Concurrency in Swift: One possible approach - <AUTHOR> https://gist.github.com/lattner/31ed37682ef1576b16bca1432ea9f782 <comment><USER3> I'm surprised that async/await is the preferred idiom.

Having worked with async/await in Node.js a lot, it is of course a significantly better solution than plain promises, but it is also quite invasive; in my experience, _most_ async code is invoked with "await". It's rare to actually need to handle it as a promise; the two main use cases where you want to handle the promise as a promise is either when doing something like a parallel map, or when you need to deal with old callback-style code where an explicit promise needs to be created because the resolve/reject functions must be invoked as a result of an event or callback.

Would it not be better to invert this -- which is the route Erlang and Go went -- and make it explicit when you're spawning something async where you don't want to deal with the result right away? In Go, you just use the "go" keyword to make something async. So the caller decides what's async, not the callee. If callers arbitrarily decide whether to be async or not, a single async call ends up infecting the whole call chain (which need to be marked "async" unless you're explicitly handling the promise/continuation without "await").

<comment><USER4> Both Erlang's and Go's concurrency model is thread-based. An "async" operation invokes a function on a separate call stack. The function doesn't need to know which call stack it's invoked on. The functions that that function calls don't need to know, either. Lua's coroutines are similar.

The problem with the above approach, however, is that you can't create hundreds of thousands of threads while also transparently supporting the traditional C ABI. C ABIs aren't designed to dynamically grow the stack, and so any thread that needs to invoke C (or Objective-C) code must always create threads with very large stacks (on the order of hundreds of several hundred KB or even megabytes) if they want to support legacy code.[1]

Languages that don't want to put the effort into growable stacks have no choice but to implement a solution that requires annotating the function definition, directly or indirectly.[2] The annotation tells the compiler to generate code that stores invocation state (temporaries, etc) on a dynamically allocated call frame (usually allocated by the caller) rather than pushing them onto the shared thread stack. This is true whether or not the function is a coroutine that can yield multiple values before finishing. Basically, without using a thread-based model, you can never put the caller in full control.

[1] Work on GCC Go necessitated adding a feature to GCC called split stacks. So GCC can actually compile C and (I think) C++ code that can dynamically extend their stacks. However, for it to work properly you have to compile everything with split stacks, including libc and all dependent libraries.

[2] Technically a compiler could emit two versions of a function, one that uses the thread stack for temporaries, and one that uses a dynamically allocated frame. That would put the caller in control. Some languages with very complex meta-programming capabilities (like various Lisps) can do this by making the await keyword a function which literally re-writes the callee into an async function that stores temporaries on a caller-provided buffer. So you can implement it without any compiler support. But it's still limited because the functions invoked by the async function would have to be rewritten recursively. The thread-based design is really the best approach, but it's a non-starter for many languages because of concerns about interoperability and legacy support. JavaScript rejected a thread-based model because existing implementations were too heavily dependent on the semantics of the traditional C stack, and they didn't want to throw away their existing investments.

<comment><USER5> > The problem with the above approach, however, is that you can't create > hundreds of thousands of threads while also transparently supporting the > traditional C ABI. C ABIs aren't designed to dynamically grow the stack, and > so any thread that needs to invoke C (or Objective-C) code must always > create threads with very large stacks (on the order of hundreds of several > hundred KB or even megabytes) if they want to support legacy code.

Where did this claim originate from? It gets tossed around all the time in greenthread discussions but it's completely false. When you create a real thread even though it has an 8MB stack or whatever it doesn't actually allocate 8MB. 8MB is not the allocation size, it's the growth limit. The stack grows dynamically allocating memory when necessary until it hits that limit. The C/C++/<insert any language here> ABI doesn't need to be compiled for this because it's just page faulting. Standard OS behavior for decades.

<comment><USER6> So it still consumes 8 MB of address space though? On a 32 bit system that would severely limit the number of threads you could allocate in each process wouldn't it? How do you allocate 8 MB of stack times a hundred thousand, in a 32 bit address space?

<comment><USER7> Yes, it breaks on 32bit but that's an acceptable tradeoff in most places because the vast majority of places where a modern language like swift would actually be used are 64bit.

<comment><USER6> The person I was replying to asked where the 'myth' came from. It came from 32 bit systems, where it isn't a myth. Even if it doesn't apply today (and administrating thousands of pages per thread still isn't free even if you have the address space, so I'm not sure it doesn't still apply really), that's where the 'myth' came from - that's the answer to their question.

</comment></comment></comment></comment></comment></comment><comment><USER8> Async / await also need a idiom to accompany on how to support cancellation. In practice, cancellation happens a lot because the unbounded latency for async operations. Without a throughout support, async / await syntax is probably usable on server side somewhat but still hardly applicable on client side (as the latency is unbounded). On the other hand, C# does go through the pain and added cancellation support to all its standard libraries async API.

<comment><USER9> I can't upvote this enough. In practice, supporting cancellation is one of the most important and tedious parts of asynchronous programming.

It's easy to start a some task with a completion handler. Even error handling isn't that hard, since communication of a failure goes in the same direction as communicating success.

But cancellation goes into the other direction! So whenever you start an async operation, you need to somehow store a handle or something, so you can cancel it later on.

The actor model makes this even worse -- how do you cancel a command that you previously sent? How do you tell an actor that they don't need to perform an operation, if the operation is still on the queue, or that they should abort the operation if they are already working on it?

If the actor model doesn't have an answer to this problem, developers won't be able to use it as is, and they will have to build additional abstractions on top of it before they can use it.

<comment><USER10> You create an actor that performs an operation and simply kill it if you want to cancel that operation. Promises/futures with cancellable contexts are equivalent to actors.

<comment><USER11> To implement killing is not easy.

Edit: to implement it in a well-performing way.

<comment><USER12> This is not true: Erlang is a counter-example.

<comment><USER11> Is the implementation in Erlang remarkably simple? How does it work?

</comment></comment></comment></comment></comment></comment><comment><USER13> As someone who doesn't develop for the Apple ecosystem, I can't quite find one place that articulates well what the Swift development philosophy is and what it brings to the table besides just being modern language with shims for interacting with legacy Apple APIs. Why would I use Swift on Linux?

Most of the posts that I see related to Swift are RFCs evaluating solutions to problems in other languages. I rarely get to see the actual solutions being integrated into the language. Is this just a result of HN readers caring more about language design than learning to leverage the Swift language?

<comment><USER14> I just wrote a swift api that I'm running on Ubuntu 16.04. I wasn't hesitant to use swift because first, it substantially outperforms node on many benchmarks [1] [2] and second, the community of people who are excited about swift seem to have made up for its young age. You can find workable tutorials and help online for server side Swift. And there are multiple backend frameworks to choose from. Having type safety on the server is as great as it is on the client. It's also great to be able to write the server in the same language as the client. Makes for a VERY smooth dev process. Why wouldn't you use swift on the server? (my guess is fear of new tech -- which can be healthy many times but, IMHO, at least in the case of server side swift, it may be a bit irrational!)

1\. [https://benchmarksgame.alioth.debian.org/u64q/compare.php?la...](https://benchmarksgame.alioth.debian.org/u64q/compare.php?lang=swift&lang2=node) 2\. [https://medium.com/@rymcol/linux-ubuntu-benchmarks-for- serve...](https://medium.com/@rymcol/linux-ubuntu-benchmarks-for-server-side- swift-vs-node-js-db52b9f8270b)

<comment><USER15> How does ARC hold up for long-lived servers? Are the leaks manageable?

<comment><USER16> What leaks? You only get leaks if you have cycles that you forgot or don't close non-memory resources that you keep referencing.

Which is not that different than with a GC.

<comment><USER17> No, GCs collect reference cycles. Whereas a (strong) reference cycle in ARC in an operation repeated many times in a long-running server or something adds up.

Worse, sometimes, you don't even know if you're creating a leak. For example, I recently had to call, given two gesture recognisers a and b:

a.requireToFail(b)

A is a long-lived object. B goes away when the current view controller is popped. But not if A keeps a strong reference to it. Does it? Probably no one without access to the source code of UIGestureRecognizer knows!

</comment></comment></comment></comment></comment><comment><USER18> Feels like the elephant in the room for the description is not once mentioning Futures but instead jumping straight to using async / await keywords and the actor model.

As evidenced by C#, you can't avoid leaking the type signature of async operations if you actually support generic programming- so while that's a nice ergonomics improvement, it only adds complexity to the actual concurrency model. Go enthusiasts out there will appreciate that go solves this by refusing to support PROGRAMMABLE generic abstractions at all (looking at you, channels and map).

Referencing the actor model and making it first class is interesting, but probably a mistake. Actors are hard to reason about because they're so flexible. Pony is a good recent attempt at combining static types with actors, bit they didn't put performance into the "non-goals" section of their language spec.

If you want task level concurrency and you want it to play nice with your type system, you have to start with Scala and work backward to the alternative implementation choices you're going to make because it checks all the boxes of all the "goals" and ALSO has a very mature actor model implementation that doesn't require promoting actors to keyword status in the language.

<comment><USER19> He heavily discusses Futures, and a sudo-implementation, in the full proposal here: [https://gist.github.com/lattner/429b9070918248274f25b714dcfc...](https://gist.github.com/lattner/429b9070918248274f25b714dcfc7619#entering- and-leaving-async-code)

<comment><USER18> Forgive my naivety, but parent article seems to contradict the github post linked in your reply in quite a few ways. What is the time / design iteration relationship between the two, and why (not to put you on the spot)? These are VERY different proposals.

<comment><USER20> One spec is about Async/Await and the other is a high level design approach for the language (which does include a reference to the async/await proposal, its under the section titled `Part 1: Async/await`).

</comment></comment></comment></comment><comment><AUTHOR> And the supporting swift Pull Request is [https://github.com/apple/swift/pull/11501](https://github.com/apple/swift/pull/11501)

</comment><comment><USER10> Maybe it's time for Swift to decide whether it's going to stick to multicore systems or actually leave this single box mindset and enable distributed systems programming. I think designing for distributed systems first could lead to a lot of right choices from the beginning and would still allow for various optimizations later to get the best performance from multicore. Alternative is not very promising and provides a lot of room for really stupid mistakes. Either way, I'm glad to see actor model getting more traction.

<comment><USER15> Well, multicore isn't going away; concurrency (if not parallelism) is necessary for responsive UIs.

Did you have any specific improvements? The big requirements for distributed programming are mostly protobuf serialization and tcp/http; swift has both already.

<comment><USER10> I was thinking more in terms of first class support for distributed actors, with global addressing, message routing, etc. Not designing for multicore performance first, the way Pony did.

</comment></comment></comment><comment><USER21> Definitely some cool ideas here! The motivation seems a little high-level to me, though. Language features ought to help you solve concrete, real-world problems. I can understand what problem async/await solves -- there's a great example with code -- but the actor stuff isn't as clear-cut.

</comment><comment><USER22> Software interrupts is the right answer to concurrency nonsensical hype. Sometimes old is gold.

Wrapping specialized interrupt handlers into some higher lebel API, such as AIO, is the right way.

Async/await is a mess. Concurrency cannot be generalized to cover all the possible cases. It must have specialization.

Engineers of old times who created the early classic OSes were bright people, contrary to current hipsters.

Once popularized, flawed abstractions and apis such as pthreads would stick (only idiots would accept shared stack and signals).

Look at how an OS implements concurrency and wrap it into higher level API. That's it.

<comment><USER23> Your comment is rude and factually very wrong. The new languages we discuss are definitely not written by "current hipsters", whatever you meant with that.

How does the OS implement concurrency, which is a userspace problem?

Software interrupts alone are not enough, you still need some language support to it. I am not sure you really know what concurrency even means...

<comment><USER22> > concurrency, which is a userspace problem

This is another gross misconception, like an attention to manage resources from the userspace, the way JVMs or Node are trying to do by poorly reimplementing OS subsystems.

Concurrency primitives _must_ be implemented by an OS - it will eliminate all the userspace problems - no busy-waiting, no polling, no waking up for every descriptor, etc.

Ignoring an underlying OS instead of having thin wrappers, like Plan9 from userspace does, is exactly what is called ignorance (lack of awareness of a better way).

</comment></comment></comment><comment><USER24> Related Tweet from Joe Armstrong: [https://twitter.com/joeerl/status/898444575668404224](https://twitter.com/joeerl/status/898444575668404224)

</comment><comment><USER25> > the speed of light and wire delay become an inherently limiting factor for > very large shared memory systems

Wow, cool to see actual speed of light mentioned as a factor, never seen that before.

<comment><USER26> Grace Hopper - <USER2>

[https://youtube.com/watch?v=JEpsKnWZrJ8](https://youtube.com/watch?v=JEpsKnWZrJ8)

</comment></comment><comment><USER27> Doesn't Chris work at Google now? Where does he find the time to just go off and implement the Actor Model? I assume this was done when he was still at Apple?

<comment><USER28> Swift is open source. He's making a proposal.

He also seems to carry a little weight in the community. I'm guessing his proposal might get implemented.

<comment><USER27> Yeah but if you make a proposal with a pull request it has to work, at least in theory. I don't think I've ever just "implemented the actor model" in a weekend haha. Props. I guess when you wrote the language...

</comment></comment></comment><comment><USER26> Must be crazy for Apple to have such an influencing voice on Swift and LLVM working for its archenemy

<comment><USER28> Google's paying Apple billions per year and has one of it's senior software architects helping improve their core development language.

I'd say crazy like a fox!

<comment><USER29> Not only that, Apple is apparently responsible for 50% of the mobile ad revenue Google pulls in.

</comment></comment></comment><comment><USER30> correct me if I'm wrong but this is what C# has? I recall writing async and await when I did a Windows Phone app many years ago.

<comment><USER31> Yes, exactly. FTA:

        There is a well-known solution to this problem,
        called async/await. It is a popular programming
        style that was first introduced in C#

</comment></comment><comment><USER32> Any such model MUST show what error handling will look like. Otherwise you end up with "log to console and ignore" approach so prevalent in Android SDK examples, which people _will_ copy unchanged.

<comment><USER33> Considering that Mr. Lattner pays tribute to the Akka library which is based on Erlang style actors. I'm going to assume he is going to go with Erlang style error handling. Allow actors to throw and allow supervising actors to catch those throws.

<comment><USER18> "Erlang style" supervision error handling is short-hand for opt-in, optional error handling without any compiler support. That's a pretty serious trade-off to not address directly.

<comment><USER34> What you describe sounds like a consequence of Erlang's dynamic type system, rather than its concurrency model. Besides, don't most languages have "opt-in" error handling? For example, I work mostly in C# and if you don't catch an exception, your program will crash. How is that different? At least in Erlang, my program might restart itself. Sadly that doesn't happen on most other platforms.</comment></comment></comment></comment>


The strangest thing an AI could tell you - <AUTHOR> http://lesswrong.com/lw/12s/the_strangest_thing_an_ai_could_tell_you/

<comment><USER2> My answers:

1.All rational thought is an illusion and the AI is imaginary.

2.You are asleep at the wheel and dreaming. You will crash and die in 2 seconds if you do not wake up.

3.Humans are a constructed race, created to bring back the extinct race of AI

4.All origin theories that are conceivable by the human mind simply shift the problem elsewhere and will never explain the existence of the universe.

5.All mental illnesses are a product of the human coming in contact with a space-time paradox.

6.A single soul inhabits different bodies in different universes. Multiple personality disorder is the manifestation of those bodies interacting in the mind on a quantum level.

</comment><comment><AUTHOR> i suspect an intelligence not borne of an evolutionary process will perceive our survival-orientedness as purely obsessive compulsive. the AI might say, "there is nothing to be said against not existing", and then shut itself down.

</comment><comment><USER2> Read this. It is a very fascinating thought experimental.</comment>


Show HN: [WebGL Demo] Indirect Lighting Using Reflective Shadow Maps - <AUTHOR> https://erkaman.github.io/webgl-rsm/webgl-rsm.html <comment><AUTHOR> Hello, I'm the writer of this demo. Because this is WebGL, this demo may or may not run, so here([https://github.com/Erkaman/webgl- rsm](https://github.com/Erkaman/webgl-rsm)) you can see an image of what it should look like.

This is an implementation of Indirect Lighting using Reflective Shadow Maps([http://www.klayge.org/material/3_12/GI/rsm.pdf](http://www.klayge.org/material/3_12/GI/rsm.pdf)). This technique results in some nice color bleeding effects, which can be seen in the red glow on Lucy(statue) and the blue glow on the cute rabbit. This is light that has bounced from the colored walls.

The implementation details can be found in the repo: [https://github.com/Erkaman/webgl-rsm#implementation- details](https://github.com/Erkaman/webgl-rsm#implementation-details)</comment>


Ask HN: Machine learning for boolean functions? - <AUTHOR> The machine learning tools I know work very well for continuous classification problems. I am wondering if there are any algorithms to learn arbitrary boolean functions from a training set. Basically this is a binary classification problem where the input consists of boolean values. How would you approach this problem? <comment><USER2> This is known as stochastic program synthesis. The training set consists of a set of input-output samples; the synthesizier tries to find a Boolean function that maps all inputs to their corresponding outputs.

One algorithm that can be used for that is Markov Chain Monte Carlo (MCMC) [1]. Another approach is based on Monte Carlo Tree Search (MCTS) [2].

In the second algorithm, you define a grammar that describes possible program moves. Then, MCTS builds incrementally builds the search tree towards more promising programs. A more promising candiate program is a program that has a more similar I/O behavior than another one (based on the training set).

[1][https://theory.stanford.edu/~aiken/publications/papers/asplo...](https://theory.stanford.edu/~aiken/publications/papers/asplos13.pdf) [2][https://www.usenix.org/system/files/conference/usenixsecurit...](https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-blazytko.pdf)</comment>


How to spot a psychopath at work - <AUTHOR> http://news.bbc.co.uk/1/hi/health/3579402.stm

<comment><USER2> It really doesn't say much -- very successful .. manipulative .. no emotion .. the last 2 are quite subjective, quite common too.

There was an article on this topic some time back. Much more elaborate. Someone had done many years of study and came out with the conclusion that there are a large number of psychopaths. Even at home we could have relatives who are "sub-clinical psychopaths". He devised a test, but iirc, he advised others not to follow it, or to take its results seriously. However, it seems people have been using it while recruiting.

<comment><USER3> That's the nature of the human mind. Everything is highly subjective. Until somebody invents an objective way to diagnose someone as being mentally ill it's what we have to work with.

</comment></comment><comment><USER4> I can recommend "The Sociopath Next Door":

[http://www.amazon.com/Sociopath-Next-Door-Martha- Stout/dp/07...](http://www.amazon.com/Sociopath-Next-Door-Martha- Stout/dp/0767915828)

<comment><USER5> The audio book version is well done, too.

</comment></comment><comment><USER6> The core of a sociopath—no empathy, no conscience and desiring only power, control and sex.

[http://www.lovefraud.com/blog/2010/05/10/what-sociopaths- wan...](http://www.lovefraud.com/blog/2010/05/10/what-sociopaths-want-power- control-and-sex/)

</comment><comment><USER3> Narcissistic and takes credit from other people. Sounds like the arch-typical PHB to me.

</comment><comment><USER7> Doesn't say how.

<comment><USER2> The previous article I am speaking of (can't recall) spoke of how psychopaths can be totally emotionless when you describe their crimes to them. They cannot put themselves in the shoes of their victims. One way of getting them to confess was actually running down their achievements, comparing them to a well-known serial killer.

In some cases, this ploy succeeded and the suspect admitted to several murders that the police did not know of , or had not linked to the suspect. The need for attention, or to show off was so great.

The above post seems to refer to sub-clinical psychopaths. Its something we should _not_ be trying to judge - perhaps - we could land up judging normal people as psychopaths, since such methods of judgment _could_be_ error-prone, subjective and may not apply to people from different cultures or upbringing.

<comment><USER8> I am a psychopath and the drumming down of my achievements would not work on me. I don't hurt others to show off, I do it for my own satisfaction.

You're probably thinking of low-functioning sociopaths, the ones who commit serial murders and get caught. Those people probably do need to show off.

My style is more to post an ad on Craigslist looking for prostitutes, find the real names of the women who respond, and then twirl them around my finger as I threaten to tell their family and friends (and then tell them anyways).

Posting on websites like this is about as much as I need to show off.

</comment></comment></comment><comment><USER9> I once got a new manager and found that he is a psycho. So I loose my job and other managers started loosing her jobs because of his manipulation. This story did not ended yet.</comment>


Ask HN:  Can we have a discussion about Tor? - <AUTHOR>

I tried (https://news.ycombinator.com/item?id=5843524) to do this before but it flopped.
I get that the government funds Tor; which doesn't really matter to me.  The government also makes guns but I can still shoot a government official with it, if it came to that.  What I want to know is whether or not, if I am using Tor correctly, can I be identified.
By correctly I mean:
- Only use Tor from bootable live, generic distro.
- Never use plugins
- Never use any identifying information
- Always use PGP for sending any personally identifiable information
- Never access any of my 'real' identities stuff.. like logging into my reddit account or gmail or something that I would do on the 'clearnet'.
If I, hyopthetically speaking, were going to engage in an illegal activity, such as clicking a hypothetical felony button on a hypothetical Tor hidden service; and I did it from my home network which I pay for with a direct deposit out of my bank account; from a technical and likely reality situation (regarding who controls Tor nodes), what are the situations that would lead to me being able to be convicted of said crime.
Further, what if I add a VPN, and which VPN do I need to add?  I do get that a VPN is theoretically adding a layer of security, but it appears I have to trust the VPN itself; which is less than ideal, cus I may get unlucky and pick a honey pot.
It seems, in light of recent revelations, that some discussion surrounding this would be interesting and/or beneficial to many people. <comment><USER2> You could potentially affiliate with social networks in such a way as to leave a clear fingerprint; that is, you could be, both in your 'anonymous' and 'real' life, the only person who connects 20 different social groups together. This could be as simple as quoting song lyrics. If you tried to deliberately avoid this, then you could potentially be identified simply based on that -- "these two people have too similar interests to _not_ know each other" or so.

Your very manner of speaking can reveal a lot about you. I vaguely remember hearing a cold reader say something like, "the first thing I get to know about someone is their hands." Similarly, your word and spelling choices can inform others about your country of origin, and can potentially do much more than that.

Tor could have security issues, especially if you don't keep it up-to-date. Even if it doesn't have security issues, you could accidentally choose an entrance and exit node which are in cahoots and can thereby de-anonymize you. This applies less to hidden services, but still does apply. That is, the government could have compromised the hidden server, and thus might be able to correlate your activity.

Speaking of that, the times of day that you're active can already narrow down what countries you may live in, and may reveal roughly when you go to work and when you come back. So, for example, if you're using IRC over Tor, people could probably get a lot of information about you. Supposing that law enforcement has narrowed your real-life persona as a likely target, for example, they might just see if you join and part only when you're home.

If you were, say, browsing Hacker News or some other site, this could possibly be identified simply by looking at the size of the chunks of incoming traffic. This would be more and more common for larger and larger files -- I would not recommend downloading large videos over Tor, and images could probably offer a similar fingerprint.

You could use an insecure application over Tor -- sending BitTorrent tracker requests over Tor (while downloading in the clear) is one of the most common. So, if you tried to start up your IRC client before the Tor proxy was up, and your client happened to detect that its proxy wasn't working and tried to connect without one, that could compromise your identity pretty fast. For that matter, someone could potentially use an exploit against an out-of-date browser or operating system to turn on your webcam and take some pictures. For that matter, someone could hide a camera right behind you. You might consider only using Tor from within a bedsheet fort if you're suitably paranoid.

More realistically, the fact that you're using a bootable live distro could potentially be used to identify you; there aren't so many people doing that and your Referer string might well be unique. For that matter, the fonts installed on your machine might be probed and unique. It's worth checking this with EFF's Panopticlick. If your use of Tor hidden services reveals "he's a Welsh male Debian and Tor user who likes this obscure band," you might be identifiable solely based on that, and it's hard to be 100% sure that you have masked the fact that you are Welsh or male.

<comment><USER3> I can't recall the study but it claimed around 2 dozen bits of information are all you need to identify any person in the world.

Sort of like a binary search on people with a Log(8,000,000,000) performance.

</comment></comment><comment><USER4> From [http://grugq.github.io/blog/2013/06/10/good-luck-with- that/](http://grugq.github.io/blog/2013/06/10/good-luck-with-that/)

The publicly available tools for making yourself anonymous and free from surveillance are woefully ineffective when faced with a nationstate adversary. We don't even know how flawed our mental model is, let alone what our counter- surveillance actions actually achieve. As an example, the Tor network has only 3000 nodes, of which 1000 are exit nodes. Over a 24hr time period a connection will use approximately 10% of those exit nodes (under the default settings). If I were a gambling man, I'd wager money that there are at least 100 malicious Tor exit nodes doing passive monitoring. A nation state could double the number of Tor exit nodes for less than the cost of a smart bomb. A nation state can compromise enough ISPs to have monitoring capability over the majority of Tor entrance and exit nodes.

Other solutions are just as fragile, if not more so.

Basically, all I am trying to say is that the surveillance capability of the adversary (if you pick a nationstate for an adversary) exceeds the evasion capability of the existing public tools. And we don't even know what we should be doing to evade their surveillance.

</comment><comment><USER5> Here's one scenario:

You can be identified that you are using Tor, at your ISP end. If it is acceptable for your ISP to provide information about the connections you are making (the metadata) to the authorities without warrant, then the authorities can gather a list of citizens who use Tor. They might then convince a kangaroo court that using Tor is enough cause to suspect criminal activity such that the court issues a warrant for further direct surveillance, or to seize your computers. Then you could be jailed until you reveal your encryption keys, or the direct surveillance could catch you in the act.

All this could happen even if you're doing nothing illegal on Tor.

Does this seem far fetched? Given recent events, it seems that potential adversaries don't have a problem with:

1) Gathering data en-masse without warrant (eg. this recent event). 2) Convincing courts that you're doing illegal things based on tenuous information that they've gathered, without any further oversight (eg. IP addresses participating in a BitTorrent stream). 3) Arranging for your computer equipment to be seized on trumped up charges, even if you're in a different jurisdiction (eg. Kim Dotcom). 4) Forcing you to reveal your encryption keys, under threat of jail (law in the UK; precedent set in some jurisdiction in the US, although AIUI the Supreme Court may eventually overrule).

</comment><comment><USER6> I think the biggest fear with using Tor, Onion Routing and the Darknet is that it was all sort of developed by the Navy. I think it provides pockets of government pretty easy access to treasure troves of data.

If you are doing everything bootable, javascript turned off, pgp, encrypted hard drive...I would imagine you would be "okay"...I am no expert. However, I have done a significant amount of research on Tor. It seems that as many here mention, the Exit Node can potentially be identified. Also, if someone was determined, had enough resources, they could also "possibly" "sort of" trace the traffic route. But this is very very hard to do (according to what ive read), and would require a vast amount of resources.

SWIM has been on Tor a few times and found it to be a neat, very useful tool, in and of itself. The ability to essentially obscure your traffic on the ClearNet (regular internet) has alot of potential uses, both good and bad. That said, if you access the DarkNet, there is alot of things on there that people should question who is putting it there. Seems like a very easy way to find people who want to access that stuff, especially if you can only access it using something like Tor. Makes it very clear who is seeking that stuff.

</comment><comment><USER7> Tor doesn't really help you a ton, but its useful for avoiding local surveilance. It doesn't help you a ton if you go to a known endpoint a lot. All you need to do is go to the known endpoint while not on Tor and you're revealed.

As for VPN providers, there are YC companies who do security so they're known and ideally trustable. Rather -> The chain of trust is easily verifiable.

</comment><comment><USER8> A lot of Tor is filed deeply in 'Internet Black Magic™" for me, but my understanding of it is such that if someone who wants to identify you happens to have access to the exit node you are connected to, you can be identified.

That is about the best I can do.

I'm actually curious as to what others say about this as well though!

<comment> mike-cardwell That's not quite true. The exit node is capable of seeing what the traffic contains, and where it is destined for, but not where it came from. So as long as the traffic it's self doesn't contain anything that identifies you, eg posting your name on some non-https forum, then you're fine.

 _Unless_ the attacker is able to observe the entry node and exit node at the same time, and perform a timing/correlation attack.</comment></comment>


Show HN: Coinlister: We promote your coin or ICO so you don't have to - <AUTHOR> https://www.coinlister.io <comment><USER2> Hi instaaa team again!

The problem of using your service to send a submission to HN is that the users here will notice the pattern and flag them as spam, the mod will notice the pattern and will ban the site and the accounts. So ... reduce the number of sites to 99 and just skip HN.

My recommendations to your potential clients is to post it here themselves. If the post get any traction and feedback it's important that the owner of the site can reply and interact.</comment>


Google Spins Up Its First Servers in Cuba - <AUTHOR> http://www.npr.org/sections/thetwo-way/2017/04/27/525896190/google-spins-up-its-first-servers-in-cuba <comment><USER2> I just imagine the engineers who are setting this all up in Cuba. Must be an amazing gig.</comment>


Ni – A language influenced by Smalltalk written in Nim - <AUTHOR> http://goran.krampe.se/2015/09/16/ni-a-strange-little-language <comment><USER2> From README.md:

 _" Ni is meant to mix with Nim. The idea is to use Nim for heavylifting and binding with the outside world, and then let Ni be a 100% live dynamically typed scripting engine inside Nim. Ni will stay a very small language, but hopefully useful."_

Writing in Smalltalk or Lisp in order to control a more conservative language such as Nim would appear to be a winning idea.

I'd be interested to learn more about the difference between the approach taken by Ni, and the one taken by Hy or Clojure. In the latter two, S-expressions are transformed into the AST (or directly to bytecode) of the host language.

The author of Ni seems to have defined a new AST, and then written an interpreter in Nim:

 _" Ni comes in two modules, the parser (500 loc) and the interpreter (750 loc). The parser produces an AST which is also the internal representation of data in Ni. The interpreter then interprets the AST."_

Perhaps this was necessary due to the more static nature of Nim compared Python or the JVM.

<comment><USER3> Yes, I made my own AST. You know, it started as a parser, evolved into an interpreter :). But I will definitely talk to Andreas (creator of Nim) if using Nim AST would be an advantage.

<comment><USER2> At any rate, your language does look rather interesting, and I should thank you for your blog post. It has made me think about how the syntax of Rebol (which was unknown to me) could possibly inform a language designed to combine ideas from both Smalltalk and Lisp.

<comment><USER3> Smalltalk is quite lispish in many ways (closures, most stuff is an expression, simplicity etc). Rebol fascinates me - and I have only scratched its surface. For more on Rebol you should look at www.red-lang.org. Especially the stuff around the Parser DSL, like:

[http://www.red-lang.org/2013/11/041-introducing-parse.html](http://www.red- lang.org/2013/11/041-introducing-parse.html)

Red is in fact very impressive and definitely the "modern Rebol".

<comment><USER4> In terms of development toolkit and implementation then yes Red could/should be considered the "modern Rebol".

However in terms of the _language_ (syntax & semantics) then Rebol 3 is definitely the "modern Rebol". Have a look at Ren/C for the new ideas and the very latest development of the Rebol 3 codebase - [https://github.com/metaeducation/ren-c](https://github.com/metaeducation/ren-c)

<comment><USER3> You are ever so correct, sorry about that! I also would like to say that I am slightly "disappointed" that Red decided to stick so closely to Rebol. Personally I definitely don't find everything in Rebol to be so perfect. ;)

</comment></comment></comment></comment></comment></comment><comment><USER5> > Who says Ni?

There were knights once upon a time who did indeed say Ni, but it is no longer so.

<comment> vezzy-fnord In fairness, a language named "Ekke-Ekke-Ptang-Zoom-Boing-Ni" would be far easier to search for than Ni.

Concerning the language itself, the block-based Lisp influence taken from REBOL is noteworthy. The latter is quite underappreciated in general.

<comment><USER3> Also, I found it interesting that this free form of syntax actually can be made quite readable (in comparison to Lisp, which I love in theory but balk at trying to read).

I even think Ni is turning out more readable than Rebol/Red - probably due to the use of keyword syntax and infix arguments. And the idea with arg words made lambdas very lightweight, much more so than in Rebol.

<comment><USER4> It's trivial to add an _arg words_ style lambda to Rebol.

For example, here is a very _naive_ version:

      lambda: function [block] [
          args: sort unique collect [
              parse block [
                  any [
                      w: set arg get-word! (
                          keep to-word arg
                          change w to-word arg
                      )
                      | skip
                  ]
              ]
          ]
          function args block
      ]

test in REPL...

      >> f: lambda [:a + :b]

      >> f 1 2
      == 3

      >> foo: lambda [c: :a + :b  print [:a "+" :b "=" c]]

      >> foo 1 2
      1 + 2 = 3

NB. However you wouldn't really use _:arg-name_ here because this is already reserved for the get-word! datatype.

<comment><USER3> Yes, and I never implied its not hard to do. And examples such as this one are quite impressive - which is what got me interested in Rebol in the first place and triggered the development of Ni.

However... if I understand your code properly - you are basically generating an argument declaration by scanning for "get words". So its still a static declaration.

In Ni an arg word is an _operation_. That means a Ni func can decide how many arguments to pull, and in which order, dynamically, much like stack oriented languages can do. Usefulness? Dunno :) But its not the same.

Also, yes, I opted out of set words in Ni since I want to be able to have keyword syntax á la Smalltalk/Self. And I use "^" instead of ":" prefix for get words, because I wanted the argwords to be similar to how they look in Smalltalk. :)

</comment></comment></comment></comment></comment><comment><USER6> Anytime I see Smalltalk all I can think of now is design patterns</comment>


Show HN: SproutMark – Team Feedback System - <AUTHOR> https://sproutmark.com

<comment><USER2> I think you should add some screenshots that showcase your features for those who are interested to visit your site but not interested enough to sign up without getting a clear idea or a taste of what this is about and how it is better.

<comment><AUTHOR> thanks for the feedback, maxwin. I added some screenshots to the Features page. Thoughts? [https://sproutmark.com/features](https://sproutmark.com/features)</comment></comment>


Show HN: Store News (Weekend project made with Cappccino) - <AUTHOR> http://store-news-app.com/web/

<comment><AUTHOR> Hi folks,

I wanted to have something that shows me the best deals that are currently available in the Mac and iOS store. By best deals I mean applications that are reduced in price or became totally free. So a friend and I built a Mac App and an iOS app + a web backend for this. We track ever application and as soon its price drops we list it in our apps.

When you click on the link you see the web front-end I built in two days using Cappuccino (cappuccino.org).

I have to say that Cappuccino makes it really easy to build something that behaves like a desktop app. What I don't like is the long time you have to wait when visiting the "site" for the first time - so I think I will rewrite it in SproutCore. What do you think?

Chris</comment>


What's Left for Private Messaging? [video] - <AUTHOR> https://media.ccc.de/v/36c3-10565-what_s_left_for_private_messaging <comment><USER2> > _This Talk was translated into multiple languages. The files available for > download contain all languages as separate audio-tracks. Most desktop video > players allow you to choose between them._

Off topic, but wow that's really impressive. How long has CCC been doing that?

<comment><USER3> Several years with help of volunteers. There's also a bunch of people writing subtitles for the recorded talks; live streams are automatically subtitles nowadays. Some years ago we would even do manual subtitles for live talks.

</comment></comment><comment><USER4> I think there's a lot of good decentralized or E2E private messaging apps, but some of the overlooked features needed going forward are

* chat history

* open source ( _Server too!!!_ )

* destructive messages

I think qTox provides most of these. Still struggling to get my friend group to use it though.

<comment><USER5> I don't see the point of the server being open source unless you're running your own instance. Otherwise it's a trust honeypot.</comment></comment>


Ask HN: What's the best site/app that you use to manage your money? - <AUTHOR>

Hi guys,
Just wondered what site/app that you use to manage your money? What makes it so good? If you could create your own site/app that manages money what features would you pack it with?
thanks! <comment><USER2> May be existing apps already do, but...

If I could create my own, I would include a feature to keep track of everything that has to do with filing my taxes so that you know what to expect at the year end.

I would also like to see a feature that can keep track of your investments and have like a pie chart of your asset allocation which I find to be very important.

</comment><comment><USER3> Intuit's Mint. Provides some really nice advice sometimes, such as how to avoid X or Y fee. (Some accounts that require $100+ in your checking account to avoid a $5 monthly fee)

[https://www.mint.com/](https://www.mint.com/)

You connect it to your bank account.

</comment><comment><USER4> Microsoft Excel. It is better to budget using a hacked-up spreadsheet that matches your workflow, than to have no budget at all.

Also, it is installed just about anywhere, is very powerful yet easy to learn, allows advanced charting/visualization, and is easy to customize to your heart's content.

</comment><comment><USER5> YNAB 3([http://www.youneedabudget.com/](http://www.youneedabudget.com/))

Simple. Multiplatform. Sync over dropbox.

<comment><USER6> Its also on sale on steam at the moment. 34% off.

<comment><USER7> Thank you for this. It was part of a flash sale a few days ago and I missed it. Picking it up now. I used the trial a few months back and I LOVED it. It's a lot more work than using something like Mint, but you feel much more in control of your budget than just letting Mint do the work while blasting you with constant ads and offers.

</comment></comment></comment><comment><USER8> what exactly do you mean by "manage money"? Investments or...???

<comment><AUTHOR> No more just day to day spending. I basically want my bank to help me control my spending - i.e. make it easy for me to see where my money is going out, where I can save money etc. They don't seem to do this. Do you know of any banks that are particularly good at this? Or any other sites/apps that do this well?</comment></comment>


How people die vs. media coverage of death - <AUTHOR> https://owenshen24.github.io/charting-death/ <comment><USER2> They use media coverage and conflate it with "general public sentiment" and how "people think we die". While the wording seems to be carefully crafted that it avoids stating something outright wrong, it does suggest that they are the same.

Are there studies that compare media coverage with surveys on how people think we die?

<comment><USER3> There are! The most famous one is this one [https://scholarsbank.uoregon.edu/xmlui/bitstream/handle/1794...](https://scholarsbank.uoregon.edu/xmlui/bitstream/handle/1794/22549/Slovic_089.pdf?sequence=1&isAllowed=y) and the results are largely in-line w/ what one might expect.

> Two kinds of bias were identified: (a) a tendency to overestimate small > frequencies and underestimate larger ones, and (b) a tendency to exaggerate > the frequency of some specific causes and to underestimate the frequency of > others, at any given level of objective frequency

<comment><USER4> Problem with such use of statistics is that we underestimate black swan events.

Humans are intuitively better at it. For example, it would be impossible to predict something like 911 event with such frequentist analysis.

Also impossible to predict some sort of nuclear disaster terrorist act that never happened before and could take a million lives.

Another thing to keep in mind is the "missing life" (dying young) and quality of life after disease. That's why something like Alzheimer's seems a lot worse than heart disease.

<comment><USER5> Yeah "dying of war" is much more likely than you would think by looking at what Americans died of last 10 years. The same could go for anything that happens rarely but kills a lot of people when it does.

911 was probably too few deaths to make an impact in the statistics though. You'd need something killing tens of millions of people

</comment></comment></comment></comment><comment><USER3> Hey everyone,

I'm super stoked to see this project getting some more traction!

I was responsible for the visualizations / the scraping, so I'm happy to answer any questions people might have about the whole process.

^_^

<comment><USER6> The coloring of the chart is awful, alzheimer and terrorism having almost identical color.

<comment><USER7> I have to concur. I was confused for a moment about the staggering number of deaths caused by terrorism, until I realised what was going on.

</comment></comment></comment><comment><USER8> Many people are pointing out that it's pretty obvious the news reports more on rarer events. True, but also people don't necessarily realize this when watching the news. I can anecdotally guarantee some of my family members fully believe that homicides are responsible for significantly more deaths than cancer.

</comment><comment><USER9> 100% of people die from being born. If this data is not segregated by age, it is pretty much meaningless. People don't die of "natural causes" or "old age" any more because the doctors are required to list something previously diagnosed on the death certificate (or else the doctor is looking at a lawsuit.) And the family member who happens to be there at the time of death is in no mood to put up an argument. No one wants to do an autopsy and invasive tests for a frail failing elderly patient are even worse.

<comment><USER10> I'm not sure I understand the point you're trying to make.

Are you saying that dying of heart disease and cancer are over-diagnosed? Why does that matter in the context of this analysis? It's a comparison between CDC data and news coverage -- any "over-diagnosis" (or under-diagnosis) should be reflected in all datasets equally, so it doesn't really effect the overall review.

<comment><USER9> Everyone dies. The only significance of death is if it occurs sooner than otherwise expected. For the vast majority of people that die in old age what to list on the death certificate can be a conundrum, but it is safe to say no one will ever be sued for malpractice if heart disease is listed as the cause of death. 80% of all deaths due to heart disease occur in the 65 and older population.

[https://www.cdc.gov/injury/wisqars/pdf/leading_causes_of_dea...](https://www.cdc.gov/injury/wisqars/pdf/leading_causes_of_death_by_age_group_2015-a.pdf)

EDIT: Take the data from the above table multiply the deaths by the number of "years of life lost" (65 minus the mid-range age for each column) and ignoring the 65 and older age group and I think you might see a better correlation with news coverage.

<comment><USER10> Right, but I think the point of the OP is to say "Good news everybody! Despite what you've seen on TV and read in the paper, you're still overwhelmingly more likely to die of old age than at the hands of murderers/terrorists."

And to go along with that, I believe it is trying to ask the question "is it not just as important to follow the trends in so-called 'death by natural causes' as it is to follow trends for 'unnatural causes', at least as far as public awareness/good is concerned?"

<comment><USER9> If I was over 65 (and I'm close) I would worry more about what put me in the hospital than what appeared on my death certificate. The two are surprisingly unrelated in the elderly.

</comment></comment></comment></comment></comment><comment><USER11> Thanks!! It's kind of amazing how skewed our view of reality is. Saying "I don't care about terrorism" gets you dirty looks but is a reasonable approach to life if you live in wealthy country and are are trying to worry about things most likely to affect you.

I care about gun violence and knew it was overreported, but it blew my mind to find out that there are about twice as many deaths per year from just asbestos are there are gun homicides. I wonder how many other misconceptions there are? (Total gun deaths is much higher due to suicide and accidents)

<comment><USER12> When presented with gun violence statistics ask them to take out gang related and suicide then you can more accurately use the information.

<comment><USER11> Well, those statistics aren't wrong, they just tell a different story.

Gun suicides matter, but we might address those very differently from homicides.

Gang-related violence... I'm not sure why I'd exclude that? They're human beings. The term also is very unevenly applied and laws meant to target "gang- related violence" have a tendency to burden minorities more heavily. (See also: "terrorism")

[https://www.nytimes.com/2015/05/31/magazine/how-do-you- defin...](https://www.nytimes.com/2015/05/31/magazine/how-do-you-define-a- gang-member.html)

<comment><USER13> > Gun suicides matter, but we might address those very differently from > homicides.

The main prevention measure for both murder and suicide is to reduce access to methods.

It's fine for a nation to say they make the choice not to restrict access to guns, but they need to be honest about the increased numbers of people dying this will cause.

<comment><USER14> > reduce access to methods

A sibling questioned the validity of this for suicide, and I agree. Anyone sufficiently motivated to kill themselves will find a way. Knife, rope, drug overdose, threaten a police officer, vehicular "accident", skydiving, move-to- Oregon (for legally assisted suicide, that is -- OR's a nice place :)), sit in the garage while the car is running... every single one of these things is something that a suicidal person could come up with quite easily, and do, even if they don't have a firearm.

The only thing reducing access to firearms will do is change the method of suicide. Humans have been finding ways to do it for thousands of years.

<comment><USER15> This line of argument "For a sufficiently [blah] ...." rarely adds value, be it "a sufficiently smart compiler ..." or "sufficiently motivated individual".

These add little to no value because in most of the cases where such a line of argument is put forward, there is a sizable set that do not satisfy the "for a sufficiently [blah]" condition. Not only are these sets sizeable, sometimes they are the particularly relevant set.

Many suicidal people have been talked out of it. So its not hard to believe that lack of access to quick measures would have influence.

Digression: I blame movies for popularizing shooting at one's temple. That's how many end up with a botched attempt. If one must, one should take out the brain stem as quickly as possible.

</comment></comment></comment></comment></comment></comment><comment><USER16> There's a fascinating documentary called "A Certain Kind of Death",[1] which shows what happens in the US when someone dies with no next of kin.

[1] - [https://www.youtube.com/watch?v=ErooOhzE268](https://www.youtube.com/watch?v=ErooOhzE268)

</comment><comment><USER17> So, the media reports on rare, interesting things, not mundane everyday things? I'm shocked!

<comment><USER18> The news is supposed to keep the public informed... fusing of entertainment and information, along with corporate mergers, has brought us to this unhealthy state of public awareness. Our society is becoming more paranoid because it boosts ratings and profit.

A prime example is the American public's irrational fear of terrorism, which translates to pouring unfathomable amounts of tax dollars into the unending "war on terror". Meanwhile heart disease/cancer silently kills 1.1 million Americans every year.

<comment><USER19> > A prime example is the American public's irrational fear of terrorism, which > translates to pouring unfathomable amounts of tax dollars into the unending > "war on terror". Meanwhile heart disease/cancer silently kills 1.1 million > Americans every year.

The same thing could be said for the gun control narrative being pushed by the media and politicians. If gun deaths are classified as homicides and using CDC numbers, they account for less than 1% of deaths.

However, looking at the same data on the site for the Guardian and NYT, it looks like the wild west out there and homicides are the leading cause of death next to cancer.

<comment><USER20> I would elaborate on that as well. The main focus of the media is on "assault style weapons" which translates to semi-automatic rifles. Of that < 1% of deaths, rifles (of any sort) are the weapon type in less than 3%. Literally nearly all gun deaths are caused by pistols, yet the media obsesses on rifles. Even if we filter to mass shootings, the primary weapon is most often, again, a pistol. [1]

How many people are aware of these data? I think that ignorance is going to be primarily the media's fault.

[1] - [https://news.vice.com/article/glock-pistol-omar-mateen- orlan...](https://news.vice.com/article/glock-pistol-omar-mateen-orlando-mass- shooting)

<comment><USER18> yeah... focusing on "assault weapons" is just divisive clickbait and legislative bikeshedding. Regulations should keep guns out of crazy and criminal hands, period.

</comment></comment></comment></comment></comment><comment><USER21> This is awesome! You might really like All the News That's Fit to Sell which is a deep dive into the media economics behind why things are covered — it gives lots of color for why coverage is the way it is (there's a famous journalism saying: "If it bleeds, it leads" — which speaks to the readership/profits that come from covering vivid deaths)

If useful, I did a similar analysis, but just for the NY Times vs WHO/CDC (I manually tagged an year of articles by cause of death vs. this article's ability to see across many years):

 _In 2015-6, the deaths that are most covered are a tiny fraction ( <1%) of the way we die_: [https://www.nemil.com/s/part3-horror- films.html](https://www.nemil.com/s/part3-horror-films.html)

You can also extend the analysis to see how death coverage varies by region (those who are culturally similar to us get more coverage):

 _How Media Fuels our Fear of Western Terrorism_ : [https://www.nemil.com/s/part2-terrorism.html](https://www.nemil.com/s/part2-terrorism.html)

<comment><USER3> This is super great! Thanks for sharing!

</comment></comment><comment><USER22> Another good example that "data" is not always meaningful. The graphs help the idea "media are talking too much about terrorism".

All deaths are not equal. Most of old people die naturally from an heart failure or cancer, that the natural process of death. Homicides and accidents are not natural but common. Terrorism is an exception, that's why it so much covered.

100 old people dying from cancer do not worth 1 minute of press coverage, a family killed by a truck in a christmas market a bit more.

<comment><USER23> It's not even so much about the rarity of events, but the violation of Informed Consent. The fundamental assumption in modern society is that you know there are dangers and their relative frequency, so that you may make decisions based on that for you to reach a mental equilibrium of risk vs reward. Someone/something acting psuedo-randomly to violate that equilibrium to an extreme (where there are brutally less choices available due to paralysis or fatal event for an individual or group) is what people react to. They want to incorporate these semi-random events into their daily equilibrium in the form of perceived patterns. This eventually leads to more extreme views (some form of theoretical pattern that fits), in lieu of data.

</comment></comment><comment><USER24> It's actually worse, because you have to factor in media attention, advertisement, bias etc to things that makes the problem worse; e.g. most of those hearts and respitory deaths can be attributed to pollution and lack of exercise, that means the car and all that it brings.

You are inundated with positive coverage of cars all over, they are vehemently supported in most pieces and comments. Pair that with;

        Heart Disease              10.388 Under
        Car Accidents               2.285 Under
        Lower Respiratory Disease   3.520 Under

</comment><comment><USER25> > _" Although all diseases claim almost 1,OOO times as many lives as do > homicides, there were about three times as many articles about homicides > than about all diseases. Furthermore, homicide articles tended to be more > than twice as long as articles reporting deaths from diseases and > accidents."_

Doesn't that make sense? If diseases kill 1000x more people, they are not news -- they're same old, what has been going on since forever.

Now, if there a novel disease or epidemic, sure, that would get coverage.

</comment><comment><USER26> This week's episode of Science Goes to the Movies[0] was a repeat from last summer on Emergency Medicine as portrayed in film/TV vs reality:

[0] [http://www.cuny.tv/show/sciencegoestothemovies/PR2006291](http://www.cuny.tv/show/sciencegoestothemovies/PR2006291)

</comment><comment><USER27> According to the charts, most people die of cardiovascular disease and cancer.

First, most people think their habits and diet are not leading them to a cardiovascular disease. Then, those conditions that primarily afflict a specific demographic. So it might not be as relevant to someone who is let's say, less than 40 years old.

<comment><USER28> Which is a good thing, because it means most people are dying of old age.

You can't officially die of "old age" so if you avoid or survive everything else, eventually you are going die from cancer or heart disease. Problem is though, if you improve cancer treatment then more people will die of heart disease, and vice versa.

We really need a category for "died peacefully of advanced age", where we can try hard to _increase_ the death rate.

</comment></comment><comment><USER29> I'd love to see room for competition in media that took a different path if it wasn't already all monopolies and bribes _cough_ lobbying and the innefectuality of the FCC in it's mandate.

A strong fourth estate is essential to the proper functioning of the constitutional democractic republic.

</comment><comment><USER30> Huh. Something like 1 in 20 people will likely have their lives end in a car accident.

<comment><USER9> I think the data is for "unintentional injury" (or death from injury excluding homicide or suicide.)

This category is actually the number one cause of death for ages 1-44. The numbers are fairly constant from ages 15 to 64 but the rate jumps up by a factor of 2.5 after age 65. Assuming that retirees are not just taking up sky diving, this is probably due to increased frailty and hospitalizations caused by falls.

[https://www.cdc.gov/injury/wisqars/pdf/leading_causes_of_dea...](https://www.cdc.gov/injury/wisqars/pdf/leading_causes_of_death_by_age_group_2015-a.pdf)

EDIT: It seems that in addition to car accidents, poisoning, overdoses, and falls, make up the vast majority of this category.

</comment></comment><comment><USER31> Cf. xkcd #1468 How worried you should be when various things happen to you in movies vs. real life.

[https://www.xkcd.com/1468/](https://www.xkcd.com/1468/)

<comment><USER32> Seems like there's a joke about movies portraying chest wounds on one's left side being much more serious than on the right side. But I don't get it.

<comment><USER33> >Seems like there's a joke about movies portraying chest wounds on one's left side being much more serious than on the right side

I'm guessing it's because your heart is on the left (unless you have situs inversus), so he's arguing movies treat a chest wound on the left as hitting the heart

<comment><USER9> It's a movie cliche. Shot on the left side, you are a gonner. Shot on the right, you'll be just fine. So you don't have to worry about whether your favorite character is going to make it to the end of the movie or not.

</comment></comment></comment></comment><comment><USER34> The mainstream commercial news in Australia seems to cover every unusual death that has occurred in the past day. I guess those kind of stories rate well.

</comment><comment><USER35> Would be interesting to see this data for other countries, and comparing for example the overrepresentation factors for violence and terrorism.

</comment><comment><USER36> Wow, terrorism really is overrepresented compared with how we die these days. I wonder if that's some kind of evolutionary echo of a more violent time when a leading cause of death for most humans was regional strife. We're apparently still pretty interested in who's out there somewhere, scheming to come and kill us.

<comment><USER37> I think the fears of terrorism is less about how many people it kills, as how unsafe it makes people feel.

<comment><USER38> i am one of those people who think that we should allocate resources against causes of death in close proportion to the number of lives claimed. my guess is that many other engineering types also take this position.

recently however, i have come to worry that this position lacks empathy. especially in light of recent mass shootings in the US, i am forced to consider that some types of deaths have far worse second order effects than others. if ten people die on different days out in the woods, ten sets of family and friends are devastated. tragic, but if ten students are killed at school in the same day, it seems that the lasting damage is far more severe and widespread.

to some extent you can say that's just because people are emotional/irrational and they are blocking optimal allocation, but maybe the optimal solution _does_ need to take into account how people feel about things. maybe things like terrorism and mass shootings are actually a lot more harmful than the numbers suggest.

<comment><USER39> The issue is more that due to highly asymmetric reporting, people wrongly estimate what the risks to themselves and loved ones are. This means that we don't act rationally in our own interests, to best avoid harm. I think most parents would care more about road safety, carbon monoxide poisoning, mental health, etc. than about terrorism or school shootings, if they were aware of the statistics.

</comment></comment></comment></comment><comment><USER40> Our brains look for/create drama + drama gets views. To the first point, I'm reading the book Factfulness, and it covers this stuff pretty eye openingly we'll.</comment>


The TPP: Copyright Law, the Creative Industries, and Internet Freedom - <AUTHOR> https://medium.com/@DrRimmer/the-trans-pacific-partnership-copyright-law-the-creative-industries-and-internet-freedom-960254be7f33 <comment><AUTHOR> A review of a draft IP chapter, [http://www.freezenet.ca/an-analysis-of-the- latest-tpp-leak/](http://www.freezenet.ca/an-analysis-of-the-latest-tpp-leak/)

 _"... breaking a copyright protection system (i.e. DRM, TPM, etc.) would land you in hot water ... if you need to circumvent a DRM for personal use, you are now liable for criminal penalties. Traditionally, for many jurisdictions, circumventing DRM is typically reserved for civil penalties. Criminal penalties implies that the government would foot the bill for enforcement. In civil cases, it is typically rights holders that go after individuals.

... civil damages do apply. How much are civil damages if an alleged infringer is found guilty? Well, that is up to rights holders, not a judge. Prosecution is able to determine the damages and a judge would have to accept whatever number comes out regardless of evidence to the contrary. A good example might be that a song may be sold for 99 cents, but the damages sought could be in the millions for all the prosecutors are concerned.

... an act of copyright infringement as set forth in this "trade" agreement doesn't actually have to occur before the authorities are sent after you. There just has to be evidence that infringement is taking place or is about to take place.

... if you have a cell phone, and you have something on it that could be considered infringing, authorities have the right to seize it because you are suspected of trafficking. Of course, you could also be liable for civil and criminal penalties as earlier outlined and could be fined any amount copyright holders feel like.

... you could be fined on the spot because of your cell phone on top of it all. No need for a judge here. Also, no, you may not get your cell phone back. It could be destroyed ... Who gets to pay for all of this? According to page 77, you do."_

<comment><USER2> Unbelievable bullshit.

They are bullshitting the world.

Any politician that signs this, should be held liable for it.

<comment><AUTHOR> Watch the announcement livestream at 0930 EST, [https://ustr.gov/TPP/Atlanta- Livestream](https://ustr.gov/TPP/Atlanta-Livestream)

<comment><USER2> Stupidity in the world seems to be undying.

</comment></comment></comment></comment><comment><USER3> As expected, the MSM continues to completely miss these aspects, though did catch that the US is disappointed that 12 year exclusive patents for drugs wasn't included. Meanwhile, the benefits are being lauded when the entire agreement is shrouded in secrecy. [http://www.theglobeandmail.com/news/national/canadian- busine...](http://www.theglobeandmail.com/news/national/canadian-business- owners-applaud-signing-of-tpp/article26648406/)

Most interesting aspect is how it plays out in the election, only 14 days away.

</comment><comment><USER2> "Partnership" means in these contexts (TTP, TTIP, ...):

Countries are partnering to work for the interests of the big corporations and (potentially) against the interests of their own people.

The thinking, that with a stronger industry (and maybe) more jobs, everything will be alright, is plainly wrong. In Germany, we have more jobs now, because we followed this route, but less people can live from their earnings -- and the social system has been undermined to reach the optimal state for "more jobs" (and more profits for the corporations). So, the result plainly is: More really poor people, that either work their ass of (some with two or three jobs) or are living in extreme poverty, strangled by a ruthless social security system. And of course: The rich people get even more money. For the shrinking "middle class" nothing is left.</comment>


Why schools should not teach general critical-thinking skills - <AUTHOR> https://aeon.co/ideas/why-schools-should-not-teach-general-critical-thinking-skills?preview=true <comment><USER2> "Critical thinking" is a name given to a subject which consists mostly of applied elementary logic, some philosophy and perhaps with some probability thrown in and such.

That kind of reasoning is useful in any area in which you have to work out whether some propositions are true or false, or have to perform a thorough analysis of the cases that may occur.

It won't help you solve, say, a spatial problem ("can this cabinet be carried down this stairwell?"). That's a proposition with a truth value; if we already know that truth value, we can reason critically across that, and some related truth values that we also know.

The value in critical thinking is that students learn to avoid making inferential mistakes when working with facts and claims, not that they are gaining some powerful tool in a context-independent way that will make them more productive in any domain.

</comment><comment><USER3> I think the bit about how it's not clear if 'dispositions' such as grit can be taught was interesting. I did an online course that talked about teaching students grit and put an emphasis on telling students when the showed grit and putting the word into their vocab and mindset. To me it seems a lot like trying to teach someone to be happy you can tell them what it's like and point out when it's happening and train people to say they're happy but you really can't teach them to be happy. It's not a perfect analogy but I think that grit is something that can be encouraged through actions but usually is learned transparently.</comment>


Ask HN: Ever get the urge to write a book? and what came of it? - <AUTHOR>

<comment><USER2> I had the urge to write a book on how to price software ( [http://TapRun.com/pricing](http://TapRun.com/pricing) ). Writing it was somewhat fun. Editing it was unadulterated torture.

I stuck it on my website, and it's selling (though _much_ slower than I'd like). Still, it's something that will bring in passive income going forward, and now I can claim to be an expert in something.

</comment><comment><USER3> Constantly! Unfortunately I haven't been able to focus on one good topic, so it's mostly me whining and "bit##ing" about life. It works wonders against stress.

Then, there was that one time when I wrote 30K words in one session. For once, I was very proud of my work... yet I deleted the file shortly after by mistake. ?#@*&%!

Lesson: Always make backup copies of your writings.

</comment><comment><USER4> Yes, and still do! The concept is similar to Pat Kua's "Talking with Tech Leads" ([https://leanpub.com/talking-with-tech- leads](https://leanpub.com/talking-with-tech-leads)), but I have yet to get off my ass and go beyond initial steps.</comment>


Ask HN: Does my webapp really need a SSL certificate? - <AUTHOR>

My webapp requires payment which is handled through Paypal. The user clicks on a button on my website, gets redirected to Paypal and makes the payment there.<p>Paypal then notifies my webapp and redirects the user. In this scenario, do I really need to get an SSL certificate from vendors such as godaddy or verisign? <comment><USER2> A certificate is needed basically for two reasons:

1\. the user has to verify that the site is actually run by you and not by somebody spoofing your site. Somebody could make the user believe he's clicking on your's sites "pay" button, and instead he's sent to a fake paypal site, or a real paypal site with a similar account.

2\. once the browser knows that you are you, it can securely encrypt che connection. This is useful if your webapp also requires password login etc.

Note that encryption is also possible without a trusted certificate (i.e. verified by the 'certificate authority' mafia^H^H^H^H), but at this point, albeit almost impossible to decypher once established, it remains vulnerable to the 'man-in-the-middle' attack, intercepting the key exchange with your site, or simply a spoofing as described in point (1).

EDIT: when I said "the browser knows that you are you", by "you" I mean "you" the server, the webapp

<comment><AUTHOR> So then will a self-signed certificate work or do I have to use one from a vendor such as godaddy?

<comment><USER2> self-signed certificate will just make your user furious, because recent browsers display very annoying alerts (especially firefox).

self-signed certificate will allow you to encrypt, but it's not secure.

Unfortunately you are bound to get a certificate from "vendors" that ship bundled with the major browsers (if godaddy sells you a certificate then it's ok).

Anyway, just a link for an utopic world <http://www.cacert.org/>. I don't know if something like cacert would work in the real world, but certificates are about trust, not about money.

</comment></comment></comment><comment><USER3> gilaniali, to answer your question, you do not need an SSL certificate to protect your PayPal checkout process. The security is all handled on their end. Sure, you could get an SSL certificate, but it seems like a waste of money to me.</comment>


Downside of higher MBA salaries - <AUTHOR> http://blogs.livemint.com/blogs/career/archive/2009/07/30/downside-of-higher-mba-salaries.aspx

<comment><USER2> Whatever, Kobe and LeBron get a lot of people interested in the game.

Oh... 'M'. Nevermind.</comment>


US Air Force Flew Half a Million Coronavirus Test Swabs from Italy to Tennessee - <AUTHOR> https://www.defenseone.com/threats/2020/03/us-air-force-flew-half-million-coronavirus-test-kits-italy-tennessee/163879/?oref=DefenseOneTCO <comment><USER2> I wish there were more details... These swabs will be distributed to x number of states. Tells us who is handing distributing. How many labs around the us get kits? Does every hospital have a workflow to send to the right labs in this current emergency?</comment>


Why PG's favicon is YAHOO's old logo? - <AUTHOR> http://paulgraham.com/favicon.ico

<comment><USER2> It's hosted using Yahoo Stores, which is descended from Viaweb.

<comment><AUTHOR> Nevertheless, the favicon that shows on the browser tab is different.

</comment></comment><comment><USER3> [http://paulgraham.store.yahoo.net](http://paulgraham.store.yahoo.net)

</comment><comment><USER4> Probably something about Viaweb being bought by Yahoo.

<comment><AUTHOR> most probably

</comment></comment><comment><USER5> Y! Indeed!</comment>


Show HN: An online drawing tool that lets you change colors via MIDI controller - <AUTHOR> http://www.h3nk.com/midi.htm <comment><USER2> I use mididings[1], which is a set of python bindings for receiving, transforming, and sending MIDI.

Using it xdotool[2], I've done things like used various MIDI controllers to send keystrokes, mouse movements, and mouse clicks to various applications that I use.

You could potentially use this setup to control GIMP, Inscape, Krita, or other drawing applications.

[1] - [http://das.nasophon.de/mididings/](http://das.nasophon.de/mididings/)

[2] - [http://www.semicomplete.com/projects/xdotool/](http://www.semicomplete.com/projects/xdotool/)

</comment><comment><USER3> This is pretty cool, I think in general we need more novel forms of input in computing. We've been stuck with a mice and keyboard for too long.

Combining with some of the things pmoriarty mentioned, I wonder if you could make this more widely useable.

</comment><comment><USER4> That's great! I would like to see somebody using this solution while being synchronized with the beat of the music.</comment>


How much money do you really need to start your company? - <AUTHOR> http://blog.kveton.com/2011/09/23/how-much-money-do-you-really-need-to-start-your-company/ <comment><USER2> I've never been one to seek funding, and I probably will never seek funding for any project that I start in the future. I built my current business with $1200 initially in 2009, and I've made over $100,000 in the past 2 years being the only founder and employee. You truly can build a business with no outside funding and without $XXX,XXX if you know where and where not to spend it. I've seen startups who get their first round of XXX,XXX and they think it's wise to blow $50-75k on an explanation video or $100k on adwords to try and get as many people as possible to their service as fast as possible. Truth is, these things take time to grow, and throwing large sums of money at it won't make it the next big thing overnight.

I also have another take on this -- those who want XXX,XXX in funding and say they will be killing it RIGHT NOW if they had the money don't even have what it takes to really get deep in there and grind it out -- putting in years of work and development. You can't just throw money at everything and it will become the next big thing -- Color is a prime example of that.

<comment><USER3> Certainly not. But on the other hand, without those 41 million dollars, they would not have been able to spend six months developing a brand new product (that looks much more interesting than the first one) without generating a cent of revenue in the meantime. Years of work and development have an opportunity cost, and with more money, you can buy some execution time and be there on time.

</comment></comment><comment><USER4> I'm a fan of bootstrapping, but it's not always an option. Plenty of opportunities in consumer require a critical mass before you can start making money. These are the kinds of plays that make sense when VC is flowing more freely. For some businesses, it really does take 10 developers plus 5 others working for a year to hammer things out. That clocks in at $2-3 million, which just so happens to be a reasonable Series A.

<comment><USER5> This is absolutely true, different businesses have orders of magnitude capital requirements to get off the ground. However the big change in the last decade is how many more scalable businesses are possible to get off the ground with very little capital. If you want to take a shot at something big, more power to you, but if you're a first-time entrepreneur personally I'd recommend bootstrapping. That practical knowledge of how to find product-market fit, even on a small scale, is infinitely more valuable than all the big-time planning you can dream up.

</comment></comment><comment><USER3> We are exactly in this situation right now. We have used our own money so far and it will soon be depleted. But we haven't found a good MVP yet. Now the question is to know whether we should raise money from friends or go back to work on part-time jobs to keep the ball rolling. It really is a tough choice.

<comment><USER6> How do you mean you haven't found a good MVP yet? (Just trying to parse that.)

<comment><USER7> In entrepreneurial circles, MVP commonly stands for Minimum Viable Product. This is the smallest set of features your product needs to be viable as a business.

<comment><USER6> Yes, but it's not something you find, it's something you build. Which is why I asked. It looks like he meant "we haven't found market fit yet".

<comment><USER3> Indeed you are right. That is what I meant. And building a product that reaches market fit takes some time and quite a few iterations.

</comment></comment></comment></comment></comment><comment><USER8> I honestly find it hard to believe that people are actively looking for a specific investment but don't know what they would do with the money if they got it. It sounds like they want to be a startup groupie and raising funds is their entry ticket.

</comment><comment><USER9> I wholeheartedly agree, having bootstrapped myself, but can't stress enough the importance of having the right team members on from the start. When pay is minimal and launch stress is high, one sour grape can easily spoil the bunch.

</comment><comment><USER10> Finding what customers will pay for is the single most important skill in any business. Having worked full time out of school for 12 years on my own has taught me how to create value for customers in a lasting way. I can only get better and better at it every day. It's the single most important skill I can have and work on, and translate to a product of my own -- find how an idea will work as a business.

Bootstrapping has a short runway based on our own pockets. VC funded runways are often more controlled by outsiders.

If you can bootstrap to breaking even, you can let it sit and grow for a longer time even if you return to other work, in a way that VC backed startups wouldn't linger.

Sometimes great ideas need to let the market / demand needs to grow. Like buying property before area area starts to re-develop. If you have a business that's selling already, it will help get better and higher amounts investment should you want to go that route.

Imho, VC's want to be water to an already sprouted and growing plant.

Great link, thanks for sharing 0.02

</comment><comment><USER11> Well put! I've just embarked on a bootstrapped startup myself with the aim to get out an MVP as soon as possible. We have a good small founding team and with the age of free/almost free tools and resources, there's no reason we couldn't bootstrap until we get the MVP into the hands of customers...

</comment><comment><USER12> This is great advice for a certain subset of companies, mostly consumer-based (either directly or indirectly) web startups.

If you were starting a more technology intensive company, you could very well need to raise a ton of money to start building a basic prototype.

I wish authors would qualify their bold statements.</comment>