Launching Fluther.com - Comments from YCers? - jobenjo
http://www.fluther.com
======
jobenjo
It's similar to Yahoo Answers or Ask Metafilter, with some new twists like
real-time discussion, questions filtered for you, and IM integration.

Now that we finally completed it we're climbing out from our cave and
wondering if the site can fly, and how we help attract people to it.

Any comments or advice?

Link: <http://www.fluther.com>

~~~
iamyoohoo
So why would I use fluther.com instead of yahoo answers which has a lot more
people answering. What is the unique proposition now that there are several
others like askville.com (from amazon) and others that have significantly more
traffic ? I want to answer the question, but didnt want to join another site -
why can i not answer anonymously ?

Just pointers to questions I ask myself as a potential user

Hope it helps ...

~~~
jobenjo
Yeah, that's useful to hear. Right now, certainly our user base is much
smaller than the big guys, but that smallness also gives it a real sense of
community--plus lots of our users are quite smart. This is a challenge,
though.

As far as anonymous questions/answers, we've thought about it a lot and we
think it's a necessary tool in maintaining the community and ensuring people
take it seriously. But it wasn't an easy call.

Thanks for the feedback.

------
maxklein
By the way, I have an idea for you as to how you can differenciate yourself.
This idea will seem silly, but it's something I've wanted for a long time.

I use ask.metafilter.com. I'm a daily user. What is really the worst thing
about it? There is no sense of community. The site forces you to stay relevant
to the question, and you cannot interact with the users directly. You cannot
go offtopic, even though many questions just BEG to go offtopic. Think of how
usenet used to be. After a while, you knew all the regulars, you knew the
personalities, etc. ask.metafilter does not have this because no real
discussion is allowed, just answers to the question.

Of course, it's clear why they do this. If you allowed discussion, the answers
will become irrelevant.

I have an idea how to solve this problem:

Make each user have a personal "space", "blog", "diary", "miniblog", "question
area", "twitter" or whatever you want to call it. When an answer goes off
topic, it's moved to the personal area of the user. There, the person can rave
and rant as he wishes, and the threads can go in any direction he wants.
People can also cross link their answers on frontpage items into their
personal area.

This is going to unfocus your site, but you will create a REAL community. The
frontpage Q&A; will be just as relevant, but behind scenes, there will be a
lot of general chatting going on.

A bit like the diaries of K5 or the journals of Slashdot.

Do so, and you'll have a winner. A BIG site. Don't do so and in 6 months,
you'll have Alexa of 60.000 and having $700 a month.

And when you get big with this idea, don't forget to send the check to maximus
klein at gmail.

~~~
maxklein
And by the way, another idea you should follow up on: Occasionally, people
post these really interesting questions about breaking up with their boyfriend
or something. WE ALL want to know how it goes on. What happened next!? But it
never comes, because we lose track of the question. One should have this
question as a sort of miniblog or so, so people can post updates, and the
interested stay subscribed to the blog. People get notifications that an
update or so has been posted.

This is gold I'm giving you here. If you don't get it yet, someday, someone
will, and that person will have a huge site.

The core philosophy I am pushing here is that you should not disassociate the
person from the question. Human life is all about social interaction.
Metafilter kills the social interaction. You should weave it in. Each question
should have the capacity to be a mini story, leading to further questions and
so on, till you have an interwoven mesh of question and answer, cliques and
groups, and real friendships developing on the site. Mirror humanity where you
want people to flock to.

------
imp
Pretty good looking. It could be a nice community. Here's my thoughts on
improvement:

Put the active questions on the top of the home page instead of a big blank
form. I really didn't know what I was supposed to ask a jelly-fish the first
time I loaded the page. Try easing visitors into contributing to your site.
They're first going to only read questions, then they'll reply to them, and
then they'll start asking their own. Make browsing the first thing to do on
the page.

~~~
jobenjo
Hmmm, this is interesting feedback. One reason we put the ask in the forefront
is to help make it obvious what the site's about, plus to encourage new
questions (which is also the best way to get into the site).

But I see what you're saying about flow. I'll have to digest this one. Thanks.

------
iloveyouocean
An idea to differentiate and make some money: Take the questions that have
good and well thought out answers and then figure out which products/services
the answers pertain to.

Example: What is the best alarm clock?

Keyword them and also figure out which Google Adwords they fit with. Also,
create an appropriate affiliate link to the product/services mentioned in the
answers. Have a script that buys the appropriate Adwords and creates a link to
the product that was chosen to be the 'best'. When people search for "alarm
clock" on Google they see an ad for the question/answer/discussion at Fluther,
they go there to read about it, then buy it via the link. You earn affiliate
commissions. Also, you establish yourselves as the "useful, action oriented
answer site". Or whatever.

There are many obvious permutations of this scheme.

~~~
jobenjo
This is an interesting idea... I worry that the outgoing revenue would not be
enough to offset the adword costs, but it's something to consider.

------
maxklein
You seem to have a fixed idea, and you are not listening to feeback. You have
a concept, now learn from your users.

Make it that answering a question is possible anonymously with a captcha. To
ask a new question, you need to register. You'll hold on to more users this
way.

Don't be obstinate. You don't know best. Everyone here is saying the same
thing about anonymous answers, do listen.

------
cmars232
Nice design, I like the wallpaper on the edges, the borders around the form
fields. Also the h3 Rockwell font, don't see that one too often.

------
jsjenkins168
The interface is pretty slick looking. However, I would size down the fonts a
bit.. they are slightly large for smaller monitors IMHO.

Fluther is a bit hard to say but its unique and sufficiently catchy. I would
stick with it.

To expand you should try attacking some focused niche areas.. Make it highly
useful to a small group of people first.

Good work

~~~
lizherring
Don't touch the fonts. They're perfect. The bigger font gives the feeling of
simplicity, don't lose that.

If you allow anonymous posting (and manage to control spam at the same time),
you could have a winner. People hate to register to do a simple thing like
asking or answering a question.

The UI is nice and easy to use. Great job there.

------
dfranke
A couple interface suggestions:

1\. Let me disable live preview. It seems to slow down my entire system.

2\. Show me a list of all questions I've answered, not just those I've asked
or that I'm specifically monitoring.

~~~
semiotomatic
Great feedback. You can view a list of all the questions you've answers under
accounts activity you're following. We'll look into simplifying that
navigation.

------
tocomment
How well is the "Tell a friend" feature working out for you?
(<http://www.fluther.com/tellafriend/)> How many people use that?

~~~
semiotomatic
Tell a friend has been a great boon to our traffic -- especially because we
present an interstitial after your third visit. It's significantly boosted our
new user registration.

~~~
tocomment
I'll have to do that then. What is an interstitial?

~~~
semiotomatic
We basically have a funny upsell for tell a friend on the site when you log in
after a few days. It's similar to mozilla's "spread firefox" message on the
moz FF homepage.

------
byrneseyeview
Slick design -- I especially liked the serene, nerdy Cthulhu in the corner.
I'm not sure a real-time question preview is especially useful, but it sure
looks good.

------
tx
Great looking site. The idea... in spite of tons of very similar sites out
there... A little weak. Unless I am missing something.

Good luck though.

------
brianmckenzie
I answered a question, thus I had to register. Twenty minutes later, my answer
has not appeared.

Did I do something wrong? Doubtful.

~~~
semiotomatic
Brian, That's troubling -- we haven't seen that problem before.

If you email me at andrew /at/ fluther.com with the discussion I can see what
went wrong.

Sorry you had trouble with the site.

------
tocomment
There seems to be no way to see a list of answers I've posted. Am I missing
something?

------
danielha
Nice -- I love the design and feel.

------
pramodbiligiri
OpenId Integration, definitely.

~~~
semiotomatic
We totally agree -- OpenID integration is in the works.

------
tx
I would seriously consider _not_ requiring people to get an account in order
to answer a question.

------
palish
Unfortunately, this idea doesn't scale. I hope all the best to you and
millions of greens, though.

~~~
danielha
Yahoo! Answers is doing quite well.

------
yubrew
fluther is such a hard name to say. <http://www.grabagooddomain.com/> (taken
from davidw's comment)


Show HN my christmas project: Focus.app, cut off your Internet so you can focus - benofsky
http://therealfocusapp.com/

======
callahad
The comment on FocusHelper's allowAllOutgoingExceptions is pretty amusing:
[https://github.com/benofsky/Focus.app/blob/master/FocusHelpe...](https://github.com/benofsky/Focus.app/blob/master/FocusHelper.m#L69)

~~~
shadowpwner
If the guy who wrote the comment ever reads this, it's "brightened". :)

~~~
benofsky
ha, it looked wrong at the time, thank you :)

------
toisanji
this is already available, SelfControl, its open source and I use it all the
time: <http://visitsteve.com/made/selfcontrol/>

~~~
zenspider
and freedom: <http://www.macupdate.com/app/mac/27958/freedom>

------
Detrus
Isn't there an OSX app that does this?

I remember people on an extremely distracting forum using it, ultimately it
doesn't work. Those same people are still spending a lot of time on that
forum, they've stopped turning it on.

~~~
grep
SelfControl

~~~
benofsky
Hadn't seen that, only a pay for app (and I'm cheap :))! Anyway, Focus is
tailored perfectly for me, hope some other people can find use out of it too.

Edit: Clarification (I'm sorry I can't reply to your comment, it won't let
me), I meant I had only seen a pay for app and not this one.

Edit 2: (reply to comment also) also doesn't appear to have exceptions, maybe
I'm wrong.

~~~
wtn
Self Control does the same thing and it's been open source on Github since
March 2009.

<http://visitsteve.com/made/selfcontrol/>

------
benofsky
Please be careful, I intentionally made there to be no easy way (it can
actually be reversed in one command but not in the interface) to re-enable
internet access before the timeout. Hope you like it!

Github: <https://github.com/benofsky/Focus.app>

------
alanh
I can’t seem to add an exception.

Edit: Literally clicking [+] does nothing, so there’s nothing to save. I’m
also not convinced 5 is enough: I want dropbox to be connected, github, our
bug tracker, our team chat, my email, and basecamp — that’s 6 already.

~~~
benofsky
Ok, quite a few people are having this problem. I'll have a fix soon
hopefully!

EDIT: It's working now download the new version at:
<http://therealfocusapp.com/focus-alpha-0.1.app.zip> — thanks to all who
helped fix!

------
nestlequ1k
A really nice paid alternative (I use it every day) is
<http://getconcentrating.com/>

------
markbao
I can confirm that this method is a pretty effective method for getting me off
Twitter and on TextMate.

------
brc
I actually use my hosts file, and block all the common time wasting sites I
like to waste time on. There is no time period - the sites are off limits for
the computer, period.

I have another computer in another room for time-wasting - with no
restrictions. But sitting there is acknowledging that you're wasting time. You
can't fool yourself or anyone else that you're being productive, otherwise
you'd be at the 'real' computer.

I find this to be far more effective than a periodic-blocking application.
Because anything you can turn off with the click of a mouse, will get turned
off just when you need it the most. Editing a hosts file is a major PITA in
comparison.

~~~
benofsky
This cannot be turned off with a click of the mouse (see my warning below) :-)
— although, one who spent 5 minutes reading the source, could turn it off! But
still, not click of the mouse.

And yes, a second time wasting computer would be ideal but ye I don't have one
:)

------
barredo
First, great app.

I use SelfControl.app, because when I need to focus, I need internet access
JUST to the sites/domains/IPs I work with.

Benofsky, is there a posibility to add a whitelist of IPs/domains to this app?

~~~
benofsky
You may add 5 in the settings. :)

EDIT: Thanks btw!

~~~
barredo
Superb, you should make this feature clear on the site

------
pygy_
It looks excellent. I like the fact that you can specify an arbitrary time,
whereas SelfControl restricts you to 15 minute intervals.

It would be nice if it were scriptable (which SelfControl is).

[http://developer.apple.com/library/mac/documentation/AppleSc...](http://developer.apple.com/library/mac/documentation/AppleScript/Conceptual/AppleScriptX/Concepts/osa.html)

------
Void_
I don't think disabling internet connection will help you focus. If you want
to focus for some time, then you will.

Also, I made something similar just a week or two ago. It doesn't disable
anything, it just shows you an icon in status bar.

<http://zone.codingwithlove.com>

------
bricestacey
Found a small bug:

I set the default minutes to 15, yet when I go to start focusing the default
appears to be 60.

I thought maybe they'd go into effect after restarting the app, but no, it
still defaults to 60.

It does default to the last value of the Start Focusing form, so long as you
keep the app open.

~~~
benofsky
Ye there're some problems with the preferences, I'm working on it. Are you on
10.6.5 by any chance?

------
farhadabas
Does anything like this exist for Windows?

------
jfeldstein2
My computer comes with this built in: <http://cl.ly/3sRk>

------
squasher
Seems similar to Freedom: <http://macfreedom.com/>

------
ninguem2
ifconfig down; sleep 100000; ifconfig up (add parameters as needed) Does this
need an app?

~~~
jason_slack
Click a button or type all of that or run a shell script, hmm. I would
clicking the pretty buttons.

This app seems to work.

~~~
mrleinad
Ok, turn the previous command into a shortcut. Done!

------
bricestacey
When I opened it, I didn't realize it went to my toolbar. If you want this to
be used by a broader audience you should have a "run once" to let people know
how to use it.

~~~
te_chris
Yeah completely agree. I was looking everywhere, opened it twice, then,
scratching my head glanced randomly @ the tool bar. The prod version will
certainly need some sort of pointer to what's going on re: this. Config wizard
or similar i guess


New prosthetic hand gives amputee life-like sensation of feeling, gripping - hallieatrobohub
http://robohub.org/lifehand-2-prosthetic-grips-and-senses-like-a-real-hand/

======
colinlewis
Simply awesome


Show HN: Semantic Versioning for Natural Language - computerlab
https://github.com/ptsteadman/semver-for-natural-language
======
mbrock
This ties into a vague idea I have bouncing around my head about viewing
natural language works "structurally", especially in terms of premises,
arguments, conclusions, etc.

Analytic philosophers are pretty good at this already, as well as good science
writers and thesis authors.

They can present the high level "type signature" of their work: something
like, I assume the premises X, Y, and Z, (see books 1, 2, and 3 which argue
for these premises) and then deploy arguments of kind A and B in order to
strengthen the conclusion C.

Interpreted with a programmer's vocational damage, that text would be a
function from (X, Y, Z) to C, using A and B as implementation patterns or
algorithms, and recommending books 1, 2, 3 as concrete providers of the types
X, Y, Z.

(Some kind of hand-wavey metaphorical Curry-Howard equivalence extended to
rhetoric?)

~~~
computerlab
I like the phrase "programmer's vocational damage", I think there's often a
tendency to attempt to over-extend programming concepts to other realms (for
example, natural language). The irony is that a lot of the concepts used in
programming are abstractions of patterns from other fields.

~~~
mbrock
:) Here it makes sense to me partially because rhetoric and logic are closely
connected already—but I still want to avoid the trap of, like, using "Gödel's
incompleteness theorem" to prove that "you can't really know anything, man".


JavaScripts in the JavaScripts [pdf] - sctb
https://wingolog.org/pub/ffconf-2014-slides.pdf

======
Lerc
It's quite hard to follow without the associated talk.

I do recall past threads where JavaScript natives were rewritten in JavaScript
and shown to be faster, then they were shown to be non-standard because of a
heap of weird edge cases that have to be supported correctly. It hadn't yet
been shown that a fully standards compliant implementation would be faster.

I think a huge amount rests on slide 8 "No JS/C++ transition cost". It should
probably be the subject of significant analysis on it's own.

The calulation is min(Ctime + TransitionCost, JStime). Knowing all of these
values individually would give a better picture. Is it better to Minimize the
transition cost or eliminate it? It depends on how much less Ctime is compared
to JStime.

------
richdougherty
Here's a link to the author's blog post:
[http://wingolog.org/archives/2014/11/09/ffconf-2014](http://wingolog.org/archives/2014/11/09/ffconf-2014)

I really got into this stuff a while ago, even fixing a few bugs in Continuum,
an awesome (but fairly buggy) JS-in-JS implementation by Brandon Benvie:
[http://benvie.github.io/continuum/](http://benvie.github.io/continuum/).

For those who like this kind of thing, I compiled a little list of JavaScript
libraries for working with JavaScript:
[http://notes.richdougherty.com/2014/03/javascript-
language-l...](http://notes.richdougherty.com/2014/03/javascript-language-
libs-in-javascript.html). Let me know if you have any more suggestions!

------
ascotan
I stopped reading when I got to the part about js being faster than C++.

------
pconner
Is there a video of the presentation?

~~~
dreen
they will be here [http://2014.ffconf.org](http://2014.ffconf.org) at some
point i assume

excellent conference, by the way


Show HN: Find a co-founder or side project buddy - makemoves

Me and some friends just released a new app. It is matchmaking tool for thinkers and makers. It's a MVP(Native iOS - https://itunes.apple.com/app/id883667173)
We would love some feedback on the app before launching and going into the growth state. You can also read more about our vision here: http://www.makemove.se/
Have a nice one!
======
kbart
Interesting project, but iOS only? Is there any reason behind that? I don't
use it and don't intend to (as the majority of other geeks I know). Webapp
would be a much better choice imho.

~~~
makemoves
Good idea with the webapp. Thanks! / Makemove Team

------
arisAlexis
I would like to use it but of course I can't (iOS). You should really launch
these kind of MVP in a normal website accessible to as many browsers to have
maximum audience. Here you do the opposite and target a small percentage of
the world that uses iphones.

~~~
CalRobert
I have to agree - I know this opinion is unpopular but there are some things
for which computers are still ideally suited, and this seems like one of them.
Would I want to restrict my audience to the 15% or so of people who use iOS?
Why does this need to be an app at all, for that matter?

~~~
makemoves
Thanks for feedback! /Makemove Team

------
Vendan
Interesting idea, but literally everyone I know at the local hackerspace has
Android or (company provided) Windows phone. Any particular reason you are
only starting out with an OS commonly seen from programmers and computer folks
as locked down and impossible to play with? After all, your target audience
seems include people who enjoy messing around with hardware and software....

~~~
makemoves
Good point. Thanks! We actually aiming for all types of
entrepreneurs./Makemove Team

------
makemoves
For all the awesome people with android: Right now we will focus solely on iOS
and then come back with an amazing Android app when we feel that we are
getting more close to our vision with iOS. The reason for that is that we are
small team and we had to pick one device.

Thanks for your support!

/Makemove Team

~~~
tatalegma
I use android and don't have an iOS device, so I can't see your app. But even
if you made it an android app, I wouldn't use it because I don't see any
reason why I would install an app for this.

I think a website would reach the broadest audience, and I would actually try
it out.

~~~
makemoves
Thanks for your feedback Tatalegma

------
bluewolf
I would enthusiastically sign up for this, except I don't have an iPhone.

~~~
makemoves
Soon my friend / Makemove Team

------
N0user
Interesting idea, looking forward to try out the Android release!

~~~
makemoves
Thanks!! / Makemove Team

------
moubarak
out of my network and out of my location is what i'm looking for. My location
is my biggest problem and i need to be able to connect with people abroad.

~~~
makemoves
Cool! The app is both local and global. You can choose that yourself :)
/Makemove Team


Declaring C String Constants - eklitzke
https://eklitzke.org/declaring-c-string-constants-the-right-way
======
iainmerrick
There's a big mistake here:

      // Bogus function, just to see how arguments are passed.
      void bogus();

      // Invoke bogus using ptr.
      void do_ptr() { bogus(&ptr, ptr); }

      // Invoke bogus using arr.
      void do_arr() { bogus(&arr, arr); }

"&ptr" and "&arr" are not the same. &ptr gives you a pointer to a pointer
(char * *), but &arr just gives you a pointer to the array data. That's why
the code is different.

This would normally show up as a compilation error, since &ptr and &arr have
different types. It's disguised here by the variadic bogus() function.

(I didn't know that no-arg functions in C are implicitly variadic! That's
bizarre. I would have expected modern compilers to disable that by default,
but I can't get Clang to warn me about it even with -Wall.)

~~~
drt1245
Additionally, he keeps talking about dereferencing the pointer, which I don't
think is right. The pointer never gets deferenced in the code shown.

I'm not an x86 guru, but I think that "movq ptr(%rip), %rsi" is different
because ptr needs to be moved from relative to the instruction pointer
(because it is on the stack, as a non-const variable).

~~~
bonzini
It's a global variable, it's not on the stack. It's in the data section.

$arr is copying the address of "arr", so it must use an immediate move
(possibly 64-bit). It could also use RIP-relative with the "lea" (load
effective address) instruction.

$ptr(%rip) is accessing memory, so it uses RIP-relative addressing with the
"mov" instruction.

~~~
magnetic
> It's a global variable, it's not on the stack. It's in the data section.

And because it's a const, it's in the .rodata section... (read-only) Playing
too liberally with the data often leads to a SEGV (as it should).

------
tonyg
Interestingly, we get

            .LC0:
                    .string "Lorem ipsum"
            [...]
                    movl    $.LC0, %esi
                    movl    $ptr2, %edi
                    xorl    %eax, %eax
                    jmp     bogus

for the same experiment done with a const pointer to const data,

            const char * const ptr2 = "Lorem ipsum";

(Incidentally, this kind of thing is why I prefer to write 'char const STAR
const' rather than 'const char STAR const', and 'char const STAR' rather than
'const char STAR'; it systematically places the 'const's.)

(PS. HN really doesn't work well for trying to write either unicode or ascii
star characters.)

~~~
bsder

      char const * const ptr2 = "Lorem ipsum";

Edit: Said exact same thing as parent but formatted differently. Sorry. :)

------
eridius
All this talk about do_ptr being slower because it copies from main memory is
misleading. Yes, it's slower, because it's _doing something different_ than
what do_arr does. It's not just a slower version of doing the same thing. So
trying to compare do_ptr and do_arr makes no sense. And the whole thesis of
this piece, that declaring string constants as arrays is better, has no
supporting evidence. You know what's better? Don't dereference a pointer if
you don't need to. That's it.

~~~
sqeaky
Wasn't that sort of the point or using arrays instead of pointers? There is
less dereferencing to get to the data, so you need to dereference fewer
pointers.

I would like to see more empirical measurement in articles like this. There
has to be a reason both compiler decided to emit that pointer based code,
surely there is some advantage.

~~~
eridius
> _Wasn 't that sort of the point or using arrays instead of pointers? There
> is less dereferencing to get to the data, so you need to dereference fewer
> pointers._

No, and that's why the article is confusing. It makes it seem like that's true
but it's really not.

If you remove everything else and just look at passing the pointer itself, the
fundamental difference between the pointer version and the array version is
the pointer version isn't constant, and therefore has one level of
indirection. This is because you can reassign to the `ptr` variable. But the
array is constant, you can't reassign `ary`. All you really have to do here is
put `const` on the `ptr` variable and suddenly you get the exact same code. Or
in other words,

      const char * const ptr = "Foo";

behaves the same way as

      const char ary[] = "Foo";

And the only practical difference between the two at this point is how the
sizeof() operator works.

------
swolchok
Or you could just #define STR "Lorem Ipsum" and be sure that it's going to be
efficient.

~~~
std_throwaway
This is a joke, right?

~~~
DSMan195276
Why would it be a joke? Using `#define` for a string constant is perfectly
reasonable for C code, IMO I'd argue it's the idiomatic and best way to do it.
String constants that are `#define`d can take advantage of C's automatic
string-literal concatenation, allowing you to avoid lots of unnecessary string
operations in some cases. If you declare it as a pointer or array instead,
then you can't do that.

~~~
quotemstr
> Why would it be a joke?

A certain influential segment of the C and C++ development community, the kind
that tends to worship "best practices" and "consistency", has been preaching
for years that C preprocessor macros are evil, even in cases where they allow
for much clearer code.

I'm not sure these people were born with the ability to experience joy.

~~~
marcosdumay
The biggest problem with C macros is that they are too opaque. The compilation
stack will complain about code that is different from what you have, and leave
you with little hint about what in your code is generating the broken code.
It's also confusing when debugging.

That said, yes they can lead to large gains so when they are worth it, go for
them. Just mention in the documentation that they are macros, in big letters.

~~~
magnetic
> Just mention in the documentation that they are macros, in big letters.

The macros themselves are usually in BIG_LETTERS already... that generally
gives it away.

------
mnarayan01
As others have noted, this is a little bizarre as the two functions are doing
different things; one being less performant than the other is not really
surprising. That said, there can be advantages to using array syntax rather
than pointers for strings (even when also declaring the pointer to be
constant), e.g. the compiler "knows" the array "pointer" is non-null:

      extern const char arr[];

      void do_arr() {
        if (arr) {
          dummy();
        }
      }

allows the compiler to optimize out the conditional:
[https://godbolt.org/g/FwBeWx](https://godbolt.org/g/FwBeWx).

------
russdill
Other comments have already deconstructed much of the article, but I'll add
this. The primary factor will be your CPU architecture. Can you put the string
in the same cacheline as the code or an adjacent cacheline? If so, awesome.
However, if you have a microcontroller with a harvard architecture, such as a
cortex M3, it's may be better to put your strings in data memory rather than
code memory. The processor can simultaneously load your string and the next
instructions via the two memory ports.

------
petters
The author took the time to write a blog post, but not trying the code for
anything else than that bogus() function. Had they done that, they would have
realized their mistake.

------
droithomme
Arrays and pointers are not the same in C, nor have they ever been. The
difference is more than that of mere syntax choices for equivalent concepts.

In the pointer version of the code, the pointer is reassignable. Only the data
it references can't be modified, the pointer can. To prevent the pointer from
being modified, the declaration should have been:

const char * const ptr = "Lorem ipsum";

With the array version, there is no pointer to be modified and so no need or
ability to have a second const.

------
kccqzy
Another difference: if you use sizeof, the pointer version gives you the size
of a pointer, but the array version gives you the actual number of bytes in
the string.

------
carlsonmark
While I do enjoy this sort of analysis, I feel the decision to choose one
method over another should be based on benchmarks (preferably with more than
one size of string.) After benchmarking, then do an analysis of the assembly
code.

Guessing about pipelining, memory access times, and the effect of generated
code size is much less valuable than real measurements.

~~~
a_t48
Beyond this,

      &ptr

and

      &arr

are different types! The signature for

      bogus(arr, &arr)

is something like

      void bogus(const char* arg1, const char (*arg2)[12])

While they do point to the same data, it's pretty rare to actually want to
declare a

      const char (*)[N]

as a function argument - template magic code excepted, you don't gain much
over a

      char *

and it's not the same as a

      char**

The two lines do different things, so of course they will generate different
code. What do you know, the one that actually lets you do useful things is a
few bytes longer.

------
bsder
What I find funny is that through all this he never actually mentioned the
fact that sizeof() a string constant _includes the NUL character at the end_.

This has bitten me more times than I care to admit.

Nowadays, I almost always use the array form and actually declare my strings
character by character so that I _see_ the NUL if I actually meant to use it.

------
mark-r
I wonder how the results would have differed if those were automatic variables
instead of static? That's a much more real-world situation. You wouldn't be
able to ignore the overhead of re-initializing the array, since it would be
occurring at run time instead of compile time.

------
Analemma_
Any programming language that needs an entire blog post about how to declare
string constants "the right way" is a programming language that needs to
disappear.

~~~
torstenvl
Any poster that needs to post comments about how any language requiring real
understanding needs to disappear needs to disappear.

~~~
irundebian
Haha, real understanding. Any language which requires a standard of 700 pages
should be seem suspicious. And any language, which lead to thousands of
vulnerabilities needs to disappear.


Authentication and the Have I Been Pwned API - mhaehnel
https://www.troyhunt.com/authentication-and-the-have-i-been-pwned-api/
======
MattConfluence
Frankly, USD3.50/month for API access is still an incredible bargain for a
service of this quality. Normal users can still use the webpage form to look
themselves up for free, API users pay a nominal fee that should cover the cost
of the resources they consume.

The only concern I can think of is that this opens the gate to raising the fee
in the future to profit from it, considering that Troy is "selling out" soon
[1] and will not be in control of the service for ever. HIBP is the kind of
service I think ought to be provided by a non-profit entity. But Troy's record
is good, so I have faith that he will do his best to pick a good new home for
HIBP.

[1] [https://www.troyhunt.com/project-svalbard-the-future-of-
have...](https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-
pwned/)


Change Your Old Amazon Password Now To Avoid Cracking Risk - fwdbureau
http://consumerist.com/2011/01/old-amazon-passwords-have-big-security-flaw.html?utm_source=twitterfeed&utm_medium=twitter
======
mdaniel
Is it short-sighted of me to think that a web presence the size of Amazon
would have detection measures in place to notice a brute force attack, or are
the so busy that one can hide in the noise?


Top 25 Most Dangerous Programming Errors - darragjm
http://www.sans.org/top25errors/?cat=top25

======
brianto2010
This article has already been posted here.

<http://news.ycombinator.com/item?id=431063>

<http://news.ycombinator.com/item?id=430577>

<http://news.ycombinator.com/item?id=431995>

<http://news.ycombinator.com/item?id=432996>


Beijing struggles to defuse anger over China's P2P lending crisis - lnguyen
https://www.reuters.com/article/us-china-lenders-p2p-insight/beijing-struggles-to-defuse-anger-over-chinas-p2p-lending-crisis-idUSKBN1KX077
======
21
In the last 5 years retail Chinese investors had massive losses in bitcoin,
gold, the local stock market, bitcoin again, now P2P.

Is it fair to say that they rush from one investment fad to the next,
typically buying the top? This is how it looks from far away, can someone with
local knowledge comment?

[http://static.atimes.com/uploads/2015/07/retail-
investors.jp...](http://static.atimes.com/uploads/2015/07/retail-
investors.jpg)

~~~
SuoDuanDao
I remember a significant anecdote about Chinese assumptions when a Chinese-
Canadian I was dating explained she always goes to busy restaurants on the
assumption that a lot of customers means they have good food. The western bias
is towards being the first to discover an unknown restaurant with great food
that just hasn't had time to build a reputation, but that's not how a typical
Chinese person would approach the restaurant problem.

Abstracting that decision-making style to retail investing in a country with a
bias towards savings, and the nature of Chinese equity markets makes a lot of
sense.

~~~
sremani
>> always goes to busy restaurants on the assumption that a lot of customers
means they have good food.

It is actually good heuristic, I would just modify it ever slightly.. lot of
customers means that they will not serve "stale" or yesterday's food.

~~~
finebalance
That's actually a very useful heuristic because, unlike perhaps in the US, in
many parts of the world food standards even in higher quality restaurants are
rather lax.

~~~
Larrikin
Even in the US I learned the hard way about eating lunch early. Chipotle is
perfectly fine with serving old steak from yesterday if you're one of the
first customers of the day.

~~~
reaperducer
I was told once that Wendy's chili is made from the hamburgers that weren't
sold the day before. I don't know if it's true or not, though. Even if it is,
that's some fine chili for a chain fast food restaurant.

------
vfulco2
There is a huge structural issue when investors of all asset classes believe
the central government will bail them out. It happens to a vastly lesser
degree elsewhere. We saw the folly of it in the US in 2008.

~~~
bilbo0s
I don't know if the structural issue was people _believing_ the US government
would bail them out. The issue was probably more that we _actually_ bailed
them out. I can't really blame rich and powerful bankers for thinking we were
gonna do something that we normally do for them.

Stop bailing them out, and they'll stop believing they're gonna be bailed out.

~~~
koboll
If we're in a position where the options are a bailout or the catastrophic
collapse of the world economy, we've already failed.

This is why regulation is necessary.

~~~
maxxxxx
"bailout or the catastrophic collapse of the world "

In 2008 this is what the bankers told us but are these really the only
options? I have my doubts.

~~~
cm2187
I worked for one of the large banks that got out of this crisis pretty much
unscattered. The Friday before TARP was introduced, which ended the succession
of large banks collapses in the aftermath of Lehman, we were told internally
that we didn’t think we could last more than a couple of weeks in the current
market. And if we only had a couple of weeks left, most of the other (weaker)
institutions had much less.

Like for the cuban crisis, I think it is easy to forget how close we got to
the brink. We have already witnessed a complete collapse of the banking system
in 1929, in a world that was much less inter-dependent than it was in 2008. It
is survivable but it is ugly.

~~~
maxxxxx
Nobody wants a banking collapse. The question is whether the people who caused
the collapse and profited greatly should get bailouts and keep their money.

In my view the government should have supported the system but not single
banks. Let them go down and make sure that executives end up with zero money.
Their lifetime contribution to the economy was negative so their bank accounts
should reflect that.

------
dmortin
I wonder if the average Chinese is aware of these problems if not affected by
them directly. If it is not reported in media and you don't know anyone who's
affected then how would you know about this?

And knowing about is this important, so you don't put your money in such an
investment.

~~~
yellowcherry
It's reported in the Chinese media almost daily right now.

~~~
pentae
Probably not the part about protestors having their doors kicked in and being
rounded up and put into holding centers, I imagine. This is probably the most
important thing people should know about.

~~~
lozenge
Chinese people know that protesting is illegal and that their government is
oppressive. It largely doesn't matter to them because they don't want to
protest.

How they are investing their life savings is clearly the more important thing
they should know about.

~~~
dmortin
There are many protests every day in China, so people do want to protest, but
many people don't, because they are afraid of repercussions.

If peaceful protests were allowed then much more people would go to the
streets to protest.

------
everybodyknows
For longer historical context, check out the inglorious record of prosper.com,
here in the U.S.

------
Animats
It's striking how terrified the government of China is of protests.

------
ruang
So it's the responsibility of smart investors to bail out dumb investors?

~~~
atr_gz
The government, including Li Keqiang, was officially promoting this industry a
few years ago. The government also tightly controls the flow of information in
China, keeping people from seeing alternate opinions. In addition to that,
tight currency controls mean the middle class is starved for worthwhile
investments.

I don't know whether these people should be bailed out or not (the companies
definitely shouldn't be), but I can see why they're upset with the government.
It's not really the same situation as in the US.

~~~
baybal2
>In addition to that, tight currency controls mean the middle class is starved
for worthwhile investments.

But that is kind also the only reason China is not completely sank in the
saving glut. They want to make it appear to people that they have no better
alternative to use their money than just spending it right away.

This is one of reasons that a thing as bizarre as that bitcoin took off her.

In reality, Chicoms have no effective way to stop capital bleed. The learned
that the stronger signal they send that "tomorrow it will be harder to get
your money out of the country," the more money actually leaves.

All kinds of eCurrencies is one side of that, but insane loan schemes is
another: the current most popular funds exfiltration scheme is following - a
guy loans money to some fund in China, and in exchange gets an interest free
or very low interest rate load abroad. The fund then finds more a legal front
for "investing abroad" or just bangs money away inside China on pump and dump
schemes.

It is borderline tragicomic that whatever seemingly makes sense,and made in
good faith policies made up by Chinese government end up acting with opposite
effect:

1\. The 50k USD limit on foreign remittance - actually aggravates capital
flight, by sending the signal that domestic capital markets are so bad that
government has to resort to such extreme measures.

2\. Prohibition on private ownership of major assets (real estate, land,
mining licenses, ownership of private business over the revenue limit, sea ad
aircraft, and on) - was made to ease saving glut, by making people rent that
stuff rather than own, but... you know: an average Chinese citizen save like
crazy just to get the 50 year rent.

3\. Salt tax - apparently is still being kept to force people buying Iodinised
salt, but everybody knows where to buy salt around the state monopoly

And on and on and on

~~~
bobthepanda
The problem is that China's economy is based on keeping the genie in the
bottle. The moment they let it out, all hell will break loose, and it'll be
1998 all over again.

------
bitxbit
I really don't understand what the Chinese gov't expects when they are trying
to control damn near everything. I honestly believe they are convinced they've
successfully hacked capitalism.

------
bayesian_horse
A bank is a bank, even if it's not called a bank.

This kind of wild west capitalism will eventually halt or at least stifle
Chinese progress and growth, just because the risks of investments is too
large.

~~~
berbec
I don't think the risks aee two large it's that the people putting the money
aren't properly informed/educated. If you want to lend to people who have a
50% default rate, feel free! Just make sure there is an actuary who can help
you manage your risk. I doubt these p2p companies were helping people weigh
risk.


Paul Allen, Microsoft’s Co-Founder, Is Dead at 65 - Bud
https://www.nytimes.com/2018/10/15/obituaries/paul-allen-dead.html
======
ksenzee
Discussion of Paul Allen's death at
[https://news.ycombinator.com/item?id=18224227](https://news.ycombinator.com/item?id=18224227)


Do Not Track Me - hanspagel
https://scrumpy.io/blog/do-not-track-me
======
luckylion
> We don't use tracking. For example, there is no Google Analytics installed
> in this blog.

Sure, but there is Google Analytics installed on the main page. "We don't use
tracking ... on this particular page where we boast about not using tracking"

~~~
hanspagel
You're right, we have to remove it there. We removed it from the app a year
ago and the blog is new and never had Analytics or similar tools.


Postmortem on Steambirds and the Flash game industry by Andy Moore - benologist
http://www.casualconnect.org/content/Seattle/2010/steambirdsseattle10.html

======
benologist
There's also a great breakdown of his monetization of the game here:

<http://www.andymoore.ca/2010/03/steambirds-by-the-numbers/>

And of course the game:

<http://armorgames.com/play/5426/steambirds> or

<http://www.kongregate.com/games/weasello/steambirds> with badges


TikTok Agreed to Buy More Than $800M in Cloud Services from Google - jmsflknr
https://www.theinformation.com/articles/tiktok-agreed-to-buy-more-than-800-million-in-cloud-services-from-google
======
arvinaminpour
TikTok seemed to run off of Alibaba Cloud (from what I read which may be
wrong) so it's an interesting move to buy Cloud Services from Google. I
probably read this as a way of strengthening the case that they're an
"American" software company since they run on the same infrastructure as any
SV startup.

~~~
ed25519FUUU
According to Chinese law, the government can quietly demand any information
they want on anyone. A warrant in China? Hah.

All they have to do is say "Give us the data stored on GCP host" and TikTok is
legally obligated to comply.

To be fair, it's not much different than in the United States unless the data
belongs to a US citizen, which is why many companies are attempting to
domicile cloud data in their own country.

~~~
russli1993
Tiktok' parent is bytedance is incorporated in Cayman islands. It has a US and
a Chinese subsidiary. Chinese subsidiary runs douyin is subjected to the
intelligence law. The US subsidiary runs tiktok and is managed by US employees
and is not subject to the same law. The intelligence law would be problematic
if bytedance is incorporated in China but it's not. The data and the code for
tiktok is stored in the US and Chinese subsidiary cannot view that data.

~~~
fiblye
>The US subsidiary runs tiktok and is managed by US employees and is not
subject to the same law.

Which leaves us with the question as to whether or not the government cares
what the law says or whether they would back down if employees in China said
they can't easily hand over foreign data.

~~~
justicezyx
Eventually tiktok will run anything that is remotely sensitive inside us soil.
That has already began.

------
bigtones
For comparison, another reference GCP customer is SnapChat who signed a 5 Year
$2 Billion dollar contract with Google Cloud, as they disclosed in their IPO
Prospectus. At that time (2017) they were by far the largest single customer
on the Google Cloud Platform by spend. They spend the majority of that on App
Engine, Cloud Storage, BigQuery, and bandwidth.

Even after this disclosure of the TikTok $800M Agreement - SnapChat is still a
much larger customer in spend per year.

[https://www.vox.com/2017/3/1/14661126/snap-snapchat-ipo-
spen...](https://www.vox.com/2017/3/1/14661126/snap-snapchat-ipo-
spending-2-billion-google-cloud)

------
baskire
Makes sense. It ensures google faces repercussions from removing tiktok from
the Android play store.

~~~
badrequest
This deal is from May 2019, well before anybody was talking about banning
TikTok.

~~~
kutorio
It's not hard to imagine them planning ahead. In fact you can argue that the
parent company ByteDance has planned for such existential risk by setting up
TikTok as a separate entity from Douyin.

~~~
justicezyx
That of course was the case. Mega corporations are as powerful as small
sovereign nations, they have to behave like one...

------
ArtWomb
I believe it. 1B daily users globally. Processed events per day probably
somewhere in the trillions. In case you missed it, they recently shared some
details on their algorithmic curation system ;)

[https://newsroom.tiktok.com/en-us/how-tiktok-recommends-
vide...](https://newsroom.tiktok.com/en-us/how-tiktok-recommends-videos-for-
you/)

~~~
soared
No chance they have 1B DAU. That doesn’t pass the sniff test.

That’s like 1.5B MAU, which is even more ridiculous. But let’s look.. 7
billion people, 4.5B have internet access. So more than over 15% of humans
with internet access are using tiktok every day.

3.5B humans have a smart phone, so 1 in 3 are on tiktok every day? Nah.

And honestly, I’m fairly even on china but I don’t really believe numbers the
put out for most things.

[https://www.statista.com/statistics/617136/digital-
populatio...](https://www.statista.com/statistics/617136/digital-population-
worldwide/)

[https://www.bankmycell.com/blog/how-many-phones-are-in-
the-w...](https://www.bankmycell.com/blog/how-many-phones-are-in-the-world)

~~~
gibolt
1.5B MAU is not unreasonable. A majority of Chinese users are using it. It is
superfluous when you ride the subway or eat in a restaurant. Everyone. That
alone could be .75-1+B.

Then you only need a relatively small percentage of the rest of the world to
reach that number.

Just because you can't see it, doesn't mean it is not real.

~~~
ponker
> superfluous

I do not think that word means what you think it means.

~~~
fragmede
I’m guessing they meant “ubiquitous”

~~~
perl4ever
Mellifluous?

------
scarface74
Just for reference, GCP earns $10 Billion a year and this deal is $800 Million
over three years. Whether this is a big deal is an exercise for the reader.

[https://www.zdnet.com/article/google-cloud-
hits-a-10b-annual...](https://www.zdnet.com/article/google-cloud-
hits-a-10b-annual-revenue-run-rate/)

~~~
pcl
That comes to 2% of this year’s revenue. I’d say that’s a pretty big deal. I
can’t imagine Google has many individual customers representing more than 2%
of revenue. Math says that at the least, they are one of the top 50 customers.

~~~
scarface74
There are two types of customers that every B2B company wants - customers that
bring in a lot of money and “referenceable” customers that are willing to
stand up on stage and have their companies listed in marketing documents.

TikTok being referenceable means a lot more so sales people can go out and
tell CxOs “look we are a safe choice because $x company trusts us”.

Disclaimer: Just in case I get called out. I work for AWS consulting but I am
so far removed from the sales process it’s not even relevant. All opinions are
my own. I’ve been in the room more when “enterprise deals” were being made in
smaller B2B companies.

~~~
aubeards
nice!!! let's get this referenceable asap!

~~~
scarface74
Yeah. I’ve heard that a previous companies. I am afraid that I’m going to
become “that guy”....

------
cairoshikobon
Am I missing something? The article says this was a May 2019 deal. Why is this
news now?

~~~
yogue
Ditto^

~~~
andy_ppp
Interesting, I suppose a little reminder to Google not to remove Tiktok?

------
rwmj
I wonder if there is a salesperson getting an insane commission from this
transaction.

More generally/seriously how exactly does this conversation go? I've seen
deals at my company which have been in the 7 figure range (involving many,
many people) but never anything so large. Is this the kind of thing discussed
only at C* level?

~~~
Joe8Bit
I was tangentially involved as a consultant when a major bank bought a few
billion USD in GCP services.

Others have mentioned whole 50 person deal teams from both sides, multi year
processes, all of Google’s most senior execs pressing the flesh etc.

But to your question this type of deal usually goes beyond even the C Suite,
to a companies board and shareholders. The bank I was involved with held an
‘Extraordinary General Meeting’ for reps of major shareholders, to present its
case and get sign-off. This part of the process was actually the longest, it
took ~6 months.

That was because the shareholders of the bank had interests to be
accommodated, for instance one of them was also a major holder of Amazon stock
so they had a vested interest in having the bank choose AWS. They needed to be
worked around or convinced choosing GCP would create more value for them than
portfolio synergies.

~~~
swyx
that sounds like a conflict of interest if a board member's shareholding has
to be accommodated.

~~~
Joe8Bit
Wasn't a board member, it was a pension fund who held stock in the bank.

------
jonplackett
I think snapchat have a similar massive deal with Google.

It really does solidify a kind of class structure within these tech giants.
Google, Apple, Microsoft, Amazon at the top and everyone else, even massive
players like snap and tick tock are completely reliant upon them.

~~~
jonas21
That's an odd way to look at things. Google, Microsoft, and Amazon are in turn
reliant on Intel for the CPUs that power their cloud services. Does that put
Intel in a class above them? No -- it's just companies buying stuff from other
companies so they can focus on what they're good at.

* _and going one step further, all of these rely on a handful of janitorial companies to operate. so maybe the ABMs of the world are in the top class?_

~~~
tapoxi
Amazon has AWS instances running their own custom ARM silicon. It's not hard
to imagine Microsoft and Google doing the same, which will eventually become
dominant for cost reasons alone.

We'll have three platforms that control most non-Chinese computing. It's hard
for smaller players to compete with that kind of inertia.

~~~
dodobirdlord
Last year’s Gartner report concluded that less than 10% of cloud computing
workloads were running in public clouds. With respect to technology, most of
the companies of the world are consistently living 20+ years in the past.

It’s certainly hard to compete at running a public cloud, but it’s hard to
compete in any industry that requires $X00B capex to get the ball rolling.

------
varbhat
Aren't US going to ban TikTok?(i heard something like this previous week)

If US banned TikTok, willn't that decision affect TikTok? (like it affected
Huawei)

~~~
syshum
>>If US banned TikTok

Any attempt to ban it to the wider public would be immediately be met with a
legal battle that the US government would lose as there is no legal way for
them to implement such a ban, our constitution would forbid it

At most they could bar employees of the federal government (and its
contractors) from using it, which given the federal government is one of the
largest would have a large impact. Even that limited action however would be
met with a large legal challenge and would have a good chance of failure for
anything that is not a Government Computer / Phone / Network

~~~
parliament32
All they need to do is poke the Play Store / App Store the right way and,
poof, it's gone. They don't need to legally ban it, just send a strongly
worded letter.

~~~
syshum
Well given that Google is anti-trump I am sure they would not simply do what
Trump says.

Now if Biden was elected I am sure it would be different

------
jeffbee
Must be all on the backend because everything they serve that I can see flying
past is coming from either AWS or Akamai.

------
subsubzero
TikTok/Bytedance seems to be growing like crazy, I had three different
recruiters from that company reach out to me in the past month. I declined for
many various reasons, but mainly what would happen if they were banned in the
US which seems like it could happen( I would prb be without a job in short
order!). Would all US operations cease and a contract like this be voided and
refunded?

~~~
xvector
ByteDance pays INSANE compensation. Significantly more than any of the FAANG.
You should consider it.

------
ct520
If tiktok had was under the influence with Chinese government why wouldn't
think do this to keep things on the up and up. Look at us guys - we put data
in US. All good nothing to see here. (as china still can request whatever it
wants). I dont see the point in this.

~~~
rafiki6
I really think this is just a company that went to get the best deal because
the homegrown offering wasn't as competitive. I still think having TikTok
isn't in the best interest of the democratic west, but you're right. There is
not sinister play here.

~~~
ct520
Man my iphone really butchers my messaging with weird auto correct now and
days. Anyways I think you got the gist. Makes sense about best deal, thought
didnt cross my mind.

------
DevX101
TikTok could have had hosting for cheaper from Alibaba, but now Google has an
$800M incentive to keep TikTok alive in the U.S. Smart.

~~~
dodobirdlord
Alibaba has a whole 2 regions in the US, and they’re much smaller than AWS/GCP
regions. They are not a significant infrastructure player outside of China,
and an app like TikTok is high bandwidth and latency sensitive. It’s not
feasible to host something like that entirely out of datacenters in China.

------
rawoke083600
Wasn't one of the promises of cloud - "it will save us money ?" It's hard to
visualise the end result of "savings exercise" for ppl to put funny video's on
the internet is 800M /s :)

Yea I know they big and there is a lot I don't graps/knows about their system

------
fooblat
Google Cloud sales are very aggressive with discounts and offers. They offered
my company great prices vs AWS and they even offered to pay for local
contractors to do some of the migration work from AWS for us.

We took the deal and it's worked out well in both price and performance.

------
gowld
ByteDance runs two video services. One is TikTok, which runs on non-China
servers. The other is Douyin, a regular Chinese app. Of course TikTok is still
subject to Chinese law governing Internet services provided to foreigners,
which is cause for concern.

------
posnet
Interesting, I wonder what discount rate they are getting, or if 'buy'
actually just means 'use'. GCP was throwing discounts and credits at companies
not too long ago, if you were willing to publicly announce your move from a
competitor to GCP.

------
jyriand
I might have missed the train somehow. First time I heard about TikTok was
about half an year ago and now it's already buying services for 800M. How did
it get so big so fast or was it already huge deal in China before it reached
us?

------
leptoniscool
This might be a bit off-topic, but why is the US worried about Tiktok? They
only show short funny/interesting videos that have almost no political
content. If anything, apps like these bring people around the world together.

~~~
x3n0ph3n3
It's believed that TikTok scoops up more data from your device than you think
and is a major data collection source for the CCP.

~~~
hackerman123469
Not just believed but actually proved with reverse engineering. They even have
the app download remote files and executing them which no app should ever do.
(Only on Android since iOS does not allow that!)

~~~
Gigablah
I mean, downloading remote files and executing them is literally what every
web browser does.

------
caretak3r
It would be nice to have articles that don't force you to pay for a
subscription.

------
ngcc_hk
Money can buy you everything. The country is so poor that what is left is
money. Done. No; when is infrastructure is just a hardware where you run your
software. When is the software hack that push a button send info back to China
or analysing in American soil using American expert but helping communist to
slightly bias and ... Is an American firm can be trusted even. And a Chinese
controlled one?

------
coronadisaster
Makes sense, now the US Government also gets their data.

------
qserasera
Bribery always works at suppressing outrage and information dissemination

------
timvisee
This page presents me with an (email) paywall.

------
habosa
OT: Can we stop sharing The Information links on HN? They seem to have the
strictest paywall of anyone. I doubt many commenters here actually subscribe
which means we're just discussing the headline.

~~~
Nextgrid
I believe The Information gives out free access links to HN, or at least used
to. Maybe we just need to wait a bit for them to notice.

~~~
ocdtrekkie
I'm not sure if it's a specific policy for HN, but often for popular articles
they aren't too upset if a subscriber shares the full article. (Which we can
do.)

I think it's worth noting that The Information is an _incredible_ journalism
outfit that does incredible work. I subscribe not for access to the content
(which other sites reblog within hours), but to support legit journalists
doing real, original research.

------
techntoke
Explains why they ignore the obvious violations and still publish the app in
their store. Seems like a major conflict of interest.

------
coliveira
Good move. Google will think twice if it is a good move to remove clients from
their platform. I think TikTok has to show they cannot go around banning apps
left and right without financial repercussions.


ShadowBrokers Bitcoin Transactions: Now There’s Some Taint for You - sjreese
https://krypt3ia.wordpress.com/2016/08/19/shadowbrokers-bitcoin-transactions-now-theres-some-taint-for-you/
======
nickodell
>If you were the gubment and you wanted to maybe trace these fuckers would you
maybe try to chum the bitcoin waters to see what wallets are used for any
liquidation of the bitcoins later?

The address of the auction is public. Sending more bitcoins to the address
doesn't make sense. The only way it would make sense to send Bitcoin to the
address is if you waited until the Bitcoins had been spent, and send a bit of
dust to the address, in the hope that their wallet spent it along with some
other Bitcoins.

The more likely explanation is that somebody is messing with the people
observing the auction. By my count, there are only two serious bids that
follow the rules set out by the shadow brokers.

------
moyix
I haven't been following the Silk Road coins, but I thought they'd been
auctioned off?

[http://www.coindesk.com/four-winners-44000-bitcoins-final-
si...](http://www.coindesk.com/four-winners-44000-bitcoins-final-silk-road-
auction/)

------
JumpCrisscross
> gubment

Wat.

> I am LOVING the l337 status on those transactions hahaha

What does this mean?

~~~
jameskilton
The screenshots are low quality, so here's a link to the transactions page
itself

[https://blockchain.info/address/19BY2XCgbDe6WtTVbTyzM9eR3LYr...](https://blockchain.info/address/19BY2XCgbDe6WtTVbTyzM9eR3LYr6VitWK)

You'll see a bunch of transactions for 0.001337 BTC, which apparently can be
traced back to coins in government agency-seized funds. That's what the post
means.

~~~
mattcanhack
Also happens to be a rickroll if you look at the addresses.

Other source: [http://motherboard.vice.com/en_ca/read/someone-rickrolled-
th...](http://motherboard.vice.com/en_ca/read/someone-rickrolled-the-bitcoin-
auction-for-nsa-exploits)

~~~
HillRat
This is surely the weirdest governmental communication _ever_. I'm fascinated
by the idea that someone had to tell the NSC and White House, "NSA wants to
rickroll the Russian government using DoJ-owned bitcoins seized from a dark
web drugs-and-assassinations forum." Evidently our branch of the multiverse is
a pasteup being collaboratively written by Grant Morrison, Charlie Stross and
Neal Stephenson.

~~~
kakarot
I just feel like clarifying that it was in no way an "assassination forum"


No CEO needed: These blockchain platforms will let ‘the crowd’ run startups - maxwellnardi
https://venturebeat.com/2017/12/03/no-ceo-needed-these-blockchain-platforms-will-let-the-crowd-run-startups/
======
westurner
Mentioned in the article are Aragon, District0x, Ethlance, NameBazaar, Colony,
DAOstack; all of which, IIUC, are built with Ethereum and Smart Contracts
(DAOs).


JavaScript can double your codebase so make sure you need it first - invalid_arg
http://mat-mcloughlin.github.io/2013/08/12/javascript-can-double-your-codebase-so-make-sure-you-need-it-first.html

======
lucisferre
There isn't a lot of detail on exactly _how_ javascript is used in this
codebase so it is hard to comment. Having worked in .NET web shops there is a
tendency to be very back-end (and .NET) oriented and not really having a lot
of deep expertise in the web, particularly on the front-end. I don't want to
assume this (the author mentioned UX and some other things which tends to lead
me to believe they do have this kind of expertise). There is also a tendency
to avoid technologies that can make working with the web easier. I'm talking
about things like Ember or Angular, build tools like Grunt or some kind of
asset pipeline for work so javascript can be more organized and structured and
you can write less of it.

In the end web development on the .NET platform (can be) is harder and front-
end development doubly so. I'll admit this is my experience so YMMV.

In the author's defence though I agree Javascript, when compared with many
other languages, particularly Java or C# is often unwieldily, there is little
help for how code is structured or organized and architecture of any sort is
more challenging. That said it can be done, just not the way you might be used
to in a more OOP C# or Java.

------
joshuacc
I'm working on a fairly substantial SPA now, and while I think these costs are
worth it for my use case, they certainly are real costs and should be
carefully considered.

~~~
ville
What does 'SPA' mean? The author does not open it and the acronym is quite
ungoogleable.

~~~
greg5green
SPA = single page app


Pirate Bay completely banned in The Netherlands - vitorspencer
http://www.expatica.com/nl/news/local_news/Pirate-Bay-website-banned-in-Netherlands_55024.html

======
jacquesm
<http://news.ycombinator.com/item?id=732590>


Ask HN: What should our value proposition be? - timjahn

If you're a freelance developer, we'd love your feedback here:
https://matchist.com
======
timjahn
Clickable link: <https://matchist.com>


Is Python really supplanting R for data work? - bsg75
http://blogs.computerworld.com/big-data/23204/python-really-supplanting-r-data-work

======
edtechdev
That is an awesome response to the original article.

The only data she can find (KDnuggets survey) indicates that both R and Python
are growing in popularity, not one at the expense of the other. 61% use R and
39% Python.


Things I learned from OpenSSH about reading very sensitive files - jsnell
https://utcc.utoronto.ca/~cks/space/blog/programming/ReadingSensitiveFilesLessons
======
gargravarr
There is quite some irony here - I was always taught to code by using standard
libraries because they've been tested to destruction and back in ways I'd
never be able to work out, and that rolling my own was destined for failure.
As far as good practise goes, OpenSSH seems to tick all the right boxes. This
article seems to criticise this, but the deeper meaning is that the standard C
library is not designed with security in mind.

There's no inherent problem with the approach taken (not like OpenSSL
reinventing several wheels and causing things like Heartbleed). In fact, the
article's conclusion that the OpenSSH team should have rolled their own memory
management code rather than use tried, tested and approved libraries doesn't
sound like a good recommendation to me.

~~~
HerrMonnezza
> In fact, the article's conclusion that the OpenSSH team should have > rolled
> their own memory management code rather than use tried, > tested and
> approved libraries

That's not the conclusion I draw from the article.

I rather read it as warning that even innocent and quite common operations
like realloc() or using buffered I/O can have security implications, so one
need to be extra extra _extra_ careful when writing code that handles
sensitive data. In other words, security can be even harder than security
professionals think.

~~~
maxlybbert
I agree with you. And while I don't think there's any secure way to use
realloc(), I would like to remind people that stdio does give you control over
the internal buffer (setvbuf()), which you can potentially set to a buffer
that can't get swapped to disk and which you can zero out at the appropriate
time. You can also call fflush() to be sure that the data in stdio's buffer
can be zeroed even before the file is closed.

------
twic
> Part of how they are so easy to overlook is that we are trained to think in
> terms of abstractions, not the details underneath them.

This is a problem in direct proportion to how leaky the abstractions are. C's
abstraction over memory is comically leaky, so indeed, if you're using it, you
need to think about the details underneath it.

But the solution isn't for everyone to forget about abstractions, it's to use
better-made abstractions.

For memory in particular, it's been understood what it takes to have a safe
abstraction for quite a long time now, and numerous widely-available languages
provide one. Use one of those instead of C.

~~~
AnimalMuppet
Could you be more specific on what you have in mind here?

As far as I can see, if something like Heartbleed exists, you can't rely on
"safe memory abstractions" at a lower level, because Heartbleed let the
attacker look at the internal memory of those abstractions. They quit being
abstractions; their raw memory is open to the attacker.

Or is your claim that safe abstractions would have prevented Heartbleed (and
all other possible attacks that let the attacker read memory)?

~~~
twic
For Heartbleed, you need an abstraction like "container that i can write bytes
to and then read the same bytes from" which has the leak "sometimes you can
read other bytes too".

In C, the memory abstraction the language gives you has that leak, so it's
really hard to build a container on top of it that doesn't have that leak.

In safer languages, the memory abstraction doesn't have that leak, because
bounds are checked, and new byte buffers are initialised to zero. You can
still build an abstraction which _does_ have that leak - say, by writing your
own reusable byte buffer class which doesn't check bounds or zero on reuse -
but at least you have the option of getting it right.

In an even safer language, the type system might make it impossible to make
that mistake, or the library might supply a safe implementation of that
abstraction already.

Remember, Heartbleed is not about the attacker doing some kind of Jedi memory
trick to read your secrets: they are relying on _your own code_ to read things
it shouldn't. If the abstractions your program is built on don't allow that,
then there's no way for it to be used to that end.

~~~
cuckcuckspruce
>In C, the memory abstraction the language gives you has that leak, so it's
really hard to build a container on top of it that doesn't have that leak.

>In safer languages, the memory abstraction doesn't have that leak, because
bounds are checked, and new byte buffers are initialised to zero.

Most of the implementations of these safer languages are in C, so clearly
there's a way to do this correctly in C.

------
eliteraspberrie
The bug is in the compiler, not OpenSSH. The OpenSSH developers explicitly
erased memory with memset. GCC decided to remove those lines without any
warning. There's the bug. (Here come the language lawyers...)

What's the difference between GCC deleting parts of your code, and an attacker
hacking into the source code repository and deleting those parts of the code?

The C standards committee addressed the problem in 2009 with memset_s. [0] The
GNU developers reject patches and state they hope this feature is never
implemented. [1]

The bug fix is to stop using GCC for sensitive code. Use CompCert instead.
[https://github.com/AbsInt/CompCert](https://github.com/AbsInt/CompCert)

[0] [http://www.open-
std.org/jtc1/sc22/wg14/www/docs/n1381.pdf](http://www.open-
std.org/jtc1/sc22/wg14/www/docs/n1381.pdf)

[1] [https://sourceware.org/ml/libc-
alpha/2014-12/threads.html#00...](https://sourceware.org/ml/libc-
alpha/2014-12/threads.html#00506)

~~~
lawnchair_larry
Pretty much every claim you just made is wrong, but at least you provided the
sources to demonstrate such. In short, dead store removal is not a bug, it is
explicitly allowed. C11 Annex K is optional, and the rejection was not based
on this feature, it was based on other problematic requirements imposed on a
conforming implementation.

------
viraptor
This of course is all true and important. But there's an alternative here -
keep private data unreadable. I believe if you use smartcard authentication
via gpg-agent, ssh simply has no access to your key. The only thing that could
be leaked is the session key (which the other side could get via standard
exchange anyway).

I moved to yubikey some time ago and don't regret it.

~~~
makomk
The downside of Yubikey is that if it was manufactured before April and you
used OpenPGP card mode, anyone who manages to steal your Yubikey could use it
to log into your servers without needing to know your PIN/password because PIN
authentication was completely broken and bypassable on the earlier Yubikeys.
YubiCo also heavily downplayed the importance of this issue, claiming in their
announcement that it didn't matter because anyone who got hold of your Yubikey
could get hold of your PIN anyway. See [https://developers.yubico.com/ykneo-
openpgp/SecurityAdvisory...](https://developers.yubico.com/ykneo-
openpgp/SecurityAdvisory%202015-04-14.html)

~~~
viraptor
Every system had, has, or will have issues. That's why you have multiple
layers of protection from cpu rings to user training. Sure, they had issues,
but I'll still take hardened box, with ssh, with yubikey over ssh on its own.
I don't trust any of those layers, but each provides more difficulty in
exploitation.

(Also, this still doesn't provide the key itself. That means even with the
vulnerable yubikey you can only spoof connections while it's plugged in)

~~~
makomk
It means that anyone who can swipe your Yubikey for a couple of minutes or
even just wave an NFC-enabled phone past it can SSH to your server and then at
their leisure convert that connection into a persistent backdoor. How often do
you check your .authorized_keys? Your list of running processes? Your .bashrc
for a line redirecting sudo to a small binary that logs your password for
later use? Arguably this even made it less secure than a normal USB key with
your SSH key on it encrypted with a strong passphrase.

------
vidarh
I remember people groaning (and I was probably amongst them) about DJB for
being unnecessarily paranoid for implementing his own IO functions instead of
using stdio (for Qmail for example).

------
jimrandomh
I think the real answer to this sort of problem would be to set up a unit test
that involves making a full memory dump and scanning it for private key
material. The traps here are just too subtle to try to catch all the failure-
to-zero bugs in any other way.

------
im2w1l
Some people used to claim that you should never use your own crypto code
because the libraries are designed by people infinitely smarter than you who
thought of everything.

That is starting to ring hollow to me.

~~~
nextw33k
"you should never use your own crypto code"

The sentiment behind that is to keep out those that don't know how to code. If
everybody followed that advice there wouldn't be crypto code.

If you have the ability to create good code and are confident you can
understand the maths of cryptography then by all means contribute to the
community. If the past year has taught us anything it's that the crypto
community needs more good engineers.

~~~
creshal
The sentiment should be "write your own code, but don't use it without
independent audit". There's another recent discussion about it here:
[https://www.reddit.com/r/crypto/comments/418nyl/write_crypto...](https://www.reddit.com/r/crypto/comments/418nyl/write_crypto_code_dont_publish_it/)

~~~
rhinoceraptor
People write their own toy kernels or malloc()s all the time, and there's
never the assumption that they would actually try to use them for real, and
the security implications are just as real there as for toy crypto.

------
Hello71
Zeroing buffers is insufficient:
[https://news.ycombinator.com/item?id=8277928](https://news.ycombinator.com/item?id=8277928)

------
marcosdumay
Funny thing. I just thought it was yet another memory leak, that could be
avoided by higher level code handling dangerous network data.

But if all the lessons the author took are that secure code should be lower
level than this, well... I can not agree with it.

~~~
makomk
Higher-level code is just an abstraction layer over the lower-level workings,
and if that abstraction layer doesn't clear memory properly there may be no
way to fix that without bypassing it altogether.

~~~
twic
If the abstraction layer doesn't let you read memory that's left over from
some previous use, then it doesn't matter (for this vulnerability) if it
clears it or not.

~~~
kuschku
Except, it does.

Remember RowHammer?
[https://github.com/IAIK/rowhammerjs](https://github.com/IAIK/rowhammerjs)

~~~
twic
Rowhammer is a great demonstration that the memory abstraction in almost all
languages _does_ let you statistically modify the memory of other processes on
appropriate hardware!

I don't think rowhammer lets you read memory, though; does it? There are
certainly some cache timing attacks that do, though.

~~~
kuschku
I’m not sure, but it’s a great demonstration that, just because the
abstraction limits direct access, it can not limit indirect access.


A brief visual intro the biggest currency bubble, Bitcoin. - skhamkar
http://www.graphnote.com/ddb965cb

======
bayesianhorse
I wonder what would have happened to the Internet if it had been called a
bubble as persistently as bitcoin is...

It's almost as if "real" economists have an emotional need to say "I'm not
stupid! I can recognize an obvious bubble!"

~~~
skhamkar
Seems like everyone is looking to call something a "bubble" after 2008. In
this case, this type of increase and crash seems to correlate with other
bubbles like the 1987 crash or the Japanese crash in 1989.


Twitter Should Decentralize (And Make Money) Via Twitter Server  - mgcreed
http://www.techcrunch.com/2009/10/04/twitter-should-decentralize-and-make-money-via-twitter-server/
======
mh_
The current value of Twitter is not in it’s technology, it’s in it’s userbase.
You could write a better engine to do what they do, but you can’t convince
enough people to use it. Your suggestion to decentralize essentially has them
giving credibility to external sites (who licence their engine) at a cost of
what they value most (their users). Once I’m buying t-server from them, a new
startup can compete on features..

I’m sure there are lots of good ways for Twitter to make money, but I don’t
think that diluting their user base is one of them..

------
credo
The Exchange analogy doesn't apply to Twitter. For starters, most people want
to keep their Exchange email confidential. IOW, the rest of the world can
neither see the contents of the "inbox" nor the "sent mail" folders. OTH most
people want their twitter status updates to be seen by others and there isn't
much incentive to host it securely.


Is the Internet Making Us Stupid? - edw519
http://www.npr.org/templates/story/story.php?storyId=91543814&ft=1&f=1013

======
sah
This is a summary of this longer article from the Atlantic Monthly:
<http://www.theatlantic.com/doc/200807/google/>

The author is complaining that the internet is teaching us to skim more, and
I'm not sure that's a bad thing. I don't do less involved reading than I did
before the internet, but I do spend a lot more time skimming to find things
that are worth reading.

He also claims that "Deep reading, as Maryanne Wolf argues, is
indistinguishable from deep thinking." I don't find that to be true at all! If
I'm reading something thought-provoking, I often have to stop reading to
think.

------
maurycy
Reminds me:

[http://www.newscientist.com/channel/being-
human/mg18624973.4...](http://www.newscientist.com/channel/being-
human/mg18624973.400-infooverload-harms-concentration-more-than-
marijuana.html)


Valley "Meritocracy" = Stanford, Harvard, or MIT - ghein
http://www.slate.com/blogs/future_tense/2013/09/13/silicon_valley_meritocracy_reuters_story_finds_connections_background_matter.html

======
anovikov
It almost sounds like there's something bad about it.


Ask HN: What do new MBA's do in tech? || Self-marketing via RE - schodge

Short question: Various stats got tossed out that x% of Stanford's/Harvard's/Etc.'s graduating MBA class went into tech this/last year, instead of the 'normal' MBA fields (e.g., finance).  What are the job titles these MBA's are winding up with?<p>Motivation, brief bio, see LinkedIn (profile) for longer:  I did my Master's in electrical engineering, but turned to the dark side and went off to law school and spent a few years practicing as an IP/patent litigator.  (Defending against trolls - the turn to the dark side was incomplete).  I then got my MBA (Santa Clara, based in SV), and have been trying to find a suitable role in a tech company.  I'm currently consulting as an electrical engineer in a biomedical company (mostly writing Matlab and Python for data analysis, plus designing measurement equipment), but would like to find something more permanent and, preferably, more interdisciplinary.  I've yet to find an effective way of branding myself.  I like hard problems, my programming skills are excellent for a business-type (mostly Python) but not what you'd want in a software engineer, and my best fit has traditionally been interfacing between tech-savvy and tech-unsavvy areas (e.g., engineers <==> lawyers).  Excellent at wearing many hats, and very good in several specialties, but not a world-class expert in any of them.  (Not looking to found a company, student loans necessitate cash flow).  Hence, the initial question above, to figure out what exactly it is other generalists are landing in tech companies as.
======
amac
Business development in most cases i.e sales of ads, licenses or whichever
unit(s) they use to make revenue.


Some unpleasant truth - eccstartup

* Coders will become cheap in the near future.
* The `boomer` of coders are getting old.
* You always need to learn mathematics if you gonna be a coder.
* Computer science is a topic who deals with fancy words and abbreviations.
* Statistics is not pure mathematics.
You can add to this list whether you agree with these or not, because it is GPLv3 license.
https://gist.github.com/eccstartup/8bea6bf21f77054d3e4b
======
csirac2
As someone who studied engineering I have to say my maths skills have only
atrophied enormously since becoming a full-time developer.

Which is a shame, I see software sometimes that appears to have some special
heuristics in there when I'm sure a standard statistical technique would've
achieved the same or better result.

I have a theory that the info-sec industry would benefit from folks with
robust stats/data-mining/"big data"/algorithms training (in a lot of ways
bioinformatics people are solving similar-looking problems).

Edit: Yes, [http://securabit.com/2014/10/03/securabit-
episode-129-bioinf...](http://securabit.com/2014/10/03/securabit-
episode-129-bioinformatics-and-infosec/) said the same thing... :)

~~~
Bahamut
As someone who studied mathematics at the graduate level & also moved to
software engineering, my math skills have also atrophied, but my problem
solving ability is still as top notch as ever - that is probably the biggest
benefit of mathematics.


Judge in Apple Case Seen as Unfazed by Stress, Even a Plane Crash - pavornyoh
http://www.nytimes.com/2016/03/22/technology/judge-in-apple-case-seen-as-unfazed-by-stress-even-a-plane-crash.html?ref=technology&_r=0
======
bonniemuffin
...yes, but does the judge understand technology? "Unfazed by stress" doesn't
seem like a very relevant trait. "Judge has aptitude for understanding the
nuances of encryption" would be a much more relevant story.

~~~
austinjp
My personal, anecdotal, highly limited experience of judges is that their
particular skill is to cut through technical complexity and fit it to the law.
They are briefed by technical experts if there are facets of a case that they
cannot reasonably be expected to grok.

There are of course pros and cons to this.

One con of a technical expert being a "judge" is that they cannot see the wood
for the trees. Actual judges should, ideally, avoid this situation. Mileage
varies, obviously.


Ask HN: In the wake of recent Gmail migrations, where do I host my address book? - e_proxus

I'm currently trying Fastmail which seems very good for email, but their address book does not sync with iOS 6 (LDAP not working) and can't in any case be updated from mobile. Do you know any hosting service providing address book hosting, with LDAP and CardDAV?
======
Casseres
I haven't tried ownCloud yet, but from what I've read so far, it seems
promising. It supports CardDAV [0]. The software is free, but you have to host
it on your own server. There does appear to be some services that offer it as
a service, and one service that has a free tier [1].

[0]
[http://owncloud.org/support/calendars/](http://owncloud.org/support/calendars/)
[1] [http://owncloud.org/providers/#free](http://owncloud.org/providers/#free)

~~~
e_proxus
Yeah, it looks interesting. Only thing for me is that most of the providers do
not look very trustworthy.


The 10 Dumbest CEO Remarks of All Time - curiouslurker
http://www.inc.com/ss/geoffrey-james/10-dumbest-ceo-remarks-all-time?cid=ps01902innovate

======
bichiliad
I really hate articles like this. This isn't buzfeed, and it doesn't culture
anything.

------
cyphax
I can't read this article without registering with their site, or am I missing
something?


States Eye Taxes on Streaming Video and Cloud Computing - shahryc
http://www.wsj.com/articles/states-eye-taxes-on-streaming-video-and-cloud-computing-1440095146?mod=e2fb
======
tired_man
Go ahead a tax it. Who cares? All that does is cut the content producers out
of any cash they may have earned from website ads where people access their
streams.

Increasing its cost with a tax will drive people to access content based in
other regions, from USENET, from filehosts, from torrents, etc....

The people who have these ideas are quite obviously still living in the era of
paper and video tape, where the only content was provided by an original
content producer.

------
shahryc
this approach may lead people to seek lower-cost, untaxed mediums (like
torrents) rather than a heavily taxed alternative


Show HN: “Active Code” in Markdown - chriswarbo
http://chriswarbo.net/activecode/

======
onaclov2000
I really like this, I imagine it would be really helpful if you were writing a
book/blog post, you could "print" the code you were using as an example, then
"run" it and output all of that into your generated HTML, this would ensure
you have a "working" example at all times.

~~~
Nullabillity
A while ago I wrote something similar (though only for Scala) for a school
project. It would basically fake a REPL session, which had the con of being
pretty tightly coupled to the language, but it would give you nice automatic
output that would match what the user would get.

Example:
[http://www.kodknackning.se/gettingstarted/types](http://www.kodknackning.se/gettingstarted/types)

Source: [https://github.com/teozkr/scala-repl-
sampler](https://github.com/teozkr/scala-repl-sampler)

------
apenguin
I love the idea of Literate Programming, and moreover pandoc is one of my
absolute favorite tools. As such, I find this very interesting.

However, I take issue with your complaint about Emacs being so huge -- pandoc
is right up there, too (134 vs 89MiB on my system). Not to mention its
seemingly endless stream of dependencies (50 packages according to my
manager), as well as GHC which is over 700MB on its own. If you work with
Haskell, this might not be too big of a deal, but otherwise you might need all
this for pandoc alone. This is actually an issue for me with my tiny laptop
SSD (this ends up consuming more than 5% of my root partition) -- I'm always
debating removing pandoc, but never do because it's just such a great tool.

~~~
chriswarbo
Pandoc doesn't seem as bad as you suggest. GHC, dependencies, etc. are only
needed for compiling; according to
[http://johnmacfarlane.net/pandoc/installing.html](http://johnmacfarlane.net/pandoc/installing.html)
Pandoc can be compiled into a standalone binary. The Windows build on
[https://github.com/jgm/pandoc/releases](https://github.com/jgm/pandoc/releases)
is 17.1MB and the Debian package in Wheezy is 18.9MB with reasonable-looking
dependencies.

The scripts I've written (PanPipe and PanHandle) require a Haskell
implementation and the Pandoc library in order to be compiled or interpreted.
Once they're compiled with GHC, they're completely standalone.

My plan is to have my server recompile my site when changes are pushed to Git.
I like having Emacs, GHC, etc. on my laptop, but not on my server.

I actually tried to integrate Babel with Hakyll originally, but hit a bunch of
problems. I didn't include that in the page since I thought it would be
distracting. Most of it boils down to Org-mode's HTML exporter being awkward
to invoke as part of a UNIX pipeline:

\- Emacs can't handle stdio

\- Org-mode has breaking changes between the version bundled in the latest
stable Emacs (24.3) and that in ELPA (which I use)

\- Syntax highlighting depends on the current Emacs theme

\- Whole HTML pages are generated, which makes templating harder

\- Anything which uses the filesystem leaves artifacts around

I did manage to hack together a shell script which created and switched to a
temporary directory, saved /dev/stdin to a file, opened Emacs in batch mode,
loaded Org-mode, opened the temp file, tangled the file, exported the file,
exited Emacs, ran the result through some XSLT transformations and Python
scripts to extract the data needed for templating, spliced the results through
the templates, spat the result to /dev/stdout, switched out of the temp
directory then deleted it. Needless to say, it was _very_ fragile, and much
more complex than writing these Pandoc filters!

~~~
apenguin
Regarding the Windows build: I just installed it, post-install size is 69.1MB.
I feel like a factor of two means my point about emacs not being _that_ big
still stands :)

Static builds also pose somewhat of a problem when it means I have to rebuild
all the dependencies for every update... I've run into this on Arch when
clearing out makedeps for hard drive space (those 50 packages probably aren't
all hard deps but I don't want to go against the will of my package manager).
I know this is a solvable issue, I just wish it was easier.

Also, I recognize the issues it poses here, but syntax highlighting inheriting
from font-lock is one of my favorite things about the HTML exporter.

EDIT: Accidentally duplicated a predicate by duplicating a predicate.

EDIT2: I'll just expand my response

The whole-page templating thing is a problem I've been trying to work around
myself, but I've had too much fun thinking about it to actually get started on
anything. At some point writing another HTML exporter feels kinda mundane and
I get the idea that I need to work on a ConTeXt exporter since it hasn't been
done before.

I like Markdown's syntax more than that of org-mode, but I don't like the lack
of standardization. I kinda wish all the (popular) flavors were a subset of
Pandoc Markdown so as to keep compatability... But that's never going to
happen.

------
hk__2
This reminds me of “Pastek”, a markdown-inspired language created by a friend
of mine which supports the inclusion of the output of some code run through an
external command, with a similar syntax: [https://pastek-
project.github.io/cheatsheet.html](https://pastek-
project.github.io/cheatsheet.html)

~~~
chriswarbo
Interesting, although I specifically avoided defining a new language. The
source to these pages is all written in Pandoc's version of Markdown, detailed
at [http://johnmacfarlane.net/pandoc/demo/example9/pandocs-
markd...](http://johnmacfarlane.net/pandoc/demo/example9/pandocs-
markdown.html)

If the PanPipe and PanHandle filters aren't used, the code blocks will just
appear in the output verbatim. The `pipe="abc"` attribute and `unwrap` class
will become regular HTML attributes and classes, just like any other.

Pandoc also supports more formats than just Markdown. These filters operate on
the parsed AST, so will work for any format where Pandoc can parse a 'Code' or
'CodeBlock' element, with the ability to attach 'attributes' or 'classes'. The
"native" and "json" formats can do this, since they're just Pandoc's
intermediate datastructures. I just tried it on HTML and it works there too!

        $ echo '
ls /
' | pandoc -f html -t html --filter panpipe

bin
        boot
        dev
        etc
        home
        lost+found
        media
        nix
        proc
        root
        run
        sys
        tmp
        usr
        var

~~~
hk__2
Really interesting, thanks for the explanation!


Non-Robust Arithmetic as Art - mourner
https://observablehq.com/@mourner/non-robust-arithmetic-as-art
======
dromen
Some syntax errors re.: "chosenOrient" and "orientRobust"? I'm on Firefox 60.8
and uBO but not blocking stringently, just Google Analytics from the logs.

I got overloaded by the page being fully editable/interactive AND with errors
AND with foreign mathematical constructs. Somehow the possibility to edit it
makes me walk on eggshells, even if it's just a local edit.

It otherwise looks good, I'd probably enjoy reading it if I was more fit. I'm
going to take a walk outside now, thanks for the unintended inspiration.

~~~
mourner
Interesting, can you share the exact log of the errors you're seeing? There
are none for me on both Firefox & Chrome with uBO.


Blockchain Is Merely a Marketing Instrument - leifg
http://blog.leif.io/blockchain-is-merely-a-marketing-instrument/
======
pollyannas
Your arguments don't hold. The point about blockchains in general is: it's an
interesting new technology. Do you disagree?

Since we can agree on that, what is wrong about people trying to put that
technology into practice? No one has ever claimed some specific blockchain
application would be profitable, but people are trying to put that thing into
use. What is the problem with that?

~~~
Yizahi
Is it interesting though? People put to forefront that it is distributed, but
I think that being distributed is a secondary attribute (after all you can run
this software solo). Mainly it is immutable and public. Immutable public
database - is it that much interesting? And for what exactly? I don't see many
possible applications, even for government since they all come with multiple
cases against this tech - e.g. voting on blockchain, cool, now it is very hard
to falsify voting but it comes with a neat option to harass and discriminate
people afterwards since blockchain is public. And so on.