Extreme mobility of mantis shrimp eyes - <AUTHOR> https://phys.org/news/2018-05-extreme-mobility-mantis-shrimp-eyes.html <comment><USER2> What is it about mantis shrimp that they have this seemingly comically over- engineered vision system? They eat small prey, so that's obviously one reason to have decent vision, but I can't imagine why they need so developed a vision system where other animals eating the same prey have no such need.

Weird.

<comment><USER3> It's possible that the vision system evolved long ago under radically different circumstances and just had no imperative to get rid of it.

<comment><USER4> Unlikely. Vision is so metabolically expensive that it disappears really quickly once it no longer confers an advantage.

On the other side of the equation, vision is so stupidly useful that it has evolved independently from several different systems in different organisms.

<comment><USER3> Do we know that this is true for features of vision systems in the same way it is for the system in general?

For example, animals who end up in dark environments lose sight relatively quickly in a few generations, but for other cases, do animals tend to lose specific parts of their vision system - color, edge detection, etc.?

<comment><USER5> Yes, newts and salamanders in cave systems have lost their eyes, due to scarcity of nutrition and habitats devoid of light.

[https://en.wikipedia.org/wiki/Texas_blind_salamander](https://en.wikipedia.org/wiki/Texas_blind_salamander)

</comment></comment></comment></comment></comment><comment><USER6> More on mantis shrimp: [http://theoatmeal.com/comics/mantis_shrimp](http://theoatmeal.com/comics/mantis_shrimp)

<comment><USER7> That was the first thing I thought of too! I wonder if he'll update the comic in light of these new findings.

<comment><USER8> This is my goto for Mantis Shrimp information: [https://www.youtube.com/watch?v=F5FEj9U-CJM](https://www.youtube.com/watch?v=F5FEj9U-CJM)

</comment></comment></comment><comment><USER9> This makes me think that maybe mantis shrimp relies on powerful sensor to see the world but doesn't have a lot of good software / internal hardware to do further processing. Human's eye sensor seems poor compare to the ones of mantis shrimp but a lot of work is done in the post processing. It's be difficult to clearly define if mantis shrimp can indeed see "more".

<comment><USER10> You're right. Radiolab had a recent episode that goes into this; [https://overcast.fm/+JaxJ5s](https://overcast.fm/+JaxJ5s)

</comment></comment><comment><USER11> If they can see the polarization of light, perhaps rolling their eyes can change the filtering of the polarization?

<comment><USER12> The same thought came to my mind. When wearing my polarized sunglasses, sometimes the screens on gas station pumps will be unreadable. However, if I rotate my head slightly one way or the other, the polarization filter is removed and I can read the screen clearly.</comment></comment>


DeepMind DQN Implementation from Nature - <AUTHOR> https://github.com/deepmind/dqn <comment><AUTHOR> Always useful to see implementations of simple components, like epsilon greedy action choice:

        function nql:eGreedy(state, testing_ep)
            self.ep = testing_ep or (self.ep_end +
                        math.max(0, (self.ep_start - self.ep_end) * (self.ep_endt -
                        math.max(0, self.numSteps - self.learn_start))/self.ep_endt))
            -- Epsilon greedy
            if torch.uniform() < self.ep then
                return torch.random(1, self.n_actions)
            else
                return self:greedy(state)
            end
        end</comment>


#FF4A00 - <AUTHOR> http://mikeknoop.com/blog/ff4a00/ <comment><USER2> Color is something that people take for granted or think of as trivial but it's actually rather complicated. There are some colors that can't be represented in print and some colors that can't be represented on a monitor. There are several different color spaces (RGB cube, L *a *b *, etc.) It doesn't help that CSS3 and HTML4 color modules are terrible (the darkest octant of the sRGB cube is empty and most of the colors are too saturated or and too light). [1]

[1]<http://people.csail.mit.edu/jaffer/Color/Dictionaries#CSS3>

EDIT: I used full width asterisks (U+FF0A) because I wanted to write L *a *b * without inserting white space after regular asterisks (U+002A).

</comment><comment><USER3> Hey Mike, that's pretty close to our color: #ff4f00.

Not random though, it's actually International Aerospace Orange (we're a flight company).

<http://en.wikipedia.org/wiki/International_orange>

</comment><comment><USER4> <http://randomcolour.com/>

My random color was #A7D6AE

<http://www.colorhexa.com/a7d6ae>

Not bad I presume... Maybe i should just do this from now on.

<comment><USER5> They should have the color change on click, save some refreshes. It's using JavaScript anyway.

<comment><USER6> I had thought about that, and/or have it show information about the colour, but decided against it in the end as I really like the single purpose nature of it.

I've also always quite liked the thought of people loading the site for the first time and not being sure if it's finished loading as nothing appears but the background colour, so then refreshing to reload the site, only to see the colour change and realise that the site is exactly what it says it is.

</comment></comment></comment><comment><USER7> How is it pronounced?

Is it Zah-pee-err, as in, more zappy?

Or is it Zah-pee-eh, like it's a fancy french service?

Or is it Zah-peer, like a fancy Frenchman pronouncing "the peer"?

<comment><USER8> We like to call ourselves "zap-ee-er" but I'll accept any pronunciation since that means you're talking about us!

Fun side note. We integrate with a lot of European and Australian companies. Most of the time on intro calls they default to the more "French" sounded version "zap-ee-air" whereas most of the US companies seem to default to a more "English" pronunciation "zay-pee-er".

<comment><USER9> As a brit, my first reading was "zay-pee-er", like how "rapier" missile is pronounced.

</comment></comment></comment><comment><USER10> Am I the only one pained that none of the favicon, the "KNOOP" title, the links on the right, or the article's hyperlinks matched #FF4A00, or even eachother, even before I saw it? :D :D

<comment><USER8> Nice eye. I think over time the color got subtly shifted by a few percentage points here and there. Nonetheless, the color you see today is directly influenced by that early random decision.

</comment></comment><comment><USER11> should have gone with #bada55

<http://ni9e.com/bada55/bada55_can.jpg>

</comment><comment><USER12> I thought "Huh, that looks like Y Combinator Orange" and then had to use Chrome Inspector to see how close it was. (#ff6600 actually)

</comment><comment><USER13> Pretty close to the X/Web color "Orange Red"

<http://en.wikipedia.org/wiki/Vermilion_(color)#Orange-red>

<comment><USER14> When I first learnt about orangered ten days ago, it felt like "too much was going on", but an experiment showed that slightly more than half of surveyed users prefer it over #CCCCFF.

</comment></comment><comment><USER15> Hey if any of you guys are ever around MO my team would love to meet you! We just moved to KC from Boston

<comment><USER8> I'm actually around Columbia, MO for the next month and half or so. We have a few employees in town, too. Care to make a trek to Mizzou?

<comment><USER15> sick we would love to! you can reach me at @mikedemarais

</comment></comment></comment><comment><USER16> Interesting. It reminds me of this campaign I was going to start called the Facebook 300 Diet. The goal was to remove all of the non-essential cruft friends from your Facebook account to clean up your network to the most essential 300 friends. I created criteria to help you determine which friends should be removed and which ones should stay. The color #FB300D.

<comment><USER17> I am Facebook underweight, then! I only have around 200.

<comment><USER18> I'm starving apparently, fewer than 50.

</comment></comment></comment><comment><USER19> I probably wrote code to perform at least two dozen of these kinds of tasks for my last business and I'll probably be a customer for my next business. This definitely creates a lot of value for non-technical small businesses.

However, I'm not sure your landing page does a great job of communicating your product's value to non-technical people.

<comment><USER8> I think we can do a lot better too. It's a classic problem: how would you sell Excel if it were a web app?

<comment><USER19> Thanks for the reply, I hope you didn't think I was just being a naysayer. This seems like a critical problem for marketing, if you have two audiences and you're catering to the smaller one. If it were me (grain of salt) I would go all in on something like "Zapier gives your employees superpowers".

</comment></comment></comment><comment><USER20> As the legend has it, Yahoo originally chose their purple and yellow colors because they were the cheapest paint colors in California back in 1995.

</comment><comment><USER21> I've always been a big fan of #f90-- useful as a highlight / hard to miss on a web page, easy to remember and type.

</comment><comment><USER22> I wonder if there are people who can visualize what a color will look like just by reading the hex value of it.

<comment><USER23> Plenty. I can do it, to a certain degree of accuracy. At least enough of a degree that there won't be a more accurate english word for the color in my vocabulary.

</comment></comment><comment><USER24> Is it really random? It doesn't look random to me with both FF and 00 in it. Perhaps randomly chosen by yourself, but not rand(1,16mil).to_hex().

<comment><USER25> Huh? How would you determine if something was randomly chosen based on a single selection? Given all the colors available, is #FF4A00 not a possible selection in your function?

Regardless, this is incredible nitpicking. "Pick one randomly" from the human brain obviously specifies a bad PRNG. Who cares?

<comment><USER26> You're correct in pointing out that the odds of #FF4A00 being selected randomly are the same as the odds of #EAF7C2 being selected randomly; just as the odds of the Powerball numbers 1 2 3 4 5 P6 being selected randomly are just the same as the odds of the Powerball numbers 1 36 40 52 53 P20 being selected randomly. However, the odds of the former sets being selected non- randomly are greater.

</comment></comment></comment><comment><USER27> TSA auctions are going to get mindblowing when they start confiscating smartphones along with pocketknives.

</comment><comment><USER28> That color burns my eyes.</comment>


Khan Academy's React style guide - <AUTHOR> https://github.com/Khan/style-guides/blob/master/style/react.md <comment><USER2> I've been working on learning React, and finding it particularly difficult. It appears there are a large number of things I need to have in place and pieces of knowledge I need before I can use it. These include some kind of Js compilation step like Webpack or Browserfy, something like Babel, a knowledge of how to use ES6, an understanding of React, and an understanding of how to use React-Router.

Although I've done some Javascript on the front end, I haven't done the other things I mentioned. The tutorials all seem to assume I know how to do everything but one little piece of detail, and I'm finding it difficult to bite on the elephant. It's hard to tell where to start on learning this stuff, and how much I need to learn before I can use it.

Any suggestions for what resources and approach to use to learn react? My goal eventually is an app that runs in 3 versions: web, iOS, android. I don't intend to use javascript on the server.

<comment><USER3> >and an understanding of how to use React-Router.

Gosh no. You don't need react router for simple applications.

<comment><USER2> When someone is looking at something in the app, I need them to be able to paste a link to someone else, and have the recipient see the same thing. Sounds like a job for react-router, right?

<comment><USER3> you can use history api or many of the simple abstractions like page.js.

react-router is waay to complicated for trying to do everything in a declarative way.

</comment></comment></comment></comment><comment><USER4> Request for comment:

Linters are by far powerful enough by now.

Can we (as community) switch to documenting style guides as linter rulesets + custom linters. Eg for javascript: eslint and jscs

Written style guides are good for understanding why - but linters actually help others to adapt to it quicker

<comment><USER5> AirBnB has a similar style guide for React and has a linter file for eslint with the React plugin. Works pretty well.

I'd like to see more style guides come with similar set ups.

<comment><USER6> Is it available?

<comment><USER7> Yes: [https://github.com/airbnb/javascript](https://github.com/airbnb/javascript)

<comment><USER8> or `npm install --save-dev eslint-config-airbnb`

</comment></comment></comment></comment></comment><comment><USER9> It's probably a good time to start looking at using the Fetch API [1] for making AJAX requests instead of using jQuery or Backbone (or even XMLHttpRequest). Support seems to be growing quickly and Github's polyfill [2] can help cover the gaps.

[1] [https://developer.mozilla.org/en- US/docs/Web/API/Fetch_API](https://developer.mozilla.org/en- US/docs/Web/API/Fetch_API) [2] [https://github.com/github/fetch](https://github.com/github/fetch)

<comment><USER10> Agreed... I really have come to like fetch, though I usually wrap it in a couple functions for my most common use cases... since some of the options are a little tedious to specify over and over again... such as `postJson(url, data)` which will post the data as json, and resolve the json response with some extra error handling.

It works well, and combined with babel for async/await, the workflow is pretty smooth as well.

</comment></comment><comment><USER11> John Resig (jQuery creator) is one of the chief architects at there, and yet you see, this line:

        Never use jQuery for DOM manipulation

Nice.

<comment><USER12> I think the implication is not that jQuery is bad for DOM manipulation, but that you should leave DOM manipulation to React to have a 1:1 relation between the held state in React and the actual DOM. In other words: Do not manipulate the DOM outside of React.

</comment></comment><comment><USER13> A couple of questions:

>Do not use Backbone models

I use Backbone models for ajax since it makes decisions such as PUT vs POST and model.save() looks cleaner than $.ajax. Also, Backbone collections provide a declarative way to handle sorting and duplicate models. But these models are internal to the Store and not exposed to the views. I'm still a React newbie. Is this a valid reason to continue using Backbone?

2\. It seems as though Khan Academy do not use React for SVG elements in their interactive exercises. For example, [https://www.khanacademy.org/math/geometry/transformations/hs...](https://www.khanacademy.org/math/geometry/transformations/hs- geo-reflections/e/defining-reflections) Do you plan to migrate SVG to React?

<comment><USER14> 1\. If you're not passing the backbone models to React components, this sounds fine. backbone models as props ends up being really painful because of how mutable they are, and when we tried to manage that with mixins, it was buggy and caused problems (note: I'm not familiar with the actual mixin we used there and whether there was a better way to do it). Since most flux implementations are pretty stateful/mutable themselves, using mutable backbone models there, _so long as you copy data out to pass to react views_ , seems safe. Though I'm excited long-term about the immutable flux implementations ([https://github.com/rackt/redux](https://github.com/rackt/redux))

2\. We had a library originally written by Ben Alpert (now core react team) that handles all of our interactive svgs [1]. Since KA has a lot of legacy code there, and there hasn't been an immediate benefit to porting it (which would take a pretty significant time investment, on the [very roughly] order of a couple dev-months), this is still mutable jQuery/raphael code. There have been a lot of talks of eventually porting this to react, but the immediate need for it hasn't been there yet. However, I did write a React wrapper around much of this code which is used by newer interactive widgets [2].

[1]: [https://github.com/Khan/khan- exercises/blob/master/utils/gra...](https://github.com/Khan/khan- exercises/blob/master/utils/graphie.js)

[2]: [https://github.com/Khan/perseus/blob/master/src/components/g...](https://github.com/Khan/perseus/blob/master/src/components/graphie.jsx)

<comment><USER13> Thanks! I did not about Redux and the React wrapper.

</comment></comment></comment><comment><USER15> I'm curious why the top is preferred over the bottom:

Open elements on the same line.

The 80-character line limit is a bit tight, so we opt to conserve the extra 4.

Yes:

      return

        ...

;

No:

      // "div" is not on the same line as "return"
      return (

          ...

      );

The latter I feel is much more readable and clear than the former, as it has a certain symmetry and cohesion that you find in normal html. The top one seems to be break readability. Wondering if anyone can comment on this specific decision?

<comment><USER16> Their logic is that because elements are typically deeply nested, it's better to sacrifice the readability for the saved indentation. By the time you get 4 child elements deep, almost half your line space goes to tabs.

</comment></comment><comment><USER17> I find it funny seeing this section:

[https://github.com/Khan/style- guides/blob/master/style/react...](https://github.com/Khan/style- guides/blob/master/style/react.md#minimize-use-of-jquery)

Even though John Resig is one of their main devs.

<comment><USER18> I thought so too. I guess this is a good time to remind ourselves that we are not our work and it's best not to be too attached to the things we create.

It's worth noting however that the heading says to minimize jQuery and more specifically jQuery plugins. My guess is that jQuery is fine as long as it's serving a low-level function (XHR, etc).

<comment><USER10> Not sure how much I agree there... I think the goal is to get away from kitchen sink libraries, react's rendering flow allows for an interaction style that doesn't typically need something like jQuery...

For that matter, I'm surprised they don't have standard polyfills that include fetch, which combined with babel (async/await ftw) make your workflows much easier to reason with.

</comment></comment></comment><comment><USER19> Style question re dom manipulation: third party embeds, such as twitter, instagram often come as specially classed blockquote elements that are swapped with iframes by a jquery plugin. What is the best way to integrate this with react?

</comment><comment><USER20> "Fit them all on the same line if you can." (HTML Properties) -- OK, easy enough, my editor has no limit on its line length. I can always fit them on one line. Or did they expect it to fit on one line visually. If so, at what width to they expect my editor window to be?

In all seriousness, though, I appreciate the brevity of this guide. It can be quickly read and understood, and is not the fully-fledged book I've seen from other places.

<comment><USER21> 80 characters

<comment><USER20> Yes, the "In all seriousness" phrase was intended to let you know I was joking. I knew what they meant, even if they didn't explicitly say it on that line.

<comment><USER22> Does actually mention the 80 character line length limit at the top of the article, just under the TOC:

>" _Follow the normal JavaScript style guide - including the 80 character line limit. In addition, there are several React-specific rules. "_

</comment></comment></comment></comment><comment><USER23> A number of these guidelines reinforce my biggest complaint with React: it is architecturally difficult to avoid monolithic view files.

In a traditional web app, we have 4 layers: client views, client app, server app, database. React, described as a strict view layer, in reality is being used as much more. At this point, it is not just consuming the client app, but is also taking nibbles at the server app as well.

To each their own of course, but i would ask people to hesitate about these decisions. The architectural issues with monolithic views is well known, and just because we have a shiny new tool does not mean we should throw that understanding by the wayside.

 _Source: i work full-time on a React and Backbone app_

<comment><USER24> Can you explain what you mean a bit more? My experience with React is that composing components is so trivial (particularly compared to e.g. Angular directives) that I've tended to end up with very small view files (~10 lines of DOM max, plus whatever functionality is directly tied to that). It's seemed like one of React's greatest strengths to me, so I'm curious as to where your complaint stems from.

(I don't use React in my day job... yet. But I'm considering pushing for it, so getting a better understanding of its shortcomings is really important to me.)

<comment><USER25> I think it might be an objection to what the style guide refers to as "logic components": components that use React's `setState` to handle interactions and decide what props to forward to a "presentation component".

Personally, I feel that React is a handy tool for both of these use cases, but the fact that we're finding these two distinct types of components suggests to me that React's "component" abstraction might be doing too much.

Maybe if we break React into the pieces that are helpful for "logic" and the pieces that are helpful for "presentation" we'll end up with two abstractions that are each better suited to their task.

React's ideology is still very young, so I'm hopeful that the community will start to head in this direction, and I'm super excited to see how this plays out :)

<comment><USER26> Don't quote me on this, but I believe that's _exactly_ the rationale behind the 'stateless functional components' introduced in 0.14.

[http://facebook.github.io/react/blog/2015/10/07/react-v0.14....](http://facebook.github.io/react/blog/2015/10/07/react-v0.14.html#stateless- functional-components)

<comment><USER25> Yeah, I really dig those :D The concept of a "presentation component" has the exact same semantics as a pure function, so I'm excited that we're actually gonna get that abstraction.

The part that concerns me, though, is the logic component. Hierarchical state/event management seems like a hard problem, and React does it okay, but a lot of things end up coupled together: why does a component that manages a state hierarchy and event flow need to be coupled to the idea of rendering a virtual DOM tree? Can't I just declare that my TodoApp state is a composition of my TodoList state and TodoForm state without _also_ declaring how I'll eventually render them?

I wonder if anyone's come up with a really great abstraction for this yet that checks all the boxes. I like the _philosophy_ behind how Redux manages state, but React provides clearer encapsulation of state and doesn't make parent components think about the events that their children are handling.

Redux is even crazy younger than React, though, so there's still plenty of room to grow there, too!

</comment></comment></comment></comment></comment><comment><USER27> "Do not use Backbone models."

This seems a little strong. What is the reason for this guideline? I know of many projects that are combining the use of React with Backbone.

<comment><USER5>
      We are trying to remove Backbone from our codebase entirely.

This is more of a guideline for their particular organization -- they've decided to move away from Backbone and don't want developers adding any new Backbone code.

<comment><USER14> Correct. That and passing mutable backbone models as props went poorly back when we did more of that. Mutable props are hard to reason about and go against all of the recommendations for React props. (There are plenty of good use-cases of backbone out there though.)

</comment></comment></comment><comment><USER28> It makes me feel so sad that the "state of the art" in front-end development is apparently rerunning your render code on every little update. Yes, I know there are shortcuts to making this more efficient, but in essence the technique remains inelegant in the sense that it does not extend well to other parts of the code (that runs computations that might also partially, and not fully, change on an update).

<comment><USER29> This pattern of the virtual DOM has some parallels with functional programming. At first look, using functional programming it looks like you're sacrificing the performance that you gain from mutations -- which to some extent is true. But when you look deeper, you'll find that the data structures for functional programming languages have been adapted to work in a very performant way with functional programming patterns.

In the same way, when you look closer at the virtual DOM model, you'll find that you can optimize the usage very well. For example, when you use React with immutable data structures (e.g., Immutable JS), deep equality comparisons can be done very quickly to reduce renders to the minimum subtree required, and to issue the renders for a given change in a batch operation.

With React, you often end up with even faster code than using manual DOM manipulations. Of course, your performance will vary depending on how you implement your code. Depending on which model you're using, and how you program, you may end up with a faster or slower product with either methodology.

But at the end of the day, the performance gain from running code using state mutations just doesn't seem worth the effort of having a significantly harder time reasoning about the code, and having to deal with the challenges of scaling a project where the complexity grows much faster with each line of logic.

And my feeling is that due to the time invested in managing a more complex project that deals with mutations, the "performance per engineering hour" gained for projects using a virtual DOM is more favorable for many projects.

<comment><USER28> I think the main problem with your argument is that you assume that the world looks like a shallow tree. For UIs this may be, to a great extent, true. But for non-frontend code, the world looks more like a deep DAG (directed acyclic graph).

Also, suppose I have a list of thousands of elements. Now suppose one element is added to the list. React will still perform a comparison operation on all of those thousands of elements.

<comment><USER13> >> React will still perform a comparison operation on all of those thousands of elements.

Using the `shouldComponentUpdate` API alleviates the problem, doesn't it? [https://facebook.github.io/react/docs/component- specs.html#u...](https://facebook.github.io/react/docs/component- specs.html#updating-shouldcomponentupdate)

<comment><USER30> Eh, kind of. If you're rendering, for example, a Table with a lot of TableRows and change one of the values in the data array being passed to Table.props, you'd return true from Table.shouldComponentUpdate, and then each child TableRow would need to run its shouldComponentUpdate, even though only a single one really needs to update. So the argument is GP is making is that it's more efficient to directly update that single DOM element rather than update the data and then perform the calculations to determine that we need to update that single DOM element.

<comment><USER31> True in theory, but as long as each TableRow implements the PureRenderMixin and the Table render itself is efficient, you're going to need a lot more than a thousand rows before React has any trouble hitting 60fps in my experience.

But if you can't meet both those conditions, that sort of thing definitely can get quite slow.

</comment></comment></comment></comment></comment></comment><comment><USER32> React and Khan Academy reminded me of this funny tweet by one of their developers: [https://twitter.com/jdan/status/655432901782302720](https://twitter.com/jdan/status/655432901782302720)

</comment><comment><USER33> I would love to read more about styling inline and completely remove external CSS files.

Are there any CSS-frameworks that have been converted to JS but not are not their own components yet? It's easy to find React-Bootstrap but that comes with ready made components, I am looking for styling that's purely in JS so I can make my own components.

Also would a route-component be considered logic or presentation, or maybe it is its own thing and they forgot to mention it?

<comment><USER34> I don't like inlining styles as objects in React so I went looking for a solution that would work with the toolchain I'm using for my current project.

I'm working on a project now that is using a combination of react-css-modules, webpack, and an ExtractText plugin for webpack that means each React component I write can have an associated CSS file.

Each class in the CSS file gets mangled so that it doesn't affect things globally by react-css-modules. Then the ExtractText plugin for webpack pulls all those CSS files out into one, global styles.css file.

Ultimately, that means that my CSS file might actually, over the life of the project, shrink! Unheard of.

In the same project I'm using redux and redux-router. The router consists of declarative components, like "<ReduxRouter />" and "<Route />".</comment></comment>


Is Slack the last business app we'll ever need? - <AUTHOR> https://medium.com/@amibendavid/is-slack-the-last-business-app-we-ll-ever-need-b642f1e7c1ab#.5b514f4ym <comment><USER2> no. hangouts and email works fine. I'm not mad at slack for building something, but it's just a slightly different wheel.</comment>


For 8 years a hacker operated an IoT botnet just to download Anime videos - <AUTHOR> https://www.zdnet.com/article/for-8-years-a-hacker-operated-a-massive-iot-botnet-just-to-download-anime-videos/ <comment><USER2> I'm skeptical of the "hobby project" designation. The botherder demonstrated decent operational security, except for the initial lapse of German C2 servers, and the tar file with user name "stefan". Used TOR to access things. Stefan T. Botherder wrote custom backdoor(s), and subnetted the infected machines. Stefan was careful not to exfiltrate data so fast as to raise alarms, and exhibited extensive knowledge of Linux and the NAS/DVR environments.

This is a lot better than most of the sub-moronic WordPress compromise bottom feeders who put bitcoin miners out there, or those goofs that run the Perl IRC bot. The Perl IRC bot people you could characterize as "hobbyists", but this botnet seems way too carefully done.

This article raises another question: how many carefully-built and maintained botnets are there, where the botherder just flies under the radar?</comment>


Ask HN: Name of Often Cited Effect - <AUTHOR> I can't recall the name of an effect thats often cited on HN about measuring goals and evaluating their progress by a given metric, thereby altering the measurement / effect measured through said metric. effectively invalidating the metric as a useful indicator of success.<p>any help would be appreciated. <comment><USER2> [https://en.wikipedia.org/wiki/Goodhart%27s_law](https://en.wikipedia.org/wiki/Goodhart%27s_law)

</comment><comment><USER3> [https://en.wikipedia.org/wiki/Observer_effect_(physics)](https://en.wikipedia.org/wiki/Observer_effect_\(physics\)) often described through [https://en.wikipedia.org/wiki/Schr%C3%B6dinger%27s_cat](https://en.wikipedia.org/wiki/Schr%C3%B6dinger%27s_cat) or [https://simple.wikipedia.org/wiki/Heisenberg%27s_uncertainty...](https://simple.wikipedia.org/wiki/Heisenberg%27s_uncertainty_principle) or similar quantum physic experiments.

</comment><comment><AUTHOR> Thank you so much! It was indeed Goodhart's law I was looking for.</comment>


A lingering farewell to the username - <AUTHOR> https://api.slack.com/changelog/2017-09-the-one-about-usernames <comment><USER2> Slack's authentication flow is the dumbest I've ever had the misfortune of using. I'm a member of multiple Slack organizations, and it needs _one login per organization_. I can't just have a single email address and join whatever org I want, I have to remember _which_ email address I used for each one, otherwise I can't log in!

I have multiple email addresses and don't use a specific one every time, so I have managed to lock myself out of many orgs because I just can't remember which email address I used.

If you click the "forgot my email" link, they go "have you forgotten which email address you used to log in to which org? Just tell us your email address and we'll tell you which orgs it's logged in to", which is exactly the _opposite_ of what I want!

It's such a clusterfuck that I just avoid joining new orgs nowadays because I know I'll never be able to log in again.

<comment><USER3> I am in a number of different slack orgs. With one email address, I join whatever org I want.

> I have multiple email addresses and don't use a specific one every time... I > just can't remember which email address I [use]

I think I see the problem. I'm not sure how this approach allows you to function on the internet at all.

<comment><USER4> I have had a personal email, two school emails (undergrad + grad), and three work emails (internships). Most of the Slack orgs I'm a part of restrict access to emails from a specific domain (@university.edu, @company.com), so each account is associated with at least one Slack org. It's a mess, and it's because of poor design by Slack. I should have a "master" Slack account where I can list all the email addresses that I own, giving me access to all the associated orgs.

</comment></comment></comment><comment><USER5> When this started rolling out it caused havoc for us. Without any warning that this was happening half of the people in our org got their display_name set to their full name, and the other half got their handle. For no apparent reason.

Within the technology parts of our org everyone knows each other by handle, and we still let people pick their own handle when they join. It's even pretty common to only know people by handle and not their real/full name. Monday morning and all of a sudden you can't ping a colleague anymore by @username, you have no idea why and now you need to know or find out what their first name is. Eventually that got fixed for everyone but it made Monday worse than usual.

I'm also not sure how this is going to interact with Enterprise Grid though. Since display names aren't unique you can get two people in a channel with the same display name. So if you now ping @John The Ripper, does it bug both, does it not go anywhere?

<comment><USER6> See [https://get.slack.help/hc/en- us/articles/205240127-mention-a...](https://get.slack.help/hc/en- us/articles/205240127-mention-a-team-member#several-matches-of-a-display-name) for a description of the UI for atting a duplicate display name.

<comment><USER7> I think I like the way HipChat does it better. @ing is suppose to be quick, if you have to click on a dialog every time you want to message someone that's going to slow you down. Hipchat just doesn't allow duplicate display names.

</comment></comment></comment><comment><USER8> If I read this correctly, the "Enterprise Grid" section hints at one technical reason for this move. Slack recently announced[0] a new feature that allows multiple teams, err "Workspaces", to share a channel. This violates the uniqueness of @usernames within the namespace of the shared channel, e.g. both teams having a "@john".

This announcement anticipates (a) getting developers to use surrogate UIDs instead of @username for mentions, and (b) that their clients will only use display names in the future and rely on specific UI elements to distinguish ambiguous ones.

[0] [https://medium.com/slack-developer-blog/network-effects- gett...](https://medium.com/slack-developer-blog/network-effects-getting- ready-for-shared-channels-600b7cc776df)

</comment><comment><USER9> I think they're missing the point, Twitter got the display name / username dichotomy right:

Display Name: what everyone sees _next to_ your username, no guarantees that you don't change it every 5 minutes though...

username: something short you choose and change rarely, can be cool, memorable, fun, and quite creative, always unique

[Real Name: who cares, often necessary for work tools even though email ought to be enough]

<comment><USER10> Twitter has some problems too. People do change their username, and every time they do, all previous tweets mentioning them by @username lead to dead ends.

<comment><USER11> If they do (I haven't verified if you're right) then that's an implementation issue. Twitters API returns rich information about every mention that shows they very well could store an association to the internal user id if they want to.

But it may very well be for good reason. E.g. lets say an account is taken over by someone who changes the account into something suitably offensive after obtaining a lot of mentions. It would seem that treating a change as basically "this is a new account now" is the safest alternative in some respects.

</comment></comment></comment><comment><USER12> In general the idea of a username is slowly being killed of across the web. In the 90s when I got my first computer few would have been "crazy" enough to user their real name. The anonymity of the web back then was so much fun. Google and Facebook really started to kill that off and nowadays most sites just use an email address for a login if they are not already using your Gmail or Facebook for auth.

Long live the username on hacker news.

<comment><USER13> Requiring comments be attached to a real identity invariably does the exact opposite of what it intends to and lowers the quality of commentary. Sure, some people use the cloak of anonymity to perpetrate abuse, misinformation or low-effort participation, but the alternative has a chilling effect on potentially thoughtful commenters who don't want to become targets.

It doesn't really get rid of the anonymous abuse or disinformation either, because there are plenty of bots using fake social network identities out there.

The real people that do remain invariably put about as much thought into their contributions as they do into the long-term consequences of associating those comments with their real identity, or are simply so angry or strident that they don't care.

Without real identities I would encounter islands of reason adrift in a sea of inanity. With real identities, I tend to see the loud and ignorant shouting at (or alongside) bots.

<comment><USER14> > potentially thoughtful commenters who don't want to become targets

I almost never discuss politics, philosophy, important personal subjects or really anything of substance on Facebook. It's become purely for staking a tether to a few hundred key individuals I want to keep track of but don't need/want to talk to more than very rarely. Most of these contacts are not close friends or people I see any point in arguing with (especially after seeing the content of the most prolific posters).

Do you remember when Google actually encouraged people to use anonymous user names? [What a 180 they did!] This was the default, established early on, for good reason. It is a true democratizer, casting aside all to distinguish anyone but their words and/or choice of posts. With one stroke, it eliminates racism, sexism, ableism, name recognition bias, fashion snobbery and all other means of discrimination by appearance or public life. It also raises the bar for one to be taken seriously, as anything you say can be fact-checked immediately.

The cult of personality infecting user representation on the internet has been a tragedy to watch unfold. People would rather copy and paste words (usually out of context) from someone on a pedestal to glorify or vilify than take the extra step of vetting or responding meaningfully to what they say. I guess I should have expected it, but it's still hard not to be disappointed.

TL;DR edit-- I meandered a bit, sorry. My point is that user anonymity results in a more level playing field for discourse. Certain discussions of substance benefit greatly from this. In the world of real names, ad hominem attacks or hero worship all too easily derail productive debate. This can happen in anonymous forums as well, but from my experience it's much better corrected for in those places.

</comment></comment></comment><comment><USER15> I have no idea what the product manager was thinking here... Can someone elaborate why this "feature" \- which implies potentially a lot of confusion - benefits most users?

<comment><USER16> So I think it's because they're introducing shared channels between multiple teams/workspaces. As a result usernames can clash.

<comment><USER15> I can't help but notice that slack is starting to get "enterprise" (threaded comments, this username thingy, ... ). They seem to be introducing a lot of complexity for all of the users, while only some of them would benefit from these new features. I'm hoping that they start realizing this, and keep simple chat the default, while allowing you to opt-in for all these "handy" features...

<comment><USER17> At least the client is lightweight, using hardly any memory, disk, or CPU.

<comment><USER18> Jokes are for Reddit, not HN.

<comment><USER19> If you think a comment is not constructive, off-topic or otherwise inappropriate flag it and don't reply [0].

I see no issue raising a genuine concern with Slack's desktop app, which is incredibly bloated – be it in a joke rather than a long-form comment.

[0] [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment></comment></comment><comment><USER20> The best solution for the name collision problem that I've seen so far is used by Discord and Battle.net, both in the gaming space where username is often much more prominent than the real name.

You can set your username to whatever you want (e.g. "jakebasile"). You then get a randomly assigned four digit number appended to the end (e.g. #5024). To add someone as a friend, you need the full username#0000, but thereafter it is not needed. To mention someone in a chat (in Discord) you type @ and then start typing - it will match on either the user name or display name, but only complete the user name. The key is that when you actually send the message it will show that user's display name in chat and notify them as you'd expect. Display names in discord can be overridden at the server level and in Battle.net games there is the concept of Real ID instead which you can choose to share your real name on a per person basis.

In both of these situations you are only using one account and one username across either multiple games or multiple servers. This avoids having to use many different accounts within the same application which is one of my primary gripes with Slack.

</comment><comment><USER11> So, they're making things more annoying for most uses I have for Slack, without providing any benefits for the uses I have for Slack (I get that it may provide some benefit for others).

Sounds like it's time to say a lingering farewell to Slack.

<comment><USER21> One e-mail linked to: many organizations and many channels, each with your own customizable display name. I think that's the ideal, is this where they're going with it?

<comment><USER11> If so, it does not at all fit my use cases for Slack.

1\. Like with LinkedIn I need to be able to use multiple e-mail addresses, but the current system of having to log in separately to each account is a mess.

2\. I want to be able to quickly mentioned people based on a username without having to go via a disruptive dialog box. Not least because I want to be able to mention people outside Slack and have integrations find the right person.

Display names are nice as an addition, but not as a replacement.

</comment></comment></comment><comment><USER22> That is the most verbose and confusing post about a seemingly simple change I've ever read.

"What's changing? Everything and nothing is changing" really doesn't help.

<comment><USER23> I ready about half way through it and then came to the Hacker News comments to figure if someone had decoded it.

</comment></comment><comment><USER24> Sad to see this go... We use @username from external systems that feed into Slack. For example, putting a comment on a Zendesk ticket using @username alerts a person who would normally never pop into Zendesk to have a look.

<comment><USER7> That's a really cool feature! We could really use that!

<comment><USER24> If you're feeding Slack with Zendesk now, try putting an internal comment on a ticket with the @. Oh, and since Zendesk forced everyone to the rich-text client you need to escape out of the automatic name selection dropdown or it will show up in Slack as @ __ _username_ __which does not trigger the mention.

</comment></comment></comment><comment><USER25> I don't fully understand what's changing: Slack always had the option to set a "real" name. Is it simply going to transparently translate the name token within messages to whatever preferred representation an organization choses? If so, why is this being presented as "the death of the username"? Or is it more complicated than this? (Perhaps an accommodation to integrate with existing directory systems in larger corporate environments?)

Does Slack feel like having usernames somewhat visible and end-user facing makes the product "too nerdy" for a general audience?

</comment><comment><USER26> what the heck? this is the stupidest move I've ever seen from Slack. Combine this with a lack of using floating windows (like Messenger on Android) and it's clear that the company is run by operations and sales --- not product. There is clear space to move in on Slack's terroritory

<comment><USER27> > _Combine this with a lack of using floating windows_

Floating windows? As if they are supposed to be good stuff?

Floating windows and MDI UIs have been phased out in most OSes, apps and GUI toolkits in the last decades favor for far more stable and intuitive docked sidebars and toolbars.

Edit: Is what I wrote inaccurate? Or it's just fans of floating windows voting this down?

</comment></comment><comment><USER28> I didn't get it...

so how do I mention someone now? I still have to type @ for autocomplete, and even if I type the realy name [return] completes to @username...

</comment><comment><USER29> Not only are they phasing out @username, they are removing the very simple /msg username – I now must type /msg @username and hit enter twice to initiate a DM. It's annoying.

<comment><USER30> On Mac if you hit CMD+T you can just start typing a username (or channel name) and as soon as it's selected, hit enter once. That's how I navigate around Slack.

<comment><USER29> Yeah, I never got into that method, I guess I'm stuck on my IRC muscle memory. CMD+T is new tab, not search! :P

<comment> yoz-y CMD+K works as well. For me it is better since that is the shortcut I use for quick open in QtCreator

</comment></comment></comment></comment><comment><USER31> Dumb move. YouTube did this and it sucked.

</comment><comment><USER32> They also removed your username/display name from your default highlight strings. We often just use names with no @, and this week we noticed that other people were no longer getting pinged for those. Now you have to go to your preferences and explicitly add your display name to the list of strings you want to be notified about.

</comment><comment><USER33> They 'll apologize and put it back in 2 months or so.

</comment><comment><USER34> I don't understand what they mean by "Unfortunately, an undocumented approach to mentioning users — <@username> — no longer functions. Please reference with the user ID format (<@U123>) instead".

Surely they're not saying slack users need to manually type opaque numeric identifiers to properly mention other users? That would be ridiculous.

<comment><USER35> That's the format a bot uses to mention a user. But, yeah, the wording is confusing.

<comment><USER34> Ah I see. Yeah, still not a fan. As someone else mentioned in the thread, some bots are mainly integration, shuffle content from one system to another. This will break mentions in IRC gateways for instance, no? Or, something Slack might care more about, make it a lot harder to have a mention in a ticketing or project management system trigger a mention in a Slack message.

<comment><USER35> Yeah it's definitely a pain. I support a bot that we use for devops and I'm already going through and doing a search/replace op in our commit messages that get posted into slack.

Seems like this is a classic 'push the work downhill' thing they've done that just costs all the devs who write slack apps.

</comment></comment></comment></comment><comment><USER36> So how is it gonna work now if I use irc gateway?

</comment><comment><USER37> This is the most confusing thing i've read in a long time. Coming from slack, that's kinda surprising and feels out of character.

</comment><comment><USER38> This change is bad.

</comment><comment><USER39> Please, make it possible to directly report or ban automated DM messages from bots/apps.

</comment><comment><USER40> Why is this HN material? It's a Slack customer advisory.

<comment><AUTHOR> From a product perspective, it seems like a big decision and discussion about it may be insightful to those building other products.

From an engineering perspective, those who have Slack API integrations may be affected.</comment></comment>


If-Else Is Bad Programming Practice in Modern Code - <AUTHOR> https://levelup.gitconnected.com/if-else-is-a-poor-mans-polymorphism-ab0b333b7265 <comment><USER2> > The art of turning 6 lines into 92 lines by replacing if-then-else and > switch with objects..

> ..In summary, traditional branching is often a student's tool until a more > suitable, polymorphic approach is discovered.

I can't tell if this is serious or a straight-faced joke. The article did not convince me at all - in fact it dissuaded me further from the kind of approach taken, which I often encounter in the wild: a class for every condition, with slightly differing implementations.

A similarly questionable article was posted a couple days ago:

Anti-IF Framework - [https://blog.arkency.com/anti-if-framework---if-slash- else-b...](https://blog.arkency.com/anti-if-framework---if-slash-else-based- on-type/)

</comment><comment><USER3> I honestly thought that this article was satire until I reached the end & found no punchline. This is a fast way to turn any codebase into a mess of unreadable action-at-a-distance nonsense. I don't have any beef with objects or classes, but it's appalling how some people will use them to obfuscate clear code by splitting an if statement over several files.</comment>


Tor Browser 7.0a4 is released - <AUTHOR> https://blog.torproject.org/blog/tor-browser-70a4-released <comment><USER2> How do the Tor project developers continue the development of Tor without the interference and corruption efforts of state level actors?

<comment><USER3> 1\. Tor is open source. Any backdoor attempts in the source would require careful hiding. Shutting down the Tor Project would just result in someone else picking it up.

2\. The US Navy funded (maybe still does) Tor. Tor is useful for western allies & spies

3\. Many of the developers live in western nations. While western nations like the US do have intel agencies who are interested in messing with Tor, it doesn't seem to have gotten to the point of shutting down the Tor Project or directly attacking their infrastructure much if at all, especially since Tor benefits the military as well.

<comment><USER4> Yep. IIRC one of the Snowden documents even mentioned GCHQ and other organisations using Tor for their own purposes.

<comment><USER5> > IIRC one of the Snowden documents even mentioned GCHQ and other > organisations using Tor for their own purposes.

I think you're referring to this presentation about hidden services by the GCHQ [1] where they state, 'Until then... Doesn't stop us from using them'

I wonder what they may have to say about the soon coming next-gen onion services.

[1] : [https://www.eff.org/files/2015/01/26/20141228-speigel- analyt...](https://www.eff.org/files/2015/01/26/20141228-speigel- analytics_on_security_of_tor_hidden_services_0.pdf) (page 25)

</comment></comment></comment></comment><comment><USER6> Could someone more knowledgeable than me comment on what Selfrando is, how it's useful, and how it works.

<comment><USER7> I recommend reading the linked blog post about it. [0]

[0] [https://blog.torproject.org/blog/selfrando-q-and-georg- koppe...](https://blog.torproject.org/blog/selfrando-q-and-georg-koppen)

There is also a research paper [1] and accompanying video [2].

[1] [https://people.torproject.org/~gk/misc/Selfrando-Tor- Browser...](https://people.torproject.org/~gk/misc/Selfrando-Tor-Browser.pdf)

[2] [https://www.youtube.com/watch?v=IikpczzNyas](https://www.youtube.com/watch?v=IikpczzNyas)

<comment><USER8> tl;dr seems to be a more advanced form of ASLR?

<comment><USER9> i think it's ASLR with more entropy by skimming through the paper, but most exploits have read primitives or infoleaks anyways so i don't see how more entropy affects them. If i am right it protects against attackers guessing the ASLR slide, but that's very unreliable and no FBI grade exploit should ever do that.

<comment><USER5> See "Real-world Exploits against the Tor Browser" pages 9-10 where they conclude,

> The reason is that these function pointers are only accessed through an > indirection layer, i.e., memory objects on the heap contain a pointer to a > virtual table which is located in the code or data section of the > application and contains a number of pointers to virtual functions. Since > the attackers can only disclose the virtual table pointer, but not the > virtual table itself, as it is not on the heap, they cannot disclose gadget > addresses. Note that, when only ASLR is applied, the address of the virtual > table is randomized with the same offset as the ROP gadgets. Therefore, such > an attack can bypass ASLR but not selfrando.

> We therefore conclude that selfrando can thwart most real-world exploits. > Attackers can only succeed in rare cases where they can disclose the > complete heap and data section.

[1] : [https://people.torproject.org/~gk/misc/Selfrando-Tor- Browser...](https://people.torproject.org/~gk/misc/Selfrando-Tor-Browser.pdf)

</comment></comment></comment></comment></comment><comment><USER10> For the over 40 crowd [https://read.feedly.com/html?url=https%3A%2F%2Fblog.torproje...](https://read.feedly.com/html?url=https%3A%2F%2Fblog.torproject.org%2Fblog%2Ftor- browser-70a4-released&theme=white&size=medium)

<comment><USER11> javascript:(function()%7Bvar%20currentURL%20%3D%20encodeURIComponent(window.location)%3Bwindow.location%20%3D%20%60https%3A%2F%2Fread.feedly.com%2Fhtml%3Furl%3D%24%7BcurrentURL%7D%26theme%3Dwhite%26size%3Dsmall%60%7D)())

bookmarklet code to do that for you on any web page not sure how to format this better

</comment></comment><comment><USER12> I'm waiting for version 8 because of my religion.

<comment><USER13> Could be a while.</comment></comment>


Ask HN: When you are very depressed, What book/movie to see? - <AUTHOR> When you depressed every day, living in Place like China like in Blade Runner, What book/movie to see to get hope or happy? How about Doraemon? <comment><USER2> Classic comedies, like When Harry Met Sally or Ferris Bueller's Day Off. Hannah and her Sisters.

Also, if you're actually depressed, that is a medical condition and you should find somebody to talk to or get professional help. See [https://www.mind.org.uk/information-support/types-of- mental-...](https://www.mind.org.uk/information-support/types-of-mental- health-problems/depression/for-friends-and-family/?o=9222#.WfrN40qnzYU) for information, or search for Samaritans in your area.

<comment><AUTHOR> Thanks

</comment></comment><comment><USER3> Books & movies can help you connect with your location or situation, they don't have to be a diversion.

When living in China I liked to watch dystopian sci-fi & anime based in large cities \- Akira, Ghost in the shell, Oblivion, Dredd, The fifth element, total recall

Then grab some headphones and go for a wander around your megacity :)

PS this also works for other scenarios. Eg "Black cat white cat", or "Brother" if strapped for cash. "Fight club" if your job is getting you stressed.

I think lot of art is created by artists as a "cure" for their current worries. And their problems tend to be just like ours.

<comment><AUTHOR> THANKS,i will see again Fight club</comment></comment>


Elections were rigged in Vitebsk, Belarus - <AUTHOR> https://www.youtube.com/watch?v=i_PEv2SO2yU <comment><AUTHOR> Sorry, a filter ate "How elections were rigged". It's audio + English transcript of the head of an election commission falsifying the results in Vitebsk (population ~366k according to Wikipedia) a few days ago.

Thought it was an interesting case of how these things happen.</comment>


Ask HN: Asked to Give a Lecture - <AUTHOR>

I've been asked to give a lecture tomorrow night on the basics of Python and how to use Python to manipulate financial data. I was only asked this morning to prepare something.<p>If you were asked to prepare something for a group of students that have little to no programming experience, what would you include in an introductory lecture? <comment><USER2> It starts out really basic, but "Snake Wrangling for Kids" is a great resource for introductory programming and python especially. You might be able to take some of the more advanced idea's and explinations out of the book and elaborate on them.

[http://www.briggs.net.nz/log/writing/snake-wrangling-for- kid...](http://www.briggs.net.nz/log/writing/snake-wrangling-for-kids/)

Good Luck, Sounds like a cool opportunity.

</comment><comment><USER3> What level are these students? College or High School students? If it's college (which I assume it is), what's the class you'll be lecturing during?

This is pertinent because it's helpful for us to know if these are captive students or students who might actually get some use out of what you're there to talk about.</comment>


Ask HN: How to deal with likely future-compromise of your passwords? - <AUTHOR>

I am coming to the opinion that I should assume any password I give a webservice will make its way in to the hands of a third party in the future.
Given that, in a perfect world, I would memorize completely random and strong passwords for each web service. I consider that a bit of a non-starter (am I wrong?).
Password managers like 1Password seem to be an option, but if both the key file and the pin for it are compromised (or lost) you're extra screwed.
I'm looking in to remembering two random ten digit strings, and using a mental algorithm to combine them based on service name, but that'll require some thought. That said, this is the solution I'm leaning towards.
Any better solutions that you ACTUALLY use in the real world? <comment><USER2> Password managers (or a GPG-encrypted file) work just fine. Yes, you're in trouble if you forget the password, so don't do that. (If you don't have regular backups and worry about forgetting the password, fix the backups issue first - drives die more often than you'll forget a password.)

</comment><comment><USER3> One thing is for sure, don't use the same password for all your important sites. To make them easier to understand, have a system of differentiating from 1 site to another. As always, I try to: 1) numbers and letters 2) not a real dictionary word 3) Mix of lower and uppercase

My real paranoia is still: "what if this/that website doesn't encrypt or hash my password?"

</comment><comment><USER4> I forget passwords all the time. If my 1Password dies, I'll just recover all my accounts through email, the way I did it before 1Password. My email password is memorized, my 1Password password is memorized, and my bank passwords are memorized. Everything else can be easily recovered.

</comment><comment><USER5> instead of remembering passwords, remember usernames. That way if one account is hacked, they won't know the password can be used in some other service...

</comment><comment><USER6> A password manager with multifactor authentication?</comment>


Why use Backbone.js? - <AUTHOR> http://backbonejs.org/#FAQ-why-backbone

<comment><AUTHOR> One of the major differences between Ember and Backbone I enocuntered almost immediately was the lack of explicitness within Ember.

It felt to me, in Ember, that I was creating arbitrary objects and attaching to arbitrary objects and from that arbitrariness instances were created...

Coming from the Backbone world where you create a definition and then initialize it manually, this was a very disconcerting change. Unlike the Backbone community, I was also unable to get any sort of help or direction after hitting up Twitter or IRC.

Support should not be underestimated.

<comment><AUTHOR> It was pointed out that my comment on Ember's support was inappropriate and I agree. It was based on a days worth of support checking and at the moment speculation. Redacted.

</comment></comment><comment><USER2> Just to add some notes to the FAQ:

1) Backbone gives you a handy way to interact with browsers and the DOM. It does not remove the necessity for you to interact with the browser.

2) It seems like a lot of folks get into trouble when talking about/thinking about event flows and using the abstract messaging layer that Backbone provides in Backbone.Event. Backbone gives some basic and handy defaults events for folks to use, but I always think it's worth considering which parts of your app talk to each other, and what that interface looks like.</comment>


9 incredible photos of our universe - <AUTHOR> http://www.bt-images.net/incredible-universe/

<comment><USER2> Astronomy is so amazing. It is jaw dropping, humbling and inspiring. From the article, I love Stephan's Quintet of galaxies the most.</comment>


Need help finding a decent book about electronics - <AUTHOR> I've started working with electronics, bought a basic equipment and start experiencing slightly, 1-2 hours per day. My only problem is that I can't find a decent book that will help me understand modern day appliances and how they work. For example let's say I have an alarm system or a battery charger, I want to know how they work and what components they rely on. <comment><USER2> im going to assume you have just started on theory, so i might seem basic but you should crawl some books on electrical theory and some simple gadjet books, like Forrest Mims.

[https://www.forrestmims.com/](https://www.forrestmims.com/)

online resources for "free" exist..

[https://news.ycombinator.com/item?id=20557533](https://news.ycombinator.com/item?id=20557533)

and you should know how to identify components by reading thier numbers and looking up the WhitePaper, the instruction manual for the component. here is a handy place

[https://www.alldatasheet.com/](https://www.alldatasheet.com/)

you should have a firm grasp on Ohms law [https://en.wikipedia.org/wiki/Ohm%27s_law](https://en.wikipedia.org/wiki/Ohm%27s_law)

and Kirchoffs circuit laws [https://en.wikipedia.org/wiki/Kirchhoff%27s_circuit_laws](https://en.wikipedia.org/wiki/Kirchhoff%27s_circuit_laws)

It is essential to be able to use these laws along with knowledge/whitepapers of components, so you can predict or explain what is happening at any point in a simple circuit, or a big network of simple ciruits. And thats another thing, no matter how ^intricate^ a PC board looks, its made up of simpler circuits interacting with each other, for example identify the power supply and conditioning section, from the rest of the device circuitry lookup the parts for thier properties, make measurements, compare the measurements to what is expected from white papers and calculations.

<comment><AUTHOR> Ok thanks for the resources, I know some basic theory about voltage, current, ohm's law and how most of the basic components work and what their purpose, like capacitors or mosfets etc. I want to know more practical things and how house devices work without scrapping every single one of them.

<comment><USER2> try to obtain abandoned electronics to "dissect" reverse engineering household electronics and appliances is a good start, just mind the dangers in things like microwave ovens TV sets, smoke detectors, and CD lasers. alot of what you see is going to look a lot like, some sort of digital electronics, with some analog control sections, and a power supply section.

there are rules for different types of technology regarding the current voltage and noise allowed.

basically you have resistors capacitors inductors then you have diodes transistors SCRs and other junctions and then you get into ICS such as analog amplifiers transducers of all sorts. then logic and digital electronics such as bus master controllers, or programmable IDEs</comment></comment></comment>


Ubuntu Mate 18.04 Beta 1 for Raspberry Pi - <AUTHOR> https://ubuntu-mate.org/blog/ubuntu-mate-bionic-beta1-raspberry-pi/ <comment><USER2> Cannot wait to try this out!

</comment><comment><USER3> What are some good reasons to run this vs Raspbian?

<comment><AUTHOR> It provides a complete, familiar, desktop environment that can be used for basic desktop computing. I've been using Ubuntu MATE on the Pi to introduce my daughter to computing for several years now.

But, it is probably of more interest to makers and device hackers who want to target Ubuntu for their projects. You can prototype homebrew ARMv7 or ARMv8 based IoT devices in a comfortable desktop environment, including building and testing your apps as snaps ([https://snapcraft.io](https://snapcraft.io)). The full Ubuntu archive is available to you.

For hobbyist projects, you can stick with Ubuntu MATE for "deployment", even with the option to disable the X11 display server if it not an application requirement. But, if you have something more professional in mind then the applications and snaps you've prototyped with Ubuntu MATE can be used with Ubuntu server or Ubuntu Core ([https://www.ubuntu.com/core](https://www.ubuntu.com/core)) on one of the ARM-based reference platforms.</comment></comment>


The Secret Structure of the S-Box of [GOST] Streebog, Kuznechik and Stribob - <AUTHOR> https://eprint.iacr.org/2015/812 <comment><USER2> Note that they have decomposed the GOST S-box into several non-linear 4-bit functions. While this is certainly great for hardware optimization, the cipher is still not fully understood: the authors have not determined why these particular functions were chosen. Non-linear functions are given in the paper as magic constants.

</comment><comment><USER3> What is the significance of this?

<comment><USER4> The choice of the numbers used for S-boxes can be very mysterious unless the designers explain it. So reverse engineering the S-box design might reveal something interesting (something good or something evil).

For years people thought that the S-boxes in the Data Encryption Standard (DES) hid a back door since the NSA had helped design it. It surprisingly turned out years later that the NSA had actually _strengthened_ the S-boxes against an attack called differential cryptanalysis that was not known to the public crypto community at the time[1]. But neither were they entirely benevolent: The NSA also weakened DES by shortening the key length so they could brute force it, and in the heyday of DES, the NSA was probably the only organization in the world that had the computing power to do so.

[1] [https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.2...](https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design)

<comment><USER5> > ...in the heyday of DES, the NSA was probably the only organization in the > world that had the computing power to do so.

Less an issue of the computing power, more an issue of the knowledge. As you noted, civilian cryptographers hadn't even _discovered_ differential analysis yet, so hardening the cipher against it wasn't even a consideration.

<comment><USER4> > _Less an issue of the computing power, more an issue of the knowledge._

I think you're mixing up two issues:

(a) Strengthening DES against differential cryptanalysis is a knowledge issue. The NSA knew about that attack, and maybe the Soviets knew too, but the public didn't.

(b) The key length for DES however is entirely a computing power issue; it is not a knowledge issue. It would be obvious to everyone even in 1977 that a 64-bit key as originally proposed would have been better than the 56 bits they ended up using[1]. Furthermore, everyone understood how to do a brute force attack, but it just wasn't feasible for the public. Only the NSA would have had the budget and inclination to develop special-purpose computing hardware to actually do it in the 1980's DES era.

[1]I have to mention one nitpick here, otherwise someone else will point it out. The 56-bit key length was supposedly ideal because DES would have been more easily cracked using differential cryptanalysis than brute force with any key longer than 56 bits. Thus the NSA can claim, "no we didn't weaken DES by shortening the key, we optimized it because 64 bits doesn't buy you extra security over 56 bits". But that argument is bogus. They could have improved DES in such a way that it used 64-bit keys _and_ wasn't vulnerable to differential cryptanalysis. But they did the latter and not the former, because it keeps DES secure against the Soviets (assuming they knew about differential cryptanalysis) and against the public (who can't mount a brute force attack) but does allow the NSA to be able crack it.

<comment><USER6> Coincidentally A5/1 was also compromised down to 56bits.</comment></comment></comment></comment></comment>


Save the web for paper later - <AUTHOR> https://www.paperlater.com/

<comment><USER2> At the same time that I think this is a fight not worth attempting; both for a print service as well as a post delivery of it... A curated paper might be interesting if you think of other uses it might have.

Not only do we probably never come back to some bookmarks, getpocket/readability/readitlater lists as often as we'd initially think...

But there's a number of users and use cases that are curiously interesting to consider (older users; people more interested in disconnecting; those who like the paper feel; or just want a permanent storage of interesting articles kept on the attic to never read again; etc...)

</comment><comment><USER3> so is this like pocket/read it later printed? wouldn't that have copyright issues?

The advantage of pocket/read it later is that you can view it on a small screen within the confines of your neighbours armpit despite how nice it is to read things on paper.

Do you check each paper for mistakes? I switched from pocket because rendering was iffy. I'd be even more annoyed if my paper was printed and was missing images and lists like pocket used to do.

</comment><comment><USER4> It feels like this should be named kill the trees or blacken the hands</comment>


Why Flash can't win the Web application war - <AUTHOR> http://devcentral.f5.com/weblogs/macvittie/archive/2008/12/10/why-flash-cant-win-the-web-application-war.aspx

<comment><USER3> As a heavy user of Flex for my start-up, I have to, heavy-heartedly, agree with the main point of this article.

Wake up Macrobe! Ajax, as loose and amorphous and crap as it is still today, is going to eat your lunch!

Flex Builder should be free and open-source and Adobe should encourage people to improve on it. They could steal much of the effort that's currently going into other RIA platforms by being more openly supportive and aggressively marketing that openness. The fact that they don't do that is simply mind- boggling.

<comment><USER4> Can I ask why you chose Flex over the Ajax approach? What features were only in Flex that you felt this was a better approach?

<comment><USER3> Several reasons, but the key one was that to build the kind of user experience we were aiming for, Ajax would have been a major, major, major nightmare - <USER2> probably not even possible (especially 1.5 years ago, but still today). With Flex, we got a very different set of compromises that worked out much better for the users.

<comment><USER5> actually i agree.. if you want a UI that is consistent and easy to build, flex has a few hands up over ajax...

ive been using flex builder for linux for a while... and frankly after trying out the windows (fully functional) trial version, i felt the windows version did not justify the price... sure there are a couple of superficial things the windows version has (like the design view - which is "ok")..

only gripe is the linux version is still in alpha so feel a bit jibbed and not to mention hesitant paying full price for it...

the real issue for me is they are leveraging so much of the eclipse framework to build an IDE, they should have more of an obligation to give it away for free, unlike MS (with its VS products)

</comment></comment></comment></comment><comment><USER6> It isn't only that the tools cost money and the format is less open. If I believed that Flash were superior technology for what we're doing (a complex web app), we'd be using it. For me, the real issue is that Flash doesn't fit the web as well as Ajax. That's a big deal.

One hears frequent complaints about how awful it is to have to cobble applications out of HTML/JS/CSS and coax them into running in browsers that were never designed for that. That's true, but it begs a question: why, if it's so awful, do so many people do it? It must have huge value to justify all that effort.

There are all kinds of subtle differences between programming for the web and programming for a desktop-like environment embedded in a web browser. I think it's a mistake to assume that the latter would be better if only we could have it.

There's another way to look at this. One reason the "bad" approach often succeeds while the "good" approach fails is that what seems good is based on previous experiences that don't quite fit what's emerging. Meanwhile the "bad" approaches seem bad because they're messy and chaotic, yet they contain something important and new that is worth the messiness. This is how I look at Flash. People want to program in what they think of as the proper way to build applications. But if it comes at the cost of taking the "web" out of web apps, it's not worth it.

<comment><USER5> why are people "cobbling out applications if it is so hard?" - shame for one. I think many people feel ashamed to abandon the hard path and take the easy path. But, open standards aside (which should be the real reason), if something fits well (both as a solution and with adoption) why not?

<comment><USER6> _why are people "cobbling out applications if it is so hard?" - shame for one._

Oh come on. There are a lot of smart people making Ajax apps. They can't all be doing it for a dumb reason.

<comment><USER5> actually shame is not such a dumb reason... combine that with uncertainty of the future...

if an open standard fails then people wont get too much flak for following it as it was an "open" standard..

starting following or adopting a proprietary and how are you going to explain (to who ever you have to explain) your choice of the chosen standard, when (a) open standards do take over or (b) a different proprietary standard wins the war?

dont get me wrong.. i never said smart people dont do Ajax. On the contrary you have to have lots of patience and brains to want to play around with the inconsistencies with a billion browsers. Lack of said brain cells made me take the easy way out ...

</comment></comment></comment></comment><comment><USER7> It's worth noting that Flex Builder 3 is free for students: <https://freeriatools.adobe.com/flex/>

</comment><comment><USER8> a) Bit-torrent puts Flash in the hands of everyone who wants it. Abode just wants to collect when you build something great with it.

b) Adobe sells Flash for less than 60$ at my university. In fact, they sell all of the CS for that price...

<comment><USER9> I don't want to install pirated software (not only because of the danger of trojans), and I am not a student.

<comment><USER10> I agree with the principle, but Adobe's offer a free download and a 60 day trial license, so the risk of trojans can be be entirely mitigated for pirates.

</comment></comment></comment><comment><USER11> I use MTASC for AS2 development and haXe for AS3, both are open source and work perfectly. We've rolled out online maps in Flash for corporate clients without me ever touching the Flash IDE, never mind Flex.

<comment><USER12> Flex SDK is also free and open source, (Flex Builder is the $$$) , anyone can just download and start building Flex applications (well except the Charting components). You can also use Intellij IDE for Flex development(cheaper). We used FAME development in my previous startup and there is a big difference in development in Fame and in Flex - I prefer Flex.

</comment></comment><comment><USER13> For any of you working with creating "apps-in-the-browser", ExtJS is a pretty well-thought out platform.

It's a JS framework that includes many of the common widgets you find on the desktop.

Google 'ext samples' and prepare to be impressed.

I recently stumbled on it and have been aggressively rolling it out in my company.

</comment><comment><USER14> 17 external links on that one article. I'd much rather see them collected at the bottom for 'reference'.

<comment><USER13> Agreed, my first instinct was article spam.

</comment></comment><comment><USER15> It could also be because Adobe controls how Flash behaves in the browser. If it suddenly changes some security feature in its Flash player and release it, browsers automatically download the player (users don't really care which version of Flash player they have and usually upgrade to a latest release) and suddenly your content stops working. Fixing it won't be an easy task. You need Flash software to compile the movie and your scripts. Not so with JavaScript and any other open languages. This was one of the reasons why I moved out of Flash/ActionScript world.

</comment><comment><USER16> pre-internet, the usual path towards success in the tech world was 1) spend a billion or two to create a monopoly, then 2) soak your customers for all you can get. examples: lotus, compuserve, aol. post-internet, it is now far easier for good ideas to triumph over companies with big piles of cash.

adobe looks to me like a company that's still trying to play by the old rules. it's amazing to me that they've lasted as long as they have.

<comment><USER17> Autodesk is also still doing well. The formula for Abode, Autodesk and friends is to write an application that can't easy be duplicated in a browser, that businesses will buy for employees, and then build a barrier thought file formats and marketing to prevent other desktop software from competing.

<comment><USER16> yeah, that's a better explanation of how that model might still work today.

</comment></comment></comment><comment><USER13> I'd like to know who the author thinks is giving Flash a run for it's money with some evidence. Silverlight? HTML+Canvas+Ajax+JS?

(If it's possible to blast pixels on a webpage quickly enough, I'm sure we'll see frameworks popping out of the later. ExtJS doesn't use Canvas and it's very app-like.)

</comment><comment><USER18> flash is a public document spec and Adobe allows other people to build editors and even players (which has been happening)

<comment><USER16> the .swf format is open, but the .fla format is definitely NOT open. that makes it impossible for third parties to build competitors to adobe flash cs3/cs4.</comment></comment>


What Did 17th Century Food Taste Like? - <AUTHOR> https://resobscura.blogspot.com/2017/11/what-did-17th-century-food-taste-like.html <comment><USER2> I've noticed food evolves in a particular way when it arrives to a new country. It's logical that food needs to be adapted to the country taste in order to get popular, but what it intrigues me is that it usually becomes more "complex", a lot of new ingredients are added, and the original refinement is missed.

A good example is pizza, I'm from Mexico, so I was get used to pizzas with a lot of different ingredients and a specific shape: [https://tinyurl.com/y7wd7hl6](https://tinyurl.com/y7wd7hl6)

So I was really excited to taste the real stuff in Italy and then I got shocked when I noticed how simple one of the most popular is: [https://tinyurl.com/nqcdhah](https://tinyurl.com/nqcdhah)

Something similar happened to onigiri.

What I know: [https://tinyurl.com/yanlww6b](https://tinyurl.com/yanlww6b) Original: [https://tinyurl.com/yaaw7f9k](https://tinyurl.com/yaaw7f9k)

And it seems like this is not something particular to Mexico, it happens the other way around too:

Original taco: [https://tinyurl.com/yb8456mf](https://tinyurl.com/yb8456mf) American taco: [https://tinyurl.com/y8vsuaxs](https://tinyurl.com/y8vsuaxs)

Original burrito: [https://tinyurl.com/ycknpbyb](https://tinyurl.com/ycknpbyb) American burrito:[https://tinyurl.com/yb84p8lq](https://tinyurl.com/yb84p8lq)

<comment><USER3> I think this just applies to the commercialized versions of those foods in the foreign countries. The pizza you linked to from Mexico looks like something you would get from any fast food pizza place in America and the Italian one looks like a margherita slice from any half decent pizza place in NYC. Same goes for the tacos. The "American" one just looks like something you get from Taco Bell while the "Original" looks like something I would get from a local taco truck.

The burrito is an interesting case. I do think that's evolved a bit in America to the point where everyone is copying Chipotle and Qdoba and trying to make the biggest burritos.

<comment><USER4> In many parts of the United States, well into the nineties, there were no Taco Bell tacos. I didn't get to try Taco Bell until 1995.

Growing up, Burritos were these frozen bean-paste wraps, with "meat" included sometimes, that you got from the super market and microwaved in multiple passes, until years later when Taco Bell appeared. Then after The Year 2000, some truly incredible Big Burrito shacks started popping up, with these gigantic, incredible 1.5 pound burritos, right before Chipotle began its massive expansion.

Otherwise, there were some rare Spanish restaurant chains like _Meson, Olé!_ (still around), which were sit down affairs, with what seemed like (nearly extravagant) gourmet foreign cuisine, when stood next to the frozen burritos. Their freebie table nachos were these amazing and decadent snacks as a kid.

Pizza looked like neither, and gambling on pizza beyond the New York tri-state area was certainly taking a chance. I remember eating a pizza in Pennsylvania in the late 80's on one occasion, and it was hard/crunchy, almost stale-ish, cardboard-style flatbread, with "sauce" and "cheese" on top. That's the most memorable incident, but the prevailing wisdom was true: don't get Pizza outside of New York. Plain cheese brick oven pizza comes close to what people view(ed) as New York style pizza, even if you might find lots of the "original" example in NYC. Otherwise, mass produced Pizza Hut or Little Ceaser's were the only two consistent regional options for a long time, and while edible, each was a variation of "pizza" and not Pizza.

<comment><USER5> > _... with these massive, incredible 1.5 pound burritos..._

This is the "Mission-style Burrito" ([https://en.wikipedia.org/wiki/Mission_burrito](https://en.wikipedia.org/wiki/Mission_burrito)). I first encountered them in San Francisco in 1997, where I found them to be quite a novelty, even though I was coming from Texas and had a more than passing familiarity with burritos.

Chipotle has now popularized them nation-wide, of course.

</comment></comment></comment></comment><comment><USER6> "as time went by, a dish tended to become sweeter, spicer, and more complicated."

Feature creep!

<comment><USER7> The original requirements were for bread and meat. With an optional drink of water if there was time and it came in under budget.

</comment></comment><comment><USER8> one of the truly frustrating things about renaissance and medieval recipes is that they are shorthand notes, not detailed instructions. Think inferring documentation from commit messages, basically.

i found a 15th century recipe for a particular kind of soup that started "make soup as normal;in addition add ..."

<comment><USER9> You don't have to go back to the middle ages for that. I have a recipe book with recipes from my grandmother and her contemporaries which are often just lists of ingredients. Knowledge of how to assemble them is assumed. Even some of the ingredients already aren't what you think. "Sour cream," for example, is naturally soured (spoiled) cream, not the stuff we now buy in the grocery store.

<comment><USER10> Just a little correction, naturally soured cream isn't spoiled but is fermented by lactic acid bacteria that occur naturally in raw milk. To sour pasteurized cream you don't let it spoil, but introduce the right kind of bacteria.

<comment><USER9> Yes, I know you are correct. I choose the word "spoiled" as a shorthand for the fermentation process. It is "spoiled" in the same sense that yoghurt and cheese are "spoiled" milk. Not entirely accurate, but perhaps more descriptive to those who don't know what it is.

In retrospect, I should have used "fermented" rather than "spoiled."

</comment></comment></comment></comment><comment><USER11> this is an interesting youtube channel related to this

[https://www.youtube.com/user/jastownsendandson/videos](https://www.youtube.com/user/jastownsendandson/videos)

<comment><USER12> A 17th century whisk is a bunch of small sticks :).

<comment><USER13> Like animal whiskers still look.

<comment><USER14> Huh... I just assumed "whisk" was an onomatopoeia. _whiskwhiskwhiskwhiskwhiskwhiskwhisk_...

<comment><USER13> You assumed right. The cat's whiskers were named after the _whiskwhiskwhisk_ whiskers.

</comment></comment></comment></comment></comment><comment><USER10> Was hoping for a little more concrete research or recipes. I work in the food industry and history is one of my favourite topics as well. My grandmother was Ukrainian and lived on a farm, and her cooking was based 100% on ingredients that came from very close to their farm, as well as processed in a non- industrial setting (cabbage fermented in a barrel, natural sour cream, farm animals that were killed behind the barn, etc...). The taste was certainly different than industrial foods. Now going back in time there were no gas or electric ovens, people mainly cooked on wood fired hearths, which would have given a different flavour. Not to mention lack of refrigeration would mean more salted and cured meats and less fresh meat. It is certainly an interesting exercise to try to recreate old tastes, but not really possible. I'd guess we can come close though.

</comment><comment><USER15> If you like this, I can't recommend the BBC's "Supersizers" enough. The pair is super funny as they re-create and re-eat historical foods.

[https://en.wikipedia.org/wiki/The_Supersizers..](https://en.wikipedia.org/wiki/The_Supersizers..).

More Claret!

</comment><comment><USER16> The author unfortunately concludes at the bottom that it's impossible to know what the foods really tasted like:

> These early modern foods are culinary false friends. They seem like they'd > be the same as our familiar correlates. But we can't be sure that they > tasted the same.

> Like so much in history, they're so close, yet just out of reach.

There are several reasons, probably the most important being that the cultivars of plants they used at the time were so different that we can't know what they tasted like. Heavy selection and breeding over the course of 500 years changes a lot.

</comment><comment><USER17> Apropos: Wikipedia has articles on topics like Ancient Roman Cuisine, Ancient Israelite cuisine, etc.

</comment><comment><USER18> What do they mean by "squash" (on the map)?

<comment><AUTHOR> The cucurbita genus of vegetables: [https://en.m.wikipedia.org/wiki/Cucurbita](https://en.m.wikipedia.org/wiki/Cucurbita)

<comment><USER18> Non-mobile link:

[https://en.wikipedia.org/wiki/Cucurbita](https://en.wikipedia.org/wiki/Cucurbita)</comment></comment></comment>


Show HN: Flint – The filesystem linter in go - <AUTHOR> https://github.com/z0mbie42/flint <comment><AUTHOR> Hi, author here.

This is commonly accepted that naming convention and style convention have no place in code reviews so we invented style linters (eslint, prettier, golint...).

But what about filenames and directory names ?

Here is the reason of flint: have a consistent naming convention among your files and directories in your projects.</comment>