fffggg

And he has decided it is not a standardized language, by any stretch of the imagination. That's the guy's point, and it's spot-on.

As an aside, I didn't realize there would be people on HN who wouldn't recognize rasmus@php.net immediately.

I agree. This should not be surprising. The ability to link a file to a directory is different from the set of permissions necessary to change the data in the file.

Here's a practical example: I can create ~/public with permissions 777 (fully permissible) and allow my friends to read and write freely in it.

They can create files with permissions 600 (only they can read/write)

I can't open up these files and read the contents, but I can remove the entire thing from my home directory.

I take things a step further -- I have no idea what my password is on sites like HN or reddit. If the cookie is ever gone, my account is gone.

I don't like the idea of identity permanence.

Instead of shitty passwords though, why not use something like 1Password to store the logins? I use that (or an old fashioned piece of paper in a secure location) for meaningful security tokens.

It's true that US public spending is larger per capita. Several times bigger than many successful european countries. It's a problem and deserves recognition.

However, it is not "120%" of the problem as you suggest. Military spending is similarly out of proportion (arguably much moreso) and military spending consumes much, much more of our federal budget than healthcare.

I'm not objecting to the idea that we need to fix our health care system -- you are right on. I'm saying that it's not "120%" of the problem; defense is, and has always been.

Military spending as a percentage of GDP only decreases if you don't count military spending outside the DoD's official budget -- which is why it appears to have shrunken when it actually has not.

For example, 50 years ago veteran's benefits were part of the DoD budget. Today, they're part of the healthcare budgets. VA spending accounts for 20% of all government health spending -- and has grown astronomically over the last decade. It's huge.

I urge you to take a second look at the numbers you're quoting. Specifically, consider how much of the "healthcare spending" increase is actually a hidden increase in military spending which has been quietly shifted into a non-military budget.

That's sarcasm, right? Military spending outstrips healthcare costs by nearly 2:1, and has for decades.

Core network as well as many POSIX functions which other languages place in sub-modules (but still use the same names for). eg select() vs IO.select or mkdir() vs FileUtils.mkdir.

OP is clearly thinking of PHP.

I'm describing about a dozen separate projects above. For same-system fast IPC I often used an in-house library (with Perl bindings) which implemented a memory mapped, sharable hash table. Unfortunately it hasn't been released as open source. The closest similar project might be http://fallabs.com/kyotocabinet/ however it's inferior in a few important ways.

Others have noted that your reply is a non-sequitur. However, I'd like to address it anyway, specifically the "luck" part.

I have written all of what you describe: large-scale multithreaded high-performance distributed applications using Perl.

When necessary I have written perlXS bindings to C routines, but this is surprisingly infrequent. Most high performance system interfaces are exposed to Perl in an efficient manner. I've had Perl processes with tens of gigs memory resident. I have written non-blocking state machines in Perl which serviced (or served) over 100k connections in parallel. Which have run on over 100k machines at once. I have worked on huge modular, multi-team undertakings in Perl. The single caveat is that separate processes and explicitly shared memory is the parallelism tool of choice with Perl.

Luck wasn't a part of any of this. Perl will scale quite well, and if you think it doesn't you likely have a few things to learn about what the language/platform can do.

What you suggest is absolutely unnecessary. Merely requiring an identifiable contact is enough to prevent this sort of behavior -- and this was how things were before voip opened things up to untraceable abuse.

The phone company doesn't need to police anything -- they just need to identify the endpoints of a call when a subpoena is issued.

The following banks and financial institutions also silently discard case-sensitivity:

Citibank

Chase

Wells Fargo

E-Trade

US Bank

Fidelity Investments

SECU

HSBC

TechCU

Responsible disclosure exists in order to allow an obscure, previously undiscovered bug to be patched before others know about it. The idea is that no one else is likely to discover the issue while it is repaired.

This is not an obscure bug. This is obvious -- very obvious. Many people will have discovered this already. Furthermore this is a pre-release product.

There is nothing to be gained by not talking about it.

And if the hypothetical car rental firm has no assets, let's take the assets directly from the nearest bank! Those guys always have money!

It appears you're suggesting a structure of a business, where the owner isn't leasing to an unrelated party. An employer is liable for the actions of his employees (even non-employee employees) through entirely separate and much more appropriate channels.

Judgement-proof operators? Nowhere was it suggested that operators ought be judgement-proof. In fact, I suggested the exact opposite.

The issue is exactly one of lobbying. As the article notes, the auto insurance industry has successfully lobbied to pass the Graves Amendment, which nullifies vicarious liability for auto rental. The article mentions this, and you can read more here: http://codes.lp.findlaw.com/uscode/49/VI/A/301/I/30106

Car rental owners are shielded by this lobbied-for legislation. The only question is whether Ms. Fong will qualify as a rental agency for the purposes of this law.

This is precisely a case where an industry has lobbied for an exemption which may exclude others from competing in said industry. It is a textbook example of regulation preventing disruption of an established industry.

Children don't have owners, they have parents -- and the determination of responsibility is much less clear than your glib comment implies.

For example, is liability held by the biological parent, or by an entity acting in loco parentis? The distinction is crucial, as it is similar to the difference between an owner of a car, and a renter of a car.

With pets, again, if I lease or rent a pet it is not the case that the owner is necessarily responsible for the pet while I have possession. They may, but they also may not -- and it's this uncertainty which drives much frustration with tort law.

"I do not think it is that clear-cut, even for car rentals"

Well, it is that clear cut. As the article notes there is a law which unambiguously states that car rental agencies are not liable in this scenario: http://gregjohnson89.wordpress.com/2010/10/28/vicarious-liab...

As the article further notes, the only question is whether a loophole in the law's definition may cause Ms. Fong to not qualify as a car rental entity.

This doesn't seem any less perverse to me. Shifting responsibility to the operator makes sense for injury resulting from operation. Shifting responsibility to the owner only makes sense for injury resulting from the ownership (improper device maintenance, etc).

If you can hold the owner of a car liable for a crash then what stops you from holding the creator of a car liable for a crash? Why not go after Toyota? By this line of reasoning Toyota is just as culpable as Ms. Fong.

Indeed, some tort actions have gone beyond owners and even pursued manufactures -- particularly gun manufactures.

The idea that an object owner or object creator might be liable for the actions of an object user is unreasonable and perverse. It has a chilling effect on innovation and forces small businesses (who can't afford to lobby regulatory protections such as the Graves amendment) out of the market.

Yes, all that's needed is for it to become available to subpoena and other lawful process.

Sudo was an example, and is certainly not the only place this problem occurs.

Variables cannot be set in the child process; the linker will have already run by the time you can access your environment. Furthermore, this scheme destroys the utility of LD_* variables, which itself is a non-starter.

All setuid binaries will be incompatible with any scheme which involves environment variables controlling the linker -- that's a core element of unix security architecture.

Over here [ http://news.ycombinator.com/item?id=3995200 ] someone who I believe is the author suggested that this thing uses DT_RPATH, and I've outlined the problems with that mechanism as well.

Perhaps I'm coming across as a curmudgeon, if so I apologize. But I've worked on this problem quite deeply and there's just no way to reliably solve it. Modifications to ld.so are an absolute requirement.

No, it won't work. This is my area of expertise and I can unequivocally state that it is not possible to solve this problem on a unix system. The linker infrastructure does not exist, and here's why:

RPATH (or better RUNPATH) has intractable conflicts in library dependencies. For example, this cannot work for any application which uses dlopen() and packages its loadable modules independently of the invoking binary. This is a problem for very high profile software such as:

* Apache, and just about any other application server with a plugin interface * Perl, Python, Ruby, Java, and just about every other interpreted/VM oriented language

Furthermore, there exists other intractable conflicts in complex library dependency interactions. For example:

bin/A needs SONAME=B.so.1 needs SONAME=C.so.1 (v1)

bin/B needs SONAME=D.so.1 which needs both SONAME=C.so.1 (v2, incompatible) and SONAME=B.so.1

The dependency relationship of every shared object in this chain are not static, and you cannot modify the invoking binaries (where RPATH must be set) every time an intermediate shared object changes its linking requirements. You also cannot guarantee ordering when a single node depends on multiple libraries -- the order of evaluation is non-deterministic. You might say this is a corner case, but you would be surprised when you try at scale. This is not a corner case.

Seriously, I understand everything about this. Can't be done. You feel free to try it out and see that it doesn't.

Environment variables won't work. They're either reset for security (when sudo is invoked, for example) or they bleed inappropriately into sub-processes. There is no reliable way to solve this using environment hints to the dynamic linker. End of story.

There's a very simple explanation: Unlike all the countries you mention, the majority of our US tax dollars goes toward military spending.

The npr graph from the parent post is extremely misleading, and understates the US military budget by roughly a factor of 2. Huge portions of the "non-military" budget entries are covers for military spending.

For example, the npr graph counts $141 billion dollars in VA health care for soldiers, but this isn't listed as part of the military budget. The same games are played with weapons r&d (often budgeted to the Dept. of Energy). Our recent Dept. of Homeland Security contains a great deal of military spending as well.

When one separates the budget by spending intent rather than the politicized department budgets in the above graph it becomes quickly apparent why we don't have good social services -- we're spending it all on military.

"You can have multiple versions or variants of a package installed at the same time. This is especially important when different applications have dependencies on different versions of the same package — it prevents the “DLL hell”."

This sounds nice, and it's a direct quote from the product page, but I can guarantee that Nix does nothing of the sort. This would need to be addressed in ld.so. It's simply not possible for a packaging system to solve this problem on a typical unix system.

"would software patents be as bad if"

You've chosen difficult wording here. When you ask if things would be so bad if we lessened their badness the answer is obviously no -- things would be incrementally better if made incrementally better. But this is no more than a tautology. Software patents are bad, in any form. They can be made not-quite-so-bad, but they will always be harmful to the intellectual development of society.

This comment stood out for me as well, and strikes me as extremely disingenuous.

Another that caught my eye was "Free Software is like Free Love, a hippie pipe dream in which computing is free from venality, commercial interests, even capitalism"

I was upset that Pike could write such things in 2006 as this is demonstrably untrue -- contrary to being a pipe dream, Free Software has completely replaced the space previously occupied by ATT unix. But, then I realized this piece was authored in 1991, which makes this opinion merely lacking in foresight.

I'm in an urban area as well. The hospital I took my daughter to was El Camino Hospital in Mountain View, for example.

It's even worse for rural people.

You haven't visited many doctors and/or have been very lucky and/or haven't been paying attention.

I was referred to a specialist this week for a new injury. The specialist's office asked me to sign several standard looking forms, one of which had almost this exact language (you agree to the terms of our privacy policy).

Then just today I was at the pharmacy and after swiping my credit card for payment I was faced with another dialog "I have read and understood the pharmacy's privacy policy"

It's not as simple as "find a new doctor." First of all, I'm on an HMO and my choices are very limited -- in most non-urban areas there may not be more than a single practice or hospital, which uses the same paperwork for all patients.

Am I supposed to put obtaining my pain medication, or potentially life-threatening care on hold while I hunt around for a new doctor? I've seen and signed similar policies while admitting my infant daughter to the ER with a 105 degree fever -- you ask how hard it can be? It is literally impossible. Obtaining health care services is not like shopping for a pair of shoes, and there are often no alternatives available.

It's a really cool idea. I would worry about it interrupting normal life. If Gloria has limited availability (on lunch, sleeping, at a movie or otherwise living life) then the app is significantly less useful.

Yes and no. There is no such notion in copyright law. Case law is unclear, however: http://en.wikipedia.org/wiki/De_minimis#Copyright