Hacker News Reader

int64_t is a userspace libc typedef. long long is ICO C (C99) and guaranteed to be 64 bits or more.

sircluelesson Reason #73 why C++ is a terrible intro language

I think a great deal of the pain in this example is self-inflicted. The hardware wrapping of an unsigned integer is fair game, but the multi-layer typedef and conversion to unsigned comparison are both warts of C++ that are totally avoidable. The multi-layer typedef is just the nature of enormous libraries with multitudinous compatibility concerns, so it's possible to forgive even that (and tools will help you there). But most reasonable languages won't let the assignment from unsigned int to int happen, and won't let the comparison happen either.

sircluelesson Linode SSD Beta

I wouldn't call an application that writes once and never deletes anything on the hard drive a write-intensive workload. Filling up a SSD with write-once data means paying well over 50¢/GB for your writes, which isn't something you can do if you are "write-intensive" -- if you're writing 100x the capacity of the drive over its lifetime, then you are really write-intensive, at which point the distinction between delete-intensive and write-intensive is nearly nonexistent for obvious reasons.

sircluelesson YC Will Now Fund Nonprofits Too

I don't like this question. It's akin to asking a startup, "What is your revenue model, and how will you be cash-flow positive?" Eventually every startup will need to answer that question, but asking it too early is more likely to stunt important and creative ideas that don't come with cookie-cutter business models than it is to reveal a winner. Much better to ask open-ended questions that get at the same thing: What's the potential impact of your idea? Why are you going to succeed where others failed? And if the answer is "We're smart and we have these advantages and everyone seems to like what we do" then it may be OK not to have the cost-effectiveness worked out in detail yet.

sircluelesson Shopify POS

...it would immediately be a target of fraud and unhappy customers and soon have to charge a more substantial fee. Bitcoin early adopters are willing to put up with more insecurity and inconvenience than most customers.

sircluelesson Bitcoin offers privacy as long as you don't cash out or spend it

This isn't a trustworthy arrangement. It may be true for a short time that a company holds true to its promise to delete logs, but especially in the US the government can and does issue subpoenas that require companies to keep all logs, and also prevent them from disclosing that they have received such orders.

sircluelesson John Carmack: Thoughts on Haskell [video]

> Database Error: Error establishing a database connection

Looks like we brought down another one. I was looking forwards to reading this too.

sircluelesson Algorithms, Part I: Kevin Wayne and Robert Sedgewick

Having actually been in Sedgewick's lectures, I can confirm that his soothing slow monotone is more effective than Nyquil for lulling students to sleep. That said, his course is damn excellent, and I know of no other teachers that have done better at making a course that actually teaches comp sci fundamentals in an approachable way. He's very understandable and clear even when played at 1.5x speed, which I recommend to anyone who isn't having trouble thinking through the concepts faster than he can lecture through them.

sircluelesson Functional Programming with Python

Not just the common ones, pretty much every one. Python 3 even removed the reduce builtin because it was so unreadable. Generator expressions and list comprehensions do so much more in a much more elegant way.

sircluelesson Art prodigy poses 'ethical nightmare' for parents

I've never been athletic at all, and I generally dislike playing sports, but I still appreciate having been encouraged to do little league and basketball when I was a kid. It's not about forcing kids to conform to social norms, it's just ensuring they're well-rounded enough so that they can make their own choices later in life.

My parents sent me to a school where painting, woodworking and handworking (basically knitting, sewing, crocheting) were all mandatory. It pays dividends now because having a background of creativity helps nearly everyone, even plain-jane computer programmers like me. Everyone had to perform in a play every year, no matter how much you didn't want to. That helped build confidence and the ability to speak in front of people. Gym and sports and recess are all important too -- no one regrets having too much hand-eye coordination, or the ability to play a pickup game of basketball without making a fool of oneself later in life. It's great to be able to relate to and be friends with people who are into sports even if you aren't, because the alternative is to politely remove yourself from all those interactions, and that's no fun for anyone.

I really do think that all kids should play team sports. If it's totally obvious that their passion is theater, or computers, or art, or music, or whatever it is, then there's no need to try out for the varsity team in high school, but giving kids diverse experiences and making sure they are physically active and aware of their bodies is never a bad thing.

sircluelesson Estonian E-Voting Source Code Made Public

Are there really places where C# is less verbose by any significant margin? The only thing I can think of is that a well-written LINQ library lets you abstract away a tremendous amount of heavy lifting into a clean and declarative query, but other than that pretty much everything requires more keywords, punctuation and declaration in C#.

Don't get me wrong, C# is relatively explicit and regular, which does wonders for its readability especially in large projects with many collaborators. But brevity is not one of its strong suits, nor should it be.

sircluelesson NeoCities

http://signin.neocities.org/

sircluelesson "Microsoft engineer" on Xbox1

This is price discrimination at work. It's basic economics 101 that monopolists or duopolists (such as Steam in PC games, or Microsoft and Sony in consoles) in a market will price their goods above the actual marginal cost of their goods, thus undersupplying the market. They would like to charge lower prices to some customers -- they are happy to sell to your brother for $30 because it's certainly well above their marginal costs. Unfortunately, it takes an awful lot of market power to be able to charge different prices to different consumers. Otherwise you will just have people arbitraging away all your profits (case in point, the folks who do a thriving business buying Steam games in the US region and trading them to folks in Australia and Germany).

Anyways, long story short, it's really hard to price discriminate in typical markets, because it's both really hard to figure out which of your customers will pay full price, and it's really hard to stop the people who get discounts from reselling to the full price folks.

But, if your market is digital, flash-in-the-pan pop culture items, then you have a market that's pretty much tailor-made for price discrimination. Who will pay $60 for a game? Well, the ones who buy it on launch, or pre-order for nominal bonuses. How do you stop the the people who buy at a discount from selling to those who pay full price? Two ways -- you attach the game via DRM to an account that is inconvenient to transfer, and you only sell the discounted copies 2 years later. Sales are also a good way to do this -- many people who buy games in sales either were waiting for a sale because the price was too expensive, or heard about the game because of the sale and wouldn't have bought the game otherwise.

The current status quo is that all the profit from the $30 customers is going to GameStop. Microsoft would rather it go to themselves and their developers, so they would rather have digital downloads. Not so they can stop games from being sold at $30, just so that they can sell games themselves at that price without killing their market.

sircluelesson PRISM fears give private search engine DuckDuckGo its best week ever

Not without someone noticing. Some sites have pinned certs in Chrome, which would stop this, and even without that you would expect some knowledgeable techie at Facebook or Github or something to be using their home laptop and say, "Wait a sec, this isn't my company's public cert!"

Not having seen any blog posts screaming, "OMG, my site is being hijacked wholesale," I can only assume that the NSA isn't doing this (or has managed to squelch by legal order every single person privy to the real cert at MITM'ed sites, which is absurd and would beg the question, why not obtain the private key from these people in a similar way?).

sircluelesson "Microsoft engineer" on Xbox1

That doesn't really work. The game is still supposed to be $60 at launch, that's when games make the most money, they really are worth that much (and more) as evidenced by the many people who pay that much for them, even on DRM-laden platforms like Steam.

The point is to let the price fall faster after launch. Xbox can't exactly promise "Our games' prices will fall faster than the other guys" because the market will determine that -- in aggregate they will, but there's a reason Skyrim is still $30 on Steam.

Microsoft wants a world where you have account-locked games tied to disks, because it gives them the benefits of Steam-like DRM but also the game conveniently on a disk to take to a friend's so he doesn't have to download it, and to let the poor schmuck in rural Nebraska with 25 kb/s to play the game some time in the next week.

Honestly, Sony can take the same pricing strategies as Microsoft on their digital downloads -- Microsoft just wants to have more convenient digital downloads, while Sony just wants more convenient disks.

My guess is that long-term Microsoft will prove to be on the right side of history (the success of Steam is evidence). Sony can probably do just fine for now, they can always transition in later generations when the downsides are no longer breaking news stories.

sircluelesson Members of Congress Go Silent Over Prior False Testimony On Surveillance

A republic is usually defined in positive terms: any government that is determined somehow by the public. That's basically equivalent to your definition that it is any government that is not private property to be handed down by heredity.

Some people use the term "republic" to imply "merely a republic" in the sense that the country in question is not a direct democracy. I am not sure whether this betrays that they think of government as having one dimension of variety from hereditary monarchs to direct democracy, whether they think that republics and democracies are incompatible forms of government, or whether they realize that democracy is merely one form of a republic and choose to simplify for effect when they say things like "The USA is not a democracy, it is a republic."

As usual, wikipedia is pretty good on the subject:

http://en.wikipedia.org/wiki/Republic

sircluelesson New Werkzeug and Flask Releases

There is a difference. Having a request or application context that encapsulates state is one thing, an architectural decision that simplifies multi-tenancy and makes many uses of Flask more performant. These are "simple", in that they are an obvious and easily-explained solution to a technical problem that exists by necessity.

Global proxies to local state are another beast entirely. They are "easy" in that they remove the need to pass application and request objects through every called function, but they are not "simple" -- they rely on intimate details and peculiarities of Python's module and import system, and its capacity for thread-local state, not to mention Python's robust context unwinding features in the case of exceptions. Overuse of context-proxies leads to the same software engineering challenges as overuse of globals, in that it becomes difficult to reason about the calling semantics of functions which rely on context state being present, or mutate context state through proxies. For example, in order to test a view function, you will at a minimum need to set up an application context, but also need to set up any custom context your app relies on. It's not always obvious how to do this, leading to documentation [1] that I notice has already been confusing people on the mailing list.

So I wouldn't conflate the two mechanisms. Application- and request-local context is a pre-requisite for multi-tenant applications and a conceptual simplification. Module-level proxies are a cute trick that makes programmers' lives easier, but undoubtedly creates more convoluted semantics and internal operation.

[1]: http://flask.pocoo.org/docs/testing/#faking-resources-and-co...

sircluelesson People with nothing to hide

This is extremely counterproductive. You aren't going to get anywhere simultaneously bemoaning the damage caused by extremist acts and the excesses of the NSA.

When you point out the failures of the NSA to stop specific instances of terrorism, it only suggests that they need more resources and legal surveillance. The reasons for wanting the NSA surveillance to stop have to be that the innumerable injustices suffered by citizens under a surveillance state would be worse than the occasional extremist attack that would be preventable under such surveillance.

sircluelesson U.S., companies: Internet surveillance does not indiscriminately mine data

The slides may have come from within NSA, but they were created for a non-technical audience of analysts. Suppose for the sake of argument that the reality is that the NSA has hardware adjacent to company servers or on the internet backbone nearby that can collect messages in transit that match some search query. That's not really direct access, and it's not indiscriminate -- all the subsequent statements from company execs and government sources would be correct. But it's easy to see how some mid-level worker in the NSA, trying to convey to analysts that PRISM enables them to retrieve emails, phone records etc. from various companies, would make an over-simplification and suggest that there is direct access to company servers.

"Never attribute to malice that which is adequately explained by stupidity." --Robert Hanlon. Despite the duplicitous and overly narrow statements about PRISM that skirt the truth, there's no reason to suggest they are all overtly lying, when a much simpler explanation is that some NSA employee overstated their technical capabilities on an internal powerpoint.

sircluelesson Learn C

The kicker for me that makes me think that working too hard to make easily parallelizable constructs isn't worth it is that communication is expensive and single cores are actually pretty darn powerful on their own. The implication is that you don't want to be parallelizing at too low a level. You want to be doing it at a much higher level if you possibly can.

If you have an 8-core machine and thirty independent tasks at the top-level, then all the functional programming research and parallel algorithm wizardry in the world isn't going to make you want to parallelize anything except the top-level tasks. So even if that's a verbose and error-prone task due to procedural programming constructs, at least you only need to do it once. Heck, in my own (admittedly limited) experience 90% of the hard work I have needed done has been handled by my OS's process scheduler and Redis.

The fact is that business applications, the web, and consumer software are all perfectly happy to accept the current limitations of hardware -- 12 processes running on 4 cores is efficient and easy, even with no parallelization at all below the OS process level (with the possible exception of GUI threads in desktop applications).

The only really interesting work happens in areas like HPC where you have 1 task and 900 cores and if you can't parallelize you are dead in the water, and latency-critical applications where the sacrifices made to run intra-task parallelization pay big dividends.

sircluelesson Provably Fair Shuffling Through Cryptography (2012)

You don't have to do it for every deck. You can work backwards from a desirable end result. For example, here's a really dumb formula to do a tiny bit better than random:

The game is "Black or red," where the top card of the deck is revealed. If it is black (clubs or spades), you win. If it is red (hearts or diamonds), the casino wins. The casino can cheat as follows: It generates all 2^32 possible Mersenne "cuts" of the deck. Then it finds those card positions which, through random chance, are shuffled to the top slightly more often by the Mersenne cut process. Then it chooses a deck to reveal as the "shuffled" deck at the beginning with a disproportionately large number of red cards in those locations. Since they will get cut to the top more than 50% of the time, the casino can do more than break even.

The law of large numbers and the fact that MT19937 is a decent PRNG that passes an awful lot of randomness tests says that the chance of each position being "cut" to the top is almost exactly 1/52. So the casino isn't going to do much better than 50% on this game. But the Mersenne twister isn't cryptographically secure at all, you can imagine a casino coming up with a better game that does better than this one at taking advantage of MT-generated permutations.

sircluelesson Provably Fair Shuffling Through Cryptography (2012)

I think tlrobinson means seed decks, not server_seeds as used in the generation of the MT seed.

sircluelesson Provably Fair Shuffling Through Cryptography (2012)

The "enough shuffling to cover all possibilities of the deck" is a server-side-only operation. It's not verified at all, they could replace a pre-shuffled deck with a carefully chosen one if they liked.

sircluelesson My Son Won't Do His Homework (2007)

Indeed, school is very, very playable. Here's one anecdote from my personal experience:

One of high school English teachers was notoriously hard on guys. It was generally understood that she considered them goof-offs and slackers, and didn't give good grades to guys even for really hard work. I was at a disadvantage in that class even before I walked in the door.

So rather than fight an uphill battle due to my gender, I spent an extra hour on the first report (a paper on Romeo and Juliet) and carefully drew hearts and a large rose in colored pencil on the cover page. I then proceeded to behave a smidge more effeminately than my natural self whenever speaking to her, and breezed through that year while my male classmates struggled, with my teacher convinced I was a persecuted homosexual.

I'm not convinced it was helpful in the long term, because the work I avoided in that class didn't do me any favors. I've never done particularly well in English classes since, despite my love of reading and an over-sized vocabulary. But it certainly did give me an appreciation for the malleability of rules and systems when they are administered by imperfect humans.

sircluelesson Show HN: It's hard to make friends offline, so we built a solution

Indeed, the internal monologue will almost certainly change from "Facebook? Are they planning to spam me/my friends?" to "Hmm, enumerating all my interests. Is it worth retyping all that to avoid facebook spam?" The latter is a real question with upsides and downsides. The former is all downsides.

sircluelesson 'Likes' are a Flawed Currency

There's probably better ways of doing this. Some people probably "Like" a bunch of things because they are less discerning, others do it because they are legitimate social leaders in their circles. So you may be able to do more if you have some way of knowing how many things someone sees and chooses not to like, or how many friends subsequently view based on a "Like" (which I suspect Facebook already considers when choosing what to show on timelines).

sircluelesson Show HN: Subtask – Organize projects the way your mind works

Indeed, the most valuable part of flashcards for me has always been distilling a semester into a set of questions that are suitable for the format. Then the flashcard is a marker into a larger corpus of information that is in my head, instead of the sum total of information I have on a topic.

sircluelesson Show HN: Subtask – Organize projects the way your mind works

Non-responsive superiors are a great excuse in business. Stuff can get "stuck" for quite a while if you have enough bureaucratic obfuscation to justify it. When the buck starts and stops in the same place you have nowhere to turn.

sircluelesson You are dangerously bad at cryptography

The token is just a key to a server-side session that will be deleted eventually, for example when the client logs out. If someone can hijack a session, that's obviously already a problem, but unfortunately XSS attacks are fairly common as they are something that can happen in any number of places on a website, and even vigilant developers will probably miss some. (See, for example, the recent XSS attacks reported on Paypal).

If you use a random token to a session that will be invalidated, then the attacker is at least time-limited. If you just naively sign an auth cookie and trust it later, he has a replay attack that will work permanently until you change your code.

As for you other suggestion, restricting sessions by IP address can be done no matter where the session data is stored. It will help to mitigate session hijacking in general, but it also degrades the experience, especially for mobile users, who will have to re-login every time they change IP addresses. It's particularly a problem if a form submission fails for this reason, because they'll probably get redirected away to a login page and lose any information they entered.

sircluelesson You are dangerously bad at cryptography

> Also, about the cookies, you can definitely have a plaintext cookie saying userid=42, as long as it's signed.

Not necessarily good enough. If you just sign a cookie that says userid=42, anyone who ever manages to read it can now authenticate as your user whenever they like. You just turned any session hijacking attack into an account hijacking attack.

Do what tptacek says, "just use random tokens to key a serverside session store" and don't write your own crypto.