Hacker News Reader

roluxon The yuan is displacing the dollar as a key currency

There is one important aspect that the article doesn't address, which I think would be a crucial element in any strategy to dethrone the US dollar:

http://www.google.com/search?q=yuan+oil+china+iran

roluxon Python for Data Analysis

Given that the posting has risen quite high on the front page, can the link be changed to the URL of the original?

Not that there was much meat in the article, anyway, but at least the following is mildly insightful:

I prefer Python to R for mathematical computing because mathematical computing doesn’t exist in a vacuum; there’s always other stuff to do. I find doing mathematical programming in a general-purpose language is easier than doing general-purpose programming in a mathematical language.

roluxon There's only one exchange rate

I don't get the point that the article is trying to make. Of course banks won't trade at mid-market price. Of course there will be a buy/sell spread.

Take a look at exchange rates for more exotic currencies than British Pound vs. Euro. The buy/sell spread can be huge, and often reflects actual risks in keeping around large amounts of cash in volatile currencies.

roluxon Facebook, I want my friends back

but I'm not just a user I'm a supplier

Unfortunately, you're neither of those two. If you have an account on Facebook, you're their product.

A lot of the disappointment here seems to be a result of ignoring this relation.

roluxon Facebook, I want my friends back

In this case, to call a spade a spade would be to call EdgeRank a spam filter, and "promoted posts" a paid option to circumvent it - right?

roluxon The most dangerous code in the world

No, I was actually trying to be specific. There's usually nothing wrong with 0/1 or 1-9.

Empirically, 0/1/2 either means no/yes/yes-and-something-obscure-on-top-of-that, or, worse, as in this case, no/kind-of-but-not-really/yes.

roluxon The most dangerous code in the world

Of course the developers are at fault here, but good API design would be to not invite developers to mess things up.

When designing the Curl API, it should have been obvious that VERIFYHOST is likely be set incorrectly, especially once it's used in languages that coerce true to 1.

roluxon The most dangerous code in the world

When it comes to API design, a good rule of thumb is that parameters that can be either 0, 1 or 2 will cause bugs.

roluxon The most dangerous code in the world

Which, as the authors show in section 7.1 and 7.2 of their paper, many PHP developers, like the authors of the Amazon Flexible Payments Service SDK and the PayPal Payments Standard SDK, will happily override with true.

roluxon The most dangerous code in the world

The issue with the code above is the return statement, most likely inserted during development, with the good intention to remove it later, since the "bit of random junk" that follows would have validated the server's certificate.

roluxon The most dangerous code in the world

Further down in the PDF, the authors present the decompiled source of the Chase app:

  public final void checkServerTrusted(X509Certificate[]
      paramArrayOfX509Certificate, String paramString)
  {
    if ((paramArrayOfX509Certificate != null) && (
        paramArrayOfX509Certificate.length == 1))
      paramArrayOfX509Certificate[0].checkValidity();
    while (true)
    {
      return;
      this.a.checkServerTrusted(
          paramArrayOfX509Certificate, paramString);
    }
  }

Good to know this isn't used for anything critical, just for, um, mobile banking.

roluxon The most dangerous code in the world

From the PDF linked in the article:

"Not the most interesting technically, but perhaps the most devastating (because of the ease of exploitation) bug is the broken certificate validation in the Chase mobile banking app on Android. Even a primitive network attacker—for example, someone in control of a malicious Wi-Fi access point—can exploit this vulnerability to harvest the login credentials of Chase mobile banking customers."

roluxon Free Flag Icons

Just to let you know that the current .zip doesn't include the change log, just the license. (Caching issue at gosquared?)

roluxon Free Flag Icons

For a good list of countries, mostly derived from wikipedia as well, that comes with properties like dependency, disputed, and so on, includes historical data, back to 1970, and whose main purpose, similarly, is a set of flag icons, see OxJS:

https://oxjs.org/#doc/Ox.COUNTRIES

https://oxjs.org/#examples/countries/live

(The latter has a menu to show more than just current sovereign countries.)

Edited to add: In https://trac.oxjs.org/browser/oxjs/tools/geo you'll find the python toolchain to automatically generate the flag images.

roluxon Photos from inside North Korean Ryugyong Hotel

Just some background info: The new contractor, Orascom [1], has been issued a licence to operate the North Korean 3G Network [2]. Orascom is both a telecommunications and a construction company.

I doubt that their plan is to use the hotel exclusively as a giant antenna, but it's not unlikely that finishing the facade was a political priority, while operating the hotel is not.

[1] http://en.wikipedia.org/wiki/Orascom_Group

[2] http://en.wikipedia.org/wiki/Ryugyong_Hotel#Construction_res...

roluxon New Zealand admits illegally spying on Megaupload founder Kim Dotcom

In other news, New Zealand's prime minister seems to have issued a public apology to Kim Dotcom:

https://torrentfreak.com/new-zealand-prime-minister-apologiz...

roluxon Show HN: I got tired of missing new music releases, so I built this

Looking at my own iTunes library, the names of some of my playlists actually leak quite a bit of private information.

roluxon Please tell us what features you'd like in news.ycombinator

Low-hanging fruit:

The byline of this thread currently reads "2041 days ago", and it's really hard to make sense of that, since dividing by 365 usually takes more than a split-second.

Thus for submissions and comments older than X days, change the byline from "X days ago" to "Month DD, YYYY".

Both 100 and 365 would be okay values for X.

EDIT: Alternatively, extend the current pattern of "minutes ago", "hours ago", "days ago" to "months ago" and "years ago".

roluxon The Pendulum Swings, Again

In addition to that, mobile is closed because hardware manufacturers, software companies and network providers all seem to agree that the combination of mandated personalization and permanent tracking is a potential gold mine.

roluxon The Pendulum Swings, Again

I'm having similar concerns, and I think both your post and the parent post are indicative of a trend that, in hindsight, will have begun just around 2011/12.

And as someone who remembers (and was part of) the first phase of migration to Apple/OS X, around 2001/02, it seems to me that it had less momentum and was harder to envision than the migration from Apple that may be in its infancy now.

(Note: "migration from" doesn't imply losing market share, or even a lower growth rate. It rather means that a specific, tiny but crucial slice of mind share may have begun to erode.)

roluxon The Pendulum Swings, Again

5 years ago many people could and did swap components in their PC. Now try doing that with a modern smartphone or laptop.

Do you think this is an entirely new development? Wouldn't the statement "5 years ago people could do X with computers, now they can't" in fact hold true for the last, say, 40 years in the history of computing?

roluxon The Pendulum Swings, Again

I agree. While I can follow the author's reasoning about the history of computing (particularly his assertion that computing was most democratic in the 1980s), he doesn't reveal the sources for his optimism, apart from stating:

If my observations are correct then such a swing is about to happen, and this time we had better get it right.

The interesting part, which is missing, would be a list of such observations.

roluxon The Pendulum Swings, Again

Remember that there are two possible outcomes, one where the internet successfully manages to cause a swing to the edge of freedom, and another where it is successfully co-opted by big money and governments in a concerted effort to give us all a subscription to online Life-As-A-Service where you will be beholden to some party for the ability to gain access to knowledge, information, the right to communicate and so on and where the act of programming will be as tightly regulated as the export of cryptography was.

It seems so me that in the 1990s, the future that was widely (outside some truly dystopian sci-fi fringes of the net discourse) regarded as the worst-case scenario was the Internet becoming like radio -- i.e. another peer-to-peer medium turned into a broadcast medium. So it may be worth noting that while the best-case scenario hasn't changed much since then, the worst-case scenario has.

roluxon William Gibson on Punk Rock, Internet Memes, and "Gangnam Style"

I think the following (quote from the article) is a very good observation:

"I suspect — and I don’t think this is nostalgia — but it may have been able to become kind of a richer sauce, initially. It wasn’t able to instantly go from London to Toronto at the speed of light. Somebody had to carry it back to Toronto or wherever, in their backpack and show it, physically show it to another human. Which is what happened. And compared to the way that news of something new spreads today, it was totally stone age. Totally stone age! There’s something remarkable about it that’s probably not going to be that evident to people looking at it in the future. That the 1977 experience was qualitatively different, in a way, than the 2007 experience, say.

roluxon Show HN: Most Wikipedia articles lead to the same loop

True, the "wikipedia loop" itself is not a new discovery. But still, congrats for coming up with a nice GUI to demonstrate it!

roluxon Show HN: OxJS - a JavaScript Library for Web Applications

mbell - thanks for taking the time to debug this. I'm aware of what you're pointing out -- a lot of requests and rendering steps could be avoided by caching data on the server.

But what you're looking at is just the HTML/JS that comes with OxJS, and it is intended to be used locally, for development. There is no server backend. You can just put it on your local web server, and it works the same. Generating documentation, tokenizing JS, running tests, etc. all happens live, on the client. (Sooner or later, we'll put pre-generated documentation on oxjs.org. But if you're running the site locally, it's really convenient to not need any build steps.)

The examples currently reference the development version of OxJS, and explicitly don't use cached files. Again, this is nice if you're making your own changes to OxJS, and want to see how they affect a particular example. But for someone just browsing oxjs.org, it's definitely overkill, and we'll fix it ASAP.

roluxon Show HN: OxJS - a JavaScript Library for Web Applications

Hey... I assume you're referring to 0xDB.org. That may be a bug in pan.do/ra (the application), rather than in OxJS itself. We fixed some memory leaks recently, but may have missed some.

If you care to provide a few more details (via e-mail, or using our bug tracker), we're definitely going to look into it.

roluxon Show HN: OxJS - a JavaScript Library for Web Applications

I get your point, but I don't think it's necessarily a browser vs. desktop thing, especially since that line is going to blur even more in the future.

I guess it rather depends on the type of application you're building. For anything complex and truly feature-rich (think a good e-mail client, or professional photo/video management software), the big advantage of a menu bar is that it makes functionality discoverable, using a well-known paradigm. Keyboard navigation + shortcuts are a plus, and OxJS provides that.

I definitely see a need for desktop-like JavaScript UI toolkits. But of course, one has to use them wisely. Non-native dialogs have become quite common, and I think they make sense for login, notifications, warnings, and so on. On the other hand, it's unlikely that a whole layer of stacked "windows" (inside a tab, inside a browser window) is a good idea.

EDIT, forgot to mention: The main reason menus or dialogs as elements on a website may seem confusing or broken could be that most existing JavaScript implementations are actually confusing and broken.

roluxon Show HN: OxJS - a JavaScript Library for Web Applications

I don't want to dismiss your comment, but for me, the site is actually quite snappy, given that it's on the front page of HN. So I guess we need more data points...

roluxon Show HN: OxJS - a JavaScript Library for Web Applications

The website you see on oxjs.org is part of OxJS, and what happens when you click the documentation button is that the documentation is generated from the un-cached, un-minified version, live, on the client.

This is really nice if you're using and developing OxJS locally. On oxjs.org, it's definitely a waste of resources, and we will eventually cache the documentation data.