Show HN: ArcaneVM – A Fully Homomorphic Encryption Brainfuck Virtual Machine - <AUTHOR> https://github.com/f-prime/arcanevm <comment><USER2> Can you guard against forged outputs? If you give me a program ciphertext and the public keys, I can simply encrypt a bogus answer and hand it back to you...

...but, if you interleave your Brainfuck program with, say, (classical) encryption of a canary constant, then you can check the canary constant when you decrypt the result, and you have high assurance that the computation is genuine - an attacker couldn't distinguish canary operations from real code, though you'd have to scatter the output bytes uniformly in the output. This scheme is a bit like obfuscation inside FHE.

\- Is there a more efficient way to securely tamper-proof your results?

\- How robust is this (or your own) scheme against a small number of adversarial bit flippings?

(Note that adversaries can mutate arbitrary bits via BlindRotate() in NuFHE/other TLWE schemes, they just can't extract the plaintext value (though they can set it, for example by NANDing.)

</comment><comment><USER3> "Fully homomorphic encryption" and "Brainfuck" in one sentence. I guess now I've seen everything :P but nice idea (obviously the language doesn't matter that much if it's a VM). Did some fully homomorphic $stuff for my bsc thesis,... Was this for a thesis as well, or just for fun? I guess next step is to use BF instead of Python? ;)

<comment><AUTHOR> Just for fun. I am taking it seriously, but I have no other motives other than to learn. This tech has serious potential to fix a lot of privacy problems. I thought it'd be good to have this out there.

<comment><USER4> Could you elaborate on the practical applications? I find this sort of thing very interesting, but it seems to get computationally infeasible once you apply it to any sort of real-world problem.

<comment><AUTHOR> Well, this project as it currently is makes no sense to use for anything real. What this project is trying to show is that ANY computation is possible with this.

So we don't necessarily have to create an entire VM to, say, run a FHE machine learning model. That can be built directly and specifically optimized for the task. I think that's where this is currently useful for real world stuff.

</comment></comment></comment></comment><comment><USER5> I went reading the linked intro to Fully Homomorphic Encryption [1]

>This means you can multiply together any two Elgamal ciphertexts, and upon decryption you'll find that the (single) resulting ciphertext now embeds the product of the two original plaintexts. Neat!

Coolest thing I've read in a while.

[1]-[https://blog.cryptographyengineering.com/2012/01/02/very- cas...](https://blog.cryptographyengineering.com/2012/01/02/very-casual- introduction-to-fully/)

<comment><USER6> You should read about "mental poker".

</comment></comment><comment><USER7> > Since the program essentially has zero context on what it is computing, it > has to run through every possible branch of the program. On top of this, the > underlying encryption schemes that make FHE possible are very > computationally expensive.

So... efficient computing with homomorphic encryption should focus on branch- free programming on CISC architectures with a huge number of instructions?

<comment><USER8> If I understand homomorphic encryption right, in CISC case it will go through all possible instructions instead of all possible branches, so no advantage here.

From repo:

> This is because at every cycle, the VM has to go through every possible > instruction on every possible data cell.

<comment><USER7> Ah. So you want a minimal instruction set, balanced with the ability to do branch-free programming.

</comment></comment></comment><comment><USER9> So cool / futuristic. A guy once wrote an open source JVM in VHDL. I've always wondered how hard it would be to port something like that on top of an underlying FHE NAND gate implementation. Edit: Link - [https://www.jopdesign.com/](https://www.jopdesign.com/)

<comment><AUTHOR> It would just be a matter of implementing the byte code into the VM. Should be possible. I thought it'd be cool to try Python bytecode haha

</comment></comment><comment><USER10> I have been thinking if this type of technology could be used to implement a mix mailer for messages, that is user aware so that online / offline correlation attacks, or compromised nodes in overlay networks (TOR etc) can be prevented.

</comment><comment><USER11> BF as an intermediate representation for a bunch of problems is a really interesting idea. Nice. Crazy. But - Nice.

<comment><AUTHOR> The simplicity of BF makes it incredibly appealing for stuff like this.

</comment></comment><comment><USER12> How is homomoprhic encryption secure? If you can do math on the data you can easily figure out an 8 bit ascii character especially if it's a prime number. I'm probably not understanding it properly.

</comment><comment><USER13> This is the coolest thing I've seen all day! There is a Udacity course on Homomorphic Encryptipn which, if it comes up again, I highly recommend.

</comment><comment><USER14> I'm confused - sorry for the dumb question. But looking at the two line Python example... where exactly is the encryption occurring?

<comment><USER15> The "run" function creates a key, encrypts the program, passes the encrypted VM state to the VM (which has no knowledge of the key), and finally decrypts the result.

[https://github.com/f-prime/arcanevm/blob/master/arcanevm/run...](https://github.com/f-prime/arcanevm/blob/master/arcanevm/run.py)

<comment><USER14> Wow, thanks for the response, that's really neat. I'm still confused though. Is this VM running _every_ possible program ever (branching N times every step, given an instruction set of size N?) And then the run function just picks the right result? Thanks again.

<comment><AUTHOR> Think about it like this.

We have a couple of variables: the data pointer, the instruction pointer

The values of these are encrypted BUT we can change them by performing logical operations (AND, OR, XOR, etc) on them.

So a cycle of the VM asks

1\. Is the current instruction the correct instruction?

2\. Is the current data cell the correct data cell?

Obviously if we _knew_ the value of the instruction pointer we could just go straight to the correct instruction, and if we knew the index of data cell I could go straight to it.

The problem is that we don't _know_ either of these things. So we have to go to every instruction and every data cell and check if it's the correct one. If it is then we can perform the instruction, otherwise we move on.

You can see now why this would be slow too. It's even slower though because in order to do this "check" we have to execute logic gates and the gates can take ~0.8 seconds (on a somewhat modern CPU).

</comment></comment></comment></comment><comment><USER16> Ooh, I didn't realize fully homomorphic encryption was possible! I presume that this can theoretically run arbitrary programs?

<comment><USER17> Arbitrary programs _that terminate on every input_ (no infinite loops), and with a few important caveats:

1\. Random access (reading input-dependent memory address) must be simulated with linear scans of the array.

2\. Input-dependent branches must be transformed as follows: both branches are evaluated, and the side effects must be combined using the branch condition (e.g. x <\- x _c + new_x_ (1-c)).

3\. Loops with input-dependent bounds must be unrolled to their maximum number of iterations (this is not always easy to compute).

In general you would probably write your programs in a special-purpose language that is easy to compile for this model of computation. Efficiency can suffer for some algorithms -- sorting winds up being O(n lg^2 n) instead of O(n lg n), for example.

Also the best FHE schemes are still nowhere near practical for the majority of computations people care about.

<comment><USER18> I didn't realize HE was still so primitive. Whenever there is a privacy kerfulffle for thing X, HN commenters say "X should be implemented with homomorphic encryption instead!"

LOL

</comment></comment></comment><comment><USER19> Sounds interesting. Why choose Brainfuck - has small number of instructions?

<comment><AUTHOR> Yeah, it has a very small number of instructions and is still Turing Complete. The Brainfuck code gets compiled to bytecode so I guess technically I could have used anything. The underlying VM was created with BF in mind though.</comment></comment>


Instapaper Is Blocking Users in Europe Until It Figures Out New Privacy Rules - <AUTHOR> https://gizmodo.com/instapaper-is-blocking-users-in-europe-until-it-figures-1826289131 <comment><USER2> That's just embarassing.</comment>


Bash prompt with git status - <AUTHOR> https://gist.github.com/sbilstein/7983019

<comment><USER2> Very handy. Thanks for sharing this.

I'm always a bit absent-minded regarding which branch I'm working on, so this is great. Note that the supplied code doesn't handle directories with spaces — I've added a comment on the gist relating to that.

Also I prefer a more simple terminal without user and host, since I tend to do only local dev. I also use a bright emoji as terminating character instead of the $, so: "\w:$(git_branch_and_status) 🌕 " is my prompt (I realise some might find this horrific).

Edit: also a maxlen > 12 is probably needed for those who tend to use a lot of wordy "feature/branches".

<comment><AUTHOR> I've updated the gist with some fixes. Thanks for looking out for the space issue. I was considering the skull and bones or a heart instead of $ but they sat sorta strangely on the line.

I tend to start all my branch names with a JIRA Issue like LSS-488 or a Github issue number so that the various tools integrate. My branch names tend to be long for sharing but the only identifier I need when I'm sharing is the ticket ID.</comment></comment>


The Associated Press adopts an extended hAtom microformat - <AUTHOR> http://paidcontent.co.uk/article/419-ap-media-standards-trust-propose-news-microformat/ Spec of the extended hAtom is at http://valueaddednews.org/technical/techspec <comment><AUTHOR> Spec for the extended hNews is at <http://valueaddednews.org/technical/techspec></comment>


Tildes – a non-profit community site - <AUTHOR> https://tildes.net/ <comment><USER2> What struck me immediately was how fast this site loaded. No font popping, no cookie waivers, no newsletter nagging, no huge images, no JavaScript fade-in, no scrolljacking, no signup wall. Funny how practical it is to make a functional forum and news aggregator that Just Works.

I'll definitely be keeping an eye on this and would love to get an invite!

<comment><USER3> Thanks! Keeping the site minimal and fast is definitely one of my main goals, and I'm never going to add any third-party assets, advertising, or anything like that (for both speed and privacy reasons).

There's quite a bit more info about my approaches from a technical perspective here: [https://docs.tildes.net/philosophy/site- implementation](https://docs.tildes.net/philosophy/site-implementation)

</comment></comment><comment><USER4> Signed up and it looks great! Looking forward to seeing it grow.

The main reason I actually use Reddit is because there's a community for almost anything. I had a quick browse through the issues/roadmap but; do you have a plan to allow user-created groups or subgroups? For example, ~food is too general for bread-making and so reddit has communities like [https://old.reddit.com/r/breadit](https://old.reddit.com/r/breadit), which is a great place to ask for baking advice specific to baking bread.

<comment><USER3> Yes, that's definitely planned over the longer term, but the community is too small to support highly-specific groups for now. Various other "reddit clones" have made the mistake of allowing users to create communities immediately, and they ended up with thousands of inactive, abandoned ones.

Even reddit itself didn't support subreddit creation for over 3 years. It takes a long time to have a userbase large enough for it to work.

In the meantime, Tildes has a pretty flexible tagging system to help categorize topics, and tags can transition into formal groups quite nicely.

</comment></comment><comment><USER3> (Tildes is my site)

The best explanation of the site's goals is probably still the original announcement blog post: [https://blog.tildes.net/announcing- tildes](https://blog.tildes.net/announcing-tildes)

Here's the discussion on HN at the time (note that the site was totally private at that time and you couldn't even view it without an invite yet): [https://news.ycombinator.com/item?id=17103093](https://news.ycombinator.com/item?id=17103093)

Feel free to ask any questions, and if you're interested in an invite please just email the address in the blog post and I'll send you one soon. It's not intended to be difficult to get an invite, I just want to keep the growth controlled while a base site culture and more features get built up.

<comment><USER5> As an avid Redditor I love this!

The company I work for, Coil, is specifically looking to enable sites like this have an alternative revenue model that is not based on ads[1]. If you have any questions you can reach out to me matt[at]companyurl

I would also suggest you check out [https://www.grantfortheweb.org/](https://www.grantfortheweb.org/)

[1] [https://coil.com/creator](https://coil.com/creator)

<comment><USER6> Wow. These links opened new doors I didn't know existed. I've been experimenting with sponsorship ads to fund my sites because I'm very against the current advertising model. However, Coil looks to be an interesting alternative to the ad model as a whole.

</comment></comment></comment><comment><USER7> What's to stop this from falling into the same trap as always? They grow, user donations aren't enough to sustain them anymore so they have to look into alternative ways of getting money, users hate it, they start a spinoff that promises to be better, rinse and repeat.

<comment><USER3> That trap happens because of sites basing themselves on venture capital, advertising, and chasing growth/profit.

Tildes is a non-profit with no advertising or investors, so none of that pressure is there. There's no danger of donations not being enough to sustain it. The expenses are already far more than covered and it could easily stay running in its current state forever.

<comment><USER8> How do you know donations will keep up with usage? I felt like the OP was referring to a situation where Tildes takes off and becomes large organically.

I'm currently building a site that I am considering attempting to make possible via donations, much like Tildes. Any advice you can share? How well have donations been working? Any gotchas? Thanks for any insights you can share!

<comment><USER3> You can see the site's current expenses and donations here: [https://tildes.net/financials](https://tildes.net/financials)

The costs to keep it running are already covered by over 10x with the current donations, and I believe the existing servers could easily handle at least 100x the current traffic level.

In terms of advice, I'd say:

\- Don't go into debt (or take any investments) to launch the site.

\- Build something lightweight so the costs are low. Use dedicated server(s), avoid cloud hosting like AWS.

\- Incorporate as a non-profit if you can.

<comment><USER9> +1 for transparency of financials, that's a really awesome idea

</comment></comment></comment></comment></comment><comment><USER9> EDIT: All invites are now gone, sorry

I have 10 invites available, send an email to firstname.lastname@example.com for an invite code. Include your Hacker News username in the message so I can verify you.

EDIT: All invites are now gone, sorry

</comment><comment><USER10> Hm. This is rare (for me). Something i liked because at first glance nothing which is disturbing or annoying from a design point of view. Has usable themes even, with the exception of the solarized ones. Always wondered who the people are which would profit from that, or what displays? Could maybe use some setting for different padding.

Edit: Different padding as in tiny/small/compact/cozy/comfortable/large/huge view like in some google apps?

</comment><comment><USER11> So is this kind of like HN but for everything? I'm digging it.

<comment><USER12> Reddit clone? I think HN was a redditclone too right?

<comment><USER13> To be fair, reddit was originally a usenet clone.

</comment></comment></comment><comment><USER14> This is great: fast, interesting content, comments, voting, but... I can't do anything until I get an invite.

Tedious.

This invite only model sucks an 18-metre radius dog anus. We've seen it far too many times before. It's really boring and overdone and needs to die. Seriously, just let us in.

And I know what you're thinking, "Wow, this comment is super-obnoxious and we don't want this kind of person in here", but check my karma: it's pretty good. You've just crossed a line.

The problem here is I'm getting old and one day I'm going to die and I only have so much breath left in my body, so I don't have the time or the patience for your infuriating invite only model.

Please: stop arsing around and open it up.

<comment><USER15> Tildes is a nice community. We don't tolerate assholes. If deimorz lets you in, please do better than this comment.

<comment><USER16> This could also be described as being cliquish, or an echo chamber.

<comment><USER15> I've found Tildes to be welcoming to a wide variety of ideas, opinions and world views.

We're hostile to trolls, saboteurs, personal attacks, self-promotion and repeated empty or trivial junk comments.

If it's cliquish to discourage activity that makes social spaces miserable, then that's the kind of clique I'd like to belong to.

<comment><USER16> Personal attacks and derision of my point of view were what I experienced right before being called a troll and banned.

Its unfortunate that some social spaces are uncomfortable with divergent viewpoints.

<comment><USER15> Sounds like Tildes is not the right community for you.

<comment><USER16> Exactly. Not as wide of a variety of ideas, opinions and world views as you make it out to be.

<comment><USER17> Or maybe it is wide, and your opinions are just really out there (or you really were in fact an asshole.).

If everyone keeps calling you out, it's possible the problem isn't with everyone. I'm not saying that's always the case, I'm just pointing out the odds aren't in your favour.

<comment><USER16> Perhaps. But culling an invite-only community tends to result in an echo chamber.

<comment><USER17> I don't remember how many bans there have been on Tildes to date but it's either two or three, and they're always a big deal. So I don't know about your definition of "culling".

<comment><USER16> Culling means the removal of something with undesirable traits.

And when the mod locks an account without explanation, I'm sure that the community doesn't notice.

<comment><USER17> > _Culling means the removal of something with undesirable traits._

You just defined "moderation". Just because you call it culling doesn't make it so. And your bad-faith approach in this thread makes me think if you were indeed banned from Tildes (which I'm starting to doubt), it was the right call.

Question yourself.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> By any chance does anyone else have an extra invite?

<comment><USER19> Yep. Dunno the best way to send it out, though.

</comment></comment><comment><USER20> I have 10 invites available, send an email to email@example.com for an invite code. Include your Hacker News username in the message so I can verify you.

</comment><comment><USER21> This looks great! Can anyone sponsor an invite for me?

<comment><USER22> I'd be very happy if someone could invite me aswell. This looks really promising.

</comment></comment><comment><USER23> there are several people asking for invites. pm me or reply here and I'll invite you (Until my ten invites run out). In roughly 7h because I'm going to sleep now.

In a recent census we realized we have very few non-tech people and women, so please help us even the scales by reaching out if you see this ;)

<comment><USER23> Sadly I'm out of the edit window, so I'll do it as a reply: If you don't have any contact information in your profile, I really can't send you an invite.

</comment></comment><comment><USER24> How is it better than here?

(I like both at the moment.)

</comment><comment><USER25> I've been on Tildes since Early Days, same username, really like the features and development.

And I've got a few invites. Reply and ping via email (see my HN user page) if interested.

</comment><comment><USER26> Any chance of an invite from an existing user? This post alone has me thrilled: [https://tildes.net/~talk/l4d/you_must_time_travel_to_any_tim...](https://tildes.net/~talk/l4d/you_must_time_travel_to_any_time_before_1799_and_never_come_back_where_do_you_go)

<comment><USER27> I can send you a code if you drop me a message. My email can be found in my profile.

</comment></comment><comment><USER28> Is this the official launch?

Tildes is great, glad it's getting exposure here. It was interesting watching the community unfold on a subreddit before eventually migrating over to a hosted third party site.

</comment><comment><AUTHOR> I discovered Tildes several months ago. I have no affiliation but I thought the HN crowd might appreciate it.

I like the approach the creator is taking with the site and is a great candidate for a Reddit-like community with more intelligent discourse.

<comment><USER29> > Reddit-like community with more intelligent discourse

I feel like that's an unfair assertion. There is _a lot_ of intelligent discourse on Reddit. There is also a lot of utter garbage on there, sure, but byte for byte, there aren't many websites with as much quality content as Reddit.

</comment></comment><comment><USER30> Top discussion currently is on Hitler.

No thanks, I'll give it a miss.

<comment><USER20> Have you actually read it?

Stories about killing Hitler and saving millions of lives are a staple of science fiction, and an interesting way to reason about time travel.

I created that thread as a creative exercise for others to partake in good, light-hearted fun. Despite the subject, there were absolutely no cases of misbehavior. That's what you get when you're in a heavily moderated community that takes being nice to each other very seriously.

<comment><USER30> Yes, I did. 'Light-hearted fun' perhaps but it strikes me as in very poor taste as someone whose parents lived through the 1940s. Okay, you went there - to its logical conclusion in which your time adventures messing around with the past inadvertently sees the Axis win the war and the 1000 year reign commences as forseen. And nobody wants that.

'a heavily moderated community that takes being nice to each other very seriously' would describe this forum, for the most part. Thus my reluctance to join another community comprised somewhat of HN invitees merely to discuss topics HN might find taboo such as time travelling assassination of historical figures.

<comment><USER20> I am truly sorry my thread offended you. I assure it was not my intention to provoke that reaction in anyone.

</comment></comment></comment></comment><comment><USER31> [https://tildes.net/register?code=EPFF9-HWU9Z-4D5U6](https://tildes.net/register?code=EPFF9-HWU9Z-4D5U6)

[https://tildes.net/register?code=B2M91-W6VD5-ABFG8](https://tildes.net/register?code=B2M91-W6VD5-ABFG8)

[https://tildes.net/register?code=LGG9Q-26K5G-LU8RK](https://tildes.net/register?code=LGG9Q-26K5G-LU8RK)

[https://tildes.net/register?code=GBLXM-N3GPO-V4MN4](https://tildes.net/register?code=GBLXM-N3GPO-V4MN4)

[https://tildes.net/register?code=MWMSC-2970F-VPWYM](https://tildes.net/register?code=MWMSC-2970F-VPWYM)

[https://tildes.net/register?code=2LDQG- FJ1N2-SM8F0](https://tildes.net/register?code=2LDQG-FJ1N2-SM8F0)

[https://tildes.net/register?code=GLF5C-JHMWP- MV4YH](https://tildes.net/register?code=GLF5C-JHMWP-MV4YH)

[https://tildes.net/register?code=9HBBF-WC5CC- LBJQX](https://tildes.net/register?code=9HBBF-WC5CC-LBJQX)

[https://tildes.net/register?code=ASYR8-V3KQJ-U96N7](https://tildes.net/register?code=ASYR8-V3KQJ-U96N7)

<comment><USER3> To save anyone else the trouble of trying, all of these links have been used now and are no longer valid.

If you want an invite, you can just email me as explained in the announcement post: [https://blog.tildes.net/announcing- tildes](https://blog.tildes.net/announcing-tildes)</comment></comment>


Taking over your code repositories with xss - mike-cardwell http://blog.mu-cs.com/2011/03/taking-over-your-code-repositories-with.html

<comment><AUTHOR> I don't understand why sites are still subject to bugs like these. After 15 years of poor-escaping bugs and the security problems inherit in them, why is it so hard to understand the two critical rules:

1\. Sanitize everything you can on the way in.

2\. Anything that can't be sanitized on the way in must be marked as unsafe and sanitized on the way out.

Nothing* should ever, ever, ever go directly from one end-user's machine to another (even the same user). Ever.

* Binaries might be an exception, but even then possibly not (e.g. virus checking).

<comment><USER2> Those two pieces of advice really are like telling programmers "just don't make mistakes".

Giving that advise is really, really easy. Every competent web developer knows that. The hard part is actually implementing it.

For example, lots of programs written today still have buffer overflow vulnerabilities. Those are even older. The fix is also very simple: "Check the bounds of your arrays before you use them". That is, again, just telling the developer to not make mistakes.

Designing security into your app can help with preventing XSS attacks, but there is no single perfect way.

<comment><USER3> that's true but especially code hosting sites, should be a bit more concerned.

Using a WAF and white listing parameters, may be a good start too.

Just another reason why I keep the code internal.

<comment><USER2> > especially code hosting sites, should be a bit more concerned.

Not really. There are many examples of sites which should be more concerned. Anything with your credit card information, say.

> Using a WAF and white listing parameters

Yeah, that's a good start. But you need to make sure everything goes through the white list, and that's the hard part.

> Just another reason why I keep the code internal.

What does this have to do with security?

</comment></comment></comment></comment><comment><USER4> I don't know if that guy spent months and months searching for those vectors - but casually lumping XSS attacks in all the big source control sites is a frightning thing to see.

We really need to pull back on the super-cool-awesome new feature bloat of HTML5 and get back to basics: sort this out in a meaningful way.

<comment><USER5> I spent about around 3 hours on github(found the bugs after like 2 hours and spent another 1 playing with wiki markup --- it is sanitized don't bother), 1 hour on bitbucket, 30minutes on gitorious(obviously the bug I found was found very quickly after signing up) and ~1 1/2 hour looking at the launchpad subdomain.

I did this over like the past 100 days.</comment></comment>


How to Decide if Entrepreneurship is Right for You  - <AUTHOR> http://online.wsj.com/article/SB125354895752528171.html#mod=WSJ_hps_sections_smallbusiness

<comment><USER2> I think I have seen this article here before and the canned response as well; "If an article can dissuade you from becoming an entrepreneur, then you were never one to begin with."

I normally don't like those snarky responses but I think in this case it is fairly true. But on the other hand, it is easier than ever to create a business online in your spare time and build it up. It all depends on what you value most short term time or long term time and freedom with no definite payout.</comment>


TP-Link begins router firmware lockdown due to FCC proposed regulation - <AUTHOR> http://ml.ninux.org/pipermail/battlemesh/2016-February/004379.html <comment><USER2> [https://libreplanet.org/wiki/Save_WiFi](https://libreplanet.org/wiki/Save_WiFi)

The FCC publishes a 90-page document on an extremely technical subject and required any comments to be submitted within 7 weeks. It would take the average aficionado several weeks just to find out about it.

The real issue here is that government agencies like the FCC are willfully excluding all but the best organized (read: best funded) groups from participating. And just like with Net Neutrality, no matter how many comments are submitted by poor people, only when the rich (the companies) and the powerful (President Obama) say something do they even bother to listen.

<comment><USER3> Also, the FCC should not be able to make rules like this. This is why we have a three branch system. Congress doesn't have the legal power, in the constitution, to give agencies the power to make laws (Even if they call them "Rules")

Increasingly over time these rules are becoming more and more draconian and including things that most people oppose.

For instance, there was an outcry about CISPA and COPA that killed those bills... so the FCC made an 800 page ruling on "net neutrality" and people accepted it, because they wanted net neutrality. (And who has time to read 800 pages?)

<comment><USER4> I agree with you that the system of federal administrative agencies is a mess. The top federal agencies hold amounts of power bordering on unconstitutional. They seem to represent a rogue branch of government, or at least artificially inflate the role of the executive branch. Of course, the point of the judicial branch is to restrict expansions of power from the other branches. Theoretically the judicial branch has the ability to restrict the capabilities of federal agencies, but it's extremely unlikely we will ever see a heavy ruling against them. There's wayyyyy too much special interest money entangled in the agencies for that to happen.

Still, to play devil's advocate, the agencies _do_ have a purpose. They are able to regulate industries that move faster than real legislation. They can employ experts (as opposed to congressmen) to write the rules. Industries like tech and pharmaceuticals are governed by extremely complex market dynamics. The federal agencies that oversee them, such as the FCC (tech) and FDA (pharmaceuticals) employ dozens of experts who are familiar with how the industry actually works. They write the regulations because no other branch of government possibly could.

Federal agencies make it possible for congress to write laws with stipulations like "all matters pertaining to <EXTREMELY GENERAL DESCRIPTION OF INDUSTRY SUBTOPIC> shall be subject to the regulations of the <FEDERAL AGENCY> responsible for overseeing <INDUSTRY>." The agencies provide a way for congress to defer the details of lawmaking to a more flexible, adaptable agency that is actually familiar with the complex dynamics of the system being regulated.

..... in theory, of course. Whether this works in practice is another question. One could make the argument that no sufficiently complex market should be subject to any regulation other than the natural market rules. One could also argue that the ability of congress to defer lawmaking to agencies is tremendously unconstitutional and enables them to enact laws with greater breadth than should be possible.

Some reading I dug up on the subject:

[http://heritageaction.com/2011/11/issue-profile- unconstituti...](http://heritageaction.com/2011/11/issue-profile- unconstitutional-federal-agencies/)

[http://www.jpands.org/hacienda/comm19.html](http://www.jpands.org/hacienda/comm19.html)

tl;dr "Thanks, Roosevelt!"

<comment><USER5> > Of course, the point of the legislative branch is to restrict expansions of > power from the other branches.

That's almost exactly the opposite of the point of the legislative branch, since the other branches have very little power _not_ explicitly granted by the legislature, and the legislative branch principally acts by defining and granting functions to the executive and judicial branches.

> Theoretically the legislative branch has the ability to restrict the > capabilities of federal agencies

More to the point, federal agencies only exist because they are created by Congress, and only have powers because they are given them by Congress.

Its not a theoretical power that Congress has over them, but a practical one whose exercise is the only reasons the agencies exist and have any power at all.

If Congress doesn't take action that you think it should against a federal agency, that's because a sufficiently large portion of Congress doesn't _want_ to take that action, not because Congress has only a theoretical but not practical power over the agency.

> but it's extremely unlikely we will ever see a heavy ruling against them.

Congress doesn't make rulings, that's the judicial branch. Congress has substantially restricted the powers of commissions and even abolished them. (A notable example being the one that served as a structural model for pretty much all other "independent" regulatory agencies, the Interstate Commerce Commission, whose powers were stripped in a series of deregulation movements culminating in the abolition of the Commission in 1995.)

<comment><USER4> Yes you're right. I edited my comment, apparently while you were writing yours, to correct myself. I meant to say judicial branch, not legislative.

<comment><USER5> The judicial branch _also_ has made fairly sweeping rulings against both individual regulatory agencies and the ways in which Congress structures (or, rather, has structured in the past, since those rulings stopped the particular practices at issue) regulatory agencies, their powers, and their relations with Congress in general.

</comment></comment></comment></comment></comment></comment><comment><USER6> This is especially sad because the NYC Mesh project ([https://nycmesh.net/](https://nycmesh.net/)) to create a mesh network in NYC uses TP-Link routers pretty heavily.

<comment><USER7> "This is especially sad because the NYC Mesh project ([https://nycmesh.net/](https://nycmesh.net/)) to create a mesh network in NYC uses TP-Link routers pretty heavily."

Won't all of those existing TP-Link routers continue to work and be unlocked to flash whatever you like on them ?

Further, aren't there sufficient TP-Link parts in the supply chain from the last 4-5 years that you'll continue to be able to source them ?

Genuinely curious...

<comment><USER8> Whatever the answer to your question, that's very short term thinking to a longer term issue.

</comment></comment></comment><comment><USER9> I'd be hesitant to trust what comes from a CS rep regarding a manufacturer's policy regarding the interpretation/compliance of an FCC rule. TP-Link may have just decided to lock down their devices regardless.

I'm not saying this "report" isn't accurate... I'd just rather hear this from someone other than a random CS chat.

<comment><USER10> if there is any legal ambiguity whatsoever, they are going to play it safe

<comment><USER11> Yes, this rep is wrong. They started doing this before the FCC issue became an issue.

</comment></comment></comment><comment><USER12> On the OpenWrt wiki for the C7[0], which was last modified Jan 13, there is this note:

" _Recent US firmware (e.g. Archer C7 v2 151014 US) do not install unsigned firmware, including earlier versions of firmware and international versions. Thank you, FCC. You need to use TFTP Recovery method to install OpenWRT until somebody replicates what DD-WRT's KrypteX is doing._ "

So, it certainly seems like this has been known for at least a month.

[0][http://wiki.openwrt.org/toh/tp- link/archer-c5-c7-wdr7500](http://wiki.openwrt.org/toh/tp- link/archer-c5-c7-wdr7500)

</comment><comment><AUTHOR> Some people/organizations associated with this thread on ninux.org have a Gofundme page to collect funds supporting their efforts in persuading more coherent action from the FCC. [https://www.gofundme.com/save_wifi_round_2](https://www.gofundme.com/save_wifi_round_2)

</comment><comment><USER13> Is this limited to devices sold in the US? They are going to impose it on every other place that sells them?

Afiu tp-link has no obligations to manage two devices trees for a niche community. Stubborn minority effect at play here. [1] [http://fooledbyrandomness.com/minority.pdf](http://fooledbyrandomness.com/minority.pdf)

<comment><USER14> That's something I'm also wondering about.

IIRC, the first thing my stock WDR3600 firmware asked me about was which country I am in, which means that frequency locking can be easily bypassed (not power levels, though).

To make this as bulletproof as FCC wants they would have to make separate firmware image for the US and prevent US firmwares from being "upgraded" to non-US.

edit:

And this is exactly what they did:

 _Recent US firmware (e.g. Archer C7 v2 151014 US) do not install unsigned firmware, including earlier versions of firmware and international versions. Thank you, FCC._

Source: [http://wiki.openwrt.org/toh/tp- link/archer-c5-c7-wdr7500](http://wiki.openwrt.org/toh/tp- link/archer-c5-c7-wdr7500)

<comment><USER15> Question: if a manufacturer has their radios/devices blessed by the FCC are they blessing the software the comes a long with it?

Would there be a gray market for international versions of routers because they're the exact same hardware and not as locked? If I'm a manufacturer I certainly don't want a whole new BOM variation just for US devices if I can solve the problem with software.

</comment></comment></comment><comment><USER16> [https://www.fcc.gov/news-events/blog/2015/11/12/clearing- air...](https://www.fcc.gov/news-events/blog/2015/11/12/clearing-air-wi-fi- software-updates)

TP-Link may well be locking down firmware, but it is NOT because the FCC is forcing them to.

<comment><USER14> How do you know?

As your link says, they intend to prohibit selling hardware which can be modified to violate FCC regs. Since 3rd party firmware allows such violations, devices get locked down.

How else are you going to explain the existence of separate US firmware which refuses to upgrade to international firmwares?

[http://www.dd-wrt.com/phpBB2/viewtopic.php?p=990535](http://www.dd- wrt.com/phpBB2/viewtopic.php?p=990535)

<comment><USER16> The link does not say that. The FCC is gathering information for a proposed rule that could potentially impact hardware sold in the future. Nobody is being forced to do anything yet. There is no rule that prevents DD-WRT from being installed on a device.

So why is TP-Link locking down their firmware even though they aren't required to? You have to ask them.

<comment><USER14> > So why is TP-Link locking down their firmware even though they aren't > required to? You have to ask them.

If you read TFA you'll learn that somebody did just that.

      Adam Longwill 09:26:19 pm Wow. Thank you. I'm impressed with your digging
      And this limitation is due to FCC rule clarifications in 2015?
      And not some other reason

      Camille 09:28:15 pm Right, due to FCC

<comment><USER17> You mean the original submitted article? Because in that article the person asks IF they locked them down, not WHY. There's still no answer as to why TP- Link thought it necessary to react to a nonexistent rule.

</comment></comment></comment></comment></comment><comment><USER18> And this is why, in a nutshell, linux should switch to GPL3.

Right now there is no issue for TP-link to "preenmptively" block their hardware. If there was, they would think twice about it.

<comment><USER19> > And this is why, in a nutshell, linux should switch to GPL3.

Unfortunately, given the number of developers that would have to agree, the fact that early contributions weren't attributed and the can of worms that defining what a derivative work is opens, makes relicensing very unlikely.

<comment><USER20> Not really. Think about it. Only to remove restrictions from a license do you need permission from the existing developers. To introduce extra restrictions you don't need anyone's permission. If Linus chooses to accept a single patch that's GPLv3, the kernel is GPLv3 from that point forward.

Linus has in fact done this to quite a bit of MIT licensed code.

Of course it only applies to future versions, and you could conceivably make versions that have those patches removed.

</comment></comment></comment><comment><USER21> So sad, I got a nice tplink for my mother and installed openwrt to gain some more control over the device. Unfortunate to see this support go away due to government.

<comment><USER22> >Unfortunate to see this support go away due to government.

This support went away because people were abusing it running their routers on forbidden bands at higher than allow transmission levels.

The vendors are doing what they can easily do now and it's block the firmware modification since they can't replace the baseband/wifi cards as easily.

<comment><USER23> How many people do you actually think were doing this? It's not a common enough problem that it's worth killing open router software.

If the FCC wasn't planning to stomp on router manufacturers, they wouldn't be doing this. Make no mistake, it _is_ the government killing innovation here.

</comment></comment></comment><comment><USER24> There seems like a fairly large opportunity for manufacturers willing to release products with sufficiently locked down baseband but a hackable host OS.

Also, amateur radio operators are legally allowed to operate these devices with modified firmware (including baseband). So why am I no longer allowed to buy these?

</comment><comment><USER25> So arguments from FCC were bogus. It did result in locked devices. What's next? Will other manufacturers do that as well?

</comment><comment><USER26> It's really annoying that Canadian policy on this matter is basically set by the FCC. It's not like we're going to get unlocked routers when the US gets locked ones, but we don't have a voice.

</comment><comment><USER27> Can somebody explain what this means? I'm still confused. Firmware lockdown, does it mean I can't install dd-wrt or something? Any other consequenses?

<comment><USER28> Correct, no custom firmware, and it appears no downgrading your firmware to an older version without this restriction.

It's a trap-door upgrade.

<comment><USER29> It's also a great way to keep the back-door open too!

</comment></comment></comment><comment><USER15> Well crap... I have two C7s. IMO there might not be (or at least have been) a better mainstream router for the price.

<comment><USER30> It's not cheap, but it's badass. [https://omnia.turris.cz/en/](https://omnia.turris.cz/en/)

<comment><USER15> The page says starting at 99 and I literally couldn't find a buy button fast enough. After landing on the Indiegogo page and seeing how much it would cost for a few of the features I'm interested in- yeah, I'll pass. It sounds like a heck of a router but it got spendy fast.

<comment><USER30> There's also this. [https://www.thinkpenguin.com/catalog/wireless-networking- gnu...](https://www.thinkpenguin.com/catalog/wireless-networking-gnulinux)

</comment></comment></comment></comment><comment><USER31> I needed to put together a VPN router because of an upcoming trip. Since I didn't want to bring a "giant" 4 port router, I went looking for an OpenWRT- compatible travel router. The TP-Link TL-WR710N and D-Link DIR-505L were my two candidates. :)

I setup OpenVPN as a bridge and configured an SSID on it so when I connect to it, it'll be as if I were still at home. (Same subnet so I have access to all my printers, tv tuners, etc).

This is disappointing news. What I just did would not have been possible for $15. I've been using OpenWRT for over 10 years and can't imagine ever using a router without some sort of customizable Linux on it. I've learned so much about Linux, networking, VPNs, etc from OpenWRT.

</comment><comment><USER32> I thought the FCC walked back on this?

<comment><USER33> My assumption: it's cheaper/easier for TP-LINK to disable all flashing of 3rd party firmware than it is to implement restrictions based on the FCC's narrowly-focused instructions.

</comment></comment><comment><USER34> This means there won't be any firmware upgrade for those routers or that only TP-Link signed upgrades will work?

Anyway, this was expected: it's the cheapest way to comply with the regulations.

</comment><comment><USER35> Doesn't the old gun argument apply here? They're just punishing the average tech guy -- smart criminals will just find a away around it.

<comment><USER36> What's the gun argument

<comment><USER37> Restricting the sale of guns makes it harder for the average person, but the bad guys will always have a way.

<comment><USER38> Its also the same argument regarding the war on drugs. It never works but thats not really the point. The point is to create options to apply pressure whenever government decides it wants to.

</comment></comment></comment></comment><comment><USER39> So are there still good, cheap 802.11ac routers that OpenWRT supports well? Now may be the right time to upgrade my 802.11n router.

<comment><USER40> I'm been replacing ASUS RT-N16s with RT-AC56Rs. $50 refurbs in-store at Microcenter, $75 new from Walmart.com, well-supported by all the firmwares that have ARM builds.

If you can't buy them that cheap the TP-Link Archer C7 has been a better value... well, up until now.

<comment><USER12> According to the OpenWRT wiki:

[http://wiki.openwrt.org/toh/asus/rt- ac56u](http://wiki.openwrt.org/toh/asus/rt-ac56u)

The BCM4352 (AC/AN chip) is not supported, which is part of the reason to get one of these routers. Broadcom router chips are usually MIPS based, and also heavy on the binary blobs (which may allow for dd-wrt support).

Edit: In fact, I can't find any image that supports this BCM4352 on dd-wrt either:

[http://dd-wrt.com/wiki/index.php/Supported_Devices](http://dd- wrt.com/wiki/index.php/Supported_Devices)

</comment></comment></comment><comment><USER11> TP-Link started doing this months ago, and as far as I can tell they did so before the FCC proposed regulation. Considering the time that it takes for a company like this to start acting, I would be very surprised if the FCC regulation has much to do with it at all.

It does make a good excuse for them, though, I guess.

</comment><comment><USER41> Related:

[https://www.defectivebydesign.org/dmca-anti-circumvention- co...](https://www.defectivebydesign.org/dmca-anti-circumvention-comment)

</comment><comment><USER42> To bad, Tplink makes quite nice hardware.

</comment><comment><USER43> I wonder how long until it's cracked. As the saying goes, "If there's a will, there's a way."</comment>


Show HN: Breezy comes to iOS - <AUTHOR> http://blog.breezy.com/breezy-comes-to-ios <comment><USER2> Add a link to your main site and a short abstract of what it is to that blog RIGHT NOW!

</comment><comment><USER3> Breezy clickable links Apple AppStore - <http://itunes.apple.com/us/app/breezy/id438846342?mt=8> Blackberry App World - <https://appworld.blackberry.com/webstore/content/48812>

</comment><comment><USER4> I would think about adding/changing your splash call to action on breezy.com to: "Now you can easily print AND FAX any document - from any device." At least add fax since thats an important value proposition. I can read in one sentence what the app does.

</comment><comment><USER5> Now you can easily print any document from any device to any printer.

<http://www.breezy.com/>

</comment><comment><USER6> I feel silly asking, but I can't find a like to the app. Where is it?

<comment><USER7> The app's available in both the Apple App Store and BlackBerry's App World - just search for "Breezy". (And yes, Android is under active development.)

Thanks for your interest!

<comment><USER6> I tried searching and got a weird unrelated app. A direct link from the website would be really helpful...

</comment></comment></comment><comment><USER8> Finally. My printing problems solved!

</comment><comment><USER9> just downloaded, very intuitive</comment>


Mast Brings You Two Numbers on One Phone with No App - <AUTHOR> http://www.theverge.com/2016/2/4/10914764/mast-mobile-carrier-two-phone-numbers <comment><USER2> Hey, Jamie, Can you talk a little more about how this works?

<comment><AUTHOR> Mast Mobile acts as a mobile network provider (MVNO), but we've integrated software into the network routing, we can do lots of cool things. The most prominent of these features is that we can provide a different caller id based on who is on the other end. This lets us show, for example, your personal number to friends and relatives, but a work number to your clients. The same architecture also lets our users specify that they aren't receiving work calls at the time, but are receiving personal calls.

All of this is done without the use of an application - you just use your phone as you normally would, and our software keeps track of which number to use for each of your contacts. There are a few companies out there that are attempting to do something similar, but they require that you make some calls using their app, which is not how people are used to using a phone.

We've done this by a series of integrations with different systems that are needed for phone account management, routing phones and billing with an orchestration layer in the middle. We plan on extending this over time so that more integrations are possible in the future.</comment></comment>


Show HN: Tyba - Personal Websites for Students & Young Professionals - <AUTHOR> http://tyba.com

<comment><USER2> I'm slap bang in your target audience, and at first the idea sounds great.

Personally I wouldn't want a "get a site like this for free" ad on my page.

I also kinda agree with ohgodthecat that it's a bit disordered.

I love the animations and things on button presses though, and the idea of splitting down is very nice. The concept seems good so it'd be nice to see another iteration.

<comment><AUTHOR> Hi Elliot,

Thank you for your feedback.

To also respond to: ohgodthecat (thank you too!), we've spent a lot of time putting the Tyba sites infront of people working in HR. So far we've mainly received positive feedback about the interface, since it gives them a very quick overview of a person (both the visual elements such as the images and the way we do the layout). However we will take this into account and keep on gathering more feedback. Thank you!

That ad is there to incentivize users to upgrade to our premium plan which is when it disappears, you unlock themes and get yourname.com.

</comment></comment><comment><USER3> Definitely more interesting than about.me and more appealing than linkedin.

But will the people I want actually bother seeing my profile on tyba (employers, investors, clients, etc)?

<comment><AUTHOR> We make sure we follow sound SEO techniques. Most Tyba sites rank on the first page of Google for the users name within days and often go up to the first result within weeks (since they have more unique content then for instance an About.me page)

We actively try to be more appealing than LinkedIn since our target user is overall younger. Students today are constantly saying "LinkedIn is borring"

We also see users currently including their Tyba site (especially premium members) in their CV, email signature, and on their online profiles.

<comment><USER3> I'm really liking this. I guess I'll make it my personal homepage.

A quick feedback: I'm reading your profile right now, and I wish there were more links: I'm clicking in your favorite books to read more about them, or on "Founder of Twollars" to know more about it.

<comment><AUTHOR> Thank you for the kind words.

I completely agree, we are constantly working on bringing new features out and one of the upcoming ones (end of next week) will be what we call the "expanded work module" where users upload more types of content for a work experience to go beyond text.

There is still a LOT of work to be done, but we're working hard at it on our end.

Thank you for the feedback!

<comment><USER4> For personal info, it would also be really great if we could have links to other personal websites (like my GitHub).

</comment></comment></comment></comment></comment><comment><USER5> I don't think it's a great idea to display people's birth dates on a public web page, since that's a piece of information that's frequently exploited in cases of identity theft. Showing just their age would convey pretty much the same information and be less dangerous.

</comment><comment><USER6> Love this idea and the site looks great. I checked out some of the member sites and they look very fresh and are well-designed.

One thing: The member sites you included all have their own domains. If users can't get their name as a domain, what are their options?

<comment><AUTHOR> The users can choose to stick with: tyba.com/theirname or what we see with users whose name is not available they often use a variation e.g. jsmith.com john-smith.com johndsmith.com etc.

Also some users upgrade to a premium plan without a domain name to remove the ads and get access to the themes.

</comment></comment><comment><AUTHOR> It is not on our website yet, but we are currently looking to hire another web developer to come and join our team in Madrid. If you are interested and from the EU (sorry, visa sponsoring is very expensive) please contact me at: firstname.lastname@example.com

</comment><comment><USER7> I think the masonry style (like pinterest) layout is the wrong way to do something like this.

You want a CV kind of website to be easy to follow these just seem all over the place.</comment>


Fleet Problem 13: Pearl Harbor, Foreshadowed (2008) - <AUTHOR> http://historyiselementary.blogspot.com/2008/12/fleet-problem-13-pearl-harbor.html <comment><USER2> TLDR - Fleet Problem 13 was a naval wargame in the vicinity of the Hawaiian Islands in the winter of 1932:

"The expectation was that Yarnell would attack with battleships, but instead he left his battleships behind and proceeded only with his carriers to the north of Hawaii where it was less likely he would be detected. With a storm as cover, at dawn on a Sunday, February 7, Yarnell's 152 (some sources state 153) planes attacked the harbor from the northeast, just as the Japanese would ten years later. The army airfields were first put out of comission after which battleship row was attacked—with multiple hits on Navy ships. No defending aircraft were able to launch. The Navy's war-game umpires declared the attack a total success, prompting Yarnell to strenuously warn of the Japanese threat.

The Navy exercise became known as Fleet Problem 13 and the results were largely ignored by Navy brass while the Japanese….the revisionists declared... paid close attention."

</comment><comment><USER3> As I read that page I became less and less interested in reading the book. That's one of the worst book reviews I have ever read, its hard to belive it made it to the frontpage of HN.</comment>


Ask HN: Requesting code sample from potential employer? - <AUTHOR>

Employers frequently request code samples from candidates during the interview process. It seems reasonable that candidates should be able to do the same and request a code sample from the company.<p>Does anyone have experience regarding this type of request? <comment><USER2> Many times, I have been shown architectural diagrams that painted pretty pictures of what turned out to be disastrous codebases. In retrospect, there were other, non-technical "smells" that indicated that the sausage might not be so well made -- dumb developers, vague managers, production broken-ness, etc.

I've seen a lot of Java codebases over the past decade, ranging from good to awful. To get a feel for the overall quality, I've learned to check out some common things that are usually indicative of overall quality. For example, bad developers never seem to understand exception handling. Database connection management is another easy spot to check out -- letting the pool close up one's connections seems to be a favorite pastime. Other stuff that's not necessarily Java specific -- use of custom frameworks that, according to the developers' own descriptions, are replicas of existing stuff.

Perhaps, as @hga pointed out here, sitting at a terminal with an experienced developer and insisting that he/she show you the stuff you want to see (as opposed to a passive, guided tour) would be a quick way to gauge overall quality. And, you'd get a pretty good idea of management's notion of "experienced developer."

<comment><AUTHOR> The active approach would definitely require some tact, but definitely seems like it would be more informative. Plus, you're right about the added benefit of understanding what management considers to be an experienced developer.

</comment></comment><comment><USER3> Good idea! And for the right company, they'll be impressed that you're doing your due diligence on them.

I haven't done exactly this (hey, I made some of my best (but most painful money) working on wretched code bases), but I've done this sort of thing when helping my company decide whether to partner with another.

If you've got enough experience looking at code bases, you could ask them to let you at a terminal with one of their experienced engineers at your side. 15 minutes of that could convince me the code base was worth dealing with (obviously, it can take considerably less time if not :-).

</comment><comment><USER4> You do that as a contractor, when you're asked to give a fixed quote for a maintenance job.

For full time positions, it's reasonable to inquire about the engineering practices of the shop, code guidelines and similar, what freedoms you have to make spot decisions, etc. But asking for actual code is just silly. It does nothing but paint you as a picky cry-baby who couldn't work with others, or cajole them into working with him (IOW, you lack both a cooperative spirit, and leadership.)

<comment><AUTHOR> Hmm. I guess I don't understand why it's reasonable for a contractor to ask for a code sample, but not a full-time candidate.

I definitely agree that asking for a code sample could make the candidate appear uncooperative, obnoxious, etc., particularly because it's unexpected. What if instead of asking for a code sample, the candidate more casually asked if one of the engineers could show him around the code base for 5-10 minutes? Would that make it more acceptable?

<comment><USER3> EDIT after rereading what I was commenting on: Full timers are frequently expected to do infinite tasks in highly finite time, so your point holds ^_^.

I don't like the "show him around" idea since it's subject to cherry picking, but it could be an acceptable alternative if they're obsessed with secrecy (which 95+% of the time is bogus and a bad sign you should take into account).

You can mitigate the issues brought up by making looking at the code base just one of all the things you ask about, like process. Hmmm, didn't Joel S. or someone else write up a short essay on the 5 or so things you _really_ want to check before accepting a job? They ranged from using SCM to doing after project analysis.

I might add that one of the things _I_ always ask is what are the finances like. If they're at death's door I might work for them (have before :-), but I want to know ahead of time.

<comment><AUTHOR> Right, I've been thinking about this as an extension to the Joel Test (<http://www.joelonsoftware.com/articles/fog0000000043.html>).

Good point on asking about finances.

<comment><USER3> Yeah, the Joel test [1] is _very_ good, but I confounded it with another that includes, I think at the end, "after action" analysis of projects. It's not ideal to be in a company that doesn't learn from its mistakes and inevitably forgets how to do things right....

[1] I thought most of it was "obvious", but #5, "Do you fix bugs before writing new code?" wasn't something I'd explicitly realized the critical importance of. Heh, notice the beginning of it starts with an after action project analysis.

Hmmm, I just reviewed the list, some time after I read the comments to Mini- Microsoft's posting on why Vista development failed so badly, and I can see where Microsoft stopped doing too many of things that Joel said they were all doing back in 2000.

This is not the place to get into a long essay on that, but by my count:

5\. Do you fix bugs before writing new code? (Similar sort of failure, e.g. a lot of bugs were officially closed when they weren't really fixed.)

7\. Do you have a spec? (Joel wrote an essay on how it took N people one year to mis-design the Vista logout? feature.)

9\. Do you use the best tools money can buy? (Developers had to spend at least one day a week keeping their Vista machines up to date. And the development process (which is a tool of sorts, think of turning a crank on the side of a box to push through something) was so bad, so convoluted, so difficult to push things through, that developers spent a whole lot less time on coding et. al. than they should have.)

10\. Do you have testers? (RIFFed in favor of "automation" that seldom happened. They also abandoned the Raymond Chen backwards compatibility "cult" and that whole function and its people.)

One bottom line is that I'm still amazed at how under resourced such a vital project was (Vista, the restart from the Windows Server code base after the .NET Longhorn attempt was canceled).</comment></comment></comment></comment></comment>


Teardown shows Nest Cam is always on even when you think it's off - <AUTHOR> http://arstechnica.com/gadgets/2015/11/teardown-shows-nest-cam-is-always-on-even-when-you-think-its-off/ <comment><USER2> Take it as you will, but some of the comments in the article are saying that the only things left active are the wifi functionality to remotely switch the device on again, and that the 'camera' part is completely disabled as you'd expect.

So at the moment, it's a bit less ominous than the title suggests.

That said, I do find it irritating how many devices seem to want to be on permanent 'standby' nowadays, especially given all the talk about wasting electricity. Or the related worries about spies being able to remotely activate devices because they're not completely off.

<comment><USER3> It says it stops transmitting the video to the cloud service. It doesn't say it turns of the camera part. In fact, from the power draw and the ABI article it seems the only things being turned of are the camera indicator led and the motion detection. Recording seems to continue at 1080p.

<comment><USER4> > Recording seems to continue

It has no on-board storage. Where exactly do you think it's recording to, if it's not transmitting?

<comment><USER5> It doesn't have to store the video to process it?

<comment><USER4> No. Dropcam streams. There's no on-board storage. (Ok, maybe there's a megabyte or so - enough to store about one second of video for buffering before transmitting.)

<comment><USER5> How does that negate my statement? You don't have to store (much of) the video to process it locally on the device. As an example, it's being compressed before streaming. As to whether it does something with the video is another question, but it's definitely possible without storage.

<comment><USER4> ... which is exactly what I said. You asked "It doesn't have to store the video to process it?", and I said no, it doesn't, other than a small amount for processing.

<comment><USER5> Ah, sorry, I misinterpreted your answer. My question was meant to be rather rhetorical. I forget it doesn't always work in written form.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I don't like paying money for devices and services that are _able_ to steal my data and/or spy on me.

I would like a security camera that is not able to connect to the outside world (when I'm back, it would allow me to see what was happening when I was out). I guess it should be allowed to the local network.

Does anyone have a recommendation for a good one?

<comment><USER7> >I would like a security camera that is not able to connect to the outside world

The whole point is to have offsite backup. Very first thing more sophisticated thugs do is disable and steal your DVR setup:

[http://www.theatlantic.com/politics/archive/2015/08/the- chut...](http://www.theatlantic.com/politics/archive/2015/08/the-chutzpah-of- a-police-union-in-orange-county-california/400502/)

<comment><USER8> Surveillance cameras constitute an "illegal eavesdropping operation", says Santa Ana Police Association. Sick. More and more you have to consider LE as the enemy when worrying about security (both physical and digital).

</comment></comment></comment><comment><USER9> You can't really know what it does because the firmware is closed. Firmware on devices like this is an example of why open source is so important.

<comment><USER7> Dropcam has been rooted before, no idea if nest changed anything

</comment></comment><comment><USER10> How do I know the article is sensationalist shit? "vice president of teardowns at ABI Research"

I am Senior Vice President of making spiteful comments at my house.

</comment><comment><USER11> "If a tree falls in a forest and no one is around to hear it, does it make a sound?"

<comment><USER12> If it wasn't heard then it didn't fall.</comment></comment>


Ask HN: Home library / digital asset management - <AUTHOR>

Hi all,
I'm hoping for suggestions from HNers that might have the same problem I have.
I've been googling and reading reviews, but can't quite find something that will solve my problem completely:
My home 'library' has increased in size substantially over the last few years (comfortably into the thousands).  It includes: - Books (fiction and non-fiction) - Reference manuals (hardware, software, programming, etc) - CDs/DVDs (video, audio, software, backups) - Hard drives (media, data backup) - Digital media (ebooks, photos, videos, audio) - Various other digital content (saved websites, links, etc)
I'm hoping to do just the basic things: - Catalogue everything (ideally with help from ISBN numbers) - Search the library - Track location (physical and electronic) - Track lending to friends - Ideally have it self hosted as a web service - Ideally open source
There seems to be solutions that cover the above functionality for physical media, and solutions that cover the above for digital assets (DAM), but nothing (so far) that does all this for both types of media.
Do people have any suggestions or ideas?
Thanks! <comment><USER2> Take a look at - [https://www.assetbank.co.uk/](https://www.assetbank.co.uk/) \- It has a lot of features that you have listed and is a self hosted web software. I haven't tested it myself but they have some really good reviews!

</comment><comment><USER3> You should take a look at my project, Libramatic ([http://www.libramatic.com/](http://www.libramatic.com/)). Hopefully it helps and let me know if you have any questions. Thanks :)

<comment><AUTHOR> It looks really promising :) Do you plan on adding catalogue features for items other than books at some point in the future?

</comment></comment><comment><USER4> It may be helpful to list the point solutions that you have found, so people could suggest methods of integration.

<comment><AUTHOR> There are quite a few - I stopped reading after a while, because it wasn't getting anywhere...

Ideally I want a single solution (even if it may require a bit of kludging), rather than integrate solutions. This is a side project, so time is limited :-/

<comment><USER4> How about Tellico or GCStar, which support custom collections?

[http://tellico-project.org/](http://tellico-project.org/)

[http://www.gcstar.org/](http://www.gcstar.org/)

For metadata indexing of physically distributed storage (like hard disks), see [http://git-annex.branchable.com/](http://git-annex.branchable.com/) . Git- annex could likely be integrated with metadata from GCstar or Tellico.

<comment><AUTHOR> Thanks! These look very promising (and neither featured on most of my searches). Any idea of something similar with a web frontend?

<comment><USER4> There's a Java app called Data Crow, the screenshots imply that it has a web interface, but I haven't tested myself.

[http://www.datacrow.net/](http://www.datacrow.net/)

<comment><AUTHOR> You're a legend! This looks almost exactly like what I had in mind. It really bugs me that these didn't show up anywhere near the top in my searches (and I used quite a few terms). How do you know about these?

<comment><USER4> I can't quite remember what search terms I used .. Calibre was one, because it's good for doc mgmt. I added "open source". Then a couple of software reviews used the term "collection management". [http://alternativeto.net](http://alternativeto.net) was helpful, after I found one of the apps. Not really sure how I found them :)

<comment><AUTHOR> Just discovered alternativeto.net :) Very useful!

Having a bit of trouble getting data crow to work headless (even though it should 'just work'). Might end up delving into code after all :p</comment></comment></comment></comment></comment></comment></comment></comment>


Elixir v0.13.0 released, hex.pm and ElixirConf announced - <AUTHOR> http://elixir-lang.org/blog/2014/04/21/elixir-v0-13-0-released/ <comment><USER2> For those not sure what Elixir is, think of it like this:

elixir : erlang vm (BEAM) :: clojure : jvm

Elixir's syntax is heavily influenced by Ruby but its semantics and structure is very reminiscent of Clojure. Like Clojure you are constantly reminded you live on JVM, with Elixir you are constantly reminded that Erlang is under the covers and thats OKAY.

Its really great stuff and the creator José Valim has really put thought, love and care into every part of the project. I highly suggest you take a look, you might be surprised at what you find.

<comment><USER3> What is the advantage over Erlang? I guess this gives the syntactic sugar on the top of Erlang but I am not sure if this takes away the good parts of the language (pattern matching etc.) as well. Anyways, Erlang has a steep learning curve but if you invest the time it is pretty rewarding.

<comment><USER4> It is different. It doesn't have a 100% advantage. In some case it just sort of inverted the choice Erlang made -- lower case variables, vs upper case. Lower case module names vs upper case etc.

It has immutable data but not immutable bindings. Erlang has both as immutable. What that means is, you can do x = value1 then x = value2. In Erlang, like in mathematical notation, once you said X=value1 it is value1, it doesn't make sense to say X=value2 (it throws an exception). In either case you can't modify value1 in place for example by saying x[3]=4 or X[3]=4 ( <\- I am making up syntax to illustrate here).

Some like it one way some like it another.

Elixir has better meta-programming, which is nice.

In general, Erlang syntax is not the steepest learning curve. The steepest learning curve is to learn to use actors for concurrency and use functional programming for sequential parts. Elixir presents a more familiar syntax but the other learning curve parts are still there.

<comment><USER3> Well you are making variables mutable. This is bad. One of the great features of Erlang and generally any functional programming language is immutability that makes defensive programming unnecessary. I would like to keep that... The rest of the stuff is great but it does not give enough value to me to not to use Erlang. Actors is a basic concept and message passing is definitely the way to go if you are building a distributed system. One of the biggest problems with Ruby and the imperative languages in general that it was designed for local execution so communication and distributing computation is more difficult than for example in Erlang.

<comment><USER4> When we talk about variables we usually talk about 2 different things. Values and bindings. Values are the data in the variables ( a list, a tuple, an object), and bindings are names that are used to refer to data ( what the variables is called).

So X = [1,2,3]. in gives you variable binding X and variable value [1,2,3]. Variable value [1,2,3] is immutable in both Elixir and Erlang. You cannot do x[0]=5 in either one and expect the value [1,2,3] to be modified in place. Binding X is immutable in Erlang but not in Elixir. In Erlang you'd do X1=[5,2,3]. and in Elixir you could do x=[5,2,3].

You can argue what is better. I think both approaches are good, there is not one clearly superior in my opinion. Sometimes I take your side and prefer Erlang, because I like having explicit and immutable variable bindings that don't change behind my back. If I make X=[1,2,3], it is going to be [1,2,3] from now until forever.

As far as Actor and distribution stuff all that goodness is still in Elixir. They complement each other more than compete. Both take advantage of the awesome VM (BEAM) -- which I think is a marvel of engineering -- concurrent garbage collection, lightweight processes, scheduling balancing, async IO background threads, binary references, distribution and so on.

</comment></comment></comment></comment></comment><comment><USER5> If you are deploying Elixir apps to Heroku, checkout the Heroku buildpack for Elixir - [https://github.com/hashnuke/heroku-buildpack- elixir](https://github.com/hashnuke/heroku-buildpack-elixir)

Easy to configure and the deploys are pretty fast.

Disclaimer: I wrote it

</comment><comment><USER6> Been using Elixir for a new project and it's really nice.

For me it's not so much about bringing a nicer syntax to Erlang (Erlang's syntax is very nice once you get used to it, except for single assignment IMO. I'd prefer it if Elixir had taken Erlang's syntax and added support for rebinding variables and macros) but about tooling (mix, the build tool absolutely rocks) and libraries (e.g. take a look at [http://github.com/elixir-lang/ecto](http://github.com/elixir-lang/ecto)).

</comment><comment><USER7> I would love to contribute to Elixir, but jumping right into Elixir's issue list on Github to fix the bug there is a bit too hard for me. I wish there was some resources getting us familiarized with Elixir code base, and leading us more easily into contributing to Elixir, just like the The Eudyptula Challenge for Linux Kernel ([http://eudyptula-challenge.org/](http://eudyptula- challenge.org/)). Or is there already this kind of resource?

<comment><USER2> Keep an eye on this label [https://github.com/elixir- lang/elixir/issues?labels=Level%3A...](https://github.com/elixir- lang/elixir/issues?labels=Level%3AStarter&page=1&state=open)

Another way is to jump on irc freenode #elixir-lang and ask :).

Another way is to use it, report bugs, poor error messages or unclear documentation, and maybe fix it.

I did the later and the Elixir developers were super helpful and responsive.

</comment></comment><comment> sr-ix Elixir v0.13.0 now runs on Erlang R17 and brings with it map/struct support over records.

</comment><comment><USER8> i've been playing with elixir for a little while. i'm still wrapping my head around all its metaprogramming goodness, but so far it's been a fun journey.

also, jose valim must have clones of himself.

</comment><comment><USER9> I really like Elixir's syntax and really want to get into Erlang. I can't wait until I have some free time soon. Any good resources other than Elixir Sips?

<comment><USER2> The pragmatic programmer elixir book is excellent [http://pragprog.com/book/elixir/programming- elixir](http://pragprog.com/book/elixir/programming-elixir) .

The elixir-lang getting started guide covers a ton as well.

I'd also highly suggest working through [http://learnyousomeerlang.com/](http://learnyousomeerlang.com/) as almost all of the concepts apply to elixir.

If you are having trouble hop onto irc freenode #elixir-lang and ask for help! Always someone willing to offer guidance, including the creators and some of the Erlang contributors!

<comment><USER9> Thanks! Hopefully I'll see you on #elixir-lang some time after pitch day and finals.

</comment></comment></comment><comment><USER10> Any examples of Elixir in production at a well-known company?

<comment><USER11> Lots of Bitcoin exchanges use Erlang/Elixir.

But really any project using Erlang can and probably will add some Elixir to its code base at some point. The languages complete interop between each other by way of sharing BEAM byte code.

<comment><USER12> That's not the greatest of endorsements to be honest.

<comment><USER11> The scale at which Bitcoin exchanges operate at is pretty impressive. Dismissing that due to Mt Gox's poor security is ridiculous. Plus, I don't think the exchanges you're thinking of used Erlang/Elixir.

<comment><USER12> I did not mention MtGox.

<comment><USER13> What exchanges use elixir?

<comment><USER14> Based on my limited googling, at least Bex.io

[http://bex.io/faqs](http://bex.io/faqs)

An industry tends to congeal around a single technology for implementation (for example, Python in bioinformatics), so if bitcoin exchanges will start using Elixir, that is interesting

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> I'm surprised by this ElixirConf thing.

I've been involved in the Rust community, a considerably larger, more active and more mature community, and I would consider a RustConf still a little premature.

Is there really enough interest in it? How many people are expected to attend? How many are needed to attend to break even in some manner?

<comment><USER16> It is hard to compare communities of programming languages (even though I would be extremely interested in such data!). The only data I have seen around is this graph comparing the popularity on Github and the number of issues in Stack Overflow: [http://redmonk.com/sogrady/2014/01/22/language- rankings-1-14...](http://redmonk.com/sogrady/2014/01/22/language- rankings-1-14/)

Note Julia, Rust and Elixir are quite close to each other (which is nice considering they are about the same age). So, based on this data, I wouldn't classify Rust's community as considerably larger than Elixir's. Although Mozilla definitely helps Rust get some exposure!

Also I believe Elixir is more stable than Rust since Elixir runs on top of an existing Virtual Machine which helps us bootstrap the ecosystem and also skip a lot of "infrastructure work". We have also been avoiding breaking changes and doing deprecation cycles for almost a year now (sometimes it is unavoidable though) and Elixir has already 3 books in development (by O'Reilly, Manning and Pragmatic Programmers) with Elixir v1.0 planned for this summer.

Just to be clear, I am not knocking on Rust, just assessing the development stage of both languages (and please correct me if I got something wrong).

I am not sure about the conference details though, as I am just helping promote it, but wasn't there something like 20 or 30 people at the first RubyConf in US? We all need to start somewhere. :)

<comment><USER15> I just did some quick comparisons of my own.

Rust, by the way, goes back further than 2012; it became public in 2010.

IRC:

\- irc://irc.mozilla.org/#rust: 480 people

\- irc://chat.freenode.net/#elixir-lang: 158 people

On GitHub:

\- mozilla/rust: 414 watchers, 4,776 stargazers, 993 forks.

\- elixir-lang/elixir: 217 watchers, 2,317 stargazers, 323 forks.

Reddit:

\- /r/rust: 3,754 rustaceans, ~30 users here now, 172 posts in the last month

\- /r/elixir: 448 developers, ~6 users here now, 14 posts in the last month

Mailing lists:

\- rust-dev (it hasn't been split yet like elixir's are and is mostly development stuff; /r/rust is used more for other talk): 50 threads this month

\- elixir-lang-talk: 45 threads this month

\- elixir-lang-core: 23 threads this month

Stack Overflow

\- [rust]: 294 questions

\- [elixir]: 119 questions

Google Trends: [https://www.google.com/trends/explore#q=rust%20programming,e...](https://www.google.com/trends/explore#q=rust%20programming,elixir%20programming) shows "rust programming" at around 3× "elixir programming"

I agree that elixir is a little closer to being a mature language (for Rust, 1.0 is not expected for some months yet, though probably still this year), and the elixir community does appear to be more active and mature than I had thought, but overall it still looks to me as though Rust has at the very least the _larger_ community (I'll drop the _active_ claim out of laziness and the _mature_ claim for insufficient evidence) by a considerable way.

<comment><USER16> Oh wow, thank you for the data, that's great! I agree with your conclusion too.

I thought Rust was from 2012 based on Wikipedia. It seems they choose 2012 due to the first alpha release. Elixir is theoretically from 2011 but you couldn't really use it for anything... the first actual release was in May 2012. Anyway, it doesn't matter much, just curiosities!</comment></comment></comment></comment>


What are online compilers and IDE's? - <AUTHOR> http://www.codeproject.com/KB/ThirdParty/what-is-an-online-IDE.aspx

<comment><USER2> | It has always been difficult for programmers to organize and work on projects across a variety of locations, computers, and devices – especially when you work in teams. When you store your code on one computer at one location, you become tied down to that one computer, finding yourself running back to that machine each time a you're hit with coding inspiration. Worse, if you're working in a team, each member of the team has to send their code to every other member, each step of the way, creating organizational distractions and unnecessary delays.

If only there was some kind of tool to solve this problem. It could keep track of revisions and allow a team to work together on a codebase more easily. We could call it 'Version Control'.

And maybe, what if there was a way to develop on another machine remotely? Maybe like some kind of... secure telnet? We could call it Secure SHell. Man, it'd be cool if you could just SSH into your server and code from there.

Nah, let's just use clumsy web-based IDEs.

<comment><AUTHOR> Sure, that was my initial thought too. But something like this becomes useful for things like IDE settings across machines.

Version control solves the problem of sharing code across people and time, yes. This is more for sharing your development environment across different machines. Without needing to set up any kind of SSH on your own. And it's only clumsy because it's still so new.

I do think it'll be interesting to see this technology mix with version control and source code hosts. You could quickly tweak a few code files and commit a single change on GitHub. On a friends computer. Without sacrificing your editor of choice. Or perhaps further in the future, you could edit a view on on Heroku and see the changes happen immediately on a test server they'd be hosting with absolutely no local setup. Cool things can happen as this technology matures.

</comment></comment><comment><USER3> I already have one. It's called "SSHing into the company server".</comment>


Ashton Kutcher joins Lenovo as product engineer - <AUTHOR> http://www.usatoday.com/story/tech/2013/10/29/ashton-kutcher-joins-lenovo-as-newest-product-engineer/3306987

<comment><USER2> So this is what he does with his time now?</comment>


Samsung et al to Bring National ID to Your Smartphone - <AUTHOR> https://news.samsung.com/global/samsung-bsi-bundesdruckerei-and-telekom-security-partner-to-bring-national-id-to-your-smartphone <comment><USER2> Yeah... Thanks but no thanks. I think I'll just keep my plastic one for the foreseeable future...</comment>


When we first met David - <AUTHOR> http://sequoiacapital.tumblr.com/post/50915611153/when-we-first-met-david

<comment><USER2> David Karp was the 'special entrepreneur' Roelof Botha wrote about here:

<http://roelofbotha.tumblr.com/post/1364535289/inspiration></comment>


Seven more years for scaling - <AUTHOR> http://www.electronicsweekly.com/news/business/seven-years-scaling-2017-03/ <comment><USER2> Go to faster/lower power semiconductors and you don't need to scale in terms of size. Faster clock speed can mean fewer parts and you can go 3d if you get power down.</comment>


Using Self-Organizing Maps to Solve the Traveling Salesman Problem - <AUTHOR> https://diego.codes/post/som-tsp/ <comment><USER2> One of the professors in my PhD programme made his name by showing that anything you can do with a self-organising map, you can do with a Gaussian process. The work essentially killed off self-organising maps as a field of study.

One time we had seminar where a guest speaker had used self-organising maps, and the professor literally fell off his chair.

<comment><USER3> How exactly did theoretical equivalence result kill SOM's as field of study?

There is similar connection between deep fully connected neural networks and Gaussian process.

Deep Neural Networks as Gaussian Processes [https://arxiv.org/abs/1711.00165](https://arxiv.org/abs/1711.00165)

<comment><USER2> In much the same way the result you linked to slowed research into single- hidden-layer NNs. Another example is when the failure to learn XOR killed off the preceptron and nearly killed neural networks as a whole.

Researchers like low-hanging fruit, and some results just make a topic look barren.

<comment><USER3> > result you linked to slowed research into single-layer NNs.

You are thinking different link.

<comment><USER2> Yep, sorry. I'm thinking of the (much older) results referred to in the abstract of the linked article.

</comment></comment></comment></comment></comment><comment><USER4> It does not "solve" it though. It's not even an approximation (which is also NP-hard in the general case, not sure about the Euclidean case).

</comment><comment><USER5> This is awesome. I did exactly this for a course project in 2012. While the travelling salesman problem code seems to have been refactored out, I have a C++ library for SOMs and hierarchical SOMs that are attatched to some openGL code that demonstrates the categorization of RGB colors by label.

If you can excuse the embarassing mess of file structure, the core lib is here, buried among a dozen other pet projects from my student days: [https://github.com/KyleGalvin/Typhoon/blob/master/Cpp/SOM.cp...](https://github.com/KyleGalvin/Typhoon/blob/master/Cpp/SOM.cpp)

Edit: it seems (on second glance) the above link is exactly the TSP problem, wired up with SDL. The core library is here: [https://github.com/KyleGalvin/Typhoon/blob/master/Cpp/src/so...](https://github.com/KyleGalvin/Typhoon/blob/master/Cpp/src/somIII.hpp)

</comment><comment><USER6> > where we are able to find a route traversing 734 cities only 7.5% longer > than the optimal in less than 25 seconds

I could be wrong, but that does not sound like a very good method.

But I am all for people writing blog posts and exploring methods in order to learn, of course.

</comment><comment><USER7> 7.5% longer than is optimal is way too much.

Doing simple 2-opt/3-opt heuristic (10-100ms CPU time of optimization, 200 lines of code) gets you to 1-3% of the optimum.

<comment><USER8> That CPU time sounds reasonable for just 2-opt but I've found that 3-opt takes longer for tours with that many stops. The quickest strategy that involves 3-opt is to do a run of 2-opt followed by 3-opt, but for instances with 500 stops this can take nearly a second to run, even after parallelizing and optimising the code.

The tools you use will also make a difference. Python is difficult to make as performant as C.

<comment><USER7> Yeah, I was thinking of a C++ implementation. The nested for loops get optimized very well for the 3-opt case. There's also a couple of tricks one can do with preloading (simd) of distances for evaluating 2,3-opt simultaneously. That all fits into 200 lines of code. There's also the fact that after executing the best moves there's a lot of previously evaluated moves that are still valid. This also fits into those 200 lines.

Not trivial, but IMO less trivial than self-organizing maps.

<comment><USER8> > after executing the best moves there's a lot of previously evaluated moves > that are still valid

Ah, this has crossed my mind as well, but I hadn't got round to implementing it yet. You could even determine a set of independent swaps per iteration and perform them all in parallel.

</comment></comment></comment></comment><comment><USER9> Nice writeup Diego ;)

I worked with Diego (the author) on a first version of this, since it was a project in the course "Artificial Intelligence Programming" IT3105 at NTNU in Trondheim, Norway where we both stayed in our Erasmus a year ago.

While it is not very sophisticated to use SOMs for this problem, it was rather meant as an implementation exercise. And TSP allows a graphical representation of the process, which is nice too. That said, we spent way too much time in the course implementing and fine tuning Genetic algorithms...

</comment><comment><USER10> Neural networks, self-organizing maps, genetic programming. It feels like we're back in the 80s.

<comment><USER11> I recently read a math paper: abelian groups, hilbert spaces, lebesgue measures. It felt like we're back in the 1900s.

</comment></comment><comment><USER12> It doesn't "solve" anything, it just gives an admissible solution.

<comment><USER13> or at least _a_ solution

</comment></comment><comment><USER14> It doesn't solve it, because it doesn't handle roads

<comment><USER15> I presume to handle the roads you just have to change the distance function to use an API like Google Maps, TomTom, GraphHopper.

This would significantly impact performance though.

<comment><USER16> Yes, and additionally the problem is then not Euclidian anymore. For example the triangular inequality (distance from A to B directly is always shorter than or equal to distance from A to B via C) does not hold. I'd guess that that will deteriorate results from this method since it relies on the Euclidian distance from the current circle to the points to be visited.

<comment><USER8> I don't understand why you think traveling by road breaks the triangle inequality. If the time/distance along roads from A to B is fastest via C, then just go via C...

<comment><USER17> The triangle inequality is precisely the statement that this never happens.

<comment><USER8> You misunderstand. I'm saying that a situation such as:

dist(AB): 3km

dist(AC): 1km

dist(CB): 1km

is impossible even if those are road distances rather than Euclidean distances. If the road distance of traveling A->C->B is 2km then dist(AB) should not be greater than 2km.

<comment><USER17> So long as you're measuring in kilometers, as the bird flies. If you're talking about the distance a car would have to drive... okay, you're correct that it'd be possible to drive _through C_ and thereby cut down on cost, but that's somewhat besides the point.

The algorithm this article is talking about assumes that all points are on an Euclidean map, and the distance between them is simply the Euclidean distance. This requires the triangle inequality to hold for _straight lines_ , and allows optimizations based on that assumption.

The inequality in itself is a weaker statement than saying the whole thing is euclidean, and I haven't read it carefully enough to be sure which is required, but any violation of it is necessarily a violation of the assumptions that make this heuristic work.

<comment><USER8> Agreed. I was just responding to Zeebrommer's claim that the triangle inequality fails with road distances.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I've not read the article in detail, but it looks to me like they have produced a more efficient brute force method, which might be impressive but isn't nearly the same as solving it in any mathematical sense.</comment>