org/wiki/Descent_from_Genghis_Khan#DNA_evidence_- _The_Ian_Ashworth_Effect)

 _Zerjal et al. [2003] [6] identified a Y-chromosomal lineage present in about 8% of the men in a large region of Asia (about 0.5% of the men in the world). The paper suggests that the pattern of variation within the lineage is consistent with a hypothesis that it originated in Mongolia about 1,000 years ago (thus several generations prior to the birth of Genghis). Such a spread would be too rapid to have occurred by genetic drift, and must therefore be the result of selection. The authors propose that the lineage is carried by likely male-line descendants of Genghis Khan and his close male relatives, and that it has spread through social selection. Both due to the power that Khan and his direct descendants held and a society which allowed one man to have many children through having multiple wives and widespread rape in conquered cities.[7] According to Family Tree DNA, Genghis Khan is believed to have belonged to Haplogroup C3._

\-- * --

The Genetic Legacy of the Mongols

[http://web.unife.it/progetti/genetica/Giorgio/PDFfiles/ajhg2...](http://web.unife.it/progetti/genetica/Giorgio/PDFfiles/ajhg2003.pdf)

</comment><comment><USER3> This is not as surprising as it might seem, and in fact is more of a statistical trick than anything else— according to Wiki, the most recent common ancestor of all humans alive today is believed to have lived only 2~5,000 years ago.

Of course Genghis Khan was unusually prolific, and the direct patrilineal aspect is what makes it special, but you don't have to go far back in time to find an ancestor you share with one in ten people, let alone one in a hundred.

<comment><USER4> Sorry that statistic seems completely impossible -- how would a man alive just before the roman republic became an ancestor to the Gauls (whom the Romans wouldn't discover for quite some time) let alone the American Indians?

<comment><USER3> All people alive _today_ , not all people ever. The article cited[1] quotes indigenous populations in North and South America dropping by 97% and 93% before 1570— in the centuries since, it has become statistically improbable that any Native Americans descendants exist who don't share a European ancestor with you.

Now it comes from a computer model, so there could be errors or exceptions— I'm thinking extant uncontacted peoples, here. The model accounted for this possibility, as the paper notes: _...in order for a remote island to affect the MRCA date, it must have been colonized prior to the lineage of the mainland MRCA reaching the source population and it must have remained genetically isolated until very re- cently in order for there to be surviving people with no modern mainland ancestry._

Remember that uncontacted peoples are uncontacted by _us_ ; the ones we know of have regular if infrequent contact with other tribes, so if contacted tribes share the MRCA it's quite probable that uncontacted ones do as well. Could there be a cache of 50-100 human beings somewhere on this planet who happen to share an MRCA with us who is older than the one shared by all other living persons, maybe 10,000 years? Sure. But they would be the only ones out of 7 billion.

[1] <http://tedlab.mit.edu/~dr/Papers/Rohde-MRCA-two.pdf>

</comment></comment></comment><comment><USER5> I wonder what the degree of relatedness (assuming inbreeding) these descendants actually have with Genghis Khan. We know that family trees break down into direct acyclic graphs over the longer term.

Note that the title assumes just patrilinear descent, so any man that may have had only daughters will not pass on the Y chromosome, though he will still have a non-patrilinear lineage (carried by both sons and daughters).

BTW, what are the main structural differences between strictly male and strictly female lineages?

<comment><USER6> The obvious one is a difference in branching factor. Women can have ten children, and I would expect many more men than women die childless (not only because more than half of all newborns are male)

<comment><USER7> I remember reading a long article/blog entry once, and it claimed that we living humans are descended from 80% of all the women who ever lived but only 40% of all the men.

Haven't been able to find it again, though.

<comment><USER8> Hrm, this may help you / someone else get closer. This also relates to the 2,000 - 5,000 year subject: [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.62....](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.62.1570&rep=rep1&type=pdf)

from Google Scholar: [http://scholar.google.com/scholar?hl=en&q=all+living+hum...](http://scholar.google.com/scholar?hl=en&q=all+living+humans+are+descended+from+80%25+of+all+the+women&btnG=Search&as_sdt=0%2C45&as_ylo=&as_vis=0)

</comment></comment></comment></comment><comment><USER9> It's worth noting here that this paper only looks at Kahn's direct descendants through the male line of Genghis Kahn. I believe that the number of people alive who are in any way related Genghis Kahn (through both matrilineal and patrilineal lines) is a lot higher than 1 in 200.

</comment><comment><USER10> Side question brought on by the headline: Is there such a thing as an "indirect descendant?" Seems like all descendants are direct.

<comment><USER11> Yep, there are "indirect descendants". If X is a direct descendant of Y's sister (or other sibling), then X is an indirect descendant of Y. Doesn't make much sense, and it's hardly ever used, but there you go.

Another reason to say "direct descendant" instead of just "descendant" is that it makes it clear that there's a blood relation.

<comment><USER3> And it makes a big diference— as I mention below, our most recent common ancestor is probably only 2~5,000 years old. However, genetic testing puts the age of our most recent patrilineal ancestor ("Y-chromosomal Adam", the one man every man alive now can say was his father's father's father's father's...) at more than 60,000, possibly 140,000 years old, and our most recent matrilineal ancestor ("mitochondrial Eve", the one woman etc.) is ~200,000 years old.

</comment></comment></comment><comment><USER12> Douglas Adams had something to say about this.

"Mr L Prosser was, as they say, only human. In other words he was a carbon- based life form descended from an ape. More specifically he was forty, fat and shabby and worked for the local council. Curiously enough, though he didn't know it, he was also a direct male-line descendant of Genghis Khan, though intervening generations and racial mixing had so juggled his genes that he had no discernible Mongoloid characteristics, and the only vestiges left in Mr L Prosser of his mighty ancestry were a pronounced stoutness about the tum and a predilection for little fur hats.

"...Mr Prosser's mouth opened and closed a couple of times while his mind was for a moment filled with inexplicable but terribly attractive visions of Arthur Dent's house being consumed with fire and Arthur himself running screaming from the blazing ruin with at least three hefty spears protruding from his back. Mr Prosser was often bothered with visions like these and they made him feel very nervous. He stuttered for a moment and then pulled himself together.

"...He saw the bulldozer driver's union representative approaching and let his head sink back and closed his eyes. He was trying to marshal his arguments for proving that he did not now constitute a mental health hazard himself. He was far from certain about this - his mind seemed to be full of noise, horses, smoke, and the stench of blood. This always happened when he felt miserable and put upon, and he had never been able to explain it to himself. In a high dimension of which we know nothing the mighty Khan bellowed with rage, but Mr Prosser only trembled slightly and whimpered. He began to fell little pricks of water behind the eyelids. Bureaucratic cock-ups, angry men lying in the mud, indecipherable strangers handing out inexplicable humiliations and an unidentified army of horsemen laughing at him in his head - what a day."

(Hitchhikers chapter 1)

</comment><comment><USER13> What is really annoying about articles like these is that they don't actually tell you the Y-DNA haplotypes or SNPs in the phylogenic graph. Even if it isn't cluttering up the main article it would be great to have as footnote information for those of us who actually know our Y-DNA information.

Sure enough, by clicking through and getting to the real journal article, this is the footnote that accompanies the graph which is duplicated in the Discover article:

      Figure 1 - Median-joining network (Bandelt et al. 1999)
      representing Y-chromosomal variation within haplogroup C*
      (xC3c). Chromosomes were typed with a minimum of 16 binary
      markers (Qamar et al. 2002; Zerjal et al. 2002; our
      unpublished observations), including RPS4Y and M48, to
      define the lineage C*(xC3c) (Y-Chromosome-Consortium 2002),
      also known as haplogroup 10, derived for RPS4Y and
      ancestral for M48. Sixteen Y microsatellites were also
      typed, but DYS19 was excluded from the network analysis
      because it is duplicated in haplogroup C. The central star-
      cluster profile is 10-16-25-10-11-13-14-12-11-11-11-12-8-10-
      10, for the loci DYS389I-DYS389b-DYS390-DYS391-DYS392-
      DYS393-DYS388-DYS425-DYS426-DYS434-DYS435-DYS436-DYS437-
      DYS438-DYS439. Circles represent lineages, area is
      proportional to frequency, and color indicates population
      of origin. Lines represent microsatellite mutational
      differences.

If you are interested in DNA and haven't tested your own Y/mt-DNA, I highly recommend getting it tested (e.g. FamilyTreeDNA) and finding out a little bit more about yourself.

<comment><USER2> _"According to Family Tree DNA, Genghis Khan is believed to have belonged to Haplogroup C3."_

\----

 _"One particular haplotype within Haplogroup C3 has received a great deal of attention for the possibility that it may represent direct patrilineal descent from Genghis Khan."_ <http://en.wikipedia.org/wiki/Haplogroup_C3_(Y-DNA)>

</comment></comment><comment><USER14> I've recently read that about every second western european male is somehow a descendant of the egyptian pharaoh Tutenchamun. I actually lived right next to the labs of a company where you can get yourself tested for that specific gene (and all other sorts of DNA related tests).

I guess then it is not too uncommon to have some genetic relation to any kind of people if they've lived many hundreds of years ago.

</comment><comment><USER15> Also, I remember someone doing "math" on how many women Genghis Khan had to sleep with everyday his life to reach the number he did (it was like 2,000 women wasn't it?) compared to his lifetime... I remember the number being pretty ridiculous.

<comment><USER16> Well, if it was only 2000 women, and he was doing it during his entirely 21 year reign, then he was only sleeping with a new woman on average a little bit less than every 4 days.

</comment></comment><comment><USER15> I remember reading a fact like 4% of China is related to Genghis Khan. Considering the amount of people in China this statistic of 1:200 makes sense.

</comment><comment><USER17> The ideal lifestyle if life was perfect would be that of Genghis Khan. There'd be no use for religion, spirituality, philosophy, etc. All of philosophy stems from "I can't have everything that I want, so...". But if you can have everything you want: endless supply of women.. then life is all grand. You conquer, You win, You build, you get endless orgasms. No need to master your emotions and deal with unfairness.

<comment><USER11> Also an endless number of people trying to kill you. Not to mention that - while Genghis Khan's religion isn't known - it was probably either Shamanism or Tengriism, and he was "interested in learning philosophical and moral lessons from other religions. To do so, he consulted Buddhist monks, Muslims, Christian missionaries, and the Taoist monk Qiu Chuji."[1] So you're operating under an "idealized" view of his life. And that's without even getting into the misogyny that your opinion reveals.

[1] <http://en.wikipedia.org/wiki/Genghis_Khan#Religion>

</comment></comment><comment><USER18> This is "come up with a ridiculous theory" season. Enjoy!

<comment><USER11> This is actually a pretty well accepted theory that's been around for a while.

<comment><USER18> Yes, really?</comment></comment></comment>


Ask HN: How do I show recruiters my work on a platform for paid users only? - <AUTHOR> My last job was on a platform that is only for paid membership, so visitors can not see what's inside.
Now I'm applying to remote jobs, and they ask what is a project that you're most proud of,
and I can't include it because its only for paid users,
how can I include my experience and prove it? <comment><USER2> I've been a software developer for 20+ years, and almost all of my work has been on things I can't show to potential employers. Tell a story about how you made an impact, use screenshots or video to supplement, but don't try to "prove" anything. If they don't believe you, then you don't want to work there or you need to get better at telling your story.

(This doesn't apply to designers, or people trying to get a job based on UIs they've created.)

</comment><comment><USER3> Usually the only people who want work samples are freelance clients. I've never had a company recruiter ask me to show them a live demo of the work I've done. Just tell them what you did.

<comment><AUTHOR> yea its that when filling and online application they ask you what you did and a url, and then you have a url but no credentials for them to try

<comment><USER4> Does the product have a marketing page that explains / shows it? That should be sufficient.

<comment><AUTHOR> YES, great to know!

</comment></comment></comment></comment><comment><USER5> Take a screenshare video recording. Lots of extensions work.</comment>


Ask HN: Help me be a better CEO - I need to learn the tech. - <AUTHOR>

I've read repeatedly on HN that a CEO must at least be familiar with every aspect of his or her business and I thoroughly agree.
I've been running my startup for over a year now and handling everything but the tech aspect pretty well (hired a developer). Now I'd like to gain an understanding of the technical aspect of things to the point where I can at least understand how much work a feature request translates to.
The web app is built on Rails, Javascript, HTML and CSS. Sorry if any part of that was redundant.
I'd like thoughts from hackers on where to start with learning how to code for a web application. I know there's a lot of languages and options out there depending on what I want to do so I hope I've made my end goals clear. I'd also like to understand the interplay between Ruby, Ruby on Rails, PHP, Javascript, etc. I literally know next to nothing about the technical aspect of it and I want to change that.
What language should I start with, knowing my goals?
What specific resources would you suggest for this (paid, free, anything)?
Thanks in advance for your help. <comment><USER2> > I'd like to gain an understanding of the technical aspect of things to the > point where I can at least understand how much work a feature request > translates to.

First, you should read "The Mythical Man Month" and then start learning about the specifics of coding. Doing it in the reverse order is the path of painful and expensive mistakes.

EDIT: I would suggest the expanded anniversary edition, rather than the original edition of the book. Also, having a minimal understanding of ancient systems (pre hard drive main frames) is helpful but not required. You can always ask here on HN about the difficult, odd and adventuresome aspects of old hardware.</comment>


The Linux Documentation Project Guides - <AUTHOR> http://www.tldp.org/guides.html <comment><USER2> Not sure what there is to talk about here: TLDP has been essentially dead for many years, unfortunately (exactly one document was updated in 2015; one was updated in 2014; ..). It was a fantastic resource back in the day (I wrote one of many HOWTOs), but lost any relevance at least a decade ago.

<comment><USER3> Yeah. It really needed sponsorship of some sort back in the early 2000s to help keep it organized and managed. It got none and as the original organizers moved on it left pretty much no one and even though some of the documentation was maintained, the project as a whole slowly faded.

</comment></comment><comment><USER4> Now days the guides put out by the likes of Linode and Digital Ocean seem to be more current and easy to follow. The other thing is that with so many flavors of Linux having one reference doesn't make much sense since each is a little different and always changing.

<comment><USER5> The Arch wiki has been extremely helpful to me aswell.

<comment><USER6> Arch wiki is extremely helpful if you know what you're looking for (for example I want to setup Secure Boot, it's easy to follow) but unfortunately there is no "best practices"/high level guides there (it takes a lot of time to think of the modern/"best" setup you want to have). It reminds me of Wikipedia's NPOV.

</comment></comment></comment><comment><USER7> The Arch wiki is probably the closest thing that's actually maintained. I'm personally not a big fan of Arch, but it's worth installing it and messing around with a bit so that you're able to distinguish the arch-specific instructions in their wiki from things that apply generically to the same daemons when configured on other linux platforms.

<comment><USER6> Just out of curiosity could you elaborate on the "not a fan of Arch" statement? Is this the rolling release model or just something else?

<comment><USER8> Not that person, but what put me off arch is that they aim to provide "vanilla" packages, which means I have to configure everything on my own.

It's fine for learning, but a hassle otherwise. Their wiki is becoming less useful too with their idea of providing less step by step and they want you to read everything and figure it out. Again fine for learning but sometimes you don't want to spend the time.

But I'm a user, not a sysadmin so maybe it's not aimed at me.

<comment><USER6> Thanks for your input! Which distro did you end up using?

<comment><USER9> I am also an ArchLinux refugee and I agree with the previous post about docs and just the general difficulty of using the distribution. It was fine when I was younger and had more time to kill configuring my tools but now I just want "works out of the box" mostly.

I use Fedora with XFCE.

</comment></comment></comment></comment></comment><comment><USER10> These HOWTOs are how I taught myself to become a sysadmin when I was 16. It would be great to bring something like it back. (I have been lazily working on something, but nothing solid yet)

<comment><USER11> I've used the TLDP network guide as recently as last year.. If you make a replacement for TLDP, I hope you will focus on collaborative processes and guidelines. I think that is what made the TLDP guides useful for decades.

There's no shortage of more recent material that is less useful than combining TLDP with manpages of new commands..</comment></comment>


ColorJack: Automatic color chooser for complementary colors. - <AUTHOR> http://www.colorjack.com/sphere/?LoadJack=fu:17,blind:0,mode:0,model:1,maly:1,currMe:191x191,cpu:0.735,cpv:0.265,abu:0.9,abv:0.07358,aeu:0.4719,aev:0.52705 <comment><USER2> This is pretty cool. Wish I'd implemented a save feature already...

<comment><AUTHOR> I certainly agree..

I find this particularly useful for my own designs, as I care quite a bit about design principals, and want to try to build applications with simple yet beautiful UIs, but I tend to fall flat on Color.

Part of the problem may be that I have a color deficiency- Greens and Greys blur together in particular, but more so, I tend to identify color primarily by intensity, then by hue, which means that I get them mixed up on occasion.

Something like this allows me, and other design challenged individuals to experiment, and look at sets of colors that often go well together.

While there isn't a Save feature for the website itself, it does allow you to download a color set to use with prominent applications, or to create a bookmark to upload..

I also love that this is available as a Widget, so you can run it locally in Dashboard.

<comment><USER3> You can save the URL of the color scheme by clicking the "sphere" link on the right hand side of the webpage. Is this the save feature you were looking for? Or something else?

</comment></comment></comment><comment><USER4> I find it pretty useless-- color is a 3-dimensional space, and this site seems to have left off a dimension (saturation is missing --degree is hue, radius is color).

I find <http://www.colorschemer.com/> much more useful, though non-free. In particular they have a cool feature that lets you extract color schemes from photos.

Also cool/useful:

<http://kuler.adobe.com/>

<comment><USER5> No, you control the saturation with the radius.

<comment><USER4> whoops, typo. You control the brightness/luminance with the radius.

</comment></comment></comment><comment><USER6> If somebody comes up with an automatic whitespace chooser then I'll be interested. Color is a relatively easy part of design.</comment>


Show HN: JHades – Your Way Out of Jar Hell (Java) - <AUTHOR> http://jhades.org/

<comment><AUTHOR> JHades In a Nutshell - JHades is a tool that helps troubleshooting classpath problems. The main features are:

-Duplicate classes detection: a command line tool list duplicate classes in a WAR, and allows filtering 'harmless' duplicates -Runtime classpath debugging: a utility class exists to query the classpath at runtime for details on the class loader chain, jars, hidden class files, etc. -Server startup troubleshooting: jHades works works well in scenarios where the server does not even start</comment>


How to Stick to a Learning Habit - <AUTHOR> https://blog.savay.app/how-to-stick-to-a-learning-habit/ <comment><USER2> Nothing of value in that article, just an ad for the app. I don't think installing one more app is going to improve my habits.

</comment><comment><USER3> > Learning is straightforward. You look for the best sources, schedule a time, > take notes, and practice till you perfect.

I know this is just throw-away sentence to kick off the article, but I disagree.

Learning is straightforward if you have a kind learning environment where the outputs match up perfectly with the inputs and you can see exactly what you're doing correctly and where you're going wrong. But if the learning environment is wicked, and it's no longer easy to tell where you're going wrong -- or worse, you're misled to believe you're doing things correctly when you aren't -- then learning isn't straightforward at all. It's why some people practice for years and don't get any better.

</comment><comment><USER4> > I remember her saying, "AI is an algorithm that allows machines to make > autonomous decisions..." Her explanation was one of the best I came across.

That's enough for me

</comment><comment><USER5> This is nothing but an ad for app which doesn't even exist yet. Nothing of material was said in the article itself.

</comment><comment><USER6> Fluff piece offering nothing of substance, tied in with learning app which hasn't launched yet.

</comment><comment><USER7> I read the article and clicked on the logo to learn more about the product... However the link directed me to [https://127.0.0.1/](https://127.0.0.1/)

</comment><comment><USER8> Sign up form didn't work for me.

<comment><USER9> Same it says something went wrong while submitting the form.</comment></comment>


Decline in the labor share of income in the U.S. - <AUTHOR> http://www.vox.com/2015/1/8/7511281/labor-share-income <comment><USER2> One of the key concepts for thinking like an economist is noticing where and how things are economically equivalent, or literally fungible.

Trade (like outsourcing) and technology is economically indistinguishable from technology from the perspective of a single country. The classic example is that if you export potatoes and import cars, this is economically equivalent to finding a way to grow cars in a field.

In practice trade and technology have always been closely related. When China could make silk and Italy could make glass, trade was very obviously a substitute for the technology.

So basically, it makes a lot of sense to treat advancements in trade and technologies similarly in our thinking. Luddite ideas and economic isolationist ideas are in this sense different flavors of the same reaction by those made redundant.

Personally, I don't buy "robots wil take all jobs" wholesale. There's a lot of guesses in there we don't have a rational way of making. We need to remember the many incarnations of Ned Ludd though time, including eminent figures like Ghandi. I think they've all been wrong regarding the big picture. While this time might indeed be different, we need to give some respect to the fact that this is an idea we have a long history with, and we've been wrong about it in most cases.

That said, I think the pace of change is a new part of the mix. The work in a 1850 factory and an 1875 factory was not different to the same extent as 1990-2015. People with 1990 skills now are not employable today in many/most fields. If that condenses further as I think it will, many people will fail to stay employable from 18-65, which means more unemployment.

I think we also need to consider some points Marx was fairly right about, the inevitability of political instability as a result of certain economic realities. Too much inequality can lead to revolution.

<comment><USER3> Can you really imagine a 18th century France style revolution in the west today? Try! I can't. Why is that? People haven't changed in 200 years yet it's completely unimaginable.

<comment><USER4> I'd say it's a combination of A: a long period of relative stability and B: in the west, _everyone_ is freakishly wealthy by historical standards and has a lot to lose, thus, you lack a base of desperate people with nothing to lose. (Chatter about "wealth inequality" in the West can sometimes cover over the fact that by historical standards, we have basically cured poverty as much as we can, modulo some fiddling around the edges of incarceration vs. institutionalization vs. homelessness at the fringes. Doesn't mean it's not bad or not a problem, but it does pay to contextualize it historically every so often, to stay grounded.)

On the other hand, it does mean that if there any sort of instability, people will have to rediscover from scratch how to deal with it, a process that sounds relatively painful to me. Here's hoping we never really have to find out.

<comment><USER5> >everyone is freakishly wealthy by historical standards and has a lot to lose

You raise a really good point here, and I think this is one of the most important stabilizing factors in today's society.

</comment></comment></comment></comment><comment><USER6> There are more issues here that could be discussed - particularly what is pointed out already in point 5, statistical quirks - but I'll stick to this one in point 6 for now:

"Another possibility is that the decline is more recent than we assume, and the result of slack in the labor market is due in large part to the recession."

I haven't studied US data, but in my country (Finland), which is a small country dependent on trade, the impact of recession is exactly the opposite. Recession means that the labor share of income goes _up_ , not down. Labor share of income has been in historically local highs at a time when life was very very bad (1992-1993): high unemployment, falling income, foreclosures.

The labor share of income has gone down here, as well. But it's not because of more money going to capitalists. Their share has been essentially the same since 1970's (23-25%). In my country, the falling share of labor is almost entirely explained by the rising share of state: the proportion of taxes on production and imports has gone up by about 5 percentage points, from 10 % to 15% of national income. So the share of labor has gone down from ~67 % to ~60 %.

I wrote this blog post three years ago but it's still quite valid: [http://ptaipale.blogspot.fi/2012_08_01_archive.html](http://ptaipale.blogspot.fi/2012_08_01_archive.html)

<comment><USER7> " Recession means that the labor share of income goes up, not down."

I think that is the way a capitalist system is supposed to work. Unfortunately in the UK and the US at least, they have been throwing money at the problem in the form of quantative easing. This has almost certainly kept asset prices high (the UK is well overdue for a hous price crash), and I assume that it has the effects of keeping labor prices lower.

<comment><USER8> Nobody has ever explained to me, in a satisfying way, what's wrong with a helicopter drop.

Edit: I mean helicopter drops in the original sense. That is, printing money and the giving it away unconditionally and equally to all flesh-and-blood citizens.

<comment><USER9> >Nobody has ever explained to me, in a satisfying way, what's wrong with a helicopter drop.

The main effect would be a a transfer of wealth from debtors to the indebted, a hit of inflation and an economic stimulus effect.

The economic multiplier would not be as high as something like SNAP (which is about 2.5-3.5x I think), since the middle classes and rich recipients would just squirrel away what they got. Or use it to pay down debts. It would have a higher economic multiplier than pretty much any money that's been funneled into bailouts though.

Whether all this is "good" depends on your perspective.

Practically speaking, though, any potential helicopter drop is going to be so small it will have virtually no effect. At the same time, it'll be demonized every step of the way by the people who would hate the precedent it would set (i.e. anybody who is owed money).

I think whatever your desired effect is there's probably a better tool to achieve it than a helicopter drop. It's a fairly blunt tool.

<comment><USER10> Why is a helicopter drop more prone to inflation than QE? Presume we're in a liquidity trap as the proponents of helicopter drops and QE do.

Edit: I have misinterpreted what you said. I read your first sentence as explaining what was wrong with a helicopter drop of money, because that is what was asked. However you probably didn't mean that to be a list of bad effects, just effects, to set the stage for your real answer which is the multiplier. Which is indeed the most important thing to consider.

<comment><USER11> A helicopter drop will put money into the hands of poor people, causing them to consume. Concretely, a poor person might eat more. This makes food prices (included in CPI) go up, hence inflation.

In contrast, QE might also stimulate investment. Concretely, we might build a factory or a road. This makes industrial machinery prices (not included in CPI) go up, hence no inflation.

Since the goal of stimulus is to reduce real wages and induce workers to stop turning down productive labor, the former is more useful than the latter. Of course, there are countervailing effects - giving workers money directly can substitute for them getting a job. (See my other post: [https://news.ycombinator.com/item?id=10438248](https://news.ycombinator.com/item?id=10438248) )

<comment><USER12> What you're saying doesn't make sense. Why would anyone invest without expecting more consumption?

The economy cycle doesn't start with investing, it starts at consumers having money and giving them to someone in exchange for a service or product. How could you know what to invest in before there is even demand?

<comment><USER11> There is clearly demand present, given that we have not (as an economy) reverted to 100% subsistence farming. In any case, you don't need to expect an increase in consumption to invest - one can simply expect to steal customers from the other guy. Uber's investors didn't expect Uber to create new rides, merely to steal riders from the cartels.

Of course, if you are correct that no one will invest, then all the money from QE will be funneled into consumption. This will have the same effect as the helicopter drop, modulo distribution.

<comment><USER12> What I mean is that there can't be _more_ investment without more demand. In the Uber example, there won't be more investment either - if you expect Uber to grow on behalf of other companies, these will be divested. In fact, you could expect decrease of investment with Uber, like with any other new technology (disputable in Uber's case, but for the sake of argument), because the whole point of moving to new technology is to decrease investment needed to maintain the same level of consumption (that is, increase productivity).

> all the money from QE will be funneled into consumption

They are, after sitting there idly for a while. The bank CEOs have to pay their mistresses and so on.

And distribution is important too. The whole problem of debt deflation is that you have money sitting idly (or better say idly circulating in an endless vortex of financial machinations), not being spent on goods and services.

<comment><USER11> I think you are confusing investment and cost of operation. Investment is building the new technology, cost of operation is the cost of providing consumption. Increasing investment today will indeed increase production in the future - that's the whole point.

*They are, after sitting there idly for a while. The bank CEOs have to pay their mistresses and so on...money sitting idly..."

The production is either consumed, invested, spent on government or exported. P=C+I+G+NX. You seem to believe it can be neither C nor I (well sometimes), so are the wealthy spending all their unconsumed income on government or exports?

<comment><USER12> > Increasing investment today will indeed increase production in the future - > that's the whole point.

So you agree that for the investment to be worth it (and thus made), consumption in the future must increase (or at least appear that it will increase to the investor)? That was my point.

> The production is either consumed, invested, spent on government or > exported.

I talked about money, not production. Money can be saved, or in today's world more likely, ran around in circles through the financial system, without ever causing more consumption to happen.

<comment><USER11> No, for the investment to be worth it the return needs to exceed the risk free rate.

If your sole claim about money is that there needs to be a functioning monetary system so that the consumer can easily transfer value to the producer, I agree.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Love it! This article is the best I've seen so far on a topic I've been writing about for years, ever since Obama said this:

[http://m.youtube.com/watch?v=yIBhg1v4bMo](http://m.youtube.com/watch?v=yIBhg1v4bMo)

All those politicians promising the middle class jobs to come back ... they are selling you a bill of goods. Automation and outsourcing has caused wages to fall. David Harvey argues this started in the 70s but was masked by the consumer credit boom and the internet boom:

[http://m.youtube.com/watch?v=qOP2V_np2c0](http://m.youtube.com/watch?v=qOP2V_np2c0)

WE WILL NEED expanded safety nets, preferably in the form of a universal basic income, so laid off people can re educate themselves. This money can come from taxing the gains that corporations make from automation, not enougu to disincentivize R&D but enough to redistribute some of that value to offset the DEMAND SHOCKS to local human labor. Without this we are heading for trouble. We do not have an elastic system right now that responds to increasing automation!

"He who does not work does not eat" \- we need to decouple these in our economic system.

And contrary to what anarcho capitalists believe, it will enable more efficient allocation of resources: [http://magarshak.com/blog/?p=185=1](http://magarshak.com/blog/?p=185=1)

<comment><USER9> >Automation and outsourcing has caused wages to fall

Outsourcing, austerity and union busting have caused _vastly_ more damage to wages than automation ever has or ever will.

Automation is simply given most of the credit for it because it's a _fantastic_ scapegoat. That's the real reason it appears at the the top of lists like these.

It lets American oligarchs and the politicians and elite economists who follow in their wake redirect blame for outsourcing, austerity and union busting and cast their opponents as luddites who are "against progress".

I think basic income is performing a similar, although slightly different function. Almost every person who advocates for it realizes that it's a political non-starter. This is, of course, glossed over every time that it is brought up.

The great thing about it being a political non-starter is that, as an oligarch you can advocate for it maintaining your progressive and 'forward thinking' credentials and your notional _opposition_ to income/wealth inequality while safe in the knowledge that you will never have to actually suffer its effects (higher inflation & a less pliant workforce).

You can continue to enjoy the great benefits income an wealth inequality has to offer you and still remain "one of the good guys" in the public eye.

<comment><USER14> What austerity are you talking about? There was no austerity in the US. The US government has spent more money every year throughout the financial crisis.

Also I assume by "outsourcing" you actually meant "offshoring." But this was covered in the article -- it's part of globalization.

<comment><USER9> >What austerity are you talking about?

SNAP cuts were one example of a deliberately inflicted austerian reform. The overall cost was actually pretty low, but the ripple effect is magnified.

With less SNAP, low income families are far more reliant on their jobs for sustenance, which turns them into more pliant workers and who accept lower wages/worse hours.

>The US government has spent more money every year throughout the financial crisis.

Yes, well, funneling ever more money into too big to fail banks and bloated military contractors while cutting food stamps is still austerity as far as 99% of the nation is concerned.

<comment><USER15> The SNAP budget has doubled during Obama's presidency. It hasn't been cut.

Here's a chart showing its extreme increase:

[http://i.imgur.com/tGgtpmL.jpg](http://i.imgur.com/tGgtpmL.jpg)

And as a share of GDP:

[http://i.imgur.com/4JbxWiT.png](http://i.imgur.com/4JbxWiT.png)

The primary problem in the SNAP program, was the flood of people participating. The per capita sum didn't quite keep up with the large influx of people wanting to be on the program. However, that has been partially offset by increases at the State level as well.

The US has never spent more per capita on food programs overall, between the local + state + national level, than it does today.

There has hardly been a drop of austerity in anything in the US.

<comment><USER9> "The per capita sum didn't quite keep up with the large influx of people wanting to be on the program."

Which is just a euphemistic way of saying that SNAP benefits have been cut.

It may not look like austerity from your oblique perspective, but then again, you're _definitely_ not claiming food stamps.

</comment></comment></comment></comment></comment></comment><comment><USER16> The trend is going on for decades now. The rise of the finance sector is IMHO the main reason.

In the finance sector, multitudes more money is flowing today, than in the real economy with products and services. Big money is going, where the most interest is been made ... but the interest must come from somewhere. To think, that it just appears somehow and everybody is getting richer, is just wishful thinking. Finally, some day, somebody will have to work for it or somebody will loose something (e.g. land that is sold to investors, that use it to generate even more money).

So, more and more interest is made by investments, money lending or even speculations. Who are the losers? The working people, that just have not enough money to invest and use their working power or their brains to get the money for living.

Globalization is helping this trend. Money can just go where it is cheapest, instead fighting fights with worker organizations. In many countries, people are so desperate, that they sell their work for a prize, they merely can survive on.

Trend is going on. Money seeks better places to invest, more land to grab, more patents, more, more, more -- and for those that have not got money already, the possibilities to earn money or to get better of are vanishing, since more and more land is owned, more "intellectual property", more lobbyist, which say, how the laws shall be that shape our future. Also more trade treaties, like TPP, TTIP and the others, which create better conditions to invest and to make profits for corporations ... which are owned by big money.

<comment><USER17> But you have to ask yourself why the finance sector have been on the rise and the answer to that inevitably become technology which powers 4 things.

Automation Digitalization Globalization Capital intensive companies instead of labour intensive ones.

All these things allow for scalability and therefore support a "highlander principle" where very few players can control most of the wealth.

<comment><USER9> >But you have to ask yourself why the finance sector have been on the rise and the answer to that inevitably become technology

It's not technology at all. Technology doesn't confer the monopoly powers which have led financial giants to be so dominant. Technology can be copied, reproduced and replicated.

The reason is much more mundane. The financial sector has been given dumptrucks full of cash and special privileges in the form of valuable guarantees. They're an adjunct of the government in all but name.

<comment><USER17> This trend happens everywhere around the world. Even in social democratic countries like the Scandinavian countries this is happening and is only slowed down by the strong redistribution of wealth.

So yes regardless of how tight or lax the regulation is same trend is seen everywhere and the only thing they have in common is the use of technology.

Ignoring that is simply lying to ourselves.

</comment></comment></comment></comment><comment><USER18> Vox (Matt Yglesias) has another take on the subject here

[http://www.vox.com/2015/10/20/9570175/labor-share- housing](http://www.vox.com/2015/10/20/9570175/labor-share-housing)

However, the focus on zoning laws is a bit weird - taxing "location value" properly seems more obvious.

<comment><USER9> Sounds like scapegoating again. Don't look at the magician behind the financial magic curtain wielding QE and deregulating lending. Look at the busybodies in your neighborhood. It was all them.

<comment><USER19> Yeah, because Matt Yglesias is leading the conspiracy on behalf of the big banks.

I guess you're not familiar with his work.

<comment><USER20> Yglesias is someone I'm pretty comfortable putting in the "neoliberal shill at first blush" category though, even if he's trolling

</comment></comment></comment></comment><comment><USER17> Outsourcing really just is the last step before automation. The major trend to look for is always cost of production where labour being the number one cost.

In order for products to keep getting cheaper the cost has to come down. This trend doesn't stop just because we outsource it to China or Brazil or India and so even they become too expensive.

Unless economist start factoring in technology as one of the key economic factors rather than treating it as they do now – an externality – we will still argue about whether too much government or too little government is going to save us all.

And the politicians wont do anything because they don't see it projected in the forecasts the economist give them.

In the meantime robots are going to slowly but surely put most of us out of a job in almost all the industries we know of right now.

Or put another way – it's the technology stupid.

These three graphs paint a picture that says a lot.

[http://www.technologyreview.com/sites/default/files/images/d...](http://www.technologyreview.com/sites/default/files/images/destroying.jobs_.chart1x910_0.jpg)

[https://plot.ly/~BethS/8/job-growth-by-decade-in-the- united-...](https://plot.ly/~BethS/8/job-growth-by-decade-in-the-united- states/)

[https://hateandanger.files.wordpress.com/2013/10/trends- in-u...](https://hateandanger.files.wordpress.com/2013/10/trends-in-us-gdp- profits-investment-and-employment-1995-2011.jpg)

</comment><comment><USER21> I mildly object to the title which would be better saying US in it. For the other 95.6% of us non US persons things have often been different. Here's a graph showing US wages largely static from 2000 to 2011 while China's have gone up something like 5 fold.

[http://www.marquetteassociates.com/Research/Chart-of-the- Wee...](http://www.marquetteassociates.com/Research/Chart-of-the-Week- Posts/Chart-of-the-Week/ArticleID/378/The-Wage-Gap-Between-the-U-S-and-China- Continues-to-Narrow)

<comment><USER17> Yeah but please keep in mind where they came from income wise.

Don't think for a second that the chinese will be spared when also they are too expensive.

Between 98-04 the US lost 4 million jobs t the chinese in that same period the chinese lost 18 million to the robots.

Outsourcing is just one step before automation.

</comment></comment><comment><USER22> What about quantitative easing? QE is like making the financial part of the economy grow on steroids.

</comment><comment><USER23> [http://www.amazon.com/Debunking-Economics-Revised- Expanded-D...](http://www.amazon.com/Debunking-Economics-Revised-Expanded- Dethroned/dp/1848139926)

Just going to leave this here. Its a real helpful read for any kind of economics debate.

</comment><comment><USER24> I appreciate the sentiment, but that graph is awful. On a scale of 0-115 they are showing just 20 of it, wildly exaggerating the scale of the drop.

<comment><USER25> You _never_ see financial/commercial graphs with a zeroed y-axis; why should graphs criticising finance/commerce be subject to this condition?

The graph correctly illustrates what they are trying to show, with the correct numbers that you have correctly identified.</comment></comment>


Homecooked Mobile Device Lab - <AUTHOR> http://bishless.com/operation-homecooked-mobile-device-lab

<comment><USER2> Oh man, I absolutely _love_ this. If I had the desk space, I'd definitely attempt to rig up something similar - especially with older devices. Nothing beats testing on actual hardware, especially when they throw up those odd bugs that made you realise why stuff isn't converting on whatever (like VH units old Safari versions).

Chrome's element inspector is great (especially for testing retina images on a normal machine), but in the early days of a project - or at least until I can sit down and test it on actual devices - I like testing something using iFrames to represent device widths just to get the responsive breakpoints right and see everything at the same time. I knocked something up here: [https://github.com/yesiamben/Responsive- Tester/](https://github.com/yesiamben/Responsive-Tester/) (or example [http://www.responsivetester.net/?http://bishless.com/operati...](http://www.responsivetester.net/?http://bishless.com/operation- homecooked-mobile-device-lab/) \- this post link included!).

</comment><comment><USER3> How nice the world would be if one could independently update the webview in Android without having to rely on the manufacturer.

Or if one could just have it updated by the Play store...

<comment> w-ll Im pretty sure Android can, just the other day I installed an update just to the internal webkit components.

</comment></comment><comment><USER4> What material did you use to built the device table? Any steps and guidance on that would be much appreciated.</comment>


Show HN: Pitch Deck Hunt – 100 real pitch decks from the best startups - <AUTHOR> https://www.pitchdeckhunt.com/ <comment><AUTHOR> Hey Hacker News Community

My name is Max, and I'm an entrepreneur based in Germany. Over the past years, I have been passionate about pitch decks as one challenge every entrepreneur will face on their journey. I always took a lot of inspiration from the pitch decks that are already out there.

And there are already some collections on the internet, but most of them lack recent decks and some functionality I would like to have — That's why I took some of my time and built Pitch Deck Hunt.

With Pitch Deck Hunt, it is my goal to build the leading resource of pitch deck examples on the internet together with you!

100+ real pitch decks from countries around the globe from Pre-Seed to Later Stage for every industry

We are adding new pitch decks every week so that you can get your weekly dose of inspiration.

 I am always looking for more awesome decks, so if you have any that I have missed - please let me know.

I hope you enjoy this site and get some value! Let me know any feedback you may have, whether more resources or ways to improve the site!

Will love to work on the next version of it!

</comment><comment><USER2> This has the potential to be a treasure trove for quantitative research in addition to qualitative exploration. What fraction of decks started with defining the problem to be solved vs. presenting the solution, for example.

If there is any way you could extend this collection to include some chronological and/or raise sequence information it would greatly help those interested in doing that kind of analysis on the data (what year was this version of the deck used, and was that a seed or Series C round, etc).

I'll assume that kind of data may not be core to your interests in decks, but having a standardized way to present it in your pages when available and an easy way for those who have that sort of info to send it to you would help make this collection grown in value.

It may also be interesting to eventually have multiple decks for a given company, both for different raises and within a single round (many times founders will tweak and revise their deck based on feedback as a round progresses). Just getting one copy of a deck is hard enough, but you might at least think towards the question of how would you present the data if you had multiple different copies of the seed round deck from an interesting unicorn.

Thanks for assembling and presenting this wonderful collection.

<comment><AUTHOR> Thank you for your kind words. We will keep up the work!</comment></comment>


Ask HN: Why do people create incomprehensible spam? - <AUTHOR>

I run a blog with comments and spam's a bit of a problem. I get that in some cases people try to put links on their for various reasons. However, we also get a lot that doesn't seem to serve any purpose. for example, on from today:
"chanel 化粧品tf szn bttt fy mlfpy urdirp cfyss
pletcherdrw - March 15, 2013 @ 8:08am
ku gcfd hsff pvs tqmu hntu qyo xdij gb fb rxi sjrp jszl hww hwdj kigk zav vkbx sc"
They've had to beat a captcha to post that. I know that's not the most difficult thing in the world, but it does require some effort. What advantage does this create for anyone?
According to Google translate, the Chinese characters mean 'cosmetic.' <comment><USER2> Maybe they're trying to post in an unsupported language or a partly unsupported language?

Also could just be sending out "test spam" so they can tell potentially clients that they have a n+1 list of sites which can be spammed for $50 (or whatever).

You often have SEO companies in particular buying lists of spammable sites or spam companies buying lists from indexers so they can sell a service to SEO companies or the mob.

</comment><comment><USER3> Entropy messes up certain kinds of anti-spam solutions. And captcha beating is mostly automated these days.

<comment><AUTHOR> Are you saying this is decoy spam sent purely to try and confuse my anti-spam system? It's an interesting idea.

<comment><USER4> Does your comment system strip out HTML tags and CSS? I used to work for an anti-spam company, and I'd see tons of those messages. It looks like garbage when you view the raw text, but with a bunch of font-tags everywhere alternating colours or floating things around, you end up with a message.</comment></comment></comment>


Show HN: Will It CORS? – an automatic CORS explainer - <AUTHOR> http://willitcors.com <comment><USER2> What drives me nuts with CORS is there's no (easy) way to disable it in the browser for development purpose, e.g. when I want to run some scripts in a local HTML file to do some basic web scrapping.

<comment><USER3> just use this [https://cors-anywhere.herokuapp.com/](https://cors- anywhere.herokuapp.com/)

or just set all your cors headers to * on your server

<comment><USER4> * is blocked by most browsers to avoid lazy developers putting their site wild open to abuse.

<comment><USER5> At least Chrome and Firefox don't block it. I've recently used something similar as an add-on until I did exactly what he said: manually setting a cors * header for that internal development server

</comment></comment></comment></comment><comment><USER6> As of sometime in 2020, the old CORS spec ([https://www.w3.org/TR/cors/](https://www.w3.org/TR/cors/)) now redirects to the WhatWG Fetch Spec ([https://fetch.spec.whatwg.org/](https://fetch.spec.whatwg.org/)) which I think is unfortunate because the old CORS spec ([https://www.w3.org/TR/2014/REC- cors-20140116/](https://www.w3.org/TR/2014/REC-cors-20140116/)) contains more exposition and also defines "simple method" and "simple headers" which everyone still uses but aren't even mentioned in the Fetch spec.

</comment><comment><USER7> An invaluable resource IMHO: [https://w3c.github.io/webappsec-cors-for- developers/](https://w3c.github.io/webappsec-cors-for-developers/)

</comment><comment><USER8> Thanks for creating this! Very useful.

Do you know what's preventing it from working in Firefox Focus/Klar? "Get Started" button does nothing unless tracker blocking (4 detected) is turned off. All tracker blocking options plus web fonts blocking are on, JavaScript is allowed and Cookies are allowed excpet 3rd party.

</comment><comment><USER9> I hope, some day to actually understand CORS. What it does. Why it exists. What good does it do. It seems extremely weird to me that my web page cannot get a simple json file from my GCP VM which is just serving that file and nothing else.

<comment><USER10> The problem with cross-origin requests as I understand it essentially boils down to cookies. If cross-origin requests weren't blocked by default, any site you visit could send requests to your bank, for example. Since those requests would send auth cookies, they could potentially make changes to your bank account. So these requests are disabled by browsers unless the bank explicitly tells them (via CORS headers) that it's ok.

IMO the better way to handle it is by allowing cross-origin requests, but locking down cookies so they aren't sent cross-domain by default (ie by setting SameSite on cookies). For my services I generally open CORS up, but only implement authenticated requests with API tokens. The main problem is if you set a custom header (such as Authorization: Bearer) it triggers a preflight request. The only reasonable way I know around this is sending the token in the query parameters, but that also introduces some security issues.

</comment></comment><comment><USER11> Beautiful, definitely one of the clearest walkthroughs I've seen on CORS, with enough detail to understand what's going on with all those magic headers.

</comment><comment><USER12> I've tried to deal with CORS, but I find it very confusing which different setting covers which scenario and which side needs to send what.

Maybe I'm missing something obvious, but I was trying to get a pdf file embedded in an iframe, where the pdf and the web page are on the same server.

So what needs to be sent with the webpage that has the iframe tag's response? What needs to be sent with the pdf file's response?

Also, I have some links that pull in styles from an external CDN (probably something I need to eliminate at some point, but these styles pull in font resources using relative urls and I need to untangle all of that to set it up locally, and it's probably not worth it at the development stage). These broke while I was experimenting with CORS. I also have images and scripts and styles that are local.

Browser-variations on the CORS headers and conflicts between different headers was something else I found confusing.

I just ended up disabling CORS, probably will look into it again when I'm preparing to move into production, but it really struck me as a frustrating time sink.

</comment><comment><USER10> My main issue with CORS is the latency doubling introduced by preflight requests. I wish there was a more secure escape hatch for that than including things like access tokens in the query parameters[0].

[0]: [https://stackoverflow.com/q/61563348/943814](https://stackoverflow.com/q/61563348/943814)

<comment><USER13> If you set the Access-Control-Max-Age header [1] it will at least cache the preflight response for up to 2 hours in chrome.

[1] [https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Ac...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Access-Control-Max-Age)

<comment><USER10> That helps, but not for the first request at each endpoint, and for my use case I have many different endpoints. I wish there was an option to cache CORS for subpaths, kind of like how you can make a cookie valid for any subpaths under a specific path.

<comment><USER14> I think the usual approach is to proxy the other domain (or subdomain) to a path on your user-facing domain. E.g. if mysite.com is making requests to api.mysite.com, you would proxy api.mysite.com to mysite.com/api.

<comment><USER10> I'm building a pure backend service that I want app developers to be able to consume. If they have a static app, they shouldn't be required to run their own backend just to get around CORS. At the very least you're adding an extra hop, which is going to increase latency.

That said, it would be cool if static hosting services like S3 offered CORS proxies for uses like this. I wonder if that's a thing.

</comment></comment></comment></comment></comment><comment><USER15> I just which chrome would finally implement CORS correctly.

The main compatibility problem between FF and chrome I run into is that chrome doesn't completely enforces CORS allowing some requests it should not if it would be standard conform and sites only testing it on chrome.

</comment><comment><USER16> One thing that confuses me about CORS is who it is trying to protect. I'd never really looked into it recently, as I'd never done anything that needed a cross origin request.

But recently I wanted to make a little web page that could control my Denon A/V receiver. The receiver has two or three different network APIs. There's one that uses telnet, and a couple of different HTTP ones.

You can point a browser at the receiver, and it gives you a page for controlling the receiver using one of the HTTP APIs. The API is reasonably fast, but the control page itself is glacial. A bit of poking around in the browser looking at requests and responses in the network monitor in the developer tools told me how to use that API.

The other HTTP API is used by the Denon mobile app. A bit of packet sniffing while using the mobile app told me how to use that API. Like the other HTTP API, that one is fast. The mobile app is also responsive, once it launches, but sometimes it takes a fair bit of time to find the receiver.

What I wanted was a simple web page, that I could stick on my website on Amazon Lightsail, which would just tell me the current source and volume, have buttons to switch between sources, and buttons for setting the volume. The page would use JavaScript to talk to the Denon.

Well, this was fine for changing inputs and volume, because those were simple GET requests. The Denon's web server doesn't implement CORS at all, so the responses lack any CORS headers, and the browser rejects them...but by that time the actual desired action has taken place on the server so I can just ignore the error.

For source and volume, that doesn't work because I need to get the returned data.

I flailed around for a while trying to find a way around this. Finally I ended up giving up on the original place of having my page on my outside website. Instead I stuck it on an RPi that is in my living room controlling a space heater and doing temperature monitoring, and put some server side code on the RPi to control the Denon. The page then invokes that code on the RPi to do the actual commands to the Denon. The web page is only interacting with the RPi, so no CORS worries.

I probably got a bad impression of CORS from all this, but I can't figure out what it actually helps. Lets say we have a site that came from site S, running on the browser of user U, and from there is trying to do a cross-origin request to site C.

It's not protecting C from anything I can see, because any restrictions C specifies in the CORS response headers depend on U honoring them to do anything. Someone trying to do something malicious with C could just ignore them.

It's not protecting U from scripts sending out personal information to C, because CORS doesn't block _sending_ information if you do your sending in a way to not trigger the preflight check, which is easy to do. It just blocks your browser from doing anything with the response.

If a bad guy is able to get scripts to run U's browser for a site from S, it does block those scripts from getting data from C (unless C says it is OK). But if the bad guy really needs their script to get data from C, they could just go through an intermediate server they control that relays data from C. They control the CORS headers on their server, and can strip the CORS headers that come from C.

What am I missing?

PS: the Denon control page came out nice, I think [1] (well, except the centering of the "Recheck status" button looks off a bit...never noticed that before). It's all flexbox layout that resizes reasonable, so it is quite usable on my iPhone, iPad, Surface Pro 4, and iMac.

[1] [https://imgur.com/3tIhXUE](https://imgur.com/3tIhXUE)

<comment><USER17> > But if the bad guy really needs their script to get data from C, they could > just go through an intermediate server they control that relays data from C.

Your browser has access to 2 things that the malicious actor's server doesn't:

1\. your cookies (which it will normally send with any HTTP requests it makes)

2\. your network position (for example if you're on a private corporate network and have access to some internal corporate servers)

<comment><USER18> FWIW, #1 is both easily fixed and AFAIK mostly already fixed (making cookies additionally scoped by origin of the requesting page, preventing "third-party cookies"). To the extent to which it isn't fixed, it should be fixed at that level.

</comment></comment></comment><comment><USER19> Awesome work! It will be in my tutoring program!

</comment><comment><USER20> Sorry, but I still don't understand what CORS is or how it works.

</comment><comment><USER21> Informative and intuitive.

</comment><comment><USER22> Oh good, the Continuously Operating Reference Station network has always been something of a myst-...

Oh.</comment>


How Can Double-Spending Be Prevented? - <AUTHOR> https://medium.com/fleta-first-chain/how-can-double-spending-be-prevented-96721e50a480 <comment><USER2> While there have still been inherent issues with Bitcoin and extortionate fees i=on the Ethereum network, newer platforms -such as FLETA or Tezos - take it to the next level.</comment>


Wat - <AUTHOR> http://www.destroyallsoftware.com/talks/wat <comment><USER2> Wow, this title suffers from some serious editorializing. What's next, "10 ways to know if you are a hacker? (cracked.com)"

<comment><USER3> I feel like we've been suffering extra-much from this effect lately...

</comment></comment><comment><USER4>
       $ php -r '::'
       Parse error: syntax error, unexpected T_PAAMAYIM_NEKUDOTAYIM

Wat

<comment><USER5> Pffth, you just need to learn Hebrew before you learn PHP. That says "double dot twice".

</comment></comment><comment><USER6> Interestingly the results from jsc, are different from node.js:

\----- jsc </comment><comment>

       [] + []

       > [] + {}
       [object Object]
       > {} + []
       0
       > {} + {}
       NaN

\</comment><comment> node.js </comment><comment>

       > [] + []
       ''
       > [] + {}
       '[object Object]'
       > {} + []
       '[object Object]'
       > {} + {}
       '[object Object][object Object]'

<comment><USER7> I don't even understand what the last node.js entry is. Is that an array with two objects?

Also, I'm on an old version of node, but my output matches jsc.

<comment><USER8> The other reply is right, to clarify String({}) === "[object Object]"

I think the actual video was a little misleading, [] + {} == the string "[object Object]" not an object. The square brackets are just part of the tostring method and are unrelated to the square brackets of arrays.

</comment></comment></comment><comment><USER9> How does this have anything to do with a sense of humor specific to hackers? Don't all professionals enjoy jokes about their field?

<comment><AUTHOR> That is exactly what I was wondering: what you say must be true, but I could not find any equivalent of what you see here for any other profession.

But maybe it is just because I write code for a living...

</comment></comment><comment><USER10> that weird behavior of javascript can actually be used for xss attacks, by being able to assemble strings. for example:

       (![]+[])[+!+[]]

produces an "a".

<https://news.ycombinator.com/item?id=1153383>

<comment><USER11> But of course, anyone that actually wants to protect against XSS attacks won't allow user input to be evaluated. If they did want to allow user-supplied Javascript, they wouldn't blacklist, they would whitelist (by parsing the user-supplied script and using the AST to emit only whitelisted operations).

</comment></comment><comment><USER12> This is incredibly funny, but does anyone know why the interpreter makes such bizarre decisions? Why wouldn't it be preferable to just throw up errors?

<comment><USER13> The Ruby stuff apparently isn't bizarre. From what I've read, Ruby creates variables as it encounters an assignment to them when parsing the code. So, when you have

       a = a

in your code, Ruby creates the variable a before it ever tries to actually execute the assignment. If later, when it has finished parsing everything, and starts executing, that statement fails because b is not defined, you still end up with variable a being defined, and since it has not had anything successfully assigned to it, it has a value of nil.

The JavaScript stuff, I think, comes from operator overloading. The plus operator is overloaded to allow adding strings to concatenate them, and it will do type conversion to get compatible types, so "wat"+1 results in the 1 being converted to a string, and then the strings are concatenated. Since the minus operator is not so overloaded, "wat"-1 instead is treated as numerical subtraction. JavaScript allows string to be used as numbers, so "123"-1 gives 122. However "wat" is not a string that represents a number, so gives NaN when forced to be treated as a number, and "wat"-1 is thus NaN.

<comment><USER14> Thanks for that. I was curious the reason, it seems obvious though after an explanation.

</comment></comment></comment><comment><USER15> Guess I'm not a hacker? It's like watching a rerun I've seen twice over with the laugh track turned up to 11 (just to clarify, someone said it was a repost but I haven't seen it before).

<comment><USER16> Really? You don't think this is funny at all? Maybe it's because I'm in my mid twenties, but I think my father would even find this funny and he knows little to none about programming.

<comment><USER15> The humor is playing on an inclination to laugh at things we don't understand, which seems counter to the hacker ethos. Software is hard, and there may be deep reasons in the dynamic type systems that cause these languages to work like this, or there may not be, but either way this type of thing is interesting and seems to demand some further explanation and/or justification. I find it interesting but don't get the humor. Perhaps, as you implied, I'm just too old.

<comment><USER17> > The humor is playing on an inclination to laugh at things we don't > understand

I think is simply laughing at absurdity: the gulf between intention and actuality. We have quite a bit of that.

</comment></comment></comment></comment><comment><USER18> For some reason, what I find the most hilarious here is reading the _extremely serious_ HN comments. It's a weird contrast.

</comment><comment><USER19> I guess this is where we all complain about HN finally jumping the shark and turning into Reddit.

</comment><comment><USER20> Does anybody knows which is the javascript interpreter he is using on the screencast?

<comment><USER21> It's jsc (comes with Webkit) - it's present on Mac OS X by default in

/System/Library/Frameworks/JavaScriptCore.framework/Versions/A/Resources/jsc

You can just do:

sudo ln /System/Library/Frameworks/JavaScriptCore.framework/Versions/A/Resources/jsc /bin/jsc

To be able to invoke it directly from the command line.

<comment><USER20> Thanks, I'll look how to get this working on linux.

<comment><USER22> At least Arch has `js`package which gives you js command to obtain JS shell; in fact it is just Mozilla's SpiderMonkey. Anyway, the best option for "standalone JS" is node, mainly because it has a sane way of importing code from other files.

</comment></comment></comment></comment><comment><USER23> The presenter also has a catalog of screencasts here <https://www.destroyallsoftware.com/screencasts>. Haven't listen to them, but the topics look interesting.

</comment><comment><USER24> Have I been pronouncing "wat" wrong all this time? I just assumed it was like "what" but ... not.

<comment><USER25> No. I'm with you man. The way he said it was seriously bugging me. At the same time I couldn't justify my annoyance with an alternative pronunciation that made sense.

Perhaps some memes should never be vocalized.

</comment></comment><comment><USER26> What presentation software is he using? Is he just jumping from his slide deck into a shell?

<comment><USER27> It's Keynote. I recorded those sessions as screencasts, then sliced them into tiny pieces so I can advance them perfectly with my talking. There are 37 slides in that four-minute talk. In some cases, the slices are only two or three frames long.

<comment><USER26> Ah that makes sense, thank you. I may steal that idea for future talks with R. Though, just embedding a shell in a slide deck would be very nice.

<comment><USER27> I like the sliced screencasts because they're so repeatable. I practice my talks a lot, and I can get the timing down perfectly because it's always the same. Highly recommended. :)

<comment><USER28> The preparation really shows -- great job. Ability to present really well is a critical skill for anyone with a product head.

</comment></comment></comment></comment></comment><comment><USER29> Array(16)

That's 15 commas, not 16.

<comment><USER30> Handy way to make some padding:

        function pad(n, c) { return Array(n+1).join(c); }

        // pad(6, "-") === "</comment></comment><comment>"

</comment><comment><USER31> What's the "correct" ("less funny"?) result of

       Array(16).join("wat" - 1) + " Batman!"

?

Empty strings separated with _NaN_ s look perfectly logical to me (I'm a JS guy though, so, well, bear with me).

<comment><USER32> That's probably one of the more logical examples. I'd have expected an exception from any other language, though (Javascript I know doesn't tend to type error).

</comment></comment><comment><USER33> Even with my limited programming knowledge I laughed a lot through this.

</comment><comment><USER11> I guess you had to be there. I can see why someone might find this funny, but honestly, nothing is that funny. Some behavior in Javascript is surprising, but not _that_ surprising.

<comment><USER34> If you've ever gone through a phase (or a graduate degree!) of thinking deeply about programming language design, you might, as I do, find Javascript's expression evaluation behavior to be just about the funniest thing around.

<comment><USER11> I have but I don't. Javascript was designed to reduce programmer-visible errors at the cost of making it nearly impossible to write a correct program. At that goal, it succeeds, and [] + {} being NaN makes perfect sense under those constraints.

</comment></comment></comment><comment><USER35> why do i have to signup to know who much it costs to subscribe. I think it should be apparent on the home page.

EDIT ok my bad it was mentioned on the screencasts homepage

<comment><USER27> It's on the front page, but at the bottom. DAS is a small one-man business, so I did the design myself (and I'm not a good designer). Sorry about that. :)

</comment></comment><comment><USER36> I think that a hacker would also realize that the title makes no claim whatsoever about the hacker status of those who don't laugh.

</comment><comment><USER37> Congrats to all of you who laughed. You are all great hackers. I don't find this remotely funny.

</comment><comment><USER38> if you laugh, you know ruby.

</comment><comment><USER39> This is the greatest video ever.

</comment><comment><USER40> This is hilarious!

</comment><comment><USER41> At work people always tell me "You IT guys are all so funny."

</comment><comment><USER42> Quicktime? We don't need no stinking web standards!

</comment><comment><USER43> WAT

<comment><USER44> Wat.

<comment><USER45> Wat?

<comment><USER46> Wat? Isn't that somewhere in Cambodia?

</comment></comment></comment></comment><comment><USER47> This is a repost, but whatever. Hopefully people who haven't seen it before will enjoy it.

</comment><comment><USER48> Hilarious! This reminds me of a StackOverflow question which asked the users for the weirdest language quirks they could think of. I laughed pretty hard at that too.

</comment><comment><USER49> Wow, I laughed so hard I cried! This is hilarious...

<comment><USER50> wow, you must be the best hacker ever congrats

<comment><USER49> I understand the downvotes since this is HN and you people don't like useless comments here. But I simply thought it was very funny. No need to be mean here.

<comment><USER51> For the record, the downvotes aren't to be mean. We just don't want this turning into a Reddit clone and/or fill the comments with run-of-the-mill comments you'd see on any PHPbb forum.

No, I wasn't one of the ones who downvoted you and no, I'm not trying to be mean. There used to be times I wondered why an innocent comment of mine was downvoted and thought I'd just let you know instead of leave you hanging.

<comment><USER49> Thanks for the reply. Perhaps I was unclear. I completely understand the downvotes - that's why they're on the site. But I thought the "wow, you must be the best hacker ever congrats" comment was unnecessary and mean-spirited.

</comment></comment></comment></comment></comment><comment><USER52> I laughed so loud I scared myself. Now, I know why my wife looks at me funny.</comment>