Was the Wheel of Fortune One Letter Solve Really a Miracle? - <AUTHOR> http://www.esquire.com/blogs/chris-jones/wheel-of-fortune-one-letter <comment><USER2> Most of the article is only worth skimming through, but don't skim so fast that you miss the kernel at the end ;)

> Sometimes, people who don't understand any better confuse the mundane with > the divine, mistake hard work for lightning bolts. They couldn't pull off > that same stunt, and so they convince themselves that nobody else could, > either. Her brain can't possibly work that way, that fast. There's no way > she solved that puzzle on her own. The game must be rigged.

> Or Burke has a gift, and she improved it with study. She practiced. She > found the little edges and secrets that make large-size success possible; > she did every last bit of the math. She earned her way to her place behind > the wheel, and then, on that fateful day, in that particular pattern of > rectangles and lights, she saw all that she needed to beat it.

<comment><USER3> >Sometimes, people who don't understand any better confuse the mundane with the divine, mistake hard work for lightning bolts.

Now that is condescending.

>They couldn't pull off that same stunt, and so they convince themselves that nobody else could, either.

Suppose you'd never met Rain-Man and saw him pull off one of his counting "stunts". Wouldn't your null hypothesis be that it was a trick? Now you meet someone else, Derren Brown say, doing the same trick do you assume he does it the same way or is it really a trick. Next you try with a buddy - first time he gets it right, WTH? Savant, conjurer or lucky?

Once at school I got a run of about 8 dates fired at me (I can't remember the context it might have been birth dates) and told people the day of the week correctly for that date. They wondered how I did it, and as I'm good at maths, figured it was some mental ability. As it happened I just guessed.

<comment><USER4> The probability of getting 8 weekdays right in a row by random guessing is 1/7^8, or about 1 in 6 million. So _my_ random guess is that either the number was substantially less than 8, or there was actually some extra information that you made use of somehow, or you didn't really get them right and the other people were just messing with your head. Or, of course, you're messing with ours.

<comment><USER3> It's crazy isn't it. Seriously, it was one of those moments where you think "hey how am I doing this". I really thought for a very short while I had some sort of untapped savantish ability to know the day for any date (I think there are people that can do this based on some form of learning|equation?). In actual fact I can barely remember the day it is today ...

The dates were being checked on this one kids graphing calc. He was the only person in the class, in the school I suspect, that had one.

Whilst the chance of guessing 1 in 7 eight times in a row is very small, a string of guesses that are correct in a larger population of guesses has no greater probability of being in any particular place in the string than any other. Provided that if I'd continued guessing a large number of times then I only achieved c. 14% correct then there is nothing wrong statistically with such a feat ...

Maybe I didn't guess at all. Maybe I had a psychic link with my classmates Casio ... ;0)

</comment></comment></comment></comment><comment><USER5> My general impression is that the cryptographers routinely do stuff that's an order of magnitude more mind-blowing than this. [1]

More people need to read _The Codebreakers_.

\---

[1] Alas, I just have to marvel, because for some reason my mind doesn't anagram well. I just don't have the knack. To me high-level Scrabble playing looks like a superpower.

<comment><USER6> _"Alas, I just have to marvel, because for some reason my mind doesn't anagram well. I just don't have the knack. To me high-level Scrabble playing looks like a superpower."_

I feel the exact same way. Well put.

<comment><USER7> I've noticed the same thing - Boggle comes easy, but Scrabble does not.

</comment></comment></comment><comment><USER8> Ken Jennings (the Jeopardy genius) has a blog post about this as well [1]. It seems to me once you start down the decision tree starting with "I'VE GOT" at the start, your average native English speaker should be able to get the right answer quite easily.

[1] <http://ken-jennings.com/blog/?p=2250>

<comment><USER9> I think the most telling part of that blog post is:

"Caitlin spins and guesses an 'L'. Note that she has not yet solved the puzzle at this point…if she was sure, she would have guessed 'T', a safe guess worth three times the money. Why guess a second-tier letter like 'L'? She's probably assuming the first word (_ ' _ _), with its apostrophe, is "I'LL," but can't figure out what comes next. "I'll put?" "I'll say?""

<comment><USER10> What I found interesting about Ken's post was his conjecture that many other players have solved the text after just one letter, but carried on playing to maximize their cash winnings. According to him, we only know about her because she chose to solve the problem and not risk the wheel. Thus, ending the game after one letter may be extremely rare, but solving the problem after one letter may be less rare than it seems.

<comment><USER8> Used to watch the show with my Grandma a lot as a kid, and very often people who know the answer (you can generally tell based on their confidence, and the fact that they never buy a vowel) will keep spinning in order to make more money.

</comment></comment></comment></comment><comment><USER11> The Price Is Right article mentioned in this article is pretty awesome also: [http://www.esquire.com/features/impossible/price-is-right- pe...](http://www.esquire.com/features/impossible/price-is-right-perfect- bid-0810)

</comment><comment><USER12> This American Life did a great show this summer which included a story about a man who figured out the pattern in the board on the 80's game show Press Your Luck and took them for a lot of money. Definitely worth a listen:

[http://www.thisamericanlife.org/radio- archives/episode/412/m...](http://www.thisamericanlife.org/radio- archives/episode/412/million-dollar-idea)

Now that I look at the rest of that episode, it also included some coverage of the Cambridge Innovation Center's Elevator Pitch contest, so all around a good listen for the HN crowd.

<comment><USER13> And here's the video of Michael Larson on Press Your Luck: <http://www.youtube.com/watch?v=8_EjKKGSXus>

<comment><USER14> Musical hacks. It sounds like he hit STOP every time a certain note played. Maybe he noticed a pattern that whenever someone hit "stop" on that note it landed on a "big bucks" icon. So account for reaction time/delay, and ta-daa. $100,000.

<comment><USER15> He realized that there were a set number of patterns. Once he figured that out it was easy to hit the button when the next square was going to be the one he wanted.

</comment></comment></comment></comment><comment><USER16> No, it wasn't. I looked at the still frame for about 20 seconds and got it myself, before I saw the video.

It just took a little logic about what words could possibly be in certain places, and the rest was filled in by phrases I heard in the past.

Edit: Don't get me wrong! It took guts for her to do that. If she got it just a little wrong, she gave the next person a LOT of hints and it likely wouldn't get back to her.

<comment><USER17> Yes, I recall amazing my family with a zero-letter solve before too. It's not trivial, but I suspect we'd have an above-average concentration of people who could do that around here.

No way could I do it under pressure right now, but then, if I knew I had a Wheel of Fortune appearance coming up you'd better believe I'd be studying and practicing. It amazes me that it's so obvious that so few people do that. Also how many people play so badly from a game theoretic standpoint; spinning a $400 on a puzzle with an obvious solution and a few open letters including one triple letter, they choose one of the single letters then solve. No prize puzzle, etc.

<comment><USER18> > It's not trivial, but I suspect we'd have an above-average concentration of > people who could do that around here.

I don't know about that. All that's required is memorize and recall word lists, breaking down a puzzle into components, and being able to do both of those quickly. I think most people would be able to do it given practice. Most school tests I've taken require similar skills.

<comment><USER17> I agree entirely. What I think would be above average around here is the number of people who have made some effort in that direction, especially the "breaking it down into components" part. It isn't that being an HN type is an intrinsic advantage, it is that it is a shorter trip for us.

</comment></comment></comment></comment><comment><USER19> Followed the embedded YouTube video and was rather disgusted by the comments on it. Almost all suggested she cheated, and half suggested it in an incredibly disgusting/demeaning/sexist way. Is this what the broader culture assumes when a woman pulls off something clever?

<comment> brown9-2 Don't make the mistake of reading YouTube comments and making any sort of broad judgments from them. It's pretty widely agreed that YouTube comments are one of the strangest phenomenon online.

</comment></comment><comment><USER20> Apostrophes help you alot. I solved the following puzzle with no letters:

_ _ _ _ _ _ _ _ _ ' _

_ _ _ _

Category was "Thing".

(Err, formatting isn't helping. That's two words, with 9 spaces, an apostrophe and a 10th space in the first word, and four spaces in the second word).

<comment><USER21> It's either a telephone's ring

Or Microsoft's bing

or a fisherman's nets

or the president's pets

or a ballerina's toes

or (something that grows

when dishonesty flows)

Pinocchio's nose?

<comment><USER20> > Pinocchio's nose

Bing

<comment><USER11> In an attempt to solve, took bigrams from [http://blog.afterthedeadline.com/2010/07/20/after-the- deadli...](http://blog.afterthedeadline.com/2010/07/20/after-the-deadline- bigram-corpus-our-gift-to-you/)

and ended up these top 10 entries:

      Schindler's	List	33
      president's	plan	32
      Microsoft's	Xbox	26
      yesterday's	post	17
      boatswain's	mate	16
      highlight's	from	16  <-- need to include only nouns
      Elizabeth's	time	16
      Wednesday's	show	13
      Microsoft's	IPTV	11

The answer didn't appear in the corpus, but there was 1 entry for

      Pinocchio nose  <-- no apostrophe and 's'

Looks like i need a bigger corpus and more data scrubbing, there must've been something else that tipped you off before or during the show...

<comment><USER20> > there must've been something else that tipped you off before or during the > show...

Not that I recall, but maybe so.

</comment></comment></comment></comment></comment><comment><USER22> She's got a great quote in there about luck: "I really believe that luck is preparation meeting opportunity"

<comment><USER23> It's a quote by Seneca, an ancient Roman philosopher: <http://www.quotationspage.com/quote/4576.html>

<comment><USER22> Cool, thanks for letting me know. I've heard similar things before and I'm trying to make it a mantra.

</comment></comment></comment><comment><USER24> Even discounting all of the logic involved in this instance, people _do_ occasionally just get lucky.

When I was in the fifth grade, we were playing hangman in class and my friend Chingfei managed to discern "White Men Can't Jump" from only two or three letters. An impressive feat, proven by the fact that I remember this 14 years later.

A "miracle" is really something with an extremely minuscule chance of occurring, but with enough trials you'll eventually get a positive result. Even the Biblical "water into wine" could happen under the laws of quantum mechanics, but it's an insanely long shot.

Still, in this case it was logic, not luck, that played out, since no rational person would just guess at solving the puzzle so early in the game.

</comment><comment><USER25> _I'LL HAVE WHAT SHE'S HAVING — didn't come close to fitting the puzzle, but it made I'LL seem an unlikely starting point. Because HAVE is the word that probably follows I'LL, and here, Burke was searching for a three-letter word._

Um, what?

I'll GET

I'll SEW

I'll AGE

I'll BAY

I'll BET

I'll DIG

I appreciate that none of these conjure memories of phrases off the top of my head, but the idea that "have" is often the only option following "I'll" is simply not true.

Let's face it, she's quick on her feet, smart, familiar with phrases and - most importantly - _got lucky_.

<comment><USER26> Phrases aren't drawn from anywhere in the English language. They must be guessable.

There are not many phrases in popular culture starting with those combinations (only "I'll get it," comes to mind). On the other hand phrases from movies are common, and those with mild sexual references are more entertaining.

</comment></comment><comment><USER27> More letters is actually helpful: <http://www.youtube.com/watch?v=JPsbY8LLVlY>

</comment><comment><USER28> This sounds like the classic 'overnight success' (after toiling for years in obscurity) stories- a great lesson for all of us.

</comment><comment><USER29> I'm pretty sure the phrase itself played a part here. Just imagine it - you've figured out something that fits using only one letter. You're probably feeling a little bit excited, but it's a bit of a gamble to guess - how many other phrases might fit? _Do you have a good feeling about it...?_

</comment><comment><USER30> No, it's not a miracle. I've done it before without any letters on the board. Just a happy coincidence where one of the thoughts floating in your brain happens to be the clue that day.

</comment><comment><USER31> Of course, who could forget the puzzle in the "Family Guy" parody of WOF:

G. .UCK Y.URSEL.

(Phrase)

</comment><comment><USER32> <quote>she immediately begins breaking it down into smaller pieces — "chunks," she calls them</quote>

I'm not sure you have to qualify that as something she calls them. I think a lot of people would call those "chunks".</comment>


Actors for Squeak Smalltalk - <AUTHOR> https://tonyg.github.io/squeak-actors/ <comment><USER3> Thanks for sharing!

I have a question coming from Erlang-world eg how exactly did you implement concurrency? Erlang VM has a counter for each VM instruction and does process switch based on that, did you implement something similar? Is this preemptive concurrency like the one in Erlang?

And a second question - will it work in Pharo? :)

<comment><AUTHOR> Class Actor inherits from class Process, so Squeak's underlying process- switching machinery is in effect, complete with priorities, nonpreemption, any use of semaphores etc.

It could in principle work in Pharo, and I did try to port it to Pharo - almost all of the necessary infrastructure is the same - but I remember that at the time there were two problems. The first is that Pharo doesn't have an integrated Promise implementation. The second is that I couldn't get Pharo's sockets to behave as reliably as Squeak's. I don't remember details - <USER2> error reporting in certain situations perhaps? - but I'd be very very pleased if a Pharo expert were to have a try at doing a port.

</comment></comment><comment><USER4> > This library adds an Erlang-style Actor model to Squeak.

Did you find any inspiration in late '80s experiments on implementing Actors in Smalltalk?

"From Objects to Actors: Study of a Limited Symbiosis in Smalltalk-80"

[http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.41....](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.41.7827&rep=rep1&type=pdf)

</comment><comment><USER5> Thank you!

I've actually started learning Squeak/Smalltalk recently, and the possibility of using actor model is a great additional motivator, since I'm interested in agent-oriented programming.

</comment><comment><USER6> Isn't an object is already an actor in Smalltalk?

<comment><USER7> Nope. Smalltalk objects aren't concurrent or asynchronous in any way. Smalltalk "messages" are good old method calls.

<comment><USER8> Smalltalk supports multicore since the early days, in fact the Blue Book even has some examples for data simulation.

<comment><USER4> Simulations can be done on one time-sliced processor!

Which main "Smalltalk" are you thinking of when you say "supports multicore since the early days"?

There certainly have been research Smalltalk implementations that do, like:

"Multiprocessor Smalltalk: A Case Study of a Multiprocessor-Based Programming Environment"

[https://www.researchgate.net/publication/234768128_Multiproc...](https://www.researchgate.net/publication/234768128_Multiprocessor_Smalltalk_A_Case_Study_of_a_Multiprocessor- Based_Programming_Environment)

and more complete implementations like Actra and Gemstone/S.

<comment><USER8> The reference to the Blue Book made it quite obvious.

Thanks for the paper reference.

As for Gemstone I was aware of it. :)

<comment><USER4> > reference to the Blue Book

So you mean ParcPlace Smalltalk-80 "supports multicore since the early days"?

I think those Smalltalk "processes" are run in the same OS thread and only use one core, so please explain what you mean.

Were you aware of Actra?

<comment><USER8> After re-reading the Process/ProcessScheduler chapter you are right, it explicitly mentions one VM per CPU.

So from that point I stand corrected, however I would say it was an implementation detail, as the ProcessScheduler could easily have other policies.

<comment><USER4> > implementation detail

There's an enormous chasm between research experiments:

September 1988 "From Objects to Actors: Study of a Limited Symbiosis in Smalltalk-80"

[http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.41....](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.41.7827&rep=rep1&type=pdf)

:and well-understood techniques supported by all the programming tools.

<comment><USER8> Thanks for the paper.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Is the spawning overhead comparable to that of Erlang's BEAM?

<comment><AUTHOR> The performance tradeoffs are quite different, because this library uses the unmodified Smalltalk virtual machine that underlies Squeak. I would _guess_ spawning is quite fast, because it is more-or-less just a few object allocations (plus a couple of linked list manipulations), but I have not made any serious measurements of performance of the system. Also, the Squeak VM has (IIRC) limited ability to make use of true parallelism.

A second tradeoff is in terms of flexibility: this is an ordinary (and fairly small) Smalltalk library, and so can be quickly sculpted into variations on the theme of Actors. Making similar modifications to Erlang would be very expensive. I aim to use this library as a foundation for experimenting with Syndicate-style ideas ([https://syndicate-lang.org/](https://syndicate- lang.org/)) in a pervasively OO setting.

<comment><USER10> Syndicate seems very cool! Do you know if it's used by anyone or is it more of a research project at this stage? Am I right that the pattern seems very similar to re-frame [0] in Clojurescript? It seems like it might be an excellent way to develop web apps, especially since I see there's a javascript version as well.

[0] [https://github.com/Day8/re-frame](https://github.com/Day8/re-frame)

<comment><AUTHOR> It is still a research project, though I am working on a new implementation that brings it up to production standards.

Re-frame does look similar, but Syndicate is general in the same way that the Actor model is general; DOM support and other "I/O devices" are bolt-on drivers, not built in to the core.

Syndicate does make a nice way to develop web apps; for example, the whatsapp- like chat app here [https://github.com/tonyg/syndicate/tree/master/examples/webc...](https://github.com/tonyg/syndicate/tree/master/examples/webchat) shows a few of the ideas, though it's only prototype/experimental quality. The new implementation ought to be suitable for making such applications "for real". See also the handful of in-browser demos, which naturally focus on web- ish things: [http://syndicate-lang.org/examples/](http://syndicate- lang.org/examples/).

The Racket implementation has been used to implement not only the server side of the webchat app, but also a TCP/IP stack [1], an IRC server [2], and a side-scrolling platform game [3].

I'm afraid that there's very little documentation available (it is still a research project, after all!). You can read more about the ideas behind it here, though: [http://syndicate-lang.org/tonyg- dissertation/](http://syndicate-lang.org/tonyg-dissertation/).

\--

[1] [https://github.com/tonyg/syndicate/tree/master/examples/nets...](https://github.com/tonyg/syndicate/tree/master/examples/netstack/incremental- highlevel)

[2] [https://github.com/tonyg/syndicate/tree/master/examples/ircd](https://github.com/tonyg/syndicate/tree/master/examples/ircd)

[3] [https://github.com/tonyg/syndicate/blob/master/examples/plat...](https://github.com/tonyg/syndicate/blob/master/examples/platformer/hll- main.rkt)

<comment><USER10> Thanks I will check out those examples! Again, this looks really cool. I just started playing a bit with Racket, so this is nice to dive into.</comment></comment></comment></comment></comment>


IAmA a malware coder and botnet operator, AMA - <AUTHOR> http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet_operator_ama/ <comment><USER2> Most of what he says is obvious stuff and the emphasis he puts on how much he modifies stuff makes me assume he's someone that just runs programs and doesn't have any unique insight, but he does make one interesting point:

> Try to use "Verified-By-Visa" and "Mastercard-Securecode" as rarely as > possible. If only your CVV2 code is getting sniffed, you are not liable for > any damage, because the code is physicly printed and could have been stolen > while you payed with your card at a store. Same applies if someone cloned > your CC reading the magnetic stripe or sniffing RFID. Only losing your VBV > or MCSC password can cause serious trouble.

Does anyone know if this (using verified-by-visa, mastercard-securecode remove any payment protection if you get key-logged etc) is correct?

<comment><USER3> When a website asks me to use one of these, and I don't want to, how do I decline but still make the purchase? It always seems like my options are take- it-and-like-it or don't complete the transaction. Is there a third option?

<comment><USER4> I've had certain websites _require_ VbV for purchases. I can only assume the transaction fees are lower for such transactions, or they got some kind of other deal from their merchant bank.

The worst part is the information required for the "I forgot my password" process is often not terribly hard to get hold of (date of birth, that kind of thing).

The best option at this stage is probably to have a "normal" credit card for everyday use which is specifically NOT VbV enabled, and a special VbV credit card that you keep at home for internet purchases from companies that require it. Or just don't buy from those companies.

<comment><USER5> > I've had certain websites require VbV for purchases. I can only assume the > transaction fees are lower for such transactions, or they got some kind of > other deal from their merchant bank.

Transaction fees are not the problem, putting a stop to consumer fraud and charge-backs are the net win for the merchant.

</comment></comment></comment></comment><comment><USER6> I very much enjoyed the reading of his comments - I pulled a few of his that others may find interesting.

[polymorphism code - to hide virus signature]

Randomness is your friend, make your own crypter and make it so fucking random on every compile, that AV reverse engineers kill themselfs (HINT: randomize the crypters sourcecode using perl scripts)

[polymorphism code - to hide virus signature]

I started coding about a year ago, hacking old malware sourcecodes and reading russian boards. Most botnet operators are dumb as fuck, who don't even care about their traces, the ones you see on TV, catched by Microsoft and Brian Krebs. If you have more knowledge you can automatize nearly everything, like creating scripts that rewrite your sourcecode for your crypters so your malware gets undetected again, saving you hard work.

[finding infections on a computer]

Use GMER (<http://www.gmer.net/>) every now and then when your spider sense is tingling. Srsly, you can't fool GMER, it scans from the deepest possible point in your system, at ring0 and is impossible to fool, there is nothing deeper than ring0 on a usual PC where malware can hide stuff from. I always wondered why other AV vendors don't do it like GMER, it can detect all rootkits. But when a AV can detect everything, who will pay 30$ a year for signature updates...

<comment><USER7> the statement about GMER is not true. I've seen GMER miss MANY rootkits/etc. As far as catching and removing rootkits that other most av's tend to misss i've had by far the most success with combofix(which includes a GMER scan). Nothing will catch 0day rootkits 100% of the time, once a system is compromised it's best to format and start from scratch (or restore from backup if you're positive it's clean, but make sure you replace the mbr too). Theres just no other way to be completely certain. I lost track of the times that I thought I got everything on a windows machine, then google for something like malwarebytes as a test only to be redirected.

<comment><USER8> He seems to think of himself as very skilled because most other people in his field can't program. While he certainly is pretty good at what he does, it is scary to think what somebody with _real_ knowledge could do.

</comment></comment></comment><comment><USER5> Let's play 33 bits on this guy, my guess is that he's German, Austrian or Swiss based on the settings for his IRC client, that should knock about 6 bits off, 27 to go.

<comment><USER9> oh I was doing that while reading the AMA. the giveaway is being the 4th customer of a bank that provides HBCI:

> My bank had around 20,000 customers using smsTAN and 3 (I was the 4th lol) > using HBCI.

He is German, of college age and an early customer at one of 2 or 3 banks that provide HBCI. Consider him nailed.

I also bet he has published security related work under his real name at some point, especially since he has been applying for jobs. Most people in the security industry applying for legit work who don't have qualifications pad out their resumes with online research (or speaking at conferences, etc.).

<comment><USER10> I really hope I never make enemies with anyone around here.

<comment><USER11> I think Hackernews has 220000 registered users. You are one of them.

You have 17 bits left. Use them wisely.

<comment><USER12> This is fallicious. Anyone can register for an account. Knowing someone is on HN only gives enough information, that said person is in the 'HN demographic'. Just because he happened to register for an account, vs someone similar who didn't, does not give us the amount of entropy removal you implied.

<comment><USER5> Since the GGP is easily googleable he actually has 0 bits left, but you are correct about the math.

</comment></comment></comment></comment></comment></comment><comment><USER13> "Protip against driveby infections (the ones in the browsers): Disable addons in your browser and only activate the ones you need. Chromium and Chrome for example let you disable all additional content like flash, html5, pdf and java in the options, you will see a grey box instead of the content and can manually run it using right-click -> Run. Chrome options -> Content options -> Plug-Ins -> Disable all or Click-to-play. Chrome also allows you to whitelist sites you trust, like youtube. This will make you immune to driveby infections regardless of the version of your java or adobe reader, because you will only be able to click and run content, that is VISIBLE on the site. Malicious content is ALWAYS hidden in a 0pixel iframe! This also stops the nasty flash advertisements implying you can't aim precise enough to win an iPad3."

This is one thing I've been trying to convince people to do for ages but, for some reason, that one extra click turns so many people off. The extra minute or two I probably spend a day clicking on plugins to activate them will pale in comparison to how much time I'll have to spend recovering from being infected.

<comment><USER14> I've actually stopped using Firefox because it re-enables plugins that I've disabled (maybe it's more accurate to say it allows 3rd-party software updates to re-enable them).

<comment><USER15> This was fixed in Firefox 8, unless 3rd-party programs have gotten much more clever:

[https://blog.mozilla.org/addons/2011/08/11/strengthening- use...](https://blog.mozilla.org/addons/2011/08/11/strengthening-user-control- of-add-ons/)

</comment></comment></comment><comment><USER16> * About 20% of the users have good graphic cards, but are not sophisticated enough to install drivers.

* 30% of victims are Americans.

* 80% have an antivirus installed.

* An average income of $40 per day (bitcoin only). May vary up to $1,000.

<comment><USER17> > About 20% of the users have good graphic cards, but are not sophisticated > enough to install drivers, so my [Bitcoin] miner can't run.

If he has root-level control of the systems, why doesn't he install the needed drivers himself?

Somebody already asked him this question on reddit, but he didn't answer.

Does anyone have any idea why he wouldn't/couldn't/shouldn't install drivers himself?

<comment><USER18> Also, why not mine litecoins (cpu's are good at doing that, so no drivers needed and he can mine bitcoins at the same time) and sell them for bitcoins? They are worth enough that his profits would go up noticeably much.

</comment></comment></comment><comment><USER19> I don't understand how these people sleep at night. The whole notion I didn't make the game I just play the ball is just hilarious.

Furthermore those guys don't understand that eventually they're hurting the web. All that will bring stricter legislation and governments will start enforcing rules like IP identification for just about anyone out there.

I can understand organized crime exploiting the cyberspace. But for individuals its just plain stupid.

<comment><USER20> They are just like petty criminals in real life, you've seen what surveillance and legislation does in real life... virtually nothing. The smarter ones go into the cracks and the shadows (Tor) which just leaves us folk being monitored for no reason, but we're okay with it because "it's helping to stop crime"

There is also the addition that you are just interacting with a computer, a keyboard, a mouse and a screen. I bet if you asked this guy if he would go out and mug someone he'd say no, because he'd be face to face with the person... he'd see the upset and pain he's caused.

Not saying it's right, but there is certainly a bit of psychology involved here, gaining from the computer doesn't seem like a crime to those not in charge of their own compass.

<comment><USER21> Well, those speed bumps increase the fitness requirements for a short time of hackers. So it's not a total loss/ black-white picture.

</comment></comment></comment><comment><USER22> Well, clearly this guy's moral compass is a bit out of whack, but the IAmA does offer some fascinating insights into this world...

<comment><USER23> yea, the world is a weird place. seeing a lot of angry ethical reactions on reddit, i can't help but think: on one side, there are people like this guy in the comments who left marketing a health product due to false claims, or me refusing to code for certain clients based on "personal" ethical judgments and on the other side there are these "crackers" who steal the credit cards of random people and who even hate them.

one thing i want to believe, you can't build a future on crime, or can you?

<comment><USER24> What is this I don't even..

It sounds like you're considering a life of crime. Probably thinking about how you could be like that botnet guy on Reddit. Getting money without working is a nice thought, after all.

You know, the "ethical reactions" stem from that guy doing evil things. He knows he's being evil but doesn't care. Some people find that appalling.

For him, it's just an easy way to make money, and the fact that he produces no value to society at large is irrelevant. He even gets to work on challenging problems!

In fact, what he's doing is quite similar to working for the financial industry, doing HFT or whatever. It's clearly wrong, and clearly harmful to mankind, but it's easy money, so ethics are thrown out the window.

It _is_ generally easier to make money by scamming/abusing people than by doing something valuable. That doesn't mean you _should_.

<comment><USER25> The thing that most people don't realize is that it isn't as easy as most people think or how he makes it sound. It's very similar to building a passive income product. You invest a lot of work up front for an "easy" payout later.

It may only take him an hour or two a day to manage the network but I doubt that's all the time he spends on it. From reading the AMA and my own personal experience I bet this guy spends much of his time researching tools, improving his code, testing AV software, and browsing / contributing to "industry" forums. This isn't even taking into account the time he spent upfront before it made him any money.

It may be something he enjoys but it's not as easy as clicking a few buttons every day and watching the money pile up. It's sad to think that all this time could be spent building a legitimate product instead of something like this.

<comment><USER5> Wait until he gets those handcuffs on, then we'll talk about how high the investment in time really was.

Next up: I thought I was hot stuff, now I'm a convict, ask me anything.

<comment><USER26> I think your faith in the justice system (especially considering the technical nature of this redditor's activities) is unfounded.

<comment><USER5> This guy is _begging_ to get caught with the amount of attention he draws. It's a matter of time.

<comment><USER27> Do you think anyone in a governmental capacity will take this Reddit and start an investigation? I'd like to think so, but sadly doubt it. There might be a couple of vigilante efforts though.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> _Magnetic stripes are the most hilarious thing ever, but still work almost everywhere on the globe._

I am amazed that magnetic stripes are still the norm for credit cards in the US. Europe has managed to move all but completely to chip-based cards, but the US hasn't.

Does the cost of fraud due to magnetic stripes outweigh the cost to upgrade the entire US system, or is the market just too fragmented to coordinate such a transition?

<comment><USER29> Credit card fraud is actually a fairly small problem in the US. Wikipedia tells me that the total cost of fraud is 0.07% of the transaction value. And I suspect (without evidence) that the bulk of this is made up of remote purchases, not swiped activity.

Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat. No, they're probably not actually worth it in terms of the cost of upgrading all the infrastructure.

A serious upgrade would need to look at things like two factor authentication, c.f. Google Wallet, etc...

<comment><USER30> "Really, the chip things are an example of security theater. Yes, they're more "secure" in the sense of being harder to defeat"

Absolutely not!

In the US fraud may be small (but it's increasing). But magnetic stripes are _very unsafe_

Chip'n'Pin may have some issues, but it's much safer to most common attacks such as

\- card stripers (very inconspicuous) \- physical theft of the card (because it requires a pin)

And, as someone that had a striped card, it's a pain (even if liabilities are $0)

<comment><USER29> You're missing the point entirely. I'm not saying that chip & pin has no value. I'm saying that the value it has is finite (i.e. it saves money equal to the amount of fraud it eliminates) and needs to be weight against the cost of replacing all the card reader infrastructure. And I argue that the fact the US has not upgraded is an existence proof that the upgrade cost[1] outweighs the savings.

[1] Really the amortized upgrade cost. Remember that chips are dinosaur technology already, and have known problems. What's the point of doing an upgrade if you need to dump it all and start over in 6 years anyway?

<comment><USER30> "cost of replacing all the card reader infrastructure"

I'm not sure how many PoS are already equipped to deal with chip cards. In the USA/Canada it's hit or miss (most misses), and in Europe it was the standard 10 years ago (but most readers take swipe cards).

Replacing cards is cheap and they can be replaced as they expire

What would be the upgrade cost for each PoS? $100? Some systems are more integrated than others (like card reader integrated with the register as one device) so this may cost more.

Or maybe it's just a matter of issuing the cards to justify the stores to upgrade.

<comment><USER31> My previous U.S. card had a chip. The very recent replacement came without one.

So they aren't really moving in the direction of issuing cards with chips. I never actually encountered a situation where I was aware I could use the chip, over 5 years or whatever it was.

</comment></comment></comment></comment></comment></comment><comment><USER32> Great nugget:

> a US credit card costs 2$ on the black market and a UK starts at 60$, > americans are all in debt.

<comment><USER33> Well this could be because US credit cards are magnetic and UK ones are (much more secure) chip-and-pin cards.

<comment><USER34> Yeah, this has got to be it. Non-US CC info seems much more difficult to acquire, and thus more valuable. And just because Americans are in debt (obviously not all) doesn't mean their credit cards are maxed out.

<comment><USER35> There is however likely a difference in average credit limit on cards of citizens of countries with different economies.

</comment></comment></comment></comment><comment><USER36> There's so many legal ways this guy could make just as much money with his skills. I never understood why someone is willing to put his freedom at risk when that is the case.

I guess he's just lazy or thinks he's incapable of making as much as easily legally, maybe he likes the thrill and challenge of it all, maybe he thinks he's invincible and there's zero chance of him getting caught. Either way he's very foolish for continuing to do this especially if he has no endgame in sight.

<comment><USER6> I have read that in many criminal enterprises it is much like business, where grunts at the bottom have lower income and lots of hours, and most of the risk (exposure). I think this guy is a grunt, probably at the same level of structure of a 2 employee business. when i read through his comments i am struck with the impression that he has passivly attempted legit employment that use the skills he has learned but has not been sucessful yet. he probably has his initial goals set to high. if he starts at the bottom somewhere, given his supposed skill level he should be promoted quickly. just need to put in the time. if not patient enough, put that effort into consulting.

given the real return on his enterprise, i agree with your assesment that he can probably make much more with a real legitimate job and just avoid that risk altogether.

</comment></comment><comment><USER37> The fact that this guy even posted an AMA shows that it's either entirely fake (doesn't seem it), or he's way too cocky. I suspect some trouble may be coming his way soon. He seems to think that he's infallible and that he won't catch a charge for running a botnet.

<comment><USER38> From what he says I agree that he seems either stupid or a liar, but I'm not sure about your premise, it's not hard to post an AMA that can't be linked to you.

<comment><USER39> For the average cyber-stalker, that's true. But I'd wager if some government agency actually wanted to track him down (he's probably too low-value of a target), he's revealed more than enough bits of information about his personal life for them to do so.

<comment><USER40> He is using Tor, which gets a lot of criticism for not being secure but actually defeats Syrian or Chinese governments. If the US can track a hidden service in Tor, they will probably not waste this trump by catching such a small fish.

<comment><USER41> You don't need to crack Tor for that. Get the list of Germans hanging out on Anonymous IRC. Choose only college students. Remove ones that don't have time to do this stuff due to actually working somewhere. Intersect with HBCI users in banks where there aren't many of those. Remove Mac users and Linux users (he mentions he only uses Windows). Remove families that use credit cards (he mentions his family does not). This would already probably end up in reasonably short list. Now amending this list with various other bits of info he left - such as which sites he frequents, which drinks he prefers, which software he uses, etc. I don't believe it should pose any major challenge for a law enforcement agency, even if part of the info is lies - they are used to legwork and assembling small pieces. But probably with his size nobody would bother unless he does something major (i.e. catching him generates a big press-release) or he just hands himself to law enforcement by doing something stupid like drinking too much and bragging about being elite haxor criminal to a female undercover officer. If he just does it for a year and then stops, he has good chances to get away with it, but not because of mighty Tor, but because the law enforcement would never notice him.

<comment><USER18> Is something like a reddit thread enough to arrest someone then? Even the person behind the AMA is tracked down, is that evidence enough to get him in jail?

<comment><USER41> As evidence - of course not. But as means to fin out who that is - sure, why not. Once the person is identified, it is a question of good old survelliance, and they are professionals at that, so chances are the guy will make a mistake, and sooner rather than later, and the hard evidence will be there. Look what happened to LulzSec - once the person is known, if he continues to do what he does, he will lose. Even professional spies can not pull it off if identified, what to say about some college students?

</comment></comment></comment></comment></comment></comment></comment><comment><USER42> It's fascinating to know all this stuff from his perspective but the moral attacks by others in the comments truly suck. What is the point of AMA if all they do is attack the one sharing information.

<comment><USER43> Especially downvoting his comments. Like he cares about karma points. All it does is push all his responses to the bottom or hide them. Then what's the point of an AMA?

</comment></comment><comment><USER44> Great post. I forwarded it on to my family and friends in order to give them some awareness of the people who're looking at them from the other side of the internet. Rather than sending more strident "think before clicking" warnings, this post is a great way to get them to think like an attacker so that they can avoid the attacks better.

</comment><comment><USER45> He's also been a coder for only one year... if he actually modifies stuff, that sounds very impressive.

</comment><comment><USER46> The CVV2 is not recorded in the mag stripe.

<comment><USER10> Ooohh.. so _that's_ why those websites ask for it. Learn something new every day :S

<comment><USER46> They can't store the CVV2 either. Doing so, even encrypted, violates PCI-DSS.

<comment><USER47> So, if you don't care about violating the terms of PCI-DSS, you can store the CVV2/CVC/whatever. I bet lots of places do. In fact, I worked for a Visa Level-1 merchant that had a card processing system that used an Oracle DB table as a queue for outgoing authorization requests. The table held the CVV2/CVC/whatever for as long as it took to get an authorization or a timeout, whichever came first. We passed the PCI audit, even though the auditors knew about it.

Given that there's only 1,000 CVV2 values (10,000 for Amex) isn't putting so much into CVV2 value a bit ridiculous? Someone who really wanted to could get a CVV2 value in only 500 auth attempts on average.

<comment><USER48> The point is that even if someone steals your order database with credit card numbers and expiration dates, they need to try every number 1000 times. That's a decent speedbump.

If you store CVV2 in your database against your merchant agreement, and someone steals it, I'm sure the credit card comp will come after you for the losses.

<comment><USER47> If you're a "Carder", and you've got 1,000 cards, you just try them once a day. You'll get 2 CVV2's a day, average. And a bet that a once-a-day wrong CVV2 doesn't trip very many, if any, fraud checks. How much more is a card worth to a carder with CVV2/CVC than one without? Another niche service to provide in the cybercriminal underground, I guess.

As far as being non-PCI compliant, you as a merchant are only compliant right at the time of the audit. And maybe not even then, given Heartland's experience. The whole PCI thing is to give Visa and MasterCard a way to do some CYA.

</comment></comment></comment></comment></comment></comment><comment><USER23> Now, what has to be done not to get hacked ends up being answered as; AVs won't help, macs won't help, linux won't help, and use ipad? are we heading towards a world where average users will end up in managed computing behind walls, and only some hackers and crackers will use open computing? is computing doomed to be a the black and white world of tyrannic rule vs. mob rule?

<comment><USER49> > linux won't help

? He says Linux does help.

<comment><USER23> but he says, only because it is not much common, and different distros are too diverse to justify an "investment"

<comment><USER49> Yes, the reasons are not very impressive ones, but nonetheless.

<comment><USER50> <http://en.wikipedia.org/wiki/Security_through_obscurity>

<comment><USER51> I don't see the relevance. Linux is no good target, because there are not many linux boxes compared to windows/mac and because 100 linux boxes might require 10 different ways to attack them, while 100 windows boxes might require 1 or 2. There is nothing obscure here, just diversity.

<comment><USER52> Diversity is always a good tacit in defeating pest. Learn from nature / biology. Monocultures are unstable and have to be superficially stabilized with great effort.

<comment><USER23> similarly the guy says, he creates variations of the code in order to avoid detection. a world where hunter and the hunt all diversify.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER53> My favorite bit so far:

        if you know how your computer is beating inside, you are hard to fool

</comment><comment><USER54> He says he has no respect for the security industry and AV companies. He makes compellling arguments against them.

Then when asked about his future, he says he plans to work for an AV company!

WTF?!

He can see what's wrong, but he can't do what's right.

And that, my friends, is the problem.

<comment><USER55> If you want to do this for the rest of your life you have no choice than working for a security firm (AV included) or being a criminal.

The problem is why he didn't get that job at Kaspersky. He is obviously skilled so what happened?

</comment></comment><comment><USER56> The thing that's scary is how easy it is for these people to get away with what they're doing. I wonder how much money is lost every year and how many hackers you never hear about going to jail for this stuff. I'm pretty sure this is the motivation to do a lot of this stuff. The risk/reward level is completely slanted.

I see a LOT of stories on HN and other Tech sites about these kinds of attacks. Unfortunately, I rarely, if ever, hear about hackers getting arrested for this sort of activity.

</comment><comment><USER57> WTF</comment>


People with ADHD are twice as likely to die prematurely - <AUTHOR> http://www.sciencedaily.com/releases/2015/02/150225205834.htm?utm_source=dlvr.it&utm_medium=tumblr <comment><USER2> Related: "This study suggested ADHD to be present among 40% of adult male longer-term prison inmates"

[http://www.medscape.com/viewarticle/735382](http://www.medscape.com/viewarticle/735382)</comment>


Ask HN: What are some good videos on real implementations of distributed systems - <AUTHOR> I recently watched https://www.youtube.com/watch?v=yvBR71D0nAQ and really liked the video. I am wondering if there are other videos on some large scale distributed software used at enormous scale, and how they work. <comment><USER2> Most of the real world distributed systems would have some videos in some conferences: Spanner: [https://www.youtube.com/watch?v=IfsTINNCooY](https://www.youtube.com/watch?v=IfsTINNCooY)

Chubby: [https://www.youtube.com/watch?v=PqItueBaiRg](https://www.youtube.com/watch?v=PqItueBaiRg)

Anything Leslie Lamport: [https://www.youtube.com/watch?v=-4Yp3j_jk8Q](https://www.youtube.com/watch?v=-4Yp3j_jk8Q)

[https://www.youtube.com/watch?v=kYX6UrY_ooA](https://www.youtube.com/watch?v=kYX6UrY_ooA)

Also the Distributed system course at MIT is fantastic. The labs are also great way to get your hands dirty with distributed system. The link to the class schedule is here: [https://pdos.csail.mit.edu/6.824/schedule.html](https://pdos.csail.mit.edu/6.824/schedule.html)</comment>


Tools to make your small business look bigger - <AUTHOR> http://www.nytimes.com/2011/03/03/business/smallbusiness/03sbiz.html?_r=2

<comment><USER2> Dup: <http://news.ycombinator.com/item?id=2281544></comment>


Facebook makes HipHop for PHP open source - <AUTHOR> http://developers.facebook.com/news.php?blog=1&story=358 <comment><USER2> _"HipHop for PHP isn't technically a compiler itself."_

...

 _"HipHop programmatically transforms your PHP source code into highly optimized C++"_

Sounds like a compiler to me. Compilers don't have to target machine code.

<comment><USER3> Exactly my thoughts. To further support your statement, theoretically, it should be possible to create a CPU that interprets C++ source code as machine code (not sure why would anyone do that though.)

<comment><USER4> By that logic then PHP itself is also assembly because someone _could_ make a machine that executes it natively. We might as well throw all distinctions away if we go down this road.

<comment><USER3> I'm not sure if I understand what you're trying to suggest. Indeed, someone could make a machine that executes PHP natively. It's a Turing-complete language, just like C++ or x86 assembly for that matter so it should be possible to build a (weak) universal machine that executes them directly.

<comment><USER4> My point is that what someone _could_ create shouldn't have any bearing on the discussion. They are using c++ as an intermediate language, fine. Just because we could make a machine that executes it shouldn't alter that distinction. We can still call that compiling, but hypothesizing new machines doesn't help.

</comment></comment></comment></comment></comment><comment><USER5> Remember when the meme was "%90 of web apps will not reach a point where scaling is an issue"? Well, of those who do reach it, %90 will not reach a point when PHP's execution (assuming you use on of the existing code accelerator, all which are free IIRC and one will be bundled with PHP6) is the bottleneck.

It's a cool hack, but really targets Facebook-level needs. For most users, the downside (eg compatibility issues) will far outweigh the benefits.

<comment><USER6> Actually it's an efficiency gain, rather than scalability. Facebook already have a system they can add more servers at, but this is designed to let them use less and save money as a result.

Also at least 90% of web apps are tiny or are startups that never made it, either way they don't need this for a long time, like you say.

<comment><USER5> efficiency -> scalability, in the sense that serving the request faster will free the server to serve another request.

My point is that for nearly all apps, executing PHP is very small part of the total request handling time, so even a significant improvement will have little overall effect. I bet many people excited by HipHop could get a much bigger performance gain by adding some simple caching)

<comment><USER6> Not really, that type of efficiency is not predictable.

From Wikipedia: "scalability is a desirable property of a system, a network, or a process, which indicates its ability to either handle growing amounts of work in a graceful manner or to be readily enlarged. For example, it can refer to the capability of a system to increase total throughput under an increased load when resources (typically hardware) are added."

<comment><USER5> I realize we're nitpicking, but I don't really get it: Why isn't it predictable (in the sense that any execution time for an HTTP request ever is)? You run http_load for x seconds and see how many requests got served, then make change y and do it again. Obviously there are other variables but it's possible to get a fair idea.

<comment><USER6> Because as you described you have to try it to find out how much it will save you, by which point you could probably just roll it out already.

Say you have 10 servers now and you expect business to grow by 10x in next year, so you put 6 months of dev. time into implementing caching. Then you get 10x the traffic in a month and you get V.C. investment as a result. You then have a problem, people are getting a bad experience and the development won't be done for another 5 months. Your CEO buys a rack full of servers, but you can't do anything with them because you don't have a scalable system. Alternatively you could find out after 6 months that you can't make that 10x performance jump after all.

Twitter had this problem a while back, essentially their DB server got overloaded but it was already a 8 CPU, 64GB machine and despite having lots of money they couldn't quickly solve the problem, because you couldn't really get a bigger system.

Facebook knows how to scale, they want to cut costs where they can to become (more) profitable.

</comment></comment></comment></comment></comment></comment><comment><USER7> Some details not in the official announcement:

Currently works off of the PHP 5.2 language specs

Compiles to a stand-alone libevent-driven web server or CLI executable

Not based on Zend's runtime/code

Currently no windows support

Intended for 'drop in' PHP replacement - if it runs on PHP and doesn't use a few things like eval() it will compile with HipHop

<comment><USER8> Did they reimplement the entire standard PHP library bug-for-bug in C++? I'm curious about that aspect of it..

<comment><USER9> Why would they need to do that? The standard library is a mix of PHP, which they can already handle, and C, which doesn't have to be rewritten.

<comment><USER8> First, they didn't call the PHP standard library: the poster of the root comment we are replying to has stated they didn't use the Zend runtime or code.

The PHP standard library has a huge number of functions that are mostly useless permutations of one another. As opposed to, say, Erlang's meager but usable lists and string module, PHP has such high-level meta-randomness as stristr() (case-insensitive search), str_word_count(), and str_shuffle(). So if you were going to convert that directly to C++, there wouldn't necessarily be a direct replacement in strings.h. Therefore I'd guess they either have to reimplement all of those in PHP, and compile that to C++, or write them in C++. Furthermore, some of these functions have unusual quirks, so some kind of framework would be required I think.

<comment><USER9> I'm sorry, that's indeed what the root comment said. Thanks for the correction.

Still, I imagine they must use a lot of the same code - half the PHP standard library is just a thin wrapper of some C library, and reimplementing all of them sounds stupid.

Then again, they may just not support the majority of such libraries.

</comment></comment></comment></comment></comment><comment><USER10> So it converts PHP into C++?!? Woaw.

Didn't people accuse Joel Spolsky of jumping the shark for doing that kind of thing (Wasabi script => php or vbscript).

.....wait this means that Wasabi can now technically convert into C++! :D

<comment><USER11> I think where most people chokes on Wasabi is the perception of compiling from an "insane" language to a sane language. No matter how cool it is to work at Fog Creek, it's very 1965 to work in a proprietary language, especially for web development. If Joel wasn't famous, anyone leaving Fog Creek would have serious problems finding a new job.

Facebook compiles from a "sane" language (PHP) to a less sane, but twice as fast language (C++). The alternative was to get their devs to work in C++, which they decided was an unattractive solution -- this seems reasonable.

<comment><USER12> > _from a "sane" language (PHP) to a less sane, but twice as fast language > (C++)_

C++ is much faster than PHP, not just twice as fast.

<comment><USER13> Languages aren't "fast" or "slow", it's programs that can be fast or slow.

If a higher-level language lets you implement a smarter algorithm, your program will run faster.

<comment><USER12> > _Languages aren't "fast" or "slow", it's programs that can be fast or slow._

We can say that "C++ is faster than PHP", because most, if not all, programs using the same algorithms will run faster when written in C++ and compiled to native code.

> _If a higher-level language lets you implement a smarter algorithm, your > program will run faster._

PHP is generally easier to master than C++, but both are high level enough to provide adequate tools to write efficient algorithms with comparable amount of effort, provided one is competent with the language at hand.

</comment></comment></comment></comment></comment><comment><USER14> I see this as being useful if you already have these two things:

1) A large PHP codebase and

2) A CPU-bound app with scaling issues

If you're starting a new app, I don't see why you would choose PHP. And I think most web apps are database-bound rather than CPU-bound. HipHop seems incredibly useful for Facebook, but are other people here on HN excited about using it?

<comment><USER15> I think this is where many run into issues with this story. This project was never really meant to be something to help the PHP community as a whole. It was meant to be a tool to help Facebook and to that end they've succeeded very well. 3 engineers + 2 years = 50% CPU improvement without having to rewrite the whole PHP codebase from scratch? That's a great achievement for Facebook but YMMV.

<comment><USER16> Seriously. $100k * 3 devs * 2 years = $600k to buy half as many app servers in the next year(s)? They saved Facebook tens of millions of dollars. I should imagine their next performance evaluation will be quite smooth.

This is what people mean when they talk about great hackers being 10x as productive...

<comment><USER17> It would have been a great freedom for the devs, at a company of facebook's size it wouldn't have been disastrous had they not really achieved a great enough performance boost to justify it's use.

</comment></comment></comment></comment><comment><USER18> This sounds rather similar in principle to Python's Shedskin compiler, which turns ordinary Python code in C++ code, using C++-based runtime replacing the ordinary Python runtime. This works extremely very well on a certain class of problems. <http://code.google.com/p/shedskin/>

</comment><comment><USER19> Does this make more sense than targeting LLVM? It doesn't seem easier to maintain, and you won't get the advantages of the optimizations/work already done.

<comment><USER20> According to the Unladen Swallow's team [1], LLVM's "just-in-time infrastructure was relatively untested and buggy" when they started working with it. So, I think not using LLVM was a pragmatic decision. In addition, debugging C++ code is much easier than dealing with intricacies of dynamically generated machine code.

[1]: [http://www.python.org/dev/peps/pep-3146/#performance- retrosp...](http://www.python.org/dev/peps/pep-3146/#performance- retrospective)

<comment><USER21> Yes, but it's not now. Unladen Swallow isn't exactly alone in blazing this trail, Rubinius is using LLVM as well.

<comment><USER22> Also Lua: <http://code.google.com/p/llvm-lua/>

</comment></comment></comment></comment><comment><USER23> I wonder if it'll let you convert things out of the box or if it was optimized for the way php is written at facebook. (eg. it doesn't support eval() but eval() is bad anyway)

Also, how hard would it be to do the same thing for Ruby and Perl? I'm sure there have been other attempts at compilers, but as noted elsewhere, having FB behind it makes HipHop more stable...

Oh, and atleast one thing from this anonymous interview came true: [http://therumpus.net/2010/01/conversations-about-the- interne...](http://therumpus.net/2010/01/conversations-about-the- internet-5-anonymous-facebook-employee/?full=yes)

<comment><USER24> I wrote a PHP->C++ compiler and bits and pieces of the standard library many moons ago (BinaryPHP: <http://sourceforge.net/projects/binaryphp/> ), and it really wasn't terribly difficult, even for a complete compiler novice. We didn't do the fancy optimization that HipHop does, but it worked fairly well at the time. The actual compiler would probably only take a month or two (disregarding real optimizations) for a talented developer or two, but the runtime (assuming it doesn't share anything with PHP proper -- don't know if this does or not) would take much, much longer.

Doing it for Ruby or Python would be fairly straightforward to get running initially, but doing Perl<=5 would be impossible (for all cases) due to it being proven impossible to statically parse.

<comment><USER25> You can compile any code - full static parsing doesn't have anything to do with that. If you have a place that is not possible to parse one way, you do a switch on the condition that causes the parsing choice. Then you compile each branch assuming that code was parsed in a specific way.

</comment></comment></comment><comment><USER26> I really could not justify not doing web stuff in PHP anymore. PHP is THE web language. No, Ruby is not going to take over, and no, python is not going to take over.

Those two would have been the main contenders for the space, but they both had their shot and their 15 minutes of fame, and rather than rapidly growing to dominate web development, they nichified.

PHP however is being improved, being cleaned up, and most importantly, being speed optimised.

PHP is what you can trivially easily outsource - try to do that with python or ruby.

This right here is basically the move that is going to cement PHP as the web language. The largest sites are using PHP and are going to stay with PHP. Nothing will take over from PHP. The battle is over.

<comment><USER27> I don't agree with you, but I find it sad that your comment has been voted down below 0. Is this what HN has come to? We just vote stuff we don't agree with down?

<comment><USER28> That's the point of the karma system.

<comment><USER29> I can't tell if you're trolling, but that's not the point of the karma system; that being to vote up "good contributions" that you would like to see more of at HN and vote down "bad contributions" which you would like to see less of at HN, regardless of whether you agree with them or disagree with them.

</comment></comment></comment></comment><comment><USER30> This is truly the PHP solution to the problem. Design a virtual machine that uses runtime information to generate highly-optimized native code? Nahh.... just regex the source into C++, compile with g++, and enjoy!

(To be fair, some language implementations have achieved good results with this method; notably Chicken scheme. But I was expecting something better and potentially more useful to the language implementation community at large.)

<comment><USER31> C++ is known to be fast, so what advantage could a more complex solution provide?

<comment><USER30> Not having to wait fifteen minutes for your app to compile and link, for one thing. But seriously, the C++ implementation comes at the cost of many of PHP's features; a "more complex solution" would allow those features to be kept. And while C++ is fast, a script translated into C++ is not going to be as fast as if you had written the application directly in C++, unless the compiler is very, very smart. (I have not seen any implementation that does this; GHC's native code generator produces faster code than it's "via-C" code generator, for example.)

Also, static compilation precludes runtime-based optimization techniques, which has made a lot of code run "faster than C" (including C, ironically; see LLVM).

So anyway, all this is is a way to compile a limited subset of PHP to C++. In doing so, you have to write a special dialect of PHP, without PHP's easy deployability and code/test/debug cycle.

In that case, why are you using PHP to begin with, when a language like GHC or SBCL would run faster and without any compromises?

<comment><USER32> Not even the Linux kernel takes 15 minutes to compile and link anymore. My desktop machine does it in under 10 minutes, but I realize you weren't being entirely serious.

<http://xkcd.com/303/>

</comment></comment></comment></comment><comment><USER33> It seems odd to me that anyone thinks PHP is "easy".

The syntax is odd, as is the behavior of the built-in functions (many retain seriously warts from older versions of PHP)

It's "easy" in the sense that you just edit one file and the webpage changes, but if that's a stumbling block for your developers then you have bigger problems.

<comment><USER34> It is really easy if you already have experience with C++. Also, it is not very different from UNIX shell, and it is clearer than Perl, so I don't get why people complain so much about it.

<comment><USER30> Everything is easy if you have experience with C++.

I fail to see how PHP is clearer than Perl. It may have fewer special characters, but everything is done with oddly-named functions that take positional arguments in an inconsistent order, return error codes instead of throwing exceptions, and randomly spew warning messages.

From a language design standpoint... there is no design. Perl may not be perfect either, but the design has been flexible enough to radically modify as the community sees fit. Or rather, how _you_ choose to modify it, as most modifications are modular and only affect a single lexical scope. Oh.

<comment><USER35> > everything is done with oddly-named functions that take positional arguments > in an inconsistent order, return error codes instead of throwing exceptions, > and randomly spew warning messages

These are all anti-features for programmers who already know how to program but they're quite helpful or moot when you're a complete noob. You're going to be spending at least a third of your time in the manual so guessable function names aren't as important as findable ones, you'll be doing lots of "what the?" style debugging so verbose warnings right on the page save you one fewer step in the debugging process.

Additionally it's easy to find a PHP hosting provider for peanuts, it will happily scale to moderate use without overmuch cleverness architecturally and there are literally thousands of noob-level tutorials that get you from "I want to build a website" to something that works rapidly. You don't feel the pain of the language until you're pretty far down the road but as Flickr and (obviously) Facebook have shown it's not too difficult to limit the pain and keep growing.

</comment></comment></comment></comment><comment><USER36> Hmm, this is one of those rare occasions where something has been released where I have a domain name that could be useful - hiphoperator.com

Now I just have to figure out what to do with it :D

<comment><USER37> at least 1 youtube video

</comment></comment><comment><USER32> I can't wait to try to try this out on a large PHP codebase like Drupal and then run some benchmarks. It'd be interesting to see how much faster it is when compared to vanilla PHP vs opcode cached PHP.

</comment><comment><USER38> I am sad to see Facebook helping to perpetuate PHP.

On the bright side though, even if HipHop yields a 50% speedup, it is unlikely to be faster than Python, Javascript V8, or LuaJit.

[http://shootout.alioth.debian.org/u32/chartbox.php?s=eNo9ktu...](http://shootout.alioth.debian.org/u32/chartbox.php?s=eNo9ktuRxTAIQ1viDarC%2FXezYm%2Fs%2FJyBQYBwUkPgJz%2FY5BBevRFqyk4JWuYikWFxUvZ7gHTHKS0HToVG56k2A5Pwnri6MkDswQc7IZBDXeVInZopz9NibfJ0qrYlH1x05dnRSkFN9GkdhB2mZHbdUMfKveKidLKbg1xmJ6h5nfZCCQGUU%2FdzxBrTCyZBD7tg6OpiKFDGD1fnqRkX5e7gnt3YCGOMmteZh7tnBKIeYI69BI8UrBTTf38menHntbL3xZ416AE0Rp2E59AY36Yv7j1Fe%2BSB29YaY1duZlA26wrnX9BsbfPN%2BwOA6XrK&m=eNozMFJwS01SMDIwNFAoNTYCABs7A20%3D&w=eNrLKU3MyizxL7PwzylN9M8qKk2q9K9MLCrzL6gsycjPM4bS%2FgUZBf4FqUU5%2FiAVAD2BFWM%3D)

 _edit_

What's with the downvotes? I can't mention my opinions on php?

<comment><AUTHOR> Use your imagination. Perhaps other languages can be compiled down with HipHop. Perhaps other languages can call PHP libraries compiled with HipHop. Then you might have an end to end solution to transition from PHP to Python.

This is obviously just a fantasy of mine. Back to coding PHP...

<comment><USER38> > Perhaps other languages can be compiled down with HipHop.

There's already something like HipHop for Python called Cython. You can compile any pure python code into a static C shared library (with the exception of generators).

<comment><AUTHOR> I suspect for interoperability, using a single framework is the most likely to succeed. But this is the whole point of open source, right? Let the community enhance it in awesome ways.

<comment><USER39> Are you serious? A magical framework that translates PHP/Python/etc into C++ code? I've got to be misinterpreting what you're saying...

Then again, you might be drinking a bit too much of that Facebook juice... :)

<comment><AUTHOR> Yes, I can easily imagine even people outside facebook adding to the HipHop effort in adding other languages. Easily imagined and easily executed aren't the same thing, unfortunately. By the way, I'm out of my element when it comes to compilers.

<comment><USER39> I can imagine it really being a very open project with outside contributors, but I'm not sure that the exact same tools will work with other languages.

For example, I think that dealing with something like Python would require a completely different set of translations because it is mainly dictionary based.

That's not to say that doing an X to C++ converter isn't possible or a good idea, I just think that the HipHop techniques may not apply to other languages very easily.

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> GitHub were crushed by the release of HipHop. Too bad, I wished to test the HipHop translator.

<comment><USER41> Their file servers crashed before the Hip Hop announcement, and Hip Hop hasn't even been pushed to GitHub yet, according to this announcement.

<http://twitter.com/github/status/8551643423>

</comment></comment><comment><USER39> So, does this mean that PHP has officially forked? I mean who is going to want to keep writing in the interpreted version as opposed to the hiphop-able version? How many changes are there? I've only seen mentions of ditching eval, but there is probably more. Will people be debugging their code in both vanilla PHP and HPHP?

How well does this support other projects, like wordpress (for example)?

Another issue this raises is who is now in control of PHP? Not in legal terms, but in terms of mindshare. It's one this for a student to write a PHP translator, but quite another for Facebook to do it. I'll be interested to see how Zend responds to this. At least when Google started unladen swallow, they had Guido working for them.

<comment><USER42> No, you'll probably see no changes in your day to day life as a result of this. There's no "interpreted version as opposed to the hiphop-able version", in terms of the code you write.

As the article mentions, almost no one is really running straight PHP, they're running it through FastCGI or are at least using an opcode cache like APC. So you could be swapping out APC for HPHP, but this is at a level of abstraction below the one you're working in.

Regarding future control of PHP, this does not change anything. Its a compiler for the language, but does not propose any changes to the language itself.

<comment><USER39> _you'll probably see no changes in your day to day life as a result of this_

I'm fairly confident about that... I gave up PHP years ago :)

</comment></comment></comment><comment><USER43> Where is the link to download it or just the documentation? On the announcement page there is only a Wiki link (besides wikipedia entries and other php-to-other-lang compilers) to a Github page that redirects to the github.com.

</comment><comment><USER7> Some notes from Facebook's UStream event this evening: [http://www.recessframework.org/page/notes-from-facebooks- hip...](http://www.recessframework.org/page/notes-from-facebooks-hiphop-for- php-debut)

High points:

the performance numbers were against PHP _with APC op-code caching enabled_

eval, create_function, and preg_replace with /e (basically eval), and conditional flow based on the existance of functions are the only features not supported.

Currently PHP5.2 with a roadmap of 5.2.12 compliant in the next month and 5.3 being the focus after that.

</comment><comment><USER44> What CGI mechanism are they using to host a blended PHP/C++ code base?

<comment><USER7> "It has it's own built-in web server when you compile it, via libevent." from Ben Ramsey who attended the demo at FB Campus.

</comment></comment><comment><USER45> _With HipHop we've reduced the CPU usage on our Web servers on average by about fifty percent, depending on the page._

Hmm. I'm guessing they're comparing it to their PHP stack that has already had the living daylights optimized out of it (with cached bytecode, etc.) and/or a large proportion of their pages doesn't hit much code (lots of stuff cached?). I'd have thought there would be more mileage in this.

</comment><comment><USER46> After this, can we still make fun of C++? I use it daily and love it. Sure, it takes someone with a brain to use it, but once you learn C++, nothing else comes close for speed and expressiveness... seems FaceBook just verified that. So while people who cannot code in C++ will still talk about it as if they know it, it continues to kick ass in solving real-world computing problems

<comment><USER47> Facebook appears to be using C++ the way C++ devs use assembly. We can definitely continue making fun of it.

</comment></comment><comment><USER48> How templatey is the generated code? How big are the resulting binaries?

Amazon's original core platform (obidos) was written in C++ and deployed as one monolithic binary. I've heard that one of the major things pushing their Java rewrite (dp) was that the binary no longer fit comfortably into memory!

<comment><USER49> Just curious, but how is Java going to solve that problem? Now you've got the Java opcodes, plus any JIT information/native code, plus the JVM. Seems like that would be even larger!

</comment></comment><comment><USER50> Will Wikipedia, Wikia, and other major MediaWiki sites use this? (Does MediaWiki code use eval()?)

<comment><USER51> I would bet that Wikipedia is more database bound than CPU bound. HipHop would probably help, but not tremendously.

<comment><USER52> You reckon? I would have thought Wikipedia a textbook case for a great big cache. I would have guessed that the great majority of their views were read- only by unregistered users, with the pages in question following a power law distribution. Hm, would be interested to find out more about that.

update: I went and looked it up. They do indeed have a great big cache, many of them in fact. In fact their Amsterdam presence runs _only_ cache! From what I can tell, it seems their bottleneck is actually Apache, and presumably a lot of that is PHP.

Interesting presentation here: [http://wikimania2009.wikimedia.org/w/index.php?title=Media:R...](http://wikimania2009.wikimedia.org/w/index.php?title=Media:Rob_Halsell_- _Wikimania_2009_-_Wikimedia_Operations_%26_Technical_Overview.pdf)

Also check this out: [http://ganglia.wikimedia.org/pmtpa/?gw=fwd&gs=Wikimedia%...](http://ganglia.wikimedia.org/pmtpa/?gw=fwd&gs=Wikimedia%40http%3A%2F%2Fganglia.wikimedia.org%2F)

Go down to the MySQL section. Plenty of headroom, but the Apaches are working hard.

</comment></comment></comment><comment><USER53> So... stupid question - Where's the code? It's the next day and no sign of it on github.

</comment><comment><USER54> It would seem they forgot to make the project public on github.

<comment><USER55> Third paragraph from the bottom of the post says they'll be releasing the source in Github this evening (probably pacific time).

<comment><USER54> Ahhh, they should have held off on that wiki link.

</comment></comment></comment><comment><USER56> If this makes a big difference to memory footprint, won't it be rather handy to embedded devs?

</comment><comment><USER57> If this is adopted widely hosting costs will drop off considerably, no?

</comment><comment><USER58> Will this be faster than less say... python?

</comment><comment><USER59> They probably just use a python script and type

from php import cppCompiler

not sure why that took 2 years

</comment><comment><USER60> Damnit - a cool project name wasted on a php to c++ compiler?? DJ Kool Herc is disgusted with Facebook.

</comment><comment><USER61> Facebook's lack of engineering prowess continually amazes me.

There were quite a few other options aside from writing a translator.

<comment><USER52> Are you living in an alternate universe? Facebook are scarily competent. They have executed brilliantly and their engineering is top notch.

<comment><USER61> Really? You mean like their ultra-reliable chat server they wrote?

Or maybe the way their replication works, so when you post things get out of order depending on what server you are looking at?

<comment><USER52> With criticisms like that, I think your expectations are unrealistic. Considering the size of their userbase, their chat server is quite an accomplishment. And minor replication artefacts are hardly a big issue.

In short, if FB had incompetent or even "just" competent engineering, they would not have close to 400 million users. And yet they do, and I have never noticed the site performing slowly. They're not Google, fine, but they have an excellent team and if you're not impressed by their performance I wonder what you would be impressed by.

<comment><USER61> Having a large user base is not an indication of technical authority.

Myspace had (and still does to a lesser extent) extremely large user base, and we know they had some stability issues (Honestly though, I've listened to their tech presentations and am more impressed than the things I've seen Facebook do).

No, I don't imagine Gacebook is programmed by a bunch of incompetent monkeys, but compared to Google, Amazon, Yahoo, or many other companies that have had to deal with large scaling issues, their approach seems amateur.

</comment></comment></comment></comment></comment><comment><USER62> "300,000 lines of code and more than 5,000 unit tests."

Both values sound good in theory, but are both meaningless. How is the code coverage? How many man months? How many developers?

<comment><USER63> I find it ironic that you feel LOC is meaningless and then asked for man- months, an even more useless unit of measurement :D</comment></comment>


Show HN: Siftery Trending Products - <AUTHOR> https://siftery.com/trending <comment><USER2> It's always interesting to see what tools people are using, but to be honest I was a little disappointed that everything on the list is a well-established, already popular app. I was hoping to see more in the way of new and up-and- coming stuff. In other words, I don't gain anything if a website tells me GitHub, Slack, and Sketch are popular.

That said, I think the overall problem of productivity/business software discovery is one that will grow in the coming years as we see a shift away from traditional enterprise dev and sales and towards a more consumer-like model. And Siftery is smart to try to build buyer trust and own the buyer side of the equation. We may well see a lead gen industry emerge in b2b software that looks a lot like the lead gen industry for consumer products like, say credit cards.

<comment><USER3> Interesting thoughts! We're definitely trying to strike a balance between reliability and short-term popularity. One of the ways we're trying to solve is by every day pushing up "wildcard" products that are getting traction.

Another of our bets is that since a user can only recommend a product once, over time the more obvious products should find it relatively more difficult to get new recommendations and newer products will surface.

This effect might become more noticeable with some filters (e.g. recommendations only from YC companies).

<comment><USER4> IMO you need two lists: "Popular Lately" which is what this list is now, and ALSO "Trending" which is sorted by some measure of recent growth.

That way up and coming stuff doesn't have to dethrone github/slack/etc in order to get seen.

<comment><USER3> Separately, one thing I'd be excited about is filtering by users at companies in a certain grouping (e.g. by Geo, industry, or some other affiliation like YC or 500 Startups alums). Siftery can do this since users have verified business e-mails.

Does this sound interesting?

<comment><USER2> Slicing and dicing in that way by geo, industry and whatnot, would be very interesting as someone looking to build and sell software. It's always really helpful to know what different kinds of prospective buyers are currently using - and if they're excited about it or not.

As a prospective software buyer, however, it doesn't necessarily sound all that interesting. I mean, so what if a lot of companies that are in a similar location and industry to mine use Bitbucket. That doesn't tell me if it's actually great or if they just don't know any better. And if fin-tech companies that went through YC love using Aha for product roadmapping, it's kind of the same thing - what does that really mean?

That said, I can see some situations where it would be interesting. If I'm looking for software that has intense compliance or performance requirements, then know what other people in my industry use would be helpful - so I would know that I'm making a reasonable decision.

Also, what would be super interesting would be knowing what software transitions/replacements people have made. For example, if I'm using JIRA and not really loving it it would be really cool to know what people who have left JIRA have used to replace it. A lot of times I've found myself not entirely satisfied with some work/productivity app and wondered if there's a better option out there, but then found it can take a lot of research and experimentation to answer that question so I just go back to the status quo. Seeing that a lot of people have happily made a transition I'm considering - or maybe a slightly different one - would be cool. Of course, you may well not have that kind of information for a long time.

</comment></comment></comment></comment></comment><comment><USER5> From the "how does this work"

> How do products trend? What causes a product to trend? Products are ranked > based on the number of users who have recommended the product in the past > month (we're using a rolling 30 days).

Ok so this isn't trending, it's popularity. Typically you want to normalize such that items with evergreen popularity get sifted out and you're left with items growing in popularity.

A marginally better approach might be to look at % of like growth month over month, with some floor of likes so that going from 1 to 100 likes doesn't dominate. This isn't perfect but it should kick google drive, Dropbox, and git out of the list.

<comment><USER3> We're looking into ways to improve the ranking, so thanks for sharing that teej. We actually started with a normalized and more complex algo that was more along the lines of what you suggest, but the resulting feed had mostly random products and was not very helpful for more casual users. It also made it difficult to understand _why_ a product was ranked. I think you're right that as it stands, we can do more to surface younger products. So far, we're doing it manually with "wildcards".

I mentioned in another comment that one of our bets is that since a user can only recommend a product once, over time the more obvious products should find it relatively more difficult to get new recommendations and newer products will surface.

e.g., if we did a filter of recommendations by YC companies (or more extreme - YC founders), then something like Slack would be popular the first month, but then have few remaining votes. Thoughts?

<comment><USER5> You need to separate the concept of popular and trending. Make two lists. Have a popular list at a couple fixed time grains - all time, last year, last 30 days (what you have now). Then for your trending list use a z-score like described in this stack overflow post [0] to normalize. I honestly wouldn't invest a ton of time trying to do something fancier then that. You're trying to rank with one signal, you can't expect computers to perform magic.

I'd also consider a third list - highlighted. Have your team internally pick something new and interesting once a month. Finding novel and interesting things is something humans are really good at.

[0] - [http://stackoverflow.com/questions/787496/what-is-the- best-w...](http://stackoverflow.com/questions/787496/what-is-the-best-way-to- compute-trending-topics-or-tags)

<comment><USER3> Thanks. Great link. It does seem that having multiple feeds is emerging as a consensus suggestion.

</comment></comment></comment></comment><comment><USER6> I like the idea of a social network of businesses first, individuals second.

The problem in this space (usually encountered when typing "Quickbooks Reviews" or "Quickbooks vs Xero") is the results do not feel trustworthy, mainly because there is no provenance of the reviewer. It feels like the reviews can be bought.

If you can build a high quality review and dataset, that answers detailed questions about the product in an objective fashion, that would be very useful.

<comment><USER2> I agree.

> It feels like the reviews can be bought.

I assume Siftery's business model depends on getting paid by software companies when a prospective buyer makes a purchase after visiting Siftery. Maybe it's more advertising-based though? (Siftery folks, please correct me if I'm wrong).

Like all affiliate marketing, there's a fundamental tension between maintaining customer trust by actually making good, honest recommendations and maximizing profits by directing consumers to products whose makers are willing to pay more. A lot of affiliate marketers start out very consumer-focused in order to build a strong brand that consumers trust. They later find it very hard to resist the temptation to maximize revenue by making bad but profitable recommendations later on. Of course that will catch up with them eventually, but they can exploit the inertia of a trustworthy brand for a while.

All of that said, hopefully Siftery will be able to provide good, consumer- focused information. There is real pain point around learning about this kind of software.

<comment><USER7> > A lot of affiliate marketers start out very consumer-focused in order to > build a strong brand that consumers trust. They later find it very hard to > resist the temptation to maximize revenue by making bad but profitable > recommendations later on.

spot on! this is one of the reasons why we want to entirely avoid any sort of lead-gen or affiliate business models that depend on revenues from sellers of software or services. we're planning to make money from buyers with higher value tools that help them after the discovery phase -- for example, providing insights into pricing, helping automate the RFP process and potentially helping them manage billing etc. early days though!

</comment></comment></comment><comment><USER8> I don't understand what problem is this solving. Another ProductHunt?

<comment><USER3> With PH there are some similarities (both are product feeds after all), but substantial differences in the feed mechanics and results. Siftery's ranking is based on recommendations coming from verified business users and the products listed all have business use cases. Products also have a persistent identity (i.e. a new one is not created each time a product is created).

Ultimately, the are different products at the top of each feed, as would be expected from their different use cases and different (if to some degree overlapping) audiences.

We think Siftery Trending is a place where b2b products can go after launching and "graduating" from a community like Product Hunt. One way we're thinking about it is that Product Hunt is to high school what Siftery Trending is to college. There's a time and place for both!

That's my take, but additional thoughts/feedback appreciated.

<comment><USER9> I think [https://founderkit.com](https://founderkit.com) is a better comparison to what you are providing than product hunt. I agree Product Hunt seems to target consumers more, whereas Siftery and Founterkit are providing a service to businesses and founders.

One thing I would find of value is a means for differentiating all of the different services being reviewed. I think everyone knows that slack is the foremost business chat app, etc. But what are the specific things that make the app at #2 different that I might be looking for that would make me chose it over what's in the #1 spot.</comment></comment></comment>


When a Unicorn Startup Stumbles, Its Employees Get Hurt - <AUTHOR> http://www.nytimes.com/2015/12/27/technology/when-a-unicorn-start-up-stumbles-its-employees-get-hurt.html?_r=0 <comment><USER2> Extensive previous discussion:

[https://news.ycombinator.com/item?id=10783711](https://news.ycombinator.com/item?id=10783711)

<comment><USER3> Thanks for the link.

</comment></comment><comment><USER4> This is from 2015 - should be reflected in the title.</comment>


How Not to Advertise on the Internet - <AUTHOR> http://www.codinghorror.com/blog/archives/001286.html

<comment><USER2> Not knowing more about Evony's business model, I think this is likely an example of optimizing for the wrong metric - in this case clicks versus conversions. The creator of the last ad is probably thrilled that it's "performing" better than the earlier ads, although I'll bet the actual return on investment is the same or worse.

On the other hand, if the site is ad-supported in addition to the freemium model mentioned in the article, this _is_ a way to drive up the number of unique visitors in their traffic stats.

<comment><USER3> for all we know the clicks are translating into sales. I mean why else would they slowly optimize it for more boobs?

I imagine it worked something like this:

"check out this civilization like game" = 20 clicks, 1 signup

"BOOOOOOOBS!" = 500 clicks, 2 signups

It may not be targeted advertising, but if it gets them twice as many signups, you can't say it doesn't work.

<comment><USER4> Dealing with 500 clicks can be a lot more expensive than 20, especially at that conversion rate. Bandwidth, support, contact, etc.

<comment><USER3> 500 clicks for a landing page costs pennies

</comment></comment></comment></comment><comment><USER5> Their target audience is probably

a) Male

b) Bored

c) Not so jaded that they won't click on ads or try something new

d) Interested in rts gaming

So yeah, that's how you reel in that audience. You control for their interest in gaming by placing the ads _on gaming sites_.

Additionally, your ad stands out because the gaming sites are clogged with ads for games that involve swords.

Once you've got them on your homepage you have the opportunity to show them fullscreen art, shots, animations, etc to actually sell the game.

<comment><USER6> Yup, these ads really do make them stand out. In the long term the press might be bad, but it's better than no press at all.

Also, yet another online free game with swords doesn't really bring in many clicks. Adding some breasts will bring in people they wouldn't have been reaching otherwise. Even if they have a low conversion rate they are getting customers they wouldn't have otherwise.

</comment></comment><comment><USER7> No matter how much Jeff and many other people might take the moral high ground, they have to admit that this is nothing more than an appeal to the true nature of an average human (male). The "problem" is not with the advertisers; they are simply doing their job in the most effective manner possible.

<comment><USER8> Not really sure that applies in this particular case.

First one looks like an ad for a game. I might have clicked that if bored. Second one? The text is kinda _odd_ , but maybe?

Then it just goes downhill fast. Last one looks like I'm signing up for porn site, with free spam until the end of times. I would have _never_ clicked that.

<comment><USER7> But are you their average target customer? That's my real point: people who look down on these sorts of things are not the intended advertising targets.

<comment><USER9> I don't know, but consider: Their target customer who will actually pay them money is someone who is going to sign up to play a Civilization-like game in their browser, and likes it so much that they're willing to buy in-game perks.

Are those people the sort of people who click on softcore porn banner ads? Could be, but my intuition would have suggested that they aren't.

<comment><USER10> Maybe that "nerd" target customer does not exist, so they settle for the softcore clients (who might be more willing to pay for whatever, too).

<comment><USER11> But so that's an admission that they're in the wrong business. They should trash the game and start a softcore porn site.

</comment></comment></comment></comment></comment></comment><comment><USER12> As a game developer, I find myself clicking on a lot of game ads...both for fun and "research". Out of all of the game ads I've seen, Evony fr. Civony are the only ads out of all of the game ads i have ever seen that I _haven't_ clicked on. And I see them a lot.

Because I see them a lot, it makes me wonder if this means they are actually profitable? They've been running these ads net-wide for at least a year.

</comment><comment><USER13> I spent a lot of time looking for something akin to "we made the last ad up". And I was shocked to find out that it is real.

</comment><comment><USER14> Sex sells. Every marketer knows this.

<comment><USER15> Not necessarily true:

In Buyology [1], the author claims that sexual ads cause the person seeing the ad to remember the sex object and forget whatever was being advertised.

Of course, if you're advertising porn, then a picture of some boobs is probably a good way to get people to click through. But most people aren't advertising porn.

[1] [http://www.amazon.com/Buyology-Truth-Lies-About- Why/dp/03855...](http://www.amazon.com/Buyology-Truth-Lies-About- Why/dp/0385523882)

</comment></comment><comment><USER16> This is hardly a new development, but it is a particularly ironic example.

</comment><comment><USER17> "To be clear, these are real ads that were served on the internet."

And they were served by Google, I saw them a lot of TechCrunch.

</comment><comment> onreact-com Sorry, but apparently these ads managed to gain some extra attention. I don't believe the sex sells mantra (most wankers don't buy unrelated products) but a well known blog like this spreading them is not a bad thing in today's tight attention economy. Displaying sexist ads as "bad" is like beating someone up to show how bad it hurts.</comment>


The Ins and Outs of Silicon Carbide - <AUTHOR> https://semiengineering.com/the-ins-and-outs-of-silicon-carbide/ <comment><USER2> Excerpts:

SE: SiC is well-understood in power electronics and RF, but is the main advantage the ability to run devices hotter than silicon, or is it to save energy?

Palmour: The goal is to save energy and reduce system costs. Silicon carbide saves the OEM money.

[...]

"Palmour: The reason silicon can't go to very high temperatures is because intrinsically it starts to conduct.

 _It really stops being a semiconductor around 175°C, and by 200°C it becomes a conductor.

For silicon carbide that temperature is much higher — about 1,000°C_ — so it can operate at much higher temperatures."</comment>