McCain working on bill to allow for 'a la carte' cable TV packages - <AUTHOR> http://thehill.com/blogs/hillicon-valley/technology/298609-mccain-works-on-a-la-carte-cable-tv-bill

<comment><USER3> I would love a la carte TV, but make no mistake: it will destroy the profitability of cable companies.

Bundling allows cable operators to segment the market: to sell the same product to different audiences at different prices depending on their willingness to pay.

A $100 package of bundled sports + movies can be sold to the person who is willing to pay $90 for sports and $10 for movies and also to the person who is willing to pay $10 for sports and $90 for movies.

But sports and movies are unbundled, they must be sold at the same price to everyone. Should they be priced at $10 each? $90? Somewhere in between? Pick any price and the cable companies lose money: the person who values it more will pay less for it than they would have, and the person who values it less won't buy it at all.

EDIT: I don't want to sound pro-cable; indeed, I am not; I am just pointing out the effects of this legislation. In some ways, bundling is a natural way to package content. MOG, Spotify, and other subscription music services bundle their content (you don't get to pick and choose what you subscribe to), and the big daddy of disruption, Netflix streaming, doesn't let you unbundle either. It's one flat fee for everything. In these cases, of course, it's easier to swallow because prices are so low to begin with. Perhaps it's not bundling that's the problem with cable, but the pricing.

<comment><USER4> "will destroy the profitability of cable companies"

I would phrase it as "it will eliminate the monopoly of the cable companies". Which is a good thing. Sick and tired of the limited options we have with cable companies and the "bundles" they provide. I don't want bundles. I want to watch what I want to watch.

<comment><USER5> That would be interesting. I have exactly one choice for cable TV and Internet where I live. The alternatives (DSL or satellite) are too bad to even be worth considering.

</comment></comment></comment><comment><USER6> This will be lobbied into oblivion. Content providers won't go for it, because they currently use their popular programming to force their new ventures onto cable providers. You can't force a cable provider to put your crappy home and garden channel on their line-up, if nobody orders it. You can't argue with real sales metrics.

Further, cable providers can't make a living when all of their customers downgrade to the three basic-cable channels they actually watch, plus HBO. Because the idea of a la cart cable is to lower the bills by not paying for what you don't want.

Huge amounts of money will, from both sides of the cable programming negotiating table will align against this pro-consumer measure, because it will force a radical rethinking of an industry that has never really had to be pro consumer.

<comment><USER7> > This will be lobbied into oblivion.

Nearly every regulatory issue in telecom (and likely most other industries, but I'll just stick with what I know) is lobbied extensively by someone. Most issues will, whatever the underlying intent, benefit certain sub-industries over others. There's absolutely nothing wrong with that. In fact, it's virtually impossible to propose a regulation that won't affect the market. By definition, regulations are supposed to to affect the market.

To assume that "cable" will outright oppose this is false, and overly simplistic. Cable is hardly a monolith, and there are things in this proposal that different types of cable companies could conceivably support. NCTA, the larger cable trade org opposes the measure, while ACA (representing relatively smaller cable companies) supports at least many of the principles behind the proposal[1].

There's a big difference in policy goals between vertically-integrated and non-vertically-integrated cable companies. Comcast, as both a cable company and a content producer, probably does enjoy policies that allow for bundling and would oppose that certain part of the proposal. However, competing cable companies who are not vertically integrated would probably support such a measure. It's not a crazy thought that Independent Cable Co. X would like to pick and choose which channels to buy for its subscribers without being forced into a bundle. In other words, for the same reason that consumers might want this choice, many cable companies could want this as well.

The part of the bill that penalizes broadcasters who switch to pay TV is something that probably all cable companies, even the big ones like Comcast, could support. Retransmission consent fees paid by cable companies to broadcasters are increasingly high and a court-blessed Aereo would provide an avenue for cable companies to simply stop paying those fees (or at least give them a good bargaining chip in retrans fee negotiations).

Oddly enough, wireless companies (e.g. Verizon) might oppose this part of the proposal. They badly want spectrum, and if FOX and others leave the airwaves, this could help get that spectrum into their hands. As an aside, I think the threats from FOX are hollow for a number of reasons.

Anyways, getting a little bit meta here, but the telecom industry is where I've been interning (various places) and would like to work in at some point. There's no reason to expect the average HNer to know these intricacies. However, from what I've learned about telecom, I can at least have a better idea of knowing what I don't know about other policy arenas. Thankfully, this will prevent me from reaching super simple (and often flat out wrong observations) such as "[t]his will be lobbied into oblivion." Obviously lots of money will be spent opposing this, but that's true for nearly any regulatory proposal, and is far from dispositive of any outcome.

[1] [http://www.fiercecable.com/story/mccain-bill-sparks- conflict...](http://www.fiercecable.com/story/mccain-bill-sparks-conflict- between-aca-and-ncta/2013-05-10)

</comment></comment><comment><USER8> Perhaps we need a bill that covers 2 things.

1\. If a channel is free (NBC, TBS, etc), cable/sat providers are required to include it as part of the base connection fee.

2\. If a channel is paid, subscribers need to pay for it directly, it can't be subsidized through the basic connection fee.

Now individual networks have the power to determine if a channel is part of the basic service or not. Cable companies still have the option of bundling channels together or go ala carte if subscribers really want to access premium channels.

<comment><USER4> I am confused. How is it any different than we have today ? Free channels are always part of the base fee and where the cable companies get you is the so called "Premium" Channels which they offer in their "bundles".

<comment><USER9> I think he means channels the cable company has to pay for. Some channels don't charge the cable cable, but get all of their money from advertising. Other channels do charge the cable company and may or may not also have advertising.

Example: <http://www.sportsgrid.com/media/espn-cable-subscriber-fees/>

List of a bunch of channels' costs: [http://allthingsd.com/20100308/hate- paying-for-cable-heres-t...](http://allthingsd.com/20100308/hate-paying-for- cable-heres-the-reason-why/)

</comment></comment></comment><comment><USER10> The interesting thing is that the foundation of the TV system is built on the increasingly obsolete concept of broadcast TV. If you could get rid of that, and force all content providers to compete evenly via the internet, we'd have much more interesting environment. You'd free up the airwaves for more valuable use, you wouldn't need the FCC regulating content, and you'd break up the abc/cbs/nbc/fox semi-monopoly must carry position.

Think how wasteful it is to use all that television frequency bandwidth largely to transmit tv signals from networks to cable companies. According to NAB, only 17.8% of US homes rely only on OTA.

[https://www.nab.org/documents/newsroom/pressRelease.asp?id=2...](https://www.nab.org/documents/newsroom/pressRelease.asp?id=2761)

</comment><comment><USER11> First off, read the link early in the story to his comments. Its more informative.

I wonder how he is going to address must carry channels that local governments impose upon the cable companies? I am all for choosing channels, but I wonder if this would permit currently premium channels to be chosen without excessive charges? As in, will they still permit bundle requirements to have HBO?

Considering it imposes similar rules on those companies selling channels to cable companies the host of groups who will line up to fight this will be impressive.

My favorite part is eliminating the black out rules on sports events for public funded stadiums.

</comment><comment><USER12> Not that this bill is necessarily a bad thing, but Republicans know no end to their hypocrisy. They'll introduce all sorts of unnecessary micro-regulation to create a "free" market. This is the same guy who supported the bills deregulating the financial industry, which lead to the derivatives crisis.

I guess Senators suffer from the same problems as software engineers - <USER2> only see the problems in their living room.

<comment><USER13> I don't have a free market in cable providers.

In my largish apartment complex, there is one cable provider: Cox. I can't use a sat dish, my apartment faces the wrong direction and I'm on the second floor. FIOS isn't available. CenturyLink agrees no "prism tv" whatever that is for me, and directtv is out because I am on the second floor and face the wrong direction.

So there's really no free market in cable providers for me, it's a monopoly situation.

The free market solution would be to require Cox to allow other cable providers to use their cable to get last mile to me and then let Cox, et. al., charge me however they wish.

I would be curious to know which situation Cox would prefer: mandatory unbundling, or force them to share the cable.

EDIT: I do wonder what keeps Verizon from offering FIOS if they wanted to. Is it too expensive to rewire a huge sprawling multi-floor apartment complex?

<comment><USER14> _EDIT: I do wonder what keeps Verizon from offering FIOS if they wanted to. Is it too expensive to rewire a huge sprawling multi-floor apartment complex?_

My understanding is that Verizon has dramatically slowed their FiOS rollout, primarily because they don't think they're likely to be able to sell you "premium services" long-term. Does anyone think that within 10 years there will be any content worth having not available over a 100Mbit (or gigabit, even) pure IP connection? How much can Verizon expect to charge for such a connection?

FiOS made sense when they thought they would be Skype, HBO, NetFlix and iTunes combined, or at least get a cut on all of those. But even if we don't get regulated Network Neutrality, competitive pressure alone will commoditize content and application delivery over IP.

<comment><USER15> What I don't understand is their pricing model. It seems like they would do a lot better to have A) a "cheap crappy" option which is something like 384K internet and basic cable for an extraordinarily low price, and B) a 100Mbps+ internet service at the same profit margin they would get by selling an entire "triple play" package and then optional over the top phone and cable packages effectively for Verizon's cost, the point of offering them at all merely being to be able to supply the same overall offering as their existing competitors.

The result would be that Verizon could stop giving a crap about whether you use their TV offerings or Hulu or whatever else because that's not where they make their money, but at the same time customers wanting the "triple play" package can get it from them for a total price competitive with similarly situated ISPs and with an overall profit margin they expect from such a thing. Just admit to themselves that they're in the wire business, stop trying to be in the content business, and charge accordingly for the wire. Suddenly "cord cutters" are not a problem, especially when the competing ISP realizes the logic and does the same thing.

<comment><USER14> You have described what I can only assume is Apple's sales pitch to the carriers: Do you want to be stuck charging $50/month to "cable cutters" or do you want to sell a sexy "Apple TV" with an associated $100+/month "smart TV" plan?

<comment><USER15> Basically. Except that there is no need for a "smart TV" plan, just charge that much for the wire itself. Apple TV isn't going to do Verizon any good other than build a dependence on Apple like what the recording industry did with iTunes. If people want an Apple TV they can buy one from Apple and hook it up to the wire. Or they can get a gaming console instead, or roll their own Linux box, Verizon shouldn't have to care. They're in the wire business.

<comment><USER14> But right now their "wire" costs $50 or so a month. Their users currently pay them $60 more for a standard lineup and $10 for HBO on top of that (rough numbers). What happens when those users can get all that content through the $50 connection and start cancelling their TV? A 100+% price hike would be a tough needle to thread.

<comment><USER15> The answer is to change what they're selling. You can currently get whatever it is, say a 16Mbps connection, for $50/month. Stop selling that entirely. Discontinue it; put the existing triple play customers on the new triple play (which so happens to have the same price, just with more allocated to the connection itself), stop offering that tier to existing internet-only customers as soon as their contracts expire. Your new alternative is a) a very slow connection (not fast enough for Netflix/Hulu/whatever) for $29/month, b) a 100Mbps+ connection for $99/month, or c) a "triple play" 100Mbps+ connection + basic cable + phone for $110/month, and whatever premium channels you want on top of that for exactly what the channel itself charges for its content. Or you can get phone from Skype and TV from Hulu and Verizon couldn't care less, because they're not in the content business, they're in the wire business -- they should _want_ you to stop subscribing to their over the top offerings and switch to third party services, because that's not where the money is.

Compare the revenues or market cap of Skype or Hulu to that of Verizon FiOS, and then realize that both Skype and Hulu have more customers than FiOS, and ask yourself which business you'd rather be in. Infrastructure operators selling over the top services is just an invitation for them to interfere with competitors -- let the over the top market be competitive (and therefore have very small margins) and take the margins from the infrastructure where you can hold on to them. Look up "one monopoly rent" theory. If they're going to have a monopoly and collect monopoly rents, just let them do it in the monopoly market and not have to lose the benefits of competition in the over the top market merely in order to claim the same overall margins spread out over more products. It actually seems to be Pareto optimal -- who is going to lose out here? Maybe the cord cutters, but they're doing something which is unsustainable at scale unless what I'm proposing ends up happening. So where's the drawback?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> This sounds really awesome, but I cannot see this being really effective.

For individual channels, they can just make it extremely cost-prohibitive to purchase single channels. Want ESPN? $20/month or you can get 20 channels for $25/month. There are some people that will take that, but I wouldn't count on it.

Same goes for cable bundling. You don't have to take ESPN with ABC, but you can either have either one of them for $15m each (making up numbers), or $15,000,001 for both.

Maybe I'm a pessimist, but these companies are experts in ignoring what people want. Without very careful checks, they'll find a way to keep their margins (which, given that they own the content, they absolutely have the right to do, as much as it upsets me.)

<comment><USER15> >ESPN? $20/month or you can get 20 channels for $25/month.

But if you _never_ watch ESPN then even saving $5 is worth it. There are plenty of people who pay for cable exclusively for HBO, and since HBO and ESPN don't share a parent company they're not going to want their networks to be bundled together.

And it also allows you to make sensible decisions like specifically refusing to pay for HLN because it puts Nancy Grace on the air.

</comment></comment><comment><USER4> This will be awesome and it is long overdue in the United States in my opinion. The monopoluy of the cable companies is outrageous to say the least. Also, enough with the bullshit "bundles" and "packages". I don't want to pay $100 to comcast (Northeast US region where I live) and get a "bundle" of channels but if i want to watch HBO, pay extra. If I want to watch Showtime, pay extra. Basically, any channel worth watching, pay extra. I would rather pay $100 to pick 10 channels that I really watch even if that includes CNN.

</comment><comment><USER17> I gave up cable TV three years ago and honestly don't miss it. I still have Internet (Netflix, Amazon Prime, NoWhere TV) and the options for providers in my area are limited... but it worth it just to pay less to Comcast. This bill, if it even passes, will not sway me to change.

<comment><USER18> Yeah, I guess I just don't see the point in legislating something that is going to be gone soon anyway.

</comment></comment><comment><USER19> The bill won't have any significant impact on most customers because cable channels won't charge the cable companies any less. If a cable companies has to pay, say, $1 Mio to distribute a channel, it needs the subscriptions to pay for that. It can either sell channels a la carte for a high fee, or sell bundles for a lower fee per channel. But the revenue will always need to be on the same level. The only difference will be that people who want _very_ _few_ extra channels may get them cheaper than people who want all available channels. But as soon as you want 3-4 channels (or whatever the amount of channels is that the average consumer is actually interested in), a la carte won't be cheaper than the bundle.

</comment><comment><USER20> As much as it kills me to support McCain (I'm not a fan of him at all), all I can say is "Holy cow, well done!!!"

This thought came across my mind first when I was 15, wishing for Cartoon Network without paying extra for cable that we couldn't afford.

<comment><USER21> pre-presidential-race McCain was known for stuff like this.

<comment><USER22> Pre-Presidential candidate was known for promoting himself as a "maverick", but I think the majority of that meme was his self-promotion and an easy media narrative. He hasn't been very independent, even if it doesn't take much to be considered an odd duck Republican in this tea party climate.

</comment></comment></comment><comment><USER23> I would love to be able to buy individual channels, however, I don't think that this is something the government should get involved in.

I would suggest working on a bill that would try to increase the prevalence of affordable high speed internet throughout the country. This would give access to all parts of the country but it would also give citizens more options when it comes to TV because Netflix, Hulu, etc would be accesible to everybody and could cause the cable companies to re-evaluate their strategy.

</comment><comment><USER24> I always thought that the physical plant / last mile should always be another company and not any way attached/owned by the content provider(s). In most areas there are at least 2 content providers who can split the physical plant costs (+ minor profit).

</comment><comment><USER25> I would totally love to order the sci-fi channel, fx, history channel and a couple others and not have to scroll through 30+ channels to get to them... i haven't had cable in years because it's never been worth it to me for just a few channels...

<comment><USER26> You'll probably still have to scroll through them - they'll just be marketing screens saying "call <cable provider> to order <useless channel>!"

I just downgraded my U-verse account. The channels I used to have are now just a blue screen with the image of a TV and a message either saying "you are not subscribed to this channel" or "call <number> to order this channel".

</comment></comment><comment><USER27> I'm going to be seriously conflicted if McCain does something I like.

<comment><USER28> With McCain I learned that "maverick" means "no consistent underlying principles". Sometimes it works to your favor.

</comment></comment><comment><USER29> Too little, too late. We needed this around 1990.

</comment><comment><USER30> I have not had cable TV for nearly 3 years and it has worked out very well since I am outdoors more often. However, the day al a carte is in town is the day I buy cable again. Comcast et. al. are just like banks, they could care less about the consumer.

I am not holding my breath as McCain is simply spinning his wheels.

</comment><comment><USER31> Beware of conservatives bearing "gifts".

Check which lobbyists have been visiting/donating to him recently.

(and with all the problems we have right now, all the unfilled positions for five years, this is what he is working on?)

<comment><USER32> It seems like he's been spending a lot of time recently banging the Benghazi drum, so this is at least an improvement.</comment></comment>


Show HN: CodeExchange – A new Java code search engine - <AUTHOR> http://codeexchange.ics.uci.edu

<comment><AUTHOR> Hi DanielStraight!

Great question. CodeExchange is intended to help you reformulate your query. That is, as you get results, it aims to help you change your query so the next results are closer to what you want.

Some typical use cases are finding API usage examples and algorithm implementations. This could mean finding code that invokes API methods, extends a parent class, implements an interface, implements depth first search or merge sort, etc...

Some examples:

[Looking for regular expression code] An example may be issuing a keyword search "regular expression", then taking the recommendation "[imports library] java.util.regex.pattern" to find code that uses this library, and then clicking on the method call "Pattern.matches" in a code result in order to return code that calls this method.

[looking for Minecraft code] Another example may be issuing the keyword search "minecraft map" and then taking the recommendation "[keywords] world" to help disambiguate the word "map" from other meanings in Java.

[looking for merge sort code] Yet another example could be issuing the keyword search "merge sort" and then getting empty class results. Since algorithms have logic in them (loops, if statements, etc...) you can critique the result by clicking the up arrow above "complexity" in order to get results with more logic in them.

These examples don't have to start out with keywords, however. Sometimes you are working with a team that already has libraries being used and you have to learn how to use them. To specify them up front you can use the "Advanced Search"

The search history is intended to support reissuing queries that worked in the past, to find code you need today.

Thanks for your interest! Let me know if I can answer any other questions or clarify anything. If you have time please fill out the survey on our site to help our research!

</comment><comment><USER2> Can you give some examples of searches which provide really good results? Or some idea of what use cases you would use the search for?

<comment><AUTHOR> Some example search videos have been posted here: [http://codeexchange.ics.uci.edu/examples.html](http://codeexchange.ics.uci.edu/examples.html) Thanks!

</comment></comment><comment><USER3> Tiny feed back after first look, the "Advanced search" needs more space :) [https://www.dropbox.com/s/w9w9nvdb9tkf1jn/Screenshot%202014-...](https://www.dropbox.com/s/w9w9nvdb9tkf1jn/Screenshot%202014-08-04%2013.46.52.png)

Other than that, looking good.

<comment><AUTHOR> Thanks :). We shall fix this soon!

</comment></comment><comment><USER4> Interesting. It looks like its actually parsing the Java to produce the results as a search for "bing" shows the number of imports and complexity of the code. This would be similar to sourcegraph.

I wonder what parser is used and if it can be applied to other languages.

<comment><AUTHOR> Good observation! We are continuously expanding our efforts, and will be looking into supporting other languages soon. For us, this will mean using or writing different parsers for different types of languages. Suggestions for which languages you want are appreciated! More details on the engineering of CodeExchange are being written.

<comment><USER4> Interesting. This is a university project yes? Will you be looking to open source some of the code, in particular the language parsers.

I ask from a purely selfish purpose as I want to integrate this sort of information into searchcode.com and would prefer to avoid writing my own implementations.

<comment><AUTHOR> Yes, it is a university project. We hope to make it open source, but first we are working to stabilize it and write about it.

<comment><USER4> Ah very cool. I have added a watch to your profile so I can see any further developments.

</comment></comment></comment></comment></comment><comment><USER5> Is the site overloaded right now? I typed in a few queries, nothing shows up, and the "status" under the 1st column is always "SEARCHING..."

<comment><AUTHOR> Thanks for letting us know! We are checking into it.

<comment><USER6> Still down for me. Still Searching

</comment></comment></comment><comment><USER7> zot zot

what was the point of this search engine? I mean who came up with this idea that we needed to build a java code search engine?

I dig the results view, its pretty cool to see 3 codes side by side.

<comment><AUTHOR> We are continuously expanding our efforts, and will be looking into supporting other languages soon. Suggestions for which ones you want first are appreciated! Thanks (zot zot)!

</comment></comment><comment><USER8> Just wanted to point out grepcode.com for comparison.

<comment><AUTHOR> Thanks for the pointer! As an academic research project, we try to collect as many of these as possible.</comment></comment>


Show HN: An multipass optimizing compiler for a simple language - <AUTHOR> https://github.com/ecaradec/j86 <comment><AUTHOR> This is a project I start wanting to know how to best assign registers to variables. It grew from that and went into exploring things like SSA forms and constants propagation. It was a lot of fun (and pain) working on it, and I learned a lot on how compilers are built.</comment>


Signed Integers Are Two's Complement - <AUTHOR> http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p0907r0.html <comment><USER2> > Naïve overflow checks, which are often security-critical, often get > eliminated by compilers. This leads to exploitable code when the intent was > clearly not to and the code, while naïve, was correctly performing security > checks for two's complement integers.

This is the most critical aspect. We have enough trouble already without the compiler _actually fighting against security_ because this would fail in a machine from the 70s

<comment><USER3> Isn't the quoted part 180 degrees wrong? Such code was _not_ "correctly performing security checks", since it was undefined behaviour - two's complement or not. Which was the whole problem.

<comment><USER4> The checks were not correct for all possible representations. If the only representation were two's complement, there could be fewer areas of undefined behavior, so simple and straightforward security checks would be much more likely to be correct.

(Unfortunately it sounds like this proposal has been revised to leave overflow behavior as undefined. That's a biggie. Oh well)

<comment><USER5> > The checks were not correct for all possible representations.

This raises the question of whether the optimization was valid, given the target architecture. I am assuming that, technically speaking, it was, because that is what the standard allowed, but that view leaves unexamined the question of whether it is contrary to the purposes for having and using the C language in the first place.

I can imagine an argument pointing out that this optimization is applied at an abstract level of representation prior to code generation, and that it would be a violation of modularity to take into account the target architecture at that point. This, however, would be a point about the compiler architecture, which I think should, where practical, yield to concerns about the overall purpose and use of the compiler, where the principle of 'no (or minimal) surprises' is important.

</comment></comment></comment></comment><comment><USER6> The link is an outdated version r0, this is r2 (don't know if it's the latest) [http://www.open- std.org/jtc1/sc22/wg21/docs/papers/2018/p090...](http://www.open- std.org/jtc1/sc22/wg21/docs/papers/2018/p0907r2.html)

<comment><USER7> _The main change between [P0907r0] and the subsequent revision is to maintain undefined behavior when signed integer overflow occurs, instead of defining wrapping behavior._

<comment><USER8> Gah, what is the point then?

<comment><USER9> The point is that signed integers are two's complement. After all, it is the title.

<comment><USER10> Naive overflow checks are often done by adding two positive numbers together and checking if the result is negative. If wrapping is undefined, this no longer works, and the overflow check may be eliminated.

</comment></comment></comment></comment></comment><comment><AUTHOR> In April, the author of this proposal said on Twitter that the C++ standards committee agreed to this proposal for C++20: [https://twitter.com/jfbastien/status/989242576598327296?lang...](https://twitter.com/jfbastien/status/989242576598327296?lang=en)

<comment><USER9> This proposal, but not this revision. (Tweets are careful about this.) In particular, signed integer overflow is still undefined.

</comment></comment><comment><USER11> > Overflow in the positive direction shall wrap around

This appears to be defining signed integer overflow semantics, which prevents the compiler from doing certain basic optimizations, for example, that (x*2)/2 == x. Is that part of this? Has anyone measured the perf cost on a real program?

<comment><USER12> It prevents _risky_ optimisations; this now requires the compiler to _prove_ that such optimisations won't change the semantics of the code, e.g. in your case by essentially proving that the high 2 bits of x (only 1 in the unsigned case, due to sign-extension) will never be set.

...and it could be argued that if the compiler couldn't prove that was true, then it just helped you find a possible overflow bug in the code. If you actually wanted the compiler to unconditionally assume (x*2)/2==x and optimise accordingly, then you'd have to tell it such; e.g. MSVC has the __analysis_assume() feature.

<comment><USER13> However it also prevents "abort on overflow" implementations from being conforming, which look like a much better way of finding actual overflow bugs in the code.

<comment><USER14> Do such implementations currntly only abort on signed overflow and not on unsigned overflow? Aborting on unsigned overflow is currently not conforming, is it?

<comment><USER15> It is not conforming, which is why `-fsanitize=unsigned-integer-overflow` is not enabled by default by ubsan. However it is available if you want to try it.

</comment></comment></comment></comment></comment><comment><USER16> I like the idea of forbidding signed integer representations other than 2's complement, as it is de facto standard, pretty much nobody makes CPUs with non-standard integer representations, partly due to C programs assuming 2's complement integer representation.

What I don't like about this proposal is defining signed integer overflow as 2's complement wrapping. Yes, yes, I know undefined behaviour is evil, and programs wouldn't become much slower. However, if a program has signed overflow, it's likely a bug anyway. Defining signed overflow as 2's complement wrapping would mean not allowing other behaviours, in particular, trapping. On architectures with optional overflow traps (most architectures not called x86 or ARM), trapping would be much more preferable to quiet bugs. Meanwhile, while it is undefined behaviour, the implementation would be still free to define it, for instance in GCC it can be done with `-fwrapv`.

<comment> loup-vaillant > _However, if a program has signed overflow, it 's likely a bug anyway._

There are programs that check for overflow after the fact. Is that a bug?

<comment><USER9> No, but since most overflows are bugs, I think the right solution is to standardize something like GCC's __builtin_add_overflow for overflow checks. Rust does this.

</comment></comment></comment><comment><USER17> The real issue isn't that C doesn't have a standard int overflow, but that it's undefined.

What they _could_ have done is made it _implementation defined_ , like sizeof(int), which depends on the implementation (hardware) but on the other hand isn't undefined behavior (so on x86/amd4 sizeof(int) will _always_ be equal to 4).

<comment><USER18> It's undefined for a reason.

      size_t size = unreasonable large number;
      char buf = malloc (size);
      char *mid = buf + size / 2;
      int index = 0;
      for (size_t x = 0; x < big number; x++) mid[index++] = x;

A common optimization by a compiler is to introduce a temporary

      char *temp = mid + index;

prior to the loop and then replace the body of the loop with

      *(temp++) = x;

If the compiler has to worry about integer overflow, this optimization is not valid.

(I'm not a compiler engineer. Losing the optimization may be worth-while. Or maybe compilers have better ways of handling this nowadays. I'm just chiming in on why int overflow is intentionally undefined in the Fine Standard)

<comment><USER19> Integer overflow is certainly not undefined _for this reason_.

It's undefined because in the majority of situations, it is the result of a bug, and the actual value (such as a wrapped value) is unexpected and causes a problem.

For instance, oh, the Y2038 problem with 32 bit time_t.

<comment><USER17> >It's undefined because in the majority of situations, it is the result of a bug,

1\. If it's a bug, it should overflow or crash (implementation defined, not undefined), or do what Rust does, crash on -o0 (or, if it's illegal to change defined behavior based on optimization level, create a --crash-on-overflow flag) and overflow on everything else.

2\. There is plenty of code where it's intentional (such as the infamous if(a+5<a)).

</comment></comment></comment></comment><comment><USER20> Getting rid of this useless (crap #!§$§$§$) legacy stuff was overdue, so i am very happy to see it done. I personally think it is _the_ most important proposal for C++20, since it will remove a lot of pointless pressure from secure coding attempts and in turn make the world a little bit more secure.

<comment><USER9> I don't see how. Integer overflows still can be security issues even if they wrap.

<comment><USER21> They can be security issues since the compiler is allowed to optimize stuff. The compiler can check, that some checks the user added "don't make sense" since those only would be hit if something undefined happens. An example is shown in [https://www.tripwire.com/state-of-security/vulnerability- man...](https://www.tripwire.com/state-of-security/vulnerability- management/compiler-undermining-secure-coding/) but there are many more.

<comment><USER19> No, they can be security issues in that the program expected x + 1 to be a value bigger than x, but it is suddenly a big negative value.

The fact that this behavior is now blessed by ISO C makes no difference to it being _wrong_ , and causing some security issue in the program.

</comment></comment></comment></comment><comment><USER22> I'm curious why some old architectures didn't use two's complement for signed numbers. What advantage did one's complement or signed magnitude have over two's complement?

<comment><USER23> It can be useful to distinguish between positive and negative zero in some cases, for example when dealing with values that have been rounded to zero or limits approaching zero.

<comment><USER24> Was that ever really a reason for signed magnitude, or did people just make use of the 2nd representation of zero because because it was available and they couldn't be bothered putting that information in another variable or using floating point or fixed point, or anything else that would have achieved the same result?

<comment><USER12> I have a feeling signed-magnitude predates binary and complement arithmetic --- it is, after all, the "natural" way humans work with numbers. A lot of the early non-binary computers used some form of sign-magnitude, all the way back to punch card formats:

[https://en.wikipedia.org/wiki/Signed_overpunch](https://en.wikipedia.org/wiki/Signed_overpunch)

On the other hand (no pun intended), early mechanical (decimal) manual adding machines made use of complement arithmetic too:

[https://en.wikipedia.org/wiki/Comptometer](https://en.wikipedia.org/wiki/Comptometer)

[https://en.wikipedia.org/wiki/Method_of_complements](https://en.wikipedia.org/wiki/Method_of_complements)

<comment><USER25> Burroughs 5xxx and 6xxx machines used signed-magnitude.

Burroughs had a unique numeric representation. Numbers were 48 bits. Sign, sign of exponent, exponent, mantissa, with the binary point at the low end. Integers were thus valid floating point numbers. The math operations would maintain a value as an integer, with a zero exponent, if possible.

IEEE floating point also maintains integer values as integers until they don't fit, but the representation is not integer-like.

</comment></comment></comment></comment></comment><comment><USER26> The equivalent for C/WG14: [http://www.open- std.org/jtc1/sc22/wg14/www/docs/n2218.htm](http://www.open- std.org/jtc1/sc22/wg14/www/docs/n2218.htm)

<comment><USER13> That document has this listed as a Change:

 _Conversion from signed to unsigned is always well-defined: the result is the unique value of the destination type that is congruent to the source integer modulo 2ⁿ._

...but that's not a change - it's been the case in C all along.

</comment></comment><comment><USER20> There seems to be an error in this proposal:

"Change Conversion from signed to unsigned is always well-defined: the result is the unique value of the destination type that is congruent to the source integer modulo 2N."

This is no change, since we have that already, e.g. see [https://en.cppreference.com/w/cpp/language/implicit_conversi...](https://en.cppreference.com/w/cpp/language/implicit_conversion) and the conversion operation on the bit pattern is the identity for two's complement representation. The relevant section in the latest C++ standard is: 4.8 Integral conversions [conv.integral] 1 A prvalue of an integer type can be converted to a prvalue of another integer type. ... 2 If the destination type is unsigned, the resulting value is the least unsigned integer congruent to the source integer (modulo 2 n where n is the number of bits used to represent the unsigned type). [ Note: In a two's complement representation, this conversion is conceptual and there is no change in the bit pattern (if there is no truncation). — end note ]

Therefore the inverse conversion exists and is the identity as well, this is what should be sanctioned.

</comment><comment><USER27> FYI you can prevent all of non-2 complement problems with -fwrapv which forces 2' complement wrapping math in gcc/clang/icc

</comment><comment><USER28> Also relevant is HAKMEM item 154 in which Bill Gosper concluded that the universe is two's complement: [http://catb.org/jargon/html/H/HAKMEM.html](http://catb.org/jargon/html/H/HAKMEM.html)

</comment><comment><USER29> Quick question: in the proposed rewording of intro.execution¶8, why is the following rewriting "((a + b) + 32765)" not reintegrated at the end of the untouched text? Have I misunderstood that with two's complement this would be legal?

</comment><comment><USER30> have they considered introducing new types for wrapping integers, checked integers and saturating integers. i understand why they might not want to make a change that could have a large effect on existing programs. but if you introduce new types then the new types will only effect new programs that choose to use them and this seems to be something that could be a library change than a language change.

</comment><comment><USER19> Requiring two's complement just means you can't have a sensible C language on some sign-magnitude machine.

Even if nobody cares about such a machine, nothing is achieved other than perhaps simplifying a spec.

A language spec can provide a more detailed two's complement model with certain behaviors being defined that only make sense on two's complement machines, without tossing other machines out the window.

There could be a separate spec for a detailed two's complement model. That could be an independent document. (Analogy: IEEE floating-point.) Or it could be an optional section in ISO C.

Two's complement has some nice properties, but isn't nice in other regards. Multi-precision integer libraries tend to use sign-magnitude, for good reasons.

What I suspect is going on here is that someone is unhappy with what is going on in GCC development, and thinks ISO C is the suitable babysitting tool. (Perhaps a reasonable assumption, if those people won't listen to anything that doesn't come from ISO C.)

<comment><USER31> >> Even if nobody cares about such a machine, nothing is achieved other than perhaps simplifying a spec.

No, I use 16bit values to represent angles in embedded systems all the time. I routinely expect arithmetic on these values to roll over as 2's complement and I expect to take differences of angles using 2's complement all the time. I'm fully aware that this is undefined behavior and needs to be verified on each compiler/processor combination. It has always worked and yet it's undefined behavior. It would be nice for it to be defined. There are no modern machines that would be impacted by this.

<comment><USER32> Yes, it is annoying to rrad comments that assume overflow is always a programming error.

You can store the angle as a union of signed and unsigned type. Do arithmetic on the unsigned member, where overflow is defined. (Both members are equivalent angles)

<comment><USER9> Not always, but overflows are usually bugs. This is replicated finding of dynamic overflow checking tools, over and over.

<comment><USER19> And if overflow is well-defined, then those tools must switch your C dialect to a non-ISO-C conforming one in order to do their job.</comment></comment></comment></comment></comment>


What are the best ways to learn Python if you are a beginner? - <AUTHOR>

<comment><USER2> <http://docs.python.org/>

</comment><comment><USER3> Learnpythonthehardway.org

</comment><comment><USER4> Udacity courses and Google python is also a good source.</comment>


Swartz Prosecutors Weighed 'Guerilla' Manifesto, Justice Official Tells Congress - <AUTHOR> http://www.huffingtonpost.com/2013/02/22/aaron-swartz-prosecutors_n_2735675.html <comment><USER2> The entire story that Techdirt is linkjacking is, via HuffPo, "Some congressional staffers left the briefing with the impression that prosecutors believed they needed to convict Swartz of a felony that would put him in jail for a short sentence in order to justify bringing the charges in the first place, according to two aides with knowledge of the briefing."

There was a hearing, and "some congressional staffers" were left with an "impression".

For all we know, that's entirely true, and those anonymous staffers hit the nail exactly on the head. But how would you know? How much less credible can you get than anonymous staffers sourcing HuffPo, regurgitated by Techdirt?

<comment><USER3> Note for readers who may find tptacek's comment confusing: Not only has the original HN submission title been edited, but the link it points to has also been edited.

The original title was "DOJ Admits It Had To Put Aaron Swartz In Jail To Save Face Over The Arrest" and the link was pointing to: [https://www.techdirt.com/articles/20130223/02284022080/doj-a...](https://www.techdirt.com/articles/20130223/02284022080/doj- admits-it-had-to-put-aaron-swartz-jail-to-save-face-over-arrest.shtml)

<comment><AUTHOR> Damn, that's bad editorializing by HN. The HuffPo article buried the lede that Techdirt was highlighting.

</comment></comment></comment><comment><USER4> Both sides in the sad Aaron Swartz case dug into their positions early, and then let the sunk cost fallacy guide their later decisions about how to negotiate with the other side. Swartz had plenty of friends who would have advised him how to gain publicity for the issue of access to old journal articles without taking the risk of imprisonment, but he didn't seek their advice. The Boston area federal prosecutors treated imprisonment, however brief, as the only outcome of the case that would signal the correct gravity of the offense, but miscalculated that Swartz could not be deterred by other dispositions of the case. Everyone involved (other than on-lookers like Larry Lessig) paid too little attention to the other side's perspective on the case and its trade-offs.

EDIT TO REPLY TO QUESTION IN REPLY COMMENT:

Yes, nothing that was proposed as to sentencing Swartz during negotiations before trial would have prevented his gaining full restoration of civil rights later, and even being able to expunge his record of conviction, if he had been convicted. His lawyers calculated (correctly, it appears to be the opinion of most but not all on-lookers) that the actual facts of what he did could constitute an offense for which he could have been convicted. So the facts, once Swartz made the facts by what he did, were not fully on his side. But what view a jury or a trial judge or a later appellate judge might have taken of the overall circumstances of the case wasn't put to trial before Swartz killed himself. Impulsive, all-or-nothing thinking is dangerous when life-or- death issues are in consideration.

<comment><USER5> Was just wondering... I've heard of some cases where a felony conviction can be expunged after a few years (seven I think) -- wasn't that the case with Randal Schwartz? Would that option have been available to Aaron? Because from what I've read, the thing bothering him the most wasn't the jail time (the smaller sentence offered in the plea bargain), but being labeled a felon for the rest of his life. Would he have been as distraught if the expungement option was available?

<comment><USER6> There's all sorts of different scenarios, including expungment (which is indeed what Randal accomplished):

* Expungment: The records are sealed. It's (mostly) as if the conviction never occurred, since there's no way for people to access the proof that a conviction was returned. But this is a legal construct that only applies in the legal world, they can't go back and erase the newspapers. * Pardon: You did it, but we just won't punish you for it.

But the only one we can ask would be Aaron, unfortunately. For what it's worth what "felon" means is entirely up to the state you live in, the people you talk to, etc.

I worked with a "felon" (and I'm using this term very loosely here) who had a clearance higher than mine, actually did the kind of jobs where they can't talk at all about it, was able to vote, use banks, etc. No one thought of him as anything less than a valued shipmate, but of course that's just my personal perspective.

</comment></comment></comment><comment><USER7> What happened to jailing people for committing crimes? Honest question.

<comment><USER8> The same thing that happened to executing only people convicted of crimes - something we abandoned long ago as well.

Once any government has seized powers like these (whether rightfully or not), it's very loath to give them up. This is an empirical observation, not a statement about the ideal.

<comment><USER9> We've never needed to convict anyone of a crime to kill foreigners not on U.S. soil. Never ever. At the time of the founding, it wouldn't even have been a question. Of course it's the sovereign right of the state to protect itself in that way. Of course the only people protected by the U.S. Constitution are those living within the scope of American jurisdiction.

See: <http://supreme.justia.com/cases/federal/us/317/1/case.html>, <http://supreme.justia.com/cases/federal/us/339/763/case.html>

<comment><USER10> But not them either. A US Citizen can be declared an Enemy Combatant, solely by the Executive, and summarily assassinated.

See: [http://www.guardian.co.uk/commentisfree/2013/feb/22/obama- br...](http://www.guardian.co.uk/commentisfree/2013/feb/22/obama-brennan-paul- assassinations-filibuster)

<comment><USER6> And yet if that U.S. Citizen shoots an anti-tank rocket at an Abrams in Afghanistan he can be summarily executed by a Private First Class (to say nothing of a democratically-elected Commander-in-Chief).

There's definitely a discussion to be had about how and where a nation can decide to use military force in the interests of its self-defense, but citizenship has never been a barrier to military action outside of the U.S. in war time. See for example <http://en.wikipedia.org/wiki/Ex_parte_Milligan>

Now certainly the Supreme Court did not envision drone strikes and one-sided warfare outside of the United States when they talk about the laws of military government, but it does go to show that even as far back as 1866 that the law showed a distinction between military operations inside of the U.S. and outside of the U.S.

<comment><USER8> > citizenship has never been a barrier to military action outside of the U.S. > in war time

These assassination are occurring in countries that we're not at war with (and in some cases, never have been).

Furthermore, many the citizens being assassinated have never even been _accused_ of a crime (like shooting a rocket), let alone convicted of one.

<comment><USER9> The criminal code is for maintaining civil order in areas under our jurisdiction. When the Constitution says that people have the right to due process of law, it presupposes that you're talking about a context where process exists (i.e. it is possible to bring someone to trial because you have police power over the area and functioning courts). It's non-sensical in a military context (and there need not be a declaration of war to have a valid military intervention--also a tradition as old as the republic).</comment></comment></comment></comment></comment></comment></comment>


Ask HN: Flow chart application for Mac? - <AUTHOR>

Hey everyone,
I'm looking for a simple, and free, application to build flow charts and diagrams.
I'm starting some documentation for a large project I've been working on and in need of something to build visual aides.
In the past, on Windows, I've used Dia - pretty cool, but very clunky as well.
Do any of you have a recommendation? <comment><USER2> Not specifically for Mac, but I've used the free plan for this Chrome app and it works quite well: [https://chrome.google.com/webstore/detail/lucidchart- diagram...](https://chrome.google.com/webstore/detail/lucidchart-diagrams- onlin/apboafhkiegglekeafbckfjldecefkhn?hl=en)

</comment><comment><USER3> For simple diagrams, I've used Pencil ([http://pencil.evolus.vn/](http://pencil.evolus.vn/)). I don't know if I'd really want to build anything complex in it though.

For intricate depictions, Inkscape is infinitely more flexible but is a little slow to use for quick diagrams.

</comment><comment><USER4> Graphviz {and Dot}.

</comment><comment><AUTHOR> UPDATE: I ended up just using Google Docs. Looks pretty good!</comment>


CISPA: Myths vs Facts [pdf] - <AUTHOR> http://intelligence.house.gov/sites/intelligence.house.gov/files/images/041613cispamythfact.pdf

<comment><USER2>
       tl;dr:
       "myth: true concern in a tin-foil-hat tone"
       "fact: here are some quote with vague legalese from the bill"

if you really want the facts without the tin foil hat tone, [http://news.cnet.com/8301-13578_3-57580268-38/cispa- permits-...](http://news.cnet.com/8301-13578_3-57580268-38/cispa-permits- police-to-do-warrantless-database-searches/)

"Rep. Alan Grayson, a Florida Democrat, proposed a one-sentence amendment... to secure a warrant ... that House Republicans "wouldn't even allow debate on requiring a warrant"

"CISPA is controversial because it overrules all existing federal and state laws by saying "notwithstanding any other provision of law," including privacy policies and wiretap laws, companies may share cybersecurity-related information "with any other entity, including the federal government." It would not, however, require them to do so."</comment>


Taking over Heroku accounts - <AUTHOR> http://esevece.github.io/2016/06/01/taking-over-heroku-accounts.html <comment><USER2> What is someone's motivation for finding stuff like this? I assume they just have some sort of innate satisfaction from finding vulnerabilities, sort of like solving a puzzle?

It seems hard to believe money is the motivating force, since the bug bounties are pretty low and I'm sure the $/hour is super low unless you're some sort of penetration tester wizard.

<comment><USER3> In my case, the motivations are money and freedom. I enjoy doing it, but if I didn't make money I won't do it. My only income is what I make participating in bug bounty programs.

Context: I live with my parents, I'm not married, I don't have kids, I didn't go to university, I don't have a CV worth enough to get a job where I would earn as much money as from bounties (unless in my country), and I work in personal projects which wouldn't allow me to commit 8 hours a day working for a single company.

<comment><USER2> If it's not too personal, how much do you make in a month and year? How much does that vary? How good would you rate yourself at doing this? Do you work a lot with a small group of companies or do you do it for tons? How long does it take on average per bug?

<comment><USER3> Not fixed income and in this year I haven't even got close to 10,000. How much it vary depends on how much time I spend and how much the companies consider to pay me at the time of giving the reward for a bug (if I find one, of course). I'm not good at rating, but I'm sure I'm not good at doing this. Usually I look for bugs in companies that I like their products/services and/or their security team, and usually I choose the ones I think it would be fun to find bugs. I'm not able to answer the last one because I don't time how long does it take to find a bug, but I can say that it takes time (it takes more time when you are tired :D).

<comment><USER2> Ah okay, I got the impression you were getting a full-time livable income from doing this, which seemed like it would be really hard to do even for someone who was really good at it.

</comment></comment></comment></comment></comment><comment><USER4> Nice, simple explanation of an attack. Walks you through every step along the way. A+.

<comment><USER3> I'm glad you liked it! I wasn't sure that it was well explained.</comment></comment>


The Architecture of Battle of Wesnoth (2011) - <AUTHOR> http://www.aosabook.org/en/wesnoth.html <comment><USER2> "Forbidden You don't have permission to access /en/wesnoth.html on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request."

<comment><USER3> Works for me now, at least.

</comment></comment><comment><USER4> It's the Battle FOR Wesnoth</comment>


MEGA.nz Chrome extension caught stealing passwords, cryptocurrency private keys - <AUTHOR> https://www.zdnet.com/article/mega-nz-chrome-extension-caught-stealing-passwords-cryptocurrency-private-keys/ <comment><USER2> The onus is also on the users of these extensions to inspect the code. Chrome extensions are not compiled - they are simply zip archives and all the code is readily inspectable. My only gripe is that the extensions are mostly marketed towards people who don't know how to code and so they run these extensions never knowing what's happening under the hood. I trust about five extensions currently, one of them being uBlock origin which has a lot of eyeballs on it. However I do worry that hackers will try to get nefarious code into popular extensions, because the more people that use the extension - the more they can exfiltrate (browsing history, passwords, etc).</comment>


The Declining Half-Life of Secrets - <AUTHOR> https://www.justsecurity.org/24823/half-life-secrets

<comment><AUTHOR> What Swire's discussion fails to recognize is that the same dynamics which refer to _state_ secrets apply equally to _corporate_ and _personal_ secrets. As I've been noting for some time, electronic data's notable distinguishing characteristic is its _frictionlessness_. It may or may not stay contained, _but once it escapes containment its worldwide spread is all but impossible to avoid_.

The fact that such disclosures can take place without detection or awareness by the hosting party, who is almost always entirely distinct from the _subject_ of the information itself, gives rise to an extremely unstable state:

 _Any electronic information, at any time, may be accessed, by unknown and often unknowable parties, without notice, and with consequences ranging from zero to catastrophic._

It's an entirely unprecedented disclosure risk environment.

<comment><USER2> It's why many of us advocate traditional methods for protecting secrets that center on paper and people. This leads to higher cost and less convenience. A necessary tradeoff.

<comment><AUTHOR> Quite.</comment></comment></comment>


Show HN: My 1st mobile app- A parasitic,anonymous,remixable img app for android - <AUTHOR>

https://play.google.com/store/apps/details?id=com.daveganly.yarrly
Hi, this is Yarrly - my first android app, backed up server side by a mongo & node.js backend. It's a two-panel image generator, and quite a fun experiment in a no-login ('anonymous') app. You generate two panel images using photos or gallery pics, and add text, then it's uploaded to Yarrly.com - creating an instagram-like link.
For example you create http://yarrly.com/y/4hhs6ryyq73da533d, then android intents mean that if you open that link on a device that has Yarrly, you can view the image, but then also remix it. Remixing downloads the component parts of the yarrly, allowing the new user to edit them, add new images or text, and upload again. This means you can create chains, like this: http://yarrly.com/c/4hhs6ryyq73da533d
So part of the interesting idea is that it's anonymous, so the links are as private as you make them. Share the link on email, and you can have a nice two way conversation with a friend. Share it on twitter, and anyone who finds the link can remix your Yarrly. That's what I mean by 'parasitic' - it doesn't have any concept of users, friends or anything else; it relies on being shared on other platforms to spread.
Why was it made?
I needed to learn mobile development and android seemed a bigger challenge than iOS - also a fun challenge to try something properly in nodejs and mongo - my last project (http://vvx.io/) was a ruby/rails web app sitting on postgresql.
Why no holo theme?
Meh, wanted to do something more unique and playful. This is an experiment more than anything, so why not pirate theme?
Who made it?
I did the code, my girlfriend came up with the idea and the fantastic design. Everything was arrived at through experimentation and discussion. <comment><USER2> Thanks for the comments and upvotes. We have just had a review on TechCrunch which, we think, is very flattering [http://techcrunch.com/2013/07/18/yarrly/](http://techcrunch.com/2013/07/18/yarrly/)

</comment><comment><USER3> Really nice execution.

Are you able to give a bit more detail on your backend stack and the reasons for your choice or technologies?

Will this stay Android only or are you planning on porting it?

<comment><AUTHOR> Sure! This started as a learning exercise, so to get the maximum learning, CHOOSE WHAT YOU DON'T KNOW AT ALL. (No really.)

So Android, (full disclosure: I've done a bit of Java, I'd rate myself as not beginner but nowhere near experienced). Android is hard to develop well for, it's activity lifecycle took a long time to get my head around, and once I hit real-world testing with different devices it was just a roller-coaster of debugging that was highly, highly challenging. Also, everyone is doing things iOS first, and that's boring. We wanted to give Android users an awesome, fun, show your friends app that was hilarious, silly and pushed things forward, even just a little.

Nodejs - I'd wanted to do something in anger with node for ages, and this was the perfect opportunity. Also no proper nosql experience, so mongo!

Full disclosure: It's on top of heroku, to save time.

Id like to say there were more deep seated reasons, but they are the most honest - try something you don't know, then just focus focus focus until you nail it.

Love to port it to iOS, of course - but that's a whole NEW learning experience. Let's see how we do android first!

</comment></comment><comment><USER4> Android more difficult than iOS - really? Having learned Android first, I am currently struggling to pick up Objective C. Any suggestions?

<comment><USER5> Hi, I was developing for Android first and am now doing iOS. I do think that Android is a bigger challenge than iOS, primarily because you have to cater to many different screen sizes. Sure, you have the iPhone 5 which is taller than the other iPhones, but it's more about "clipping" the content for the smaller ones rather than "scaling" the UI up or down for a screen size and Android OS version. It's also heaven how you can have arrays and dictionaries (maps in Java) that contain different data types in Objective-C, even blocks of executable code!

I used to do just Java and knew no C or C++. Below are the references that best helped me to understand the programming philosophy of Objective-C (it's easy to learn the syntax, but why code is being written a certain way is different).

Programming in Objective-C (5th Edition) by Stephen Kochan [http://www.amazon.com/books/dp/032188728X](http://www.amazon.com/books/dp/032188728X)

CS193P: Developing Apps for iPhone and iPad (Stanford, via iTunes U) [https://itunes.apple.com/us/course/coding-together- developin...](https://itunes.apple.com/us/course/coding-together- developing/id593208016)

</comment></comment><comment><USER6> Nice work!

Do you generate the images in the app and upload it to your servers or on your server & download the image to the app?

<comment><AUTHOR> Generated in-app, and uploaded.

</comment></comment><comment><USER7> The UI looks fantastic. Did you do all the design(i.e images/logos and etc) yourself?

<comment><USER2> Thanks! All the UI elements were made by my own hand/mouse. It took a while, and a lot of iterations until we had something we were happy with. However, after only dabbling in design before, I'm now totally hooked on making icons, cartoons and microinteractions. Already started work on another illustration project.

</comment></comment><comment><USER8> Really nice looking UI. I'll have a play with it in a bit. Good work!

<comment><USER2> Thanks! (I made the graphics) I'm really proud of the wheel UI which makes sure any action you might want to take is in one megabutton. Micro interactions are something I get huge kicks from too so check out the like the wheel rotating on upload, and the loading spinner; if you look closely they're sharks swimming in circles. This keeps me endlessly amused.

</comment></comment><comment><USER9> brilliant idea and perfect execution. Consider putting "Made by Yarrly" text under Yars( I would like to call pictures as Yars) and there could be a paid option to remove it.

<comment><AUTHOR> Haha! Nice monetisation idea! We just have 'Yarrly.com' \- going for high viral-coefficient first, but not going to overpower people's output with advertising/watermarking --> USER FIRST! ...but we'll keep it in mind!

</comment></comment><comment><USER10> Looks neat. Kinda reminds me of Rando.

<comment><USER2> We love Rando. The humour UsTwo put into the design makes it really human, something we hope to achieve too. The difference here is that Yarrly doesn't distribute your image for you; that's down to you sharing it. Plus you can remix and form chains, creating less of a snapchat/rando immediacy and more of an image message board effect.</comment></comment>


Ask HN: How do you verify "author here" comments? - <AUTHOR> <comment><AUTHOR> how do you verify if you see any "author here" or "co-author here" comment on some thread? Isn't this risky as some may try to defame or misinform the community? Will HN take such responsibility? Curious.

<comment><USER2> While anecdotal, their domain knowledge and comment history on the topic/project generally validates their input.

But more importantly, in my experience their HN handle matches their GitHub or Twitter profile that's found in the project, and it's easy to interact with them and explore more of their work (I've never seen a non-matching username or throwaway account claiming authorship before).</comment></comment>


Rate my Website - <AUTHOR> http://www.rochafashion.com I have started my online business recently. Just wanted to get reviews from you guys. It has worked quiet well as I have achieved revenue of $2000 by spending $400 or so in first month. <comment><USER2> "WELCOME TO ONLINE FASHION STORE" is not really proper english, say "welcome to our store" or "welcome to rocha fashion"

<comment><AUTHOR> Thank you for the comment! I will consider it!</comment></comment>


Killing Strategy: The Disruption of Management Consulting - <AUTHOR> https://www.cbinsights.com/research/disrupting-management-consulting/ <comment><USER2> For all you consultant-haters out there: there are some services that are very natural consulting engagements. They have the following properties:

1\. A particular company will need the service infrequently

2\. Many different companies will benefit from the service

3\. The service requires a lot of manpower

4\. The service is complicated and has a learning curve

So, to provide a concrete example, suppose you want to re-negotiate all your contracts with all your suppliers. This is the bread and butter of many large firms. However, you can't do it all the time, you only want to do it once every 10 years or so. It is quite complicated and requires a lot of people with experience doing it, and almost any company will benefit from doing it.

This is exactly when you would hire a consultant that is known and respected in this area.

<comment><USER3> Logically that sounds good, but in practice most of the work is done by people without specific related backgrounds.

The problem is the company can't judge work quality if they don't understand the domain. So, it boils down to most companies over billing and under delivering.

<comment><USER4> Have you ever done consulting?

The _problem_ is that the company can't judge the size of the problem they have. When you don't know what you're asking you are very likely to get sticker shock.

If two agencies put in a bid on your job, where one is planning to profit on rework (dishonesty) and the other is estimating for all the unknowns, you're going to go with the first guy because you like his price better. And then you're gonna get taken to the cleaners.

<comment><USER5> Rework is often the profit strategy when the client comes to us with a lowball price in mind. Don't chalk it all up to dishonesty; many times we have to do exactly what the client asks us to first, watch it fail, then suggest a more expensive path for rework.

The right call is the right call, even if the client dislikes the price. But sometimes you have to let the client fail before they're willing to listen to you (the bigger the implementation, the more true this tends to be).

</comment></comment></comment></comment><comment><USER5> As a management consultant, I 100% agree.

I would say the main function of a modern management consultant is twofold: we bring in best practices from outside, and we help companies communicate. Best practices is an obvious function, but the communication is where most companies really fall down.

Often, it's simple things like the product group never formalized the formats for their user stories / features, so we simply help them drive standards around things and make sure the dev teams intaking the stories understand the change as well.

90% of what we do is change management or in preparation for change management. Those are things that companies will probably never be good at.

And by the way, we still do the business strategy too; it's just baked in to the implementation work these days.

<comment><USER6> I have seen this as well. At a role earlier in my career it turned out we had a major engagement with McKinsey around figuring out what was actually happening in some of the most areas most critical to the future. One could rightly point out that this is a symptom of dysfunctional senior management but I think that oversimplifies the issue. Organizations are built over time and simply hiring a new CEO is not really the answer. Its not like a public company can just fire its entire leadership team, even if that is the right thing to do.

I ended up feeding a lot of data to the McKinsey team who as it turned out were really smart and helped in both directions, both connecting our team with other parts of the company that might be able to leverage what we were building and also helping our team craft our message to gain the broadest visibility. We could have done it all ourselves but given that they were already there it greatly speeded up the process.

The final thing I will say is about costs. With an engineering budget that ran into the hundreds of millions annually, saving a couple million on consultants might seem like an easy optimization to make and it will make no material difference to the company. If they do add some value it will probably be at some multiple of what they cost.

<comment><USER5> Yeah... consultants really do bring a lot of value for things that are complex, infrequently performed step functions. Of which there are a _lot_ within a company.

But ultimately, when you're talking complex software implementation, you need folks who understand both the business context and the tech context at a deep level. Those people tend to be consultants, either working independently or employed by a major firm (or more often recently, working independently and brought in by a major firm).

The job you're often doing here is switching between _multiple_ business (HR, finance, IT, etc) and technology (application, network, cloud, service, etc) layers. You really DO need MBAs, about half of whom are former engineers with 5+ years of experience. This is complex work that takes nuance and soft skills. If companies could do it themselves, they wouldn't hire us to come fix their broken Workday/Salesforce/whatever implementations.

There are a ton of us too. My MBA program 7 years ago was teaching modern ML/AI (with profs from the school's top-ranked CS dept) and DevOps. The MBA has become far more tech focused than it was in the past; I would expect modern coursework to include some intro to cryptography if not cryptocurrency.

</comment></comment></comment><comment><USER7> I've never understood why the management consultants get so much money for so little. They are, in the end, selling the labor of clever and well- credentialed but woefully inexperienced people at really eye-popping rates. You'd think any well-run company could get the same sort of insight from its own people. It's really a masterpiece of packaging and brand-building, as far as I can tell.

Let's be clear; I'm not talking here about specialist consultants with deep industry experience and consequent insight. Those make sense to me.

I'm talking about generalist corporate-strategy/management consultants who are peddling what sure looks like a suite of industrial command+control or planning+strategy techniques. How could they possibly be providing enough value to be worth hiring?

<comment><USER8> I've been in this role. It is pretty common at Fortune X00 companies to have its own people have "the answer" or "an answer" but either 1) not have the conviction to bet their careers on it, i.e. don't rock the boat, 2) don't care enough to push for it, or 3) don't have the credibility to get the attention of the senior executives.

Consultants get past all three of these challenges to surface a good solution and in the process get buy-in from everyone who needs to agree in order for a major change to be made.

Additional point is that usually there is involvement of industry specific specialists that advise project teams. They put in fewer hours, as they're not needed for the more mundane project work (slide making). Often times they're hyper-specific to the topic at hand, e.g. former CEO of competitor.

<comment><USER9> "1) not have the conviction to bet their careers on it, i.e. don't rock the boat, 2) don't care enough to push for it, or 3) don't have the credibility to get the attention of the senior executives."

1\. Poor executive leadership. 2\. Poor executive leadership. 3\. Poor executive leadership.

When you breed a culture of fear and silence this will always be the result. It's the CEO who says, "I'm not surrounded with people who say 'Yes' to me. I'm surrounded with people who share my vision." The CEO, after having replaced, removed, and reassigned anyone who is willing to call into question a decision made by the CEO, will make decisions without any real feedback from their executive team (an echo chamber).

The alternative?[0] The CEO who lets and encourages everyone to speak their mind. The CEO who rewards those with differing opinions and seeks truth by asking "Why?" instead of shutting down dissent. The CEO who actively seeks out executive leadership that will challenge them to justify their decisions and to keep a written record of those decisions.

[0][https://www.ted.com/talks/ray_dalio_how_to_build_a_company_w...](https://www.ted.com/talks/ray_dalio_how_to_build_a_company_where_the_best_ideas_win)

<comment><USER10> You linked to a TED Talk from Ray Dalio at Bridgewater - a company that has hired McKinsey and BCG frequently. It's not as simple as just communicating.

The reality is that strategy consultants sell services targeted at senior management at large corporations, a category that ~0% of Hacker News falls into.

</comment></comment></comment></comment><comment><USER11> There have always been many alternatives to consulting.

But large expensive reliable branded companies are important because if they make a mistake you can't blame the person who hired them.

Also ex consultants from these firms see their value and process and hire them.

They have thrived not in spite of all the alternatives but because of them. When there are so many choices, quality signals matter.

</comment><comment><USER12> From the top link: "When the client-consultant relationship is functioning at its best, the consultant gives the client: ... * Execution: The roadmap to choosing and implementing the changes to be made."

I think many of us might define execution as more than coming up with the roadmap.

</comment><comment><USER13> There was a saying in the valley: You hired a consultant when you needed to fire someone high up.

</comment><comment><USER14> This is a great explanation of what management consulting is and how it's evolved over the past 60 years, but the title is a bit clickbaity - I kept reading through expecting to see how the big 3 were going to be disrupted but in the end the article concludes with:

> A lot of the value that traditional management consultants have offered > their clients has been similarly disrupted by technology. But as we've seen, > consulting firms are nimble. It may help that they themselves invented the > concept of "disruption."

> Of course, there's no guarantee that consulting firms will survive forever > in their current state. Every day, there are more ex-consultants ready to > share their expertise. Every day, the tools that companies can use to form > their strategy get better and more advanced. And every day, consulting firms > need to prove that they can be relevant in this new world — and not simply > the prestige name Fortune 500 CEOs hire to get the board off their back.

</comment><comment><USER15> [https://hbr.org/2013/10/consulting-on-the-cusp-of- disruption](https://hbr.org/2013/10/consulting-on-the-cusp-of-disruption)

</comment><comment><USER16> Nitpick. The article wrote:

> _Bain & Company had always preferred intimate client relationships where it > could drive greater value over [more] numerous but [less] valuable > relationships._

I think the prepositions were swapped. Judging by the bullet points that follow, that sentence makes more sense with the positions of "more" and "less" swapped as follows:

> _Bain & Company had always preferred intimate client relationships where it > could drive greater value over [less] numerous but [more] valuable > relationships._

<comment><USER17> I think the article is using 'over' to be 'preferring A instead of B' while you are using over to mean 'A applied to the set of B'. I agree it is ambiguous.

</comment></comment><comment><USER18> Anecdotally, I worked for an advisory and reporting company that produced reports and ranked them in a hazily defined index (the company was later bought by another, larger advisory company). The way the sausage was made was not pretty. The research staff consisted largely of recent ivy league graduates with little experience or knowledge of the domain or of statistical methods. Data was largely collected from the web. Initially, collection was done by hand, but we were working to automate as much as possible (though the leadership did not quite appreciate the need to invest in tech and did not understand the dao of building software services). In some cases, the data collected was woefully below the minimum sample size you'd need to be justified in drawing any sort of meaningful conclusions (there wasn't even a sense of what a minimum sample would look like, and not much concern about these things when these issues were brought up to management). I recall researchers telling me that the metrics and ranking were adjusted for important clients, something that smells to me like pay-to-play. The data science team was wholly unqualified. The management across the board was unqualified. The article suggests insider trading practices inside consulting companies. I had a similar suspicion, though not something I can prove, that insider knowledge was being laundered through cooked data and presented as "rigorous, data-driven insight".

The impression I got of this space:

1\. Clients, usually executives within large, billion dollar companies, don't really mind spending what for them are pennies on a subscription from a company that claims to know what's up when they feel they don't. They see a company with certain associated credentials and trust the advice.

2\. Executives, wishing to justify their own decisions, want to cover their own asses by appealing to "experts". Their employers may come across those reports, see their company ranking highly, and say "Wow, Bob. You've done a great job." It matters little how meaningful the data analysis is. The data analysis is just decorative.

3\. The ranking in reports become a self-fulfilling prophecy of sorts. If you rank highly in an advisory report on a certain kind of product, and readers of that report believe the ranking, then this can lead to more sales or whatever.

To be fair, this isn't some kind of Newtonian mechanics. You can't take a bunch of data and just have all your conclusions fall out as a tidy positions in space and time. I am not making the claim that advice cannot be given or that these things cannot be researched to produce meaningful insight. I also do not claim that there are no companies out there producing valuable research. However, my personal experience does make me wonder. Even if and when the claims in the research are true, the appeals to data can become little more than a game of appearances. Maybe, in relative terms, they're not in much worse shape than academia with its data massaging, p-value hacking scandals, and unreplicated/unreplicable studies.</comment>


Ask HN: Why is my profile page "limited"? - <AUTHOR>

I'd like to use my profile page (https://news.ycombinator.com/user?id=leereeves) to check for responses to my comments, but for the past day it simply says:<p>"We've limited requests for this url."<p>What happened? And can I do anything to fix it? <comment><AUTHOR> If anyone finds this in the future, resetting my router fixed the problem.

</comment><comment><USER2> Works fine for me.

To check for responses to your comments, why not click on "threads"?

<comment><AUTHOR> Same problem.

"We've limited requests for this url."

<comment><USER2> Maybe email firstname.lastname@example.com to get support?

<comment><AUTHOR> I'll do that. Thanks for taking a look.</comment></comment></comment></comment>


Amazon SES CloudTrail Logging - <AUTHOR> http://docs.aws.amazon.com/ses/latest/DeveloperGuide/logging-using-cloudtrail.html <comment><AUTHOR> Can we disable cloudtrail logging for a specific AWS service? e.g. I wan't to disable cloudtrail logging for AWS SES.

Is there any way?</comment>


US (E2) Visa: Worth getting an immigration lawyer/London recommendations? - <AUTHOR>

For those who know/have been through the process..my business partner and I are considering relocating to the US upon receipt of $300k in angel seed capital.
1) We're both EU Nationals (Treaty countries), long-term resident in the UK.
2) Most likely, we would be aiming for E-2 Visas.
Qs -
1) Is it worth getting help from professional immigration lawyers?
2) Any particular recommendations for London-based, or focused on the London Embassy (which seems to hold a special status?), lawyers?
The experience I've had when doing some primary research so far has not been encouraging - most seemed more concerned with ripping me off on introductory meeting fees etc.
Many thanks. <comment><USER2> Have you tried www.visas4america.com . They have very reasonable rates, are E-2 experts and are based in Hemel Hempstead , Herts .

You do need a UK based attorney's firm as the application of the E-2 rules vary from US Consulate to US Consulate.

US Embassy, London is particularly stringent.

Kind regards,

Ozz Anthony

</comment><comment><USER3> When you do figure it out, it would be great to have this kind of info collected online somewhere.

From what I've read so far though, the usual way is to get an immigration lawyer in the US, not in your home country, as you seem to be doing.</comment>


Ask HN: Do we need another email service? - <AUTHOR>

I got a chance to work with email recently and thinking of starting an email service, but wondering do we need one now? if it is paid, what makes you pay for it? <comment><USER2> The missing email feature I'm interested in is analytics - I couldn't find anything the last time I looked.

Who takes up most of my time, as measured by the number of words I've written to them? Who is worst at responding to me? Can you do anything with sentiment analysis?

<comment><AUTHOR> Yes, this is one of the features I am thinking.

</comment></comment><comment><USER3> Yes, we need another paid email service. Competition is good.

Besides the obvious gmail, I think your fundamental competitor in the not- gmail space is fastmail.fm or something like it. If you think you can make a go of it at those prices, plus or minus an order of magnitude, then have at it.

Mail is not for the faint of heart. Besides the technical details (which are harder than most people assume), you have to operate in a way that you earn and keep the trust of your customers. You have to not lose mail, you have to stay up.

You have to accept that you'll be an unwilling partner to the NSA and other law enforcement. You'll also be a target of under the table surveillance by the NSA and other spies and criminals.

You have to get email fundamentally, rock solidly right. Above that there's lots of room for features and services more or less related to email.

You're going to have to work hard to peel me away from fastmail, and you'll have to work even harder to peel everyone else away from gmail, or even to get them to notice you.

I look forward to your Show HN (truly).

</comment><comment><USER4> Yes, we do. I would pay for it if it is not ridiculously expensive (mykolab) and has decent privacy AND encryption. Servers in america == bad.

That icelandic one from recently (forgot the name) I can not take too seriously, since they want to roll their own browser that will basically be a bad version of Tor browser and also some other stuff they want to build their selves.

<comment><USER5> I'm guessing you mean Mailpile[0], but those guys are only providing an email client (which you can run both from a thumb drive or on a server).

[0]: [https://mailpile.is/](https://mailpile.is/)

</comment></comment><comment><USER6> I'd be open to a new open service, if and only if it really went above and beyond our current expectations of email providers today. I think gmail(what I currently use) is great and I'm satisfied with it but it doesn't mean that I wouldn't switch if something could out-do it in certain arenas. I think the obvious factors of security,privacy and UI/UX would be the things that would really have to shine for me to open my wallet. I'm not sure but I think that the market has some pretty decent offerings and people might not be on the lookout for a new email service but to make an example; I wasn't looking for a new text editor when I came across Sublime. Sometimes thing are so great that they are just worth trying. It would be a large undertaking on your part but who knows how it could turn out? Good luck.

</comment><comment><USER7> If it can differentiate itself by being private and secure, sure. That means non-US hosting, zero knowledge storage, PFS on all SSL/TLS, properly defined security policies from a company side to reduce social engineering, secure architecture, etc.

Many people on HN probably either host their own email or considered it, but a good secure service is better to sell to people without that technical knowledge who don't want to be a Google/MS/Apple/Yahoo/etc product. I've pointed less technical people towards MyKolab before; they are a good model for how an email service should be done.

</comment><comment><USER8> I don't think we need another email service. The backend stuff tends to be very complex and it would be a waste of time to reinvent the wheel. I do think there' s a lot of potential for improving the user experience on the client side, finding new ways to simplify and augment the current offering. Too bad the main player in this space (Gmail) doesn't offer the kind of API access needed for a deep integration, maybe in the future.

<comment><AUTHOR> It is true that backend stuff is complex. My idea is to improve the existing one and do some cool stuff on the UI. I strongly believe that there is scope for many players in this segment.

</comment></comment><comment><USER9> I might pay a buck a year for an email service that didn't serve ads, had a gmail-level quality and had solid privacy/security baked in. That said I tend to steer clear of the lavabit-esque providers who go out of their way to advertise their over-my-dead-body stance on handing over emails because it makes them a target and tends to make people associate you with paranoids (even if they are after you :)

</comment><comment><USER10> I'd like a service that unifies my email with messages on other services I use eg facebook, Whatsapp, Linkedin, SMS etc so if I've been chatting about say going to Vietnam I can search for that in all sources. Maybe even posts on HN. Basically anything I write that people reply to.

<comment><USER11> Yeah, the walled gardens are hellish. Makes it very hard to manage things... sadly, it is getting worse not better.

</comment></comment><comment><USER12> Few years ago, there was email service called Zenbe. It was cool and ahead of time and I've seen it as only real competitor to gmail. But for some reason they got out of business (I don't remember why). Search for Zenbe and maybe you will find some clues.

</comment><comment><USER13> Yes, it's all about branding. Most legible names are taken in all big players, so a new service would see an influx of users trying to secure their vanity names.

And that, my friend, will occur for as long as a million human beings are born each day.

<comment><USER9> rema.il

If I had the slightest inclination to make a mail service I would buy this name, but I don't, so have fun.

</comment></comment><comment><USER14> We tested demand late last year and relative numbers didn't look too convincing.

[https://www.minervafabric.com/](https://www.minervafabric.com/)

Feel free to ping me for more insight or specific data.

</comment><comment><USER15> It would be cool if besides privacy for users you contributed/used already existing open source mail related software. You know, follow the model of those companies that are based on and expand oss.

</comment><comment><USER16> Paying for Google to host the e-mail for all companies; ran private exchange before; it's just not worth it :)

Imho, it's extremely hard to beat what Google offers.

<comment><USER3> There's one thing that Google cannot offer: not being Google. That's a feature for me and many others.

</comment></comment><comment><USER17> Location is an essential issue today for e-mail services: don't expected much enthusiasm if your servers are in USA

</comment><comment><USER18> yes we need another mailprovider, with all the killerfeatures of gmail:

lots of storage / archive

contacts / sync

kalender / sync

decent privacy/ encryption

servers in EU

i dont care about webmail/mailclient.

<comment><USER19> Try [https://mailbox.org](https://mailbox.org)

</comment></comment><comment><USER20> I'll die for an emailbox where I could rearrange my mails on the fly.

<comment><USER21> I love this idea.

</comment></comment><comment><USER22> IF and only IF the spam filters are as good as Gmail.

<comment><USER23> Then use gmail!!

</comment></comment><comment><USER24> Any innovation in email is welcome by me.</comment>