just2n

Well that decision is pretty necessary when you realize that JS has no syntax to indicate a function is variadic (we use the arguments magic variable, but use of it does not necessarily indicate that a function is variadic) and that implementation supplied functions are not required to have their arity exposed via Function.prototype.length (http://es5.github.io/#x15.3.5.1).

There's no way to know, even at run-time, whether a function is being called with too few or too many arguments, since that's equivalent to the halting problem. So the sensible alternative is just to default everything to undefined, and silently ignore extraneous arguments.

But yes, if JS was strict with how it handled argument definition lists and had support for indicating infinite arity, I'd agree, this would be a WTF, or at least strange. But I think it makes a lot of sense, all things considered.

There are so many good WTFs in JS, but this is not one. parseInt expects 2 arguments and Array.prototype.map provides 3 to the callback it is given. Both of these facts are very well documented and known.

    var mappableParseInt = function(str){
        return parseInt(str, 10);
    };

    ['10', '10', '10'].map(mappableParseInt);

I'd suspect this snippet is more a snipe at people who don't know JS very well and expect parseInt to be base-10 only.

> Software is eating the world, and doing so using smaller and smaller teams. WhatsApp was able to disrupt the global SMS industry with only a few dozen engineers. Small teams can have a big impact because software development (and deployment) has improved dramatically over the past decade.

While this is true, I'm coming to realize more and more that a lot of would-be highly needed disruption is just not feasible because laws and monopolies are standing in the way, much of it due to lobbying and sometimes patents. It's sad.

My expectation is that if they were serious about this initiative, they very likely would've stepped forward with some vulnerabilities for disclosure.

But it seems like it's just words and business as usual.

I'm curious what their response would be in the perfect storm scenario. A foreign country or criminal enterprise causes severe damage to much of the US. Both the intelligence agencies, government secrets, and the technology industry are severely impacted, crippled even. And the enabler? A series of vulnerabilities they didn't disclose.

How much damage has to be done before people wake up and realize that what NSA doing is effectively pointing armed nuclear warheads at high-value targets in the US and giving our enemies the controls? The fact that NSA refuses to disclose serious vulnerabilities is an indication to enemy governments and criminals that spending money finding these vulnerabilities is going to be an extremely effective tactic.

I mean this seriously: this is actively telling our enemies how to attack us. How is this not treason?

> Treason against the United States, shall consist only in levying War against them, or in adhering to their Enemies, giving them Aid and Comfort.

My solution for 4 was quite efficient in design (and very simple). I was able to be very inefficient in the rough implementation (being lazy and copying arrays, reading the entire input file at once and breaking it up into lines in memory) and still, using JS, solve the large set in only a few milliseconds.

That should probably be a few orders of magnitude higher to realistically make the time constraint remotely difficult.

This was a fun problem to think about, though. Naomi is such a cheater.

So all evidence suggests that the 3rd problem is the hardest, by far, which is likely just some number of non-obvious edge cases.

Curious why the "hard problem" disclaimer is on the 4th?

The 4th also has a 90% solve rate (with 50% more submissions) while the 3rd has 44%.

Really it means (as everyone assumed in the first place) that anything a web server might have in its heap needs to be totally thrown away. Private keys. Passwords. Credit card numbers. Security questions/answers. Sessions.

Anything you'd send to a web server or receive from a web server is presumed compromised.

What do you mean "multiplayer"?

In the spirit of this challenge? A single exploitable endpoint where any number of N people are to go at the same implementation?

You can't tease this hard, man.

Also, Friday launch? :)

I agree with most of the points, as needless complexity and especially complexity to "add simplicity" (as this seems to be the justification). I believe it's generally a side effect of backwards compatibility -- we'd rather add customization via complexity rather than breaking something that's fundamentally not working into simpler, saner parts. The former doesn't scale with time. Something has to give eventually.

I'm a little confused at how he praises Angular and React while simultaneously complaining about the addition of complexity in HTML and CSS to support misgivings. That's a good description of what both of those libraries are currently doing.

I can understand looking on component-oriented development or intelligent data binding here as "better" if the entire underlying system is totally replaced by these. Unfortunately you can't get away from the complexity below them even in the simplest of real world applications, nor should you (a fact Angular sort of embraces, except that you shouldn't be modifying the DOM). It exists and is therefore relevant if need to do things in the browser. The ultimate outcome of total DOM abstraction is something like ExtJS which is just fundamentally broken and unusable. Something is broken when the thing that was supposed to make you productive constructs walls for your protection that you must break through or work around just to do basic things.

I'm curious in general about the author's interest in Angular. It's become so much more complex than that little library Miško was showing off way back before it became big. There's so much magic going on these days that it'd be a nontrivial task to master using it.

Maybe it's because you don't typically see an "app" that is just completely unusable on your device.

When the vast majority of simple websites (not even applications) have terrible experiences on mobile web browsers, is it really any surprise that users prefer using an app that at least puts effort into being usable?

HN and at least 80% of the linked articles I read on my commute have terrible mobile interfaces.

I really don't see the "performance" argument. It's unlikely anything you build natively is going to compete with a browser's raw HTML/CSS performance. That's something they do incredibly well. And really, that's all a static blog needs to be. I don't need your comments. I don't need your ads. I don't need your HTTPS. I don't need your massively broken up application that requires a GET for every asset on the page (and the 20+ JS files you've decided not to package together, none of which is needed). I don't need your parallax effects, your hover/click listeners, your scroll events, your damn lightboxes, or your image rotators.

At the end of the day, I don't use the mobile web very much. It's not because mobile web sucks. It's because nearly everything on the mobile web sucks.

They generally require a deliverable, though. If the product is successful, backers get some form of tangible benefit.

I don't see why this can't be some share of the company. Giving away 10% for a huge chunk of seed money ($2.4m in this case) is actually way better than you'll ever do from angel investors or any kind of incubator. So if the product is successful, throw a unit at a backer as well as a tiny percentage of the company. Just so they can not feel cheated when you sell for a multi-billion dollar exit that is not in the interest of your backers, because in that case they all get their money back.

You don't have to say "your backing guarantees you X% of the company", you just say "in addition to receiving a VR, you will also receive an X% stake in the company if we are successful."

The SEC can get involved precisely now, not when the funding happens, but rather when the options are given out.

It's up there with the price of my enthusiast RIVB, 4930k, 2x GTX 780 Ti, 64GB 2133 RAM, 256GB Samsung 840 PRO...

Seems silly.

This needs a donate button. There's more fun here than in most AAA titles. Hell, you could turn all of these into Android/iOS apps and make millions.

This seems like a problem that can easily be fixed with technology. We're in the industry of replacing inefficiencies.

Why don't we just replace ICANN?

I feel like that would stem from the belief that people only watch movies once, ever.

I mean, people re-read books. People listen to the same music many many times. And I don't know a single person who hasn't watched a movie they really like more than once. Most have seen some movies dozens of times.

I would not mind watching a movie with ads in some crappy streaming service for free if I also had the option of buying a DRM-free copy (an actual copy, including all the rights afforded to ownership of that copy by copyright law and by consumer laws, not a license to access a copy) at a reasonable price that I could then play on ALL my devices at the highest available quality.

That's how music works. That's even how physical books work. I don't buy the argument from big media that movies are special snowflakes and deserve to be protected from us by DRM and kept in bullshit distribution systems (like movie theaters or "pay per view" premium cable services).

I never understood this. Parents tend to get off work around 5-6, right? Schools were so adamant, in my experience, about getting kids out of there (and sending all the staff/faculty home) by 3:30. This is at every grade level, including those where the students can not yet drive. This also means that there's an extra need for school-provided transportation (busses). The need for more than half of the student body to ride busses feels like a huge process smell to me, both in that the city should be providing transportation and that the school is requiring students to come and go at times that are too inconvenient for everyone.

Why not, instead, shift the school end time back to 5:30? Instead of 3:15 (as it was for me, though I'm sure it varies), this adds 2 hours and 15 minutes to the day. As a result, the academic day can begin at 10:30 rather than 8:15. Labs, libraries, etc can all be open during this period to allow students to catch up on work, get help, etc if they wish to come in early (or need to due to their parents' work schedule). The cafeteria could even open on a limited basis to serve breakfast in this time. But there's no rush to get in class by 8:15 and no need to start serving breakfast at 7 AM or earlier.

Then athletics can start early (say 6:30-7) instead of running excessively late. And further, the school can remain open in the same state it did for morning for these students and others who wish to stay late and work on their assignments.

I felt, in HS, so rushed to get in class, "learn" (hard to do when you're constantly moving from room to room) and then get out and do all the work at home. Ok that's fine, it was convenient for me since I was able to walk home in just 5 minutes, but for most people I suspect this was a horrible pressure. And for people who don't have access to everything at home, this is also probably damaging to their ability to complete work, and likely discouraging. Not to mention distractions, etc.

I really liked how it was in college. Because I had to commute, I tended to stay on campus later. I didn't have my distractions (home, games, computer, etc) with me, so I'd end up just doing my work or research. Then when I went home, I had nothing but free time. Time I spent reading articles on hacking, watching defcon videos, chatting in IRC, playing games, reverse engineering, etc. All tasks which I thoroughly enjoyed. All made possible because I had a place to work separate from my home. So the notion of "home work" seems broken to me. Totally broken. There needs to be work/life balance, and part of that includes a separation of "home" and "work". I never felt that in HS.

I found it really strange that morning detention was incredibly productive. I had the pleasure of receiving this once in 7th grade. I brought a book and read half of it in that time. In fact, working was required, no talking. Otherwise I would've been just standing outside goofing off. There was no place for us to go like that at the school to be productive. We had to stand around outside until classes started. And you realistically had to do that to be on time to class. Doesn't this seem odd?

Also interesting was the partial schedule I had in my senior year. I had a calculus course that began at 11 AM, which means I got to sleep in most days of the week. I would often go to school at 10 AM and go sit in the library and read or go over my work, then go to class at 11. I don't think I ever received a B on anything in the class (sure, it was easy, but this was statistically anomalous to my other grades, I never did homework at home; I always did it on campus, and my grades reflected that, and I didn't care because "home" was not a place to do work). I also got a perfect score on the Calculus BC exam and skipped multiple college courses as a result. And because of that experience, I realized I enjoyed math far more than I had previously thought and wanted to learn more, beyond Calculus, and so I ended up getting a math degree.

Are there actually any negatives? Sure, the pay for teachers needs to be increased to justify spending more time at school, and even more than that, it should probably be doubled or more realistically because there's currently no economic incentive for the smartest people to teach. But that's an existing problem.

Do most games that use Lua for scripting (addons, UI, possibly game logic) actually use LuaJIT?

As far as I could tell, 100% of the AAA titles that use it that I tested (3 in total) did not. And in profiling, Lua was actually consuming a lot of CPU relatively.

That confuses me given how easy it is to use LuaJIT over the reference, and how vital performance in these environments is.

Games, contrary to the beliefs of dense hiring managers, disconnected producers, and even designers, are performance critical applications -- achieving a mere 30 FPS and > XX+ms input latency on hardware 5 years in the future in the enthusiast category, on the order of $4000+, is an absolute failure. Every gamer I've ever met (thousands, thousands upon thousands, hundreds that I know well) is extremely sensitive to performance. Performance is king. If a game looks a little shitty but runs AMAZING, it is better than a game that looks AMAZING but runs a little shitty. Hell, it's even better than a game that looks WTFAMAZING and runs pretty well. We only start caring about the looks, typically, when performance is sufficient. So if we can dial the game's graphics up while maintaining performance, we get happy. Enthusiasts love it when they can dial all the way to max settings and still play the game at 60+ fps and unnoticeable input lag. So running your render loop and lua on the same thread (a WTF in itself) and not using LuaJIT is a huge WTF.

I missed where anyone gave us the option of streaming new releases online.

Movie theaters offer neither convenience nor comfort. It's 2014, not 1914. Further, they are epicenters of disease transfer and otherwise completely and utterly dominated by inconsiderate jackasses who, to the benefit of everyone else, should actually probably stay at home.

It's hard to imagine that we live in a world where something so absurdly ancient is still the norm. They want us to endure that AND to pay $13 to watch a new movie. The 400% ROI on the first weekend of release isn't enough, they then want us to pay $20 to "own" the movie at home (and by own, I mean have access to watch it, because they learned that it's really bad to ever give anyone an actual copy of anything, because copyright law actually then prevents them from making even more money later on). Then maybe at some arbitrary point in the future, you can pay to watch a movie once, but for $5. Long after that movie is irrelevant. As a last attempt to extract money from a dead thing, and only as an attempt to make more money. It's in no way about your convenience, nor access to the work.

Imagine if music was still the same way. For every new work, radio stations are prevented from broadcasting the music at all. You have to go to an audio theater where you will sit in an uncomfortable chair with food stuffs splattered all over the floor, all the while battered from all directions with ads and menus for overpriced food and drink for "your enjoyment." You will listen using headphones that have clearly not been cleaned in a month, next to a person with a screaming child and another person who just sneezed a fine mist over 40 sq ft, much of which landed all over your face. Now you can listen to the latest and greatest the music industry has to offer. And oh yes, for this fine pleasure you WILL pay $13. No option just to hear the cover, not even at a reduced price. This is, after all, the bastion of decadence, a truly wondrous place where you should feel privileged to have access to the latest and greatest in entertainment! This is how kings live, and you'll like it!

Then 3-100 months later, chosen arbitrarily, you'll be given the "option" of having access to listen to that music whenever you wish for a mere $10 fee, and 18-500 months after that, finally, radios can start playing it, but only if they pay enormous sums of money to the copyright holders, which requires them to ask you for a subscription fee. What the fuck? You want to listen to music for free on the radio? LOL. Shut the fuck up and listen to my ads.

Clearly that model wouldn't work for music. They tried it, and it failed, so they actually adopted a better model, or rather they got out of the way and let innovators make things so convenient that piracy has become a mere historical oddity. I don't remember the last time I've even heard of someone pirating music.

So why do we still have these evil fucks insisting it works for movies? It very, very clearly doesn't. Piracy is a clear symptom of this. What happens when piracy becomes so easy and so simple that the barrier to entry gets lowered to nothing, so that everyone is suddenly able to experience availability as it should be? My sincerest hope is that it kills the profitability of the movie industry as we know it. Maybe then it may be replaced with something that actually places value in the consumer and their interaction with the work, not solely in the work itself.

A simple strategy of building along one side will get you to a 1024 tile every time, but getting to 2048 seems largely dependent on RNG. If you get tiles spawning where you want them, it's very easy. If not, it can actually be impossible.

It's unfortunate that RNG plays a significant role.

No, but it's not easy (in fact it's quite hard to do well) because of how insecure the browser is.

You can take advantage of the fact that you can store private information in closures. To prevent malicious code from overwriting a native function to which you pass sensitive information (like the CSRF token in this case) you need to Object.freeze the prototype of things like XMLHttpRequest or take your own references of the native functions.

Naturally all of this assumes the user doesn't do something like set a breakpoint and then inject a script with access to scope variables. But if social engineering gets you that far, you could probably just have the user run any arbitrary code on their machine.

This kind of stuff reminds me of these as a child: http://www.amazon.com/1-5-inch-Rubber-Poppers-Pack/dp/B002R2...

The memories.

Crockford does opinionated wrong. It's fine to be opinionated, but it's not fine to give absurd (often stupid) justifications for actions and beliefs that are wrong:

"I removed pointers from C because I saw people were using them to manipulate implementation defined details of their environment, a practice which would have destroyed interoperability. I know that the lack of pointers makes some people sad, but it shouldn't."

Another of my favorites is the justification for part of why jslint is unusable in any real environment because Crockford thinks anonymous functions are unprofessional and only used by people who don't know what they're doing:

https://groups.yahoo.com/neo/groups/jslint_com/conversations...

Sure you avoid the games, but they're clearly making tons of money. People find things that "work" -- they earn tons of money. They repeat. Other people see that it works. They copy. Suddenly the world is full of games that have artificial limitations that can be passed by waiting N hours or by paying $N.

I say we boycott applications that do this. But if it's easier to legislate, then by all means.

I'm not saying it would. But the point is that it should, and it's stupid that it doesn't.

It's 2014.

"Someone stole my car by using a packaged exploit that is easier to find and abuse than breaking anything on DVL"

This is just unacceptable.

I think most of us (here) care about the software our cars are running. It's also absurd that we can't access the computers and put our own software on them. It may be difficult to get legislators to realize just how bad this software is and how much important it is to get right, but it's their job to listen. An alternative is to push for openness of these computing devices. Having access to put your own software on any computer you own may enable the existence of open source implementations that are better than the defaults, and sensationalist headlines might get enough attention of the right people to make something happen. "These hackers can keep your car from being stolen, for free."

Alternatively, headlines about this kind of issue need to be more specific. 'Mysterious "black box"' seems like the headline created by someone in the pocket of the industry. Instead, how about a headline like "a black box created by low-tech criminals exploiting massive security holes that car manufacturers know about allows anyone to unlock and start any car". Maybe it's a bit wordy, but it's somewhere to start. And it shines a light on the real problem. It doesn't paint it as a mystery with only the thieves at fault.

I don't think there's any other way to apply pressure to these companies other than regulation, unfortunately. They don't care much about what we think, and their customers don't care, so outside of forcing them to use a secure system (or else not be allowed to sell their products), it'll never happen.

It doesn't because 99% of people are entirely and completely ignorant of these systems and their importance. And no amount of discussion or even car theft is going to put it in terms that they understand. Here the news item is "with a black box that nobody understands." That wording is HORRIBLE for HN. Because it makes it sound like it's black magic and this group has found some genie that opens cars. Instead, it's more likely a simple exploit of a very vulnerable system. But that wording gives you a glimpse into how most people see technology. It's just magic. Their cares about how software works are nonexistent enough. There's no reference for "good" vs "bad" crypto, insecure design, etc.

Until we have a car that kills 500 people because of faulty software, it's just not that important to people, which means there's no pressure in industry to get it right. People understand "my car will kill me if X isn't good." That's why people understand getting their tires rotated and replaced. That's why they understand to get checkups and to replace belts, filters, oil, etc. That's why they understand you need to replace your brake pads and other such hardware, even if it feels a little expensive. But when you point out that very few people have ever even been injured by bad software in a car, they think "well it can't be that bad." And "good enough", especially in a market like the US where mediocre is what sells the most, is where the market stops innovating.

I hope a company like Tesla is a little more concerned with the quality, though. Maybe we can get a decent example of how to do things.

I don't think "government" means "good engineering", I think that it should be thoroughly vetted by sufficient expertise.

I'm not sure if the FDA or FAA are capable of doing that, given how the government is really, really bad at building or contracting software (in general).

If only we could have some kind of standardized software to power these devices that is built by the community at large and thoroughly reviewed for correctness. Even at the cost of limiting hardware, I think that's an option.

During the daytime, your solar panels are dumping power onto the live grid. The same grid your car at work is plugged into. And all your neighbors'. And every other car in the garage or parking lot.

During an outage, unless it's a weather-critical incident or a disaster, the convenience of not needing to go and power a generator (and thus mess with needing to refuel it, and depleting your supplies which will be more useful in a real disaster) would likely be better. If it makes sense to power up a generator, then do that. It would also be charging your car.

This is only the tip of the iceberg as far as this kind of thing is concerned (this kind of thing being people relying on software to keep them and their belongings safe).

With peoples' lives at risk and with cars representing huge investments for many people, it's probably about time to get regulation that requires the software systems that are interacting with vehicles to be open to experts at large.

The same goes for things like in-home security software.

The competition should not be in the critical software. That much needs to be standard. The competition should be around fluff, construction quality, body design, brand, perks, horsepower, etc.

How is this kind of thing handled in the medical and aviation industries? How about NASA? Life-critical and safety-critical software isn't something you should hire the lowest bidder to create, nor is it something that should be hidden away in the belief that "obscurity is (the best, and the only) security."

What kind of draw can you put on these batteries?

An 85kWh battery may be more useful in every garage than this article claims. The added expense is claimed to "keep consumers away", but really it means things like solar panels become more useful.

If you are able to charge your car via power you generate and it can supply enough power back to run your home, you can get some huge benefits. You can have power at night that you generated during the day. No need to suck power from the grid. During outages, you would likely still have a few days of power. And finally, if we actually take full advantage of this, our power infrastructure could directly use these cars to distribute and store energy and route around outages, increasing stability in a huge way.

All in all, this could usher in an era of crowd-sourced power generation. One of the primary reasons that hasn't been feasible was the ephemerality of power on the grid. You consume it just after it's produced. We have no good way to store it. But with hundreds of thousands of 85kWh capacity batteries plugged into the grid, we suddenly have a start.

I think paying an extra $20,000+ for a car if that's a potential outcome is worth every penny.