What fun and low-cost fringe benefits/perks would you offer to employees? - <AUTHOR> http://answers.onstartups.com/questions/1498/what-fun-and-low-cost-fringe-benefits-perks-would-you-offer-to-employees <comment><USER2> Proscribed fun is hard. I can think of about 20 great engineers who would be turned off by a scotch library and free trips to the driving range (is it software for country clubs?) Substitute any of foosball, ping-pong, beer kegs, red-bull, razor scooters and whatnot. You're only going to please half the people, half the time, and probably the wrong people, because who really ever liked razor scooters and nerf guns, anyway?

Career and skill development is a perk that is really overlooked. It's a start to offer unlimited Amazon books. However, companies could go much further and offer seminars and full blown courses. It doesn't even have to be expensive corporate training. You could pay a grad student to teach a full blown machine learning course for less than half the cost of a weekend long training seminar.

<comment><USER3> We would generally be happy to consider sending people to a class. But I don't think we're too different from a lot of companies with HN presences in that we're staffed mostly with people who enjoy figuring things out for themselves. It's hard for me to think of a class that's so clearly valuable to our team that it would make sense sending people to.

One thing we try to do is to run internal classes. We had one on C programming that I need to get back up and running; we have a long-running one with cryptography.

Businesses routinely do the equivalent of paying a grad student to teach machine learning; they just don't call it that. In the real world that's called consulting.

</comment></comment><comment><USER4> 1\. Respect 2\. Autonomy 3\. Control

None of those cost money yet so few workplaces value them since disrespect, micromanagement, and industrial era style division of labor are addictions of the corporate management crowd. It's gospel to Ivy League educated and Old Money.

As a separate issue, "As startups, we can't really offer top-dollar salaries to our employees." is complete nonsense. First of all, "we don't pay top dollar" is doublespeak for "We pay below market rate." Nothing says "We don't respect you." as much as that does. If you can't at the absolute minimum pay market rate for the level of talent you require you shouldn't be in business. End of story.

<comment><USER3> This is not a helpful comment. It only sounds like one. In fact: since nobody on HN would sponsor a "respect-free" or "autonomy-free" or "control-free" work environment, it actually doesn't say anything at all.

This is frustrating because there are probably a million things we could do for (e.g.) Matasano team members without having to restructure the business, and I'd love some more ideas.

<comment><USER5> We are exploring an alternate mode of vacation (one might say, the French model, although not because it is not national) -- in which the company essentially shuts down august till labor day, on top of a couple weeks of ordinary flexible paid time off. We hope that this will enable people to take _real_ vacations (without worries that something really important is happening around the lab), and the lab isn't hamstrung when missing someone important. Plus, a month of free time allows people to take a serious sabbatical and do something really substantial outside of work.

Those we around a month of productivity, we think that people will end up being more than 10% more productive/happy/creativity, and the people we can attract may be 10% better suited to our work. We think it's a perk hardly any other american company can match; great hackers value their time.

More than any of these, philosophically, we want to allow our colleagues to experience the world. We want them to experience freedom.

<comment><USER6> Forced vacation isn't freedom. If August isn't a convenient time to take a vacation, and the employee would rather work, let them work and take that chunk of time off at some other point. If taking that time off another time during the year is unacceptable, then your policy simply isn't fair to all your employees.

Where I work even the national holidays are floating holidays, so if I want to work on Christmas that isn't a day off for me, and I can trade that for a day off for any other day of the year.

Especially for travel, it's way cheaper to do so for off-peak seasons, so forcing August or the last week of December etc. when just makes for more expensive vacations. This is one reason why I think the "French model" kind of sucks.

<comment><USER3> This works for some businesses and not for others. Most successful YC companies, for instance, cannot simply shut down for the entire month of August. In others, teams are so tightly coupled that the business wants vacations as synchronized as possible. It all depends.

The important thing to remember is that there is _almost always_ some degree of freedom withheld by vacation policies. It's not especially productive to reason about vacations as if absolute freedom of scheduling is a sacred principle. Some businesses can come closer to others in providing freedom, and if that freedom is especially valuable to you, you should adjust your compensation expectations accordingly.

But remember the iron law of supply and demand. If a company provides a benefit (say, "months of paid vacation any time of the year on no notice"), and the market values that benefit, candidates will factor that into their compensation negotiation and the salary the company needs to pay for a given level of quality will decrease. In other words: you're paying for the vacation policy one way or the other.

(This is a subtext to the constant jealous comparisons between European and American vacation policies that tends to bug me.)

<comment><USER5> __Most successful YC companies, for instance, cannot simply shut down for the entire month of August. In others, teams are so tightly coupled that the business wants vacations as synchronized as possible. It all depends. __

We're certainly in the latter category, so this is an important distinction. I do think groups in product organizations have this freedom where operational groups don't, though something similar may be possible there.

 __But remember the iron law of supply and demand. If a company provides a benefit (say, "months of paid vacation any time of the year on no notice"), and the market values that benefit, candidates will factor that into their compensation negotiation and the salary the company needs to pay for a given level of quality will decrease. In other words: you're paying for the vacation policy one way or the other. __

I don't really think that talent is best thought of as an efficient market. People are empirically quite limited in their ability to perceive ahead of time the situations in which they will be the happiest or most productive, and salaries seem to be primarily determined by societal norms.

For us, the decision mostly hinges upon whether or not our employees will actually be happier, more creative, and ultimately more productive under the new model. The policy might sway a few candidates that would otherwise look elsewhere, and it might retain several candidates confronted with lucrative alternative offers, but ultimately it's how it will effect the team's spirit that really matters.

<comment><USER3> I'm not sure it takes an efficient market for candidates to be able to do a simple math problem. The company that offers 4 weeks vacation a year pays a $90k salaried employee the equivalent of $51.10/hr; the company that offers 6 weeks vacation pays $53.50/hr, or 5% more.

Comp clearly isn't the only reason people pick jobs, but it's a big reason.

There's a "quality of vacation" point you're making, but generally I think the real issue there is that employees are pushovers, and ask permission to use all their vacation time all at once, instead of just informing their employer that they're going to take July off.

<comment><USER4> Myself I pretty much don't do jack shit in any given hour of the year, so I guess companies that would hire me at those rates are getting ripped off since they aren't getting anything for their money.

On the other hand, over the period of a year, I am amazingly productive and product thousands of times more value than the typical engineer.

Interestingly, the less down time during that year, the fewer incredibly valuable things I make.

<comment><USER4> It's a bit frustrating to see very insightful contributions like my comment here downvoted. Downvotes isn't meant to be for good points. Let me make it more explicit though for people who have difficulty understanding things.

ENGINEERS THAT CREATE THE THINGS YOU SELL DO NOT CONTRIBUTE BY THE HOUR. THEY CONTRIBUTE BY THE QUARTER, THE YEAR AND THE DECADE. HOURLY WAGE CALCULATIONS ARE THE WRONG WAY TO CALCULATE HOW MUCH THEY ARE PAID BECAUSE THEIR FUNDAMENTAL UNIT OF TIME ISN'T THE HOUR. WERNER VON BRAUN DIDN'T DO ANYTHING NOTICEABLE IN ANY GIVEN HOUR OF DESIGN WORK.

What does this mean in practice to the MBA set? It means that measuring engineering work as cost per hour means there is something seriously wrong with your company because you don't understand the fundamental nature of the work.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER3> The scotch library is pretty silly.

1/2 day on Halloween is a great idea.

I am not a fan of company-sponsored lunch; it sends a message that you're expected to be working constantly. Many of the big finance companies do it, and the employees are clear about why.

Books are so cheap relative to FTE cost, I don't know why you'd even come up with a "training policy" for them. We just give everyone an Amazon account and say "go to town". You buy a book, it's yours; the only rule is, don't buy books for your friends on our dime. :)

<comment><USER7> I think you raise a good point about company lunches. It depends on if it's "grab some food on us and go eat at your desk," or "put out tables and sit beside people you don't know" kind of lunch.

</comment></comment><comment><USER8> My company had an official holiday -- Company Founding Day -- adjacent to a national holiday every year, turning a 3 day weekend into a 4 day weekend, and required anyone wanting to work on Company Founding Day to get signed permission from the CEO. (Of a 1,000+ employee megacorp.) When customers/vendors complained about a particular employee's inavailability for their needs, everyone could just say "Sir, I'm sorry, there is nothing I can do. It is Company Founding Day."

That costs rounding error next to an employee. Fog Creek-style catered lunches are rather substantially more expensive, but having done them, I think the social benefits to them are pretty awesome. (Company-sponsored dinner, on the other hand, would scare the heck out of me.)

<comment><USER3> We did a "company offsite" instead of an extra holiday; we spent the morning building Arduino robots†, and the afternoon at Three Floyds. I'm sure there's someone here ready to say "that's not a benefit! just give me the freedom to choose what i do that day myslef"[sic]. Oh well. I'm guessing I'm not too unhappy about missing the opportunity to work with the kind of people who would complain about stuff like that.

† _More accurately, the rest of the team made robots while I went and rented a huge van._

</comment></comment><comment><USER7> Depending on your business and your employees? Equipment.

I recently worked at a TV station and regularly asked my boss if I could do things like borrow a camera on a weekend, or installed a single game for some of us to play after hours when no one was working.

The answer was always "no". That was unfortunate. The camera I kinda get; it could break. But using my computer at work, when no one else is? Seemed relatively harmless.

<comment><USER9> One of the most awful forensic engagements (that didn't involve the threat of bodily harm) I ever worked was for a company who called me in to image the drives for an entire video production department.

Apparently, they discovered that one of their employees, in his spare time, had used one of the editing stations to edit video for his church. When they disciplined him about it, he stated that "everyone else was doing the same thing", which made them panic and decide to treat the whole department as a forensic incident.

I can't think of a more innocuous use of resources than "editing church video in my spare time", but they were all freaked out about it. You'd be surprised what companies worry about.

I had the envious task of imaging ~ 35 workstations (and 2 big-ass RAID arrays) in the middle of the night before employees were supposed to be back in the office the next morning.

<comment><USER7> Ahah, you poor soul.

I guess the thrust of my argument is that... Employees are trusted with those resources while under employer supervision. ("Supervision"; not that their bosses are over their shoulders, or in some cases even know how to operate it themselves.) But the second that the intent is not approved of, suddenly that employee is suspected of having destroyed everything with an errant keystroke. It's funny, is all.

<comment><USER9> I agree.

My boss at my previous employer somehow managed to convince the higher-ups that we needed a lab full of about 20 ridiculously well-spec'd desktops with high-end video cards (and this was well before you could argue for their use in things like CUDA).

This was our Counterstrike lab.

</comment></comment></comment></comment><comment><USER10> Quiet hours, especially in a cube farm.

Free soda, coffee, tea. (I'm a little negative on free snacks, but if that works for you, okay).

Subsidize access to things like the ACM portal, or other subscription journals. Buy technical books for people.

A shooting range in the basement. ("Let's go think about this problem over a few rounds" has a different flavor). While zoning and other laws would make this impractical, some of the groups I've been in have had "range days," and they've all been a lot of fun, even -- or maybe _especially_ \-- for the newbies.

</comment><comment><USER11> The best perk is to manage development in a way that doesn't require overtime from the programmers.

</comment><comment><USER12> Don't forget to review Dan Pink's talk on motivation:

<http://www.ted.com/talks/dan_pink_on_motivation.html>

Having said that my personal favorites are unlimited free books a la Matasano, and flexible work environment (working from office or remotely are interchangeable), and flexible vacation policy (several recent HN posts on this).

Completely distributed teams like SpiderOak are pretty awesome, so set up your company to work like that as the default, and have an office people can work/meet in when they want or need, but connect to the servers the same way whether in or out of the office (a universal API, so to speak).

Let me work when I'm most productive, be it 6am to 3 in the afternoon, or noon to midnight, or whatever. Trust in my incentive to care about the company's success (and by extension my own cashflow). I don't even mind a pager in setups like that, as long as it's used for emergencies only and not abused.

</comment><comment><USER13> Let people choose what tools they use to get the job done. It really sucks to be forced to use inferior tools/software/hardware/etc at work than what you have become accustomed to using in more progressive environments.

</comment><comment><USER14> I would have couches and sleep/napping areas--a lot of them.

I think the best and most essential things to quality of life are: air, water/food/drink, exercise, sleep. I find that there is an unsurprising correlation that when I am healthy and fit, I am also able to perform my best at the computer.

</comment><comment><USER15> Treats. Free donuts, coffee, pizza, beers, etc. That kind of thing is low-cost and highly appreciated.

Plus there's the communal, social factor of all eating/drinking together as a team.

<comment><USER16> Only if you throw some fruits in there.

As a health-conscious (non-preachy) vegan, I feel left-out otherwise.

</comment></comment><comment><USER17> Range time; tactical training. Also disaster prep for you and your dependents. (ie come to the office after the bay area earthquake....)

</comment><comment><USER18> 1\. be neutral about where work gets done

2\. be neutral about when work gets done

3\. be neutral about how work gets done

<comment><USER19> Recognizing everyone has their own patterns and giving them the autonomy to maximize work given their own patterns is certainly important. Of course step 0 of this prescription is hiring someone who is trustworthy and self-aware.

<comment><USER20> I completely agree, and that is why we will have a completely web based system so that I can hire contractors all over the U.S. and let my normally onsite employees work from home a day or two a week. Instead of me saying, "Work at home tomorrow", they will choose the day and I will OK it. Obtaining input from employees makes them feel valued and important. Besides, I trust that they will know when it's OK to work at home.

I also plan to ASK each person what a good reward would be (everybody is different), and make sure to thank them. I understand that it's their job, but it goes a long way to boosting everyone's morale and productivity by saying you appreciate them.

A friend's boss wanted to buy her a small token of appreciation for successfully completing a huge project, and my friend jokingly said she wanted a Hummer. The boss bought her one - a diecast collectible H2, and 6 years later my friend still says that was the best gift she's ever gotten :)</comment></comment></comment>


Ask HN: Idea for a startup, as a one-man team what should I do next? - <AUTHOR> I have an idea that I would like to try to turn into a startup product, but I have no idea what I should do next.
Do you guys/gals have any steps to launching or tips/books to read/etc. on what to do after coming up with an idea for a product?
Thank you for your time! <comment><USER2> It's a vague question. An equally vague answer would be to read books like "Lean Startup". Lean may not be your answer but it will open you up to other things. Validate your idea and business model and if you are satisfied by what you found (i.e. backers ready to spend money upfront), go and build it</comment>


Hackers Stole Source Code of Google's Global Password System - <AUTHOR> http://www.wired.com/threatlevel/2010/04/google-hackers

<comment><USER2> I dont see what the source can get you. In fact, given that Google reuses a lot of open source, the source code is probably out in public already.

I think for Google, their _data_ would be far more valuable. For their password systems, I guess it is safely secured with a salt+hash somewhere so someone would have needed to hijack an admin's account.

<comment><USER3> And where do you suppose the salt is stored? (EDIT: Not to suggest Google would be so naive as to use a single static salt value with N hashing iterations. I really hope there's something smarter at play than that. The question is, does the source code contain all the information needed to perform dictionary attacks, or is some element of it externalized? And does anyone even know if user 'passwords' (in whatever hashed form they exist) were compromised?)

<comment> brown9-2 I think sriramk's point is that having the source for this system isn't that much of a benefit if you don't have access to the data itself or the systems involved.

<comment><USER4> Well, if I were planning to hack into a system to steal its data, I would definitely prefer to have the source beforehand.

</comment></comment></comment></comment><comment><USER5> I cannot believe this. Google is a very bright company in security, I don't beleive a flaw on SCM's security fence.

<comment><USER6> They use the same broken software we all do. ssh, written in C. Perforce, written in C. Find a single memory management error in one of those programs, and Google's source code is yours.

<comment><USER7> So you feel that ssh should be written in Perl?

<comment><USER8> That's a disingenuous way to say c is a fine language for ssh.</comment></comment></comment></comment>


Telsa overtakes GM to become largest US auto manufacturer by market cap - <AUTHOR> https://www.wsj.com/articles/tesla-overtakes-gm-to-become-most-valuable-u-s-auto-maker-1491832043 <comment><USER2> [http://n-gate.com/hackernews/](http://n-gate.com/hackernews/) nailed this bit last week:

> A financial website documents Tesla's overvaluation, while explicitly noting > that Tesla cannot compete with real automakers in any sense. The company's > valuation is recognized to be so high purely because Elon Musk is our lord > and savior.

</comment><comment><AUTHOR> GM's market share is 17.5% while Tesla's is just 0.2%. There's a lot of hope priced into that stock.</comment>


Solving the problem of open source contributions - contrihub.com - <AUTHOR>

Projects are born and die every day. Most often than not they die from lack of motivation to further their goals or simply lack of time. That's a pity because most of these projects are useful and solve meaningful problems. What if we could pass a dying project back to the community? What if there was an easy way to find new people to help you with a new project or carry on an old one?
Our goal is to provide a dedicated service for contributors and owners of open source projects that tremendously seek for contributions. Project owners will be able to request for help, while developers will have a lean and clean way to get involved and interact with the community. Contrihub is a website created as part of the RailsRumble 2012 hackathon so, as a prototype, it is rough around the edges and bumpy in between. We apply heuristics to open source projects in order to determine, whether or not a project needs contributions by determining a score based on factors like open and closed pull requests, issues, collaborators, watchers, forks, downloads. A project owner can verify the project ownership with a simple request and plead for help. Verified projects where the owners actively ask for help are boosted even further. Organisations, companies, FOSS foundations or individuals can use this service to invigorate projects.
By the time the competition ends, we are willing to further extend in functionality. Eventually we plan to as many contributors with a project where the contributions will have a revitalizing commitment. The matching will be based both on expression of interest as well as help spot interesting projects that are in dire need of help, thus achieving maximum impact.
What are your criteria for contributing? What do you think would be the best way to identify projects that need help? Feel free to share your thoughts. We need your feedback on the idea.
TL;DR
We have created a website that aggregates open source projects that need help by contributors. <comment><USER2> It would be nice if I can search for projects using specific programming languages. Also why can't I just upload the project I need people to contribute without using github?

<comment><USER3> Thank you for the feedback! We are going to support the "search by programming language" feature, soon. We also plan to provide a more generic way on how to add an open source project. The current state is a quick and dirty prototype due to the limitations of the participation in the rails rumble competition (a 48 hours hackathon).

</comment></comment><comment><USER4> I dont see how a project will get more contributers when the site isn't adding something or removing something. What is it really? Seems like viewer of Github repositories.

Also, "github url" on projects page should possible be a link, not plain text.

<comment><AUTHOR> This is not a "viewer of Github repositories". We apply algorithms on source code we collect every day and calculate a score that determines whether an open source project needs contributors or not. So, what we add is scoring and what we remove is 'noise' of powerful open source projects. Contrihub is a web service built in 48 hours and currently there are several inconsistencies, far more serious than hyperlinks. By the end of the competition we will work on improving and extending in functionality. Anyway, we thank you for the disapproval, we are glad receiving your feedback.

</comment></comment><comment><USER5> Nice!</comment>


Free TekPub (training videos for Ruby, Android, iOS) this Friday - <AUTHOR> http://blog.tekpub.com/post/1014366821/tekpub-free-friday

<comment><USER2> If they can keep the site up with the extra traffic, it will be a great day to sit back and learn something new.</comment>


From SocialCalc to EtherCalc - <AUTHOR> https://gist.github.com/3978463 This is a draft for the upcoming book; forks/comments/feedback welcome! <comment><USER2> This project exemplifies better than all others the advantage of being able to run the same language on the front and the backend. And it is awesome as well! Kudos.

</comment><comment><AUTHOR> This is a draft for an upcoming book, and comments/feedback would be much appreciated!

BTW, for environments where WebWorker-Threads is not an option (e.g. Node.js 0.6), [https://github.com/audreyt/ethercalc/commit/0f41d20324833885...](https://github.com/audreyt/ethercalc/commit/0f41d2032483388533ce9b62faa7902944efbb05#L5R8) provides a backward-compatible fallback.</comment>


The Synthesis Kernel (1988) [pdf] - <AUTHOR> https://www.usenix.org/legacy/publications/compsystems/1988/win_pu.pdf <comment><USER2> This paper was somewhat famous in the Berkeley system department when I was there; the lore was that it was the perfect academic system that proved a point but crashed ... frequently.

<comment><USER3> This could apply as a partial general explanation: [https://news.ycombinator.com/item?id=15048914](https://news.ycombinator.com/item?id=15048914)

</comment></comment><comment><USER4> Also: [http://valerieaurora.org/synthesis/SynthesisOS/index.html](http://valerieaurora.org/synthesis/SynthesisOS/index.html)

</comment><comment><USER5> It says "Winter 1988"; the Morris Worm broke out in November that year. Security wouldn't really have been on people's minds so much yet. Which is perhaps why that word doesn't occur even once in this paper!

Clumsy system calls which start from first principles and traverse some data structures to get to the state they want can be verified for security issues. At every step they can validate each datum. For instance, a given integer file descriptor can not only become invalid between two successive read calls; it can point to a completely different object. We cannot cache/curry the resolution of that descriptor number to a descriptor object; we have to validate it from scratch on each call.

If you take any shortcuts via synthesized code or other tricks, you have to be able to convince yourself that security holes aren't created by skipping the sanity checks performed by the original system calls.

<comment><USER6> If you can describe your synthesis operations in terms of some program transformation, you may be able to verify/prove that they preserve certain semantic properties (similar to compiler verification). We have both verified compilers and verified kernels already so this is not a long stretch but it would still be a research project of its own IMO. Also, there has been some research on breaking invariants temporarily between computational steps while preserving them overall [0] (unfortunately, behind a paywall and I couldn't find a non-paywall version).

My point is that although this paper doesn't discuss the security aspect, this work can be implemented in a secure manner.

[0] [http://dl.acm.org/citation.cfm?id=2661142](http://dl.acm.org/citation.cfm?id=2661142)

<comment><USER7> You can just get it off Libgen as usual: [http://dl.acm.org.sci- hub.io/citation.cfm?id=2661142](http://dl.acm.org.sci- hub.io/citation.cfm?id=2661142)

<comment><USER5> Man that strikes close to home! Breaking invariants when nobody observes it.

I did something in this spirit in my Lisp dialect.

I broke the invariant which says "no matter how you terminate a form, the unwind-protect cleanup forms get called".

I broke it by introducing the concept of "absconding": leaving a scope in such a way that the local resources tied to lexical/dynamic contours are left alone. No unwinding calls are done.

The justification is precisely that it is OK if the scope is later re-entered (specifically: restarted via revived continuation). The revived control then finds everything intact --- and can leave the scopes _normally_ at which point the cleanup _does_ take place.

By doing this, I solved the problem of how to integrate continuations with scoped resource acquisition/cleanup, without the horror of _dynamic-wind_ or its ilk.

</comment></comment></comment></comment><comment><USER8> apparently Massalin is still at MicroUnity after 20 years. does anyone know if they do any business outside of patent licensing?

</comment><comment><USER3> Mods: This needs a (1988)

</comment><comment><USER9> ow! my eyes burn from the 80's texture background...

Synthesis was one of my favorite papers - sort of more Unixy, traditional-ish than Self (another fav from that decade...)</comment>


How Screwed is Intel without Hyper-Threading? - <AUTHOR> https://www.techspot.com/article/1850-how-screwed-is-intel-no-hyper-threading/ <comment> old-gregg The very first graph (Cinebench R15) is wrong. i7-8700K does not score 3314 or even 2515 on this benchmark [1]. i7-7700K numbers are also way off. Not sure what happened here, but I can't take any other measurement they published seriously. This is more useful: [https://www.phoronix.com/scan.php?page=article&item=sandy- fx...](https://www.phoronix.com/scan.php?page=article&item=sandy-fx- zombieload&num=3)

If you're using an overclockable workstation CPU, the good news is that turning SMT off gives you additional ~200Hz of overclocking headroom. Modern Intel chips are thermally limited when overclocking and turning SMT off makes them run a bit cooler. My i9-7900X overheats over 4.4Ghz, but with SMT off it's comfortable at 4.7Ghz on air (Noctua D15).

[1] [https://www.guru3d.com/news-story/intel- core-i7-8700k-benchm...](https://www.guru3d.com/news-story/intel- core-i7-8700k-benchmarks.html)

<comment><USER2> > the good news is that turning SMT off gives you additional ~200Hz of > overclocking headroom

That'd be 200 MHz, not 200 Hz?

<comment><USER3> Not on my MOS 6502!

<comment><USER4> The concept of a hyperthreaded 6502 is intriguing, and I wish to subscribe to your newsletter...

</comment></comment></comment></comment><comment><USER5> Another micro-architecture attack. Since the advent of Spectre and Meltdown, I really wonder what is the practicality of exploiting these vulnerabilities. As an end-user, if I have malware running on my machine trying to trigger these exploits, then in many ways I have already lost. The malware program has access to all my personal data anyway.

Personally I wonder whether the cost of mitigation is worth it. According to the article (and their simplified HT methodology) certain workloads experience a 25% performance hit.

The only cases I currently consider as exploitable are VMs in the cloud (perhaps a reason to own dedicated servers after all this time) and running JS in the browser (perhaps a reason to disable JS).

There will always be side-channel attacks. Our devices are physical devices and will leak side-effects, like electromagnetic radiation ( [https://en.wikipedia.org/wiki/Tempest_(codename)](https://en.wikipedia.org/wiki/Tempest_\(codename\)) ). This recent spate of MDS flaws don't necessarily fit in my threat model.

<comment><USER6> Hopefully you'll agree that there is a world of difference between an electromagnetic side-channel and something that can be achieved by simply running some JS.

In particular, disabling JS would be pretty disabling for an average modern web user, so an easy, practical attack through this vector is especially relevant.

<comment><USER7> Yet every time I ask my web developer friends to ensure that functionality works online without JavaScript for basic things I am met with hostility.

If we were able to run without JavaScript and have basic use of websites again then these attack vectors wouldn't be so scary.

Maybe it's a personal failing of mine; but I don't understand why people don't consider JavaScript untrusted code when other vectors of running software on my machine come from a gpg-signed chain of custody.

<comment><USER8> Well, you would have to architect an app from the ground up to be functional with/without javascript and test any new functionality with it off. You're talking 2x the work to appease maybe .0005% of the web browsing public. I wouldn't be hostile if you asked me to do that... but I wouldn't entertain the idea seriously either.

<comment><USER9> If you build using server side rendered HTML then progressive enhancement with JavaScript is not actually that difficult. It takes a different mindset that most webdevs don't have. Getting the UX nice for the fallback is hard.

<comment><USER10> Yes _if_, but many websites have moved on to client side rendering because if done right it delivers a better user experience for the 99% of users that have JS turned on, because there is no latency between page transitions.

Sure, passive content such as nytimes.com can work without JS (although some of their interactive articles would not), but anything more complicated will often be done with client side rendering these days.

<comment><USER11> > no latency between page transitions

Not true, latency scales with CPU capacity on the client. SPAs now exist with client side rendering to mask the bloat in the site plus its dependencies.

If you have a SPA arch but you did a page load per click, you would die. But all sites creep up to 500ms page load times regardless of their starting stack and timings.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Intel's doc [1] if SMT is not disabled, not only does the OS need to perform group scheduling (only allow threads that trust each other to run on the same core at the same time) but the OS also has to interrupt the sibling thread running on the same core whenever user mode code enters kernel mode, synchronizing syscalls. For compute-heavy applications, this might be ok, but for servers doing a lot of syscalls this might be terrible.

1 - See "Synchronized ring 0 entry and exit using IPIs" in [https://software.intel.com/security-software- guidance/insigh...](https://software.intel.com/security-software- guidance/insights/deep-dive-intel-analysis-microarchitectural-data-sampling)

<comment><USER13> I haven't seen a Linux implementation of this yet, but I suspect the performance is beyond terrible. Intel's doc says:

> There is no hardware support for atomic transition of both threads between > kernel and user states, so the OS should use standard software techniques to > synchronize the threads.

Ha, "standard software techniques". Let's see: suppose one thread finishes a syscall. Now it sets some flag telling the other core to wake up and go back to user code as well. But the other core is running with interrupts on. So now we sit there spinning until the other core is done, and then both cores turn off interrupts and _recheck that they both still want to go to user mode_. This involves some fun lock-free programming. I suppose one could call this a "standard software technique" with a somewhat straight face.

Meanwhile, the IPI on entry involves an IPI and the associated (huge!) overhead of an x86 interrupt. x86 interrupts are incredibly slow. The IPI request itself is done via the APIC, and legacy APIC access is also incredibly slow. There's a fancy thing called X2APIC that makes it reasonably fast, but for whatever reason, most BIOSes don't seem to enable it.

I suspect that relatively few workloads will benefit from all of this. Just turning off SMT sounds like a better idea.

<comment><USER14> Much like many late model intel cpu features x2apic was buggy at launch and so people disabled it by default.

</comment></comment></comment><comment><USER15> The article says that disabling hyper-threading is a worst case scenario, but I don't think it is.

Intel themselves said [1] "Intel is not recommending that Intel® HT be disabled, and it's important to understand that doing so does not alone provide protection against MDS."

[1] [https://www.intel.com/content/www/us/en/architecture-and- tec...](https://www.intel.com/content/www/us/en/architecture-and- technology/mds.html)

<comment><USER16> Indeed. In order to protect against MDS on Intel chips, you need to disable hyperthreading _and_ apply microcode and OS updates which have their own additional performance penalties on top of that.

<comment><USER17> If my understanding of the announced updates [1] is correct, the need to update exists for non-HT CPU, too (see C3000 series and such).

[1] [https://www.intel.com/content/dam/www/public/us/en/documents...](https://www.intel.com/content/dam/www/public/us/en/documents/corporate- information/SA00233-microcode-update-guidance_05132019.pdf)

</comment></comment></comment><comment><USER18> Honestly the cure is worse than the disease with these "vulnerabilities." How do I opt out of the 10-25% performance hit for an extremely speculative vulnerability?

<comment><USER19> On Linux you can just ignore the intel-ucode package (or whatever it's called) and not update your CPU microcode. BUT, I think they also have mitigations in the kernel, so you would have to not update your kernel, or somehow remove the patches.

<comment><USER20> [https://make-linux-fast-again.com/](https://make-linux-fast-again.com/)

</comment></comment></comment><comment><USER21> I can't find any recent news about class action suits against Intel. It seems everything is from early 2018.

Is this situation so unexpected that major companies don't even know how to react? If I were Amazon or Google, I'd be requesting my 30% discount, retroactively. Perhaps they are?

<comment><USER22> Probably a condition for getting that discount is to promise to not make it public.

</comment></comment><comment><USER23> On a sidenote, does anybody else find it interesting that all the benchmarked games running on Vulkan have only minimal performance hits?

IIRC Vulkan was designed to be more suited to modern multi-core processors, and I believe that the "HT-agnosticism" it exhibits is good proof that they managed that pretty well...

<comment><USER24> I think it's more likely that the particular Vulkan games they tested are GPU- bound, so a slower CPU won't have much of an effect on their framerate. I mean Doom even runs at 60 fps on current-gen consoles' low-powered CPUs.

<comment><USER23> Maybe they are GPU-bound precisely because the CPU-intensive parts are so well done with Vulkan?

<comment><USER24> I don't think so. DX12 has the same performance characteristics as Vulkan, yet the DX12 games tested show performance degradation when HT is disabled but Vulkan games do not. As I said, I think it's because the particular Vulkan games tested happen to be more GPU-bound than the DX12 ones.

</comment></comment></comment></comment><comment><USER25> Does this mean that the vulnerability doesn't affect CPUs that don't have Hyperthreading (e.g. the 9700K - 8 cores/8 threads)?

</comment><comment><USER26> How realistic are these attacks for every day desktop users?

</comment><comment><USER27> If we want securely-isolated low-horsepower machines, why don't we just fill server-racks with large numbers of low-horsepower physical computers, rather than small numbers of big-iron computers using software isolation in the form of VMs?

Wouldn't that win half the battle, at least on server-side? It wouldn't apply to workstations, of course. Malicious/untrusted processes running there would still need to be isolated (malicious JavaScript in the browser, say).

Also, am I missing something, or are these concerns really not applicable to gaming applications (which the article emphasises)? That's a highly trusted codebase, so securely containing it isn't worth a 15% performance hit, no?

<comment><USER28> The cloud is only able to be cost effective because they are able to utilize those fleets of big-iron computers to provide nearly infinite VMs and resources to anyone who signs up for their services. Relegating each customer to their own physical computer would raise costs so high as to essentially eliminate the purpose of the cloud's existence, and most businesses would be better off going back to their own data centers at that point.

<comment><USER29> > Relegating each customer to their own physical computer would raise costs so > high as to essentially eliminate the purpose of the cloud's existence

plenty of places rent bare metal machines, and the price doesn't seem quite that world-ending. see packet.net for instance.

and it only gets better if on the bare metal machine you get to turn off all of the performance-draining fixes.

<comment><USER30> It's actually much cheaper than cloud. It doesn't have the scaling flexibility, but that is partially compensated for by running faster, lower latency, etc. Lots of people use Cloudfront etc but still host on their own bare metal.

<comment><USER27> Isn't it still 'cloud'? It's still _on a server somewhere that I don 't think about_, which is really all 'cloud' tends to mean.

I don't care whether Amazon use virtualisation to get me my 'instance'. They're always careful to stick with 'instance', and never to commit to 'VM'. Wise move, now that they're offering physical ('dedicated') instances [0]. Time will tell whether they take an interest in low-horsepower dedicated instances.

[0] [https://aws.amazon.com/ec2/pricing/dedicated- instances/](https://aws.amazon.com/ec2/pricing/dedicated-instances/)

<comment><USER30> There is a non-smooth transition from a server you own/lease and sits in specific rack in a known data centre with well understood routing and one provisioned as a dedicated instance in AWS/Azure etc that you manage with an API.

</comment></comment></comment></comment></comment></comment><comment><USER31> How much do these problems actually affect normal users tho? AFAIK not a single exploit has been created using meltdown or spectre, and why would there be?

</comment><comment><USER32> For 10-15% FPS I'd take any vulnerability any day of the week. I'd easily accept wiping my machine every night and never browsing the web on the same machine if that's what's required. I can just get another machine for whatever other task I have and it's pocket change compared to the gaming machine.

<comment><USER33> There might be a way to block the patch, but having a computer _strictly for gaming_ makes you a bit of an outlier.

<comment><USER34> an outlier, but not a unicorn. Dedicated machines running RetroPie for gaming is very much a thing. Probably most people doing this use a RPi (so not Intel), there's a lot of us buying old OptiPlexes and stuff.

<comment><USER35> People running RetroPie are unicorns of unicorns in terms of the people using computers. Hell even people gaming are unicorns in terms of overall computer usage.

<comment><USER34> I disagree. I can think of at least three use cases that frequently employ Intel CPUs, and that involve running a limited set of low-risk software:

* Gaming-only machines, like my RetroPie example.

* Media servers, like for Plex or Kodi.

* NAS servers, powered by software like UNRAID.

<comment><USER35> But those uses are still smaller than rounding errors in terms of overall usage.

<comment><USER34> It's big enough to create whole markets for commercial software, as my examples of Plex and UNRAID show.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Can anyone explain attack vectors? How does this happen?

</comment><comment><USER37> So does this mean that I will get a performance hit with the comming windows update?

Is there any way to mitigate this performance drop, disable the fix?

</comment><comment><USER38> Interesting that they measure FPS instead of frametime. FPS doesn't scale linearly, but frametime does.

</comment><comment><USER39> Pretty cool business model where putting dangerous vulns in your product can help you capture 90% of the market.

Then when your fuckups are discovered, other people not on your payroll expend their own resources to fix it.

And you don't even have to compensate customers who paid full price but now find 40% of their compute evaporated.

And that massive performance hit needed to fix your fuckups stimulates incremental demand for your product because customers now need more cores to finish their compute.

<comment><USER40> > Pretty cool business model where putting dangerous vulns in your product can > help you capture 90% of the market.

This is extremely disingenuous phrasing. You seem to be trying to craft a narrative that makes putting security vulnerabilities in products an intentional thing to sabotage people, time, and resources.

<comment><USER41> At some point, I bet someone in a design meeting said "Hey, I think this might compromise security, can we study that before implementing it?"

And the decision to implement it without that study, or despite it, was made. Because implementing it increased performance which made the numbers which captured market share.

It's not like the processor designed itself that way. Humans made choices along the way, and every choice is a tradeoff. Execution-time attacks and other sidechannel leakage have been well-known for years, and I can't imagine that at a place like Intel, nobody had heard of that.

<comment><USER42> Why do you think that it's likely that someone in Intel design meetings had thought of that if literally noone outside Intel did for many years?

It obviously wasn't obvious to the very, very many people worldwide who know about execution-time attacks and other sidechannel leakage, as it took _more than 10 years of almost every chip worldwide being vulnerable_ until it was noticed. It's not as if some 2016 design tradeoff suddenly enabled Meltdown. Engineers were carefully studying competitor's chip designs, and none of them noticed that flaw for more than a decade.

<comment><USER43> Even better: at least one person documented thinking about this issue, trying to exploit it and failing - showing that even if you could come up with this, it was really non trivial to achieve.

</comment></comment></comment></comment></comment><comment><USER44> Gamers dont care about obscure vulnerabilities on their gaming rigs.

So I think this is some sort of misguided hit piece against intel.

Everyone knows pcs are riddled with security flaws less obscure than this. People who run their business on cloud servers might care. Gamers though? No.

<comment><USER45> They should care, considering some of these vulnerabilities are exploitable just by JavaScript, meaning merely visiting a bad website could leak sensitive information

<comment><USER44> Lol. You are out of your league here fearmonger.

Gamers are are the 5 dollar whores of the security world, they are riddled with bugs and the dont give a crap.

<comment><USER46> We've banned this account for repeatedly violating the site guidelines. If you don't want to be banned, you're welcome to email email@example.com and give us reason to believe that you'll follow the rules in the future.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment><comment><USER47> Intel are consistently the assholes of the silicon market.

</comment><comment><USER48> Intel is not really screwed, cloud providers are. Those "vCPUs" people have been buying are actually hyperthreads. I have a hypothesis that a double digit percentage of cloud customers don't know what vCPUs are. As a cloud provide, imagine cutting your fake "core capacity" in half _and_ having to raise prices to offset the increased capex.

<comment><USER49> I've had difficulty parsing the guidance from Google for Google Kubernetes Engine here: [https://cloud.google.com/kubernetes-engine/docs/security- bul...](https://cloud.google.com/kubernetes-engine/docs/security- bulletins#may-14-2019)

> Note that n1-standard-1 (the GKE default), g1-small and f1-micro VMs only > expose 1 vCPU to the guest environment so there is no need to disable Hyper- > Threading.

I'm wondering if they've decided to just eat the loss on the single vCPU nodes, and for vCPUs >= 2, they pass the decision on to the customer.

Or is there someone else's VM running on the other hyperthread?

Here's their guidance on machine types: [https://cloud.google.com/compute/docs/machine- types](https://cloud.google.com/compute/docs/machine-types)

> For the n1 series of machine types, a vCPU is implemented as a single > hardware hyper-thread on one of the available CPU Platforms.

</comment></comment><comment><USER50> Wow. Even more Intel CPU vulnerabilities. I hadn't even _heard_ about MDS until now. Glad I based my new rig on the Ryzen stack.

I wonder how much these continuous performance degradations are costing bigger customers, like cloud operators. This shit can't be cheap.</comment>


Looking for the vulture assist with Neolithic burials - <AUTHOR> http://johnhawks.net/weblog/reviews/archaeology/neolithic/burials-vulture-excarnation-pilloud-2016.html <comment><USER2> An interesting and reasonable proposal. Similar practices are still alive today [0][1].

[0] [https://en.wikipedia.org/wiki/Sky_burial](https://en.wikipedia.org/wiki/Sky_burial)

[1] [https://en.wikipedia.org/wiki/Tower_of_Silence](https://en.wikipedia.org/wiki/Tower_of_Silence)</comment>


Regional Persistent Disks on Google Kubernetes Engine - <AUTHOR> https://cloudplatform.googleblog.com/2018/05/Get-higher-availability-with-Regional-Persistent-Disks-on-Google-Kubernetes-Engine.html <comment><USER2> This is a cool feature. However, for me it is helpful to know how often GCE tends to have a zone fail, but not the whole region. Personally, I've been using GCP to run cocalc.com since 2014. In the last year I _remember_ two significant outages to our site, which were 100% the fault of Google:

(1) Last week, the GCE network went down completely for over an hour -- this killed the entire _region_ (not just zone!) where cocalc is deployed -- see ://status.cloud.google.com/incident/cloud-networking/18010

(2) Last year, the GCE network went down completely for the entire world (!), and again this made cocalc not work.

In both cases, when the outage happened, having cocalc be hosted in multiple zones (but one regions, or in (2) one cloud), would not have been enough. I haven't had to deal with any other significant GCE outages that I can remember that weren't at least partly my fault. For what it is worth, I used to host cocalc both on premise and on GCE, but can no longer afford to do that.

<comment><USER3> Last week's outage does look bad, and clearly would have severely impacted certain dynamic patterns of scaling, but "went down completely" does not match what's documented on that link: it prevented the creation of new GCE instances in us-east4 which required allocating/attaching new external IP addresses.

Of particular relevance to this thread, if you had a GKE cluster spun up in that region, that cluster would have continued unaffected based on that description.

GCP does have outages just like AWS does, but in recent years the impact is usually something constrained to certain products and use cases.

(Disclosure: I worked for GCP 2013-2015 but haven't worked for Google since then.)

</comment></comment><comment><USER4> What does a failover look like in Kubernetes? From the GCP Docs: [1]

> In the unlikely event of a zonal outage, you can failover your workload > running on regional persistent disks to another zone using the force-attach > command. The force-attach command allows you to attach the regional > persistent disk to a standby VM instance even if the disk cannot be detached > from the original VM due to its unavailability.

Does the kubernetes.io/gce-pd provisioner have the logic to detect a zone failure in GCP and call the "force-attach" command if a failover is needed? Or does it always try to do a "force-attach" if a normal attach call fails? How does it handle a split-brain scenario, where the disk is requested by two separate nodes in each zone?

[1] [https://cloud.google.com/compute/docs/disks/#repds](https://cloud.google.com/compute/docs/disks/#repds)

<comment> brown9-2 Note that in [https://cloud.google.com/solutions/using-kubernetes- engine-t...](https://cloud.google.com/solutions/using-kubernetes-engine-to- deploy-apps-with-regional-persistent-disks#simulating_a_zone_failure) they only simulate a zone failure by deleting one zone's instance group.

</comment></comment><comment><USER5> This is going to enable some very simple multi-region failover for k8s, and I'm excited to try it out!

</comment><comment><USER6> I wonder what the performance hit from this is.

<comment><USER7> [https://cloud.google.com/compute/docs/disks/#introduction](https://cloud.google.com/compute/docs/disks/#introduction)

Only difference in docs is 1/2 the write throughput per GB on SSDs. Latency is probably the real issue though. Kind of annoying that neither pricing or performance is even mentioned. Pricing is at a "promo" price of .24 a GB for SSD and .08 for standard.

<comment><USER8> > Latency is probably the real issue though

Reads should be just as fast as zonal disks.

From the docs:

A write is acknowledged back to a VM only when it is durably persisted in both replicas. If one of the replicas is unavailable, Compute Engine only writes to the healthy replica. When the unhealthy replica is back up (as detected by Compute Engine), then it is transparently brought in sync with the healthy replica and the fully synchronous mode of operation resumes. This operation is transparent to a VM.

Regional persistent disks are designed for workloads that require a lower Recovery Point Objective (RPO) and Recovery Time Objective (RTO) compared to using persistent disk snapshots.

Regional persistent disks are an option when write performance is less critical than data redundancy across multiple zones.

(I work for GCP)

<comment><USER9> Do you use vector chains or partially ordered sets etc. to detect or prevent split-brain?

e.g. The first replica fails, and the second keeps writing, then the second fails and the first recovers. The second never recovers.

Without vector chains, the user would never be made aware that data was lost on the second replica. Or if the second replica recovers, data might be lost when merged.

<comment><USER10> In your example, the disk is entirely read-only I think.

I would guess the state of each disk replica (HEALTHY, UNHEALTHY) is stored in a master elected data store. Anytime a write to one replica fails, the data store must be updated to change the state of the failed replica before considering the write complete.

Then to change the state back to HEALTHY, everything must be online and fully re-replicated.

If the master elected state store can't be written to, because (due to a network split) it doesn't have sufficient votes to gain mastership, then no writes can occur.</comment></comment></comment></comment></comment>


Baseball's Fight with Fatigue - <AUTHOR> http://www.wsj.com/articles/baseballs-fight-with-fatigue-1424710560?mod=WSJ_hp_EditorsPicks

<comment><USER2> I must not understand Baseball well, because it strikes me as one of the least fatiguing sports that there are.

<comment><USER3> Here is what I'd recommend: for four hours, alternate sitting and standing every ten minutes in a sunny park. When standing, once every thirty seconds or so tense into a squat position and concentrate as hard as you can on something about 100 feet away. Every 10th time, sprint all out in a random direction. Every 20th time, throw a rock as hard as you can as far as you can.

What you will find is that you, a normal human, can keep this up for about one hour, before you collapse of exhaustion or hurt yourself.

That the super humans who play professional baseball are able to do this day in and day out for more than half a year is insane.

<comment><USER4> No, if you're a professional athlete this should not be all that difficult. Boring but not difficult.

Look at the average baseball player. So many of them are plump or overweight. I'd argue that soccer players running 10-15 miles every game have a bit more to deal with.

baseball needs some yoga and proper nutrition.

<comment><USER5> A first baseman, sure. They only need to be able catch well and sometimes throw across the infield. Find me an out-of-shape center fielder. Miguel Cabrera, for example, is a bit bigger. He's slow getting around the bases. But his talent, other than being a first baseman, is hitting the ball hard enough that he can casually stroll around the bases if he wants.

But humans were meant to run. That's why we stand upright, that's why we sweat. Running long distances on a flat grass field, to a trained athlete, is going to be less fatiguing than standing still in the sun waiting for something to happen. Pitchers throw 100+ pitches at 90+ MPH and for the most part, are dead accurate. Even if the ball is spiraling through the air to confuse the batter. And the players, other than the starting pitcher, are out there almost every single day, and sometimes play two games per day. Baseball has a ridiculously packed schedule.

So I would disagree that soccer players have it rougher. Running is easy.

<comment><USER6> Baseball pitchers regularly play well into their 40's. Jamie Moyer was still pitching a month or two shy of turning 50. For soccer players, still playing at 40 is nearly unheard of. Ryan Giggs did it, but that's about it, and it was mostly sentimentality that kept him playing that last year or so. So I would disagree that baseball is that much more taxing than soccer.

<comment><USER7> "Baseball pitchers regularly play well into their 40's"

Unless you're someone like Mark Prior who had their body give out when their career was just getting started. Why are you only highlighting the outliers, the genetic freaks (amongst genetic freaks no less)?

The thing with baseball pitchers is that there's an enormous selective pressure on their bodies (primarily shoulder & elbow) being able to withstand the brutal toll throwing all those pitches causes. The absolute best pitchers (talent wise) might never even make it to the MLB because their arm falls apart before they get a chance. There are pitching motions which hurt my arm just doing them in slow motion, now imagine heaving a baseball 90+ mph repeatedly for your entire life.

This is a far different selective pressure than what e.g. soccer players would have where quickness & speed on their feet is what matters.

The problem with these discussions is that people are using words like "taxing" to only narrowly mean what they want it to mean.

<comment><USER6> There are lots of Major League pitchers in their 40's. There might be no Premier League outfield players in their 40's. Lots of players in both sports get injured and end their careers in their 20's.

No doubt that a starting pitcher's pitching arm takes a lot of abuse, but they can have much longer careers than almost any other athlete.

<comment><USER7> That's not my point, what I was saying is that the two have completely different curves due to relying on completely different physical attributes.

A soccer player (or NBA player or many NFL positions, etc) is going to deteriorate steadily as they age after hitting some peak year. For some sports there'll be a slight bubble after that ast the intersection of athleticism decreasing and increasing wisdom but not for all. Sure, someone might endure a catastrophic injury and some players are made of glass (e.g. Greg Oden in the NBA) but generally players will wash out either when their athleticism is not high enough for their level or it deteriorates below the level necessary.

A baseball pitcher's curve is different. Their arm/shoulder will either be able to withstand the long term abuse or it won't and if it's the latter they'll wash out pretty early on (likely long before they ever see an MLB field). Once they clear that hurdle the actual deterioration rate is much slower in the general case. It also helps that pitching is a position where accumulated wisdom can really help, a lot like the quarterback in american football and that can help balance out declining athleticism as well

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> baseball, as with all sports, has a long and storied history with using various performance enhancing drugs to cope with injury and fatigue. amphetamines were commonplace in ball four ... bouton casually discusses greenies, players' coffee vs. regular coffee, etc. there was a sporting news snippet from the 1910's (that i can't find right now) that discussed pitchers dealing with arm fatigue ... the takeaway was that some pitchers preferred cocaine injections, while others preferred morphine. and then there was the steroid era ... lots of attention of course to creating cartoonishly large players, but most of these drugs were to shorten recovery from workouts ... you don't magically get huge from taking steroids.

</comment><comment><USER9> Interesting ideas by the Marlins, but I'd like to see the MLB take this further by cutting down the number of games from 162 to 100, and trimming the inning count from 9 to 7. Sure, the historical data won't match up, but it would be better for the players and more entertaining for the fans to watch shorter, less frequent games.

On an unrelated note, it would be nice if they expanded the playoffs to include 16 teams with the first two rounds being a best out of 5, concluding with the NLCS/ALCS and World Series being a best out of 7, of course. It would get more fanbases interested in their team if they at least made a playoff appearance more often.

The sport could use a shot in the arm in terms of viewership as the average age of your typical MLB viewer is ~54 years.

[1][http://www.bloomberg.com/bw/articles/2014-04-01/fixing- baseb...](http://www.bloomberg.com/bw/articles/2014-04-01/fixing-baseballs- old-people-problem-with-merchandise-highlights)

<comment><USER10> > _by cutting down the number of games from 162 to 100_

Since coming to North America I've always felt one of the problems with Baseball and Hockey is they just play too many games, so no game is significant enough. When your team loses to a certain team, you don't care enough because you know they'll play them multiple times more.

Baseball is 162, Hockey is 82 games in "regular season"

NFL is only 16 games, which to me, makes it much more exciting because each win or loss really matters, and as a spectator I actually care.

<comment><USER11> You just haven't followed baseball closely enough. When it's September and you're in a close divisional or wildcard race, there is nothing more exciting in sports: every pitch counts and every at-bat counts -- and there are ~5-6 games per week. (And that only counts your team! Part of the terror of a close race is that you're also watching every pitch and every at-bat of your rivals.) If anything, it's almost exciting to a fault...

<comment><USER10> It was recently explained to me that Professional sports is watching other people have the time of their lives....

If you're at a bar drinking, or at the game, you're literally paying to watch other people have the time of their lives.

Worth thinking about

</comment></comment></comment></comment><comment><USER12> I am surprised they focus on the hitters. I thought that the pitchers were the only ones that were a big concern. It sounds like the league needs a rule that each player can only play 5 days with out a mandatory day off.

<comment><USER13> I don't think the league needs to mandate anything. It's not like these are dropping dead. It is like a marathon, pacing yourself is just part of it.

</comment></comment><comment><USER14> No one wants to comment on the blindingly obvious startup aspects? When dealing with millions of dollars, experienced professionals don't get shoved like sardines into the smallest possible space, don't even try to produce at world class level for 16 hours a day 7 days a week for years, don't turn to energy drinks and potato chips as a primary source of nutrition... Apparently pro-ball is the "anti-startup" despite the similar focus on individual rock stars and teamwork and millions of dollars on the line. Perhaps they're just dumb jocks, or maybe, just maybe, startup culture is wrong? Obviously its one or the other.</comment>


PlusClout measures your Google+ influence - <AUTHOR> http://www.plusclout.com/?ref=hn

<comment><USER2> Launching a service called 'Clout' with a competitor called 'Klout', in which the only difference is that it measures a different social network, but in the same way?

Really?

</comment><comment><USER3> Hey I know the answer already... "You influence n curious nerds who signed in to register their accounts and have never returned."

</comment><comment><USER4> Mine's 0 until they rescind that name policy.</comment>


I'm raising money on Indiegogo to contribute to a Kickstarter campaign - <AUTHOR> http://www.indiegogo.com/ouya-1337

<comment><AUTHOR> I'm not sure if it's dumb or funny, or good or bad, but I worked hard at coming up with a plan and contribution perks that are actually fun/valuable.

<comment><USER2> The only thing that could make this better would be if you were doing this as an independent contract for 16 credits.

<comment><AUTHOR> Ha. You are telling the truth.</comment></comment></comment>


Ask HN: How to hack or get better at decision making? - <AUTHOR>

I consider myself a thinker and find myself easily getting paralyzed by the choices that emerge when you think or analyze a problem. The good thing is I can see many possibilities and the bad thing is because of all the possibilities I find is very hard arrive at a decision. Would love to hear experience from people who are facing or have in the past faced this problem and how they deal/dealt with it. <comment><USER2> Psychological research suggests

(1) narrowing down to a series of binary choices:

Japanese or American brand? Japanese

Honda or Toyota? Honda.

SUV or car? Car

Civic or Accord? Accord

Used or new? New

Red or black? Red

(2) Decisions are emotional, not just logical. Look at [http://en.wikipedia.org/wiki/Emotions_in_decision- making](http://en.wikipedia.org/wiki/Emotions_in_decision-making).

A good example of this is people who experience damage to their prefrontal cortex. Not only do they experience changes to their emotions, they are unable to make decisions, deliberating extremely long for the simplest things.

[http://brain.oxfordjournals.org/content/125/3/624.abstract](http://brain.oxfordjournals.org/content/125/3/624.abstract)

</comment><comment><USER3> Easiest way is to remember that not making a decision is itself a decision, it's just one done with _zero_ analysis, _zero_ conscious thought, and usually _zero_ positive impact on the world. In other words, most of the time it's the worst possible decision you can make. So do your research and just pick a course, even if it's not perfect, because you'll never have perfect information. You don't have to; you just have to be better than everyone else's information.</comment>


A platform helping friends in different locations coming together - <AUTHOR> http://www.trooptravel.com <comment><AUTHOR> Hi Hacker News Community!

Here's our project's explanation:

PROBLEM I have a lot of friends living in different locations. Once-in-a-while I want to meet up with them. I don't really care WHERE to meet but THAT we meet. I was missing a page which quickly analyses different flights and recommends places to meet with my friends.

WHAT WE DO So we built this very first version of a platform which recommends places to meet based on your starting locations. We already gathered quite some interesting results where it is up to 60% cheaper for 2 people to fly to a 3rd location rather than 1 travelling to the other. Concretely, we had one traveler from Madrid and 1 from Barcelona which could save 56% of the total flight costs if both are meeting in Ibiza rather than one traveling to the other!

WHY WE DO WHAT WE DO We believe that in our "online" world, the in-person meetings will become more and more important and we just tried to build a tool which facilitates the process.

SOURCE OF DATA We are using live data through the API from www.skyscanner.com. Thus, the prices you see are real prices.

BUGS It might be buggy (especially on Firefox) but we believe that it already gives a value to groups of friends based in different locations.

HELP NEEDED! We would love to get your comments on functionalities which you would like to see in a platform like this.

Thanks for your support and feedback! Dennis www.trooptravel.com</comment>


Summer school? Reading books? Camp? Computer games might be a better choice - <AUTHOR> http://trueslant.com/garyandrewpoole/2009/06/24/summer-school-reading-books-camp-computer-games-might-be-a-better-choice/ <comment><USER2> For the child who plays games throughout the school year, a summer program in which the child meets a new peer group face to face is a very good idea. At some summer programs, computer games will be banned, but they will be a topic of conversation anyway. Many math summer programs

<http://www.ams.org/employment/mathcamps.html>

are essentially free to participants, as they have heavily discounted list prices for everyone, and lavish need-based financial aid.

</comment><comment><USER3> My favourite subject in school is history. I love it in (almost) all its facets, the military, the diplomacy, the politics, the study of what people did. You can say that my interest began at a young age, reading lots of children's books on castles or the Romans, but what really got me into the subject was a game: Age of Empires II.

I was nine, and a friend had given me a pirated copy of the game. I was instantly fascinated by the campaigns and the background to the actual gameplay (at which I was pretty bad). I learned a lot about history in general, I loved playing around with castlebuilding or crushing an enemy with a huge army. I loved the evolving and changing missions, reflecting a real battle, more a long, progressing struggle with sudden interruptions and changes than a simple fight. I spent ages creating my own scenarios. I loved playing the game, and it shaped me.

Fast foward to the present day. I'm 17, and going to choose the specialist subjects for my final exams in 2 years. History is definitely going to be one of them.

</comment><comment><USER4> :-( One of my pet peeves is that Civ gives a very wrong idea of history and the way cultures evolve.

<comment><USER5> Personally I find Civilization 4 to give striking insights into the development of world history, with diplomacy being one of the key elements. I remember playing, with the USA no-less, and sitting on a piece of land void of any oil. With time ticking on I sought the weakest opponent I could find and built a large, though somewhat outdated, fleet. I strategically planned a shock-and-awe tactic and managed to conquer the target city in a single turn. Then all the world hated me and the most powerful Civ declared war, wiping out my fleet in a single round with his well-fueled destroyers.

Such is history.

I lost that game.

<comment><USER4> My issues are primarily with the "tech tree" (including cultural advances). I would recommend to at least read "Guns, Germs and Steel" alongside playing Civ ;-)</comment></comment></comment>


On the rise of digital design - <AUTHOR> http://www.osnews.com/story/26715/On_the_rise_of_digital_design

<comment><USER2> For those who would like to read more about the design philosophy of Metro, I would recommend "Brave NUI World" (Wixon).

Another book "The Mobile Frontier"(Hinman) briefly summarizes NUIs in Chapter 2, and concludes with an excellent interview with Mike Kruzeniski (Creative director at Microsoft in the Windows Phone Design Studio).

Hinman describes our current situation as being stuck in a chasm between GUIs and NUIs, with designers taking entrenched metaphors from GUIs and attempting to apply them to gestural interfaces and NUIs.

Hinman, Wixon, and Kruzeniski argue that skeuomorphic designs are insufficient for ephemeral and networked information.

Essentially, "Authentically Digital" means "content is the interface". Its a shift to focusing on the interaction, not the interface. Kruzeniski cites Photosynth's UI as an example of where mobile UIs are going.

As an Android developer since 2009, Windows Phone has me pretty excited from a technological standpoint. Android and iOS are essentially WIMPs with desktop metaphors. Maybe iOS has more skeuomorphism. But I see Android's Holo as simply a theme, not a fundamental difference in the UI of the system. Just lipstick on a pig, err WIMP, essentially.

</comment><comment><USER3> Interestingly, if I would've read the discussion out of context, I definitely would have thought the author meant digital as shadowy and gradienty, and analog as flat.

</comment><comment><USER4> The progress in of design clearly follows growth and adoption curves.

Early designs are 'analog' because users have no frame of reference. Components become increasingly stylized over time as analog parts become distractions rather than aids. Now we're back to digital.

I imagine the same will happen to the next revolutionary consumer technology.

Google glass? Who knows.

</comment><comment><USER5> A good read for sure. It's not just a style, in order to differentiate themselves from Apple, MS and Google went with the 'digital' or 'flat' design. We can argue if they ever even could, were it not for Apple and the iPhone, but 'flat dsign' works really well! The biggest winner is the user. We're seeing a "maturing" of mobile design. I can't wait to see Apple's response.

</comment><comment><USER6> What is exactly is "digital" about a design language that has been used for decades in the real world in parks, airports, roads, and so on as signage? To me that just seems like a "flat" variation of skeumorphism.</comment>


Long term psychoanalytic therapy helps major depression if other treatments fail - <AUTHOR> http://onlinelibrary.wiley.com/doi/10.1002/wps.20267/abstract <comment><AUTHOR> Impossible (for me) to get actual title into 80 chars.

"Pragmatic randomized controlled trial of long-term psychoanalytic psychotherapy for treatment-resistant depression: the Tavistock Adult Depression Study (TADS)"

This study is a thing because:

1) There isn't much for major depression if meds and CBT don't work. Electro convulsive therapy is sometimes considered, but that's obviously controversial and has a number of side effects.

2) Psychoanalytic therapy is controversial. This study shows it works for some forms of depression in some people.

3) It's a large well run study.

EDIT: Personally I think this is tricky for providers. This therapy (long term, provided by experienced practitioners in specialist settings) is expensive. Less expensive than cycling through MH in-patient stays; far better than death by suicide.

Also, it's interesting to see the recent work on sub-therapeutic doses of ketamine (5 mg per kg) given as infusion for anhedonia.</comment>


Show HN: Better photo filters for web - <AUTHOR> http://stunwall.com <comment><USER3> Nice. I open sourced something similar a little while back [https://github.com/joshduck/PixelStir/](https://github.com/joshduck/PixelStir/) (demo at pixelstir.com).

<comment><USER4> Thanks for sharing!

</comment></comment><comment><USER5> Was just thinking of making something similar today, but with a twist - <USER2> users create, save, and share their own filters. You could then show the popular filters, new filters, etc.

<comment><USER6> Interesting idea. I wonder what the result would be. How likely is it there are still good filters to be created.

</comment></comment><comment><USER7> Nice...good execution and I like that instead of forcing the user to create an account, you give them an optional account to use in the future, as well as the ready-to-send image.

I don't know if this is meant to be just a hobby project or a MVP...but if it's the latter, I wouldn't position it as "better at making beautiful photos via filters". It's not just because that's a subjective argument between Instagram/Flickr/etc, but because the appeal of Instagram, in particular, is that it is so seamlessly tied to people's most frequently-used photo device and one with a large user network. People like the filters, but it's the casualness and the addictiveness of acquiring "Likes" that is Instagram's main draw, and that's more of a UI/UX thing than aesthetic appeal.

</comment><comment><USER8> Very nice. I was just looking at CamanJS [0] for a project, and your project overlaps with Caman with regard to filters. However, the great thing about your version is how instantaneous the changes are. Caman is great too, but making any changes results in a 1/2 second to 2 second wait on my machine.

Anyway, very nice work.

 _Edit_ : One note: I find the jump in effect for vignetting from 0 to 1 rather large. Maybe start the vignetting much further out so that the jump isn't quite so big?

[0] [http://camanjs.com/examples/](http://camanjs.com/examples/)

<comment><USER9> these are far better than the OP's link. There's a reason the OP's filters are fast, they are trivially simple transforms. Doing something more interesting takes a little time. half a second won't kill me!

<comment><USER8> Fair enough, but even the simple operations on Caman - adjusting brightness, for example - have a delay. And don't get me wrong, I think Caman is great, and is much more powerful.

</comment></comment></comment><comment><USER4> Great idea, also listed at [http://stockphotos.io/resources/photo- editor/](http://stockphotos.io/resources/photo-editor/)

</comment><comment><USER6> Very nice, love the simplicity.

One thing I would tweak though: when you punch in the numbers for brightness and vignette (instead of using up/down), the effect doesn't take place until you click somewhere on the page. Would be nice to see it auto update as you write the values.

</comment><comment><USER10> Better: [http://webcamtoy.com](http://webcamtoy.com)

</comment><comment><USER11> My biggest issue is no description of the website anywhere! While I personally can figure out the purpose and usage, I think that it may confuse others. Otherwise nice work.

</comment><comment><USER12> The nicest / most surprising thing to me was the instant image preview. In less than a second I had 'uploaded' a huge image and was editing. Nice work.

</comment><comment><USER9> I don't get why everyone is so positive! The filters are horrible and just very basic color transforms. most leave a sickly look to the photo due to greens and blues.

</comment><comment><USER13> just went to use your twitter link, its a bit too intrusive for my liking. i just wanted to tweet about your site.</comment>


"Potentially rogue binary" in Sprint Evo - <AUTHOR> http://www.unrevoked.com/rootwiki/doku.php/public/unrevoked1_disclosure

<comment><USER2> I'm part of the team that found this backdoor. A few points:

1\. "Never Trust Sprint Again" is editorializing on the part of the submitter, not our stance. It's a very, very crappy thing to put on a phone, but there's no evidence it was placed there maliciously.

2\. It was released in the wild on the HTC Hero for some time. We believe it would have been in the wild on the EVO if we hadn't reported it.

3\. Sprint was very responsive when we reported this to them. They turned around a patch within a few days that sealed this particular hole.

4\. We have no idea where this came from or who was ultimately responsible. That information never made it back to us.

<comment><USER3> Clarification request: I don't have one of these phones, but have friends who do. Are the OTA updates installed automatically, or do they need to take some action (e.g. run a software update app or the like)?

<comment><USER2> If you're running stock (or close to stock firmware), you'll get a popup notification saying there's an update available. If you haven't received one for a few days, you're more than likely up-to-date.

<comment><USER3> Thanks! I'll let my friends know.

</comment></comment></comment></comment><comment><USER4> Look, if your backdoor binary sits in /usr/bin or similar in a file system, you really have no business writing backdoors.

Sprint could have the same functionality built into the kernel and no one would have noticed it. It's actually a good thing it's not running by default. I would snoop around further and see how it's launched; the command list only has the shutdown commands, not the launcher. Without the trigger you really don't have the whole answer.

<comment><USER5> Also if you name it "SkyAgent" (or anything vaguely Terminator-y), you wear the hat of shame. To parties.

</comment></comment><comment><USER6> "We do not believe that skyagent could ever be invoked remotely."

Whats the risk here? Possibly a debugging helper app left inadvertently?

<comment><USER7> Or an OTA update adding it to the init process (though apparently skyagent has not been removed)

<comment><USER2> It was removed in the OTA update on the EVO and Hero (not just chmodded, but unlinked).

<comment><USER7> Erm yes, I apparently mistyped, I meant to write that it had been removed (saying that it hasn't been removed makes low if any sense)

</comment></comment></comment></comment><comment><USER8>
      4 Jun 2010: Sprint OTA update removing skyagent binary.

I didn't trust any of the carriers to begin with. At least Sprint removed it.

</comment><comment><USER9> skyagent == air marshal?

</comment><comment><AUTHOR> What's unstated here but recognized by unrevoked is that Sprint had skyagent purposefully on their phones so that they could easily gain root access and keep their phones under their command.

<comment><USER10> If is recognized by unrevoked that that is true, then why does it state, "At this time, we believe that skyagent was a debugging binary left over from manufacture. We have been consistently impressed with the actions taken by Google, Sprint, and HTC to expeditiously resolve this issue."

<comment><USER11> But a few paragraphs later they write:

However, the security vulnerabilities present in skyagent are of less cause for concern than the purpose of the program. It appears that the binary was designed as a backdoor into the phone, allowing remote control of the device without the user's knowledge or permission. When the program is invoked, it listens for connections over TCP (by default, port 12345, on all interfaces, including the 3G network!) that accepts a fixed set of commands. These commands appear to be authenticated only by a fixed "magic number"; the commands are neither encrypted on the way to the device or on the way back. The commands that we have knowledge of at this time include:

sending and monitor user tap and drag input ("PentapHook"), sending key events ("InputCapture"), dumping the framebuffer ("captureScreen"), listing processes ("GetProc"), rebooting the device immediately, and executing arbitrary shell commands as root ("LaunchChild")

<comment><USER12> Isn't your comment fully supporting the previous poster?

It sounds a lot more like a debugging tool than a malevolent program: a backdoor sitting in an obvious folder, with an easy default port and no encryption, that allows to see system status, events, or run commands. Also, "We do not believe that skyagent could ever be invoked remotely".

<comment><USER11> Curious name for a "debugging tool", but maybe that's just me.</comment></comment></comment></comment></comment>


Google Maps App Hacked Onto iPhone 3GS Running iOS 6 - <AUTHOR> http://techcrunch.com/2012/09/24/google-maps-app-hacked-onto-iphone-3gs-running-ios-6/

<comment><USER2> This is a sad state of tech "reporting" nowadays. One guy posts one thing on twitter, and this is at least the 4th or 5th "news" report about it, with nothing more to go on other than one tweet.

I don't doubt it can be done, and I don't doubt Petrich is capable of it, but nearly half a dozen news posts (each one getting more and more outrageous likely) from what's essentially barely a proof-of-concept level hack just makes my soul weep.

You must remember playing "telephone" as a kid. Look at what passes for tech news lately on subjects like this and just watch the reporting get more and more divergent every time one tech blog recycles another blog's half-news.

Rant done, sorry.

<comment><USER3> Which is why everyone should install AdBlock

</comment></comment><comment><USER4> > Petrich has the old version of Google Maps working, yet says it's still > "crashy" and he isn't ready to share the method quite yet.

I'll stick with using the Apple Maps app and web-based Google Maps then.

A working solution to mapping on iOS6 and not a link-bait breathless worthless bit of 'news'.

<comment><USER5> Petrich is a competent programmer, but yes I agree this isn't news-worthy. It was just a Twitter post.

</comment></comment><comment><USER6> One thing I don't understand - if licensing issues was the reason why Apple and Google fell out on maps, can people on iOS 5 continue to run the old maps, or will it stop working sometime in the near future?</comment>


Ask HN: Need advice on tricky situation with investor    - <AUTHOR>

First time poster, long time lurker.
Our startup took on an investor right before we launched who owns 30% of our company.  He gave us the money with no contract and nothing in writing detailing any terms (all the email says is you guys get X amount in exchange for 30%.)
We're in the process of trying to sell our company, for only slightly more than he originally put in. I was wondering if he is entitled to first money out or rather just 33% of the sale price.
(Also I'm aware that verbal contracts hold up in court.  These details have never been discussed verbally or through emails.)
Thanks <comment><USER2> I don't think there'd be any first-money-out rule (i.e. liquidation preference) unless you actually negotiated one. The default rule is that assets are split proportionally to equity. You could get a minority- shareholder lawsuit if he opposes the sale and feels he's gotten a raw deal, though.

(Standard 'not a lawyer' disclaimer.)

</comment><comment><USER3> Sounds like a free-for-all, ie a nasty court battle. How can he own 30% of your company if he has nothing in writing? An email stating intent isnt the same as an email stating "You acknowledge i have given $x for x% of the company" and of course without a signature thats a pretty big presumption.

Pretty much its an issue of whats more likely to piss him off and is it worth the cost of court.

</comment><comment><USER4> The short answer, is consult a lawyer. Seeking competent legal counsel before things potentially turn ugly can often avoid them turning ugly, or at least make sure you are on the firmest possible footing when they do.</comment>


A decade later, Reddit's comment sorting still fails to do its job - <AUTHOR> https://www.singlelunch.com/2019/09/17/a-decade-later-reddits-comment-sorting-still-fails-to-do-its-job/ <comment><USER2> Does HN use any similar algorithm? In the posts with enough comments to run onto a second page, I have never clicked through.</comment>


Ask HN: Is there a design equivalent for HN - <AUTHOR>

Lots of people post sites on HN for review. Is there an equivalent that is for people to critique a design I have? <comment><USER2> Maybe <http://dribbble.com>? I don't have an account, but it seems like that give you what you are looking for and have a niche group as well.

<comment><USER3> I came in here to mention this, but it is invite-only to keep the quality high, so it might not work for the OP.

It's great for inspiration though.

</comment></comment><comment><USER4> There's a lot of design forums but like dev forums, they can be pretty specialized.

Also, most of the best are private or invite only since ppl are looking for feedback or critiques for large clients.

Here's a few you could check out: <http://www.qbn.com/> <http://forum.howdesign.com/> <http://www.designerstalk.com/forums/></comment>


The Genius and Tragedy of Patrick McKenzie - <AUTHOR> http://sebastianmarshall.com/the-genius-and-tragedy-of-patrick-mckenzie <comment><USER2> I wish it started with a disclaimer stating that it makes unwarranted assumptions about patio11. Only at the end does an edit admit "[t]his post set off a huge controversy", and it doesn't detail what inaccuracies the post contains.</comment>