Introduction to Apache Mesos - <AUTHOR> http://www.antonlindstrom.com/2015/03/29/introduction-to-apache-mesos.html <comment><USER3> As noted in another comment, we, a growing starting with 5 people around software out of 15 people total, run a Mesos cluster with a couple of hundred machines. By FAR our largest challenge has been to adapt our thinking to break the "this machine is 'production', that machine is 'staging'" mindset. We have a production compute infrastructure and you're welcome to launch 'production', 'staging' or whatever jobs into it. The friction around "running Mesos" has mostly been the friction of the air from exhalatoins of joy buffeting our esophagi...

We have a separate, much smaller cluster to test new Mesos (and Chronos and Marathon) versions. But the distinctions "production", "staging" and "dev" have become much more nuanced, so we've settled on discussing the "application" environment versus the "infrastructure" environment. Much as, as a startup on AWS, you wouldn't distinguish the RDS instance of your database (e.g. 9.3.1), you would distinguish the version of your database on an RDS instance, we distinguish the versions of our apps on the production cluster and not the version of the production cluster. One of the team was an ex- Googler and he said that Google did much the same.

The one thing Marathon and Chronos currently lack is a prioritization mechanism so we're building that as a Chronos task that monitors and scales down/up Marathon tasks by their priority (as represented in their id or tag).

<comment><USER4> > The friction around "running Mesos" has mostly been the friction of the air > from exhalatoins of joy buffeting our esophagi...

Is there some common phrase relating belching and being happy that I haven't heard?

<comment><USER3> Not that I know of, but it'd be awesome to have a word for joyous belching...

</comment></comment></comment><comment><USER5> An interesting talk about Docker and Mesos by a former coworker, he also contributed to 0.22:

[https://www.youtube.com/watch?v=ZZXtXLvTXAE](https://www.youtube.com/watch?v=ZZXtXLvTXAE)

</comment><comment><USER6> Maybe this is a good place to ask a question that I've been pondering for a while: Why is Mesos based on the concept of resource offers? AFAIK this is backwards compared to other schedulers where you ask for resources and the schedule gives them to you (or not).

<comment><USER7> To load the framework (application) with the logic with the concern of deciding what resources it wants. The scheduler shouldn't care about what you get, just fairness. Two-tiered scheduling achieves this:

 _Mesos decides how many resources to offer each framework, while frameworks decide which resources to accept and which computations to run on them._

[http://mesos.berkeley.edu/mesos_tech_report.pdf](http://mesos.berkeley.edu/mesos_tech_report.pdf)

<comment><USER6> I guess that makes sense if frameworks care about placement (which I generally don't) because otherwise they'd have to express placement constraints to Mesos.

I still can't find documentation about what fairness policies are actually implemented, though.

<comment><USER7> Mesos uses dominant resource fairness:

[https://www.cs.berkeley.edu/~alig/papers/drf.pdf](https://www.cs.berkeley.edu/~alig/papers/drf.pdf)

</comment></comment></comment></comment><comment><USER8> Allow me take the opportunity and ask if anybody here is running Elasticsearch with Mesos (and Marathon) using Docker container?

I'm running Elasticsearch nodes on a dedicated Mesos slaves and I'm still not sure how much memory should I allocate to Elasticsearch task e.g. all available memory as reported by Mesos or some smaller amount to leave something for the system? Please note that I'm asking about memory allocated to the Marathon task not about JVM heap size.

<comment><USER9> I've taken the view of treating our database slaves as special and allocating all the memory on the slave to ES. That way ES (or any other db) always runs on the right slave, and no other potentially long running/resource hungry process runs alongside it (but just enough that's jenkins tasks and chronos tasks can still rune if need be).

AKAIK, there isn't a right way to run databases because the persistent storage layer into mesos is still being baked.

<comment><USER10> > the persistent storage layer into mesos is still being baked

That's pretty important point, would have thought persistent storage would have been first point to get working for a project like Mesos. Also, their homepage ( [http://mesos.apache.org/](http://mesos.apache.org/) ) outright states: "Apache Mesos abstracts CPU, memory, storage, and other compute resources away from machines [...]". What storage are they talking about if not persistent storage?

<comment><USER9> This mesos 0.22 talk goes into a bit more what they are imagining - [http://mesosphere.com/2015/03/27/mesos-0-22-0-released/](http://mesosphere.com/2015/03/27/mesos-0-22-0-released/)

Essentially the current mesos disk quotas are just so that tasks that run, run with a minimum amount of disk space. I think what they are trying to accomplish in future releases is some way you could build an EBS Style disk space management on top of mesos.

<comment><USER11> Yes, they are calling it dynamic reservations:

[https://issues.apache.org/jira/browse/MESOS-2018](https://issues.apache.org/jira/browse/MESOS-2018)

With a first draft of the user documentation at:

[https://gist.github.com/mpark/e8ee4eb9671bdb252c4f](https://gist.github.com/mpark/e8ee4eb9671bdb252c4f)

It will be really slick once this makes it all into Mesos 0.23

</comment></comment></comment></comment></comment><comment><USER12> question / thought : seems like mesos could evolve to be an alternative to openstack ...especially if a tenant layer is developed ..yes/no ???

<comment><USER6> Probably. And OpenShift 3.0 (also on the front page today) is a PaaS (Cloud Foundry competitor) built on Mesos.

<comment><USER13> OpenShift is most definitely not built on Mesos. RedHat's plans over time are to integrate with Mesos at a lower level for fine grained resource allocation, but for now Kubernetes is used as the cluster scheduling and orchestrations runtime.

</comment></comment></comment><comment><USER14> Okay, maybe I'm getting old, but I can't really see the point of Mesos. It feels like it's adding too much magic to the mix, and I can't see myself using it to deploy web app servers/databases. Is there a different intended purpose that I'm missing? I suspect it's great for deploying task workers, for example.

<comment><USER15> You can use it for web apps/services ([https://mesosphere.com/docs/getting- started/service-discover...](https://mesosphere.com/docs/getting- started/service-discovery/)). But I'm with you on databases. I guess I just like knowing that those hosts are being managed and cared for (pets vs. cattle).

With that said, I often wonder how many people are using Mesos/Marathon before they have any need for it? Using it on for 4 hosts vs. 40 or 400?

<comment><USER16> There's nothing wrong with Mesos on 4 hosts, though...

Anything more than a single host requires additional co-ordination - <USER2> Mesos is mostly no different than rolling alternate methods for doing so.

It's not choice with the least overhead, but it's a possibility, for those for whom it has the right conveniences...

</comment></comment></comment><comment><USER17> I've looked at Mesos briefly, but it seems completely JVM-based, and that you're not prepared to build your whole stack around the current Java stack (Hadoop, Spark, Storm, Kafka, Zookeeper etc.), Mesos has zero utility. Is this accurate?

As someone working on scaling microservices, I keep being disappointed by potentially useful services that turn out to require a JVM-based language such as Java or Scala. For example, Kafka looks very decent, but the high-level client is written in Java; if you're not on the JVM, you're stuck implementing a lot of the client yourself. As far as I know (from the last time I looked at this stuff), the Zookeeper client is similar, whereas Spark and Storm both require that you write processing code on the JVM, and libhdfs is apparently still JNI-based, not native.

For someone using Docker, is there anything competing with Mesos that _isn 't_ wedded to Javaland?

<comment><USER3> > [Not using Java -> ] Mesos has zero utility. Is this accurate?

Not at all. My company has a cluster with a few hundred Slaves and we're mostly a Python shop, with some C++ for machine vision.

Mesos certainly has its issues (as does everything), but its awfully nice for micro-services: if you can package your service into a Docker container, then you can launch it into the cluster and Chronos/Marathon/Mesos will take care of making sure that it's run/running.

I missed the deadline for the Mesos conference (I was unaware of the deadline), but I'm trying to squeak in a talk about "Using Mesos at [small] Scale" because we're a small company and Mesos has allowed us to do a bunch of big company stuff.

>is there anything competing with Mesos that isn't wedded to Javaland?

Yes, I can look at the source code and see that it uses te JVM (Chronos uses Scala), but, AFAICT, Mesos isn't "wedded" to anything. All of the components are API-driven. I apt-get install it, I run it, I send jobs to it, it works and it behaves well. Better I can poke at the APIs of any of the services to find out what is happening. So we use Marathon for service-discovery and run Chronos, a framework, under Marathon. Makes finding Chronos, which could be on one of 200 machines, quick and easy.

<comment><USER17> Thanks for the detailed reply!

I have to say I'm wary of big frameworks like this that insert themselves as a kind of monolithic control structure for everything.

My ideal setup is always one where I pick and mix the best modules for the job, and where I can write some interface glue to let my apps slot into the system, as opposed to writing my apps for a specific API (as tends to be the case with, say, Hadoop, and which of course would tie the whole platform to that API, making it hard to migrate to something else).

Sounds like Mesos is pretty modular and open in that respect?

<comment><USER3> Once you get to know it, Mesos is really quite simple: slaves emit events about their capabilities and running processes; masters collect and distribute an inventory of slaves and their processes and of events that occur on slaves. The frameworks (ie. Marathon for long running jobs; Chronos for scheduled jobs) then listen to those inventories/events and ask the Mesos master to add and delete processes from slaves. So Mesos is quite modular.

</comment></comment></comment></comment><comment><USER18> If you don't want to manage ZooKeeper manually to bootstrap Mesos cluster, you need another Mesos cluster haha.

<comment><USER19> Or just use Exhibitor. I don't remember the last time I manually anything'd with Zookeeper.

Between Exhibitor and Curator, I honestly find Zookeeper so straightforward and easy to work with that I don't quite understand the popularity of etcd.

<comment><USER20> I'm running a small Exhibitor/Zookeeper cluster dockerized (5 nodes, several hundred clients), and its extremely straightforward. Etcd isn't what we'd consider production-grade yet.

<comment><USER21> Having worked with etcd in production for the last few months, I have to agree. The CoreOS stack needs some more time to marinate.

<comment><USER20> Thanks for this comment. Glad to know I made the right choice.

I'm not saying etcd won't ever overshadow Zookeeper, it probably will with the momentum behind it, but as an ops guys, I wasn't willing to bet production application service discovery on it.

<comment><USER19> My distaste for the Go community is pretty well-established in these parts; I think worse-is-better is screwing us all, and etcd seems to me to be the worse-is-better Zookeeper. And for things that don't _matter_ , sure, worse- is-better your life away; a Rails app can be whatever you want, but the infrastructure _I_ manage had better be bulletproof. I won't say etcd will never be _competitive_ , but without some significant changes, I don't see it getting my vote--and those changes are largely around the parts of the feature set that etcd doesn't support, at which point...why use it, anyway?

</comment></comment></comment></comment></comment></comment><comment><USER22> I'm curious which of the Marathon bugs caused your downtime?

<comment><AUTHOR> I'm afraid I don't remember exactly which one it was but after an upgrade of the framework it worked perfectly again.

<comment><USER23> The 0.7X releases contained a number of bugs. 0.8X has been significantly better!</comment></comment></comment>


Google's Les Paul Doodle Cost More Than 10 Million Man Hours - <AUTHOR> http://digitizor.com/2011/06/13/les-paul-doodle-cost/

<comment><USER2> Estimate is 26 seconds on an average per person "wasted" on this doodle. Also, a possibly incorrect assumption that all google visitors on that day played with it.

What exactly is the point being put across here with such stats?

I wonder if it never ever occurs to them that on the flip side, google has saved time for a _lot_ of people over a long time? Where is the math on that you awesome spark-in-my-brain reporter?

</comment><comment><USER3> It's more like time invested. Assuming the logo attracted new users or made google newbies more into the service, then the more that those people use google, the more time they probably save in the long run.</comment>


Getting to know Android 4.1, Part 1 - The Basics - <AUTHOR> http://www.androidpolice.com/2012/06/30/getting-to-know-android-4-1-part-1-the-basics-slide-unlock-software-buttons-and-new-icons/

<comment><USER2> I've got Jelly Bean running on my GNex and I think the new UI is much nicer. This review spends a lot of time nitpicking the buttons, and the blown up pictures do make them look a little off. But I don't notice it all when using the phone.

In my opinion this review leaves out the best new parts of Jelly Bean. The notifications pull down has changed to show better previews of text or email messages. Including showing previews of both messages if you have more than one. The overall look and feel of the notification UI (and integration with the cards) is also much better.

This review also doesn't spend much time talking about the new cards system. It took me a few days to integrate it into my workflow but its really nice, especially the integration with Google Places. I basically see cards as a more refined UI to Google search results.

Just my two cents, overall Jelly Bean is a good improvement to Android and continues Google's goal to unify the Android UI.

<comment><USER3> It is "Part 1 - The Basics"...

</comment></comment><comment><USER4> Glad they fixed the icon height inconsistency issue. That bothered me a lot more than it should have. I always look at little problems like that as kind of a proxy for the rest of the system I can't see. So some random app force closes and I'm thinking 'this is because the parts I can't see are just as sloppy as the parts I can see' I totally realize that's not a fair assumption to make but I can't help it.

EDIT: Never-mind. Scrolled down in the article and realized they didn't actually fix it. I can't see how this could take someone more than a couple hours to fix. Come on guys.

<comment><USER5> > I can't see how this could take someone more than a couple hours to fix.

This is what kills me about the icon consistency thing. All it would take is a single Googler with Photoshop a single day to fix.

<comment><USER3> Because iterating great design is so obvious & effortless?

<comment><USER4> They just need to line them up. We know these icons are often going to be next to each other. I know Googlers are using these phones. It doesn't bother them?!

</comment></comment></comment></comment><comment><USER6> Why is it that they keep messing with the interface? It changes significantly even in minor version bumps. I think that goes to say why iOS usually feels much more polished. I can't imagine having my lock screen and UI colors change every couple months.

<comment><USER3> Few Android users keep the default backgrounds so it's only natural for Google to change too. It also makes it easy to see that it's new and different.

<comment><USER6> Background images are the smallest concern; the significant changes are UI accent colors, the unlock mechanism, fonts, input styles, toolbar buttons... while they change many times a year, iOS still looks essentially the same as 5 years go, yet beautiful and usable. The most radical changes I can remember are the switch to rounded radio buttons, lock screen shortcuts and notifications pulldown.

<comment><USER7> Well, "yet beautiful and usable" is a matter of opinion.

I find the 5 year old iOS UI boring and much less usable than the AOSP Android UI.

And this could be related to the fact that the Android team is refining the UI with every iteration.

</comment></comment></comment></comment><comment><USER8> Remember @thechut this is only part one. They'll probably go over the features you had mentioned. I think they did a fine job of analyzing the design and pixels, although i didnt notice the issues initially im glad they provide a second set of eyes.</comment>


Why Top Developers Love Fixed Pricing - <AUTHOR> https://gigster.com/blog/top-developers-love-fixed-pricing/ <comment><USER2> I'm curious to hear experienced developers' opinions on this. Is it true that fixed pricing is better for both sides, clients and freelance developers?

Here's the part I related to: "Freelancers rarely prefer a fixed price payment unless the it's significantly higher than market rate. That's because they've been _burned by scope creep_ or _unreasonable clients_ so they protect themselves by accepting hourly payment." (emphasis mine)

So how does a freelance developer with fixed pricing protect against scope creep, "unreasonable" clients, or unexpected things that take up more time than estimated? Sometimes, the jobs are so customized and varied, that it's hard to make any accurate estimate, even after planning in detail.</comment>


Gene Regulation, Illustrated - <AUTHOR> http://blogs.scientificamerican.com/sa-visual/gene-regulation-illustrated/ <comment><USER2> I've seen those before! The bottom set (with the coiled DNA and the mice) are my wife's illustrations. The process is interesting: both the mice and the DNA are 3D models rendered with Lightwave3D. Usually Jen (Scientific American's art director, and the author of the blog) creates a hand-drawn "sketch", then Emily creates the models and a rough "render", and then she and Emily go back and forth for several iterations of revisions.

Perhaps disturbingly to those who might take for granted the accuracy of the illustrations, a lot of time is spent searching the web for reliable references. Sometimes there are pre-existing line drawings from published papers, and sometimes it involves reading the text of the scientist's dissertation and trying to figure out what's actually happening. If anyone has questions on how the graphics are made, ask here and I'll get answers.

Or if you happen to be looking for similar custom scientific illustrations, here's Emily's website: [http://cooperhawk.com](http://cooperhawk.com).

<comment><USER3> Thanks! I never thought about how these drawings were made and your wife's website is very delightful to browse.

Does your wife get follow on work from the science community once a piece is published? For example, having the piece reproduced for conference journals.

<comment><USER2> She occasionally gets follow-on work with the original authors, but it doesn't seem that common. Reproduction varies for different publications, but usually she retains the reprint rights. I think she usually charges 10% of the original fee for anthologies and such. The original is usually priced by page size and complexity. An complex full page illustration like this one was probably about $2K, so reprint rights would be about $200.

</comment></comment></comment><comment><USER4> A great analysis of the Mukherjee article referenced in this article.

"...the word "epigenetics" isn't just being abused in the wider press. It's been abused by scientists as well..."[1]

[1][http://blogs.sciencemag.org/pipeline/archives/2016/05/12/epi...](http://blogs.sciencemag.org/pipeline/archives/2016/05/12/epigenetics- for-the-spirit)

</comment><comment><USER5> It's scary to see how certain traits can be passed on to next generations without altering the genes.</comment>


Ask HN: What careers outside technology as I get older? - <AUTHOR> I'm wondering if maybe I should leave the technology industry and do something else.
Older people I think find it harder to keep a dependable career and I'm not sure I want to continue in technology anyway.
But what else to do? I can't imagine anything else that might be an effective way to make a living.
Any ideas? <comment><USER2> Depending on what stage you are in life you could be a lot like me. I'm slowly but surely losing faith in a lot of things that I took for granted. I'm a computer security enthusiast and it really is depressing sometimes the direction things are going. So...I have deleted most of my online accounts and starting to work on being more independent. I lost my internet connection for two weekends in a row and it was a little surprising how much it effected how I live at home. Yes I could used my cell phone for the essentials like email but for everything else everything I had set up was useless. I would recommend trying to get a physical hobby where you could create something physical. It could be carpentry, blacksmithing, hunting/ fishing, etc. The point would be to get away from tech industry for short periods of time. I think the reason a lot of older people find it harder to keep a dependable career is because their values start to change. When you are young you are willing to burn the candle at both ends to build a career and get established. When you are older you sometimes don't want to spend your entire waking day working to keep up with the Jones' or maintaining your career.

<comment><USER3> Can I ask what you're losing faith in? I've just joined the infosec workforce but it's been a hobby of mine for awhile(22 y/o). I've already become jaded and bitter at this industry. I just see the industry being pillaged by profiteers at a detriment to the health of the industry.

<comment><USER2> To quote a tweet from Brian Krebs, "Being in infosec for so long takes its toll. I've come to the conclusion that if you give a data point to a company, they will eventually sell it, leak it, lose it or get hacked and relieved of it. There really don't seem to be any exceptions, and it gets depressing." [1]

Sometimes I feel like to only way to win is to not play the game. I believe that is another quote from the movie Wargames.

[1] [https://twitter.com/briankrebs/status/1045091640480804864](https://twitter.com/briankrebs/status/1045091640480804864)

<comment><USER4> Or perhaps we can change the rules of the game? It's noteworthy that he doesn't consider the possibility that a company delete/destroy the data.

As it stands now, its a no-brainer for companies to save as much information as they can about a person because there's almost no down side. The risk of a data breach to the individual(s) far exceeds the risk of a breach to the corporation. The incentives are massively misaligned. I'm cautiously optimistic that GDPR (with all of it's many flaws) could mark the beginning of slow a transition from corporate data hoarding to minimalism. You heard it here first: Corporate KonMari Consultant will be the trendy Gen Z career.

<comment><USER2> I doubt that Brian Krebs hasn't considered that. He works in information security and I would assume he is not on any corporate boards.

I would however agree that even though I am not normally in favor a regulations this would be a good place to have something similar to the GDPR. There should be a balance between data being an asset vs. a liability. Right now it is only viewed as an asset so there isn't enough emphasis on security.

<comment><USER4> Apologies for the confusion. I simply meant that particular quote hadn't contemplated destruction. And with good reason, there's virtually no incentive for businesses to destroy data they collect. I'm certain he has given quite a lot of thought to data destruction as it relates to data security. I was trying to point out that it was conspicuously absent in his tweet.

</comment></comment></comment></comment></comment></comment><comment><USER5> The whole ageism thing is overblown.

I'm in my mid 40s and I have a circle of six friends who are still developers and hands on architects. The youngest is 40 and the oldest is in his late 50s. The oldest one is our former manager who hired all of us and self demoted to a developer after his kids graduated.

All of us are able to change jobs like we change shoes depending on how picky we are being.

We don't live in SV or on the west coast. We live in a major metropolitan area. We all aggressively keep our skills up and are careful to not get left behind the current trends:

\- all of us (except for me) are using the latest cool kids front end frameworks.

\- we are all developing on top of either AWS or Azure and are actually using the technologies they provide and not just hosting a bunch of VMs.

\- we can all do Devops in a pinch.

\- all of us are using the latest .Net Core features or Node and most of us are using Docker.

\- We are all using a combination of SQL and NoSQL databases.

Etc.

We all have corporate jobs and won't go near any of the cool kids work 80 hours a week at below market wages with the promise of equity startups. We have grown people bills to pay and want to get home to our families.

<comment><USER6> >The whole ageism thing is overblown.

Or maybe you were just one of the lucky few.

<comment><USER5> How is it luck? I didn't become aggressive about changing jobs and my careeer until I was in my mid 30s. I've changed jobs a few times since then.

<comment><USER7> It's not necessarily luck, you've built a network in an area with opportunity, either on purpose or by accident. That works for both young _and_ old.

The problem is when you have to go in cold and pass a google-style interview just to get considered for any job, even at a greeting card company. The now ubiquitous position where "we only hire the top 1%."

With that much competition, being old puts you at a definite disadvantage. Especially when tech interviews focus on CS trivia rather than engineering design and experience, to the benefit of those fresh out of college.

Not every place is a startup of course, but the cargo-culting of interview "best practices" has spread far and wide as stodgy companies yearn to look cool.

<comment><USER5> Even after graduating from college over 20 years ago. I purposefully took a job as a computer operator in a larger city where I still live that was way below my skillset and the amount I could have made at in a smaller city closer to home as a junior Dev for the opportunity.

Over a decade later, when I really started taking my career seriously again, I made the same calculation. I had two choices, I could accept an offer that was paying more but using a technology that I didn't see having a future or taking a job paying only little bit more but was clearly a better long term play technologically. I'm aggressive about keeping up and having a competitive resume.

I respond to _every_ local recruiting company that reaches out to me. I keep them in the loop, I've met a few recruiters for lunch and I refer my favorite ones when I know someone is looking. I've also done hiring through recruiters.

 _The problem is when you have to go in cold and pass a google-style interview just to get considered for any job, even at a greeting card company. The now ubiquitous position where "we only hire the top 1%." With that much competition, being old puts you at a definite disadvantage. Especially when tech interviews focus on CS trivia rather than engineering design and experience, benefiting those fresh out of college._

I am still hands on. But, I had to elevate myself above being seen as "just a Developer". I've been asked simple technical questions to determine whether I had basic competence, but all of my interviews over the past few years have been along the lines of "draw out an architecture" or "describe how you would solve these $hairy_problems we are having. I have never been asked a leetCode type question. The closest I've gotten was writing a merge sort on the board - I did, got an offer but I was so turned off by the entire process that I took another job instead.

<comment><USER7> Yes, you made some decisions that turned out to be good, twenty years ago. A lot of folks didn't. Personally I've got a mixed bag.

<comment><USER5> Trust me. I haven't made a lot of bad decisions. But I made a few big ones between around 2002-2008 that I paid for for years.

Namely staying at one company too long, not keeping up with changes in technology, not building soft skills and having no network.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> It helps if you have a hobby you can make a use of / that you are good at.

For example, carpentry, metalworking and electronics (and low-voltage electrician) are some things that interest me in my free time, and it looks like you can make a living off of them, at least in my country.

</comment><comment><USER9> Have you considered technical work in academia? The culture's much more friendly to older people and you might prefer the type of work if you're a bit jaded by industry.

</comment><comment><USER10> > But what else to do?

At the intersection of career and life purpose-- good interview here with Simon Sinek on Finding Your Why...

> [https://www.jordanharbinger.com/simon-sinek-whats-your- > why-a...](https://www.jordanharbinger.com/simon-sinek-whats-your-why-and- > where-do-you-find-it/)

</comment><comment><USER11> What are your interests? What do you mean by "effective" way to make a living?

</comment><comment><USER12> Local economy always needs personal assistants, salesmen, customer service and carers.

</comment><comment><USER13> Artist.

<comment><USER14> To make a living?!

<comment><USER13> Did you mean "to make a life?"

<comment><USER14> I don't know what you're trying to say. I meant what I said. The OP was asking for ways to make a living. (disclosure: artist/musician, distinctly _not_ making a living from that)

<comment><USER13> The difference between what you wrote and what you wrote plus "right now" glommed on the end is the optimization function.

<comment><USER14> Again, I find it very hard to understand what you say. You write like you're making notes for yourself, but to communicate with other people, please be more explicit. Say what you mean. Both times, I've had to guess, because you didn't say. Only this time, I have no idea. (Or at least, it seems I don't have the knowledge you assumed I have.)

</comment></comment></comment></comment></comment></comment><comment><USER15> I recommend you to start your own business consulting firm as Consulting is a significant and growing business.

<comment><USER5> "Starting your own business" is not always the right answer. I agree with consulting but working for a consulting company. There is a lot to be said about being able to go to work everyday, do your job, and go home and not have to worry about chasing after clients, payments, etc. I like the idea of going to work every day, coming home and guaranteed money showing up in my account for the same amount twice a month.

The usual retort is you can be laid off from a job. That's true. But if you keep your skills current and marketable, have a network of local recruiters, and live in a major metropolitan area anywhere in the US, finding a job in IT is not exactly hard in 2018.</comment></comment>


Ask HN: Any Devs using HubStaff for time-tracking? - <AUTHOR> <comment><AUTHOR> [https://hubstaff.com/](https://hubstaff.com/)

Just curious what your feelings are about this level of 'tracking'.

Do you feel comfortable with it?

Is it too obtrusive?

Would you walk away from a project if this was required of you?

<comment><USER2> I'm using it both as an employee, and as an employer right now. Depending on the manager (or company / "organization" as it's called in Hubstaff) some of the features can be turned on or off.

As an employer, I absolutely love it. I've actually turned off all the intrusive features (screenshots, app tracking) and use it mostly just to get very accurate hours to bill our clients. Since my team works almost all on the computer, they use mostly just the desktop apps and it's pretty simple to use it as just a start / stop timer for when you're working.

As a consultant / freelancer / whatever term you want these days, it does force me to focus. Because I know there are screenshots, I do tend to do get heads down on a task. Some of us simply walk away from the computer when we need to take a break and let the timer detect if we were idle long enough that it needs to be removed. I tend to stop the timer manually when I need to get up and walk around. (~25 minutes.)

I find it also helps me make sure that I can bill enough hours to meet all of my financial goals, since the information is surfaced in the tool.

From the employee end, a lot of how comfortable you feel might end up with the manager as well. If they're lording over the data expecting 90 - 100% typing or will let you go at the first screenshot of a personal email, that would make me uncomfortable enough to walk away.</comment></comment>


Algorithmic tagging of Hacker News or any other site - <AUTHOR> http://blog.algorithmia.com/post/86295023534/algorithmic-tagging-of-hackernews-or-any-other-site <comment><USER2> Looking at the hn demo, I'm impressed. There are definitely relevant tags being generated. Unfortunately there also some noisy tags which clutter the results. Taking one example, the post "DevOps? Join us in the fight against the Big Telcos" given the tags "phone tools sendhub we're news experience customers comfortable", I would say that "we're" is unarguably noise. Another example, "Questions for Donald Knuth" with tags "computer programming don i've knuth taocp algorithms i'm" I would call out "i've" and "i'm".

There are other words in both examples that I personally would not use as tags, but I can't really say they would be universally not-useful. I think a vast improvement could be made just by having a dictionary blacklist filled with things like these - from this tiny sampling contractions seem to be a big loser.

<comment><AUTHOR> Agreed. Actually we could turn up the number of times it runs inside LDA algorithm and those would fix up but it affects performance. This was just a quick and dirty example (with an expectation of high traffic).

You can also seed LDA with a whitelist of words which we didn't do either - again all in the name of a quick and dirty solution to show.

Glad you liked it!

<comment><USER3> Try using tf-idf instead of raw word frequencies.

<comment><AUTHOR> not using raw word frequencies but [http://en.wikipedia.org/wiki/Latent_Dirichlet_allocation](http://en.wikipedia.org/wiki/Latent_Dirichlet_allocation).

Didnt know about tf-idf thanks for the tip.

<comment><USER4> it's hard to imagine someone knowing an LDA without also knowing about TF.IDF (it's a dot product, not a hyphen)

<comment><USER5> The OP is pushing "Algorithmica" whose manifesto is here: [http://blog.algorithmia.com/post/75680476188/algorithm- devel...](http://blog.algorithmia.com/post/75680476188/algorithm-development- is-broken)

and this doesn't really strike me as much of a victory for the idea that it's just the implementation of an algorithm being the sticking point in practice.

<comment><AUTHOR> We are just showing the versatility of the platform through a real world use case. LDA is hard to implement/scale for the untrained same as many other machine learning, optimization, graph traversing,etc algorithms. What we are building is crowd-sourced and generalized API where all these algorithms can be combined and used together to really make any application smarter.

The demo we show here is a version of how we used our platform to generate tags for all entries in our API by combining algorithms that existed already in Algorithmia. (modified for performance over quality due to the volume that HN would bring).

Cheers.

<comment><USER6> It's only hard because most libriaries I've seen have so little documentation available. It's simple once you understand the library. We need people picking these libraries up, implementing them on weekends on fun projects, documenting their work and code, and publishing it for everyone to learn from.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Very interesting.

I have been doing some research towards automatic tagging lately, and I found several Python project coming close to this goal : [https://pypi.python.org/pypi/topia.termextract/](https://pypi.python.org/pypi/topia.termextract/) , [https://github.com/aneesha/RAKE](https://github.com/aneesha/RAKE) , [https://github.com/ednapiranha/auto- tagify](https://github.com/ednapiranha/auto-tagify)

but none of them is satisfying, whereas Algorithmic Tagging of HN looks pretty good.

I have been trying to implement a similar feature for [http://reSRC.io](http://reSRC.io), to automagically tag articles for easy retrieval through the tag search engine.

<comment><AUTHOR> got your email will be responding later today. We enable automated tagging for any site directly from our API no need to implement anything else.

</comment></comment><comment><USER8> Well, it's not that easy. The algorithms are very primitive and too full of noise to be useful.

For example, try this on restaurant reviews like [http://www.yelp.com/biz/el- gaucho-seattle](http://www.yelp.com/biz/el-gaucho-seattle). I get these tags:

steak reviews seattle food service gaucho restaurant review

Not useful, right?

The current state of the art would use much more sophisticated NLP for generating POS tags and use sentiment analysis. For example, check out MSR Splat at [http://research.microsoft.com/en- us/projects/msrsplat/defaul...](http://research.microsoft.com/en- us/projects/msrsplat/default.aspx).

</comment><comment><USER9> This does well on the 'T Shirt test' on some sites, e.g. [http://www.riverisland.com/men/t-shirts-- vests](http://www.riverisland.com/men/t-shirts--vests)

This could be really useful in ecommerce for creating search keywords for category pages. The noise in the results matters not, so long as it gets 'T-Shirt' and someone searches for 'T-shirt' then all is well and good.

Are you looking to plug what you have into something such as the Magento e-commerce platform? The right clients could pay proper money for this functionality. It is something I would quite like to speak to you about.

<comment><AUTHOR> definitely interested please email me at diego at algorithmia dot com

</comment></comment><comment><USER10> LDA is very impressive. But it might be better to have an iterative algorithm that forms a linear-algebraic basis from several tags (and let people add more tags as vectors into the mix) and then every time people upvote something, you update their interests (points in the linear algebraic space) and then every time an article gets upvoted you update ITS tags ...

after a while the system converges to a very useful structure and new members can see correctly tagged articles and the system learns their interests by itself

do you know anything like this already existing?

<comment><USER11> slashdot.org tag system ?

<comment><AUTHOR> should be easy enough to implement, our API will be in public beta very soon I can show you how to build it.

<comment><USER10> Please do. Can you contact me at [http://qbix.com/about](http://qbix.com/about)? Shoot me an emailthere plz

</comment></comment></comment></comment><comment><USER12> This has real poetic potential:

        "Erlang and code style"

        process erlang undefined
        file write data
        true code

</comment><comment><USER13> After watching "Enough Machine Learning to Make Hacker News Readable Again"[1] I thought of recommendation engine/machine learning based linkshare/discussion system (eg HN/reddit style). Your frontpage would be continuously formed by your up/down-votes. I'm not sure if the same could be applied to comment threads too, essentially creating automatic moderation. Algorithmic tagging would certainly be useful for that kind of site.

[1] [https://news.ycombinator.com/item?id=7712297](https://news.ycombinator.com/item?id=7712297)

</comment><comment><USER14> Not too impressed to be honest; singular/plural forms are not treated equal; not familiar with LDA, but I've written and LSA implementation in the past, and it did a lot better than what is shown here.

<comment><USER15> I'm sure there is an amusing LSD joke in there somewhere.

</comment></comment><comment><USER16> Lol, this seriously took me by suprise. I'm currently developing a HackerNews with tags (you can self host it). I quickly generated this Google Form, if you are interested for being a beta user in the nearby future

[https://docs.google.com/forms/d/1UeSD11hrjwhsVbbPiv63VZBrEcz...](https://docs.google.com/forms/d/1UeSD11hrjwhsVbbPiv63VZBrEczzG5Tr4lwkuKAzY8A/viewform?usp=send_form)

PS. Screenshot included + it's already in alpha in a company with 100 users.

<comment><USER13> Do you know [https://lobste.rs/](https://lobste.rs/) which is essentially HN with tags.

<comment><USER16> Yeah, i know lobste.rs. But i go much further then HN or lobste.rs.. (not limiting with only url's or texts is just one feature). It's more a "Document Management System" with HN influence for larger Businesses (or public websites) with ( > 30 users) then a HN copy.

Call it lobste.rs 2.0

</comment></comment></comment><comment><USER17> I did that in 2012 for a pet project with a friend [https://github.com/SnippyHolloW/HN_stats](https://github.com/SnippyHolloW/HN_stats)

Here is the trained topic model (Nov. 30, 2012) with only 40 topics (for file- size mainly) [https://dl.dropboxusercontent.com/u/14035465/hn40_lemmatized...](https://dl.dropboxusercontent.com/u/14035465/hn40_lemmatized.ldamodel)

You can load it with Python:

      from gensim.models import ldamodel
      lda = ldamodel.LdaModel.load("hn40_lemmatized.ldamodel")
      lda.alpha = [lda.alpha for _ in range(40)]  # because there was a change since 2012
      lda.show_topics()

Now if you can figure out what is this file: [https://dl.dropboxusercontent.com/u/14035465/pg40.params](https://dl.dropboxusercontent.com/u/14035465/pg40.params) I'll pay you a beer next time you're in Paris or I'm in the Valley. ;-)

<comment><AUTHOR> I'll take a look, thanks!

<comment><USER18> [0.006791154078718692, 0.004654721825624361, 0.004632114646875695, 0.011976800134937546, 0.01799155954072435, 0.009181094647452455, 0.0345230793213232, 0.005232498042562552, 0.011402661654834138, 0.009024477282685779, 0.007034922780349653, 0.0031922239118904504, 0.007097905854058182, 0.004999249488505551, 0.016499595508879424, 0.024729974527642036, 0.004985711413178751, 0.03119529793092641, 0.015437847520669401, 0.2948424084650949, 0.06912364384956156, 0.004776347484051836, 0.0893067258386264, 0.018226129712679208, 0.0315656235097838, 0.006267920316323028, 0.01240414536928756, 0.005343403072840281, 0.006566103139036195, 0.009403510178615212, 0.009875448474490003, 0.0038449507757111973, 0.007531241580033292, 0.0014680865916836157, 0.00767397135040071, 0.002118254148078463, 0.02605710351719099, 0.034716581721697254, 0.002314474872742398, 0.12599103592023264]

<comment><USER17> Yes but what does it mean?

<comment><USER19> Looks like cosine similarity output

<comment><USER17> It's PG's parameters for a naive Bayes model based on these LDA topics, learned by taking his comments on HN as upvotes for the articles content.

</comment></comment></comment></comment></comment></comment><comment><USER20> After receiving 42 comments, I've ran their tagging algorithm on this page and got:

tags tagging hours link doppenhe reply ago lda

looks pretty promising!

</comment><comment><USER21> LDA/Topic Modeling is interesting stuff. I always feel like the way this data gets surfaced as "tags" is very ineffective. Any non-tech person would look at this and generally be confused. So this item is triggering my rants against tagging: \- Tagging is like trying to predict the future. What word will help some future person to get to this content? \- Tagging often tries to fill the hole left by bad search \- There is no evaluation method to measure how good a set of tags are \- Tags make very bad UI clutter.

Some of these points are related to encouraging users to tag content, but auto-tagging also seems problematic.

To me something more along the lines of entity extraction is more useful because it is a well defined problem, and can be used to improve a lot of other applications.

<comment><USER18> It seems like you would want to run k-means over the comments and the tags to pull out semantically meaningful words for tags and then reduce the total number of tags over the corpus. Then say, use wikipedia to generate an automatic taxonomy where those extract words occur.

<comment><AUTHOR> we do have k-means in our API as well this wouldn't be hard to do.

</comment></comment></comment><comment><USER16> I like this project (i am creating something like this, so i'm pretty serious).

But doesn't the auto-tagging feature make to much noise for a business use- case? For example, it tags a article of Amazon and includes Google in the tags. White-listing words wouldn't fix this (Google is a whitelisted word if Amazon is).

I don't know about LDA though. Perhaps a proper tag administration would fix this, but then you'd have to remove tags on the go.

<comment><AUTHOR> would love to chat more diego at algorithmia dot com.

</comment></comment><comment><USER22> Direct link to HN with tags: [http://algorithmia.com/demo/hn](http://algorithmia.com/demo/hn)

<comment><USER10> I always wondered -- how are some sites able to get an up-to-date mirror of HN, when HN blocks usage of its API after a while?

Are they using some alternative API that was blessed by HN?

<comment><AUTHOR> we just use their RSS

<comment><USER10> And they don't block that after a while?

How does iHackerNews show all the comments and everything?

Where are these RSS feeds? I doubt that's how "the pros" so it.

<comment><USER23> There is also an api:

[https://hn.algolia.com/api](https://hn.algolia.com/api)

I would think lots of apps are still scraping pages.

</comment></comment></comment></comment></comment><comment><USER24> Has anyone seen Open Calais [1]? It does tagging and categorization. It's been around for years and seems pretty powerful. It's a bit lower-level than Algorithmia (not href aware), but it seems more powerful, and a system like Algorithmia could be built on it.

[1] [http://www.opencalais.com/about](http://www.opencalais.com/about)

</comment><comment><USER25> With german sites it does not work so well. There is no blacklist for to generic terms for other languages than english?

</comment><comment><USER26> Doesn't seem to handle pdfs properly. For the mtgox link it comes up with

> stream rotate type/page font structparents endobj obj endstream

<comment><AUTHOR> the demo version if we cant scrape the text from the HTML we cant really run the topic analysis against it. pdfs, images, etc wont work.

<comment><USER27> PDF is easy to support if you use pdftk. You can even simply get the first page for large docs.

[http://www.pdflabs.com/tools/pdftk- server/](http://www.pdflabs.com/tools/pdftk-server/)

<comment><AUTHOR> thanks for the tip.

</comment></comment></comment></comment><comment><USER28> I signed up. Not sure if i would use it, but the Algorithmia concept is pretty interesting.

</comment><comment><USER29> @doppenhe - any hunch as to how well it would work on transcripts?

<comment><AUTHOR> you can try it yourself at the bottom of the blog post or you can send me a url and I can try a bunch for you diego at algorithmia dot com or @doppenhe.

</comment></comment><comment><USER30> error: failed to find worker for algorithm

<comment><AUTHOR> HN took us down for a second. Back up and running. Thanks for reporting.

</comment></comment><comment><USER4> Maybe also take a look at AlchemyAPI

</comment><comment><USER31> looks cool.</comment>


Sourceforge is down since March First - <AUTHOR> https://twitter.com/sfnet_ops/status/969743281922936832 <comment><USER2> They are up again, since about an hour: [https://twitter.com/sfnet_ops/status/970143157307559936](https://twitter.com/sfnet_ops/status/970143157307559936)

<comment><USER3> I'll definitely be interested in the postmortem.

<comment><USER2> Me too. I figured out that they moved to another data center during February, but not much else. Maybe I'm looking at the wrong place.</comment></comment></comment>


The largest cosmic structures in the universe don't really exist - <AUTHOR> http://www.forbes.com/sites/ethansiegel/2015/10/23/the-largest-cosmic-structures-in-the-universe-dont-actually-exist/ <comment><USER2> > The struggle between gravitational attraction and the expansion of the > Universe actually had its end determined some six billion years ago, when > dark energy became the dominant factor in our Universe. At that point, any > objects that weren't already gravitationally bound to one another never > would become so

This is assuming gravity won't become the dominant force again billions of years from now. We don't know whether or not dark energy is uniformly distributed in the Universe -- if it isn't, gravity could win again one day!</comment>


$60+ million in pre-orders in 6 weeks: A startup to watch - <AUTHOR> https://electriqpower.com <comment><USER2> Very intriguing..ill be watching this one closely.</comment>


The Most Honest Privacy Policy, Ever - <AUTHOR> http://www.itworld.com/print/129778

<comment><USER2> I've mentioned this before, I've never understood putting a ToS or privacy policy on a website.

Is it a legally binding document? They can change at any time and without notice. Who is to say what you just read, and apparently agreed to, didn't change in the few seconds it took you to post something.

How can you prove someone has read or not read it when something goes to court?

ToS of this comment: If you read this, you owe me 10 dollars.

Stupid, isn't it?

<comment><USER3> In some jurisdictions, you have to provide a privacy policy. Australia is one (for some businesses).

<comment><USER4> California too I think, if you're collecting personally identifiable information. <http://en.wikipedia.org/wiki/Online_Privacy_Protection_Act>

</comment></comment></comment><comment><USER5> I wish it expanded on the first paragraph in the (new) second paragraph.

 _For example, we profile your browsing habits and what you're interested in, and sell that to advertisers who attempt to predict your interests in porn, our most lucrative information sharing market. Recent web browser updates have prevented us from directly querying your history, but our statistics indicate that you might be interested in child models._

</comment><comment><USER6> i kind of expected this to be a more serious attempt at solving the current state of privacy policies being "hidden" behind overly long and complicated documents.

i think it's a brilliant idea to have a few standard privacy policies and/or terms of service documents where the service provider just fills in the blanks, a la GPL or BSD licenses.

seeing "our privacy policy is FPP" on a web service where FPP is a hypothetical document blessed by a reputable privacy advocacy group would certainly increase the appeal of that service amongst the ones who care.

</comment><comment><USER7> Where do I click "I agree"?

</comment><comment><USER8> What would you think about a revolution in the world of "Privacy Policy", spreading the usable approach of Creative Commons? We are trying to do this all at <http://www.iubenda.com> Let's discuss, I want feedback to change this world in better (I'm armed with Mockups :P)

Andrea

</comment><comment><USER9> Actually it's full of factual inaccuracies.

Sorry but this kind of snark does nothing to further the privacy debate.

<comment><USER10> yep, full of inaccuracies. The phrase "We're just suckers for guys with crew cuts carrying subpoenas" in the actual real-life privacy policies sounds like this

"We're just suckers for guys with crew cuts carrying subpoenas, of for guys who look like or sound like or whose emails look like they have crew cuts and carry subpoenas, or for guys who were able to persuade us that they look like they have crew cuts and carry subpoenas"

</comment></comment><comment><USER11> Deployed it on my blog - <http://www.puremango.co.uk/about/privacy-policy/></comment>


Probably the most bicycle-friendly city in the world - <AUTHOR> http://kevytliikenne.ytv.fi/?lang=en

<comment><USER2> Bicycle culture in Amsterdam: <http://www.youtube.com/watch?v=qk6YxhKH590>

</comment><comment><USER3> Helsinki is not that bicycle-friendly at all. More space for bicycles on the roads would help a lot more than a route planner. It is good progress, I don't deny that, but it certainly doesn't make Helsinki the most bicycle-friendly city in the world. Amsterdam and Copenhagen are probably years ahead of Helsinki.

</comment><comment><USER4> Ever been to Davis, CA? <http://en.wikipedia.org/wiki/Davis%2C_ca#Bicycling>

The city logo is a bicycle, and there's a bicycle statue too... <http://daviswiki.org/Bicycling>

</comment><comment><USER5> Boston is also quite good. An avid cyclist friend in SF was very jealous of our minuteman trail. I certainly love it, and there is talk of extending it all the way downtown.</comment>


Getting Superfish Out of Firefox - <AUTHOR> https://blog.mozilla.org/security/2015/02/27/getting-superfish-out-of-firefox/ <comment><USER2> This is a great move, but given my history I found this quote funny:

 _" Finally, a word to software authors who might be considering SSL interception: If you want to add features to the Web, don't intercept, make an extension. All of the major browsers offer extension frameworks (see these links for Firefox, Chrome, IE, Safari, and Opera)."_

It's funny because the whole intercept thing is an escalation between ad networks and browser writers.

Basically if you can simulate a search engine, and get someone to put ads on those pages, you can make a bit of money. Back in the day it was all about creating a toolbar that had some features, and oh by the way changed your default search engine. Didn't matter whether those results came from Google, Bing, Blekko, or more recently Yandex. The money was made when the person clicked an ad. (and yes the search provider got some form of remuneration, either for returning the results or as a share of the advertising revenue (or both in some cases).

But given the abuse of the extension eco-system all of the browsers now have really strong protections against switching your search choice, and if you don't do that the toolbar is pretty worthless. So to continue in their business of providing ads when they were not wanted, the folks in "Download Valley"[1] switched to trying to get between you and your search engine of choice and then "helping" it with a few more ads.

[1] Hat tip to Matt Cutts who clued me into that particular name for the cluster of folks who build all this adWare.

<comment><USER3> I would say the entire mechanism for extensions that can interact with pages is broken.

First, taking Chrome as an example, extensions are given the permission to see, track and interact with all pages loaded in the browser. Essentially, they can inject code, but they can also directly pull data from fill-in forms and other places.

Of course, these are the things that people use extensions for, so the ability to modify pages makes sense. Take one of the original extensions that was was used to modify pages at runtime, Greasemonkey. It was designed to attach a user.css to the page, or to run a transform on the page and inject specific DOM elements. Of course, there was nothing stopping an injected piece of script for posting data to a third party, but a cursory examination of the particular Greasemonkey customization would show that immediately, and the script could be flagged and removed from the collection.

Now we have extensions that do much more than these user scripts did in Greasemonkey and are self contained and harder to break apart and study. Two examples, Feedly which is my chosen replacement for Reader, has an extension which places a Feedly icon on every page. It doesn't add it to the browser chrome but actually adds it to the DOM of every single page that loads. As similar example is a Chrome extension for managing cookies, but which had a donation function that placed links on pages to donate to the project or something of the sort. Either of these could be accomplished with a small installable transform, and neither required the extension itself to have access to the DOM, the transform script could have handled the limited functionality of enumerating RSS/ATOM links or whatever the other extension did. But both of those extensions requested the amorphous permission of modifying every page you access.

In Firefox, at least until recently, unsigned extensions could execute native code in the form of XPCOM libraries, they could modify the entire chrome and run with the same permissions as the browser itself. They could intercept not only DOM calls but low level calls in browser js files which also ran with chrome permissions.

By reading a configuration file for a unique string, or, in some cases, guessing, you could find a path where placing a zip file or directory was enough to install an extension, so these extensions rode alongside installers for applications, BHOs in Internet Explorer that also installed themselves into Firefox, and other places that would have a chance of destroying a users experience and perception of Firefox.

<comment><USER4> That's why browsers suck as a platform - as a (power) user what I want is _more_ powerful extensions. Security limitations seriously hinder usefulness of things - but we need them because Internet is a hostile place, full of criminals and assholes (like companies we're talking about here and their ilk) looking to take your hard-earned money from you.

</comment></comment></comment><comment><USER5> People are getting mad at Lenovo for making people's laptop vulnerable to MITM attacks. But what I don't get is why people are not even more mad that Lenovo is injecting ads on their private computers.

Since when is it a thing that some laptop brands would put advertisements on your softwares? How come people still buy Lenovo if they do that?

<comment><USER6> Why would they be even more mad about the ads? Injecting ads is sleazy and deceptive, enabling MITM attacks is actually dangerous. You're right though, the ad injection by itself is still pretty sleazy even if it were perfectly safe. I think it just got overshadowed by the security concerns.

Heck, it's insane to me that most PC manufacturers slap a bunch of big ugly stickers on most of their laptops so they can make some absurdly small amount of extra revenue on a product that costs hundreds if not thousands of dollars. Willfully endangering users for a similarly marginal profit boost is so much worse. I have no idea why anyone would buy stuff from such a company.

<comment><USER7> Probably because the MITM vulnerability is horrible sloppiness, but the ad serving is done with the malicious intent of continuing to extract revenue from users that just ponied up a couple thousand dollars for the laptop to begin with.

I've read people saying there's no way developers didn't know what they were doing WRT the MITM vulnerability. To them I say "you've never worked for a giant corporation." Security holes are second in volume only to spent Keurig pods.

However, the choice to turn someone's entire computer in to an adware mechanism was explicit and just really sleazy.

<comment><USER8> I believe the possibility that a developer capable of understanding and creating this local MITM not being aware of the wider security implications is near zero. That would be like a scientist understanding nuclear fission and bomb making not knowing that detonating it in the middle of a city would cause a lot of deaths...

<comment> vertex-four The MITM framework was created by a separate company from the company that developed the specific piece of software. Just like you don't actually have to have a clue how a web server works to write a Rails app, the Superfish developers bought an off-the-shelf MITM framework and used it, which doesn't require much thought.

</comment></comment></comment></comment></comment><comment><USER9> Is there a way to check if _any_ non-standard root CAs have been added to my browser, without going through them one by one and comparing them to a fresh install? If not, is there at least a button to reset the list to a blessed-by- Mozilla default?

Because it's not just Superfish we need to be worried about. It's too easy for arbitrary programs to add root CAs to browsers, even if they aren't pre- installed by the hardware manufacturer. A while ago, I installed Avast! Antivirus on a Windows PC and found that it did exactly the same thing: injecting its own root CA into every browser (including Firefox) so that it could MITM all https connections.

Corporate IT with their own root CA is a special case that has nothing to do with the vast majority of Firefox users. For the rest of us, it would be very helpful if Firefox shipped with an independent certificate verification feature by default. Corporate IT can feel free to disable it at their own risk.

<comment><USER10> There are 176 certs in Firefox

[https://wiki.mozilla.org/CA:IncludedCAs](https://wiki.mozilla.org/CA:IncludedCAs)

So you could just count them, that would be a start :)

direct link to Google spreadsheet :

[https://docs.google.com/spreadsheet/ccc?key=0Ah- tHXMAwqU3dGx...](https://docs.google.com/spreadsheet/ccc?key=0Ah- tHXMAwqU3dGx0cGFObG9QM192NFM4UWNBMlBaekE&usp=sharing#gid=0)

EDIT: I tried it myself, exporting all the X509.crts from FF36.0 and got 253 !

sigh

</comment></comment><comment><USER11> What we really want is some way to be able to check the fingerprints to make sure that the cert that's being used is the expected one. This unfortunately doesn't seem possible without some out-of-band communications system.

Here in Thailand the junta promises to MITM all TLS traffic. I doubt it can be stopped, but it would be good to at least be able to see when they do it. I don't see sites publish their certificate fingerprints anywhere which would at least allow some form of manual check.

It might be enough to be able to get the browser to tell us when a certificate changes -- this would need to be opt in of course.

<comment><USER12> > I don't see sites publish their certificate fingerprints anywhere which > would at least allow some form of manual check.

That's exactly what Google and the likes are building in Certificate Transparency ([http://www.certificate- transparency.org/](http://www.certificate-transparency.org/)). It's basically a log of all modifications on any certificate chain that can be monitored by anyone who is interested so that misissuance can be detected.

There's also the old Perspectives project which idea was forked into Convergence ([https://en.wikipedia.org/wiki/Convergence_%28SSL%29](https://en.wikipedia.org/wiki/Convergence_%28SSL%29)) by good ol' moxie. The idea: any number of independent entities run notary servers, and when you get the certificate for a domain you also ask the certificate for the same domain to those notaries; if they have the same certificate, it means you all have the same "view" of the domain, so everything is probably ok. If they differ, maybe you (or they) were MiTM'ed.

<comment><USER12> Oh, and of course "publishing certificate fingerprints [somewhere]" is basically the idea behind DANE. So the idea is hardly, new. The _implementation_ , now ...

</comment></comment></comment><comment><USER13> Why dont browser makers add a function where the browser would tell you if your SSL connection is being intercepted? It's trivially easy to check, all you need is a known good site to sign a message with the cert of a specific CA, and if the browser sees it's signed by anything else, it would throw a warning. Chrome already does something similar with cert pinning.

<comment><USER14> Because the next Superfish will just let that one site through and intercept the rest. (If you don't believe me, take a look at the arms race around captive portal detection, and captive portals don't even have the convenience of running on the same computer and being able to add SSL root certs.)

Alternatively, the next Superfish could just patch that check out.

<comment><USER15> What arms race is there with captive portal detection? Don't they want to be detected so that the user can log in?

<comment><USER14> Many captive portals don't want to be detected _in a separate flow_. OS X, iOS, Android, Chrome, Windows 8, etc. all notice if you're running a captive portal, and pop up a separate browsing window: as soon as you can reach the portal, they kill the window and let you get back to your work.

But if the portal was going to redirect you to some ads or other "value-added" content, then they may not want that window to be killed. My former local Barnes and Noble would explicitly whitelist Windows' detection URL, so that they could redirect you to the BN home page instead of to the page you were trying to visit.

Cisco has explicit documentation on whitelisting Apple's URLs... and in turn, Apple has switched from testing a single URL at apple.com to "as many as 200 websites". [https://supportforums.cisco.com/document/11934456/captive- po...](https://supportforums.cisco.com/document/11934456/captive-portal- ios7-public)

<comment><USER4> Indeed.

And seriously, let's admit it - the "value added" thing is bullshit, and captive portals are mostly either useless (TOS that no one reads anyway) or evil ("value added"). And as I see a few of my cow-orkers working on a captive portal right now, I can't help but think that marketers indeed live inside a strong reality distortion bubble, not realizing that the product they want is making everyone's life worse.

</comment></comment></comment></comment></comment><comment><USER16> I've read a lot of conflicting information about this. One source says Firefox doesn't use the windows store, so it's not affected. Then this says it is affected. But how? Are Lenovo laptops coming preloaded with Firefox? Is it happening after the fact?

<comment><USER17> Firefox doesn't use the Windows certificate store. The Superfish installer will add its certificate to Firefox's store if Firefox is already installed, but it isn't on Lenovo laptops.

</comment></comment><comment><USER18> For a trial of something on an even worse level, British (previously monopoly) ISP BT deployed something called Phorm[1].

I'd love to see the internal Lenovo emails that led to Superfish being part of their OEM build. No way they didn't know exactly what they were doing.

I was just hovering over the new Dell or the Carbon X1 as my next purchase. Decision made.

[1][http://en.wikipedia.org/wiki/Phorm](http://en.wikipedia.org/wiki/Phorm)

</comment><comment><USER19> >In order to be able to inject content into secure connections, it adds a trusted root certificate to the Windows and Firefox root stores.

I'm really not an expert. Can someone please explain what this means? How is Lenovo able to modify firefox to intercept web connections? If Lenovo can do this, can anyone? How can I check firefox hasn't been tampered with before I download it?

<comment><USER20> |||->Options->Advanced->View Certificates

SSL works by verifying a certificate against an authority, so if there is anyone you don't trust on your list, you can't trust site you are visiting. Superfish distributed their private signing key everywhere, protected only by the simple 'komodia' password. Now anyone can pretend to be them. Operating systems install their own list of authorities, but Firefox maintains its own. Other Komodia products are also vulnerable.

<comment><USER21> I feel like it's better to not mention the password on the key. It could have been the best password in the world and it wouldn't matter. Local signing means the key can be extracted. Talking about the minor obfuscation of storing a passworded key in the same file as the password is a red herring that gives the wrong impression.

In short: It wasn't protected by the password. It was protected by nothing.

<comment><USER20> Good point. The important part is that it illustrates just how vulnerable Komodia products are. That password will likely get people access to other things as well.

</comment></comment></comment></comment><comment><USER22> > "We do not remove the root certificate if the Superfish software is still > installed, since that would prevent the user from accessing any HTTPS > websites."

I would have thought that breaking HTTPS for these users is a superior outcome to allowing the continued use of broken HTTPS. If I were a n00b and it were my Lenovo laptop, I'd rather have my internet browsing fail.

</comment><comment><USER23> Why take a system you know is compromised, shift a few things around, and hope for the best?

Format the drive and install a fresh, non-malicious OS image.

</comment><comment><USER24> Can't they remove it via a software update? I know they've removed add-one before.

<comment><USER25> It's added as a root certificate in Windows, not directly in Firefox, so a bit different.

<comment><USER26> Firefox uses its own certificate store through its bundled NSS libraries, which was also targeted.

<comment><USER25> Thanks, my mistake, I think it would make sense to remove automatically in the case.</comment></comment></comment></comment>


How the EPA is hindering cleanup in the Gulf - <AUTHOR> http://online.wsj.com/article/SB10001424052748703426004575339650877298556.html?mod=wsj_share_facebook#articleTabs%3Darticle

<comment><USER3> WRT the Jones Act: [http://www.factcheck.org/2010/06/oil-spill-foreign-help- and-...](http://www.factcheck.org/2010/06/oil-spill-foreign-help-and-the- jones-act/)

"Q: Did Obama turn down foreign offers of assistance in cleaning up the Gulf oil spill? Did he refuse to waive Jones Act restrictions on foreign-flag vessels?

A: No to both questions. So far, offers from six foreign countries or entities have been accepted and only one offer has been rejected. Fifteen foreign-flag vessels are working on the cleanup, and none required a waiver."

WRT to the EPA being slow to waive regulations or allow state and local initiatives, they're doing their job to make sure the cure isn't worse than the disease. The sand berm idea for example has been panned by a lot of experts. I also have a friend at the EPS region 1 office who works in water quality and they are very skeptical that the berm idea will work but they're under political pressure to allow it. Ideas should be implemented because they're good ideas, not because under-educated politicians think it will make them look good.

<comment><USER4> (a) Why was the one offer rejected?

(b) Might more offers have been made if the Jones act didn't exist?

(c) Isn't it true that the fifteen foreign-flagged vessels working have nonetheless had to have their experienced foreign crews replaced with Americans due to the demands of the Jones Act? Also, don't they have to stay at least three miles offshore at all times?

<comment><USER3> _Might more offers have been made if the Jones act didn't exist?_

From the linked article: "In reality, the Jones Act has yet to be an issue in the response efforts. The Deepwater Horizon response team reported in a June 15 press release that there are 15 foreign flagged ships currently participating in the oil spill cleanup. None of them needed a waiver because the Jones Act does not apply. The Jones Act is a trade and commerce law that was enacted in 1920 as part of a larger Marine Merchant Act. It requires all trade delivered between U.S. ports to be carried in U.S. flagged vessels constructed in the United States and owned by American citizens. The law states its purpose is to develop a merchant marine for national defense and commerce."

and

"To date, 25 countries and four international organizations have offered support in the form of skimming vessels, containment and fire boom, technical assistance and response solutions, among others."

</comment></comment></comment><comment><USER5> A vessel able to collect 500,000 barrels per day? There's no way the government should block this (albeit foreign) ship.

 _"The combination of these two regulations is delaying and may even prevent the world's largest skimmer, the Taiwanese owned "A Whale," from deploying. This 10-story high ship can remove almost as much oil in a day as has been removed in total—roughly 500,000 barrels of oily water per day. The tanker is steaming towards the Gulf, hoping it will receive Coast Guard and EPA approval before it arrives."_

<comment><USER6> Of oily water. That's very different from 500,000 barrels of _oil_ per day.

</comment></comment><comment><USER7> It's incomprehensible to me how people can still be thinking this. Essentially _all_ the _facts_ point to things like this being fundamentally incorrect.

Help has been accepted, and the Jones Act isn't an issue. Help that's been refused has been refused for pretty rational reasons (unapproved chemical dispersant), and some of the "help" is the same help vultures offer - <USER2> come with extravagant price tags, clearly hoping to get rich off our misfortune.

This is flamebait bordering on libel.

</comment><comment><USER8> I think the author's insinuation that this is an attempt not to "let a good crisis go to waste" drained a lot of the credibility from the article.

It's clear that Obama is a huge proponent of offshore drilling and that he won't do anything to jeopardize it.

It's odd how a conservative essay tries to paint Obama as someone who would stop all drilling when it's so far from the truth.

I think that ending all offshore drilling should certainly be under serious consideration after a disaster of this magnitude... there is no economic justification at present for risking the environmental damage.

<comment><USER9> I agree with everything up to the last statement after the ellipsis.

There _is_ economic justification for risking environmental damage. More offshore drilling = cheaper oil; More offshore drilling = more jobs (to name a couple).

I don't think this is a simple issue. The debate is a valid one.

Nuclear energy is dangerous but we do it anyway and similarly, it's not like all of a sudden deep water oil rigs are going to start failing left and right; statistically that is highly improbable.

<comment><USER8> It's not fair to compare oil to nuclear. Nuclear offers so many cost advantages, while adding some oil wells in American waters only minimally impacts the price of oil. Jobs should never be a justification for anything (if job creation is the goal, simply banning the combines that harvest corn would create tens of thousands of field worker jobs).

Deep water oil rigs will fail and when they do untold environmental damage will be wrought. We simply can't control the ocean's currents or seismic events.

There is absolutely no reason that a first world nation should settle for offshore drilling and the environmental impacts/risks it creates.

</comment></comment></comment><comment><USER10> this is a dupe, please kill it. big comment thread on same exact article within the last few days.

<comment><USER11> I can't find the dupe. Care to provide the link?

<comment><USER10> sure thing:

<http://news.ycombinator.com/item?id=1482486>

</comment></comment></comment><comment><USER12> Hope they change this policy soon.

</comment><comment><USER13> You know when you can stop reading the WSJ's blather, when an opinion piece begins with this gem:

"First, the Environmental Protection Agency can relax restrictions on the amount of oil in discharged water, currently limited to 15 parts per million. In normal times, this rule sensibly controls the amount of pollution that can be added to relatively clean ocean water. But this is not a normal time."

This just sounds straight like out of BP's badly bungled PR playbook.</comment>


Microsoft OpenAI can write Python code based on function signature and comments - <AUTHOR> https://www.youtube.com/watch?v=fZSFNUT6iY8 <comment><USER2>
        def f() -> bool:
            """return True iff the Collatz Conjecture is true"""

        def g() -> bool:
            """return False iff OpenAI correctly completes this code"""

These tricks will only work for simple things, won't work for complex things (but is likely to give obviously nonsense answers), but even worse there will be a middle swamp where it'll write something complicated, plausible, and wrong.

As usual, a video of 2 or 3 simple examples, curated beforehand so you're confident they'll work, tells a different story.

Just for the sake of curiosity, I also asked GPT-2 whether it would work. Here's what it said:

        Here's why this Python code-generating AI won't work. The other
        reason is that it will require you to make something that performs a
        large and complex program. This, after all, is what the function
        call is to do, a "simple function" that returns a function that
        accepts an integer number as its result. Let's say that I say
        "hello" in the code and I get the value by making a change. To do
        this, I divide the value by a few. Next, I increment the value by
        two. The process will fail, because I need a new function which will
        return a result, but in this case I get a value by incrementing the
        value by two. This gives me the answer that is most likely true. We
        need to know exactly which value we want for the computation and to
        implement ways to handle returning it.

You said it, GPT-2.

<comment><AUTHOR> > These tricks will only work for simple things, won't work for complex things

Even complex systems include a lot of simple code.

A practical tool based on this doesn't need to be able to generate large working systems or solve complex problems hands-free. It just needs to be able to provide autocompleteable suggestions for the simple code parts. It can do so only when it's very confident it knows what you're looking for, and you'll share a meaningful percentage of time off of all software development work. Never write any boilerplate code for anything ever again.

Accuracy is likely to improve in that case too, since inline suggestions have much more context than just a function declaration.

That's before you start thinking about running this in reverse, and using it as AI-powered linting. If I write some code and the AI is very confident that part of it isn't what it would suggest, flag it for examination. It'll only catch simple mistakes, of course, but a lot of developers make a lot of simple mistakes that they miss every day.

</comment></comment><comment><USER3> More interesting to me is the capacity of Idris 2 to complete a function based on type signatures -- because (when it works) you can be sure it got it's correct.</comment>


Ask HN: Is the Free "Masters in Financial Engineering" by WQU Worth It? - <AUTHOR> I would like to know if HN thinks it is worth to go through WorldQuant University's "Masters in Financial Engineering".
https://wqu.org/
The two-year program consists of 14 courses and is offered by the philanthropic arm of Worldquant, an investment management firm.
What do you think about the course content? Is it practical and how useful it is in the age of Machine Learning? (the courses has ML courses and primarily uses Python).
I believe, courses like Stochastic Calculus, Derivatives are not covered, does this omission misses important topics from the perspective of the job market?
What do you guys think? <comment><USER2> If you can already program apply to places like Two Sigma and Jane St Capital [https://blog.janestreet.com/interviewing-at-jane- street/](https://blog.janestreet.com/interviewing-at-jane-street/) then work in finance for a while and see what you really need to do Quant type work, which is typically a lot of university level stats/math.

</comment><comment><USER3> actually looks pretty good from the course descriptions... too bad I am to lazy to do it ;-)

</comment><comment><USER4> Probably.</comment>


My Attempt to MIT Sloan Optional Essay - <AUTHOR> http://solforsloan.com/ <comment><USER2> Wow, I'm really not used to the manner people today blow their own horns. It used to be only politicians would dare do that, but apparently everyone and their "younger artistic sister" find it okay now.

Which is probably not a bad thing (if you can't say good things about yourself, who else will?) -- it's just that it makes me feel I'm from another planet entirely.

<comment><USER3> I was just reading this thread at reddit: [http://www.reddit.com/r/AskReddit/comments/1syhp1/people_wor...](http://www.reddit.com/r/AskReddit/comments/1syhp1/people_working_in_college_admissions_what_are_the/)

Amuse yourself.

</comment></comment><comment><USER4> Hey what's up, bro? I have unsolicited suggestions both personal and professional.

Professional: Your thing needs to be more specific. List more concrete crap that admission officers want to see, particularly meaningless statistics that these people would get off on, since this is B-school, emphasize on BS skills: e.g., improved user conversion on X project from 10% to 25%. led X project with Y developers using X PM methodology and delivered to customers Z months ahead; just throw in one tech skill for good measure.

Personal: You seem to be very 1) implicitly smug about your accomplishments and 2) vague about your goals except that you are fixated on prestige and the Asian immigrant story, such as listing your wife "being a doctor" and your very endeavor of applying to "b-school" and your family's "started from the bottom now we here"; no one cares, bro.

First, you have to learn how to toot your own horn without blowing your cover. Stroke other people's egos like applying to b-school, figure out the crap that those people care about, e.g., "innovation" and pretend that you buy into their system, I used "big data to analyze which African village is in the most need for water and went out and tried to get grants." Have to brag yourself and give a reach-around to the powers-to-be without appearing to brag yourself.

Second, you have to learn how to have a real concrete goal. Don't care about your family, don't care about what awkward nice things people have to say when you solicit rec's from them. Say something real, like "I want to be the next Korean superstar and take over the world!!" means more to me than "Data Scientist". I may not like "Korean superstars" but at least I'll have respect for someone who knows what they want and won't take crap from anyone.

<comment><USER5> This is an 'optional' essay. SO I guess is an appendage to other more trad stuff like resume and regular recommendations. Making that assumption there should be links from this to the specific projects that you worked on.

My initial impression was to agree with the parent - much more specific. What context did these people say these things about you? I would de-emphasize the personal stuff a bit and foreground the professional.

So when Jesse who you know from 'quid' says X, it has context.

The overall layout is very linear and there are no crosslinks. All a bit overwhelming.

Having someone mouse over a series of photos to get unconnected comments is not a good way to show mastery over data.

At this point - I think the result of your hard work in this case is a liability. All these blurbs and datapoints do not tell a story (and there really are not that many of them).

Give it better structure - connect back to some reference point (resume, etc) and it could work well.

best of luck

</comment></comment><comment><USER6> Let me be brutally honest, because I think this gives you a clear POV on this. I think if you would have invested the time you put into this website and the surveys into some good cause or a smart idea that produces only a(nother?) single line in the newspaper, you would send a much stronger signal than what you have now. Especially MIT is a place that asks for people who do things, not those who do use the megaphone (mens to manus). I believe you might be a smart person and have ambitious goals but the approach might just not fit to the institution you aspire.

The main questions that remain unanswered to me are: 1\. What does the website serve for? 2\. What has he achieved so far? (entrepreneurship record, projects etc.) 3\. Where has he been a decision maker? 4\. What professional recommendations does the person have? (And how biased are they?) 5\. Social impact? 6\. REASON WHY? (Being at MIT to be at MIT?)

Whatever I missed in the first five points, you really need to fix #6. It is the far most important.

Among the answers by your friends, there is nothing really tangible. So far, it is just a collection of adjectives. It reads like you are a nice person but the special something is missing. Imagine you just had an interview at Sloan and there were likely around 30 others like you. How do you make sure to get reminded by the interviewers and how?

"The guy with the friend survey", "the data-driven decision maker" or "the one with the family" is not likely to give you a signature move.

I'd say give yourself some time and start something else; develop yourself. Don't expect MIT to polish a raw diamond. Also, don't forget that business experience, professional recommendations etc play a much more important role as any friend-recommendation. Further, I have worked with many MIT people and institutions in the past and what I can say is that it might be one of the places where many people who have bright ideas and great backgrounds are still interested to stay low and humble. They don't necessarily search for attention. I might be corrected by MIT people that this perspective is totally wrong, but that was my experience in about 8 years.

@auctiontheory. "It's pretty clear that the two best B-schools to get you ahead in life are HBS and Stanford GSB.". The more I think about this sentence, the more arguments come to my mind why this is complete nonsense :)

</comment><comment><USER7> I'd stick with native scrolling. The accelerated scrolling (I'm assuming via a jQuery plugin) made it difficult to explore the content.

</comment><comment><USER8> Assuming that you are interested in technology entrepreneurship, I'm not sure that an MBA program is the best use of your time and money. It's pretty clear that the two best B-schools to get you ahead in life are HBS and Stanford GSB. The ROI drop off is pretty steep after that, at least outside of Wall Street.

The differentiator is not quality of education, it's brand and network. E.g. see where top VCs get MBAs.

<comment><USER9> While I agree with your general point and sentiment, the falloff happens a bit later, and I'd widen to include Sloan, Wharton, Tuck, Kellog at least.

<comment><USER10> And Booth, particularly if you study the right things.

</comment></comment></comment><comment><USER11> I don't know the requirement for the essay but I'm guessing that the admissions board is supposed to get to know you or your work better through the essay. I'm not sure how successfully this website achieves that goal. Also try to follow the "show, don't tell" mantra.

That being said, the design is nice and best of luck to you.

</comment><comment><USER12> You should move the survey response bars into a more neutral organization, otherwise it places "respectful" and "team player" in a context where they appear to be lacking compared to your other traits. Also, I believe you mean 'persistent' in your scrolling text bit at the top.

</comment><comment><USER13> I wonder if this will put social pressure on the reviewers. Do they have to accept the popularity (if this thing becomes so viral?) into the admission account or will they be able to decide independently. I think the initiative is great and truly admirable for an MBA graduate study.

</comment><comment><USER14> Psst: it's "persistent".

</comment><comment><USER15> Looks great Sol. All the best of luck.</comment>


Google Employees Shocked, Depressed, And Ready To Bail - <AUTHOR> http://www.webguild.org/2008/10/google-employees-shocked-depressed-and-ready-to-bail.php <comment><USER2> Yeah, how could they have predicted this? It's not like we had a major internet bubble burst just a few years ago that could have provided any reasonably awake person a little perspecitive on the value of options, or anything like that.

</comment><comment><USER3> "Google has established a plan with Morgan Stanley (which might go under)..."

Wow. That is, IMHO, a hugely irresponsible claim to make unless the author, the president of the WebGuild, is privy to some inside information as to the state of Morgan Stanley. If so, he should back-up his claim with his source and not just nonchalantly bring it between two parenthesis.</comment>


Security culture, the Dropbox way - <AUTHOR> https://blogs.dropbox.com/tech/2018/06/security-culture-the-dropbox-way/ <comment><USER2> I'm sure Dropbox takes security seriously and works hard at it but this piece doesn't tell me a lot more than that except in much longer form. You can find/replace 'trust' (and 'security') with 'truck' and come away as informed and potentially slightly more amused.

<comment><USER3> Some informative parts that keep their meaning under s/trust/truck/g include:

"... daylong social engineering workshop designed and led by internal experts that immersed them in a hypothetical scenario involving a malicious insider."

"... a hands-on workshop where Dropbox employees researched, crafted, and presented their own phishing schemes."

"... our annual Capture the Flag"

It's interesting the emphasis on social attacks. You only have to get the cryptography right once, but every employee needs to defend against social engineering.

<comment><USER2> You forgot the really important ones, I think. Trucktober and tailgating. It does raise the interesting question of why Dropbox does not celebrate Trarch.

</comment></comment></comment><comment><USER4> The harder a company tries to sell their philosophy the less I'm inclined to believe them. Words are cheap.

</comment><comment> java-man a better approach would be implementing a zero-knowledge storage infrastructure, like tarsnap.

<comment><USER5> which prevents issues like [https://techcrunch.com/2011/06/20/dropbox- security-bug-made-...](https://techcrunch.com/2011/06/20/dropbox-security-bug- made-passwords-optional-for-four-hours/)

<comment> java-man as well as [https://techcrunch.com/2014/10/11/edward-snowden-new- yorker-...](https://techcrunch.com/2014/10/11/edward-snowden-new-yorker- festival/)

<comment><USER6> Thanks for this. I'm going to look at moving away from Dropbox.</comment></comment></comment></comment>


How many Wolfenstein 3D and Shakespeares can fit into Atom editor - <AUTHOR> http://thehumbleprogrammer.com/shakespeare-in-the-castle-wolfenstein/ <comment><USER2> While using Electon to kickstart project might be a good idea, but it is failing in the long run. There are so many issues, that could be avoided by using some other technologies. Just look at Sublime Text 2 editor, even if they are using Python, program size is relatively small and it performs much better than Atom. Sadly, Sublime is not developed as actively as Atom.

</comment><comment><USER3> Hipster kids can't code (efficiently, or at all, depending on your definition). In other news, Pope is catholic.</comment>


Show HN: Travel Packing Lists Made Easy - <AUTHOR> https://play.google.com/store/apps/details?id=webivo.com.packinglist <comment><USER2> Seems to require a social login. I might have tried it out otherwise.</comment>


Protect your AWS against hackers mining Bitcoin - <AUTHOR> http://wiki.mcrozes.com/display/PUB/Track+your+API+calls+on+the+cloud

<comment><USER2> Useful and well detailed guide</comment>


Ceramics enter a new era with laser-welded joints - <AUTHOR> https://arstechnica.com/science/2019/08/ceramics-enter-a-new-era-with-laser-welded-joints/ <comment><USER2> For those wondering why this matters:

One reason is for electronics in extreme environments. Glass/Ceramics are more energetically stable than metals, so can withstand much higher temperatures. Think advanced sensors inside a rocket combustion chamber... while it is on.

<comment><USER3> I would add that there is a case for ceramic matrix composites in modern gas turbines. And this could also radically alter the ease of manufacturing for solid oxide fuel cells, which in addition to having extremely high combined cycle efficiencies (>80%), can natively use existing hydrocarbon fuel sources, as opposed to just pure hydrogen.

<comment><USER4> Is this what GE is putting behind the 9X to reduce noise?

<comment><USER3> It is used for the turbine blades and combustion chamber, but it has more to do with heat tolerance and weight than noise. I think the biggest part of the noise reduction comes from using a much larger and more efficient fan.

</comment></comment></comment></comment><comment><USER5> With the ability to weld glass to metal and now ceramic welding, the next 50 years are going to see a manufacturing revolution.

<comment><USER6> This seem to need very high precision and until you can hand weld it, it will have limited applications comparing to Steel

<comment><USER7> Steel is routinely welded robotically. There are a very large number of applications where this advance in materials science will make a very large difference, keep in mind that:

\- ceramics are thermally quite stable (with respect to expansion/contraction)

\- ceramics do not conduct electricity

\- ceramics do not melt easily

\- ceramics are hard; leading to excellent longevity

\- ceramics are chemically very stable

This is a pretty major thing.

<comment><USER8> I agree with you that it's a big deal to be able to do it, but I am pretty sure it'll stay specialty and extremely expensive for a long time. Brazing is good enough for a lot of things after all, just not so much against corrosion or super high temperatures.

</comment></comment></comment></comment><comment><USER9> Link to the actual paper: [https://sci- firstname.lastname@example.com...](https://sci- firstname.lastname@example.com)

</comment><comment><USER10> I was hoping to find a ceramics fusion welding technology while I was researching thermionic converters. I thought it was impossible. Glad to see someone figured out how to do it!

<comment><USER11> What were you making thermionic converters for?

<comment><USER10> Just personal interest in converting heat to electricity. I saw a demo of it on youtube and it seemed simple in principle. The materials required are often superlative and hard to master.

</comment></comment></comment><comment><USER12> This is very interesting. Anyone have a good article for laypeople about the modern use of ceramics in making things. I tried googling but failed.

</comment><comment><USER13> What sort of applications would this be used for? I see in the article housing electronics, but isn't plastic pretty good for that? Aren't ceramics super brittle?

<comment><USER14> I'm thinking the ceramics would cancel lots of the electrical noise that electronics, and electrical components, put out. You can't have a very sensitive antenna if all the components in a receiver are spewing lots of electrical signals.

Making it possible for even smaller computers.

<comment><USER15> Thinking of it... Recycling of these computers will be challenging - how do you dispose an item made from "unobtanium" ?

Crush it into sand? It is one of the hardest materials, one needs a harder material to crush something. Heat/cool to have it crumble does not work well either with ceramics.

Melting it into glass or something? Might not be practical due to extremely high temps required.

Using it as "pebble" in road/bridge construction? Not sure if concrete will be able to stick to it.</comment></comment></comment>


Letting Go - An Irish startup goes from idea to sale - <AUTHOR> http://www.destraynor.com/serendipity/index.php?/archives/179-Letting-go.html

<comment><AUTHOR> "Bigulo started off as 800 lines of broken code, that we were always told that "anyone could have written". But we did, and that's usually the difference."

I can't underline those words heavily enough. Anybody _could_ do such-and- such, but somebody actually did and that _is_ the difference.

<comment><USER2> Yep. Million dollar ideas are a dime a dozen - really, the idea is the EASY part.

</comment></comment><comment><USER3> "Lesson 4: To paraphrase Jamie Zawinski - if your code can get people laid, you're off to a good start."

Say what you want, but it's true.

</comment><comment><USER4> Does anyone else assume that whenever the price of an acquisition isn't flaunted that it must be some very low number and that "acquisition" really means cutting your losses and taking whatever you can get?

<comment><AUTHOR> perhaps, but I also try to remember that the vast majority of startups don't have any exit of any description. Getting even a dollar of goodwill is a small victory.

The only time I would look askance at a modest exit is when the founders were tricked out of making a lot more money. In other words, if this company run by these founders could have fetched 10x as much, then it's a loss. But if they've made as much as could be reasonably made given the idea and circumstances... Then selling for market value so they can move on to a better idea is good business.</comment></comment>