Hacker News Reader

ssafejavaon How to reliably and portably check the OpenSSL version?

What's the rationale for doing this, rather than simply using the package from upstream?

That would be perfect for a ratio-enforcement scheme that works cross-tracker.

I'm sure there would be ways to game it, but it could go a long way in ensuring the average user gives what they get. It would be awesome to integrate a 'currency' into a similar client, where you slowly earn more by seeding.

ssafejavaon "Fixing" xkcd 1340

Since the image is actually rebuilt server-side to reflect the current rotation of the earth, it's simple to just rotate it with CSS based on the current time:

http://jsfiddle.net/4taWt/1/

ssafejavaon Ask HN: Should I quit my job if I am not learning?

That's nonsense. There are a lot of reasons that a first (or any) job isn't a fit, and a whole lot of them aren't caused by the employee's negative traits.

Just to name a few: the job description didn't match the actual job, overbearing managers, overbearing coworkers, uninteresting work, a better offer elsewhere, changing interests, or - just like OP - the employee feels like he would grow his talents better elsewhere. I have been in the same situation and employers have understood and respected my decision.

ssafejavaon Wireless System Could Offer a Private Fast Lane

The pCell spatial demonstration [1] is really amazing. If this delivers what it promises, we could finally have the technology we needed to cut the cord entirely for personal/business Internet access and to no longer be at the mercy of Comcast/TWC/Verizon to deploy the last mile. That is, if we aren't just trading one despot for another.

1. http://vimeo.com/86746051

ssafejavaon Bitrot and atomic COWs: Inside “next-gen” filesystems

Lots of people do - some backup providers charge tiered amounts or 'unlimited' data, and the convenience of getting your OS back exactly the way it was is absolutely worth using an extra 10-20GB of storage.

ssafejavaon The "Window Resizer" extension for Chrome now contains malware (2013)

A chrome extension can make network connections that you won't (normally) see in Dev Tools using a background page. You'll see the connections if you inspect the background page directly but most users won't.

Unfortunately this is simply a byproduct of the web's (and browsers') botched security model; there is no way to allow extensions to modify pages without them being able to read the pages, and if they can read the pages they naturally can catch events, including keystrokes.

This is why you should think - hard - whenever allowing any extension with that permission. It could autoupdate at any time to include malware.

There are a lot of bad extensions out there. I've encountered quite a few. It's a wide-open vector for exploitation and it happens all the time. Just last month I came across a game extension (super mario clone) that contained jQuery. Upon further inspection, it turned out it had been re-minified (making diffs difficult) and had a few lines deep inside that hijacked ads and replaced them with the author's ad network. Silent, effective, and this extension was on the 'top lists' for months. It might even still be there.

Be very aware of the permissions an extension asks for.

ssafejavaon CSS Variables in Firefox Nightly

This is a fantastic feature, and something that preprocessors like SASS/LESS cannot do without complicated workarounds.

There are often times in my CSS workflow where I want to do something similar to this:

  .widget
    $padding: 3px
    $activeColor: $color1
    $inactiveColor: $color2

    padding: $padding
    /* ... etc. */

  .subWidget
    $padding: 6px

  .subWidget2
    $inactiveColor: $color3
    /* ... and so on */

With preprocessors, this doesn't work - you're better off defining a mixin that you feed variables into, which isn't the most intuitive approach. I hope this is adopted quickly by the major browser vendors. Unfortunately, writing your styles in this way will completely break in browsers that don't support it, in the absence of some sort of polyfilling JS or build tool.

ssafejavaon JavaScript Developers: Stop Being Cute and Clever

That's not the first time I've been disappointed in the style and operation of the JS packaged with bootstrap. While they solved some useful problems and packaged it nicely, they did so with very little regard for style, performance, or extensibility.

The typeahead plugins, both the bootstrap and the larger standalone versions, are hellish to work with or modify in any way. The same goes for dropdown and many others. Unfortunately they never thought that anyone would use these plugins except in their prescribed way - so few to no events are ever thrown, and incoming events are often canceled (stopPropagation, preventDefault), making it hard/impossible to reuse those events for other interactions.

I have had to monkey patch bootstrap JS more times than I can count and I generally stay away from it now. I don't think there's anybody paying much attention to the repos anymore; the number of issues and PRs outstanding for typeahead.js (a small library!) is pretty astounding.

FYI, the older versions of bootstrap.typeahead were more performant, but of course did far less than the now standalone typeahead.js does.

Don't get me wrong, typeahead.js is a nice project and the devs have clearly worked very hard on it. It does some really nice things. But there is clearly some leakage from the twitter style where comments are barebones, assignments take place in conditionals, semicolons are missing, and ~ is a common sight. It is effectively write-only code.

ssafejavaon Implementing microstates in Backbone.js

That's really interesting! Could you post any examples of how you're using it?

ssafejavaon Implementing microstates in Backbone.js

TFA is arguing to use the router for navigation without having it push a separate URL to the bar, and still have back/forward work correctly. Essentially, creating a route change that isn't a route change, so it can properly trigger a router action. Of course, this is the actual point of `stateObject` as far as I understand it.

I think this is a good idea and would make a nice simple Backbone plugin. I've run into similar issues before; sometimes you want to display a temporary menu or other interstitial without a refresh taking you back to it.

Some purists get annoyed by this sort of thinking; they think that the URL bar should always reflect the current state of the app. I disagree with that line of thinking; different apps have different requirements and one size definitely does not fit all.

I've been writing Backbone applications for a while and I constantly run into router limitations that require creative solutions to get around. Backbone.routefilter is a great way to get some more flexibility - in every project I usually use a home-rolled combination of routefilter and a few more injected events. One of my favorites is to add permissions checking at the router definition level, to provide routes that only specific users should be able to use.

I've also been floating the idea around in my head of the url being essentially just a text representation of a state object - could easily just be a query string or something similar. Instead of a router globbing the url, you could attach event listeners to events on specific properties (similar to model/collection events), giving you all the power that most server-side routers have. For example:

    var MyRouter = Backbone.ExtendedRouter.extend({
      routeEvents: {
        'var1' : {'change' : onChange},
        'var2' : {'change add remove' : onVar2Event},
        '' : {'all': onRoute}
      },
      // ...
    });

And so on.

It would then be great to use the above microstates idea to create a navigation api like the following:

    App.Router.setState(publicState, privateState, triggerOptions)  
    App.Router.replaceState(publicState, privateState, triggerOptions)  
    App.Router.addState(publicState, privateState, triggerOptions)

That way, we can trigger routes exactly when we want them (with or without an actual url change), store private state using the History API, and support microstates. The best part (IMO) is that different routers can listen to separate parts of the url, allowing a URL change to trigger multiple routes on completely separate routers. This would go a long way toward true separation of concerns in larger apps.

Of course a lot more needs to be fleshed out. If any BB devs are interested in helping with idea, please let me know (email in profile)!

ssafejavaon CPU reliability – Linus Torvalds (2007)

I think the GP was on the right track, but somewhat confused. They obviously don't do this on all models, but some dual-core models are disabled quad-cores. Remember the Athlon X3? That was a binned chip that usually was created from X4s with a broken core. Most buyers didn't mind, and some of them got lucky and were able to re-enable the disabled core.

It seems like the GP might be suggesting that a quad-core CPU will swap in another core when one dies. That doesn't happen. But the binning process allows them to still sell slightly defective silicon with disabled parts (cores, cache), which saves money.

On a related note, a lot of GPUs actually do have a few dozen execution units that are disabled by default and can be swapped in after stress testing at the factory. I believe some can even do that in the wild, but I could be wrong.

ssafejavaon Bitcoin’s roller-coaster ride gets wilder as Wall Street, China climb on

Just use coinbase. IMO it's the only exchange that actually does fiat currency to BTC correctly - all the rest have horror stories posted all over bitcointalk and reddit.

ssafejavaon Ben Noordhuis's Departure

You have to admit, that responding to a very informative message comparing and contracting Solaris's networking stack with Linux's with

  Have you ever kissed a girl?
  - Bryan

is incredibly tasteless.

But of course that was long ago.

I don't think it at all appropriate to criticize what was clearly an honest mistake with a call for his employer to fire him. I would expect that of the masses on Twitter and commenting on the PR, but not of Joyent or Cantrill.

ssafejavaon Xbox One: The Review

The nicest description most Polygon staff could manage for the Xbox One's silhouette is "inoffensive" — there's no sugarcoating the console's lack of visual flair. Microsoft has created a system designed to blend into the other components of your home entertainment center, and it does that ... for better or worse.

It's quiet, and it runs relatively cool. But if you’re looking for subtlety, this is not the console for you.

Is it just me, or does the writer/editor not understand the word "subtle" here?

Otherwise, that was a really beautifully done review, at least visually.

ssafejavaon Ask HN: Should I focus on my job or my degree?

In my experience, it is absolutely worth having a degree - by all means, don't give that up, you should graduate, especially since you've come this far.

In terms of grades, I found that only my first two jobs cared about GPA - I took it off my resume shortly after because work experience became much more important. That's not to say you should give up on your GPA entirely, but in my experience companies care far less about GPA than they care about whether or not you can actually code.

ssafejavaon Ask HN: Remote workers, tell us how you got started

I became a remote worker through a mix of bad luck, bad management, and a startup that wasn't going well. Of course at the time, I thought it was terrible; it turned out to be incredibly liberating and probably one the best things that's happened to me, professionally.

I was a software consultant for about a year and it was all networking - after all, that's how business gets done in the real world. I never had a time where I had too little work to do. My 'hack' for the whole thing was working in a coworking space, which is IMO the best ~$300/mo you can ever spend in a city that has one. I was lucky enough to have been working in one for more than a year and half before I started working for contract work, but I think you could easily do it in less time than that. When I started looking for work, everyone knew somebody; I never went outside of my space to find any work. It was incredibly convenient and really just worked out easily.

I always advise coders who are looking for freedom, a work environment change, or are newly unemployed to try a coworking space while they figure things out. You'll make a bunch of friends in a low-stress environment, meet entrepreneurs, and make great connections in the community that will get you work. It has worked well for those I know who have tried it - the secret is finding the right space. A socially-oriented space with as few walls as possible is best. You get used to the noise. Take long coffee breaks, go to lunch with people, go to happy hours and meetups. If you let it be known that you're looking for work and others know your skills, the jobs will come to you.

ssafejavaon HealthCare.gov’s head tech guy is out

Naming him wasn't the right approach and I apologize for that - however I cannot edit or delete the post. His involvement as the UI team lead is, however, public information. His credentials are not the main issue, of course.

There are serious quality issues along the entire codebase and a number of snippets that strongly suggest the team's primary skill is not JS. Given the cost and gravity of the project, I believe it is fair to say that the American public expects (and deserves) better. It speaks to the vast inefficiencies of the RFP process and gov IT contracting in general that code quality is so far down on the priority list.

It's not just aesthetic, either. There are serious functionality issues, as anybody who has used the site will attest to. And those bugs are not just limited to the backend. Backend bugs have seriously compromised the security of user accounts [1] and frontend bugs prevent major sections of the site from running at all [2].

It is one thing when ugly code is "successfully deployed to solve problems". It is quite another when ugly code on such a high-profile, expensive project is deployed to such disastrous effect.

The constructive part of the post is the repository I linked to (issues are being reported and fixed, for better or worse), and in bringing attention to the fact that government IT does not follow serious engineering practices. Serious attention needs to be brought to the problem so that it can be fixed. I am not happy about it, I am not pointing fingers with glee. I just hope that it has embarrassed HHS & the administration enough to make substantive change.

1. http://blog.isthereaproblemhere.com/2013/10/does-healthcareg...

2. http://blog.isthereaproblemhere.com/2013/11/stuck-in-middle-...

ssafejavaon HealthCare.gov’s head tech guy is out

It gets worse - the UI team lead had an associate's degree in Art & Web Design from a community college, and a bachelor's in Zoology. [1] Normally, I would say credentials generally don't matter - but combined with the code quality, the argument writes itself.

I started looking him up after seeing this mention (and the awful code below). [2]

1. http://www.linkedin.com/in/mkayan

2. https://github.com/STRML/Healthcare.gov-Marketplace/blob/mas...

ssafejavaon Mozilla, OTOY, Autodesk Work to Deliver High Performance Games and Apps on Web

I believe sound is disabled by default - makes it honestly not very different than an animated GIF from an advertising perspective.

ssafejavaon Adobe confirms stolen passwords were encrypted, not hashed

So, if Adobe engineers eventually realized that they needed to upgrade their password security, and they had access to the passwords in their DB (they used 3DES, and they had the key) - why did they not immediately decrypt and hash all passwords?

ssafejavaon Show HN: Make your app handle going offline

You guys have put out some great pieces of JS in the last year and the quality is getting better. I'm a big fan of how this is not jQuery dependent and the code is simple. I've been watching the HubSpot repos since globalMessenger and the code and presentation are far above par.

Thanks for releasing your internal libs.

ssafejavaon Off

The difference is only a few inches!

ssafejavaon The PC is not dead, we just don't need new ones

Computers DO get cheaper every year. That Core 2 Duo machine you bought in 2006 might have cost $2000, but those components (if you can even find a place to buy them) would likely cost about $300 today.

It's unfair to say that they don't get cheaper considering that a Mac Mini is an entirely different class of machine from an Apple II, in so many ways that it's ridiculous to even try to list them here.

As for your statement about $570 vs $200... what do you base that on?

ssafejavaon Why Python uses 0-based indexing. It's because of slices

Funny thread, but just in case somebody takes it seriously:

    (And to those taking the thread seriously: this is all 
    in jest. We won't change the indexing base. The idea 
    is so preposterous that the only kind of response 
    possible is to laugh with it.)

    --Guido

https://mail.python.org/pipermail/python-ideas/2011-Septembe...

ssafejavaon Healthcare.gov Lines of Code Comparison

The craziest part has been the hysteria about the healthcare.gov repository going down. It never contained any files that were useful to anyone - it was just the blog / landing page. It's like Microsoft promising to open-source their operating system and all you get is the software that generates the help files.

ssafejavaon Healthcare.gov Lines of Code Comparison

Have you found marketplace backend code anywhere? The frontend code is easy to find and there's at least one repo with it (see my previous code) but I'd be very interested to see backend code.

ssafejavaon Healthcare.gov Lines of Code Comparison

A simple `find . -name '*.js' | xargs wc -l` on the marketplace repository at https://github.com/STRML/Healthcare.gov-Marketplace reads about 72K LOC. About half of that is vendor scripts, such as jQuery.

The 500M figure is quite obviously nonsense. Even if one adds the source of every tool involved, including the browsers used to display the site, it would be difficult to get to 500M. For example, Chrome is ~5M LOC, depending on comments/version.

ssafejavaon HealthCare.gov’s glitches prompt Obama to call in expert troubleshooters

While the server-side components may never become open-source or auditable (significant portions are based on existing, closed systems), the client-side code is easily auditable. If you have a chance, I would love to see what you would find by analyzing https://github.com/STRML/Healthcare.gov-Marketplace. If you get a chance to look at it, please submit a PR.

ssafejavaon GoDaddy, Media Temple, and the Horrible World of Web Hosting

Anecdotes are one of the only real ways to get information on whether or not a hosting provider is any good. At least it cuts through the marketing BS. I generally track hosting company's Twitter accounts too - it's pretty telling what people will say to them. I've been using a few sites to keep on top of it as I bring up some new services:

[1] http://reviewsignal.com (reviews scraped from social media / public support requests) [2] http://serverbear.com/ (VPS/Cloud host benchmarks & stats)