Oroville Dam: Cost to repair spillways nearly doubles in price to $500M - <AUTHOR> http://www.mercurynews.com/2017/10/19/cost-of-repairing-oroville-dams-spillway-nearly-doubles-in-price-to-500-million/ <comment><USER2> I'm not surprised at the cost, given the nature of the project. Filling in the _massive_ canyons that were cut when the spillway failed has taken an incredible amount of RCC (roller compacted concrete) and man-hours of difficult,dangerous labor. Last I heard the project is still zero injuries, which is really impressive.

The blancolirio channel that nraynaud mentioned has a _lot_ of very impressive reporting and flyover footage, and the CA DWR itself has also been posting regular drone footage[1], which I highly recommend for a sense of _scale_. The spillway is a _lot_ larger than it looks like from most of the overview photos. The closeup drone footage that includes the repair crew shows how massive the structure really is. It's supposed to be able to handle 270,000 cfs outflow (the outflow that damaged the old spillway was "only" ~100,000 cfs).

I'd also like to point out this[2] video from blancolirio, which shows just how close the emergency spillway was to being undercut. Yah, this repair is going to be expensive, but it's good to see that proper repairs are being done. Some things are worth the money; the central valley flooding would be a lot worse.

[1] [https://www.youtube.com/user/calwater/videos](https://www.youtube.com/user/calwater/videos)

[2] [https://www.youtube.com/watch?v=oU4AGuQ5gMo](https://www.youtube.com/watch?v=oU4AGuQ5gMo)

<comment><USER3> If no one gets injured on a $500M project, safety standards are almost certainly too stringent.

<comment><USER4> I feel like this comment is callous, but unfairly downvoted.

All projects contain risk. Getting out of bed and taking a shower involves risk, you can slip and fall. The larger the project, the larger the sample size and the more statistical considerations for risk should be managed.

Modern western society has greatly lost all tolerance of risk. One difference that struck me for risk culture, compared to the past, is old footage of the 1955 Le Mans disaster: after the catastrophic crash, bystanders themselves helped carry bodies away from the scene, and clean up wreckage. This calmness and social damage tolerance in the process of a disaster is very different from a modern "evacuate and let the professionals handle it" attitude, and I think this is an example of a clear shift in social tolerance of risk.

I wonder if the Apollo project would have worked today, instead of in the 1960s. At the scale of an infrastructure project of half a billion dollars, we're not talking about something so big that zero injuries safety standards are bad. However, as you get larger projects, it is statistically impossible to keep risk at 0; I'm not sure how willing modern society is to accept that injuries on large projects is inevitable.

Elsewhere in this thread, user JumpCrisscross comments about comparing the cost overrun to the second bid. Following up that comment, the top response is something along the lines of "nobody was injured, so showering the contractor with money is ok". This attitude is prevalent in modern society, and it doesn't really get questioned. Let's pose a hypothetical scenario: If a person has their leg broken, let's say a platform caused someone to fall and hurt their back. Would that amount of damage be worth a $250million additional cost? Think of the amount of social good you can do with $250million. At what level does society overvalue the reduction of risk? This is an important question to ask.

Let's not even talk about minor injuries. Let's say 1 person died. If you walk up to a random person, tell them that they have the opportunity to die; BUT their immediate family would receive $125 million dollars, and $125million would be donated to the charity of their choice. I suspect a very large percentage of people would actually be willing to take that offer.

And yet, giving an extra $250million to a contractor to build something is considered "worth it" to the general public if no injuries were reported. At which point does society overvalue reducing risk?

<comment><USER5> So what value would you put on someone being killed or maimed to save some money? Because that is exactly the calculation you are proposing should happen.

<comment><USER4> A quite a bit less than $250million, which is how much is being paid.

In fact, people would even volunteer to die for "just" $100million. Just see this reddit thread: [https://www.reddit.com/r/AskReddit/comments/4jqfka/what_woul...](https://www.reddit.com/r/AskReddit/comments/4jqfka/what_would_you_do_for_100000000_but_not_for_100000/d38pkhv/)

This is EXACTLY what I mean by "risk management for large projects". For a small $10k project? A small percentage cost decrease for increased risk of death isn't worth it. For a multi-billion dollar project? All of the sudden, the incentives change drastically. How many people would be willing to work on a project that is a tiny amount more risky, but knowing that their families will be handsomely compensated in case anything happens? If you told me that my family will receive $100mil guaranteed if I die/get maimed, there's very little I'm not willing to do.

Also, to note: $100,000,000 is enough to save around 30,000 children from an excruciating death by malaria.

TL;DR 1 average human life generally isn't worth throwing away $250million. I will literally volunteer my own life on this fact.

<comment><USER5> But how do you know that it is a simple trade off between money and safety standards? It's been noted on HN that the US seems particularly bad at large infrastructure projects compared to other developed countries and I'm struggling to believe that's because the US has wildly better safety standards.

<comment><USER4> I don't. That's moving the goalposts.

Who cares if Oroville Dam is in the USA or not. The same thing would still apply if it was in the UK. I'm merely saying the modern public should reconsider spending $250million extra, instead of applauding it simply because no injuries happened.

<comment><USER6> I'm going to make a guess here and assume that you are not working construction. And if that's so I would highly recommend you join a construction crew for a couple of years and then come back here with your idiotic approach to workplace safety. It's all about _preventable_ accidents, and your assumption that we could save 250M on a project by compromising workplace safety is both wrong _and_ the beginning of a slippery slope that ends with maximum savings and no workplace safety at all. After all, it's not the life of you and your family that is at risk here.

Fuck those construction workers, fuck those miners and who cares about factory workers. After all they're disposable. /s

Workplace safety is there for a reason: to stop white collar criminals from putting a price on human lives and then to optimize for the lowest they can get away with.

<comment><USER7> I feel you're missing the point, I can't tell if it's deliberate.

Suppose you wanted to reduce risks for computer programmers - everyone gets a personal doctor who sits with them to monitor their vitals, state of the art monitoring device, daily blood tests, screenings for all sorts of diseases. Each person gets a fitness coach, dietician, sleep coach, whatever. Programmers with injuries get oxygen therapy and physios on hand. Basically you treat them like world class racehorses (!). Whatever, hopefully you see the point.

Would that be overkill? No? Well then you don't think programmers matter at all and want to see them all die in industrial accidents. /s

If we can accept at any point that we should, maybe not buy the most expensive chair/table/keyboard/screens, even if there's a chance of injury (eyesight, cardio problems from 20 years of sitting, cut from a sharp edge on a filling cabinet, etc.) then you're agreeing with the general concept of the OP IMO.

Now, in public procurement, should we pay $1000 per seat for a currently $100 app to ensure no programmer ever gets a thrombosis/carpal problem/etc.?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> > _Kiewit, the Nebraska-based construction firm that has the main contract to > rebuild the main spillway and emergency spillway at Oroville, the nation's > tallest dam, estimated in its winning bid in April that the work would cost > at least $275 million. But the price tag has now grown to at least $500 > million_

Out of curiosity, what was the runner-up bid? Is there no mechanism to re-open bidding when the circumstances change? What prevents me from bidding $1 and then busting it to $1 billion after winning?

<comment><USER9> I find it interesting the default commentary to this sort of event - ballooning budgets on underbid projects - assumes that bad faith on the part of the bidder is the problem, and that if only we could punish these few bad apples - punish those scheming, underbidding contractors, then the problem would disappear.

It seems unlikely that bad faith is the primary cause. Yes, there are really contractors and owners who do act in bad faith, like the Trump organization, but these are unusual, and highly publicized. Punishing dishonesty seems like the easiest problem to solve, and it's easy to rally around for a quick and cheap victory. But I have seen these run-up bids for decades and no amount of punishment has ever seen to stem the flow of these events; it seems as if every city and state is infected with this problem. Either we are in a system where bad apples are so numerous that punishing a few has no meaningful effect on incentives; or we are in a system where bad apples are so rare that we punish good apples mistakenly, and can't figure out the real cause for our poor planning. Until we move on from the assumption that a few bad apples are to blame, we likely won't be able to discover the real underlying problem.

<comment><USER10> The bids aren't in bad faith. They are just over-rationalized and under- justified until the number is small enough to be in the winnable range. Middle Management talks out of both sides of their mouth, demanding lower estimates, while demanding integrity of results (wink wink).

They don't really want integrity, they want to get a number that won't get them yelled at by their boss. The integrity bit is a pass the buck clause.

So the estimator is in the position of trying as hard as they can to lower the estimate. "Well, if we assume xyz unreasonable assumption, then we can lower the amount by this amount."

And then there are "risk" shenanigans. You itemize all the risk items, declare an arbitrary probability of happening. Then management rolls those up, and declares that they are not going to fully fund the risk and instead "carry" it forward.

Fully funding basically would mean multiplying the likelihood of occurring by the cost, and adding all the items up. Which is already iffy as the probabilities aren't based on much except a w.a.g.

So you win the bid, the risks are realized, and weren't funded. blow out.

Standard practice. And because everyone does it, the honest bidder is the loser. Losers go out of business. So the whole bidding practice is self selecting for cheats.

If you say, "this is unethical, I'm going to do my best to give a realistic bid", you lose.

<comment><USER11> Should be easy to fix, if the contract for work includes a "penalty for being wrong for circumstances completely within the bidders control that they should have seen".

Austin government did this for its MoPac toll express lanes and got them for way cheaper than what they should have paid: [https://www.bizjournals.com/austin/news/2017/09/27/big- settl...](https://www.bizjournals.com/austin/news/2017/09/27/big-settlement- reached-in-mopac-expansion-end-in.html)

However, the project ran over for two years longer than it should have (it was supposed to be completed in September 2015, and they are only just now wrapping it up). So I guess no one really won there aside from the Austin transportation budget guys, except the populace hates them now for traffic jamming the place up for two years longer than they said they would.

<comment><USER7> Isn't completion something that is at least in part in the bidders control. Did they employ all available personnel and work 24 hours?

<comment><USER11> Sort of, when they could. In this case there were penalties for going longer on the project. Main problems ended up being weather (heavy rains) and lack of knowledge of the soil - many changes were made to the project because the contractor (C2HM) did not do a proper soil survey where they were going to be digging.

</comment></comment></comment></comment></comment></comment><comment><USER12> For the people interested the blancolirio YouTube channel does an incredible job reporting on the dam.

[https://www.youtube.com/user/blancolirio](https://www.youtube.com/user/blancolirio)

<comment><USER13> He keeps referencing a "plunge pool" half way down the new slipway. Does anyone happen to know what the purpose of the plunge pool is?

<comment><USER14> I think it's the natural depression that eroded where the water first comes off the top half of the chute.

<comment><USER12> I watched everything and I confirm, it's what was the crack, and it doesn't exist anymore, it's filled in. At about the same place the are putting an aeration feature to mix air in the water and make it less destructive to the concrete downstream.

</comment></comment></comment></comment><comment><USER15> The total construction cost of the Oroville dam, ending in 1968 was $480 million. Inflation-adjusted, that's $3.5 billion in 2017. $500 million just to repair the spillway seems excessive...

See table 8 in [http://www.water.ca.gov/swpao/docs/bulletins/bulletin132/Bul...](http://www.water.ca.gov/swpao/docs/bulletins/bulletin132/Bulletin132-69.pdf)

<comment> crooked-v Modern safety standards in construction are much more stringent than late-60s safety standards in construction.

<comment><USER16> And modern requirement for additional administrative roles and salaries, both directly and indirectly linked to that business, have probably more to do with inflation...

</comment></comment></comment><comment><USER17> My folks live in the nearby area not downstream. That's what happens when preventative maintenance is ignored by reactive bureaucrats. _Pennywise, ..._

Here's one of the YT channels that's been following the progress, filming and combining DWR footage. [https://www.youtube.com/user/blancolirio](https://www.youtube.com/user/blancolirio)

</comment><comment><USER16> I feel like this thread is ignoring the main point, which is that preventative maintenance would have been cheaper.

Also, when this thing started falling, they could have stopped it earlier, which would have resulted in cheaper repair, but no...

Sure we would not have awesome drone footages, and I like the discussions on worker's risk and contractor down-biding, but at the end of the day it's a lot of money for something preventable. Same can be said of worker's riks, health care, environment, retirement.

</comment><comment><USER18> All in all, pretty impressive engineering project, correcting engineering defects dating back more than 50 years.

</comment><comment><USER19> 500 million? Wow. Can't they just lay down a big pipe and decrease the water level that way? Seems to me like just about any solution would be cheaper than 500 million...

<comment><USER20> The spillway _is_ a sort of a big half-pipe.

</comment></comment><comment><USER21> Lots of patterns here similar to large IT overruns.

</comment><comment><USER22> They should do an ICO to raise money to fix it. Citizens shall pay for their water in ETH to the token holders. Kidding, but in 20 years I might not be.

</comment><comment><USER23> cost of not repairing is still higher

<comment><USER24> Well... obviously... otherwise why would they be doing it?

</comment></comment><comment><USER25> Why is this on HN?

Whenever non-tech posts are put up on HN, they're ruthlessly hounded. What does this article have to do with tech that absolves it? The fact that it comes from San Jose's newspaper?

<comment><USER26> It is a tech related post, especially an engineering related process. And beyond the importance of the Oroville dam for California, the repairs are an interesting case in project management. They have a fix deadline (Nov. 1) and not meeting the deadline was not an option. And it looks like they are making the deadline, what an achievement!

<comment><USER25> That's quite a stretch, though, don't you realize?

The H in HN stands for "hacker". I fail to see the connection to any "hacking" here in the article other than maybe "hacking bureaucracy to make a dam", but you must see the incredible lengths to which one must stretch the notion of hacker-related ideas to apply to this article.

There are other non-SWE-related topics that certainly qualify, like overcoming natural barriers in engineering a la the Iceland forest article that was posted a couple days ago.

This news article in OP is little more than a status update about something that affects California's water infrastructure and nothing else.</comment></comment></comment>


Tetris effect - <AUTHOR> http://en.wikipedia.org/wiki/Tetris_effect <comment><USER2> I'd be interested to know whether this guy gets the Tetris effect: <http://www.youtube.com/watch?v=jwC544Z37qo> According to the video description, he's the best Tetris player in the world, and I can believe it: the end of the video is one of the most amazing things I've ever seen.

<comment><USER3> I was totally agreeing with your description of the end of the video, and then I actually got to the end of the video. Absolutely mind-boggling.

<comment><USER2> I've shown the video to a few people, and they sometimes completely miss what's going on at the end. When I tell them, I usually have to pick their jaws up off the ground.

</comment></comment></comment><comment><USER4> The only similar effect that I've ever experienced was that after few hours of continuous playing of Frozen Bubble, I saw _everything_ insanely blocky. Even quite round shapes were looking like blocks. But that was over within few minutes.

I play tetris a lot, but when doing so, I don't think about it. Tetris is a game that you can play without actually thinking about it. I play ltris, and if I play another variant that has different colors for different shapes, or some other minor difference, I'm completely screwed. In fact, I play tetris in order to be able to think about something else, it employs my hands and I can clearly think about something I want. The game itself is just a complete routine.

(And by the way, I can play tetris completely in my head, without a computer. Just close eyes and imagine playing it. And it actually feels like playing tetris. Shapes randomly appearing at the top, that I try to place as I would in the real game, then they make rows, disappear, and after some time, it gets so fast that it overwhelms me and I lose :-))

</comment><comment><USER5> I experience this with RockBand and Starcraft, but has anyone had this experience with _math_?

During exam time I'd often experience hallucinations of equations, but even crazier were the dreams: sometimes I couldn't wake up unless I performed a mathematical operation on some regular object, ie. "what's the Laplace Transform of this blue chesterfield?"

<comment><USER6> _has anyone had this experience with math_

Yes, and also computing. Among other things, I've had a dream where I was trying to open files and had to win a race against someone who was replacing them with evil symlinks; several dreams about copy-on-write B+Trees; and a dream where I was a mutex and was trying to keep threads straight except that I got confused when I was locked recursively.

</comment></comment><comment><USER7> Amazing! Now there's a name for this experience. I was a server admin for Tetrinet2 and naturally had all my friends playing for hours at a time. We all talked about how we'd dream falling blocks, the background music, etc.

</comment><comment><USER8> Once, when leaving my girlfriend's apartment after a marathon Halo 2 session, I heard a sound in the distance. Wanting to see what happened, I tried to "zoom in." My right thumb even moved to where "B" would have been if I were holding an Xbox controller.

edit: I've also, of course, tried to Ctrl-Z when writing on paper... many times...

<comment><USER9> I've expected to use a find function in a paper text book. Also, when revising, thinking ohh it fine do not need to note down citation, will just Ctrl - F.

Very annoying when you realise you actually have to go through a lot of skimming instead :(

</comment></comment><comment><USER10> I was wondering if there was a cell phone effect wherein you thought you heard a cell phone ringtone while listening to music.

<comment><USER11> Replace music with lawnmower, and I share your experience. Until the mower if off I think a mobile is ringing constantly.

</comment></comment><comment><USER12> I'm guessing the habit of strafing into a room after playing Doom a bit too much is of the same nature :)

<comment><USER13> While driving home after a marathon LAN session of DESCENT, I was cut off in traffic. My first instinct was to bank smart missiles of the nearby burger king. My hand even grasped toward the turn signal controls to fire.

I guess that's where my mind decided the smart missile controls would be.

I remember it very clearly, as I've always been slightly unnerved that not only was it a reflex thought, but that I'd actually moved to act on it.

<comment><USER14> Grand Theft Auto has created a similar experience for me. Every once in a while, I will legitimately feel the instinct to force my vehicle in between other cars or knock them out of the way. After a split second I realize that it's insane, but the feeling is still deeply ingrained in my perception of traffic negotiation.

<comment><USER15> I have no idea why you got down-voted for this. I've had this after marathon GTA sessions. I imagine it's disturbingly common. The desire fades after a while. I think you're post is in keeping with the theme of the discussion.

All in all, maybe marathon or prolonged gaming sessions aren't the healthiest thing in the world, mentally and physically. Say all you want about hand-eye coordination and I'm no Gaming or Net Nanny or anything but ...

</comment></comment></comment></comment><comment><USER16> I've started to have dreams about refactoring code... where to encapsulate imperative parts into functions, what functions to make into objects....

<comment><USER17> I asked my girlfriend to refactor the dishwasher the other day.

<comment><USER18> What was wrong with it?

<comment><USER17> The dishes needed rearranged in order to fit more in there. The original arrangement was never intended to be more than a prototype. I swear.

</comment></comment></comment></comment><comment><USER19> After a Mass Effect marathon, I started instinctively reaching for "quicksave" before making decisions or initiating dialogue. If only...

</comment><comment><USER20> I used to call it the "falling sand effect" cause it happened to me after playinmg those flash falling sand games...

</comment><comment><USER21> I never knew there was a name for this. I experience this both with writing code, and for running a company in general. Sometimes I see myself making strategic business decisions as I drift asleep or in the morning just before waking up.

</comment><comment><USER22> >They might also see images of falling Tetris shapes at the edges of their visual fields or when they close their eyes.

I get an effect similar to this after playing airsoft, except it looks like BBs flying towards me.

What I find interesting is that it's not all-that common while playing to see BBs flying towards me. It happens several times a game, but only for seconds at a time. So if this is the same effect (not just a different one with similar symptoms), it's not caused simply by an overload or repetition of a particular stimulus.

(It's not just me: my friend said he gets the same effect. But I haven't asked around, so I couldn't say if it's widespread.)

</comment><comment><USER23> I got this quite a bit from halo 2... It's what convinced me to stop playing competitively. Not worth dreaming about everything in FPS form. It gets weird.

</comment><comment><USER24> This absolutely happened to me in high school when playing Tetris on my graphing calculator. I'd see the shapes falling as I fell asleep at night. I always thought it was because I felt only semi-conscious for stats class in the morning, and I was returning to that "half awake" state while falling asleep.

Cool to find out it's a real phenomenon.

</comment><comment><USER25> I always considered that the "Syphon Filter Effect" in honor of this TV spot: <http://www.youtube.com/watch?v=hdrBM-265ns>

I don't think that commercial would get OK'd today. A video game that makes you hallucinate shooting innocent bystanders? It's so pre-columbine.

</comment><comment><USER14> I spent a week in middle school at a barbershop quartet camp. For several days afterwards I heard dominant seventh chords whenever I heard white noise. I especially remember listening to the air coming in through the crack in the car door on the ride home and hearing chord progressions for the entire two hour trip.

</comment><comment><USER26> During my undergrad WoW days, I'd get this quite a bit.

I got it when I cooked professionally, and would dream about cooking on the line at work.

These days I dream about coding a lot, and occasionally of dealing w startup logistics, which is always funny.

Its a good sign of when I need a day with just a bit less of whatever has been occupying my mind all night

</comment><comment><USER27> After a day in the ocean, you will often feel the motion of the water as you fall asleep.

<comment><USER14> Also with roller coasters.

</comment></comment><comment><USER28> Funny, during work I was listening to a segment in a Radiolab episode about sleep: <http://www.wnyc.org/shows/radiolab/episodes/2007/05/25>

it's the last segment.

</comment><comment><USER29> I've had this happen to me with Tetris and not batted an eye. When it happened with Nethack, though... I freaked out and didn't play again for a year. That shit was scary.

</comment><comment><USER30> This happened to me when I played too much D&D one summer. I saw everything in dice rolls for about a week after I took a prolonged break from it.

</comment><comment><USER31> oh god. i guess there's a bejeweled effect too and another for brain age two's game

</comment><comment><USER32> I used to experience this, but I called it the "WOW is making me fucked up" effect.

</comment><comment><USER33> This happened to me the summer of 1993, but in my case it was Mine Sweeper.

</comment><comment><USER34> After playing a lot of DDR, I saw arrows as moving up my field of vision.

</comment><comment><USER35> The definitely happens to me if I play too much Geometry Wars.

</comment><comment><USER36> After FPS marathons, I get visions of running through tunnels before falling sleep.</comment>


Myths About Sleep - <AUTHOR> http://www.webmd.com/a-to-z-guides/features/7-myths-about-sleep

<comment><USER2> Why does this community have a minor obsession with sleep? I'm asking out of genuine curiosity.

<comment><USER3> because a lot of programmers are the type who reject their natural sleep rhythm any time it becomes an inconvenience to getting work done. since this is fairly often (lots of articles have been written on why people doing creative work stay up late, won't rehash here) they wind up with chronic sleep problems when others demand that they conform to a schedule (read: the rest of the world).

my take: One of my MAIN goals for making a lot of money is to get to the point where I can just sleep whenever I feel like sleeping.

<comment><USER2> okay so to take this further, what motivations are there for breaking the "natural sleep rhythm" that are prevalent in the world of creative entrepreneurs (hackers) but not so in the "rest of the world"

You gave the exact answer I was expecting, but I'm not convinced this suffices. It /IS/ an obsession... my late night coffee binges are the stuff of legend (mostly because I rely entirely on natural stimulants when my other friends take more unorthodox steps to maintain.... "consciousness")... but WHY is this so? My stimulated friends are there for the simple pleasure of being wrecked on particular drugs, does the brain of a hacker/creative entrepreneur expect a similar payout? you mentioned being motivated by money... so by breaking (or taming?) the natural rhythms of sleep, does one invest some abstract personal commodity in the hope of future security? What could motivate this?

[ASIDE: notice that I'm trying to _START A DISCUSSION_.... voters/recent posters would do well to take that into consideration as for some reason it has been overlooked of late]

<comment><USER3> I think money is a background concern, with the foreground being puzzle solving. the fact that you are ultimately being paid for said puzzle solving just adds to your rationalization for staying up. once you get in "the zone" you don't want to leave it, since you know that you are 10 times more productive while in it.

<comment><USER2> So it's just a quirk of a hacker's mind that puzzle solving (and possibly peer admiration) is addictive? My reasoning being that we all KNOW that it is not good for ones health, but those that can access flow/"the zone" do so to burn bright and die young? I'm also thinking of performers there...

sorry if I'm rambling, but I find this a very interesting topic... not just because I indulge in this, but because it's becoming more and more common and I can only see it as self destructive. What good is a creative outlet that forces you into burnout? Why does the hacker mindset look for ways to cheat around the obviously unsustainable lifestyle? Is it pride? being a perfectionist? simple delusion that the system is geared to reward those that over-invest their energy?

I can see myself falling off a damn rocky road any day now, and it's got me thinking: why was it that I couldn't get to the same place using an easier route? Money? is that it, does it all boil down to simple investment? most hackers aren't backed by anything more than their determination and a vision that simply _must be realised_ .... but that's Obsession!?

/me stops having a mini-breakdown

</comment></comment></comment></comment></comment><comment><USER4> I think this one is no longer a myth:

3\. Some people function perfectly on four hours of sleep.

I read about a gene that some people have that lets them do this: <http://sciencenow.sciencemag.org/cgi/content/full/2009/813/2>

<comment><USER5> Thanks for the tip but we'll have to wait a decade, at least, for therapeutic gene therapy.

</comment></comment><comment><USER6> nice read</comment>


SS7 MITM Attack Against WhatsApp and Telegram - <AUTHOR> http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-and-telegram-encryption-useless-503894.shtml <comment><USER2> This article glosses over a few important details.

The reason that end to end encryption exists is precisely because man in the middle attacks are possible, and always will be. This kind of attack is devastating for Telegram, because by default they don't use end to end encryption, and instead store the entire plaintext history of every message you've ever sent or received, all of which an attacker instantly gets access to.

For WhatsApp, everything is end to end encrypted by default, so the attacker doesn't get any message history. All of the contacts for the MITM'd user also get a notice that their contact's security code changed, and a comparison will fail to match. This is exactly what E2E was built to protect against.

<comment> Fry-kun So many people confuse encryption with authentication... Suppose you're a whistleblower trying to contact a reporter using WhatsApp. You've never met in person, so you send a message over WhatsApp, "Hello!" The reporter replies, "Hi!" You now have a big problem -- you don't KNOW that it was the reporter who replied to you, it might've been a nefarious 3rd party who already intercepted your original message and is now replying. WhatsApp's only mechanism for checking if that's the case is comparing some numbers out-of- band (e.g. in person, with QR codes). What's even more tragic is that WhatsApp doesn't track/show which contacts you may have already authenticated.. good luck remembering which of your 100 contacts are verified

<comment><USER3> Just curious, how would you solve the authentication problem? I worked on a semester long project building decentralized chat and found this as well as bootstrapping to a node that you could trust be some of that hardest problems to solve because it always boiled down to just trust.

<comment><USER4> Out of band, very public signatures. Of course this only works for fairly known people, but the reporter example could be easily covered by that solution. Publishing signatures with every article for example.

This fails for two anonymous people... but that's "by design" of being anonymous.

<comment><USER5> _This fails for two anonymous people... but that 's "by design" of being anonymous_

It's almost like a tautology: by definition, someone who is anonymous has no identity to authenticate.

</comment></comment></comment></comment></comment><comment><USER6> Is there a translation of how they got into SS7? Google rejects the PDF as too large to translate.[1]

[1] [http://www.ptsecurity.ru/download/PT_SS7_security_2014_rus.p...](http://www.ptsecurity.ru/download/PT_SS7_security_2014_rus.pdf)

<comment><USER6> Thanks. From that article: _" To access an SS7 network, attackers can acquire an existing provider's connection on the black (underground) market and obtain authorization to operate as a mobile carrier in countries with lax communications laws. In addition, any hacker who happens to work as a technical specialist at a telecommunications operator, would be able to connect their hacking equipment to the company's SS7 network. In order to perform certain attacks, legitimate functions of the existing communication network equipment must be used. There is also an opportunity to penetrate a provider's network through a cracked edge device (GGSN or a femtocell)."_

So they don't have a way to break into WhatsApp without breaking into SS7 first. SS7 isn't publicly accessible, and it doesn't extend out to the air link for mobiles. The attacker has to find a backdoor into SS7. The problem is that, once on the SS7 network, you can send lots of messages which are believed by telco networks. You can divert phone calls and set up MITM attacks easily.

If this works against WhatsApp, their app lacks adequate MITM protection.

<comment><USER7> You can get the SS7 link for a few hundred bucks a month:

[https://www.youtube.com/watch?v=lQ0I5tl0YLY](https://www.youtube.com/watch?v=lQ0I5tl0YLY)

Its an hour, but I highly suggest the talk.

<comment><USER8> But you can just connect to a carrier SS7 network because you bought an SS7 gateway appliance or because bought a SIP trunk to some third party. It doesn't work like this. You need to have an agreement with a carrier to even talk to their gateway. These are usually well vetted as well because you are entering into a financial agreement with a carrier when you connect to them this way.

</comment></comment></comment></comment><comment><USER9> SMS verification really sucks. It's hugely helpful because it is an 'open social graph' to use a Zuckerbergism. However, it's not at all designed to do this. It's like the problem with SSL verifying ownership via email - ok at first sight, but then say you run a webmail service and you can register webmaster@, game over without any crypto bother. Or just trojan the webmaster@ mailbox and get control over the guy that runs it and issue a valid cert. Insta-MITM.

Mobile numbers are easy to spoof and easy to port away from people. In most countries telco regulators look at how easy it is to port cell numbers as a badge of honour on how efficient their mobile regulation is. Just like everything, attackers will rush to the easiest point of failure. In this it's SMS and using phone numbers as a trusted identifier.

In the UK you need to get a "PAC code" to change provider, but it's not hard to social engineer that if you went through someones trash and grabbed an old cell bill. The number will be ported in a day or less and even worse, there's no way for you to port it back quickly since you'll have no idea who it's got to. And with it your WhatsApp, etc will all be gone security wise.

All this talk of "oh just enable these super warnings and scan QR codes" is nonsense. People port phone numbers and move phones all the time, these warnings can't be this strong otherwise half your phonebook would false positive.

</comment><comment><USER10> SS7 is broken beyond repair, infact it being a walled garden is the only security it ever had.

This ccc talk is a good intro - [https://media.ccc.de/v/31c3_-_6122_-_en_- _saal_1_-_201412271...](https://media.ccc.de/v/31c3_-_6122_-_en_- _saal_1_-_201412271830_-_mobile_self-defense_-_karsten_nohl)

<comment><USER8> SS7 is not broken at all. It's an extremely robust protocol thats been around forever. It was designed to work in the closed Bell system not designed for an idea 40 years in the future. Its not uncommon for an SS7 gateways to have 6 9's of uptime. Yes 6. There is nothing broken about it.

<comment><USER11> Oh I disagree. High-security engineer Clive Robinson has been writing online about SS7 and similar protocols risks for years. In posts like this...

[https://www.schneier.com/blog/archives/2015/08/ss7_phone- swi...](https://www.schneier.com/blog/archives/2015/08/ss7_phone- switc.html#c6703762)

...he points out that telecom and spy agencies were very tight in U.K. (and often U.S.). Many features that benefit spying are there on purpose. As he predicted, they continued to be a problem in upgrades due to the compatibility argument and downgrade attacks following. Worst, certification or connection to a major wireless standard might force you to include weak crypto or security in your product.

It's all crap in terms of security. Sure they're reliable... amazingly so in some cases... but they're not secure and that's on purpose.

<comment><USER12> The parent commenter isn't claiming that SS7 is secure. Nobody thinks it is.

<comment><USER11> I may have misread it. The subject is SS7 security and here's the parent comment:

"broken beyond repair... infact it _being a walled garden is the only security it ever had_."

bogomipz countered with how robust the protocol is. Your critique is true if bogomipz was only countering the words "broken beyond repair" with no context. In context, though, the counter would imply disagreement with the security claim.

"isn't claiming that SS7 is secure. Nobody thinks it is."

Hopefully true. :)

</comment></comment></comment></comment></comment><comment><USER13> The real problem is not Telegram or WhatsApp, it's the banks that insist on using SMS as a secure authentication channel for authorizing transactions.

<comment><USER14> The real problem is that there is no alternative to SMS for GSM messaging.

It is one of those protocols that won't die nor get replaced, like email.

<comment><USER15> WhatsApp and TOTP apps can already replace SMS for verification. The only problem is 2FA providers are still choosing to use SMS.

<comment><USER16> Not everyone uses WhatsApp or other 3rd party app while SMS is enabled by default on all user phones, even "dumb" ones (still used by many people around the world). I use Signal, many friends use WhatsApp, others Telegram etc. Do you expect a bank to support them all or somehow enforce installation of their app of choice?

<comment><USER15> They should enforce one app. Since WhatsApp has the correct design and has a billion or more users, I suggest that one.

<comment><USER16> So when another new, shiny app made by some walled garden company shows app, bank should enforce that instead? My bank is using mobile signature(1) and I think it's way superior to any app, because the encryption part is done inside SIM which has quite good security record. There's simply no way I would trust Facebook (via WhatsApp) with my financial data.

1\. [https://en.wikipedia.org/wiki/Mobile_signature](https://en.wikipedia.org/wiki/Mobile_signature)

</comment></comment></comment></comment></comment></comment><comment><USER17> >...encrypted apps use SMS authentication to identify and authenticate users participating in encrypted conversations

Is this true? Because it's common knowledge that SMS is insecure. So I don't understand how why anyone would want to use it for secure authentication - especially in the case of Whatsapp.

<comment><USER18> Ask Moxie? He uses it for Signal also, and unlike WhatsApp, Signal is "sold" as secure...

<comment><USER19> I don't think anyone has implied that E2E-crypto without out-of-band key verification is bulletproof. Both WhatsApp and Signal allow you to do that.

<comment><USER20> And Telegram. If someone bothers checking this they'd also use Telegram's secret chats which do have open source end to end encryption.

</comment></comment></comment></comment><comment><USER8> I realize every new outlet on the internet is regurgitating this story but if I call you via whats app and are both using wifi does the communication even transit an SS7 gateway at all? Why would it? Also SS7 is generally a closed system, not anyone can connect to an SS7 gateway. To signal to a carrier's SS7 gateway you have to either be a subscriber or carrier that has agreement with the owner of a SS7 gateway to terminate traffic, since this is how calls are billed. For an external carrier to connect to another carriers SS7 gateway they need to know your "code points"(kind of like an IP address for SS7.) in advance. There wasn't a lot to go on in the google translated doc.

</comment><comment><USER21> Stop using/requiring phone system in internet based instant messengers.

</comment><comment><USER22> All the more reason to find an alternative to SMS based authentication.

It is somewhat comforting to know that message history cannot be retrieved from WhatsApp or other E2E apps like Threema.

<comment><USER23> Threema isn't affected by this as it uses a randomly generated ID as unique identifier, not your phone number.

</comment></comment><comment><USER24> To mitigate this issue on WhatsApp, enable security notifications in settings and verify your contacts QR code.

If you go to a contact there is a QR code you can scan to verify a contact. If the code of a contact changes, WhatsApp will tell you.

</comment><comment><USER25> i can't say much for telegram as their encryption has been broken, and is not an openned, but whatsapp's new signal protocol designed by moxy marlinspike doesn't use sms to authenticate. It doesn't by default require authentication, but rather has it as an option and the option generates a long 80 character passcode or QR code, to be communicated in person or via some out of band communication channel, similar to threma. Maybe they are talking about old whatsapp?

<comment><USER19> I think the article is referring to the fact that out-of-band key verification is optional and isn't something that _most_ users will perform. If you're doing out-of-band key verification with all your contacts, and have enabled the setting that'll make WhatsApp notify you about key changes of your contacts, this doesn't concern you.

<comment><USER2> _Most_ users probably aren't worried about targeted attacks from adversaries who've compromised SS7, either. But the ones that are have an easy option.

</comment></comment></comment><comment><USER26> So trust on first use -style system can be attacked by intercepting the initial handshake? Yay... I suppose next the researchers will show how to MITM SSH with free wifi hotspot.

</comment><comment><USER27> When people perform attacks like this, how are they getting access to the SS7 network? Would they not need use of a (presumably expensive) trunk?

<comment><USER28> You pay someone giving you access. Check the YouTube videos up there, the talk at the CCC is worth it.

<comment><USER20> Saw the talk live, can confirm it's worth watching.

</comment></comment></comment><comment><USER29> > "The researchers, using their Linux laptop..."

My eye twitched a little when I read that. Is the author trying to suggest that Linux is some hackers-only operating system?

<comment><USER30> Well, c'mon now. When was the last time you saw someone with a Linux laptop that _wasn 't_ a hacker? :P

<comment><USER31> Little kids with chromebooks.

<comment><USER32> You should watch them more closely. Little kids are devious.

:)

<comment><USER33> Yeah. Back in the days of 2012 when schools used Macs, some of the kids caught on to the fact that SSH and Terminal existed because I was using them. Now NOBODY is safe. :-D</comment></comment></comment></comment></comment>


Ask HN: Have any Mexicans ever been accepted into Y Combinator? - <AUTHOR>

I was talking with this schoolmate, somehow we started talking about Mexico City. I remembered about his trip one and a half years ago, so I asked about CETIN (Centro de Tecnología e Innovación Telmex). He told me about how awesome it was, that there we're all this programmers doing their own thing. So I asked him if he had ever heard of Y Combinator, I told him what first came to my mind. "It's an accelerator", "The best accelerator in the world", "Dropbox, Airbnb", "$6,000 USD years ago", "$100,000 USD now", "USA three months", "$500,000 USD Azure", "$100,000 USD Google Cloud", "10% Equity", "Very selective", "Demo day", etc. Well you get my point. On the way home while I was reflecting about our chat, I got really curious about my question, so I thought I'd ask! <comment><USER2> I believe in my friends year there was a man from Argentina ( = Latino != Mexican)

I personally lived in Monterrey, Mexico for two years. While most of my best friends are Mexican, I would hope that Y combinator would focus on the best ideas and the best teams and NOT where they are born or they would be in danger of loosing their "best status"as other programs would simple get the best possible people.

I think of Basketball where some countries, lets hypothetically pick Switzerland, pick the tallest/best 5 players that are Swiss. Other countries like the US, by comparison, pick the tallest/best 5 players from anywhere they can find them. The USA doesn't have the CONSTRAINT of having to pick just Americans.

I say pick the best from anywhere.

</comment><comment><USER3> Is your question about ethnic diversity or the practicality of applying from another country? I think your question sounds a bit loaded and could stand some clarification.

<comment><USER4> I think you're reading too much into the question. It's not really ambiguous -- he is asking if any citizens of Mexico been accepted to Y-combinator. It's a yes or no question that could be answered more fully with a single number. If you wanted to answer it more broadly you could consider immigrants from Mexico too.

<comment><AUTHOR> >I think you're reading too much into the question. It's not really ambiguous -- he is asking if any citizens of Mexico been accepted to Y-combinator.

Yep, just this!

</comment></comment></comment><comment><USER5> There is not an answer for the country of origin but of the demographic (race and gender). I wrote about it here: [https://medium.com/@JDcarlu/what-is- wrong-with-sv-networks-a...](https://medium.com/@JDcarlu/what-is-wrong-with- sv-networks-a2f203431ea6) PS:I'm latino

</comment><comment><USER6> While we're on the subject: what's the geographical distribution of YC- accepted founders?

</comment><comment><USER7> I read an article recently that in the past they did not measure founder metrics like this besides gender but were considering doing so going forward.

</comment><comment><USER8> Dunno for YCombinator, but 500startups (USA-Mountain View) has had already 4-6 startups founded by Mexicans (and a Mexican-cum-american, wait, that's me) You don't need to come to Silicon Valley for an accelerator, 500startups Mexico City is right there!</comment>


Qt GUI Toolkit Ported to JavaScript via Emscripten - <AUTHOR> http://badassjs.com/post/43158184752/qt-gui-toolkit-ported-to-javascript-via-emscripten

<comment><USER3> I'm not sure whether I should be impressed, consterned or scared.

It's the sort of things I would love as a developer (Hey ! Portability! Less code to write ! awesome mature toolkits !) and I would never want as an user ( Hey ! It's the same as old Qt apps, except five time slower !).

</comment><comment><AUTHOR> From the comments: "From Qt came KDE, KDE produced KHTML which became WebKit which I can now use to render Qt. Full circle indeed!"

<comment><USER4> Just that KJS -> JavascriptCore. Is that understood as part of KHTML/WebKit?

</comment></comment><comment><USER5> "it's actually really fast and responsive"

Is everyone today equipped with at least 4-core 3GHz i7s or what?

Text Edit demo is barely responsive on my Athlon 64 X2 4600+ in recent Google Chrome beta (25.0.1364.84) on up-to-date debian wheezy. To the point it's unusable, unfortunately.

I admire the project, it must have been a great fun to build it and it is impressive achievement. Really!

I still hope it may be optimized more, so it will be truly responsive. Even then it doesn't mean it's the right way to go. Web developers, please, do not write your websites as Qt apps to compile them later with emscripten-qt!

<comment><USER6> It is not optimized at all yet - still using software rendering in pure JS. Will be more interesting with hardware acceleration, I intend to work on that with the author of these ports.

</comment></comment><comment><USER7> Well, this is no more than a showcase. On my fairly modern computer with powerful graphics card it is unbearably slow even in Chrome, while remember, Qt used to run on embedded devices with no hardware acceleration whatsoever . Everyone and her granma is excited about web technologies, but this is not the future I want.

Native Client approach is a lot more promising, despite not being welcomed well in the industry.

<comment><USER8> it might be more of a canvas issue than anything. emscripten gets some good results most of the time (something like 10x speed down compared to g++ -O3).

Canvas (and webGL notably) support is there, but its super flaky and hard to make fast.

<comment><USER7> And at which point in history 10x speed down has become acceptable? In certain industries people are trying to squeeze the last bit of performance out of their code, fine tuning cache usage, SSE and whatnot. I just don't see it as an innovation in technologies, quite the opposite in fact.

<comment><USER9> Extreme portability is often worth 10x slowdown.

<comment><USER7> It sure may be, but JavaScript can't be "extremely" more portable than, say, C++, since all JavaScript engines with majority market share to date are implemented in C++.

Also its portability is not an inherent property of JS, it is because of the history.

</comment></comment></comment></comment></comment><comment><USER10> Cute idea; compile C++ -> LLVM -> Javascript.

...but the problem is that relatively few business GUI applications _do nothing_. The front end has no purpose other than to trigger some kind of backend action, or update some database, or read some data from some source and display it.

...and that backend, non-QT code, which talks to system libraries, is never ever ever going to compile to javascript.

So other than tech-demo, what's the use case for this?

<comment><AUTHOR> Say no more, say no more! There is just the thing for you:

<http://www.webtoolkit.eu/wt>

To answer your question, I'm not sure what is the use for this, since you know, it does not compile to coffeescript /sarcasm. But in all seriousness, I did not post this to advocate it's use, but because I found it somewhat strange.

<comment><USER10> What on earth are you talking about?

I'm not dissing this project; I think the c++ to javascript compiler is really neat.

I just don't think I've ever seen any real QT applications that would compile and run with it; they all talk to databases or system services, which isn't supported.

<comment><USER11> The Emscripten use-case seems to be all about components rather than applications.

</comment></comment></comment></comment><comment><USER12> Good news for browser centric thin clients/devices, I suppose. There was a lot of criticism of devices, particularly Chromebook, that rely on the cloud; that you're fairly limited by what you can reach via the browser. Well, it looks like you can reach a lot more now.

I hope we can look forward to getting rid of pointless apps that are forced on you just to read a web page though. That's really, really annoying.

</comment><comment><USER13> I really hope this includes QtWebKit!

<comment><USER14> i heard you like browsers...

<comment><USER4> ... so i put a browser in your browser so you can browse while you browse.

</comment></comment></comment><comment><USER15> Why on earth would I want to use this?!

<comment><USER16> Because you can write web applications without having to use crippled, half baked JS frameworks. GUI programming was solved over a decade ago. The things we do in the browser these days, in terms of complicated web apps, mostly consist of reinventing the wheel. Backbone, ember, knockout, etc are all toys with missing wheels in comparison to a serious GUI toolkit. In contrast, Qt is well tested, very well designed and elegant. It's been around since 1992 - <USER2> years old!

<comment><USER15> I will take the desktop over the web any day for complex applications.

My experience in web development projects makes me every day more convinced that the only thing the browser is good for, is documents.

</comment></comment></comment><comment><USER17> Are there any projects using emscripten that aren't just demos?

<comment><USER6> In practical terms, most of the publicly available stuff is demos. It's easy to create demos of open source projects and publish them immediately.

It takes longer for commercial codebases to be ported, pass all the stages of productization, and be officially launched. My prediction is for a few such projects to show up later this year.

With that said, there are some uses of emscripten that are not demos. For example emscripten was used to port the crunch decoder to JS in gl-matrix, and that might well be used in non-demos. Also there are educational sites using compiled languages like repl.it as another commenter mentioned. I've also seen a few other practical uses, e.g. of sql.js in sqlfiddle.

<comment><USER17> It doesn't have to be commercial to be more than a demo. Sql.js was a great concept but hasn't been updated in 10 months (unless there is a fork that is maintaining it), even though it has major issues.

I know you Mozilla guys don't have time to maintain ports, but are you doing anything to encourage open source devs to actually use and maintain this stuff? I'm working on an emscripten port of a game myself that I _do_ want to actually maintain and improve upon, but I get the impression that I am in the minority.

<comment><USER6> > I know you Mozilla guys don't have time to maintain ports

I used to have time to maintain at least sql.js, ammo.js and box2d.js, but recently work on asm.js and some porting projects has monopolized my efforts I'm afraid. My hope is people that use it will maintain those.

> but are you doing anything to encourage open source devs to actually use and > maintain this stuff?

Do you mean ports like sql.js and ammo.js that I began, or new ports people make?

I don't know how to encourage people to work on my ports - either they do or they don't ;) I ask for help and mention the projects, but it's up to people to be interested of course.

Regarding other people's ports, I definitely try to support them as much as possible. Fixing bugs that those ports encounter is always high priority for me.

> I'm working on an emscripten port of a game myself that I do want to > actually maintain and improve upon, but I get the impression that I am in > the minority.

There are a few serious/long-running ports, like jsmess and nebula3. But most ports are more short-term: they accomplish the goal, and then not much is left to do.

There are also commercial emscripten ports, but most commercial work by nature is secret until it launches.

</comment></comment></comment></comment><comment><USER18> I'd love to see a (either ported or native) Unix in javascript that can run all these ported programms. I know emscripten already does have a filesystem and stuff. But I mean something bigger, something with filesystem backends for webdav and local storage, a shell, process management and all the usual stuff. I'd be a victory over the walled garden, because today everything speaks javascript.

</comment><comment><USER19> What a wonderful, pointless, hilarious, inpiring hack.

</comment><comment><USER20> No, thanks. I'm already frustrated by all the crappy "native" (non-ported) javascript applications that never work as expected, so let's not keep adding to this.

</comment><comment><USER21> I'm curious how this would run inside an Android webview. Anyone have some hardware to try it out?

</comment><comment><USER22> I was kind of hoping it could run a Qt Webkit demo!</comment>


Show HN: The Progression of Coronavirus - <AUTHOR> https://gieoon.github.io/Coronavirus-Live-Map/ <comment><USER2> Beautiful live map. I liked the news summary too.

I think the source of each headline in news summary should have an action to show (or not) the sources.

Eg:

⯈ China's death toll rises to 1,113

⯈ Japan reports 39 more cases aboard cruise ship, coming to a total of 174

⯈ Singaporean bank evacuates all personnel after one Employee tested positive

⯈ WHO officially names the disease Covid-19

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>

And if the user click on some of these, the source appear below the topic.

Eg:

⯈ China's death toll rises to 1,113

⯈ Japan reports 39 more cases aboard cruise ship, coming to a total of 174

⯆ Singaporean bank evacuates all personnel after one Employee tested positive

• [https://www.bloomberg.com/news/articles/2020-02-12/dbs- evacu...](https://www.bloomberg.com/news/articles/2020-02-12/dbs-evacuates- some-singapore-staff-after-worker-gets-coronavirus)

• [https://www.reuters.com/article/us-china-health-singapore- db...](https://www.reuters.com/article/us-china-health-singapore- dbs/singapore-bank-dbs-evacuates-300-staff-after-coronavirus-case-surfaces- memo-idUSKBN2060KJ)

⯈ WHO officially names the disease Covid-19

<comment><AUTHOR> That's a really good suggestion, thanks will add the news source in over the weekend :)

</comment></comment><comment><USER3> This is very cool... I have been wondering when a visualization like this would exist. I am sure there are others but this is the first I've seen.

Nice work! Hopefully Coronavirus will be contained soon!

<comment><USER4> I use [https://flu.io](https://flu.io)

It's nice on mobile

<comment><AUTHOR> This is a really nice site!

</comment></comment></comment><comment><USER5> when navigating the history with arrow keyboard keys, you need to do a full keypress (instead of a keydown) each time to advance to the next day. It would be great if you could just automatically fire some events when the arrow is hold down otherwise the natural repeat behavior feels broken.

<comment><AUTHOR> Thanks, this has been done</comment></comment>


Borderlands 2 16bit 'Demake' game - <AUTHOR> http://wubwub.eu/demake.php

<comment><USER2> For those wondering, there was never a 1989 original edition of Borderlands. This is just promotion for Borderlands 2.

Tip: Don't choose the acid weapon given the choice, it's really bad.

<comment><USER3> Sort of. It does fall a little low in the progression

Edit: moved info in other comment.

</comment></comment><comment><USER4> The powerups are rather ... ummm ... random and the method for choosing them is not conducive to making good choices. But other that a fun diversion.

<comment><USER5> I e just like in Borderlands. All drops are randomly generated.

<comment><USER4> I meant more that they're very unbalanced. As one commenter noted you can get a crazily good railgun very early and be invincible. Equally you can pick up a weapon with random aiming and then have a very very hard time progressing at all.

</comment></comment></comment><comment><USER3> Some info about the game.

Weapon data:

      Weapon type, Base Damage, Base Rate, Base Clip, Rarity

      Pistol, 7, 700, 5, 0.5
      Machine Gun, 5, 100, 25, 0.7
      Shotgun, 9, 1000, 5, 1
      Flamegun, 11, 80, 30, 1.1
      Acidgun, 7, 600, 17, 1.2
      Railgun, 25, 1500, 5, 1.3
      Rockets, 22, 1300, 3, 1.4
      Eridian, 15, 600, 12, 2.2

Cheat code:

      On menu screen type 'cl4p-tp' to get to level 20 and some Claptrap graphics.

</comment><comment><USER6> On my second try, I got a double (Forward + backwards) railgun early on. So overpowered it's not even funny. Most enemies don't even make it out of spawn zones, if you take a hit it's a sign you're falling asleep.

</comment><comment><USER7> Some weird bugs where enemies end up on the walls and you can't progress....</comment>


Isaac Newton as a Probabilist - <AUTHOR> http://fermatslibrary.com/s/isaac-newton-as-a-probabilist <comment><USER2> Well, once again my intuition completely fails in a probability problem. My thinking was the more rolls you make the more uniform your distribution of the number showing becomes. In the limiting case as number of rolls -> infinity you are guaranteed to have 1/6 of the rolls be a 6. So the probability of at least 1/6 is less than 1 for a small number of rolls but approaches 1 the more rolls you do. Intuition is like a good friend who likes to mess with me at weird times.

<comment><USER3> You're on the right track with this idea about the flattening of the distribution as N grows.

As in the article, let

      X = # sixes in N rolls

and note that the expected value of X is N __*p = N /6 in this case (fair dice).

The event of interest is:

      {X >= N/6}

We want the probability of this event as a function of N.

It turns out this is a decreasing function of N, and that fact answers the question ("A is most likely"). But why does it decrease in N?

As you say, the distribution of X flattens out as N increases. The probability mass is spread out over the numbers 0...N, with a peak at exactly N/6\. (Not N/6 - 1, or N/6 + 1, but N/6.)

About half the probability mass is between 0...N/6, and half is between N/6...N. So in general, the probability we care about (A, B, or C) is rather close to 1/2 (because it is just the right half of the distribution).

Since the distribution is flattening out, as N increases, mass moves out of the exact center (X = N/6) and toward the left or right. Since the event of interest is

      {X >= N/6}

and not

      {X > N/6},

the fact that the precise center is steadily losing mass (some moving left, some moving right) as N increases is critical.

In short: Because the event of interest contains the very center, as more rolls are done, the overall distribution flattens, and the interval between [N/6...N] benefits less and less by containing the (ever-more-diluted) center point.

This is another way to restate Stigler's explanation at the top-right corner of page 401 in the OP. ("The ranking ... reflects the fact that ... P(X = Np) decreases as N increases and the distribution spreads out.")

</comment></comment><comment><USER4> let me give a ridiculous argument that all 3 events A,B,C are equally likely:

      * event A involves getting one 6 from six dice
      * event B involves getting two 6's from twelve dice
      * event C involves getting three 6's from eightteen dice

      since all three events are in proportion,
      1:6=2:12=3:18
      the events themselves must all be equally likely.

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--

these faulty arguments must have been thrown out all over the place in Newton's time... and I doubt many discussions today are more careful.

I can imagine a room full of politicians arguing over the likelihood of a certain event and three camps emerging as to whether they feel A, B, C is more likely --- throwing away the correct mathematical argument as too complicated.

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--

what is the correct argument anyway? For the third event

      C(18,3)*(1/6)^3(5/6)^(18-3)

I believe as we put larger and larger numbers we do get a limit, so these numbers are tending to zero:

      C(6*k,k)*(1/6)^k(5/6)^(5k) ---> 1/sqrt(2*pi*(5/6)*k) ---> 0

so that event A could be the most likely. This does not sound like Isaac Newton at all.. instead more like Jacob Bernoulli

<comment><USER5> For what it's worth, the article formalises "one 6 from 6 dice" as " _at least_ one 6", and similarly for the other events, which throws off your probability (which works with " _exactly_ one 6") and hence your asymptotics.

</comment></comment><comment><USER6> Here is the Newton-Pepys problem explained by Professor Joe Blitzstein in the Harvard class Stats110: [https://www.youtube.com/watch?v=P7NE4WF8j-Q&feature=youtu.be...](https://www.youtube.com/watch?v=P7NE4WF8j-Q&feature=youtu.be&t=17m47s)

We see that probability is counterintuitive and complete understanding can elude the strongest of minds.

</comment><comment><USER7> Probabilities could be correctly applied only for fully observable and well defined cases like of an unbiased dice or a fair coin. Everything else is a misapplication and should be regarded as a type error.

Frequency based approach is the right tool, but it could explain nothing about the partially observable phenomena, except partial statistics of the outcomes observed so far.

Attempts to derive any causal relationships from statistics of a partially observed phenomena which is not fully understood and well-defined is unscientific and is the source of so many misleading "studies" and overconfident decisions and policies.

The observations that the sun is raising each day on the east does not tell anything about whether or not and why it will raise there tomorrow. Only physics offer a causal explanation.

</comment><comment><USER8> Here's my heuristic. I wonder if it can be made rigorous.

Write P_n for the probability of throwing at least n sixes with 6n dice.

1\. P_0 = 1

2\. P_n -> 1/2 as n -> infinity, by the central limit theorem.

3\. I can't see any reason that P_n shouldn't be monononic.

Thus I expect that P_1 >= P_2 >= P_3.

<comment><USER9> I had originally heuristically reasoned in a similar but opposite way, to the wrong answer. To wit:

1\. P_{1/6} = 1/6 [when rolling one die, you have a 1/6 chance of getting more than 1/6 many sixes]

2\. P_n -> 1/2 as n -> infinity, by the central limit theorem

3\. I couldn't see any reason that P_n shouldn't be strictly monotonic.

Thus I expected that P_1 < P_2 < P_3

<comment><USER10> If you calculated P_1 = 0.665 I suppose you would guess P_2 would be between that and P_infty = 1/2, thus smaller than P_1.

</comment></comment></comment><comment><USER11> There are simple ways to intuit the answer to this problem (simpler than the "heuristic" argument the author gives), but Newton's argument is amazingly bad. Surprising he could have thought that way.</comment>


Where to Find Startup Money - <AUTHOR> http://www.entrepreneur.com/magazine/entrepreneursstartupsmagazine/2009/june/202102.html

<comment><USER2> Are there any grants available to entrepreneurs in the UK? If so, does anybody have any experience with the process?

<comment><USER3> It depends what region you are in. You should first look at the Business Link website for the list of grants available in your region. Also search for regional development agencies in your area.

I have had some experience with them and the problem is that they don't generally fund companies with no IP (i.e. software) and the process can be slow. If you are associated with a university then there are other types of grant you can apply for. Again, business link, your RDA or the university tech transfer department can tell you about them.

</comment></comment><comment><USER4> Wow, grants.gov has $220,000 open for something very similar to what I'm working on.

</comment><comment><USER5> A pity there isn't a list of something like this for Canucks - I've looked.</comment>


France fines Google over 'right to be forgotten' - jim-greer http://www.reuters.com/article/us-google-france-privacy-idUSKCN0WQ1WX <comment><AUTHOR> Duplicate, discussion is here: [https://news.ycombinator.com/item?id=11355270](https://news.ycombinator.com/item?id=11355270)

<comment> jim-greer Whoops, didn't see that one.

</comment></comment><comment> jim-greer To be more precise, they are requiring Google to remove specific results for searches on a person's name.

The problem is that Google gets hundreds of thousands of these requests, and over 50% of them are deemed to be invalid - a doctor removing links to a malpractice suit against him, for instance.

The search engine must make the call on whether the request is valid or not, based on very vague standards. If they don't remove something and is later found to have been wrong, they could be fined up to 4% of their annual revenue or €20M, whichever is greater (that's under pending legislation)

[http://blogs.lse.ac.uk/mediapolicyproject/2015/12/18/the- fin...](http://blogs.lse.ac.uk/mediapolicyproject/2015/12/18/the-final-draft- of-europes-right-to-be-forgotten-law/)

</comment><comment><USER2> France has declared the absolute right to artificially censor google globally?

Dandy. Next China will ask the same thing globally of other results. How can you do anything on the internet if you must follow all laws everywhere at the same time?

<comment><USER3> France has the absolute right to protect its citizens.

<comment><USER4> Bubble wrap is reputed to work well.

</comment></comment></comment><comment><USER5> Is there a right to be forgotten? Because if there is,

a) it should not be limited to the internet: one should be able to request to be forgotten by a certain group or by the humanity altogether. This is not possible.

b) it is not practical: to what extent does it apply (in essence, not in practice)? I grab pdf-prints of articles sometimes. Am I guilty if an author wants their online presence removed? More, there are many search services, many other services that index and archive online content, which of these would have to respond to such requests? And if the _right_ is not limited to the internet, how it is possible to do, practically? Well, it's impossible.

c) it is a _right_ that conflicts with the freedom of thought: It should be at one's own will to forget something or not, this is a state intervention into peoples knowledge and memories.

d) it has implications on posthumous publications of work: after someone is passed away, who decides if they shall be forgotten or not? Or does anybody have the right to?

e) it has implications on the collective knowledge of the man: if, say, Stephen Hawking wanted to be forgotten, we'd have lost some important part of it.

f) it has implications on derived works and citations: If one quotes person A, in, say a blog post, and if that person A wanted to be forgotten, what will the citing author would have to do? Anonymise the quotes? Remove them?

I guess this _right to be forgotten_ is either not a right, and is an example of a freedom that violates others' freedoms. It's unbelievable that serious, smart people (!) got convinced enough about this that this became a law. Publicising something is completely at one's will. Will brings responsibilities, and one should either take the responsibility for what he publishes, or live with the consequences. Because if there is a right, it applies globally, i.e. equally to the non-digital realm, and the _right to be forgotten_ would have really bad consequences.

</comment><comment><USER6> France can get lost. They may get to censor France; they don't get to censor the planet.

And if France does, does China? ISIS? Trump? Me, too?

</comment><comment><USER7> Saying that a law needs to be applied across the entire planet is another demonstration of the viral ridiculousness of the so-called Right To Be Forgotten.

</comment><comment><USER8> This is a free speech issue, plain and simple. Google is being entirely truthful in saying "this is a page that exists", and no one has a moral right to tell them they can't. This whole idea of a "right to be forgotten" is purest excrement of bull, and can only be enforced by violating the rights of free speech and, if you took the phrasing seriously, rights to our own thoughts. But of course they don't take the phrasing seriously, because that would reveal what a runny load of crap it is.

<comment><USER9> Maybe it's the European in me but I think the right to be forgotten is a good idea. Maybe not implemented the best, but the idea is sound.

Say someone published a book of peoples names and photos, complete with a description of the worst thing they have done during their lifetime. Sure, if your a doctor and you had some malpractice problems then it's a good thing that people can see that, but that time you got drunk and did something stupid that ended up in the news? Should that be the first thing that pops up when searching for you? Wouldn't that effect your employment prospects, your future? Is there any actual value to anyone in that being only a search away, other than it matches a particular query for your name?

Google is being truthful in saying "this is a page that exists", but does it have to if the person the page is about has a legitimate reason for wanting it removed? The actual page still exists and can still be accessed so nobodies freedom of speech is being curtailed, this just gives citizens a right to say "maybe I don't want the fact I was wrongly convicted of something to follow me around forever".

If anything this is giving citizens the freedom of speech to say "I want this to be forgotten, it's not me and shouldn't haunt me forever".

<comment><USER10> The implementation really is the problem here. There just isn't a way that this can be implemented fairly. Or maybe there is, but trying to force it before we've found the right way to implement it just isn't working. Obviously it would be great if the Internet really could forget about the stupid things I've done. It would be even better (for me) if I could get everyone to literally forget about those things. Of course there's not an ethical way for me to get other people to literally forget things, and I think what GP is saying (and I agree) is that there's also not an ethical way to get the Internet to forget things.

<comment><USER9> > there's also not an ethical way to get the Internet to forget things.

Sure there is, be lucky enough to have a common name (or one shared with a celebrity) and wait until enough news piles ontop of your bad news that nobody will ever find it.

<comment><USER10> Lol I guess that's true. Or start to use a nickname / middle name. Or even just do enough neutral / good things that get reported online that you bury your own bad stories.</comment></comment></comment></comment></comment>


Ask HN: What's your quit-now number - <AUTHOR>

If you suddenly received $X money (lottery, inheritance, bitcoin), you would quit your job (?).<p>How much is X right now for you?<p>(Inspired by https://news.ycombinator.com/item?id=7827915) <comment><USER2> About 200k USD

Pays off mortgage, credit cards, car loans, etc... That would leave us in a position where the wife makes enough for us to survive with 0 debts (as what we would be paying for would be utilities / food / cost of living...) and I could focus on new app development / freelance.

And yes, I'd do it in a heart beat if it was real cash money.</comment>


Show HN: Codebox – Open source cloud and desktop IDE - <AUTHOR> https://github.com/FriendCode/codebox#0.6.2

<comment><USER2> How do you go about using this as part of a web application? Can you run this on a Rails app client? I went thru the docs, but couldn't find much info.</comment>


Ask HN: Are there any solid stats on Flash crashing Safari? - <AUTHOR>

All I ever hear is anecdotal evidence that it's really bad, but never see any numbers. Do any exist? <comment><USER2> Quote from Mozilla's blog of Metrics on work to correct Firefox crashes:

 _"For example, with a significant percentage of crashes in Flash, a lot of work around stability improvement for Firefox users is currently going into Flash Player 10.1."_

[http://blog.mozilla.com/metrics/2010/04/08/dramatic- stabilit...](http://blog.mozilla.com/metrics/2010/04/08/dramatic-stability- improvements-in-firefox/)

It's also worth noting the comment that explains another large percentage of their crashes came from misbehaving extensions when they rejigged the internal code between 3 and 3.5. Since Safari doesn't have that issue that would increase the Flash crash rate as a percentage of the total for them.

You can also look at Firefox's crash stats and dig through the various bits of data in various ways. Most of it is incomprehensible to me, but if you sort crashes by site then Flash based sites seem to come top.

[http://crash- stats.mozilla.com/topcrasher/bydomain/Firefox/3...](http://crash- stats.mozilla.com/topcrasher/bydomain/Firefox/3.6.4)

Obviously these sites are partly there because they are popular (take that Steve Jobs!), but it still seems over-represented by Flash to my eye.</comment>


Seeking open source programmer for oss project - <AUTHOR>

We(initially three people,but now two) are working on open source project.- basically creating a website- It is to be an interactive environment where people can learn command line skills, bash scripting. That sort of thing.We are looking for a web developer(our previous web-dev ,said he couldn't find spare time to continue with us because of his hectic day job) with good skills/experience on php/Java script/mysql and also a guy with good experience with Linux security issues.Remember its oss project , so this whole project may end up as complete waste of your time with nothing earned (money) other than experience. Anyway, it's an excellent learning opportunity for different skills.If you are interested in joining us ,please let me know. <comment><AUTHOR> Sorry, I have updated my profile now. You can reach me on lakshmipathi DOT g AT gmail DOT com

</comment><comment><USER2> How to contact you? I find no contact info in your profile.</comment>


How a bacterial cell recognizes its own DNA - <AUTHOR> http://www.sciencedaily.com/releases/2015/04/150413130825.htm?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+sciencedaily+%28Latest+Science+News+--+ScienceDaily%29 <comment><USER2> I want to know why the viruses haven't evolved to include Chi sites in their DNA.

My initial thought is perhaps a downwards pressure on the maximum length of the viral DNA, or perhaps Chi sites stop the DNA packaging properly.

</comment><comment><USER3> tl;dr There's a sequence called a Chi sequence found very frequently throughout the bacterial genome, but rarely in the viral one.

Amazing the complexity of nature - I didn't realise bacteria had immune systems.</comment>


Learn Emacs Lisp in 15 minutes - <AUTHOR> http://bzg.fr/learn-emacs-lisp-in-15-minutes.html <comment><USER2> Basic Emacs lisp is _well_ worth learning. It takes Emacs from being _an_ editor to being _your_ editor.

With something like Eclipse, even adding a little bit of functionality is an undertaking. You have to create a project, write a bunch of boilerplate, load it and so on. With Emacs, it's basically effortless: a line or two of elisp can do wonders. Sometimes I add functionality by just executing elisp directly (with M-:), without even bothering to put it in a file! It's that easy.

This has really changed how I work. Now I don't think twice about having some throw-away elisp for just one project. Or even just one file! Modifying the editor (in small ways) becomes an action almost as natural as copy and paste. Now Emacs is like a jazz performance, with room for improvisation: never the same editor twice.

Emacs is also the perfect development environment for Emacs lisp. (Who would have guessed?) It's the most integrated system I've ever seen; there is an intuitive and remarkably consistent link between the lisp code and the editor itself. I usually know how some bit of elisp corresponds to an action and vice-versa. And if I don't, the incredible interactive help system is, well, helpful: I can easily look up what function a keybinding calls or what keys are bound to a function. These days, I do it instinctively, without thinking. Throw in Emacs's general lisp prowess (paredit is incredible), the ability to randomly evaluate an expression and see the results immediately as well as the ease of inspecting variables and you have a very remarkable environment.

15 minutes as the key to all this? There's no question! Since you're going to be using your editor for _years_ , it's well worth 15 hours or 15 days or even 15 weeks. (And since it's Emacs, you'll end up using it for more than just programming: LaTeX, org-mode, blogging, chatting, email...)

Go for it!

<comment><USER3> An excuse to dive into lisp like that just might pull me away from Vim (Vimscript is terrible, sigh).

<comment><USER4> Have a Look at Evil, really good vim bindings for emacs

<comment><USER5> +1. Evil is great. I think it's made Emacs my favourite implementation of Vi yet.

<comment><USER6> Well, the problem is that these bindings don't usually implement the corner case Vim functionality I've come to rely on over the years. Can it record macros perfectly? Does :%s/foo/bar/ work? How about selecting, then :s/foo/bar/gi? Does the period key reproduce all actions properly? How about :%s/foo\\([0-9]+\\)/bar\1/ ? Do all of the basic actions do exactly the same thing as they do in a vim editor? Does % take you to the nearest parens or brackets, then cycle between the opening and closing one? If so, I'm sold. These aren't just random desires -- all of these are necessary for anyone who thinks in Vim.

A few years ago I tried some emacs vim simulator and it had glaring flaws in multiple categories. Vimpulse or Viper or something, I think.

It seems like it's a catch 22 because anyone sufficiently skilled with emacs to design a perfect vim simulator also has no reason to do so, since they're emacs masters.

(I'm on a phone else I'd check out evil now.)

<comment><USER7> It actually works similar enough that I switch between Vim and Evil daily without getting annoyed. I usually use Vim from the terminal. The follow things you asked about are all working:

      Macros
      Repeat
      :'<,'>s/foo/bar/gi
      :%s/foo\(bar\)/bar\1/

It is very actively developed and quite stable. There are of cause Vim features that are not implemented yet, but the core seams to be very well covered.

<comment><USER8> Interesting, maybe I'll give it a try. Do you feel any kind of impedance mismatch from using emacs w/o the native emacs bindings?

<comment><USER9> No, Emacs should be configured to your liking. The default Emacs keybindings (especially the more complex ones for common things) suck.

That said, you're still using Vim keybindings within Emacs and for some operations that Vim has no equivalent for you will need some Emacs knowledge. Also, some thing that Vim does have an equivalent for are easier to do in Emacs.

You cannot step into Emacs + evil-mode thinking you will never need to know anything else. You would be well advised to learn some Emacs basics and then help functionality.

For day-to-day operations like buffer editing you'll be able to use you Vim muscle memory.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> If you don't know Emacs Lisp, there's no point of using Emacs. You'd probably be more productive in Vim or [insert favorite proprietary editor here].

Emacs Lisp is probably the most featureless language you can think of; it doesn't even do basic threading and the async stuff is a joke. All the major programming language modes are implemented as ad-hoc Elisp regexp parsers making bugs impossible to fix. Virtually _everything_ is implemented in Elisp, because the C code is a gigantic unmaintainable mess. This means that all the pretty high-level stuff like Magit is _shit_ slow. Good features take ages to propagate to upstream, whose reasons are often more political than technical.

However, it is the only programmable editor in the world, and people continue to churn out more and more Elisp. Recent developments like MELPA and Marmalade have made packaging and distributing easier than ever, and users just need to `M-x package-install` to get their favorite packages set up.

The reason Emacs has been so successful is very simple: there is one global environment where all symbols are bound; any package can overshadow any existing symbol (variable/function) from anywhere. There are no "core" functions versus "library" functions; any package can modify very "core" behavior (for instance, find-file) very easily [1]. Ofcourse, this has severe downsides: you can eval bad code and screw up your Emacs environment pretty badly (it might even refuse to quit); often the only way to recover is to restart Emacs, flushing the environment.

I'd say: learn as much as you can about editors from this monster; enjoy tinkering with it. Hopefully, a fresh community will come together to build another programmable editor soon.

[1]: The exception is the few C builtins.

<comment><USER11> I always get a chuckle out of people complaining that Emacs is too slow. Maybe I've just "gotten used to it", but when I first started using it I was sharing a Sun 3 with ten or fifteen other people.

I'd also argue that modes in other editors are ad hoc regexp parsers in some other form... regexps, in the hands of someone who knows what they're doing, work well.

And yes, virtually everything is implemented in Emacs Lisp. That's the whole point.

People have been trying to build "another programmable editor" for 30 decades. It hasn't happened yet. Why do you think it will happen soon?

<comment><USER12> 30 Decades!!! wow.

<comment><USER13> Emacs didn't work very well on the Bouchon loom ([http://en.wikipedia.org/wiki/Basile_Bouchon](http://en.wikipedia.org/wiki/Basile_Bouchon)) but dammit, they tried.

</comment></comment></comment></comment><comment><USER14> I would encourage would-be Elisp hackers to read the info manual "An Introduction to Programming in Emacs Lisp" that is bundled with your Emacs (`C-h i` then select "Emacs Lisp Intro" from the Table of Contents) as it enables you to evaluate the example lisp forms in-line in addition to being a really great and pedagogical introduction to elisp.

</comment><comment><USER15> Ha, this is perfectly timed. After years of being a vi/vim user (not for any particular reason, it's just what I learned a few years back and just stuck with), I decided to start running through the Emacs tutorial for the hell of it yesterday.

I really miss Lisp from my college days, and being able to work it back into my regular workflow just sounded like a fun idea.

I read through this tutorial and its really a great introduction, really well written and very clear. Nice job!

<comment><USER16> vi is the god of editors.

emacs is the editor of gods.

<comment><USER17> emacs is the editor of sore wrists.

<comment><USER16> Q: How do you recognize experienced Emacs user?

A: Foot pedals.

[http://bc.tech.coop/blog/041024.html](http://bc.tech.coop/blog/041024.html)

[http://www.cb1.com/~john/computing/emacs/handsfree/pedals.ht...](http://www.cb1.com/~john/computing/emacs/handsfree/pedals.html)

<comment><USER18> After a decade of Emacs, I never had wrist problems, but I did end up developing pinky problems, due to remapping Ctrl to Caps Lock.

I tried foot pedals (and still have them under my desk). They were better than nothing, but after I switched to the Kinesis Advantage keyboard I ended up not using them anymore. Hitting Ctrl+Alt with your thumbs is more convenient than hitting them with your feet, especially since I tend to fidget a lot. Another advantage (no pun intended) is that the arrow keys are convenient to hit, which lets you remap several standard Emacs keybindings. For example, I use C-b to switch buffers.

Neither switching keyboards nor using foot pedals solved my hand pain, however. I ended up having to take more drastic measures: I switched to the carpalx QGMLWB keyboard layout[1]. One of the advantages of the carpalx approach is the clear and powerful mathematical model which quantifies the effectiveness of keyboard layouts. I was able to select a layout that minimizes pinky strain--if I had switched to Dvorak or Colemak, I would have _increased_ my pinky strain.

[1]: [http://mkweb.bcgsc.ca/carpalx/?full_optimization](http://mkweb.bcgsc.ca/carpalx/?full_optimization)

<comment><USER17> >A: Foot pedals.

That's hilarious.

I get that emacs has technical merit but the keybindings are horrendous. Even if they don't cause hand pain they're long-winded and distracting.

<comment><USER11> > [B]ut the keybindings are horrendous. Even if they don't cause hand pain > they're long-winded and distracting.

Ha, after 26 years using Emacs I find Vim's keybindings long-winded and distracting. To each their own. However, unlike many people I don't dismiss vi because of unfamiliarity, or use them as an excuse not to learn the editor. I try to use it all the time, but I can never seem to train myself to do non- trivial things with it.

I have the similar problem with other editors: I've seen people rave about Sublime Text, yet none of its killer features (modulo multiple selections) really strike me as worth switching. And any of its features I think I want I could (conceivably) implement in Emacs, so...

<comment><USER19> With regards to multiple selections, have you seen: [http://emacsrocks.com/e08.html](http://emacsrocks.com/e08.html) [http://emacsrocks.com/e13.html](http://emacsrocks.com/e13.html)

<comment><USER20> That looks great! Earmarked to check out on a rainy day. Thank you for sharing.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> _unless you get so angry that you throw it on the floor_

Hey, just M-x doctor

</comment><comment><USER22> If you don't like lisp-interaction-mode, you can also use ielm (M-x ielm) as an elisp repl

</comment><comment><USER23> That was actually quite helpful. I've had the toughest time "thinking in Lisp" as I'm told I have to do to get my head around it (also because I work with the C++/C#/PHP family and switching between them and Lisp doesn't help).

I really appreciate the simple instructions in that regard.

<comment><USER24> I'm not a professional programmer, but I spend all day in Emacs primarily because of org-mode. Two years ago I read about org-mode here on HN and was inspired to give Emacs a shot. Today Emacs is my main technical hobby. Extending Emacs with Elisp is a pleasure and a joy. My various init files total over 3,000 lines of code that I wrote my own little self.

That said, while I remain incredibly impressed with the integrated documentation system, especially the Info manuals for their sheer literacy and clarity, I discovered over time that it doesn't adequately teach you "the Lisp way." Explanations of the basic concepts -- like a symbol for crying out loud -- are scattered and not really complete, leading to frustration as I got deeper into extending Emacs.

For me, the light bulb went off after I worked through Seibel's Practical Common Lisp. I've also read chunks of PG's On Lisp. Together these two outstanding books resulted in an epiphany regarding Lisp and the functional approach in general.

The result is that, where before I couldn't figure out Emacs's own Elisp sources (i.e., "Why is this function written this way, and not that way? Why do I see this idiom so often, what's it doing?"), now I can. The payoff for writing my own Elisp has been incalculable. Now I'm fired up to read SICP, and Felleisen et al, hoping to learn more about functional programming.

<comment><USER25> Allow me to suggest Coursera. They have nice courses about FP. Somehow in simple -> difficult order.

Systematic Program Design by Gregor Kicsalez (I believe influenced by HtDP). Programming Languages by Dan Grossman. (50 50 HtDP SICP and Brown University material)* Functional Programming using Scala by Martin Odersky (influenced by SICP).

In case you can already do the SICP exercises without issues then you won't need these, but otherwise, the deadlines and automatic grader were great ways to keep a regular pace in learning.

*) this course focuses on semantics, and language design, the problems are not hard applied problem solving, that's why I put it in 2nd, but they can twist your mind quite a bit when dealing with different meta-levels.

<comment><USER24> I've never heard of these. Thanks much.

</comment></comment></comment></comment><comment><USER26> This will definitely be merged into learnxinyminutes.com when I'm back from vacation :-)

<comment><USER27> Ditto -- thank you -- this site is awesome. :)

</comment></comment><comment><USER28> I felt that the "Teach Yourself Programming in Ten Years" was also very helpful.

</comment><comment><USER29> Emacs is a miracle, no doubts. It is self-descriptive and self-contained system, like Smalltalk (you could lookup any function, variable or even key- binding, without a fancy browser, but in a way that is good enough). There is nothing much to say, actually. Emacs is just a wonderful thing.

<comment><USER30> Indeed. The most value I got from from learning to customize Emacs wasn't the functionality I implemented but seeing how powerful a domain specific language can be. The ways that Emacs Lisp supports working with text, whether data or code or documents, showed me what I should be aspiring to when I create a DSL.

<comment><USER29> Imagine, then, what a wonderful thing Open Genera was.)

<comment><USER31> Apparently an older version was opensourced at some point. I don't see why the people who love it don't port it to x86.

</comment></comment></comment></comment><comment><USER32> 1\. Every book on computers, or anything technical should read this guys blog before they get fire up the word processor.

2\. My biggest gripe about 99.9% of COmputer programming books are: They are long. They are poorly written. They read like a telephone books.

3\. I once heard one famous programmer state, I won't read a programming book with more than 500 pages. I think he was off by 400 pages?

4\. I truly believe if you take 80% of words out of most books; it would make learning a subject easier.

<comment><USER33> writers get paid per word, still wondering why 80% of book has no substance?

<comment><USER34> Peter Van der Linden included a recipe for Oobleck¹ on the last few pages of "Expert C Programming: Deep C Secrets". It's right after the Phony C++ Job Interview Answer Key and right before the paragraph-long rant about Dr Seuss's influence on the software engineering profession.

[1] [http://en.wikipedia.org/wiki/Non- newtonian_fluid#Oobleck](http://en.wikipedia.org/wiki/Non- newtonian_fluid#Oobleck)</comment></comment></comment>


Ask HN: The safest way to store data online? - <AUTHOR> Imagine you have to build the safest way to store data online.
As "data" in this example, we take something really simple : a PDF.
And by saying "safest", I mean the highest level of security + usability/ease of use.
1. Which technology/ies would you use to ensure your users they deal with the safest storage solution online ?
2. And if you allow your users to share this PDF with someone, would this choice change ? You have to ensure the same security by sharing the document/data.
(FYI : we already built a solution - I want to compare our solutions) <comment><USER2> When my accountant sends me a PDF he encrypts it, sends it via email, and sends me the password through a different channel.

This is how big accounting firms do it and also the lawyers I know.</comment>