Faceniff: Cookie snatching for Facebook on Android - <AUTHOR> http://www.engadget.com/2011/06/02/faceniff-makes-facebook-hacking-a-portable-one-tap-affair-vide/

<comment><USER2> I was curious about the technique used under the hood, so I decided to have a closer look.

\-- What it does to intercept network trafic:

1/ The app spawns an android (java) service that, that performs the following as root when it starts:

# echo 1 > /proc/sys/net/ipv4/ip_forward

# iptables -t nat -I POSTROUTING -s 0/0 -j MASQUERADE

# iptables -t nat -I OUTPUT -j DNAT -p tcp --dport 1337 --to 127.0.0.1

# iptables -t nat -I PREROUTING -j DNAT -p tcp --dport 1337 --to xxxunclearherexxx

My understanding is that it redirects outgoing packets (targetted at port 1337) to loopback, where the native daemon listens (2/)

This is not visible in the video, but when the user clicks to use a caught Facebook profile, it seems to trigger an android Intent to actually go to Facebook on port 1337 instead of 80, so it gets caught by the iptables hook.

2/ It then execs the faceniff binary to go native (unpacked from resources) with some params (stealth/passive mode, license check), and polls its status every 1s.

\-- Native part: I believe it handles most of the logic. Looking at the strings contained, it seems to deal with libpcap to intercept and forge headers on the fly.

Some interesting strings: libpcap version 0.9.8

new user found but the app is locked!

Unable to find ssid in cookies [%s]

HTTP/1.1 200 OK Content-Type: text/html Connection: close

Set-Cookie: %s=%s; expires=Fri, 14-Jul-2017 04:40:00 GMT; path=/; domain=.%s

<meta http-equiv='refresh' content='0;[http://%s/>](http://%s/>);

HTTP/1.1 200 OK Content-Type: text/html Connection: close

Date: Wed, 02 Feb 2011 01:51:18 GMT

%s
](http://%s:1337/%s>%s
);

client asking for: [%s]

Technically speaking, this is interesting. Please feel free to add info if you are familiar with the technique.

</comment><comment><USER3> Looks like closed-source with a paid version for more sniffing ("more than 3 profiles"). There is no way I am going to install this.

<comment><USER4> I risked it an installed it. It didn't seem to work (Galaxy S), and then my phone started running very, very slowly even after I closed it.

I uninstalled. I wouldn't recommend this app at all, and I'm pretty suspicion about what it was doing.

<comment><USER5> I had the same experience (Droid 2), except it crashed before I could even accept the Root Permissions dialog, so I doubt I suffered any major damage. (The default permissions are more innocuous)

</comment></comment></comment><comment><USER6> Hopefully this'll prompt these sites to switch to SSL by default...

<comment><AUTHOR> Funnily enough I had switched my Facebook account to SSL automatically a while and completely forgot about it. I ran the app on my phone and was surprised it worked.

It seems that some "application" that I had used on Facebook required SSL to be temporarily disabled. I don't remember an application saying that SSL had to be disabled, and I'd be the sort of person to read these things. I'd worry that this would be a problem for less techy users.

SSL should be an opt-out feature for anything that harbors personal information. I can only assume that this isn't the case due to the extra server overhead that FB would have to deal with ?

<comment><USER7> Whenever I go to a FB page that displays some content that is not served over https, FB gives me a warning saying that the secure connection will be temporarily disabled, but will be restored when I log back in the next time. And you have to agree to that.

<comment><USER8> I'm told that there were bugs in that process discovered shortly after its introduction that could mean the switch back to HTTP happened without the user being told so explicitly. These have been fixed, but the poster you replied to may have been unlucky enough to have used such an app during a window when such a problem was still present.

Another source of confusion is that nether the iPhone or Android native facebook applications respect the HTTPS setting, so to use HTTPS for facebook access on a phone make sure you use it via the web browser not the native app. IIRC this was one of the bugs: accessing facebook via one of those apps would reset the switch for next time you accessed the site by other means, whereas now it doesn't.

</comment></comment></comment></comment><comment><USER9> I wonder if there is anyone working right now on an open source version for that. I will not install Faceniff, but an open source equivalent would be really attractive.

</comment><comment><USER3> Direct link: <http://faceniff.ponury.net/></comment>


Quantum Physics Revealed As Non-Mysterious - <AUTHOR> http://www.overcomingbias.com/2008/06/quantum-physics.html

<comment><USER2> Y'know, I'm a physicist, specializing in quantumy stuff, and I suspect that some form of many-worlds is probably true.

But I don't really like the preachy "Many Worlds is just the way it is, and anyone who thinks otherwise is a fool" tone of this series of articles. They're actually pretty well written (I'd rate them above David Deutsch's Fabric of Reality, frinstance -- though I don't consider that very high praise), but I recommend taking them with a grain of salt.

Example: _We have embarrassed our Earth long enough by failing to see the obvious. So for the honor of my Earth, I write as if the existence of many- worlds were an established fact, because it is. The only question now is how long it will take for the people of this world to update._ \--- Sheesh, that kind of thing just doesn't belong in any scientific debate.

The domain name bothers me as well. Is it supposed to imply that anybody who doesn't agree with everything written in overcomingbias has simply done a poor job in overcoming their biases?

<comment><USER3> I don't really like them either. They're written well enough for one to basically follow along the sentences, and the tone is such that it seems they're really understanding something I'm not. But I looked pretty deeply into these questions. I read the original papers of Einstein Podolsky and Rosen, of Bohr, of Born. I read much of John Bell's original work, and I'm pretty sure that there are results being assumed here (and elsewhere) that haven't really been proven, or were even originally stated.

For example, it's commonly asserted that Bell's theorem rules out any deterministic quantum mechanical description of reality with local hidden variables. But this was, to my knowledge, never shown explicitly by Bell -- he simply ruled out a particular class of local hidden variable theories. There exist theories, consistent with experiment, which are local and deterministic: for what it's worth, a toy example is just a classical computer simulating everything in our universe we've yet seen.

We don't know where the Born probabilities come from, but we also don't really understand the implications of many body entanglement. We don't even have a consistent _definition_ of entanglement for three or more particles. We don't know, we haven't been able to calculate, but I have reason to suspect, that measurement consistent with Born probabilities could be _entirely_ explained by the deterministic axioms already part of Quantum Mechanics. We haven't really gone as far as we could go with them. And already people are treating Many-Worlds as axiomatic. I don't really buy it.

<comment><USER4> >for what it's worth, a toy example is just a classical computer simulating everything in our universe we've yet seen.

I think the state of the classical computer qualifies as a nonlocal hidden variable.

To use the language of formal logic, the classical computer is a model for quantum theory, i.e. (classical computer) |- QM. Within the QM theory, the computer qualifies as a non-local hidden variable, even though within the classical theory the computer is embedded in, it is local.

Another toy example is Bohmian mechanics on _configuration space_ : the theory is just a local PDE + local particle. But that's non-local in physical space.

>We don't even have a consistent definition of entanglement for three or more particles. We don't know, we haven't been able to calculate, but I have reason to suspect, that measurement consistent with Born probabilities could be entirely explained by the deterministic axioms already part of Quantum Mechanics.

Decoherence makes sense on the macroscale (1000+ particles), although it's true that 40 particles is iffy. Different classical states (i.e., experimental apparatus has light on vs light off) are separated by a distance sqrt(number of particles) in configuration space, and don't interact.

As for explaining measurement with Born probabilities, that's reasonable. My co-conspirators and I currently have a physical, macroscale model where we show this to be true (no citation yet, but I'd be happy to explain more via email). But you still need _some_ ontology.

All deterministic QM can show is that the probabilities work out correctly; i.e., the born probability of (measurement 1 says spin up, measurement 2 says spin down) = 0.

You still need a way to actually pick a configuration based on that probability distribution. The universe as we (you, me, even pg) know it is a point in configuration space, not a wavefunction. I'm happy with both MW and Bohm for that purpose.

<comment><USER3> I concede that by this definition of locality, a simulator doesn't quite count. But it _is_ a physical model both consistent with our quantum experiments and special relativity, and it's local in _something_. And if it's local physics in _something_ we're talking about, why is it 3-space that we're treating as the _real embedding_.

> Decoherence makes sense on the macroscale (1000+ particles), although it's > true that 40 particles is iffy. Different classical states (i.e., > experimental apparatus has light on vs light off) are separated by a > distance sqrt(number of particles) in configuration space, and don't > interact.

> As for explaining measurement with Born probabilities, that's reasonable. My > co-conspirators and I currently have a physical, macroscale model where we > show this to be true (no citation yet, but I'd be happy to explain more via > email). But you still need some ontology.

Please do. I looked for a while at decoherence and others, and the mechanism behind the _processes_ kept fading from view. It's was like thermodynamics, where we can say something about the equilibrium states eventually reached, but we're having a hard time explaining the processes by which it reaches one state or another, and by those processes, the reasoning in other parts of physics break down. Like microscopic <-> macroscopic reversibility.

But the people in nonequilbrium statistical mechanics have made a lot of progress in reconciling microscopic reversibility and macroscopic apparent irreversibility. Is such a thing possible for quantum measurement, or more generally, the quantum classical transition, as well? Might there be a reversible description -- Schrodinger's all the way down, so to speak?

Finally, I'm not so sure that MW, decoherence, Bohmian mechanics, etc. are truly equivalent. In other words, I expect that one might start getting different answers.

And there's reason to believe that they're incomplete descriptions. If you take one measurement, you'll notice it takes time. And the microphysics of QM says that it's time evolution should be unitary. So, halfway done, if we stop the clock, when we're doing a measurement, what do we find? Or rather, what would our laws tell us we'd find?

The more popular interpretation seem to tell me 'don't ask this question.' But it seems there's something important hidden here.

<comment><USER4> >Might there be a reversible description -- Schrodinger's all the way down, so to speak?

Basically, what I've got is a model of a particle interacting with a measurement apparatus (a BEC, to make the calculations simple). You can reduce the many body schrodinger equation to a mean field model on reduced configuration space: (particle coordinate X BEC coordinate). So yes, it is schrodinger (actually madelung) all the way down.

Measurements (of position) correspond to the particle making a splash in the BEC (1). Splashes at different locations correspond to different measured outcomes. Once the difference between splash sizes is macroscopic ( (number of particles) * splash profile =O(1) ), the measurement is complete.

By "complete', I mean that if you pick a random BEC configuration (N BEC particle locations), and you can determine with statistical significance (i.e. 99.9999% sure) where the splash is.

Before this occurs, you've just got two overlapping probability distributions in configuration space. Picking random BEC configurations won't tell you (statistically significantly) the particle location.

The process is continuous, but it doesn't look that way to us since it is also very fast, i.e. t = O(1/number of particles in observation apparatus).

<comment><USER3> Yes, this is exactly the sort of example I was looking for! Do you have any further details? Maybe I should work it out myself, to see if our results match up.

I suspect that there are all sorts of examples like this, accessible in theory and models of measurement in experiment, where things basically match up with with Born probabilities. Though I expect in some degenerate case they won't, just as, as the fluctuation theorem in nonequilibrium shows us, sometimes the second law is inaccurate, because whatever we call 'entropy' decreases.

</comment></comment></comment></comment></comment></comment><comment><USER5> This bothers me because it pretends that it's railing against an unenlightened status quo, and it isn't. Philosophers of physics considered, and largely rejected, the many-worlds interpretation because, if quantum events result in every possible outcome occurring in some world, and our consciousness ends up in one of them by some chancy process, then there's no reason why we observe some events with higher probabilities than others. But we do, and many-worlds doesn't explain that. The author talks around this by saying that, yes, these probabilities are very mysterious, indeed. Well, there are other interpretations under which they're not. Such as a) the many flavors of GRW (a collapse theory), b) the bohmian interpretation (waves + particles), and c) the many-minds interpretation (anti-realist and therefore the most out-there of the three). Those are all pretty much consistent with QM, or there's a good reason to believe that they'll be beaten into a form that is so consistent (e.g. tumulka's relativized version of GRW-flash, but that's outside the scope of a HN comment).

<comment><AUTHOR> I don't know much about this, but wouldn't it be a lot more probable to be in a world of those many where the probabilities of events are distributed in a reasonable way, than to be in another world where the distribution of probabilities is out of the standard? (that is, there are many possible time lines, but the distribution of probabilities would indicate that there would be a lot more time lines for probable events, than for improbable events, so it's easier for us to be in a probable time line than in an improbable one). Or am I understanding something wrong?

(Sorry for my English, I'm not a native English speaker)

<comment><USER5> The problem with many-worlds is that there aren't more timelines for probable events. If every outcome occurs in some world, then for some event with two possible outcomes, there ends up being two of you; say, Lefty and Righty, one in each world. So there's no sense in saying "I'll probably end up being Lefty, since his outcome was more reasonable," because you'll end up being both of them.

<comment><USER4> I think in MW, there are continuously many (macroscopically identical) lefty universes and continuously many righty universes.

So one macroscopic state (righty) corresponds to a set of finite volume; the set of all configurations who's macroscopic state (i.e., ignore quantum details humans can't see) looks like righty.

So all one can reasonably ask is "what is the probability my universe lives in that volume?" The obvious answer is the integral of |\psi|^2 over that volume, but that is a postulate, not something you can derive from the schrodinger equation.

<comment><USER5> I believe that on Everett's approach, when you measure some observable with two possible outcomes, the total number of worlds increases, like a bacterium dividing. But on the version you're suggesting, it sounds like we constantly hop from one already-existing universe to another, because every instant brings with it a different configuration. But it makes little sense for our bodies to hop between worlds, since they're parts of worlds, so is it our 'mind' that does it? But that sounds like many-minds, except with many worlds instead of one, and with a new problem of how we do the hopping.

Unless by configuration, you mean that each world is a world-line that contains a set of definite outcomes for all quantum events, and so all the quantum outcomes are predetermined for each world, and we explain probabilities by recourse to the proportion of some worlds to others. That's not really many-worlds, that's modal realism (every possible world exists, and "the actual world" just means "my world"). Which is more David Lewis than Hugh Everett.

<comment><USER4> In Everett's approach, I think it is the _macroscopic_ state which splits. But the macroscopic state is a volume of worlds. So I guess think of the interval [0,1] as consisting of a single (macroscopic) world. But [0,1] has infinitely many numbers in it; each one comprises a different "world".

Under evolution, [0,1] splits into [-0.5,0] U (0.5,1], two macroscopic states but still infinitely many microscopic ones. Every state in [0,0.5] was turned into a state in [-0.5, 0] and similarly (0.5,1] -> [0.5,1]. (Each real number corresponds to a world configuration.)

(note: there are quite a few variants of many worlds, and not everyone realizes they are talking about different theories. I don't know if I'm describing the most common view. )

My (non-mainstream) mental picture of MW is bohmian mechanics, with each possible bohmian trajectory corresponding to a different world history.

<comment><USER5> >Every state in [0,0.5] was turned into a state in [-0.5, 0] and similarly (0.5,1] -> [0.5,1].

I hadn't heard this version, but it doesn't make sense to me. So these microscopic worlds each change when a quantum event occurs? If they can change, then why not think that there's only one world, which changes when you measure something? It's a lot simpler and seems to handle everything that this theory does. Of course, if they don't change, then we're in a microscopic world with a precise configuration at any given moment, and every observable has a value, and Einstein was right, and we wouldn't observe Bell's inequalities. But we do, and anyway, the whole reason we postulate this stuff is because we think that things _in our world_ (you know, the one I'm sitting in, microscopic or otherwise) actually evolve according to the wave function.

BTW, if your picture is Bohmian mechanics, then you only need one world, where every particle has a well-defined position all the time, and these evolve according to the wave function. These different possible histories are epistemically possible because we don't know what region of the wave function the particle currently inhabits. But that's not a continuous infinity of worlds, microscopic or otherwise, unless you're just using the word "world" that way.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Wow do I wish I had the time to read all of that. As a former physics nerd, I enjoy well-written pieces that explain complex principles simply (though I'm not averse to some calculus).

Maybe someday after I leave startupland.

</comment><comment><USER7> the AI and Bayesian stuff is OB's strong suit. I don't think they've made their pet QM case very well.</comment>


Ask HN: Do web app yourself – is it relevant? - <AUTHOR>

Hello,
I want to share with you a project dear to my heart : Give a way to non-professional programmer to create simple web application.
The idea of this project is to define data and program logics in a single file (JSON format). This file is converted to a web application that can be be run to any computer. It is not mandatory to install anything to create a program, nor to pay a hosting solution. Everything is done on a web site.
The 'pro' languages do very cool things but it takes time to learn. The language that is proposed with this project frees you from constraints of classic programming (asynchronous flow, data binding, ...) and focuses on the essential : to display, manage and calculate data. As a result, do not expect to create the new killer app with this project ;)
A video is available on YouTube to show basic features : https://www.youtube.com/watch?v=FiccHCoJOlY
A demo of the language with some examples can be found on the web site : http://www.thelogicalbox.com
The service itself is currently in beta development stage but you can ask for an access code if you wish.
I hope this project can provide valuable support to people who need a small program but they lack the time, money or skills to do it.
It would be useful for me to have feedback, especially if:
1. The idea of a language for non-professional programmer is relevant.
2. The language seems simple and easy to understand.
3. You have ideas for improvement
4. You need a program (I can help you if it sounds possible with this project)
Do not hesitate to criticize, that helps !
Thank you for your attention,
Sébastien <comment><USER2> I have some experience in this area, I'm the main author of 3 programming frameworks targeting this (two created for two failed startups ). Now, I got great results like doing 4 products in an year ( with hundreds of concepts, database tables, complex processes) with only 2 programmers. An visible speed improvement but still was not the case that non programmers could program easily. Because of financial constraints we abandoned the creation of the GUI for creating apps and used the framework (targeting Flex/Flash ). Now, I outsourced an MVVM framework for JS ([https://github.com/salboaie/SwarmShape](https://github.com/salboaie/SwarmShape)) that is created with an architecture that serve the purpose of having visual UI to speed up the development. There is no GUI and tools but the framework is constructed to make tooling possible. I see such UI behave like better spreadsheets usable for creation of simple apps (using reusable components and simple scripting) by intelligent people having only a few days of training. It is feasible, only the business aspects should be clarified. If you want an discussion on this topics, feel free to contact me. firstname.lastname@example.com

</comment><comment><USER3> >Give a way to non-professional programmer to create simple web application.

Sounds like a good idea. Wait...

>(JSON format)

What is this JSON of which you speak? It sounds like programming to me! I won't have any of it!

I don't see why or how you want to get non-programmers interested in your programming environment. Rails already has a way to create simple web apps in a few minutes, but I don't know any non-programmers who use it. What's different about this, apart from the fact that you _can_ write killer web apps starting from the code that "rails generate" produces?

<comment><AUTHOR> Thank you for your feedback.

JSON defines data. Human can write and read JSON files.

Add logic to the data seems to me easier for non-programmer to define what a program should do.

A basic JSON file for describing a circle could be: { "radius": 5, "diameter" : 25 }

With the following program, we can modify the radius and see the diameter value: { "radius": "att(5)", "diameter" : "radius * radius" }

It is closed to the original file.

The difference with solutions like Rails is that people do not need to know how to deploy an application.

In this project, people write in a JSON file and the application is automatically ready to serve the data.

</comment></comment><comment><USER4> There are already services which try to cater to "non-programmers", but they generally try to deploy a web version of a WYSIWYG editor.

I personally do like the idea, but I wonder if, in practice, it would end up being complex enough that it might as well be programming for the layman. Your listed examples already appear to incorporate string concatenation, arrays and booleans. You might have a difficult sell to non-technical people who are also looking at, say, Wix.

<comment><AUTHOR> Hi Krapp,

You're right. WYSIWYG editor is easier to use than writing code but the aim is to make program running on the internet, not creating web page.

You're also right that my examples are using concepts than non-technical people could be afraid of.

What I'm thinking right now is that I should have created an interface to produce the code like scratch : [http://scratch.mit.edu/](http://scratch.mit.edu/)

</comment></comment><comment><USER5> I see JSON more as a hindrance than an advantage. Putting a function invocation in string in some other data format seems rather strange to me. It almost seems like you have created something like Lisp.

How about instead of trying to use some home-brewed pseudo language you try to extent something like coffescript?

<comment><AUTHOR> Hi Bliker,

Yes, it is a bit strange for programmer but maybe not for non-programmer: I wanted to be closed as possible to the data that people want to manipulate.

Extending existing language is for sure the easiest path but that means I will create something for programmer. That is not the idea.

</comment></comment><comment><USER6> why not just create a web lisp-interpreter?

<comment><AUTHOR> Do you think people will use it ? For instance, polish notation is difficult to understand.</comment></comment>


Fundraising tips for first-time startup founders - <AUTHOR> http://www.mittal.vc/2013/08/18/9-critical-fundraising-tips-for-first-time-startup-founders/ <comment><USER2> I wasn't expecting much (most articles with titles like that are terrible), but this vastly exceeded my expectations. If I'd had advice like this when I worked on my first couple of startups, rather than the advice in _Hackers and Painters_ , I think things would have turned out differently.

The first-time founders I mentor now have somewhat more realistic expectations than we did during the Web 2.0 startup craze circa 2005, but there are still far too many of them looking to build what comes easy (e.g. social network) instead of looking to build what makes money.

For my part, I'm done taking money unless there's a compelling reason. Right now I'm spending weekends building my next startup while doing my time at my last startup, now post-acquisition. It doesn't just feel better than chasing money, it feels right. If enough revenue comes in such that I need to quit and put my full time in, it will be a victory that tastes all the sweeter because this time I did it on my own terms.

<comment><USER3> Can you give an example of advice I give about startups in _Hackers & Painters_ that you consider to be mistaken?

<comment><USER2> Let me preface this by saying that when I was 19 and _Hackers and Painters_ was just published, there was no book more subversive to the natural order of things. H&P changed my life so completely that less than a year after reading it I was standing in the YC office in Mountain View for a YC interview.

And even after subsequent rejection, deciding to change majors to CS, going back to school to seek of the advice of Olin Shivers, and actually getting a CS degree, I practically kept it by my bedside. There was nothing even close to as influential in my decision to move to Cambridge and get reinvolved with startups as soon as I graduated.

But while H&P is is great at showing people like me that you can succeed in business without an MBA, and in fact might be at an advantage, it might be _too_ subversive in that sense as well. Later essays that weren't included in H&P tell a clearer story. _Black Swan Farming_ and _What We Look For In Founder_ and _Why Smart People Have Bad Ideas_ are essays that might have affected my thinking back then.

I don't think anything could have changed my path away from startups; any book containing _Why Nerds Are Unpopular_ and _How to Make Wealth_ was destined to have a profound affect on my life. But while VC is somewhat demonized and stories are told about running out of money, I think there is a certain glorification of the process that translated in my brain to "build product -> seek seed funding (YC) -> get users -> get VC", when I might have been better served by something telling me in big, bold l etters that while all this is great, if you're just starting out, don't just make something people want, make something people want to _pay you for_.

I didn't learn the lesson fully (after all, everyone I knew was building facebook clones back then) until being part of my first exit at a startup where we took no money . It was so refreshing to fund the company off customers' payments that even for my latest side project I found ways to make people want to pay me for it before I had built anything.

So while I don't think _Hackers & Painters_ gives any wrong advice, I think that you are such a good essayist that you unintentionally glorified the traditional VC-back ed startup process to someone as young as I was. If I'd read more about how to be a cockroach, and had someone tell me that my _first_ company should focus on making so mething people will pay me for immediately, maybe I would have had a better chance of success at 19 instead of in my mid- twenties.

<comment><USER3> Thanks for the kind words, but I think you may be attributing ideas to "How to Make Wealth" that you picked up elsewhere at about the same time. Perhaps from your peers building Facebook clones. The whole point of that essay is that startups should make something people pay them for. E.g.

      What a company does, and has to do if it wants to continue
      to exist, is earn money. And the way most companies make
      money is by creating wealth.

<comment><USER2> I don't deny that I may have missed the point of "How to Make Wealth" when I was younger, but I think it wasn't so hard to get the wrong things out of it:

\--

        So I think you should make users the test, just as
        acquirers do. Treat a startup as an optimization problem
        in which performance is measured by number of users.

\--

        Here, as so often, the best defense is a good offense.
        If you can develop technology that's simply too hard for
        competitors to duplicate, you don't need to rely on
        other defenses. Start by picking a hard problem, and
        then at every decision point, take the harder choice.

\--

        The advantage of creating wealth, as a way to get rich,
        is not just that it's more legitimate (many of the other
        methods are now illegal) but that it's more straightforward.
        You just have to do something people want.

What those passages mean to an experienced entrepreneur and what they mean for a college student living in a dorm around the time facebook was released might be completely different (it was for me). Building something technically difficult to replicate that people wanted didn't scream "find paying customers yesterday", then build it. None of us paid for any of the software we used (either b/c it was free or we had Kazaa), so the "user test" meant something different to me than it does now. I think I was pretty convinced that the "monetize later" model was the way to go until at least 2008.

So you might say my main critique is that I was too naive at 19, and needed things spelled out for me. "How to make Weath" was just too subtle.

</comment></comment></comment></comment></comment><comment><USER4> > As for people, there are plenty of folks willing to work for free.

Advising founders to recruit unpaid volunteers is horrible advice. Not only do you tend to get what you pay for, "free" labor can prove to be anything but free once the lawyers get involved.

<comment><USER5> Not to speak for the author...but, well, here it goes...

I read that point to specify that you don't have to pay them in money, rather there are other currencies that are out there that can be far greater than money; like stock options, connections, real life code examples, etc.

All of the points you mention about the pitfalls of "unpaid" persons can be seen with paid employees as well. It just seemed like he was saying that there are alternative currencies out there other than _just_ money.

<comment><USER6> People capable of building a quality product will not settle for " stock options, connections, real life code examples, etc".

</comment></comment></comment><comment><USER7> I love that the first bit of advice was

 _" consider NOT fundraising"_

This mirrors my own thinking... delay fund-raising as long as possible, and bootstrap as far as you can. Best case: You never raise at all, and find that you achieve your goals based solely on organic growth. Less ideal case: You have to raise outside money eventually, but you have more leverage and therefore more favorable terms.

</comment><comment><USER8> To the site owner - your site isn't readable on mobile. Hiding the floating element on mobile may be enough to make it readable.

</comment><comment><USER9> Is it how they fund raise in India?

<comment><USER10> Investing in India is very nascent. I think You need to have a fully working company with customers to raise seed money.

We have planned 5 products in our suite, 1 of which is in production use and 3 in advanced prototype and it was not enough to get into an accelerator program.

Also not sure if angel investors here understand what is seed money. Currently in the US, seed money that YC offers is about 11k to 18k USD. The angel firm we were speaking to mentioned an amount of about INR 10 million (which is way above even the US amount as seed).

INR 0.5 mil would be enough as seed money here, but I think nobody wants to take this early stage risk here.

We have eventually got into an accelerator program at iim-a, but that is because we won a contest.

*Edit (grammar)

<comment><USER11> Correct. The Investor mindset is a bit different and they look for more safer bets.

<comment><USER9> Thank you for your replies. It's very similar to this, here in Poland. The emerging markets have a lot of common characteristics. However, I didn't expect risk taking aversion to be one of them. Maybe just an "American thing" to be bold and take risks. Might be this that can't be replicated elsewhere :-(

<comment><USER11> umm.. I think its more to do with time. Someone sometime in your region will fund that crazy start up, waiting to explode. Others will follow suit after that.</comment></comment></comment></comment></comment>


Dr. Southern California: Heading west for the cure (2019) - <AUTHOR> http://www.cabinetmagazine.org/issues/66/kilston.php <comment><USER2> _One of the early boarding houses for consumptives was founded in 1882 by Emma C. Bangs, who arrived from the east with her ill daughter_

The belief about a better climate/cleaner air in the southwest persisted a long time after that.

Relocating to the SW was what my great-aunt (b ~1900) did with her ill daughter (who had TB or COPD, I can't remember the details), moving from the Buffalo area to Mesa, Arizona (about 6 hours from LA) where they believed the "better air" and warm climate would be help her improve (the daughter lived for about another 10 years). Her husband had done something similar when his TB had become severe shortly after WWII, driving to a VA hospital in Tuscon but returning to Buffalo a few years later, where he died.

<comment><USER3> One of the shopping centers just west of the Denver city line is JCRS. The initials originally stood for Jewish Consumptive Relief Service, which had a center there in the early part of the 20th Century.</comment></comment>


Show HN: A curated library of venture capital investment pitch decks - <AUTHOR> https://www.chagency.co.uk/getstartupfunding/ <comment><AUTHOR> Hi all,

We've needed this for ourselves since we saw these pitch decks pop up on LinkedIn every few weeks. We wanted a library with all these pitches curated, but what we found was either: not going deep enough or a 404 return of a now- defunct website.

Personally, that's what I find the most interesting: the early days. Not how big companies look like today and what decisions they take now — but rather what decisions got them there from the early days. Because when we start, we're in that position.

I hope it will inspire you but, more importantly, I hope you'll do something with it.

</comment><comment><USER2> This is very cool.

That said, the fact that Theranos is in here without any commentary puts me off a bit. That's not a pitch deck, it's a fraud deck.

This is like putting Al Capone in a list of "inspiring stories about hardball entrepreneurs".

<comment><AUTHOR> The headline of the website is "helping founder craft successful VC pitches". Emotions and controversies aside, Theranos _did_ raise capital.

No, I don't think it's nice to do what they've done (or smart, for that matter). But you want to see both ends of a spectrum, otherwise we'll fall prey to the survivorship bias. Hence, we've put up the "failed" category and didn't really want to give Theranos a category in itself called "fraud".

Again, controversy aside, I think there are lessons to be learned from them. People can misinterpret what I'm saying here and say I'm pushing them to commit fraud, but from my end it's more of a "This is how you should not do it"

We need to know both ends of an interval

<comment><USER2> The argument here seems to be "to raise capital, tell investors whatever they want to hear, irrespective of how true it is. Pass DD by covering up your lies, then cover up the coverups".

This is supposed to be a _curated_ list of VC pitches. I honestly don't understand how Theranos, a company that raised and grew _solely_ by spreading lies and then covering them up, can end up in a list like that, except if the authors of said list think that this is a good way to raise money.

I don't understand how it is that everybody agrees that stealing a painting from a museum is bad, but when you steal billions (!) from investors then suddenly it's "inspiration".

EDIT: I hadn't yet realized you're the author.

> but from my end it's more of a "This is how you should not do it"

This is a good point, and with that I think it makes more sense. But IMO it needs a much bigger "fraud alert! don't do this, these people are evil" note :-)

</comment></comment></comment><comment><USER3> Useful, but a shame none come with any extra context. Just the "from 300k to 9billion" blurb.

Have a look at Buffer. Already had around 5 investors before going for a big round. Not dissing this at all. This is totally normal, but the less experienced might think one nice pitch deck will get you from 0 to Billions in one round.

<comment><AUTHOR> Hi Tim, glad to see you here. In other places where I've posted this, I've also added the following bit "We've added the "early days" only on some of them, let us know if you find it valuable and we can cover the rest as well."

Wasn't sure whether people would want it. Glad to read your comment and to learn that people do want it.

@Buffer — For MySQL or Monzo, for instance, we've added how it wasn't the seed. I understand what you're saying — I guess if someone does believe that they would... assume... by themselves that they're all "seed stage pitches"?

</comment></comment><comment><USER4> Great resource! Thanks for compiling this. From the _other_ side of the table, Scott Kupor (a16z) has written a new book[1] "Secrets of Sand Hill Road". I look around and find mostly positive reviews for this. Yet to pick it up.

[1] [https://www.amazon.com/Secrets-Sand-Hill-Road-Capital- ebook/...](https://www.amazon.com/Secrets-Sand-Hill-Road-Capital- ebook/dp/B07KLJQ13R/ref=tmm_kin_swatch_0?_encoding=UTF8&qid=1560841825&sr=8-1)

</comment><comment><USER5> Thanks for compiling this. Too bad Uber makes up 4/5th of your title's claim ;-) Read Lost ans Founder a while back so nice to see Moz in there!

<comment><AUTHOR> It's like half isn't it? Heard ONLY good things about Lost and Founder — is it that good of a book you reckon? What stood out for you?

<comment><USER5> His openheartedness about the startup myth and the downsides of accepting VC money. What I really liked as well was his growth as an entrepreneur and how he valued his team. All in all it was a really relatable honest story about his journey.

It definitely made me more aware of the pros and cons of VC and what the relentless pursuit of growth above all else does to an entrepreneur emotionally. And it made me do a second take of the "Why". I think about his story quite a bit actually, more than most of the bio books I've read.

There's no chestpuffing or sugar coating at all :) Refreshing read.

</comment></comment></comment><comment><USER6> The headlines all seem totally wrong.

        Uber: $1.25M VC capital turned into $84.2B

That sounds like the guys who invested $1.25M now own $84B worth of Uber stock. I don't think that is even remotely true. I would think there came many more investors who put in more money. And that's how the vast majority of the $84B market cap was created.

<comment><AUTHOR> Sad to hear the mark was missed - I'm looking at it from the founder/s' perspective since this is a place where founders hang (less so investors)

They made a $84.2B company and started with that investment. Yes, the story is longer, multiple investment rounds were gathered but in a nutshell, we can look at it from this angle

</comment></comment><comment><USER7> This is certainly a helpful resource but quite conflicted on whether Theranos' deck should be in here (along with the disclaimer) even if it's just for historical purposes.

<comment><USER8> Why wouldn't it be? These aren't examples of how to run a company. They are examples of pitch decks from companies that successfully raised venture capital. Raising a ton of venture money is the one thing that theranos succeeded at.

In fact, even labeling some companies as failed doesn't help much. Might be more useful to see pitch decks from companies that failed to successfully raise any money.

<comment><AUTHOR> Hi J, maker here. I would love to death to have pitches from those who have failed to raise money as that would actually fix the "survivorship bias" for raising money.

What we put there would be eliminating the bias for... running a company I guess. Thanks for adding the comment, it was what I had in mind when we added Theranos.

In fact, maybe Theranos teaches us what kind of behaviour/talk "slips" through VCs, thus making us understand how we, the founders, will pick the VCs. I know, not a popular opinion for US to pick VCs — but we need to start spreading this idea of selectivity.

Not stupid selectivity ("I deserve this. Give me that"), but rather the one that makes us weed out those who don't have the acumen to tell between Theranos, a fraud, and a real startup

Sequoia didn't invest in Theranos. Index, Benchmark or Andreessen Horowitz didn't.

Maybe we can learn from Theranos' deck how we can pluck out those VCs.

</comment></comment></comment><comment><USER9> Very cool!</comment>


Ask HN: I need your help. Trying to develop secure and anonymous email - <AUTHOR>

http://securmail.launchrock.com/
Hi guys, I have a problem and I need your help: me and a couple of my friends decided to create a web service for free anonymous and secure mail after hearing about the NSA debacle(Lavabit closing his doors). We created a launch page to get email for people to try out the service as beta tester. Just go check it out and if your are interested, signup.
If you have suggestions, don't hesitate. We are working hard to build something great and useful for everyone. If you could share the service to help us out too, it would be awesome. Thanks
Really, it all comes down to how you want to protect your data. Now that we know Google's been working with the NSA and other email services. There aren't many options left for secure email.
Ever since news of PRISM broke, there's been a lot of confusion and denial about exactly how the NSA is getting the data from the companies that have been collecting it. Now Google's fessed up to the details, and it's unsurprisingly simple: by FTP or even by hand.
With what we are building, it would be basically impossible to do. Built on AES-256 Encryption and Host Proof Hosting, ensuring that your sensitive data is never accessible to anyone but you. We never have your un-encrypted data. Even if our servers were hacked your emails would be safe and when you delete an email, it is not recoverable(US DOD, 7 passes). We do not log any traffic or session data. For this reason, we're unable to identify any user of our service.
Here is the launch page: http://securmail.launchrock.com/ <comment><USER2> With respect, I think it's likely that you don't understand the threat model here and are making dangerous promises of security that you can't keep.

If the NSA shows up and demands that you help them access a user's data and not tell anyone about it, they won't merely be asking for a copy of your hard disk. They could ask that you modify your javascript (since you're a webapp, presumably you're doing client-side cryptography in JS, which is a terrible idea but let's ignore that for now) to send the user's key to you, or otherwise transfer cleartext back to you.

I don't mean to be harsh, but I think it would be better not to release anything at all than to release a product that can't live up to its privacy promises. If you really want to innovate in this field, please do it with open source code and peer review from expert cryptographers.

<comment><AUTHOR> It think you have a great idea about peer review of the code. We already have contacts with coders in the online password management business. The only thing that might be a problem is the involvement of the government. Like with Lavabit, they force them to reveal there SSL master key so that they could intercept every communications. We are currently trying to figure out if we could host our server in switzerland or something.(it fixed the problem for several security company we know.) I think our product present a huge leap in privacy for email compared to google and the likes who allow free access to data. Keep that in mind. [http://gizmodo.com/how-google-gives-your- information-to-the-...](http://gizmodo.com/how-google-gives-your-information- to-the-nsa-512840958/all)

<comment><USER2> I would not trust your service more than Gmail.

With Gmail, I can be fairly sure that the use of encryption is competent and that they've invested in entire teams of people dedicated to monitoring the service for hacking attempts -- I might have to worry about them handing data over to the NSA, but I don't have to worry about them handing data over to a random black hat who decides to modify the JS you deploy. I also trust that Google's legal team is capable of _some_ level of argument with the NSA, rather than just folding to them the first time actual money would be required to pay a legal team.

I don't see how hosting a server in Switzerland helps you when the NSA is at your door, telling them that you must help them and you must not tell anyone about it. The weak point is you, not your servers.

<comment><AUTHOR> Its a personal choice after all. We are not trying to replace Gmail. Our solution target people which focus more on privacy. Would you compare Gmail to a service like mailinator, etc. Part of our encryption is based on OpenPGP(most widely used email encryption standard in the world).

"I don't have to worry about them handing data over to a random black hat who decides to modify the JS you deploy" -cjbprime

I like to think that when you do business with people, there is a little of faith that is necessary. Otherwise, nobody would do business with startups.

And to answer your question about Switzerland, The only way to gain access to the data hosted within a Swiss data centre is if the company receives an official court order proving guilt.

I hope it answered your questions.

</comment></comment></comment></comment><comment><USER3> If you found a proof that P != NP, you'd want to communicate it with the rest of the world. In doing so, you'd want to portray yourself in such a way that people don't think you're a crank. You'd speak in the standard style of prose that related CS papers use, you'd avoid the signs of a wrong proof as described at [http://www.scottaaronson.com/blog/?p=458](http://www.scottaaronson.com/blog/?p=458) or explain why they don't apply here. You'd portray yourself as somebody that knows what they're doing.

When it comes to the topic of secure and anonymous email, you haven't done that. You've done the opposite. There's about a 1 in 1000 chance that somebody writing the post you've made here is in any position to be writing this software.

In particular, you don't predict questions people would have and address them beforehand. Your post leaves so much room for doubt, doubt that you should be aware of and have resolved yourself. You've also failed to address cjbprime's question in a way that suggests you have a realistic view of how the world works -- you didn't mention having a team member in Switzerland who's the only one that can access the server. That would be an essential fact, but you've omitted it. Whether it's true or false, you didn't know it was essential, and now it seems like you don't know what you're doing.

</comment><comment><USER4> A question: have you hired a security consultant to review your procedures and processes? or, are you yourself a security expert?

I mean, do you know that a secure mail is much more than encryption and public-private key? You really need to have your service security reviewed.

</comment><comment><USER5> This is essential reading/watching here:

[http://ritter.vg/blog-deanonymizing_amm.html](http://ritter.vg/blog- deanonymizing_amm.html)

[https://www.youtube.com/watch?v=_Tj6c2Ikq_E](https://www.youtube.com/watch?v=_Tj6c2Ikq_E)

</comment><comment><USER6> I do not know if it is possible but you should tell people a bit more about your service on your webpage. I could find no details about how any of your claims are implemented.

<comment><AUTHOR> We are thinking about implementing a blog so that we can share part of the coding process so that anyone can have a general idea of how our servers are secured and emails encrypted, etc.</comment></comment>


Mars Express gets festive: A winter wonderland on Mars - <AUTHOR> http://www.esa.int/Our_Activities/Space_Science/Mars_Express/Mars_Express_gets_festive_A_winter_wonderland_on_Mars <comment><USER2> Geoffrey Landis made a proposal for a polar landing site for the first manned mission to Mars back in the 90s. One of the clear advantages is that you don't need to bring hydrogen with you for the return trip, but instead you can just make it from the ice. Landis proposed the mission for northern hemisphere summer so that solar power would be constantly (or nearly constantly) available. One thing Landis didn't mention but is worth considering is that ice could be used for radiation shielding, either by tunneling into it or by melting it and reforming it into a surface structure.

However, landing on the polar ice cap has some downsides, not least of which is it would be the most boring place on the whole planet to land.

Korolev crater might make a good alternative site since you could conceivably land near a substantial amount of easily accessible water ice while still retaining easy access to terrain that is not ice-covered.

[1] [http://www.geoffreylandis.com/pole.html](http://www.geoffreylandis.com/pole.html)

<comment><USER3> " you can just make it from the ice"

I always read this but do we really have the tech to this without needing big and heavy equipment and a lot of energy? Why don't we "just" do this on the South Pole?

<comment> Tuna-Fish > I always read this but do we really have the tech to this without needing > big and heavy equipment

Sure, the chemistry is simple and well understood and the equipment needed isn't that heavy.

> and (without) a lot of energy

Nope. Splitting water is heavily endothermic. The SpaceX BFR Mars mission plan would require ~3MW continous for two years for the energy required for CO2 capture and chemistry to make enough CH4+O2 to return to earth. This is a massive amount of energy, basically requiring either a quite respectable fission reactor or ~10ish MW of solar panels, which take about a single BFS cargo hold by themselves.

The reason these kinds of plans are floated regardless of the energy costs are simply that carrying that much power production down there is still much easier than taking enough fuel with you to return home.

<comment><USER4> >that carrying that much power production down there is still much easier than taking enough fuel with you to return home.

Rationally, yes. This sentence makes sense. But, I find it amazing and difficult to visualize just how EXPENSIVE FUEL is.

</comment></comment></comment></comment><comment><USER5> That's quite probably the most impressive picture of 2018. For a long time there was a belief that earth was singular in possessing an abundance of water and now spectroscopy has revealed the presence of water on other planets and fly-bys by probes show geysers erupting from the surfaces of moons. Science advances even if it's not always at the pace we would like.

<comment><USER6> Hydrogen and oxygen are the most (~75%) and third most (~1%) abundanten elements in the universe and this has been known for quite some time, so it does not seem that unexpected that water is not especially rare. But maybe the formation of water from gases requires conditions that are at least somewhat rare in the universe.

<comment><USER5> True enough, but if you are old enough to remember the 1960's and early 1970's the belief, at that time, in the presence of water on other bodies in our solar system was never a given.

</comment></comment></comment><comment><USER7> I'm a bit confused - werent the NASA landers looking at the Martian dirt for microscopic traces of evidence of water in the past? or perhaps digging for some sign of water? and the NSA probe just flys by and says hey look out the window, there's a entire lake of frozen water, sitting on the surface, that noone has ever observed before.

<comment><USER8> This image is digitally generated from topographical maps collected by satellite. There are no probes on Mars that are located in a place where they could actually take a picture like this. EDIT: My first sentence was wrong. As finnh points out, it's actually based on a real satellite photo that was then stretched to give the illusion of a perspective from low altitude.

<comment><USER9> And yet the article says: this feature, known as Korolev crater, is found on Mars, and is shown here in beautiful detail as seen by Mars Express.

It is in fact a synthetic image constructed from a couple data sources. Not a real image taken from a camera. It may as well be one of those "artists conception of...." images used whenever a new planet is discovered.

<comment><USER10> I think that's just for the perspective, though? We'd have to be flying much, much lower to get the perspective shown in the image.

The straight-overhead view is less CGI-y (still composed, but of multiple overhead strips):

[https://www.esa.int/spaceinimages/Images/2018/12/Plan_view_o...](https://www.esa.int/spaceinimages/Images/2018/12/Plan_view_of_Korolev_crater)

I'd like to know more about the input images...

<comment><USER8> Thanks for this info.

</comment></comment></comment></comment></comment><comment><USER11> For anyone skipping the article - This is actually a composite image and not a single photo.

<comment><USER8> Its not a composite photo either. It's a fully artificial visualization based on real topographical and composition data. EDIT: nope, I was wrong, it's actually based on a real satellite photo that was then stretched to give the illusion of a perspective from low altitude: [https://www.esa.int/spaceinimages/Images/2018/12/Plan_view_o...](https://www.esa.int/spaceinimages/Images/2018/12/Plan_view_of_Korolev_crater)

<comment><USER12> > artificial visualization based on real topographical and composition data

Yes, that's what they mean by a composite.

<comment><USER8> "Composite photo" means "multiple photos combined together" not "artificial picture generated from information on chemical composition".

<comment><USER12> They used topographic data and visual imaging to create the "composite" image, that's accurately described as a composite in my book. Similar to zooming around a city in Google Earth.

Here's the top down view (still quite spectacular!):

[http://www.esa.int/spaceinimages/Images/2018/12/Plan_view_of...](http://www.esa.int/spaceinimages/Images/2018/12/Plan_view_of_Korolev_crater)

</comment></comment></comment></comment></comment><comment><USER13> Images like this one give me goosebumps. It's another planet!

<comment><USER14> I got the shivers from this as well. It is not only absolutely fucking stunning in and of itself but considering what it took to be able to see this image, all of the people responsible are utterly magnificent bastards. Also I have had a thoroughly shit week, so I wish them extra thanks for gifting me a bit of optimism, which I sorely needed. Awe is an overused term, but here it genuinely applies.

</comment></comment><comment><USER15> TFA mentions that the air above it gets cold and sinks creating a cold air layer, presumably it is more dense. Any idea how dense this air would be?

<comment><USER16> I don't think it would be particularly dense, it's just denser than the other air on Mars. Mars's gravity is less than Earth's, so the air will probably be less dense than the air over the arctic.

EDIT: According to [https://en.wikipedia.org/wiki/Mars](https://en.wikipedia.org/wiki/Mars) , typical atmospheric pressure on the surface is about 0.6 kPa, compared to about 100 kPa on Earth. That's a bigger difference than would be explained by gravitational differences alone, so probably the fact that there is just much less atmosphere is more important. Either way, it's substantially less dense than any air you're likely to encounter on Earth.

<comment><USER17> Gravity on Venus is 0.9 that of Earth, but it's atmosphere on the surface is 90 times as dense. Surface gravity doesn't say much about atmospheric density (the mass of the atmosphere does).

</comment></comment></comment><comment><USER4> This is simple, but how many of you want to go there?

Pictures like this make me want it. To stand somewhere on the ice, maybe brush a little snow around and see the rim all around... it's like a little island, delicate.

We are living in fantastic times!

</comment><comment><USER18> Well, now we know where to land the first fleet of robotic air and fuel factories.

</comment><comment><USER19> Snowboarding on Mars anyone?

<comment><USER20> It's an interesting question whether this would work. A lot of the low- friction properties of snow are due to pressure-based melt. I wonder if skis or a snowboard would slide well in this crater, both due to the low gravity and extremely low temperature. Maybe with size adjustments to optimize surface area and pressure for an adult human weight it might work, but I have no idea where to even start this calculation.</comment></comment>


AB Principle: Quick way to check if what you are doing is worth it - <AUTHOR> http://www.karthickgopal.com/2009/10/if-you-are-searching-for-direction-and-meaning-heres-one-way/

<comment><USER2> I'm mostly all about "C" - Does this pay the mortgage?

<comment><AUTHOR> haha. You can use a lot of b to get c done in my opinion.</comment></comment>


Leap second causing Linux server crashes? - <AUTHOR> http://serverfault.com/q/403732/8453 <comment><USER2> It appears to be fixed in Linux 3.4 [1]. According to the original commit [2] it's been broken since 7dffa3c673fbcf835cd7be80bb4aec8ad3f51168 [3], which appeared in 2.6.26.

So, kernels between 2.6.26 and 3.3 (inclusive) are vulnerable.

[1] [https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2....](https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=bcd550745fc54f789c14e7526e0633222c505faa)

[2] [https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2....](https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6b43ae8a619d17c4935c3320d2ef9e92bdeed05d)

[3] [https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2....](https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7dffa3c673fbcf835cd7be80bb4aec8ad3f51168)

<comment><USER3> Which, in summary, is pretty much every production kernel out there.

Spent the last two hours recovering servers, tomorrow will be another interesting day.

Whoever figured it'd be a good idea to INSERT[1] the leap-second instead of just slowing/accelerating time... <censored>

[1] Clock: inserting leap second 23:59:60 UTC

<comment><USER4> Well, it was a known bug and you had six months to prepare (i.e. update your kernel).

<comment><USER3> Where was it published?

Almost all of my machines run the Debian stable kernel and were still affected.

<comment><USER4> The leap second was scheduled in January. That event is so unusual you might get worried. So you do a simple google search and find out that there was a critical bug[1] in Linux kernel last time leap second was inserted. People got worried rightfully[2][3]. I don't know about debian, if it was known prior, if it is the same bug as before, ... But I don't run Debian, you do.

1\. <https://bugzilla.redhat.com/show_bug.cgi?id=479765>

2\. [http://it.slashdot.org/story/12/06/30/2123248/the-leap- secon...](http://it.slashdot.org/story/12/06/30/2123248/the-leap-second-is- here-are-your-systems-ready)

3\. [http://serverfault.com/questions/402087/does- centos-5-4-prop...](http://serverfault.com/questions/402087/does- centos-5-4-properly-handle-leap-seconds)

<comment><USER3> No need to be a smart-ass about it.

Even if I had googled (which I didn't) then I'd probably have assumed the fixes for bugs from 2009 to have long made it into the current distro kernels.

I just didn't expect something so basic to be still (or again) broken.

<comment><USER4> Don't get me wrong, I wouldn't too by default. But do you remember Azure crashing on February 29th? And checking for that date is a matter of three conditions. Leap second is much more complex. I'm not trying to be a smart- ass.. I'm just saying it's something I would worry about and would try to find something about it. And perhaps it wouldn't lead anywhere with Debian.

And still, something in your app stack could crash on this as well, leaving the kernel patching pointless.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Google uses a "leap smear" and slowly accounts for the leap second before it happens.[1] As long as you are not doing any astronomical calculations or constrained by regulatory requirements I think google has the right idea.

[1] [http://googleblog.blogspot.com/2011/09/time-technology- and-l...](http://googleblog.blogspot.com/2011/09/time-technology-and-leaping- seconds.html)

<comment><USER6> As part of Google Compute Engine we provide an NTP server to the guest which is based on Google Production time. As such our VMs get to take advantage of this leap second smearing implementation. I was going to mention this at my talk at IO but forgot.

<comment><USER7> So a VM on G's Compute Engine could in turn run an NTP server that exported G's Production Time? Do I also see GPT on App Engine?

Any chance Google could just make a GPT NTP server available as a public service anyway, just as 18.104.22.168 is their public ping responder. ;-)

<comment><USER8> 220.127.116.11 and 188.8.131.52 are Google Public DNS, not a "ping responder." <https://developers.google.com/speed/public-dns/>

Google does provide time servers, although I'm not sure whether they are officially supported. The addresses are:

        time1.google.com
        time2.google.com
        time3.google.com
        time4.google.com

<comment><USER7> Yeah, sorry, I know they're the public DNS, but they're also jolly handy as unforgettable IP addresses you expect to be able to ping, hence the smiley.

Good news about the time{1..4} NTP servers, I'll give them a try, thanks.

</comment></comment></comment></comment></comment><comment><USER9> Not surprising. In spite of all press that Y2K was just a silly waste of money, its events like these that makes me suspect it would have been a much bigger deal if everyone had ignored it and fixed it after things where shown to break.

<comment><USER10> Why does everyone always say Y2K wasn't an issue ? I'm sure there were a lot of consultant making too much money with little work - however _alot_ of bug fixes were done, that would have caused problems. So because it was taken seriously , stuff were fixed and issues didn't happen because of that.

Personally, I fixed 3 Y2K bugs back then, 2 of them would have brought down a rather critical business support to simply crash every time new data arrived.

<comment><USER11> "Why does everyone always say Y2K wasn't an issue?"

From the outsider's perspective, it is indistinguishable from any number of other putative disasters that required lots of money to fix, yet didn't come to pass... in some cases including putative disasters in which the money wasn't spent and the disaster didn't happen anyway.

I have the insider's perspective and I agree that it is the more accurate, that Y2K was, if not necessarily going to end the world, certainly a bad thing and was largely averted through effective engineering. But I can still see how from the outside it sure doesn't look that way.

<comment><USER9> This.

Many, if not a majority, of my non-technical friends and acquaintances have expressed at one time or another a reference to the "Y2K disaster" and rolled their eyes to suggest it was somehow not an issue. I was the 'Y2K compliance officer' at my startup at the time (we even got certified, and that actually may have been a scam (the certifying part)) but we identified and fixed a number of issues our box would have suffered had we not done the work.

</comment></comment></comment></comment><comment><USER12> 2012\. and we still have problems keeping track of time. This is both fascinating and scary.

P.S. for people wanting to know more this video is simple to understand but really amazing <http://www.youtube.com/watch?v=xX96xng7sAE>

<comment><USER13> From discussion of this same issue in prior threads, my takeaway was

(a) it's really not at all difficult to handle leap seconds, but

(b) the POSIX standard specifically disallows them, by specifying that a day must contain exactly 86400 seconds. (Analogously, imagine if leap days occurred as normal, but a "year" by definition contained exactly 365 days.)

The existence of leap seconds means that it's not possible to simultaneously have (1) system time representing the number of seconds since the epoch, and (2) system time equal to (86400 * number_of_days_since_epoch) + seconds_elapsed_today, and all the proposed methods of dealing with the problem involve preserving (2), which seems worthless to me, and throwing away (1), which I would have thought was a better model.

edit: actual system times may be in units other than seconds, but the point remains

<comment><USER14> It's harder than leap days, because leap seconds aren't inserted on a regular schedule. Leap days follow a predictable pattern of insertion. Leap seconds are inserted whenever the IERS decides to insert them.

The problem of leap seconds is therefore closer to that of time zone definitions -- which are a total mess, because they depend on keeping rapidly changing system tables up to date. I can see why people don't relish the idea of requiring similar tables just to keep system time accurate.

<comment><USER13> How are systems being notified of the leap seconds now, that wouldn't immediately enable them to update their hypothetical leap second table?

It seems like we already have a much bigger lead time for notification than we could possibly need.

> I can see why people don't relish the idea of requiring similar tables just > to keep system time accurate.

But the 'solution' we're using now is to make system time less accurate, not more accurate. Accurate would be if leap seconds incremented the system clock like normal seconds do. If the accuracy you're worried about is displaying a clock time rather than time since the epoch, you already need a time zone to do that.

<comment><USER14> _"How are systems being notified of the leap seconds now, that wouldn't immediately enable them to update their hypothetical leap second table?"_

I am not an expert, but as far as I know the most automated solutions are doing it via NTP, which just resets the second, then relies on clock drift to bring everything back into synch. Otherwise, I think your only option is to keep the timezone packages up-to-date (which is a non-trivial task for large deployments). A quick search found this:

<http://www.novell.com/support/kb/doc.php?id=7001865>

 _"But the 'solution' we're using now is to make system time less accurate, not more accurate."_

Yeah, I'm not disputing this. I'm just saying that preserving the assumption that _"day == 86400 seconds"_ probably breaks less code than the alternative. NTP messes with the notion of seconds-since-epoch anyway, so we know that single-second variations in unix time aren't automatically deadly to most unix software.

<comment><USER15> NTP sends a special message to the kernel (using adjtimex), that boils down to: today you will insert a leap second. This isn't the same as clock drift, which gets smoothed out, it means a minute with a 60th second (in UTC) or with the 59th second happening twice (in POSIX). NTP servers need a leap second table ( [http://support.ntp.org/bin/view/Support/ConfiguringNTP#Secti...](http://support.ntp.org/bin/view/Support/ConfiguringNTP#Section_6.14). ), but most other systems only need to know the _current_ delta between POSIX and TAI, and manage without a leap table.

</comment></comment></comment></comment></comment></comment><comment><USER16> Fear the Unix 32-bit time-becomes-negative bugs, in 2037.

We have 25 years to get ready. I still think we'll be patching at the last minute.

(Yeah, lots of systems will be 64-bit by then, but there will still be a lot of embedded crackerbox systems running 32-bit timestamps. It's all the embedded stuff I'm worried about).

<comment><USER17> It's 2038, not 2037.[1] (Specifically, January 19th, 2038 at 3:14:08am.) And while lots of systems will be 64-bit, many programs still won't be -- and it seems highly likely that this will be a significantly more serious and widespread problem than, say, Y2K or DST. (And certainly more serious than leap seconds, which happen relatively frequently.) Then again, I might be biased: perhaps I'm secretly hoping to spend the years leading up to 2038 paying for my retirement with high-priced consulting gigs to fix it...

[1] <http://en.wikipedia.org/wiki/Year_2038_problem>

<comment><USER18> <http://article.gmane.org/gmane.linux.kernel/1184914>

Less than a year ago there were already people thinking about your job security. (It's a better explanation than "the glibc maintainers are insane".)

<comment><USER16> But MUCH less than a year ago, many more people were still writing 32-bit- dirty time_t based code.

It's gonna be a fun one.

</comment></comment></comment></comment><comment><USER19> Now facing this issue... By using 'adjtimex' command, you can clear the problematic INS bit.

At first, you can confirm the status flag like this.

        $ ./adjtimex --print | grep status
        status: 8209

8209's binary representation is like this. This surely have INS bit "100000000[1]0001" (5th LSB).

        $ ruby -e 'p 8209.to_s(2)'
        "10000000010001"

8193 is the value after the clearance of the INS big.

        $ ruby -e 'p 8193.to_s(2)'
        "10000000000001"

Then, let's set it as a current value. Please ensure your ntpd is not running.

        $ adjtimex --status 8193

</comment><comment><USER20> Novell kb: <http://www.novell.com/support/kb/doc.php?id=7001865>

      SLE9 (kernel 2.6.5-7.325): NOT AFFECTED
      SLE10-SP1 (kernel 184.108.40.206-0.2.12): NOT AFFECTED
      SLE10-SP2 (kernel 188.8.131.52-0.42.54.1): NOT AFFECTED
      SLE10-SP3 (kernel 126.96.36.199-0.83.2): NOT AFFECTED
      SLE10-SP4 (kernel 188.8.131.52-0.97.1): NOT AFFECTED
      SLE11-GA (kernel 126.96.36.199-0.2.1): VERY UNLIKELY
      SLE11-SP1 (kernel 184.108.40.206-0.3.1): VERY UNLIKELY
      SLE11-SP2 (kernel 3.0.31-0.9.1): VERY UNLIKELY

      Update (06/26/2012): after thorough code review -> SLE9 and SLE10 not affected at all.

</comment><comment><USER21> FYI: I've updated the post with details of the workaround as implemented on our servers.

</comment><comment><USER22> Pardon the ignorance if this is a stupid question. I've been looking at some of my hosts and have noticed a message "Clock: inserting leap second 23:59:60 UTC" in dmesg output but each of the hosts is in the EDT timezone so the I was under the impression that the leap second hadn't been applied yet. So what does that mean? That the systems have applied the leap second successfully or have only received it from their NTP servers?

<comment><USER23> The leap second is applied at midnight UTC time, regardless of what timezone the server is in.

<comment><USER22> Okay, so does that mean that the various bugs that have been circulating can still hit as it hasn't hit midnight in EDT yet or can I exhale?

</comment></comment></comment><comment><USER24> We just had 100s of EC2 instances generate high (alleged) load. Instances had load averages of 90+ but were responsive.

Running on a 3.2 kernel

Rebooted them all and they're fine.

<comment><USER25> What he said.

</comment></comment><comment><USER26> FYI: Our Debian servers did not kernel panic but system CPU load went through the roof; A quick restart brought levels back to normal.

<comment><USER27> My Ubuntu 10.04 desktop went to 100% proc and load avg of 20, none of my 10.04 servers or Debian stable servers were affected.

This fixed it:

      date; sudo date `date +"%m%d%H%M%C%y.%S"`; date;

<comment><USER28> You are a lifesaver. All morning my desktop's load has been pegged at 20. I upgraded FF, Chrome, etc. and no impact. I was dreading a full re-start, as I have lots of windows, tabs, etc. open. The above command knocked the load down to almost nothing in seconds.

</comment></comment></comment><comment><USER29> After reading these tales of woe, all I can say is that I hope the criminal element doesn't start assaulting NTP servers.

</comment><comment><USER30> I was logged on to a couple of CentOS 6 servers when I saw this happen, and on each one the Java processes went absolutely haywire. Everything else seemed to work fine.

I attempted to fix with adjtimex and the script in the linked question, but to no avail, in the end having to restart them all instead. After that, all was good again.

<comment><USER31> I just had the exact same experience.

</comment></comment><comment><USER32> POSTMORTEM fix for CPU eating softirqd threads without rebooting:

stop ntpd, run ntpdate or sntp, start ntpd

/etc/init.d/ntp stop; sntp -s <ntpserver>; /etc/init.d/ntp start

Unfortunately sntp / ntpdate wrapper is not shipped with squeeze for example. I've used the binary from SuSE 11.4 just fine on squeeze.

<comment><USER32> OK this is how it works on squeeze etc.:

apt-get install ntpdate; /etc/init.d/ntp stop; ntpdate pool.ntp.org; /etc/init.d/ntp start

<comment><USER32> or easier still just date -s "`date`"

without ntpd restart

</comment></comment></comment><comment><USER33> Ouch!

My Debian GNU/Linux 6.0 is still standing

Oh well, reading the issue, the machine date is Sat Jun 30 16:11:31 EDT 2012

Stopped ntpd just in case

<comment><USER34> Same here. Set ntp to restart in 12 hours.

<comment><USER33> With ntp stopped, no problem whatsoever

</comment></comment></comment><comment><USER35> Two days ago while booting, the BIOS time on my eeepc was suddenly reset, with an error message on boot to adjust the time manually. Was just thinking that it may be related?

</comment><comment><USER36> Our Linux instances running on Amazon EC2 had no issues since we are not running ntpd on these servers and adjtimex returns status as 64 (clock unsynchronized).

I think the Xen host takes care of the synchronization and we need not do it in the guest OS. (see [http://serverfault.com/questions/100978/do-i-need-to- run-ntp...](http://serverfault.com/questions/100978/do-i-need-to-run-ntpd-in- my-ec2-instance)).

Is this fine or should we run ntpd for better accuracy?

<comment><USER37> Yes. This issue notwithstanding, you should be running ntpd.

</comment></comment><comment><USER38> Stupid question: Why was this not caught? Seems pretty easy to test. Just set the clock to today (or any day with a leap second), and watch what happens.

<comment><USER39> > Just set the clock to today (or any day with a leap second), and watch what > happens.

That won't work. The bug is only triggered when an upstream NTP server reports that a leap second was scheduled. Since leap seconds aren't predictable (and aren't even scheduled very far in advance), just setting the time back to the date of a previous leap second won't do anything.

<comment><USER40> True, but the question still stands, since you can still test it by just telling the kernel to insert a (fake) leap second.

<comment><USER41> It also should not be that hard to provide your own upstream ntp server, and have that generate leap seconds at will. Both machines could be VMs, too.

</comment></comment></comment></comment><comment><USER42> On debian, I was able to fix the issue (fix the load issue specifically) with this command

/etc/init.d/ntp stop; date; date `date +"%m%d%H%M%C%y.%S"`; date;

</comment><comment><USER43> If really all of the Linux where affected more than half of the Internet would be still down by now. Could be only a specific combination of kernel/userspace bugs that only exists in some systems.

What a bit sucks is that my VPN was affected to (openvpn) causing my computer to do a poweroff. I replaced the poweroff with

ip route add to 192.168.1.0/24 dev lo

hope that saves me when the next leap second occurs.

</comment><comment><USER44> Pirate Bay has also been crashed by this: "TPB crashed just after midnight June 30th GMT (5.5 hrs ago) The crash appears to have been caused by the leap second that was issued at midnight."

<https://forum.suprbay.org/showthread.php?tid=125071>

</comment><comment><USER45> No burps from my BSD boxes either, although they're all in UTC so the leap second hasn't happened for them yet.

<comment><USER20> The leap second is added at the same point in time regardless the timezone your server is configured to use. So if you're GMT+3, the leap second will be inserted at 03:00 local time.

From the answer: "The reason this is occurring before the leap second is actually scheduled to occur is that ntpd lets the kernel handle the leap second at midnight, but needs to alert the kernel to insert the leap second before midnight. ntpd therefore calls adjtimex sometime during the day of the leap second, at which point this bug is triggered."

</comment></comment><comment> mkr-hn Is this implementation-specific, or could the Windows equivalent to ntp cause the same problem?

<comment><USER46> Implementation specific. It looks like it is a bug in the Linux kernel with how it adjusts the time. It is possible that Windows, OS X, and other BSDs will be affected by a similar bug, but that would be coincidental as the bug is not due to ntpd but rather how the kernel handles a request that ntpd generates.

More specifically, there is a condition in which the kernel tries to insert a leap second and, in doing so, attempts to acquire the same lock twice causing the spinlock lockup and (effectively) halting the kernel.

</comment></comment><comment><USER47> My AWS EC2 instances got spun up to 100% cpu and have been like that for a day. Basically saw a step function from 0 to 100 in the CPU graph. Just had to reboot them.

</comment><comment><USER48> Hey, I'm running Ubuntu 12.04 . Could someone guide me through what I can do to detect/prevent this from crippling my server? Thanks.

<comment><USER49> Read the linked article.

> The work-around is to just turn off ntpd. If ntpd already issued the > adjtimex(2) call, you may need to disable ntpd and reboot to be 100% safe.

</comment></comment><comment><USER50> Oddly netflix went down for me at 12:01 last night...

I assumed some cronjob or something similar was to blame.

<comment><USER51> Netflix had outages due to a huge storm on the east coast of the US. That was probably the cause.

<comment><USER50> Probably...

</comment></comment></comment><comment><USER52> My Ubuntu servers seem unaffected thus far.

<comment><USER53> Unfortunately I can confirm that Ubuntu 10.04 is vulnerable. We're proceeding with the fixtime.pl workaround.

<comment><USER54> I can confirm it too, but didn't catch it in time. A reboot however and everything is back to normal.

<comment><USER55> We didn't catch it in time either. It was oh so much fun to wake up to our service not working at all, all java and mysqld processes spinning like crazy, and having to reboot all servers. :-/

</comment></comment></comment></comment><comment><USER56> That wouldn't happen if servers were Macs

<comment><USER57> Mac OS X is a BSD variant, so there's every chance.

<comment><USER58> How does that follow? OS X runs an odd hybrid kernel (XNU) which is Mach and parts of BSD, but... this is a Linux kernel bug. There's an effectively zero chance of this impacting anything but Linux.

<comment><USER57> The kernel is not the only OS component relying on time that may have not considered this.

<comment><USER59> This is evidently a kernel bug. The fact that both operating systems rely on time isn't particularly relevant. Could there be time bugs in OS X? Certainly. But it wouldn't be this one. Windows relies on time too, so I don't see why you bring up the fact that OS X is a BSD variant.

</comment></comment></comment></comment></comment><comment><USER60> Read that as "high rates of cash."</comment>


The Capital Allocation Guide for CEOs - <AUTHOR> https://behavioralvalueinvestor.com/blog/capital-allocation-guide-for-ceos <comment><USER2> Is it maybe a sign that the system is fucked up when you have to go out of your way to emphasize "legal and ethical"? Implicit in that statement is the fact that there is an incentive to do things that are illegal and unethical in pursuit of that goal.

Also it's disingenuous to say that an owner benefits from treating their employees well; an owner benefits from treating their employees as poorly as they can without impacting their productivity.

Actually this owner person sounds like a parasite on the rest of the business, why not just make the employees into the owners?</comment>


Thoughts on MVP - <AUTHOR> MVP stands for Minimally Viable Product. It's as trite and banal a maxim in software as the 10X improvement. While widely adopted, interpretations vary. Here's my take:
The term "viable" is the central point of contention, and will be my focus. There's two schools of thought: the fasçade types out to test as many feature hypothesis as possible, and those with scarce yet robust releases.
Our initial premise was that early adopters are willing to put up with slowness and instability if the product were left-field enough. In other words, fascade-type. While that is true to some extent, retention ultimately comes as a byproduct of the diametrically opposing philosophy ~ doing the small things well.
Retention is distilled to repeated use. It therefore should come as no surprise that minor faults compound with time. Faced with two options, a platform full of new features versus those with few, it becomes an effacing exercise to opt for the latter.
To succeed in the former however, your escape velocity must exceed the growth of consumer expectations. In other words, the optimization of the your platform must be predate your users getting frustrated and leaving.
This is unlikely. Fascade-type release are by nature deficient in sound architecture. Refactoring old code takes about 3 times as long, mostly due to entrenched thinking. What's more, almost nothing outpaces consumer expectation these days.
The greatest yield of your diligence will comes from honing the few central tenets of your offering, and delivering those reliably.
For more, checkout Zero Defects of Philip Crosby of the Martin Company. W.E. Deming is also a good read.
D <comment><USER2> It sounds to me like you are trying to balance deep vs wide in an MVP.

Wide being a large group of features/hypothesis, deep being more focus on fewer features.

I think it depends on the situation, but for the most part I believe MVP should be neither of these things, or somewhere in the middle.

It isn't about testing many hypotheses, it is about testing one hypothesis. "Is there a market for x".

The answer isn't to build a robust release or build a facade for many tests, but to build the minimum amount to answer that question. You don't want to build deep into the technology of a single 'feature', and you don't want to build many features. What is the minimum number of features and the minimum amount of those features that can be built in order to answer the hypothesis.</comment>


The Struggle - <AUTHOR> http://techcrunch.com/2012/06/14/the-struggle/ <comment><USER2> Ben Horowitz is a great entrepreneur and a great investor. But it's pretty hilarious how he quotes the Geto Boys and Snoop Dogg while being assiduously politically correct in his writing style ("the women from the girls"?).

You can understand this if you realize that he's actually an ultramasculine guy, and rap lyrics (caricatured though they be) are the only acceptable way today to express unbridled, unchecked, dominant masculinity.

But in addition to being ultramasculine, he also loves to win. And you don't win if you say that stuff outright. No white collar white male can get away with even 1/1000 the stuff that DMX says on a daily basis. So thus his formal writing has "hers" and "shes" all over the place, while his true self is channeled through a rap star messenger than no gender egalitarian can successfully attack for fear of being dubbed racist.

It is 3D chess after all.

<comment><USER3> Wow, I think you're over-analyzing this. First, there's a lot of misogyny in rap music, I agree, but it's too easy, and wrong, to dismiss all of it as misogynistic, ultra-masculine braggadocio. There are just too many sub-genres for a simplistic definition. And, if you spend time listening to rap lyrics, you'll come across some truly profound verses; some of Lupe Fiasco's stuff is just mind-blowing. I think Ben Horowitz simply appreciates rap as an art form and enjoys summarizing his posts with applicable verses. Does there have to be more to it than that?

</comment></comment><comment><USER4> I really love this post by Ben. It feels so honest, shares so many insights and at the same time gives such encouraging advice.

My favorite parts are where Ben describes the struggle in these one-liners. It reads like a novel. Incredible. I can feel it when I read it.

And the part where he talks about going public. So encouraging. There's always a way. Just great.

IMHO we need more posts like this - especially all the founders and co- founders out there thinking about starting a startup, or thinking about finding a (technical) co-founder. This kind of honesty and encouragement is what they need to get started. This is what they need not to loose faith.

</comment><comment><USER5> > When they teach you how to drive a racecar, they tell you to focus on the > road when you go around a turn. They tell you that because if you focus on > the wall, then you will drive straight into the wall.

This is very true.

When I took racing school, my instructor told me the same thing. I learned to focus on the road and the turn; by the end of the course, I nailed every apex on lacuna seca in my little formula dodge and set a blistering lap time.

Funny thing is, I didn't realize that I'd been applying this to my life ever since until I read this article.

Thanks, Ben.

<comment><USER6> The term for this incidentally is "target fixation." It's a problem for hang- glider pilots too.

</comment></comment><comment><USER7> Anyone else think it is ironic that he quotes Marx in a capitalist "pig" column on a website that thrives in a darwinian startup culture?

<comment><USER8> All capitalists want Marxism - to stage their own revolt in an old industry and wind up on top as dictator of their own little command economy. We aren't so different, you and I...

<comment><USER9> Yeah, that's exactly what Marx advocates.

<comment><USER8> Soviets were designed as self-governing co-ops - which is similar incentives to a startup with widely held equity right? It's not fully the same of course, but the views aren't so different in their aims.

<comment><USER10> The closest parallel to an equity structure would probably be to the employee- owned cooperative firms that exist in some jurisdictions. A crucial difference from startups is that equity is not tradable, not available to non-working investors, and cannot be taken with you if you leave the firm. Rather than owning securitized shares, you definitionally are entitled to a share of profits while working at the company; and everyone is entitled to the same share. So, for example, if there are 10,000 employees, you have a 1/10,000 claim on any dividends. If you leave the company, you no longer own shares. And there is no way to buy shares; cooperatives will generally only accept investment on bond or loan-like terms, not equity terms.

<comment><USER8> Sure, it's not as flexible, especially the totalitarian systems, though co-ops aren't as simply structured in their mature forms.

Look up "Mondragon" for what a modern form of distributist co-ops look like. Not the same share of profits, equity investment is the rule (limited to workers or co-op friendly orgs), and there are many other interesting aspects.

</comment></comment></comment></comment></comment></comment><comment><USER11> I immediately put on the Lupe Fiasco song he quotes at the beginning while I read the rest. Made it even more intense.

<http://www.youtube.com/watch?v=_NHkv0S1NEA>

</comment><comment><USER12> Incredible.

 _This is not checkers; this is mutherfuckin' chess... technology moves, the competition moves, the market moves, the people move_

Couldn't have summed it all up more perfectly

</comment><comment><USER13> Wow. This is one of the more powerful essays I've read in a while. If you don't get why that is, please just think about it some more. Think about what you are telling yourself about it.</comment>


A sensing system to constantly track the performance of workers - <AUTHOR> https://techcrunch.com/2019/06/29/researchers-developed-a-sensing-system-to-constantly-track-the-performance-of-workers/ <comment><USER2> Well, shall the consequence be an uptick in staff churn?</comment>


Designing a programming system for understanding programs - <AUTHOR> http://worrydream.com/#!/LearnableProgramming <comment><USER2> I remember articles asking for this in the 80's. Shame no one listened. Guess we were all to busy programming to worry much about what the IDE (if there was one) could be doing. Here is an interesting example <http://www.sorting- algorithms.com/> I've always resented as a code documentarian that I got no help from the one thing that knew what the hell was going on---the compiler! Sigh...

</comment><comment><USER3> > If a programmer cannot see what a program is doing, she can't understand it.

I really agree with this. An aspect of any "new" programming language/environment should be continual and immediate feedback.</comment>


Ask HN: What book would you recommend for learning basic database theory? - <AUTHOR> I want to have a better understanding of things like:<p>* CAP theorem * ACID or BASE (and the pros and cons of each)
* some commonly used data structures / algorithms a database system uses under the hood * graph databases * relational database normalization<p>..and related concepts. <comment><USER2> _Database Systems, The Complete Book_ , any old edition is good enough and will be cheap.

It won't cover all those topics you mention. It will provide the background for understanding them because they all stand in relation to relational databases...you know, the basic theory you mentioned will give you the _vocabulary_ to understand what people are talking about and some background toward understanding the advantages/tradeoffs of non-relational models like graph databases.

The other resource is _The Red Book_. It's free and online. But...though it covers current trends, most of the papers it contains tend to assume that the reader understands the relational model.

<comment><AUTHOR> Thank you!

</comment></comment><comment><USER3> Just Google up database theory. You'll find a lot of lecture material about it with often references books.</comment>