Flappy Space Program - <AUTHOR> http://corpsmoderne.itch.io/flappy-space-program <comment> T-hawk I'm incapable of playing something like this without laying out some strategic principles:

When launching, hover the bird at the edge of the atmosphere for a few clicks, to give it time to tilt into horizontal orientation, so your thrust can affect the orbital parameters. If you don't do this, you'll just thrust vertically into the outer barrier.

Circular orbits are best. Two objects in circular orbits at different altitudes can never collide.

High-altitude orbits are best, where there's more room for more objects.

So circular high-altitude is best, but it's not easy to get there. Standard orbital astromechanics apply: to circularize, thrust at apogee to raise your perigee. Problem is, it's not easy to tell when the bird is at apogee, and it may not even occur before you lose control of the bird and the next appears. Also, the thrusting resolution is rather coarse: if the apogee is any higher than about halfway to the edge, two clicks will send the bird into the barrier, so you only get one attempt. These details and coarse controls make the game a lot harder than it looks, just like the original Flappy.

Finally, if you just need that one more point to break your high score, launch the next bird into the lowest fastest orbit possible. That altitude should be clear if you launched all the other birds higher, and it will register quickly before any more collide. I managed 8 thanks to this.

<comment><USER2> Perfect! Thats almost all the points covered, and it took me an hour to get to this. Although, I should say, it was more like a physics practical tutorial, I learnt to apply thrust at apogee, say, just by intuition. So since this game is based on physics, there has to be strategy.

</comment></comment><comment><USER3> I read through the source and was surprised at its simplicity and readability.

[http://storage.googleapis.com/itchio/tmp/main.js](http://storage.googleapis.com/itchio/tmp/main.js)

No funky frameworks , just plain old jQuery and some JS.

I've just begun learning JS and the source was very informative.

<comment><USER4> Meh, don't use best practices for assigning functions to variables, but other than that looks pretty readable.

<comment><USER5> What are the best practices for assigning functions to variables?

</comment></comment></comment><comment><USER6> Once you figure out the space bar cadence, that _Flappy Kessler Syndrome_ [1] is gonna hit you hard any time above 3 bird's.

[1] [http://en.wikipedia.org/wiki/Kessler_syndrome](http://en.wikipedia.org/wiki/Kessler_syndrome)

<comment><USER7> You get the gold medal with 16 flying birds. By the time I reached it I had prevented 12k collisions. Spanning at random position would help to create different orbits.

<comment><USER8> I've had some success with doing sub-orbital hops before taking off finally for orbit, to move myself to a new launch position. Doesn't really work well if you have birds in orbits with very low peris though.

<comment> T-hawk This is unnecessary - it's functionally equivalent to just waiting a moment before launching for the orbiting birds to progress. There's nothing absolute about the positioning of the launching bird, it's all only relative to the orbiting birds.

<comment><USER8> Changing the initial launch position makes it easier to choose what area of the planet the periapsis will be over. When I launch the birds, unless I take great care to do otherwise, my periapsis tends to slightly after my launch position.

With periapsis's in different positions, you can get birds into rarely colliding 'resonances' of sorts. Making sure that the periapsis of birds is not over the default starting location is also good to ensure that you do not lose orbiting birds to a pre-launch bird.

</comment></comment></comment></comment></comment><comment><USER9> Suggestions. Decrease the number of clicks slightly when using a mouse. The fingers hurt trying to go that fast. Alternatively, add spacebar support.

Absolutely unplayable on a phone. Bind to touchdown events on mobile. Click events have a 300ms delay. Make the game full screen for mobile.

<comment><USER10> _space_ bar, how appropriate..

<comment><USER11> To the moon.

<comment><USER12> Ducks! Yes, ducks in outer space...

</comment></comment></comment></comment><comment><USER13> Are you supposed to get it to go through the space between the "stars"? Is it even possible?

Edit: Got my first point (50 - 100 tries?). You need to make it go a full orbit without touching the outer circle. This seems obvious in retrospect.

Edit 2: And they knock each other out of orbit. This is fun.

<comment><USER14> No, just have as many "satellites" in orbit as possible simultaneously. The game is continuous. I got up to 5 and gave up ;)

<comment><USER15> I got 4 and was very, very proud of myself. That said, if it were controllable through spacebar, I'd play a lot longer.

<comment><USER16> I've been playing using the spacebar... Debian/Chromium

</comment></comment></comment></comment><comment><USER17> For a real treat, try Desert Bus[1]. The scoring works like soccer: 1 point and you've basically won.

[1] [http://www.newyorker.com/online/blogs/elements/2013/07/the-w...](http://www.newyorker.com/online/blogs/elements/2013/07/the- worst-video-game-ever-created.html)

</comment><comment><USER18> I hope I'm not at all stepping on the developer's toes by pointing out you can fullscreen it by going to the iframe's source, where you can also have some fun trying to script it.

I'm in the early stages of designing a junior high programming curriculum and think this may be a great example of an engaging, practical experiment.

      boost = function(duration, interval){
          setTimeout(function(){
              clearInterval(window.kp)
          }, duration)
          window.kp = setInterval(function(){
              $(document).keydown()
          }, interval)
      }

<comment><USER19> I know I enjoyed playing with that snippet! Thanks for sharing.

</comment></comment><comment><USER20> Speaking of orbiting... [http://www.kanyezone.com/](http://www.kanyezone.com/)

<comment><USER21> That game is even worse

</comment></comment><comment><USER22> "The developer has not uploaded a game yet..." are we overloading the server?

<comment><USER23> It's fixed! The itch.io team has be great on this issue

<comment><USER24> still getting that error

<comment><USER25> Sorry, the page was cached for 10 minutes and it wasn't cleared after deploying fix.

</comment></comment></comment></comment><comment><USER26> It's an infinite game -- you don't die and score can go both up and down. This is a new kind of game for me.

<comment><USER27> Never tried to play Kerbal Space Program, or Minecraft, or... well... pretty much every sandbox game out there? ;).

<comment><USER5> Neither of those have hard point metrics, psychologically it's a different to see a number that represents your progress in the game drop to zero in a spectacular three bird crash.

</comment></comment></comment><comment><USER28> The graphics are kind of blurry and fuzzed-out by scaling. It seems to be a by-product of re-rendering the the sprite images within a <canvas> object.

[http://commondatastorage.googleapis.com/itchio/html/4923/spr...](http://commondatastorage.googleapis.com/itchio/html/4923/spritesheet.png)

[http://commondatastorage.googleapis.com/itchio/html/4923/bg....](http://commondatastorage.googleapis.com/itchio/html/4923/bg.png)

This would be top notch if the images were resized to provide crisp, well- pixelated edges. The spritesheets look great, in and of themselves, but the browsers scale them poorly.

<comment><USER29> I think that's an homage to the original.

<comment><USER28> Sure, but compare the relative size to the flapmmo.com sprite sheet:

[http://flapmmo.com/atlas.png](http://flapmmo.com/atlas.png)

</comment></comment></comment><comment><USER30> Anyone else getting "The developer has not uploaded a game yet..."?

<comment><USER31> yep

</comment></comment><comment><USER32> So bad, why don't they support the space key and instead use click? Trackpads/touchpads are not good for that at all.

<comment><USER33> You are right on that. I can't send any bird to space. my bad luck.

</comment></comment><comment><USER34> Flappy Bird meets KSP.

This is possibly the best Flappy Bird -type game I've seen.

</comment><comment><USER35> I wish there was a way to control when a new one spawned, I had loads in really good setups to make nice circular orbits and then a new one spawns.

</comment><comment><USER36> I set up some really crazy orbits :-D

[http://imgur.com/3HA4ubl](http://imgur.com/3HA4ubl)

One of those birds is in a circular orbit one bird-height above the ground!

Another is in a very eccentric orbit that skims the ground when it comes to the bottom-right of the screen, then almost grazes the asteroids in the top- left.

<comment><USER36> The one thing I don't like is that this game's physics don't seem to behave properly. In real life (and in Kerbal Space Program) you burn at apogee to increase the height of your perigee, or burn at perigee to increase the height of your apogee. But that rule doesn't seem to apply to Flappy Space Program, making this game anti-educational. :-(

<comment><USER23> Hi, dev here. I certify you that the physics are OKish. You should burn at apoapsis to circularize, etc. What prevent you to realize this is that it's hard to know when you're at apo/periapsis, so you're burning with some vertical velocity and that changes how your orbit change. Anyway, this game was really a joke, if you want an educational game, I've also made this: [http://deltav.corpsmoderne.net/](http://deltav.corpsmoderne.net/)

<comment><USER37> +1 for the delta-v game!

Here's a reddit thread about the game with a "high score list": [http://www.reddit.com/r/gravity_games/comments/1fks9v/oc_del...](http://www.reddit.com/r/gravity_games/comments/1fks9v/oc_deltav_a_small_2d_game_where_you_program_a/)

If anyone wants to test out their orbital mechanics skillz, you can try to beat my unofficial world record, a grand tour of the Jovian moons:

[http://deltav.corpsmoderne.net/game.html?s=Jupiter&prg=QlVST...](http://deltav.corpsmoderne.net/game.html?s=Jupiter&prg=QlVSTiAwLjAxIExFRiAxMApCVVJOIDQ3Ljg2OSBSRVQgNDkuNjUKQlVSTiAxNDYuNjc5IFBSTyAyLjUKQlVSTiAyMDMuNTQxIFJFVCAxOApCVVJOIDI1OCBQUk8gOC42MjUKQlVSTiAzMzIuNjk5IFJFVCAxMgpCVVJOIDM4MC4zIFBSTyA1CkJVUk4gNDM5LjExNyBSRVQgNwpCVVJOIDQ4Mi41IFBSTyAxMApCVVJOIDUxNC43MDEgUkVUIDEyCg==)

<comment><USER38> I took on your challenge, determined to do it from scratch with no copying, and I have this:

[http://deltav.corpsmoderne.net/game.html?s=Jupiter&prg=QlVST...](http://deltav.corpsmoderne.net/game.html?s=Jupiter&prg=QlVSTiAwIExFRiA3CkJVUk4gNDcuNzM4IFJFVCA0My41CkJVUk4gMTk4LjExIFJFVCAyNwpCVVJOIDIzNy4wNSBQUk8gOC43CkJVUk4gMzIzLjMxNCBSRVQgMTUKQlVSTiAzNzkuOTUgUFJPIDQuNwpCVVJOIDQzMy45MDQgUkVUIDcKQlVSTiA0NTUuMDk0IFJFVCAxCkJVUk4gNTIzLjEyIFBSTyAxMC44CkJVUk4gNTU4LjUyOSBSRVQgMTgKQlVSTiA1ODguNyBQUk8gMTgKQlVSTiA1OTcuODcxIFJFVCA1NwpCVVJOIDcyMy4yNzkgUkVUIDMK)

More points, due to orbits of and impact with Jupiter, but slightly less efficient and elegant overall I dare say - some burns not really at peri-/apo- apsis, and my orbits are generally higher and less circular. Kudos also for motivating me.

</comment></comment></comment></comment></comment><comment><USER39> I am very much enjoying the new flappy meme. It's pretty cool that a game came and went and became a legend in such a short time. And now the "flappy" adjective is a byword for simple, nearly impossible games.

</comment><comment><USER40> There, I _finally_ got a bird to stay in orbit and a new one appeared on the ground. Score: one. I triumph!

(Now I'd better leave it alone or the next hour or two will disappear.)

</comment><comment><USER41> Neat idea. Probably would improve if you go with click-hold rather than tap- tap-tap-tap-tap, or at least enable the ability. Also, needs more Mario pipes :)

</comment><comment><USER42> for a simpler game, try [http://kookiekrak.itch.io/flappy- pipes](http://kookiekrak.itch.io/flappy-pipes)

</comment><comment><USER43> Would you mind sharing how you've made the game?

<comment><USER44> [http://storage.googleapis.com/itchio/tmp/main.js](http://storage.googleapis.com/itchio/tmp/main.js)

</comment></comment><comment><USER45> When I double click on the canvas it selects it.

You can fix it by adding:

        user-select: none;
        user-drag: none;

With appropriate vendor prefixes.

</comment><comment><USER46> Doesn't work on my ipad (ios7). The screen just tries to constantly resize to fit all the content, and my taps are thrown away before they ever get to the game.

The recent "Flappy Bert" [http://www.sesamestreet.org/cms- static/flappy_bert/](http://www.sesamestreet.org/cms-static/flappy_bert/) doesn't have this problem.

<comment><USER47> Get yourself a proper computer.

<comment><USER46> Is it too much to ask that a web-based clone of a single-input game originally designed for phones and tablets also work on a phone or tablet? Apparently for you, it is. Either that or this was some kind of platform flame. I can never tell any more.

<comment><USER47> Platform flame, FYI.

<comment><USER46> An, I suspected as much. Let me respond in kind, then. Ahem.

Kindly insert the antiquated, unfriendly device that you dignify with the name "proper computer" into your excretory orifice of your choice.

Hmm, not very good. I'm really not very good at platform flames any more. Especially when it's such an unspecific one as "tablet" vs "not tablet". I dunno, I'll take a shot in the dark and urge you to go back to fellating Bill Gates and his heirs, or Linus? Or pick up on the British English and suggest that you go back to your precious Speccy. I mean, really, give me something to work with, man.

</comment></comment></comment></comment></comment><comment><USER48> I was going on pretty well, really enjoying the game and taking advantage of the fact that I have two mouse buttons (external + laptop's) to avoid breaking a single mouse (or my finger) with so many furious clicks. At some point the X server crashed - I wonder if due to so many clicks, or due to clicking on both mice. Did anyone experience the same issue?

</comment><comment><USER49> Looks cool, but I'm traveling and on mobile. Maybe add touch events so us mobile users can enjoy too?

<comment><USER23> This version should work on mobile: [http://corpsmoderne.net/fsp/](http://corpsmoderne.net/fsp/)

</comment></comment><comment><USER50> It appears that _any_ mouse or keyboard button works, additively. Tapping any two keys at once will put the bird just above the clouds in one hop. Three rockets it straight into oblivion. Holding down several keys produces impressive fireworks.

</comment><comment><USER51> I'm surprised no one has made "Flappy [Lunar] Lander" yet.

</comment><comment><USER52> The game also serves as political commentary on [http://en.wikipedia.org/wiki/Space_debris](http://en.wikipedia.org/wiki/Space_debris)

</comment><comment><USER53> Out of all the Flappy variants, I played this one the longest (20 sec) and had the most fun with it! Kudos! I could really see a lot of people buying this as an iPhone program.

</comment><comment><USER54> Well there goes my spacebar from ferociously whacking it.

</comment><comment><USER55> Six birds in space at [http://www.youtube.com/watch?v=R7vNInUbhZU](http://www.youtube.com/watch?v=R7vNInUbhZU)

</comment><comment><USER56> Flappy Bird will be the biggest merchandise for free in 2014. There will be more Flappy Bird teddies than Angry Birds and nobody needs to be paid.

</comment><comment><USER57> So this is the ornithological version of Gravity

</comment><comment><USER58> Excellent game - congrats!

Just wondering what the revenue is for your donation button vs having adverts.

Also, have you considered creating ios/android apps?

<comment><USER59> >Just wondering what the revenue is for your donation button vs having adverts.

I doubt he'd make much money with either option. People rarely donate to software projects and you need lots of traffic to make money off of advertising.

<comment><USER58> From my own sites, I'm averaging $1.50 per 1000 pageviews with adsense adverts.

</comment></comment></comment><comment><USER60> I couldn't get past 5 without them colliding, at least with the minimal effort I put into this game. Really cool though.

</comment><comment> mauricio-OH It is so addictive I just lost 20 minutes of my life for no reason.. and got only 4 birds in orbit!

</comment><comment><USER61> Fun fact: this game is much easier on my gaming mouse than using mere Dell mouse at work.

</comment><comment><USER62> Makes me feel like Elon Musk.

</comment><comment><USER63> 5.

Really cool though.

</comment><comment><USER64> 7.

</comment><comment><USER65> HOLY COW THAT IS SO FUN.

</comment><comment><USER66> if you zoom out on the page the icon and points board do not scale well.

Nice game

</comment><comment><USER67> Great! Now add the green tubes for extra difficulty :p

</comment><comment><USER68> This.. Is the best flappy game ever!

</comment><comment><USER69> Not working.

</comment><comment><USER70> Hey. Dude. This game is awesome.

</comment><comment><USER71> Good God is that game addicting!

</comment><comment><USER72> Way more fun than the original!

</comment><comment> data-cat This is a fun game. Good job.

</comment><comment><USER73> It's just awesome ;D

</comment><comment><USER74> We have a winner, folks.

</comment><comment><USER75> Ha. Nice game :)

</comment><comment><USER76> all 3 of mine are in polar orbits!!! :0

</comment><comment><USER77> These flappy clone brigade is just dumb.

<comment><USER4> that partially the point I think.

</comment></comment><comment><USER78> wtf hard

</comment><comment><USER79> alper slym</comment>


O'Reilly To Release DRM-free Ebooks In July - <AUTHOR> http://toc.oreilly.com/2008/06/select-oreilly-books-soon-on-kindle-and-as-drm-free-digital-bundle.html <comment><USER2> Here are the titles:

      iPhone: The Missing Manual
      Windows Vista: The Missing Manual
      Facebook: The Missing Manual
      Making Things Happen
      Open Sources 2.0
      The Art of Agile Development
      Information Architecture for the World Wide Web, 3ed

Anyone want to make any guesses how well those titles are selling and whether or not that had anything to do with O'Reilly's decision?</comment>


Show HN: My friends solution to inconsistent and crappy email signatures - <AUTHOR> http://emailsignaturerescue.com/

<comment><USER3> Hi guys, Thanks for the look in, I have been working on this over the Christmas break and would love to hear any feedback you have. We are basically in a soft launch phase so definitely take any advice on board.

HN is always good to me so in return if anyone actually needs a signature/s please use this coupon

code "RESCUEHN"

(all caps no space) and you will get 25% off your plan for LIFE, I'll leave the code valid for a few days for the stragglers ;)

Cheers - <USER2>

</comment><comment><USER4> why not give a 14 day trial? $29/month for 1 signature seems a bit high for someone like me thinking this is interesting but not sure if it's worth 3x what I pay for spotify.. site looks great btw, love the concept!</comment>


Making connections with WebRTC - <AUTHOR> http://blog.bignerdranch.com/2080-making-connections-with-webrtc/

<comment><AUTHOR> If you want to jump straight into some code, here's a link to the demo app I threw together:

<https://github.com/vanstee/webrtc-demo></comment>


The New Poor - <AUTHOR> https://medium.com/@laurajeanmoore/the-new-poor-6b88647c649c

<comment><USER2> "Not only do the New Poor have the same skin color and/or cultural habits of white moneyed individuals and their families, but they are also socially- linked to those individuals and families by virtue of their educational backgrounds."

Please stop linking to these racist articles.

<comment><USER3> i wouldn't call this racist at all. rich people are, by percentage, mostly white.

<comment><USER2> Well, if you said a large percentage of minorities commit crimes in a certain area of the country, based on statistics, you would be called 'racist'.

It's the world we live in.

<comment><USER2> Downvoting this is exactly what I am talking about: generalizing that whites are rich is fine, but generalizing that minorities are poor or commit crimes is not.

It's extremely hypocritical and I just can't take someone seriously that has these sorts of views.</comment></comment></comment></comment>


Introducing the Librem Key - <AUTHOR> https://puri.sm/posts/introducing-the-librem-key/ <comment><USER2> > The Librem Key opens up possibilities for even stronger anti-interdiction > protection for customers who need it. We will be able to link a Librem Key > with a laptop running Heads at our facility and then ship them separately. > Then when each package arrives you can immediately test for tampering with > an easy "green is good, red is bad" test.

That's really neat, but I'm curious about what interdiction threat models this does or doesn't help with. For example, could the people performing the interdiction have sophisticated enough hardware-tampering capabilities that they could modify the key or extract its secrets and then send it on its way? Could they have a small enough chip that they could place in the USB connector itself to do some kind of malicious thing later on?

<comment><USER3> I've always assumed if you are a high-value target and a state-level actor, or a sufficiently motivated private entity, knows where high value hardware is being manufactured, or dispatched from, you ought to assume your security is already hosed. Either because they've simply tracked the delivery or tampered with it.

Are we to assume the CIA and it's ilk don't have operatives inside these organisations?

Of course, if you're sufficiently organised, you'd have low level grunts take on all the risk.

Or did staying up for way too long selling meth-amphetamine for the better part of a decade make me _way too paranoid_?

</comment></comment><comment><USER4> Looks like... It's just a Nitrokey Pro with different branding, nothing special. But this is how open hardware designs should work, and having multiple vendors is good.

 _edit: the hardware design is nearly identical, but not the firmware. See my follow-up post._

<comment><USER5> Looks like hardware wise that's true, but from the article they've added what looks like a challenge response type mode that the key informs you about (based off totp?) so that you can say that the bios has validated itself to the key.

        We have worked with Nitrokey to add a custom feature to
        our Librem Key firmware specifically for Heads. This
        custom firmware along with a userspace application allows
        us to store the shared secret from the TPM on the Librem
        Key instead of on a phone app. Then when Heads boots, if
        the BIOS hasn't been tampered with the TPM will unlock
        its copy of the shared secret, and Heads will send the
        6-digit code over to the Librem Key. If the code matches
        what the Librem Key itself generated, it flashes a green
        light. If the codes don't match, it flashes a red light.

I can't say I know how secure or safe this is going to be without examining it in detail myself (and even then i'm an amateur at cryptography stuff) but it sounds like a good start to things.

<comment><USER4> > _I can 't say I know how secure or safe this is going to be without > examining it in detail myself_

I've been working on something about Heads (a minimal Linux-based secure bootloader) since January, too. And I can say the boot verification used by Heads is sound and solid. The implementation is basically a verified/measured boot scheme with TOTP.

During initialization, you generate a random TOTP key, add the key to your TOTP authentication device (e.g. Google Authenticator on mobile phone), and "seal" the key in your TPM, along with your boot "measurements". During the boot process, these "measurements", or the SHA hashes of various information/configuration about hardware, software and firmware, is being passed to the TPM. If the configuration has changed, the TPM will refuse to release the TOTP secret, otherwise, the TOTP key is released, then used to calculate a random number by a shell script in Heads.

If the number on your mobile phone matches with the number on the screen, then it proves the system is not being tampered.

Read the code here:

[https://github.com/osresearch/heads/blob/584c07042ef4898de52...](https://github.com/osresearch/heads/blob/584c07042ef4898de52ba4981997211c646b75fd/initrd/bin/gui- init#L93)

[https://github.com/osresearch/heads/blob/584c07042ef4898de52...](https://github.com/osresearch/heads/blob/584c07042ef4898de52ba4981997211c646b75fd/initrd/bin/unseal- totp)

(yes, all shell scripts... I'm not sure whether this is a security issue, but this design is probably inspired by the initrd/sysvinit shell scripts)

Obviously, it means every time you boot your computer, it requires you to check the 6-digit code against your phone, before it boots the actual Linux kernel, or enter your full-disk encryption key. To me, Librem Key improves it, by automating the process (as Nitrokey has TOTP functionality already), and using a simple protocol to automate the challenge-response verification.

If you want to learn more, make sure to read about Heads first.

[https://github.com/osresearch/heads](https://github.com/osresearch/heads)

This presentation is a good start.

[https://trmm.net/Heads_33c3](https://trmm.net/Heads_33c3)

Attack Vectors:

1\. The trustworthiness and security of the TPM. The Free Software community has historically rejected them because of the DRM aspect of "trusted" computing. But to this day, the complete DRM dystopia (where all the proprietary software is running inside Intel Management Engine, and performs DRM-related cryptography in TPM blackboxes, was it called Microsoft Palladium?) didn't turn out to be a threat, fortunately. So now even RMS acknowledged that there is no actual reason to not implementing free software security tools based on TPM.

Another reason is potential backdoor, but even there is a backdoor, using it still improves security, compared to completely unprotected machines. In the future, perhaps there can be Free Hardware TPM, but not in the foreseeable future, and Heads's usage of TPM is still a big step towards security.

2\. Completeness of measurements. If some software/hardware changes are not measured, or can be replayed by the attacker, the attack will not be detected. But the measurements are done collaterally by coreboot in early boot, and Heads in later boot, and to me is fairly extensive. Maybe there is still room for attacks, but difficult. Pentesters are always welcomed. BTW, man-in-the- middle attack to the entire verification process is possible, but it only has theoretical interests, as the attacker has to stay in the middle between you and your screen.

3\. Another general issue is the security of the TOTP seed, like, if your Google Authenticator is hacked. The problem is somehow mitigated by using a Nitrokey/Librem Key, but the TOTP code is still running on a generic STM32F1 MCU, not the OpenPGP Card. STM32F1 is known for its tamper-nonresistance. But because of NDAs, there is currently no good alternative choices though. But still, just like TPM, I think it greatly improves the current situation so far, let's use it. It still has problems, and in the future we may do better.

4\. Automation. Librem Key automates the challenge-response, unlike the original Heads, which prints the code on the screen. In the original Heads, if Heads itself is tampered, it will noticed by the user for incorrect/no code. But with automation, perhaps the attacker has a way to trick the users now? Need to check this.

> _and even then i 'm an amateur at cryptography stuff_

Me too. I'm also working on a similar security token in my spare time. Hopefully, before the New Year, I can submit a Show HN. You may find it's interesting to read.

Finally, all of my descriptions are based on my first-hand impressions, not necessarily facts, and totally unverified. Make sure to check the primary sources!

<comment><USER6> _But to this day, the complete DRM dystopia (where all the proprietary software is running inside Intel Management Engine, and performs DRM-related cryptography in TPM blackboxes, was it called Microsoft Palladium?) didn 't turn out to be a threat, fortunately._

That's optimistic. It's reasonable to assume that Intel's Management Engine has been penetrated by NSA, the CIA, the FSB, and the PLA's Third Department. It mostly relies on security through obscurity, which can be overcome with money.

<comment><USER4> Your point is about mass surveillance and the inauditable backdoor of ME, which is an important security issue by its own, and I'm definitely not optimistic about the situation, especially when Boot Guard rendered removal impossible.

What I was addressing there is a different issue, which was how the general objection of TPM in FOSS community came from - In the original vision of "Trusted Computing" around 2006, it was expected that a TPM and ME-based DRM would prevail in a proprietary system and lock every piece of media, software, and file down.

You can read Lucky Green's presentation from 2002 to understand more about the situation of that time. [https://web.archive.org/web/20180416211840/https://cypherpun...](https://web.archive.org/web/20180416211840/https://cypherpunks.to/TCPA_DEFCON_10.pdf)

> _You could create Word documents that could be read only in the next week_

\- Steven Levy

> _Fritz Hollings Bill: S. 2048_ : _Plug "analog hole" with 2048-bit RSA_ : > _Monitor out, Video out, Audio out._ _Microsoft:_ _Additionally encrypt > keyboard input to PC._ _S. 2048 makes it illegal to sell non-TCPA compliant > computers_ : _A $500,000 fine and 5 years in prison for the first offense; > double that for each subsequent offense._

But fortunately, THEY were way too optimistic...

> _As of 2015, treacherous computing has been implemented for PCs in the form > of the "Trusted Platform Module"; however, for practical reasons, the TPM > has proved a total failure for the goal of providing a platform for remote > attestation to verify Digital Restrictions Management. Thus, companies > implement DRM using other methods. At present, "Trusted Platform Modules" > are not being used for DRM at all, and there are reasons to think that it > will not be feasible to use them for DRM. Ironically, this means that the > only current uses of the "Trusted Platform Modules" are the innocent > secondary uses—for instance, to verify that no one has surreptitiously > changed the system in a computer._

> _Therefore, we conclude that the "Trusted Platform Modules" available for > PCs are not dangerous, and there is no reason not to include one in a > computer or support it in system software._

[https://www.gnu.org/philosophy/can-you- trust.en.html](https://www.gnu.org/philosophy/can-you-trust.en.html)

</comment></comment></comment></comment></comment><comment><USER7> The Nitrokey Pro this is based on doesn't do U2F, according to Nitrokey's literature and reviews of the product. Does this custom firmware somehow add a U2F capability?

If it doesn't, I don't understand the product. It's more expensive than a Yubikey 4, and bigger, and the Y4 does U2F along with the smard card RSA stuff.

We use Y4s in our practice, and my experience is that for every time I use the smart card RSA stuff (for instance, to SSH into something with a long-term RSA key), I use the U2F feature 10 times.

<comment><USER8> > ... Y4 does U2F along with the smard card RSA stuff.

PIV applet also supports P-256: [https://developers.yubico.com/PIV/Introduction/YubiKey_and_P...](https://developers.yubico.com/PIV/Introduction/YubiKey_and_PIV.html)

> ... for every time I use the smart card RSA stuff (for instance, to SSH into > something with a long-term RSA key), I use the U2F feature 10 times.

Does that mean you use SSH rarely, login to U2F sites frequently or use different keys for SSH (e.g. not on Yubikey)?

<comment><USER9> [https://news.ycombinator.com/item?id=17682946](https://news.ycombinator.com/item?id=17682946)

The thread is actually better than the linked post because it tells you about ways you can (relatively easily) set up systems without long-term ssh keys.

<comment><USER7> Right, there's an interesting split in modernizing/hardening SSH philosophies:

Philosophy 1: Move to hardware SSH keys. That's what Y4s and Nitrokeys represent: keys where, if your machine is compromised, the SSH key itself can't easily be stolen.

Philosophy 2: Move to SSH CAs that issue short-lived certificates, and use U2F to authenticate issuance. This is roughly how you'd do a modern integration of an SSO system (like Okta or GSuite) with your SSH services.

SSH CAs have more steam behind them, and are desirable for a bunch of reasons that hardware SSH keys don't really address.

Since the primary function (beyond U2F, which these keys don't do) of a hardware key is to protect your SSH key, I guess it's worth considering how they fit into the modern SSH worldview or whatever you want to call it.

<comment><USER10> I like non of these optins. What I want is U2F for every ssh connection.

<comment><USER11> HashiCorp Vault also supports that scenario: [https://github.com/hashicorp/vault-ssh- helper](https://github.com/hashicorp/vault-ssh-helper) . The main downside is that if the Vault instance is down, nothing can be SSHed into.

</comment></comment></comment></comment></comment></comment><comment><USER12> Sad that the form factor looks terrible compared to YubiKey Nano.

It'd be really cool to have a similarly priced "open" solution which comes in a minimally invasive package.

For reference: [https://i1.wp.com/vaultumllc.com/wp- content/uploads/2017/03/...](https://i1.wp.com/vaultumllc.com/wp- content/uploads/2017/03/YubiKey-4-Nano-In-Use-1.png?fit=1200%2C800&ssl=1)

<comment><USER13> The YubiKey Nano is meant to be left constantly in the USB drive, essentially turning your entire laptop into a key. That doesn't work if the key is meant to be used to unlock the laptop.

</comment></comment><comment><USER14> I love the Nitrokey products and recommend everyone to try them out. The Nitrokey Start is a fully open source GnuPG token just in software (gnuk). Their pro and hsm rely on a smartcard, of which the code is not fully open (based on Smartcard-HSM for the Nitro key HSM).

</comment><comment><USER15> How SOL are you if you lose one of these? With 2factor QR codes, you can save the picture as a "backup" or generate backup codes through the service.

I haven't carried a thumb drive in a while, but I personally have lost a couple before...

<comment><USER7> You generally do one (or both) of two things with hardware security devices:

* You buy multiple devices and configure your systems to honor both, as a backup plan.

* You back up your keys or their artifacts to paper or a small drive and keep that somewhere safe.

If you do neither of those things, and you lose the hardware key, you are either (a) boned or (b) using an insecure system where the key is just theater.

<comment><USER16> Isn't the point of this device that it generates the private key onboard and never divulges it? Or does it have a one-way lever you have to pull at the beginning before which it's possible to sync the key to another device or download and print it?

<comment><USER7> You can literally export the RSA key from some of these keys (for backup purposes), but you can also just enroll multiple keys in whatever system you're using them with (or, you can enroll a software-based key, which you then keep only on a disconnected storage device).

</comment></comment></comment></comment><comment><USER17> I'm surprised there's no button. No way for the user to show intent (for whatever action: signing, decryption, etc).

</comment><comment><USER18> What are these keys used for? Is it for 2FA? I would love to use my phone for 2FA, and not have to carry an usb device with me, because

\- I often log in to web services on my phone, and I don't have an usb adapter cable with me to use the key, and

\- because having to carry a device always with me sounds cumbersome. My phone is always with me anyways.

Is there some other use case I am overlooking? I am eagerly awaiting browser vendors to implement these use cases: [https://w3c.github.io/webauthn/#use- cases](https://w3c.github.io/webauthn/#use-cases)

<comment><USER19> TOTP/HOTP can still be sort of trivially MITM'd - a phishing form could ask for your auth code and then turn around and supply it to the site in question.

U2F uses a challenge-response protocol that should (in theory) make it impossible to MITM. Google has said that they have had zero successful phishing attacks since they switched to using U2F devices (I think Yubikeys) for all employees.

</comment></comment><comment><USER20> Some of the other posts have already picked up that this doesn't appear to do U2F. Along that line, does anyone know if there are any new FIDO2 compliant keys are the market is is still just Yubikey? Are more sites adopting Webauthn or is it stagnant?

<comment> TD-Linux Nitrokey, the manufacturer of the Librem Key, has a U2F key available for preorder.

<comment><USER21> That's a third party product. Nitrokey doesn't have u2f in any of their products yet.

<comment><USER22> The Nitrokey FIDO U2F is compliant to Web Authentication (WebAuthn) but it's not FIDO2. The main difference is that FIDO2 promises to replace passwords while FIDO U2F is supposed to be a 2nd factor (in addition to a password). Nitrokey FIDO U2F is not a third party product but it's source is available here: [https://github.com/Nitrokey/nitrokey- fido-u2f-firmware](https://github.com/Nitrokey/nitrokey-fido-u2f-firmware) [https://github.com/Nitrokey/nitrokey- fido-u2f-hardware](https://github.com/Nitrokey/nitrokey-fido-u2f-hardware)

<comment><USER21> I was going by the announcement on this page [https://www.nitrokey.com/news/2015/5-new-nitrokey-models- and...](https://www.nitrokey.com/news/2015/5-new-nitrokey-models-and-their- availability) which states, "The Nitrokey U2F is a third party product ..." as well as some historical articles like this one [https://lwn.net/Articles/695438/](https://lwn.net/Articles/695438/). I wasn't aware that this was an official product developed by nitrokey. Did this change recently ?

</comment></comment></comment></comment></comment><comment><USER23> Does this device support U2F?

<comment><USER7> Nitrokeys generally do.

<comment><USER21> The nitrokey u2f is a third party product. I don't think any of their products support u2f yet.

<comment><USER22> The Nitrokey FIDO U2F is not a third party product but it's source is available here: [https://github.com/Nitrokey/nitrokey- fido-u2f-firmware](https://github.com/Nitrokey/nitrokey-fido-u2f-firmware) [https://github.com/Nitrokey/nitrokey- fido-u2f-hardware](https://github.com/Nitrokey/nitrokey-fido-u2f-hardware)

</comment></comment></comment></comment><comment><USER10> Wow, the integration with the heads bios is something I thought for a long time would be a great feature for a external key.

The problem is just that we don't live in a world where most people can use heads.

You either have to buy older hardware that is compatible with coreboot or buy a Librem laptop.

</comment><comment><USER24> Alternatively, you could keep a microsd card in a ring to safely store key files.

[https://www.thingiverse.com/thing:1970583](https://www.thingiverse.com/thing:1970583)

</comment><comment><USER25> Don't know how possible this is to answer, but how likely is it that a device like this would fail?

<comment><USER26> I don't know about specific MTBF rates, but all hardware eventually goes bad or gets damaged. The standard protection against failure ( and loss, and theft ) is to register multiple devices with your accounts and physically secure the backups.</comment></comment>


Approximating Haskell's do syntax in TypeScript - <AUTHOR> https://paulgray.net/do-syntax-in-typescript/ <comment><USER2> Oops, certificate expired</comment>


How Silicon Valley powers terrorism - <AUTHOR> http://www.kernelmag.com/features/report/exclusive/4302/how-silicon-valley-powers-terrorists/ <comment><USER2> Another hit piece denouncing cloudflare. The kernel really has a hard on for that company.</comment>


Daft punk on random access memories - <AUTHOR> http://www.rollingstone.com/music/news/exclusive-daft-punk-reveal-secrets-of-new-album-20130413

<comment><USER2> "Electronic music right now is in its comfort zone and it's not moving one inch," Thomas says. "That's not what artists are supposed to do."

I love seeing artists taking this approach. Though I may not love this album, I still appreciate the fact that they're trying to continually evolve their sound.</comment>


How laziness changes thinking in Haskell - <AUTHOR> http://www.newartisans.com/2009/03/functional-yet-lazy.html

<comment><USER2> The example given in the article can be addressed by using foldl' instead of foldr. The issue is discussed in

<http://www.haskell.org/haskellwiki/Foldr_Foldl_Foldl>

A Haskell programmer needs to understand when non-strict evaluation can/should be avoided. foldr is usually more elegant but sometimes less efficient.

<comment><USER3> Your link is missing the ' at the end.

<http://www.haskell.org/haskellwiki/Foldr_Foldl_Foldl%27>

</comment></comment><comment><USER4> I've read a whole lot about Haskell, but still haven't fired up ghc for fear of spending too much time playing with it. This post makes me even more interesting to play with it, but even more scared that I will like it. I'm afraid that I will like it because I am afraid I will run into stuff like this when it is too late.

Unrelated comment: do any other Haskell fans know of a solution or debugging strategies for this problem?

<comment><USER5> If you have the spare time think of learning Haskell as a great learning experience. Haskell's concepts are imho worth your time and are useful to know when programming in other languages. It is a cliché but i do think learning Haskell has made me a better programmer.

Haskell's laziness is at times surprisingly cool but will also remain tricky. I sometimes compare it with lock based multi-thread programming. It can be done but also requires additional thought.

</comment></comment><comment><USER6> There are a number of useful tips in this article about when, and how, to use strict evaluation in Haskell.

<http://users.aber.ac.uk/afc/stricthaskell.html>

</comment><comment><USER7> "Ugh, I'm too tired to learn Haskell. Maybe another day."

That kind of laziness? (I kid, I kid, we all know it's "I'll learn Haskell only when I have to compute something which requires me to know it. I mean, I thunk I know it.")</comment>


Upgrade your career - <AUTHOR> http://www.joelonsoftware.com/items/2009/11/05.html <comment><USER2> "They're the elite of the elite of the best programmers out there. They're the people who participate in Stack Overflow..."

participating in SO makes you elite? Although, there are many convincing real case scenarios discussed by few (perhaps fit for 'elite' label), they are overshadowed by the majority - the badge-gatherers.

What I found (mostly) in SO is more of karmaholics, copying/pasting info from the web. Imho, it is more of a human-enabled search engine for your questions - you get a compiled list of filtered result for your questions, instead of you filtering google results.

<comment><USER3> The major flaw in StackOverflow is the huge difference in rep you can gain depending on how many people use the same tech as you do. Answering C# questions, even insanely easy ones will get you loads of rep (between +100 to +1000) but that really specific and difficult post about some edge case in a niche technology will probably get you +10 rep, mebbe +30 if you're lucky.

<comment><USER4> I can't help but completely agree with that. After all, that's how I got most of my reputation score on StackOverflow. On the other hand, advocates of smaller but prouder technologies (such as Lisp) are more generous with upvotes than followers of more "mainstream" languages such as C# or Java.

<comment><USER5> No, I can personally testify to what the Op says; In general people in the Python/django community are quite stingy with up votes.

See S Lott (or Alex Martelli) and Jon Skeet for instance; There are many, many good programmers in Python tags giving many good answers; but to be only at +2 and an accepted.

In the C# tag on the other hand, or if you yourself, once in a while ask a question on git or svn, you can notice how many upvotes and points those questions get.

In general, I tend to up vote liberally, particularly for the Python community related questions; but there is a limit to number of upvotes as well ;)

</comment></comment></comment></comment><comment><USER6> I think there is a reasonable chance that the number of non-"shithole" employers (using Joel's term from the article) that know the difference or maybe even care that they are not getting the top 10% of talent is overestimated.

I hope that StackOverflow Careers site does turn the job market upside down for the best software developers. I completely respect the idea they are trying to get across to employers looking for good candidates. But pointing at some online reputation and technical question forum isn't going to help the people who wouldn't know a great hacker from a turnip. Which, as discussed here many times, is the vast majority of people, including other hackers.

I think that it is more effective for hackers to offer up portfolios of completed work to potential employers. Projects the hacker designed, implemented, integrated with the work of others, in X time, that serve Y customers.

I also don't buy the idea that charging people to post their resume/CV before it will show up in potential employer's searches helps filter so that only "active, serious job applicants" show up (from the FAQ). Its a bit on the slimy side - you're charging us for the content you're selling to someone else?

<comment><USER7> The charge stuck out to me too.

My immediate reaction was that making developers pay a fee to be searchable doesn't seem to be turning the job market on its head at all.

I don't know if there's a non-slimy way to take money from developers when your stated goal is to help developers make money. It comes off sounding like any other job-assistance scam, where they take $20 to drop a resume into a template and spam it to X-hundred companies.

If you only want serious job applicants, you could just require the developer to check in every now and again.

And if this were really turning the market on its head it would need to provide developers far more information that they could use to get a leg up during negotiation and assessment. Developers would need to see things like: who's looking at their resume, what salary range they're looking in, team sizes, technologies in use, what search terms brought them to your name, what other developers they looked at, how many positions they're trying to fill, etc.

<comment><USER8> _I don't know if there's a non-slimy way to take money from developers when your stated goal is to help developers make money._

Come one. I dig free too. Maybe it's even better if it's free. But you can't just disqualify any attempt to charge for a service as slimy. $20 to post a resume if it might connect you to a job you want is nothing. There is nothing wrong with charging developers (or anyone else) when your stated aim is to help them make money. In fact, that is a very normal way of doing business. Charge money for something that is valuable because it helps you make money.

</comment></comment></comment><comment><USER9> "To a hiring manager, the fact that you took the time to help a fellow programmer with a detailed answer in some obscure corner of programming knowledge, and demonstrated mastery, is a lot more relevant than the Latin Club you joined in school."

I wonder how relevant will the fact be that I dared to ask stupid noob questions about new technologies I am trying to learn. Maybe it's best I stick to giving Java advice :-/

<comment> brown9-2 You could always ask the "stupid noob" questions under a different identity if this is something you are worried about.

Although personally I wouldn't really be all that crazy about working for the kind of employer who cared about this thing ("What? You asked... questions?").

</comment></comment><comment><USER10> My concern is that this takes the fun out of participating in these kinds of online communities. Learning and helping others for the sake of fun is one thing, but doing it to beef up a resume is totally different.

<comment><USER11> /me goes to create 20 new accounts to ask questions that I can then answer myself

<comment><USER12> Sounds like a lot more work than just answering a bunch of genuine questions.

<comment><USER13> yeah but you are guaranteed 20 up votes and the selected answer points too. Basically the system is to easy to game since it is completely anonymous.

<comment><USER14> If only there were a way to detect accounts that are always upvoted by the same group of accounts...

<comment><USER5> I think they do have a system in place that detects "upvoted answers by same user, only, so many times"

</comment></comment></comment></comment></comment></comment><comment><USER15> I was one of those engineers that hated their job a month ago, so my job search commenced just around the time Joel and Jeff announced SO Careers.

At first the idea is intriguing. SO has a customer base of engineers, some of whom are very talented and where there is a rough way of quantifying talent through the karma points. Why not tap into that for the job market?

I was very tempted to sign up, because as I said, I was sick of my job and finally ready to move on. But $99/year? I spent a handful of hours on Craigslist and LinkedIn and within two weeks I had several interviews and two good offers. And I'm not nearly an all-star, just a guy with 5 years experience with LAMP (PHP and Perl) that isn't an idiot (or so I'd like to think).

So is SO Careers really targeted at someone like me? Is it targeted at the young post-college upstart? (If so, does he even have $100/year?) Is it targeted at the uber-engineer that has his own FOSS project and is a minor blog celebrity? (doesn't he have an even easier time picking and choosing his jobs than I would?)

It doesn't make any sense to me, and what frustrates me most is their explanation for charging is that "they need to make sure the candidates are serious." If they want to avoid the "stale resume" (and why do Jeff/Joel keep using the term 'CV'? are they too good for the word 'resume'?) problem on existing job boards, charging someone isn't going to make a difference -- a person is going to get hired and unless he immediately updates his SO careers profile, his resume is now stale too. Also why would I pay $99/year for something that I'll probably only use once a year, at most? Just how often am I looking for a job exactly?

</comment><comment> brown9-2 Joel do you pay any royalties to this employee whenever you use his photo? <http://www.joelonsoftware.com/items/2009/11/05work.jpg>

Because every time I've seen you use it in an article and/or on your site, it really cracks me up.

<comment><USER16> Hi. I'm that employee (<http://babak.ghahremanpour.com/>). Joel does pay me for using the photo. He babysits twice a month so my wife and I can enjoy romantic dinners. I get shoulder rubs when I ask for them. And, he makes me the best lattes (including latte art). All the other Fog Creekers are jealous...but, they're not the ones entertaining JoS readers, by being funny in a picture... :)

<comment><USER17> "He babysits twice a month" Really? That's pretty damn cool.

<comment><USER16> No, not really! (Though, he would make a good sitter.) I was trying to be funny, but I guess I should stick to making silly faces in pictures.

However, he does enjoy making lattes for visitors at Fog Creek HQ, and people around the office.

<comment><USER17> Damn. I just reread your original post and now I feel stupid. _slaps forehead_

</comment></comment></comment></comment></comment><comment><USER18> Were I to pay for this kind of service I'd want to know who's looking at me (not just how many times). Are the hiring companies vetted in any way?

There has to be more balance in the model. Employers can look at you and see how your peers (or actually, anyone with an account) rate you. Hiring companies should be similarly exposed.

As I understood it, we provide the content, we pay for the service, maybe we get job offers from companies that don't suck. Who's getting the most value from this arrangement.

(let me state for the record that I really, really like SO. I'm just iffy about this careers business model)

It would be good to offer the service free to the unemployed (if that could even be verified). It's terrible practice to charge people for access to a job if they need the money for food.

Maybe a more fair arrangement would be to offer the service free after X number of comments or questions contributed. That way, even if you don't get a job out of it, there's a direct relationship between what you contribute to SO and what you get (aside from all the free knowledge).

</comment><comment><USER19> pay for someone to put up my cv on their website?

Anyone I know who is a good developer has more offers than they can manage, even in these times of recession. In my experience, there is no real need to put one's cv up on a jobsite to get good offers.

Would any good developer pay to put their cv on SO? I find it difficult to believe but I could be wrong. If anyone does this, please keep us posted on how it went.

<comment><USER20> I agree the best should already have offers.

But the premise of the SO careers is that 75% of the elite are not "delighted" with their current job.

So for many being happy with the job isn't a priority?

<comment><USER19> Well Joel did say, "They're the elite of the elite of the best programmers out there."

What I'm saying that a _good_ programmer has no problems getting offers all the time , leave alone the "elite of the elite". Why should an "elite of the elite" programmer pay to get job offers? And how does SO guarantee that anyone who lists his cv there gets a better offer through SO than he does otherwhise?

Let's make this more concrete.I am decent programmer. Hardly "elite". Suppose I wanted to apply to an "elite" company, say Google. I'd just pick up the phone and ring up my friends who work there and ask them to get my cv int teh right hands. A real "elite" programmer(say Linus) would have no issues getting a job either. so this seems to be targeted at "less than elite" programmers who don't have the networks/open source code bases / whatever to get noticed by the right people. I still don't get exactly what SO charges for. I can put my cv on dozens of "job sites for free (not that I really would, but hypothetically I could). I can also add my SO profile url to my cv if I wanted to.

So unless Joel and CO can get my cv in front of people I couldn't normally reach what am I paying for exactly?

As I said earlier, I would love to hear from someone who actually got hired through this site.

<comment><USER21> I'll make it concrete too. First up though, I'm not particularly unhappy with my career.

I live in London, and work remotely for a US company, but I'm not from London, and haven't worked for any other companies in London. (I'm here because of my girlfriend.) I have no colleagues in London. Most of my contacts are on the west coast of the US, where it's somewhat awkward to get a job as a non-US citizen, and doubly awkward if one wants to work remotely.

Now, _if_ I wanted to get a different job, what would I do? The best solution would probably be a job right here in London, but I have no "in" here. But I don't see that that lack has any obvious connection to my abilities as a developer.

<comment><USER19> "The best solution would probably be a job right here in London, but I have no "in" here."

But this is exactly what I said. SO is targeted at people who don't have an "in". "Elite " programmers generally get an "in" by their reputation and contacts, not by paying to list a cv on some website(I don't believe SO can overcome that lack of "in" any more than any other job site, but that is a separate point. And anyway, if I am popular on SO I can just add the url to my cv. Why pay SO?).

If I were in your position (US citizen looking for an "in" in London ) I would make contacts in the local sw industry asap. Attend local ruby/c++/whatever- tech-you-are-interested-in interest groups, attend major conferences and so on _and make friends with talented people_.

Writing /contributing to open source software buys you quite a bit of "in" with competent people anywhere.

People you know are the ultimate "in", followed closely (for devs) by shipping products/open source software you wrote.

Anything SO can provide (in addition to a url to your contrinuctions which you have anyway)is a weak/nonexistent imitation. And you certainly shouldn't (imo) have to pay for it and (again imo) won't be getting value for money if you did.

All that said, I do await SO career success stories. I'd love to be proven wrong. I still maintain that "elite of elite" programmers (to use Joels' words) won't pay SO (or anyone else) to host their cv.

<comment><USER21> I'm not a US citizen; but I've attended various interest groups, but to be frank, most of the folks I've met aren't up to much. Far better are the contacts I've made while I've been speaking at conferences, and in that case, it's the speakers who are the contacts, not the plebs who attend.

But like I said, I'm fairly happy with my current job, so I feel no big pressure to integrate with the local scene.

</comment></comment></comment></comment></comment></comment><comment><USER22> I'm not going to look good on Stack Overflow. I like to spend my spare time actually programming, you know? It's the difference between being a spectator and playing the game.

Edit: Of course, a high SO rep might mean that you spend your working hours answering questions there. Generally you're employed to do something else [says the HN contributor, midday].

</comment><comment><USER23> SO is turning out to be a really nice case study on web business. (1) Create a community that will provide free content to your web site; (2) charge them for the privilege of saying to potential customers that they are contributing. :-)

I wouldn't be concerned about paying for this, but what I think that it will not turn around the market as mentioned. Instead will create another hurdle for developers. The issue is that after a potential employer contacts you, the whole interview process will be the same as before. No Hollywood treatment you can be sure.

Moreover, for many companies search is usually done by HR firms. The SO interface will be used by these firms in the same way they currently use linkedin, etc.

I would be much more interested in free web site where you can list your accomplishments: projects finished, previous jobs, open source developed, so employers can have an easier way to compare you to your peers.

<comment><USER24> There's also nothing stopping other sites from pointing at your SO profile.

</comment></comment><comment><USER25> My goal is to establish a successful company that people will recognize as being worthwhile and offering a useful product or service. Then if I'm ever in a position where I'm looking to work for someone else again I can just point to that and say "I did that". Hopefully that'll be enough street cred to get me the job.

</comment><comment><USER26> What's going to prevent recruiters from seeing these? They're unbelievable pests.

</comment><comment><USER27> I just listened to one of the SO podcasts that happens to have more information about this service. A few things of note (that have come up in these comments):

The $99/yr is meant to be a nominal fee to keep out the riff-raff, basically (my metaphor, not Joel's). SO will charge the hiring companies a much larger amount to get the opportunity to search the database.

It seems like this was actually designed more from the perspective of the person who is HIRING, not the person being hired. Joel mentions the frustrations of sorting through a zillion resumes, many of them from people who are wildly out of their league, and the reality that even a good resume doesn't really prove that the person is a good coder. Two people with identical backgrounds might have wildly different qualities as developers. Looking at resumes isn't enough.

So the $99/yr is a deliberate barrier to entry to reduce spam, and your Stack Overflow rep/answers are a second way to distinguish the quality of developers.

The grand unifying theory that makes it work (if it does work) is that developers want to work for the kind of company that takes enough care to look at SO answers in order to distinguish great devs from mediocre ones. That's why you would want to pay the $99 bucks just to have your resume searchable there. In theory.

Also, as a deliberate, specific method to prevent recruiters from using the database, you're required to give the name of the company that is hiring in order to search the database. Recruiters won't do this since the dev could skip the recruiter and go straight to the company, in which case the recruiter can't get their commission.

</comment><comment><USER28> I'm excited to see where this goes. I've always felt like finding a job is probably the most annoying thing to go through. It'd be nice to have companies try to find you using parameters that they find useful. I'm not sure where it will all end up but I'm glad that people are actively working on this problem in a sane way.

I don't mind paying for the service either. It seems like something I'd want to have exposure to and support to work towards a good solution to this problem whatever it turns out to be.

</comment><comment><USER29> Linking the SO account to career account sounds ridiculous. What if I'm not interested in SO and not a reputable person there?

<comment><USER30> Then using SO careers isn't a good idea for you? The whole point is people who want to try and leverage what they do on SO towards easing/improving the job hunt.

Which if you aren't reputable on the site would tend to imply that isn't a goal so why would you care?

<comment><USER29> Lets assume if an recruiter looks up my name on Stack Overflow careers, and they won't find me there because I was busy I didn't have time for Stack Overflow. Does that mean I'm not a good programmer? does that mean I don't help my fellow programmers? How long until other sites come up with this point based resume linking? Sounds like another online game to me now. Except that you use your points in real life.

<comment><USER30> No matter what you do if a recruiter has foolish assumptions that you don't happen to meet you are screwed. Just like how in many bigger companies you have to survive the buzzword mine field to be considered for a position.

All part of dealing with people for the hiring process.

</comment></comment></comment></comment><comment><USER31> I can't imagine paying to have a searchable CV. I already hear from recruiters about 2 or 3 times a month.

Other people have made a lot of money finding me and placing me with good employers, or I've sought out specific positions at specific companies I was interested in. While I can see _some_ value in linking CVs to SO accounts, it seems like the wrong group is being asked to shell out.

</comment><comment><USER24> To me, the value is in what a technical team could see about a developer. Are they narrow-focused, or have a broad range of skills? Do they keep up with newer technologies? Are they capable of answering tough questions, or do they just skim the easy ones? Too many people say 5/5 for Java or whatever, but don't have the first clue.

</comment><comment><USER32> I don't know.

I love StackOverflow. From the first day StackOverflow was announced, I wanted to be a part of it. I _knew_ that it would be successful and useful to at least a small group of programmers.

StackOverflow Careers? Not much. Why do they have to defend this careers thing so much? SO Careers is addressing a real problem, but I don't know if it is the right solution.

I don't mind paying, (paying back the great SO team is fulfilling) but the viability of the SO Careers model for an international audience is debatable. As EugeneG pointed out, we are not participating in SO just for the karma factor.

<comment><USER33> "Why do they have to defend this careers thing so much?"

A career page seems to be the preferred route to go to raise revenue for programming websites. They're not defending it, they're promoting it. Using a job board to directly or indirectly raise revenue is done here, on reddit, on Joel on Software, and now on Stack Overflow. Probably because programmers often have adblock on and don't generally buy a lot of software.

</comment></comment><comment><USER34> You can pay $99 a year to be in a database where potential employers will contact you? I ended up on a whole ton of those for free back in the 90s.. :-)

I guess you're paying to prove that, yes, you _will_ take their calls.

<comment><USER35> I'd pay $99 a year for the opposite - for recruiters to stop calling!

</comment></comment><comment><USER36> great! another way for me to filter out potential employers.

"can you send us your stack overflow account?" "yeah, i'm no longer interested."

</comment><comment><USER37> At least at first glance, this all seems predicated on hiring managers browsing CVs at this one site.

This seems fairly unlikely at first glance. Large organizations often have required procedures that hiring managers must use. Smaller organizations clearly have more flexibility, but it seems the ones that want to go searching for talent themselves instead of soliciting applications will probably be looking for people whose reputations they already know or even already know personally.

</comment><comment><USER38> Uh, obscure programming knowledge? Most of the questions on StackOverflow are about methodologies or about how to do something in some specific programming language. How obscure is that really?

</comment><comment><USER39> If nothing else, the SO Careers site provides a convenient place to park your CV and make it public (if that's what you want) -- for free. I think the markdown formatting is more than sufficient to get the look you want and highlight what's important. The linking of up to 10 technologies with job experience is intuitive.

SO reputation or not, this presentation is at least as good as what even an "elite" programmers resume would look like.

</comment><comment><USER40> Isn't this the guy that basically said if you have ever had to apply for a programming job then you are probably a loser that can't program anyway? (some article about "High Notes")

</comment><comment><USER41> I really do think there is a LOT more money to be made doing stuff like this (and Stack Overflow more broadly) than selling Fogbugz. Smart move-- hats off to Joel.

<comment><USER42> Probably, but I really don't get the impression that Joel is motivated purely by money. There is a certain genuineness there about wanting to help the best programmers become better.

</comment></comment><comment><USER43> I went to SO Dev Days in San Francisco and I'm certainly not the best of the best. At least I didn't think so until now.

</comment><comment><USER44> I would LOVE to hire someone who spends a lot of time answering other people's questions on SO.

</comment><comment><USER45> I love how you get a 90 day money back guarantee - when you pay for the next _three_ years.</comment>


The System That Wasn't There: Ayn Rand's Failed Philosophy (and Why It Matters) - <AUTHOR> http://www.rotman.uwo.ca/the-system-that-wasnt-there-ayn-rands-failed-philosophy-and-why-it-matters/ <comment><USER2> Libertarianism probably converts to other forms of government pretty readily with a couple assumptions.

1\. All interactions would eventually come under contract.

2\. Since it would be impossible to psychically agree to ever item on a contract you would need implicit agreement for practicallity.

3\. The government can't restart all contracts every time a new member is added.

4\. children would most probably be bound to their parents decisions.

5\. Most people(if not all people) would agree to contracts that at least have some elements to that don't benefit them.

6\. Your pretty much already on a giant social contract.

My logic and arguments are a little sloppy but I hope you can follow my argument.</comment>


Solving the KAYAK crossword puzzle with code - <AUTHOR> https://github.com/stepanbujnak/kayak

<comment><USER2> Was the use of ANN necessary, or simply done because it was cool to do? Because at least in my mind it looks like extracting the text and running a brute force program on it would be faster, no?

<comment><USER3> If my reading is correct, the neural network was used to OCR the image, extracting the text. From there, it is indeed a simple brute-force string search.

<comment><USER4> Yeah, but the type is pretty regular and and the alphabet is small. I bet you could just use convolution.

</comment></comment></comment><comment><USER5> FWIW that's not a crossword puzzle. As a crossword enthusiast, I would be very interested in the implementation of an AI-backed crossword puzzle solver!

<comment><USER6> For my masters thesis I wrote some software to solve UK-style cryptic crosswords[1].

We're cleaning up the code now for release as an AI paper, so as soon as we're done I'll release the code on Github.

[1] [http://en.wikipedia.org/wiki/Cryptic_crossword](http://en.wikipedia.org/wiki/Cryptic_crossword)

<comment><USER7> What a great idea. What's your success rate like?

Cryptic crosswords (at least good ones) play with conventions so much, I imagine it must be quite a challenge.

</comment></comment></comment><comment><USER8> How I did it:

0\. Download and install Tesseract [https://code.google.com/p/tesseract- ocr/](https://code.google.com/p/tesseract-ocr/)

1\. Crop and adjust curves of the image in Paint.Net (= get a better contrast) to ease OCR

2\. Save as PNG in the folder of Tesseract

3\. Open cmd in Tesseract folder, type tesseract kayak.png kayak (produces kayak.txt)

4\. Open kayak.txt in Notepad++, remove empty lines (to have correct indexes), CTRL+F "KAYAK"

<comment><USER9> Doesn't this only work if the word is west-to-east? Seems like it'd fail for any other orientation (there are 7 others).

(Well, for a palindrome, it works for east-to-west too - so I guess you missed 6).

<comment><USER8> You are correct. However, it is stated that 'KAYAK' appears only once and it seems to me that CTRL+Fing should be the first thing to do when searching for a string in a relatively small text. The next step, had the CTRL+F failed, would have been to search for "KAYAK" vertically/diagonally programmatically.

(on a sidenote, you're counting is incorrect, as it is a palindrome there really is only 4 directions for the word to appear: W-E, N-S, NW-SE, NE-SW)

<comment><USER10> for vertical, you could transpose the crossword then Ctrl+F, just being aware that the result has its columns and rows switched.

</comment></comment></comment></comment><comment><USER11> This seems like a good place to link to the UsVsTh3m one-word-wordsearch generator:

[http://games.usvsth3m.com/one-word- wordsearch/#MTAsS0FZQUssN...](http://games.usvsth3m.com/one-word- wordsearch/#MTAsS0FZQUssNzk3MjE=)

<comment><USER8> In the source: "bastardTouchMoveWhatTheHellIsWrongWithMobileBrowsersSeriously"

</comment></comment><comment><USER12> Found it in a couple minutes by hand. I started from the position (3,3) and circled the board looking for "Y" surrounded by two A's, and checking for the phrase. Working inward it's only a matter of time before you find it. There are also the borders to check then.

</comment><comment><USER13> Similar:

[https://projecteuler.net/problem=11](https://projecteuler.net/problem=11)</comment>


Track HN: Downtime visualized - <AUTHOR> http://hnstatus.net

<comment><USER2> And such start the trend of measuring metrics. The next logical step is to measure when hnstatus.net is up/down.

<comment><USER3> Yes. How meta of us. :)

How many times in history has a change in the state of a community's forum turned into a dominating discussion onto itself?

<comment><USER3> When I had probs with HN today, the first thing I did was a twitter search which confirmed it wasn't just me.

</comment></comment></comment><comment><USER4> What does the graph mean? I see a red rectangle next to a white rectangle. Is the red rectangle downtime? Surely not...

<comment><USER5> It was indeed down in the early morning.

<comment><USER6> I just asked Trevor what was going on. Apparently we turned off the restart-HN process back when we were hacked a few days ago, and we forgot to turn it back on. Things should be back to normal now.

<comment><USER7> _I just asked Trevor what was going on._

Now you got me really confused. I assumed tlb==Trevor.

<comment><USER4> Oops, that was me. I was using Trevor's computer when I typed that.

</comment></comment></comment></comment></comment><comment><USER8> I've seen an app like this before ..

My recollection was that it was generalized so that a user could specify a site, and the app would say whether the site was up or not .. but it did not monitor to let you know when it was back up ..

Combining the two would make a very handy tool .. to be able to monitor when any site is back up ..

<comment><USER9> You're probably thinking of <http://downforeveryoneorjustme.com/>; You're right, though, continuous monitoring would be very handy for some sites.

<comment><USER10> When I checked, it said it was just down for me.

<comment><USER11> Are you referring to HN during the earlier downtime?

The server still seemed to be responding, it was just empty. (I didn't check the headers, so I don't know specifically what if anything was happening.) I believe dfeojm works by checking whether you get a response or not, so as far as it could tell HN was still up.

<comment><USER10> _Are you referring to HN during the earlier downtime?_

Yes. Thanks.

</comment></comment></comment></comment></comment><comment><USER12> I seem to often see the site, but when I click threads, I get nothing. Or sometimes on the homepage I get just one story.

<comment><USER13> Cache? Opera instantly gets page from cache when I press "Back", even if I don't have internet connection.

</comment></comment><comment><USER14> I am finding that HN is down more often these days. Is it because of occasional spikes or is it a persistent occurrence. Perhaps pg could explain what's going on under the hood?

<comment><USER15> I find it handy when HN goes down. Lets me get some work done. :)

<comment><USER14> I on the other hand become further unproductive. I keep coming back every 30 seconds to see if it's up again and end up doing nothing at all.

<comment><USER16> I'd say that's a sign you probably should block yourself from HN for a while. Any time that I notice that I'm getting too compulsive about a particular site I add it to a blocked list and leave it there for a week or two. I'm also a huge fan of Freedom.app for disconnecting my internet for blocks of time where I notice that I'm too easily distracted.

<comment><USER17> the freedom app seems interesting, does it have windows/linux equivalents?

<comment><USER16> Not that I know of, but it's a pretty trivial app. It just removes all of the default routing. Sure, I could probably add them back, but I've intentionally never learned how to use the BSD route that comes with Mac OS for that reason. :-)

With Linux, actually, you could probably go one level lower by writing a small kernel driver that you could signal from user space to disable networking for a given period and then do some goofiness so that it couldn't be unloaded effectively and still get networking back.

</comment></comment></comment></comment></comment></comment><comment><USER18> Why?

<comment><USER19> When hacker news is down, it creates the "I must not waste my time pressing F5" effect.

<comment><USER20> Or ctrl + R

<comment><USER21> Or cmd + R

</comment></comment></comment></comment><comment><USER22> It might be useful to add what timezone that time actually refers to. Unless we sometime soon have downtime which spans several days which makes the +-12 margin irrelevant.

<comment><AUTHOR> Yes, I already have plans for some future lazy sunday. I'll probably add "last 24 hours", "3 days" etc. graphs for a better grip.

Unless ofcourse pg fixes the downtimes - that would kinda pull the plug on my little pet project here.

<comment><USER23> _Unless ofcourse pg fixes the downtimes_

Sheesh - it's a free service on the internet, used (amongst other things) as a vehicle for the new language he's working on. I think you're setting your expectations a bit off.

What does the graph really provide? We know when it's down -- Just seems like griping for me.</comment></comment></comment>


Ask HN: What books are you reading, Feb 2018 - <AUTHOR> There have been numerous threads about the kinds of books that the folks of HN read, and I've enjoyed going through those answers. What technical / no-technical books are you wanting to grok this month? <comment><USER2> * Man's search for Meaning by Viktor Frankl

* How to stop worrying and start living by Dale Carnegie

* The Name of the Wind by Patrick Rothfuss

</comment><comment><USER3> Deep Work by Cal Newport is next up for me!

</comment><comment><USER4> The count of monte cristo!</comment>


Does the quantum wave function represent reality? (2012) - <AUTHOR> http://phys.org/news/2012-04-quantum-function-reality.html

<comment><USER2> Based on a quick read: This assumes [https://en.wikipedia.org/wiki/Counterfactual_definiteness](https://en.wikipedia.org/wiki/Counterfactual_definiteness) and denies [https://en.wikipedia.org/wiki/Superdeterminism](https://en.wikipedia.org/wiki/Superdeterminism).

This doesn't look like anything new, as it's been known for a long time that assuming either one tells you a lot about the interpretation of quantum mechanics.

Maybe someone who knows more about QM can tell me if this is meaningful at all?

Edit: this is from 2012. I don't see what's there that hasn't been known since the 70-80s.</comment>