PyTorch – Tensors and Dynamic neural networks in Python - <AUTHOR> http://pytorch.org/ <comment><USER2> Only a few months ago people saying that the deep learning library ecosystem was starting to stabilize. I never saw that as the case. The latest frontier for deep learning libraries is ensuring efficient support for dynamic computation graphs.

Dynamic computation graphs arise whenever the amount of work that needs to be done is variable. This may be when we're processing text, one example being a few words while another being paragraphs of text, or when we are performing operations against a tree structure of variable size. This problem is particularly prominent in particular subfields, such as natural language processing, where I spend most of my time.

PyTorch tackles this very well, as do Chainer[1] and DyNet[2]. Indeed, PyTorch construction was directly informed from Chainer[3], though re-architected and designed to be even faster still. I have seen all of these receive renewed interest in recent months, particularly amongst many researchers performing cutting edge research in the domain. When you're working with new architectures, you want the most flexibility possible, and these frameworks allow for that.

As a counterpoint, TensorFlow does not handle these dynamic graph cases well at all. There are some primitive dynamic constructs but they're not flexible and usually quite limiting. In the near future there are plans to allow TensorFlow to become more dynamic, but adding it in after the fact is going to be a challenge, especially to do efficiently.

Disclosure: My team at Salesforce Research use Chainer extensively and my colleague James Bradbury was a contributor to PyTorch whilst it was in stealth mode. We're planning to transition from Chainer to PyTorch for future work.

[1]: [http://chainer.org/](http://chainer.org/)

[2]: [https://github.com/clab/dynet](https://github.com/clab/dynet)

[3]: [https://twitter.com/jekbradbury/status/821786330459836416](https://twitter.com/jekbradbury/status/821786330459836416)

<comment><USER3> Could you elaborate on what you find lacking in TensorFlow? I regularly use TensorFlow for exactly these sorts of dynamic graphs, and it seems to work fairly well; I haven't used Chainer or DyNet extensively, so I'm curious to see what I'm missing!

<comment><USER2> When you say "exactly these sorts of dynamic graphs", what do you mean? TensorFlow has support for dynamic length RNN unrolling but that really doesn't extend well to any dynamic graph structure such as recursive tree structure creation. Since the computation graph has a different shape and size for every input they are difficult to batch and any pre-defined static graph is likely excessive, wasting computation, or inexpressive.

The primary issue is that the computation graph is not imperative - you define it explicitly. Chainer describes this as the difference between "Define-and- Run" frameworks and "Define-by-Run" frameworks[1].

TensorFlow is "Define-and-Run". For loops and conditionals end up needing to be defined and injected into the graph structure before it's run. This means there are "tf.while_loop" operations for example - you can't use a "while" loop as it exists in Python or C++. This makes debugging difficult as the process of defining the computation graph is separate to the usage of it and also restricts the flexibility of the model.

In comparison, both Chainer, PyTorch, and DyNet are "Define-by-Run", meaning the graph structure is defined on-the-fly via the actual forward computation. This is a far more natural style of programming. If you perform a for loop in Python, you're actually performing a for loop in the graph structure as well.

This has been a large enough issue that, very recently, a team at Google created "TensorFlow Fold"[2], still unreleased and unpublished, that handles dynamic computation graphs. In it they tackle specifically dynamic batching within the tree structured LSTM architecture.

If you compare the best example of recursive neural networks in TensorFlow[3] (quite complex and finicky in the details) to the example that comes with Chainer[4], which is perfectly Pythonic and standard code, it's pretty clear why one might prefer "Define-by-Run" ;)

[1]: [http://docs.chainer.org/en/stable/tutorial/basic.html](http://docs.chainer.org/en/stable/tutorial/basic.html)

[2]: [https://openreview.net/pdf?id=ryrGawqex](https://openreview.net/pdf?id=ryrGawqex)

[3]: [https://github.com/bogatyy/cs224d/tree/master/assignment3](https://github.com/bogatyy/cs224d/tree/master/assignment3)

[4]: [https://github.com/pfnet/chainer/blob/master/examples/sentim...](https://github.com/pfnet/chainer/blob/master/examples/sentiment/train_sentiment.py#L125)

<comment><USER3> Ah, fair enough, I see your point. An imperative approach (versus TensorFlow's semi-declarative approach) can be easier to specialize to dynamic compute graphs.

I personally think the approach used in TensorFlow is preferable – having a static graph enables a lot of convenient operations, such as storing a fixed graph data structure, shipping models that are independent of code, performing graph transformations. But you're right that it entails a bit more complexity, and that implementing something like recursive neural networks, while totally possible in a neat way, ends up taking a bit more effort. I think that the trade-off is worth it in the long run, and that the design of TensorFlow is very much influenced by the long-run view (at the expense of immediate simplicity...).

The ops underlying TensorFlow's `tf.while_loop` are actually quite flexible, so I imagine you can create a lot of different looping constructs with them, including ones that easily handle recursive neural networks.

Thanks for pointing out a problem that I haven't really thought about before!

</comment></comment></comment></comment><comment><USER4> It's a community-driven project, a Python take of Torch [http://torch.ch/](http://torch.ch/). Several folks involved in development and use so far (a non-exhaustive list):

* Facebook * Twitter * NVIDIA * SalesForce * ParisTech * CMU * Digital Reasoning * INRIA * ENS

The maintainers work at Facebook AI Research

<comment><USER5> Not only that, but it appears to use the same core c libray (TH) as Lua torch.

<comment><USER4> we actually share the same git-subtree between Lua and Python variants. TH, THNN, THC, THCUNN are shared.

<comment><USER6> I have been running in the back of my mind the idea of attempting a julialang interface to torch for a few weeks now, using the ccall interface: [http://docs.julialang.org/en/release-0.5/manual/calling-c- an...](http://docs.julialang.org/en/release-0.5/manual/calling-c-and-fortran- code/?highlight=ccall). Do you have any thoughts / recommendations w'r't' that? (This would be more of a fun / weekend(s) project for me than anything else) My goal would be to have the tensors override the .* and * operators as used here: [https://gist.github.com/divbit/ec57ad2f1989bf13aecdf9e1e1056...](https://gist.github.com/divbit/ec57ad2f1989bf13aecdf9e1e10563f0)

</comment></comment></comment></comment><comment><USER7> This project aside, I'm in love with that setup UI on the homepage telling you exactly how to get started given your current setup.

<comment><USER8> Agreed. Reminds me of this scary page I found the other day when googling "certbot setup":

[https://certbot.eff.org/all-instructions/](https://certbot.eff.org/all- instructions/)

</comment></comment><comment><AUTHOR> Actually not clear if there is an official affiliation with Facebook, other than some of the primary devs.

<comment><USER9> Copyright (c) 2016- Facebook, Inc (Adam Paszke)

Copyright (c) 2014- Facebook, Inc (Soumith Chintala)

Copyright (c) 2011-2014 Idiap Research Institute (Ronan Collobert)

Copyright (c) 2012-2014 Deepmind Technologies (Koray Kavukcuoglu)

Copyright (c) 2011-2012 NEC Laboratories America (Koray Kavukcuoglu)

Copyright (c) 2011-2013 NYU (Clement Farabet)

Copyright (c) 2006-2010 NEC Laboratories America (Ronan Collobert, Leon Bottou, Iain Melvin, Jason Weston)

Copyright (c) 2006 Idiap Research Institute (Samy Bengio)

Copyright (c) 2001-2004 Idiap Research Institute (Ronan Collobert, Samy Bengio, Johnny Mariethoz)

Notably absent is the otherwise Facebook-typical PATENTS license thing. Which I see as a good sign.

Also, it doesn't look like this has happened just now? PRs in the repo go back a couple months and the repo has 100+ contributors.

<comment><USER4> it's the same license file as [https://github.com/torch/torch7](https://github.com/torch/torch7) and [http://torch.ch](http://torch.ch)

The C libraries are shared among the Lua and Python variants

</comment></comment></comment><comment><USER10> At this point I've used PyTorch, Tensorflow and Theano. Which one do people prefer? I haven't done a ton of benchmarking, but I'm not seeing huge differences in speed (mostly executing on the GPU).

<comment><USER11> Keras is going to be the interface to Tensorflow - [https://news.ycombinator.com/item?id=13413487](https://news.ycombinator.com/item?id=13413487)

<comment><USER10> Yes, but Keras works just fine using Theano as a backend as well...

</comment></comment></comment><comment><USER12> Is there any reason this might not work in windows? I see no installation docs for it.

<comment><USER4> the C libraries are compatible with Windows, they are used in Torch windows ports. We just dont have any Windows devs on the project to help and maintain it :( .

<comment><USER13> Are you guys looking for Windows devs to contribute or help maintaining it? I'd be interested in helping out if I can. I currently use Chainer, but I'd like to try pytorch

<comment><USER14> Yes! There's an issue on that, where we'll be coordinating the work: [https://github.com/pytorch/pytorch/issues/494](https://github.com/pytorch/pytorch/issues/494)

</comment></comment></comment></comment><comment><USER15> Been using PyTorch for a few things. Love how it integrates with Numpy.

</comment><comment><USER16> Most important question. Is this still 1 indexed (Lua was 1 indexed, which means porting code you need to be aware of this)?

<comment><USER14> No! Python 0 based indexing everywhere.

</comment></comment><comment><USER17> I've never fiddled with machine learning thing so don't know anything about it.

I am wondering if CUDA is mandatory for torch installation ? I use a Macbook air which doesn't have graphics card, so not sure if torch can be installed and used on my machine.

<comment><USER18> It's not mandatary, but for some problems such as using image data, it provides as substantial speedup when training a classifier.

</comment></comment><comment><USER19> Very nice to see Python 3.5 there.

</comment><comment><USER20> This is really interesting, I've been wanting to learn more about Torch for a while but have been reluctant to commit to learning Lua.

<comment><USER21> Lua is a pleasure to learn and use. The language core is so simple and elegant, you can learn it in a day. Standard library is also very light, which is both strength and weakness.

I use it more and more for hobby projects. Combine it with LuaJIT (which torch uses) and you have the fastest interpreted language around. Give it a try.

<comment><USER22> I want to reiterate this. I started learning it for guilt because it was created in the university I studied. Then I realised it was really a pleasure to use it. I still use it in many hobby projects nowadays whenever I can.

</comment></comment></comment><comment><USER23> I am confused with the license file. What does it mean? Some rights reserved and copyright... Doesnt look like a real open source project.

<comment><USER24> It is a standard 3-clause BSD license. The "All rights reserved" portion definitely adds ambiguity (and only exists in the BSD license out of all major OSS licenses). There is StackExchange answer that goes into the history of it[1].

[1] [http://opensource.stackexchange.com/questions/2121/mit- licen...](http://opensource.stackexchange.com/questions/2121/mit-license-and- all-rights-reserved)

<comment><USER23> Got it. It makes sense now.

</comment></comment></comment><comment><USER25> What's the highest level neural network lib I can use? I'm a total programming idiot but I find neural nets fascinating.

<comment><USER26> Keras requires just a few lines of code, it's designed for easy use and practicality.

<comment><USER14> torch.nn offers a very similar interface to Keras (e.g. see Alexnet definition at [https://github.com/pytorch/vision/blob/master/torchvision/mo...](https://github.com/pytorch/vision/blob/master/torchvision/models/alexnet.py#L13)).

</comment></comment></comment><comment> aaron-lebo Is this related to lua's Torch at all?

[http://torch.ch/](http://torch.ch/)

<comment><USER27> They don't seem to explicitly say it, but it might be using the same core code given the structure of the framework and their mentioning that it's a mature codebase several years old. The license file also goes back to NYU before being taken over by Facebook, similar to Torch.

<comment><USER14> The core libraries are the same as in Lua torch, but the interface is redesigned and new.

</comment></comment></comment><comment><USER28> It is worth adding that there is a wip branch focused on making PyTorch tensors distributable across machines in a master-workers model: [https://github.com/apaszke/pytorch-dist/](https://github.com/apaszke/pytorch- dist/)

</comment><comment><USER29> i've been running their dcgan.torch code in the past few days and results have been pretty amazing for plug and play

</comment><comment><USER30> Guess there's no escaping Python. I had hoped Lua(jit) might emerge as a scientific programming alternative but with Torch now throwing its hat into the Python ring I sense a monoculture in the making. Bit of a shame really because Lua is a nice language and was an interesting alternative.

<comment><USER31> Lua is extremely flexible to the point where there is basically no standard library. This causes problems with code reuse and moving between codebases because everyone does things drastically differently. Compare this to Numpy in the Python world, a single fundamental package for scientific computing in Python.

Lua is less used than Python in the scientific community, and a lot of the most innovative machine learning researchers already work with C++ and Python. Using yet another language with only marginal benefit increases cognitive load and drains from the researcher's mental innovation budget, forcing the researcher to learn the ins and outs of Lua rather than working on innovative machine learning solutions.

Lua is a nice language. Python 3 is a nice language and there are many new exciting features and development styles (hello async programming?) in the making which will prevent a monoculture from forming in the near term.

<comment><USER30> Thanks for the interesting and informative comment. Do I sense just a tiny bit of regret though? Yet another Python interface. YAPI. You heard it here first. And no, Py3 is not that nice. Too much cruft by far. And lua is miles faster than Python when you're outside the tensor domain, ie while you're sourcing and wrangling your data. Arguably luajit obviates the need for C , something you can't say about Python. Disclosure: I am a massive, but increasingly disenchanted, user of Python. I had actually started looking at Torch7, foregoing tensorflow, precisely because of Lua. But the walls are closing in....

<comment><USER31> A very large portion of performance problems can be mitigated with the use of cython and the new asyncio stuff.

asyncio success story: [https://magic.io/blog/asyncpg-1m-rows-from-postgres- to-pytho...](https://magic.io/blog/asyncpg-1m-rows-from-postgres-to-python/)

cython: [http://scikit- learn.org/stable/developers/performance.html](http://scikit- learn.org/stable/developers/performance.html)

<comment><USER30> Luajit is at least 10x faster than python and easily obviates the need to mess around with cython. That's an easy win for Lua. Let's be honest: Torch has decided that if you cannot beat them, join them. It is about network effects. Not about Python better than Lua intrinsically.

<comment><USER19> but why do you care if luajit is faster than python if everything that matters is computed on the GPU anyways?

</comment></comment></comment></comment></comment></comment><comment><USER32> Every time I decide I'm going to get into Python frameworks again, and I start looking at code, and I see people making everything object-oriented, I bail

Just a personal (anti-)preference I guess

<comment><USER14> But it is possible to write your model in purely functional style. Check out the PR to examples repo with functional ResNets [https://github.com/pytorch/examples/pull/22](https://github.com/pytorch/examples/pull/22).</comment></comment>


Terminal.app in OSX Lion, anyone know anything? - <AUTHOR>

anyone with the developer build notice an improved Terminal?<p>is there at least fullscreen and 256 colors? <comment><USER2> I don't really care about Terminal.app anymore, iTerm does full screen and 256 colors well, and iTerm2 is under development and has even more fancy features.</comment>


Startup Chile - $40k grants available - <AUTHOR> http://www.corfo.cl/startupchile/Default.html

<comment><USER2> Absolutely amazing how fast the turnaround times for acceptance/refusal are, 2 weeks!

Also, this page is in English and it says you don't need to know Spanish in the FAQ but the linked form for a visum is in Spanish only.

From the FAQ: "During your 6 to 12 month stay entrepreneurs should seek to achieve the goals stated on their proposed action plan. We will be monitoring and helping you to accomplish those goals."

So this is a temporary situation, not a permanent one!

PDF with average salaries:

[http://www.corfo.cl/startupchile/download/Avg_Salaries_USD.p...](http://www.corfo.cl/startupchile/download/Avg_Salaries_USD.pdf)

</comment><comment><USER3> This thread has come up a couple of times:

Just wanted to point out that even if you get the grant, 1) they are reimbursing you 90% of your startup budget rather than giving $40k cash money, so 2) you have to put in the other 10% which is 4k.

I don't know if you can just budget $44k as salary but I highly doubt it, so you'll need to be able to spend the money to get it.

<comment><USER2> And there are quite a few reporting requirements. As well as a term that states that until the final reports are in you are responsible for all the costs (that's month 6) so I take that to mean that you have to finance all the costs up to that point out of pocket, or they might claim it back if you don't report in time and in the way required.

</comment></comment><comment><USER4> Chile its a wonderful country. I've been there several times. Its capital, Santiago has beautiful neighborhoods and they have this place they like to call something like their own Wall street center since all the big fancy pants companies are pretty much in the same block. Many of them speak english and they have a strong economy. I just cant find any cons of setting up in Chile a startup. Interesting.

</comment><comment><USER5> Bummer, it's only for people that live abroad.

<comment><USER2> From the FAQ:

Do I need to be in Chile to apply? No. Applications can be sent worldwide. Do I need to be of Chilean nationality? No. The program is open to entrepreneurs of all nationalities, including Chileans.

<comment><USER5> Please read the terms & conditions [http://www.corfo.cl/startupchile/download/Technical_and_admi...](http://www.corfo.cl/startupchile/download/Technical_and_administrative_mandatory_guidelines_start_up_chile.pdf)

Specific Objectives:

i) To attract 25 entrepreneurs with residence abroad, to Chile during 2010 with the purpose to implement a Business Plan in Chile, through the application of a project.

Beneficiaries:

Natural person, national or foreign, with residence abroad, that have innovative business plans for global markets and wish to develop them in Chile, may apply.</comment></comment></comment>


Ask HN: Have you seen godaddy's latest dark pattern? - <AUTHOR> Right after buying a domain name, it takes you to a page that is the first step in setting up their hosting service.  It's not completely obvious that you can skip it, even with the fine print warnings.  I think people would fall for it. <comment><USER2> GoDaddy has been doing this kind of nonsense forever. They also sell services at one price and then substantially increase the price without express notification after at renew (and, yes, it is in the T&Cs small print, but it is intentionally buried).

Some of their competitors have made it their mission to differentiate themselves from companies like GoDaddy, emphasizing their straight forward pricing and lack of gotchas.

</comment><comment><USER3> It's hardly surprising. GoDaddy has been doing shady tactics for years, the first thing I do when I get a client that uses them is to migrate elsewhere.

<comment><USER4> What are some reliable, fairly priced alternatives to GoDaddy for registrar/webhosting?

<comment><USER3> I've used NameCheap for 10 years and never had any real problems apart from some API features missing.</comment></comment></comment>


Don't Freak Out About the New Gmail 4.5 Update for Android OS - <AUTHOR> http://contacternst.kinja.com/dont-freak-out-about-the-new-gmail-4-5-update-for-andr-512189476

<comment><USER2> Thanks, this was helpful.

<comment><AUTHOR> No problem! I've honestly tried to get into blogging for a long time now. This post just flowed so naturally, I really enjoyed putting it together. Thanks so much for the feedback.</comment></comment>


Ask HN: Would you use a periodic travel ticket search engine? - <AUTHOR> What I mean by this, suppose you want to go home for a weekend but you don't necessarily care which weekend as long as it's cheap.
I have built a small script which searches every Friday to Sunday train and flight tickets for 4 weeks and gives you the cheapest fare for a weekend.
Right now it's a command line script and I was just wondering if anyone else would find it useful? <comment><USER2> Sounds good, can you specify what time on Friday you want to leave?</comment>


Given Expert Advice, Brains "Shut Down" - <AUTHOR> http://blog.wired.com/wiredscience/2009/03/financebrain.html Article here: http://www.plosone.org/article/info%3Adoi%2F10.1371%2Fjournal.pone.0004957 <comment><USER2> I noticed a similar effect on my opinion about movies and books. I am extremely influenced by what I hear, to the point that a movie that I love when I see it for the first time is completely spoilt the second time if I heard a disparaging comment by someone I respect. The same thing almost made me stop listening to music. I've heard so many bad things about Houellebecq that I know there is no point in even trying to read his books.

This sounds like I can be easily influenced, but it may also be that I am more conscious of these effects because I find it very important to judge things by myself.

<comment><USER3> With some movies though - I'll go in with a negative expectation - and come out very pleasantly surprised!

</comment></comment><comment><USER4> Here's a summary of the "experiment":

      * hook 24 college students to brain-scanner-majigs.
      * given them an economic problem.. the better they do, the more they get rewarded
      * have some of them do it on their own.
      * have some of them receive advice from someone who is said to be an expert of economics.

The results? Guess what! Different parts of your brain are active when you do something yourself, and when you receive advice. Oh, and also, people tend to follow advice from experts. Here's the amazing scientific breakthrough the research suggests: maybe we can one day make brain-scanners that tell you when you're receiving expert advice or making the decision yourself. Wow! I'd pay $0 for such a thing, because I don't need one: I know when I'm choosing to take a short-cut by following expert advice, and when I'm deciding myself.

Following expert advise isn't a bad thing. Think for yourselves what it means to follow expert advice -- to me it's what allows the human race to advance at such a rapid pace. You ask someone with experience, so that you don't have to experience/learn it all yourself. It's the same concept as paying a business to do something that would be inefficient for your own business to do, or figure out how to do. If someone suggests using a company that in the past has had good results, and you use them, and they fail... would you say that your brain was _shut off_ during the decision to use them? No... they just let you down. Plain and simple. But what if someone took brain scans while you made the decision process?? Well, in that case, you could write an article about it in Wired, it seems.

This is sensationalized science... and in this case is especially ironic, since people seem to be taking the article headline at face value.

</comment><comment><USER5> This is another reason why I hated undergrad education. You have a bunch of teachers positioned as "experts," and they ask you to accept counter-intuitive statements under extreme time pressure and the threat of not passing the class. The most natural thing to do is turn off your brain and accept what they tell you, to pass the test.

Even if what you've "learned" is correct, you've disengaged yourself from the actual process of thinking and learning.

<comment><USER6> Most of what you learn (in school) is stuff you HAVE to take on faith. Are you going to empirically verify the concept of covalent bonding? Are you going to figure out Kreb's cycle from first principles? Will you deduce the results of the Civil War based on it's causes?

If it was limited to subjects where students could study the evidence and come to their own conclusions, school would quickly end up being useless...

<comment><USER7> We would still have math. Or most of it.

</comment></comment></comment><comment><USER8> I have noticed that in the people I have been pitching my startup idea to. Thirty seconds or so and they would "lock up" and stare blankly. It took several iterations and beta-testing on friends and family until I formulated my pitch into a 3 minute high-level interactive approach. E.g:

"We all use the web and love it. Oh man, this is my favorite website, I'm gonna do X and catch up with Y, but look! [problem description here]. [explain the aggravation caused by the problem. [real numbers about the loss in productivity or lost sales potential]. [projected growth in my industry, a quick highlight of what's out there and how we're different and better]." Then I go into the project description and everyone is delighted at that point.

To engage the people ask them questions. Instead of "we all do X" say "don't we all do X?". Instead of saying something is a problem for you, say "is it just me or does X bug the hell out of anybody else? [then look the audience members individually in the eye]"

Participatory learning is something good teachers and salespeople have known for a very long time, as far back as Socrates at least.

</comment><comment><AUTHOR> Article here: [http://www.plosone.org/article/info%3Adoi%2F10.1371%2Fjourna...](http://www.plosone.org/article/info%3Adoi%2F10.1371%2Fjournal.pone.0004957)

</comment><comment><USER9> Now, they need to conduct this experiment again with a general population control group and a "successful people" variable group. I'm willing to bet that successful people think for themselves.

<comment><USER10> I was about to reply in a different manner, but let me start by asking you what you mean by "successful people." What kind of people would be in that group?

<comment><USER9> I put it in quotes to leave it intentionally undefined.

You could run several experiments with differing variable group selection criteria to find out what kinds of people are more or less easily influenced. However, in particular, I was thinking of people who are considered to be strong leaders.

</comment></comment></comment><comment><USER11> This is one of the issues I was thinking about when I was looking at that Hunch site. The purest decisions that I make are the ones that have the additional attribute that I think I know why I'm making them. This seems to provide the most fertile ground for creativity.

So experts have worked on the Hunch algorithms - how do they codify this issue of providing solutions without the taint of incestuously created (self- reinforcing) knowledge? It's a closed environment that discourages the existence of black swans.

Specific to the Wired piece, many remember the team of math guys who put together a stock picking app back in the 90's. They thought the algorithms were nearly foolproof, and built an investment business around their work. Of course, their effort ultimately crashed spectacularly. An example of shutting your own brain down from your own work.

</comment><comment><USER12> My brain doesn't "shut down". I tend to question everything even ideas that are widely held by people around me.

</comment><comment><USER13> Haven't they noticed that people spend all of their formative years in schools were they are taught to never question authority? After so many years of "behavioral training" it seems quite normal to me that people's brains shut down when listening to an expert.

</comment><comment><USER14> Hmm. To me this illustrates that we should be more skeptical of who we consider to be "experts" not that we should not seek counsel of those with subject matter expertise.

Hint, someone with a TV show is probably NOT who you should be listening to.

</comment><comment><USER15> I see the implications of this are enormous. The first example that comes to my mind is criminal prosecution.

The second are software salesman. I have seen a lot of smart people who bought from Vignette, Oracle, Microsoft... Now they have an excuse...

<comment> a-priori I don't think this study speaks to anything about criminal persecution. This study was about the effect of _one_ expert against a person's own judgement. What you're talking about is the effect of the opinion of two competing experts (persecution and defence).

My hunch is that having two expert opinions would be similar to having no expert advice, in terms of fMRI activity.

<comment><USER15> Not at all. I am worried about the implications on the study conclusions on interrogation techniques. The validity of a confession obtained under coercion can be questioned when you show the effect an "expert" opinion can have on someone's own capacity to assess his/her situation.

Cops will need to interrogate their suspects inside an fMRI machine...

</comment></comment></comment><comment><USER16> Why is there a video of Cramer on the side?

</comment><comment><USER17> "Socratic method" FTW!

</comment><comment><USER18> There is some old classic paper titled The Programmers Stone. In the first chapter there is very good description of two different states of the mind - Packers and Mappers. This study is about packer's brain, because mappers will try to combine expert's opinion with their own map, alter or update it when necessary, or even create a model which fills both opinions. The rest of this Programmers Stone is some kind of nonsense, but this first chapter is a must read.

<comment><USER8> Absolutely phenomenal find there c00p3r. The paper in question is <a href="[http://en.wikipedia.org/wiki/Programmer%27s_Stone">here&...](http://en.wikipedia.org/wiki/Programmer%27s_Stone).

Any more pointers on the psychology of programming would be nice, folks (I know there is google, but I want to crowd-source that searching and vetting ;-)

<comment><USER19> Weinberg Psychology of Computer Programming recently published in 25th anniversary edition:

[http://www.amazon.com/Psychology-Computer-Programming- Silver...](http://www.amazon.com/Psychology-Computer-Programming-Silver- Anniversary/dp/0932633420)

<comment><USER18> The Man-Month is enough! =)

Btw, there is another 33 years old book which is still worth reading - [http://www.amazon.com/Structure-Magic-About-Language- Therapy...](http://www.amazon.com/Structure-Magic-About-Language- Therapy/dp/0831400447/)

<comment><USER8> I found "abstract NLP", specially their use of Chomsky's work, a bit of a voodoo. I have worked through Bandler and Grindger with a pencil for months, and eventually became disenchanted with the faux-science aspects of NLP.

<comment><USER18> This book is not about NLP, it is about that language is a key, about gule- governed behavior and about understanding and modeling of this behaviour.

The great idea is about using linguistic methods to understand and model a human's mind activities, which are based on language constructions.

NLP itself is just a trend, an attempt to sell these theories to the masses.

</comment></comment></comment></comment></comment></comment><comment><USER20> Someone needs to tell me who the experts are so I can be mindful of this and prevent it from happening to me.</comment>


Unhappy, unhappy, Apple makes me very very unhappy - <AUTHOR> https://medium.com/@marcmasat/the-broadway-show-30fa6292a7c8

<comment><USER2> Gonna need some more details. I'm still not 100% sure what's going on

<comment><AUTHOR> [https://medium.com/@marcmasat/apple-itunes-support- aa2fb0f9c...](https://medium.com/@marcmasat/apple-itunes-support-aa2fb0f9c4c)</comment></comment>


How to Generate Sales Without a Marketing Team - this-ali https://www.intandemly.com/blog/generate-leads-without-marketing/ <comment><AUTHOR> Lol, this is such a low value blog post for the front page of HN. Probably the lowest ever? There's 10,000,000 articles like this out there. And I say that as a non-repentant marketer.

<comment><USER2> Please flag an article if you feel that way.

<comment><AUTHOR> Got it!

</comment></comment></comment><comment><USER3> This a common problem for most solopreneur. I was in your situation then I found a person who decided to mention my product in his course. That gave me a big boost.

To answer your question, start looking for an affiliate who is in same niche as you.

People often don't think of affiliate marketing as part of their growth plan. Most start-ups may not know where to find someone who can promote their business.

Couple of week I started working on a new project that not only tracks commission and sales but also connect businesses with influencers, bloggers, etc.

It will take couple more months before beta is available but feel free to subscribe to get notified [https://www.affiliatehunt.com/](https://www.affiliatehunt.com/).

</comment><comment><USER4> Tesla might be the best example ever of this practice.

<comment><USER5> In the future we are going to find out Tesla had a social media team that "maintained Tesla's reputation".

They did this by astroturfing and paying for upvotes/likes.

Tesla claims to not spend money on marketing, but I consider that a dubious claim.

<comment><USER6> Someone should tell all the people with marketing manager roles at Tesla that their employer isn't spending any money on them...

<comment><USER7> A family member recently left a role in marketing at Tesla due to... well, Tesla not spending any money on them.</comment></comment></comment></comment>


Launch HN: SuperTokens (YC S20) – Securely manage session tokens - <AUTHOR> Hi everyone! My name is Advait and I co-founded SuperTokens along with @rishabhpoddar (https://supertokens.io/). SuperTokens helps companies securely manage their session tokens, saving developer time and preventing identity theft.
We started SuperTokens 1.5 years ago when we were building a consumer app and wanted our users to be logged in for a long time in a secure way. When it came to managing user sessions, there was a lot of ambiguity. We read many forums (Reddit, Stackoverflow) and blogs, and found that developers were arguing about best practices, such as using local storage vs cookies, implementing JWTs, etc. We had to do a lot of the first principles thinking ourselves to understand the tradeoffs. Around the same time, Facebook, Docker, Gitlab, Youtube, Uber were in the news for session vulnerabilities.
Stealing a user's session allows you to access their account as if you had their username and password. Hence being able to mitigate against this is important. We've audited companies and found large session vulnerabilities that they were not aware of. For a YC company, we were able to pull information on users that we shouldn't have had access to.
Through our research, we built something internally and decided to write a blog post [1] explaining how our system works. While SuperTokens is not currently open source, you can see the original codebase on Github [2].
Building a good solution for sessions requires a lot of specialised knowledge and time that could otherwise be spent on building your core business logic. Detecting session theft reliably is difficult. There are multiple race conditions, edge cases and network issues that need to be thought about. In fact, one of our libraries that solves a difficult race condition has 100K downloads / week and is even used by Auth0 [3]
SuperToken mitigates against all session attacks (XSS, CSRF, etc) by implementing best practices. For a full list of types of attacks with real life examples please see [4]. However, it is not possible to mitigate against all attacks (for eg: social engineering) and hence, SuperTokens is also able to detect session theft. We use rotating refresh tokens as per the official OAuth specifications in RFC 6819 [5]. Auth0 has also started offering this, but due to their setup, they cannot use httpOnly cookies to store these tokens and this goes against popular compliance recommendations.
Besides security, SuperTokens also offers improved API performance and developer convenience. For clustered and distributed environments, session verification for each API takes < 1 millisecond. You can get a user's ID and access role without any database lookup. SuperTokens can be implemented in 15 minutes, provides a simple API and has clear documentation. We abstract away complexities of token management by providing frontend and backend SDKs.
In the coming months we plan to offer Access Control, Internal Auth between services and for internal tools (i.e. recent Twitter hack was through unauthorized access to an internal tool), and more! We're still experimenting with pricing, so you won't find this on our website, but we'd love to hear your thoughts about it.
Thank you for reading! We'd love to hear what this community specifically has to say and if you have any experience dealing with this. We'd appreciate any feedback!
<comment>----
Footnotes:
[1] - Blog post: https://medium.com/hackernoon/all-you-need-to-know-about-use...
[2] - Github: https://github.com/supertokens/supertokens-core
[3] - Library used by Auth0: https://www.npmjs.com/package/browser-tabs-lock
[4] - List of attacks: https://supertokens.io/pdf/attackshomepagev1
[5] - OAuth RFC 6819: https://tools.ietf.org/html/rfc6819#section-220.127.116.11 </comment><comment><USER2> Is this really a problem that needs solving?

Generate a secret, hash it, and store it in your database. Set the secret as a cookie in the client. On every request, hash the cookie value on your server and compare it to your DB values.

It seems like very little effort to implement this yourself in a way that doesn't involve completely trusting a different company.

<comment><USER3> I'm not going to speak for the company or their solution, but yes it is a serious problem. The token itself isn't the hard part as you pointed out, it's the full life cycle management of it and the security analysis is. Detecting and acting on session hijacking is hard to do right. It can get very complicated as well if your system needs to enforce things like non-concurrent logins, etc.

But I'm glad the company offers a self-hosted version rather than being forced to rely on their managed service (that was the first thing I looked at). I haven't dug into it at all and am taking at face value that their self-hosted daemon doesn't have any required real-time connections to their systems, but that would be a deal killer as well.

<comment><USER4> Thank you!! We use rotating refresh tokens to detect session theft reliably.

<comment><USER5> I'm not entirely sure I'm understanding the terminology you're using.

Are you talking about OAuth2 tokens (i.e. [https://tools.ietf.org/html/rfc6819#section-18.104.22.168](https://tools.ietf.org/html/rfc6819#section-22.214.171.124)), or are you talking about browser cookies?

In both cases, rotation strikes me as being of limited (though nonzero) value. While rotation (and invalidation of the previous token) can be used to prevent long-lived concurrent use of cloned tokens, there's a good chance an attacker can ensure that _they_ are the ones who get the "new" token.

As a result, the user--the legitimate OAuth client or browser--would be left with the now-invalidated token, and will be logged out. The most likely result of which--depending on application design choices--is that the user simply logs in again! You now have two sessions, one of which is solely owned by an attacker, and one of which is solely owned by a user!

(There are cases where this is still valuable: if you enforce "only one session globally" per user, for example, or if you use the presentation of an "invalidated" token as indicative of theft. But both are application design choices that will commonly be inappropriate.)

At the extreme, of course, if your threat model is local malware, UXSS, etc, an attacker can just do a "person in the browser" attack, in which no token copying happens.

I'm not sure why I'm bothering to write all of this. Call it free consulting? ;)

My point is really that the threat model needs to be clearly stated and, for some threat models (including some which are featured in case studies on your website), this approach may be largely ineffective.

</comment></comment></comment></comment><comment><USER6> Congrats on launching!

If I understand correctly, you're having me integrate a library on my backend that manages session cookies.

You've implemented refresh tokens and that seems to be one of your major selling points, but I'm confused what benefit that provides?

I thought the use case for refresh tokens in OAuth was that the user can revoke access from the OAuth provider side. But since the user can't go to SuperTokens and revoke their session, isn't the refresh token functionality superfluous?

<comment><USER4> Thanks! The benefits we provide are session security and convenience (not having to know or think about tokens and session management).

We don't use normal refresh tokens. We use one time use refresh tokens. This allows to detect token theft in a reliable way for long lived sessions ([https://tools.ietf.org/html/draft-ietf-oauth-browser- based-a...](https://tools.ietf.org/html/draft-ietf-oauth-browser-based- apps-06#section-8)).

Also, OAuth is different to session management in that OAuth is for delegation purposes, whilst "a session" can be used to maintain authentication between your own frontend and backend.

In terms of revocation of sessions, our SDK provides functions that can be used to revoke sessions. Soon, we will be making a dashboard that can be used to do the same (and other things)

<comment><USER6> Thanks for your response!

I'm still a bit confused why you're referencing OAuth here and in the launch announcement while also saying "OAuth is different to session management"

Why have you chosen to use OAuth solutions if you're not solving an OAuth problem? How are you sure it's still the right solution? I see some overlap but it's not obvious to me that OAuth methodologies should be applied here.

<comment><USER4> Technically, you do not need to exactly follow OAuth methodology for sessions. You are right. However, there is one common problem with sessions and OAuth, which is token theft.

In order to detect token theft, we use the general principle of changing tokens on each use. So theoretically, we can use one random string token, that changes on each use and solve the problem in case of sessions.

The problem with that is that it's not scalable since for any request that changes tokens, we need to synchronise calls to that request ([https://supertokens.io/blog/the-best-way-to-securely- manage-...](https://supertokens.io/blog/the-best-way-to-securely-manage-user- sessions#2)).

In order to make things scalable & have this security benefit, we use two tokens. One that doesn't change, and one that is used rarely, but changes... This starts to look like OAuth now.

Pushing it further, we can name those tokens access and refresh tokens. So while OAuth and sessions are different, we can pick specific concepts from OAuth and apply them to sessions.

</comment></comment></comment></comment><comment><USER7> I don't wanna hijack his thread, but I'm a small contributor to a great open source project library called AccountsJS, which seems pretty similar to this, AFAIK. and it's really modular/flexible on whatever you want to implement it with!

You can use it both with REST/GraphQL, and any frontend you may like.

Also supports Oauth like Twitter, FB, Google, Insta, etc...

Has 2FA. MFA on the works...

Anyway if it piqued your interest here are some links: [http://accountsjs.com/](http://accountsjs.com/) Repo in GH: [https://github.com/accounts-js/accounts](https://github.com/accounts- js/accounts)

<comment><USER8> > _I don 't wanna hijack his thread..._

But you did :) accountjs looks great! Another related hands-off do-it-all solution that I like is [https://userbase.com](https://userbase.com).

</comment></comment><comment><USER9> I am using FaunaDB for a side project and your product would be a very good fit to work with their tech.

They have a built-in authentication in their distributed database, but not session management. A lot of people is starting to build things with FaunaDB and struggling with auth. In their Slack they even had to open a channel only for authentication doubts.

So if you are looking for a niche, the FaunaDB integration could be a good shot.

<comment><USER4> Actually yes! We are already working on providing session management for FaunaDB users. Using us, you can easily get a FaunaDB token for a user on your backend and frontend. We take care of all the heavy lifting of creating those tokens and making sure they are alive (and of course, providing session management).

We should have something out in a few weeks from now!

</comment></comment><comment><USER10> How do refresh tokens work in the presence of concurrent requests from multiple tabs? I don't see how two tabs could synchronize their access in a way that won't lead to the possibility of one tab thinking it has been logged out. I guess you can try and paper of these issues with JS but without client side JS you are completely lost.

<comment><USER4> Yea! That's why we have a frontend SDK that solves for issues like these. Our SDK uses a library called browser-tabs-lock which provides locking across tabs ([https://www.npmjs.com/package/browser-tabs- lock](https://www.npmjs.com/package/browser-tabs-lock)). So essentially, whenever a refresh call is made, we synchronise those requests.

This library is written by us to solve for the exact problem you mentioned! It's also being used by Auth0

</comment></comment><comment><USER11> I don't see any kind of compliance, code audit, or SLA to back up the kind of claims your landing page makes.

Also, maybe it's just me, but your landing page is very slow and laggy, and my browser hung a bit while navigating around.

<comment><USER4> Thanks for letting us know! We use Cloudflare and had to purge the cache today cause of some changes.. Is it laggy while scrolling any specific page? Or only when switching pages?

About compliance & code audits, those are being planned. We will have code auditing done in a few weeks from now. But yea, I understand your point. Thanks!

<comment><USER11> Both, the initial page load and getting to the carousel is pretty sluggish.

<comment><USER4> Thanks! Will investigate & fix.

</comment></comment></comment></comment><comment><USER12> AD: I authored a solution to the revocation of tokens[1] for JWT and even verified the solution through TLA+. It uses a monotonic counter as a claim per JWT, you can revoke X active sessions behind the last issued, you can also use time to do temporal permission inflating (sudo... etc).

What sort of verification have you done on your solutions? What are the down falls of your solution?

[1] - [https://github.com/endiangroup/compandauth](https://github.com/endiangroup/compandauth)

<comment><USER4> Sounds interesting! I'll have a look at your library. Our solution takes relevant aspects of the OAuth specs. Specifically the idea of using rotating refresh tokens to detect session theft.

That being said, we have not had any formal verification. We plan on doing an outside code review / audit from a reputable 3rd party in the coming weeks.

Two question for you: \- In your solution, I assume there is one JWT per logged in user. If I want to revoke one user's session specifically (without affecting other users who have a similar count), how would I do that? \- When would I want to revoke all sessions before some count X?

Apologies if I have misunderstood how your lib works.

<comment><USER12> Good luck with the audit, the solution sounds interesting on the surface!

Ah I think you've slightly misunderstood, there is a 'counter' per entity, each user has their own separate counter so when you are revoking it is only relevant to sessions related to that users account. This would fall under your database lookup version of JWT management, it's centralised but in the smallest way possible.

That might clear up your second question, you'd want to revoke all sessions like I'd want to 'Log out all other active sessions', logging in to my Spotify on my friends computer last week, and my sisters the week before, I want to log them ALL out.

<comment><USER4> I see. Thanks for the clarification.

So when you are verifying an incoming JWT, don't you need to check what the allowed counter is for that session? If yes, then doesn't that require a database / cache lookup for each verification? And if it does, then how are you able to get super fast session verification?

<comment><USER12> Yes absolutely, as I stated in the comment before. The super fast verification is once you've done the DB lookup and do the actual comparing (as it's just int64 comparisons). CAA is intended as a set of primitives to be built on top of.

As I understand ST is in effect making the client act as the cache by giving them a refresh token (RT), you delay having to do a central DB lookup until the AT expires and RT is used... You could do the same with CAA, check the DB every X interval (30s) instead of every request, the security implications would be the same (some period of time that no matter who is using the token it will work) as I understand?

From what I've read Theft Protection is a matter of detecting reuse of RT (as I've understood), again with CAA and using the above, you could track each periodic "check" against the master with another counter and embed into the token, if you see a tracking number < or > what you've seen then a Theft has occurred. Would that be the same as ST?

<comment><USER4> Yea! Absolutely. Both our solutions follow the same fundamental idea of changing tokens to detect theft. That being said, there are edge cases that need to be considered when detecting token theft such that there are no false positives: [https://youtu.be/6Vzit514kZY?t=747](https://youtu.be/6Vzit514kZY?t=747).

The video about describes 2 edge cases specific to our flow, but I maybe they also apply to your solution?

</comment></comment></comment></comment></comment></comment><comment><USER3> Good luck guys! Do it right and keep moving forward, it's a problem that does need to be solved. Just make sure it can work behind a corp firewall without hooks back to your servers ;-)

<comment><USER4> Noted. Thank you!

</comment></comment><comment><USER13> Your pricing is pretty hard to find, had to go to documentation -> scroll to the bottom and it's in the right hand corner. Then when I click on it, there is no pricing on that page.

<comment><USER4> I understand that this is annoying. The reason we have it that way is cause we are experimenting with pricing on a per user basis - it's like the "contact us" pricing plan for other SaaS products.

Soon, we plan on standardising pricing based on our pricing experiments. Thanks for the feedback!

<comment><USER14> Cool product and I can see myself using it. What's the difference between the non-pro and the pro licence?

<comment><USER4> Thanks! As of now, there is only one version - the pro version. We may add an open source version soon. If we do, it will be clearly mentioned on our site along with what the feature differences between the non-pro and pro versions are.

</comment></comment></comment></comment><comment><USER8> > _While SuperTokens is not currently open source..._

Might want to update your Twitter, then?

 _@supertokensio The most secure solution for user session management... We 're open source and easy to implement._

<comment><USER15> There's this: [https://github.com/blitz- js/blitz/blob/724c6921da1646a35625b...](https://github.com/blitz- js/blitz/blob/724c6921da1646a35625b96320a3cf97478c357a/packages/server/src/supertokens.ts)

It's neither the old open source version of supertokens, which is deprecated, or the new version of supertokens, but is in between.

<comment><USER4> Yup. For blitz, there is a default session management solution that's essentially based on a long lived, opaque access token. There is also going to be one which is what SuperTokens is. Either using SuperTokens directly, or an implementation of that in Blitz itself.

</comment></comment></comment><comment><USER16> Can you talk a bit about the tech stack behind this? I see <1ms API responses which is very impressive, curious to hear more about the implementation.

<comment><USER4> Sure! Briefly, we use JWT access tokens which are used for session verification. JWTs can be verified using just a secret key which can be stored in memory. Hence, no network calls = < 1MS latency.

However, there are issues with using just a JWT, like inability to revoke them or bottlenecking all user security on one secret key. To solve those and other issues, we use rotating refresh tokens. More about this here: [https://supertokens.io/blog/are-you-using-jwts-for-user- sess...](https://supertokens.io/blog/are-you-using-jwts-for-user-sessions-in- the-correct-way)

</comment></comment><comment><USER17> Congrats on the launch!

We're building stuff in a similar space! Would be cool to chat and swap ideas: we're [https://www.osohq.com](https://www.osohq.com), I'm sam@ the same domain.

<comment><USER4> Awesome!! Your site looks really clean! Will reach out!

</comment></comment><comment><USER18> This really isn't a problem that needs solving? Much less paying some random company to have access to all your user data.

<comment><USER4> Not all apps will want to have a good level of session security (as of today). But there are enough that do.

We have a self hosted version that uses your own db to store tokens. So you don't need to give us any "user data".

</comment></comment><comment><USER19> This is great! Any plans to support Elixir/Phoenix anytime soon? Don't see it in the dropdown in your website :(

<comment><USER4> Thank you :)

We can add that to our roadmap. We are also happy to prioritise depending on your use case and commitment! Do reach out to us via email (firstname.lastname@example.com)

</comment></comment><comment><USER20> Can I ask how this fits with the YC thinking that startups should have unicorn potential?

<comment><USER4> We are in the authentication space. Sessions is a way to get into the space.</comment></comment>


VOIP + Cloud = Better Political Campaigns - <AUTHOR> http://docs.google.com/View?id=ajfpnj43nx69_7d94ddrfb

<comment><USER2> I built a service on top of EC2/Asterisk that did political phone polling. Not really polling though as much as voter ID, we'd push out 100,000 calls into a congressional district and campaigns would use the resulting data for targeted mail and GOTV. It was all point and click-- write your poll and record it with a flash plugin-- stupidly simple. After the 2008 election I shut it down, largely due to getting to work with so many politicians and realizing how totally worthless human beings most of them are. Seriously, how the fuck these people are writing laws is beyond me.

And yeah, the laws are total bullshit. If I revive the project my plan is to have a massive list of phone numbers as well as a list of congressman's offices, personal cell phones, children's cell phone numbers, mistresses, etc. Whenever an important vote comes up you call your people and give them a very short briefing on the issue and then connect the call through to the appropriate number. Because you can control the call throttling you can lock up phone lines and it would be about 100x more effective than traditional calling campaigns. Ron Paul 2012.

</comment><comment><USER3> Political calling is one of few areas you could build something like this and get away with it.

In any type of business-to-consumer calling you're going to need to hire a lawyer before you even design the system because of all the telemarketing regulations (at federal, state and local levels) that have to be followed. There's lots of documentation to be prepared that you have to make available to anyone that asks while you call them, there are rules about how predictive dialers can be used (such as maximum drop call rates and dead air times), etc.

Politicians, when writing these telemarketing regulations, purposely wrote clauses into them excluding political calls. Ya know, consumers don't want to be bothered by telemarketing so our politicians actually listen and pass these laws, but it's OK for _them_ to bother us with telemarketing still.

<comment><AUTHOR> gotta love that, right? i'm figuring that once this is built really well for political applications that i'll take it to commercial market as well and deal with all the regulations at that point. commercial clients can provide a nice stabilizing business stream to balance out the comings and goings of political campaigns.

</comment></comment><comment><USER4> Last time I tried using Asterisk on Amazon EC2 the call quality was pretty bad - presumably because Asterisk's timing was being messed up by the virtualisation.

<comment><USER5> I'm using FreeSWITCH on EC2, without any issues. There are kernel images with 1000HZ timing.

</comment></comment><comment><USER6> nice idea. this is a very good vertical application to build on top of <http://www.twilio.com/>

<comment><AUTHOR> yeah, twilio seems pretty cool, and i'm looking at it for another voice/political project. but it's basically an api for level 3 with some nifty features tacked on, so for a project as voice-heavy as a predictive dialer that doesn't need the extra features, i'm guessing it makes more sense to find a developer with voice experience and avoid the markup and the added layer of potential problems. if somebody with twilio or other voice experience is listening, i'd love to get another opinion.</comment></comment>


Giant rats put noses to work on Mozambique's landmines - <AUTHOR> http://www.theguardian.com/global-development/2014/jan/22/giant-rats-mozambique-landmines

<comment><USER2> If that works as advertised, there should be plenty of other areas to clear afterwards. Hell, my brother-in-law spent two years in Kosovo (as a UN peacekeeper) a few years back. He said that even then there were large areas of land that were still off-limits to people because of uncleared mines.

Despite the danger, and the warning signs, some locals are desperate enough to seek arable land where ever they can. One can only imagine what happens when they hit a 10-year old mine.

I was told it's not pretty.

<comment><USER3> Landmines and ordnance are not just a problem in Kosovo, the rest of former Yugoslavia still has its problems with contaminated forests and agriculture areas.

<comment><USER4> Oh yes indeed. When I was cycling (and camping) in the less-often-visited-by- tourists areas of Croatia and Bosnia in 2011, there were mine warning signs all over the place. I even had to wait for an hour while a demining team cleared a roadside so that roadworks could commence.

In the Croatian wars, with its long and hard to guard front lines, the mines were more or less shoveled out of trucks , with little in the way of administration. To make matters worse, when the spring floods came and eroded the riverbanks (the river systems, during the wars, were less well- maintained), they took the mines buried there with them, and so they ended up in other places alongside the rivers.

The Croatian government has a GIS webapp up at [https://misportal.hcr.hr/](https://misportal.hcr.hr/) . I used it to mark my paper map with a sharpie, so I would know in which areas I'd better not pitch my tent. The mined areas (in red) viewable through the webapp show the contours of the breakaway ethnic-Serbian "Republika Srpska Krajina" pretty well. (The stuff to the far eastern side of the map is the border front with Serbia and has nothing to do with the Krajina contours).

It amazed me to find these areas still so devastated and deserted. Bombed out houses everywhere, even in town centres (notably Pakrac), where the young people I spoke to who were working and living in these scarred towns hadn't even been born when the fighting started (early 90's, I remember we had a refugee in our class in primary school.).

</comment></comment></comment><comment><USER5> Rats (and dogs) still seem to be "state of the art" in the detection of chemicals.

Both the rats and the dogs scale very poorly, though. Maybe training rats via AI would improve that? Human labor in Africa is cheap, so automation doesn't really save wages, but it could improve how much you know about the reliability of the rats, and thus you could train more numerous and more reliable rats.

</comment><comment><USER6> This does not give me a lot of optimism:

"Last year, Apopo received international funding of $4.5m (£2.7m) from various donors and cleared 618 acres of mined land in Mozambique."

There are 640 acres in a square mile, so this is like $5 million per square mile cleared.

</comment><comment><USER7> They are working in lots of other locations besides just Mozambique. They are also good at sniffing out whether a sputum sample is positive for TB! Check out their website. I've been giving them money for several years now. They were featured in an article in the NYTimes ([http://www.nytimes.com/2010/06/17/opinion/17kristof.html](http://www.nytimes.com/2010/06/17/opinion/17kristof.html)), a list of different ideas for Father's Day gifts. My dad got a kick out of it.

</comment><comment><USER8> This idea seems to be taking a long time to be put into use. I read about it in 2004 - here's an interview talking about rats, dogs, and bees [http://www.irinnews.org/indepthmain.aspx?InDepthId=19&Report...](http://www.irinnews.org/indepthmain.aspx?InDepthId=19&ReportId=62880)

Here's a page with a bit more information about rat demining including some video [http://allafrica.com/view/group/main/main/id/00028535.html](http://allafrica.com/view/group/main/main/id/00028535.html)

<comment><USER9> Yeah, not surprising though. It's one of those things where 99.9% clear means a few children blown up every now and then. Having a field with "hardly any mines" really isn't good enough, so I can imagine it would take a long time to vet new procedures.

</comment></comment><comment><USER10> Not so uncommon although this one has the ultimate goal of "detonating" land mines rather than simply detecting them: "...offered the U.S. forces a large number of monkeys, some from Morocco's Atlas Mountains and others imported, to use them for detonating land mines planted by the Iraqis."

Source: [http://www.upi.com/Business_News/Security- Industry/2003/03/2...](http://www.upi.com/Business_News/Security- Industry/2003/03/24/Morocco-offers-US-monkeys-to-detonate- mine/UPI-14431048506179/#ixzz320CmlktT)

<comment><USER9> The problem with detonating mines, is that it only gets the ones that works 100%. So you might still have some left with partly broken triggers. Doesn't mean they won't blow up later, though.

<comment><USER11> UXO (unexploded ordnance) remains a problem quite after the fact. A gentleman in Virginia became the latest casualty of the Civil War in _2008_ due to a naval artillery shell.

The house my mother grew up in, and the block surrounding it, had to get evacuated twice. You wouldn't naturally think Pulaski Street in Chicago would be a great place to find bombs but you aren't counting on my grandfather, who twice had a shell land in his foxhole on Iwo Jima and fail to explode. Believing them to be his lucky charms, he brought them home with him after the war and put them in his basement, next to his collection of nails.

The CPD bomb squad said, after disarming the second one, "If he has a third one down here, it is _your_ problem."

</comment></comment></comment><comment><USER12> Far more cost-effective would be cloning ឯកសារ (Aki-Ra).

[http://www.badassoftheweek.com/aki- ra.html](http://www.badassoftheweek.com/aki-ra.html)

</comment><comment><USER13> Rodents Of Unusual Size? I don't think they exist...</comment>


Amazon Pantry - <AUTHOR> http://www.amazon.com/gp/browse.html/ref=pe_1118660_122178890_pe_button/?node=7301146011

<comment><USER2> Hear that, retailers? It's Amazon, coming for you. All of you.

I mentioned to my wife that I expected Amazon to have same day delivery in the next 5 years and she said "Then, why would you shop anywhere else? Why would you ever go to the grocery store?"</comment>


On emotional authenticity and masking as an autistic person - <AUTHOR> http://cassolotl.tumblr.com/post/160117558965 <comment><USER3> He says he attributes it to his autism, but maybe that isn't the cause at all. I'm not autistic, but I recognized what he was writing about. I have difficulty showing genuine emotions. My wife joking calls me Captain Holt (a reference to the stoic leader of the Brooklyn 99). Encounters with strangers are a draining experience involving a constant inner dialogue that sounds like am-dram director: "Emote more! Bigger smile! Deliver with eye contact! Now bring it down a notch. Act concerned by this revelation."

<comment><AUTHOR> According to the profile at the top left of the page, this person's preferred pronouns are "they" and "them". They self-identify as non-binary.

<comment><USER4> I am sorry, not a native english speaker.

What does this mean?

<comment><AUTHOR> Here is my understanding, after some extensive conversations with people in the same situation as the author.

In English one refers to a male as "him" and a female as "her". However, some people identify as "non-binary", which means that in their own internal self they so not feel that they are entirely male, or entirely female. As a result, they find it not quite right to be referred to as "him", but also not quite right to be referred to as "her".

So they prefer to be referred to in the gender-neutral "them".

If you are "traditionally aligned", if your personal self-identity matches the body your ghost[0] inhabits, this can be totally mystifying. Personally, I've come to accept that people are weird, and if someone says they want to be referred to as "they" and "them" then why not?

[0] "You are a ghost driving a meat covered skeleton made from stardust[1] riding a rock floating through space."

[1] Or nuclear waste - take your pick.

 _Edit: To the people downvoting this, it was intended to be a factual answer to a direct and reasonable question. I have no idea why you think this comment is inappropriate and deserves a downvote._

<comment><USER4> That must feel terrible...

Is this common? Never heard of it.

<comment><USER5> It's extremely common on parts of the internet but extremely rare in normal life

<comment><USER6> I feel like we would've said that about gay people thirty years ago if we'd had the Internet we do today. ' I live with one person who uses "they/them" and have lived with three others, one of whom identified as transgendered (as opposed to "gender queer). At the high school I worked at, we typically had a transgendered population of 1%-5%, but no one who used they/them--just one who used he/him/his and several that used she/her/hers. I think I've known more transgendered people than I've known CMU, Harvard, Stanford, and MIT grads combined, despite working in a tech startup and being the son of two CMU grads.

Yes, it's rare, but not as rare as graduating from Harvard, and it's definitely not just an Internet phenomenon. There are just a lot of areas where they don't feel welcome. They're real people in real life and they tend to congregate in places where they'll be treated as such. Right now that includes sections of the Internet, but also quite a few real life enclaves.

<comment><USER5> I agree with you, but Only a small subset of transgendered people want their pronouns to be they/their

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I am very far from Autistic but I think the whole idea of authentic feeling is rather fragile. I may generate appropriate responses very smoothly but I have no idea if they're authentic until much later. Mostly not. Mostly just what I know people need to see and hear.

I imagine an Autistic mind-adventurer who got inside my head would be very disappointed.

<comment><USER8> This post is slightly surlrising to me, although I don't doubt that many people feel like they need to behave that way to be accepted / loved. However, an authentic only response exposes your true feelings and opinions about something, and I feel like most of the time, you should be able to generate a decently socially respectful and well attuned response without misrepresenting yourself, even if it takes a slight bit of effort or risk feeling rejected

<comment><USER9> This seems to imply there IS a current feeling. Is that that always the case?

</comment></comment></comment><comment><USER10> > NTs seem expert at knowing which of their emotional reactions are > appropriate, so they can effortlessly express the appropriate emotions and > suppress the inappropriate ones.

Emotional reactions and empathy are not consciously regulated on a basic level (at least not for me). Conscious masking of emotions still produces micro- expressions, for example.

By the way, emulating an emotional response is not uncommon for "regular" people, too, e.g. when attending a funeral where you don't care about the deceased or attending a wedding where you hate the bride or groom. I'd say it's an important skill for social survival.

(I guess it could be argued that empathy is kind-of a low-level emulation of emotional responses... at least in some situations?)

<comment><USER11> > By the way, emulating an emotional response is not uncommon for "regular" > people, too.

I think that was the author's point. Everyone, autistic or not, finds themselves in situations where they need to fake emotions. The difference is that "regular people" can detect if the fakery is not working, know instinctually what the "right" response is, and can usually switch gears fast enough to satisfy the other person and save the interaction. The author seemed to be saying that not only do they need to operate off a "playbook" (which is normal for everyone), but that if the playbook goes wrong, they both can't detect it and don't have a backup plan.

> I'd say it's an important skill for social survival.

I mean, practically the defining characteristic of autism is the extreme difficulty, if not impossibility, of getting these skills. We get them for free "in hardware", but they're trying to do as best they can without them. Reminders like this are kind of redundant and unhelpful.

<comment><USER8> it's dumb, but in these situations I always think of the gpu vs software rendering in 3d graphics.. how much having dedicated hardware can do a crazy difference.. makes me wonder how much things would be different if we had dedicated brain hardware for other things

<comment><USER11> It's not dumb at all IMO, this is actually my preferred metaphor for explaining autism, at least to people who are technically-minded. When your brain has "dedicated hardware" for some function, it's easy to miss just how difficult the underlying problem space actually is. Being social animals, we evolved a lot of autopilot functionality for processing social interactions, and if this isn't working, you have to do it "in software", and that's incredibly tricky.

</comment></comment></comment></comment><comment><USER12> I am not autistic but I relate 100% with the author. In fact I have given lots of thought to this same subject.

I have realized that while I usually struggle to find the appropriate emotion to express to people, sometimes I do have authentic emotional experiences, and I wonder if the author does as well. For instance, do you laugh at jokes?

</comment><comment><USER13> There is a set of skills that might help quite a bit. Big Bang Theory to the rescue: [https://www.youtube.com/watch?v=vkSwXL3cGUg](https://www.youtube.com/watch?v=vkSwXL3cGUg)

It's not an easy skill, but it only need to be learned once.

<comment><USER14> Bringing up the Big Bang Theory as a realistic example of how to deal with a person with autism and calling your action a "rescue" is petty and hurtful. That show only shows harmful stereotypes of nerds for people to laugh at. What social skills could you possibly hope to magically convey through one two- minute laugh track? The author is fighting a lifelong battle here. Please at least respect their struggle.

<comment><USER13> The video is a good example of active listening. You don't have to understand what the other person is saying in order to connect with them. It's a very useful skill, removes a lot of stress from interaction.

<comment><USER14> Oh, that's what you were getting at. I suppose so, but it feels like that scene was played up for laughs because of how fake Anne felt the conversation, which completely went over Sheldon's head.

</comment></comment></comment></comment><comment><USER15> That sounds a lot like my current state of mind. Only that I'm not on the autistic spectrum. Just did the wrong thing in trying to tough out a major depression on my own which tuned me to feeling vaguely neutral all the time, plus I somehow lost the ability to be empathic almost completely. I do remember how it's supposed to look though, so hardly anyone notices.

If you're feeling like you're blowing fuses, stop what you're doing and get help before you adapt in the worst possible way.

<comment><USER16> > Just did the wrong thing in trying to tough out a major depression on my own

Can you please post what did to tough out

</comment></comment><comment><USER17> I can relate to the frustration but this whole article is in poor-me mode.

The author expresses his/her frustration with developing connections - <USER2> understand. The most important thing to realize is, no one wants to be around complainers.

Except other complainers, they get together and complain, and theorize about why the world is not the way they want it to be.

Being able to emotionally relate is honestly a false flag - there are plenty of people who are socially oblivious and they're doing just fine.

If the author was a super athlete and couldn't relate to people, he would simply be a 'jerk'. I bet he wouldn't have written that article :)

So really, it's not that you can't relate to people - it's that you haven't found a way to win despite having a bit of a setback and you are spending your energy on complaining.

Here's the solution: go and become really good at something, that other people value, and they'll forgive your social strangeness, in fact, they'll find it exotic and interesting.

Just go be really really good. At social dancing, at sports, at music, at dragon boating, beach volleyball, etc. Something social that takes skill and persistence that regular people don't have.

Autistic people have the gift of not being burdened by the same social programming most people are living in. The ones who take advantage of it live a great life. I mean, look at Elon Musk...

<comment><USER18> _> ...this whole article is in poor-me mode._

That strikes me as being very ungenerous. The article comes across to me as an honest attempt to explain as clearly as possible the social interactions internals of one particular autistic person - the author - to someone who is not autistic.

I found it an interesting insight.

 _> Here's the solution: ..._

How do you know? What are your specific qualifications that let you speak with such definite certainty?

<comment><USER17> Caroline, you're giving me a version of 'that's just like, your opinion man', coupled with 'I don't like your tone'.

I understand the author better than you think. The author has a worldview of 'my life is hard because X', coupled with 'X is something most people can't relate to'.

My point is, everyone goes through 'my life is hard because X' \- the solution is to work around it.

I offered a few options that have worked for me and people I know.

In regards to qualifications - people who have them don't go around asking, the qualifications are implicit in the value they bring to the table.

People who explicitly ASK for qualifications, are typically just being passive-aggressive, which's fine - it's just good to be aware of what you're doing.

<comment><USER19> What implicit value are you bringing here? It's important to question the source when somthing seems like useless stereotyping and metacomplaining, thats a form of complaining about complainers to reenforce current standards and stifle dissent.

</comment></comment></comment></comment><comment><USER20> > Imagine if you had to consciously process every breath. It would seem > stilted and robotic. You wouldn't be able to fully concentrate on anything > else. Imagine how exhausting and disabling that would be!

This is a dangerous analogy. The logical consequence is that any reasonable person with this condition would take a "cure" if (well, when) it's available. After all, who in their right mind would want to think to breathe!

What happens when those "cured" patients want to go to sleep to revamp the cognitive exhaustion they're used to, they're instead treated to an entire new domain of emotional impressions and memories to process? When they try incessantly to "solve" these emotional impressions and memories, but only end up creating yet more emotional impressions?

What happens when they realize that "null" doesn't actually equal "0"\-- that they cannot _ever_ turn off their new sensory perception?

<comment><USER21> An Experimental Autism Treatment Cost Me My Marriage[0] is a concrete example of the costs of a cure.

Edited to add the title of the article and move the link to a footnote.

[0] [https://well.blogs.nytimes.com/2016/03/18/an-experimental- au...](https://well.blogs.nytimes.com/2016/03/18/an-experimental-autism- treatment-cost-me-my-marriage/?_r=0)

<comment><USER20> That's a great example. I was speculating after having seen an interview with someone blind from birth who had gained limited sight late in life. But it appears the point applies quite well to this case.

</comment></comment></comment><comment><USER22> I have often thought that autistic people or socio-path people who have had to learn the appropriate responses to various human emotions would be a good resource for AI research in the area of developing more "human like" interactions. I am not autistic but I think I have elements of that lack of empathy, so I have had to also learn certain rule sets in a similar way: if someone says thing A that is supposed to have reaction B. Intensity of A implies Intensity B depending on situation C and so on. It would be interesting to capture all those rule sets from various subjects.

<comment><USER9> I always thought that austic people had an abundance of empathy but dealing with that is very hard.

<comment><USER22> hmmm, could be I am confusing sociopathy and autism ?

<comment><USER9> I have no idea; some people on the autistic spectrum may have issues with it too. I guess my point is that autism seems to be about ability to handle social situations rather than the underlying reasons.

</comment></comment></comment></comment><comment><USER23> In this subject: [https://gist.github.com/stared/98599fc53959b77ac6769de07e759...](https://gist.github.com/stared/98599fc53959b77ac6769de07e759061) (from A Mind-Body Look at the Concept of Asperger's Syndrome by Michael Samsel, LMHC)

</comment><comment><USER24> NTs?

<comment><AUTHOR> Neuro-Typicals

<comment><USER25> This concept seems like a fallacy designed to deepen one's own sense of alienation without illuminating what it is that the others are actually doing

<comment><USER26> Could you elaborate on this?

I disagree with what it seems you're saying, but I'm not sure I get your point.

<comment><USER25> I think that the primary symptom of what is being called autism in this case is the belief that others are better at handling social interaction. The autistic's commitment to this belief is the cultural milieu they develop for themselves.

I hear you, it is more of a glimmer of a thought than something that I have worked out well, and I gladly welcome your explanation as to why I am off- base!

It feels though that the elaborateness of this self-identity is a sign that the person is actually quite typical, but somehow their ability to perform critical analysis has been turned viciously against their own behavior because of a few early formative experiences becoming the archetype of all socialization.

In short then it is the scrutiny they are subjecting themselves to that is the problem.

Their commitment to furthering the development of this self-identity is of course all good, free to choose their lives as they see them. If they are in fact in social pain about the state they discover themselves in I would suggest to them that what they consider to be discovery is instead creation. And creation carries no inherent obligations, and they are much freer than the story they have learned to tell would permit them to admit.

<comment><USER26> I'm still not sure what your point is.

Mild autism (what we're talking about here), in many ways, is (to use a tech analogy) like missing SSL offloading when everyone else has it.

You can still talk SSL, by manually doing it on the CPU, but it bogs down the CPU with crypto and becomes overwhelming if you're trying to do other things at the same time.

You're also not going to be as efficient at SSL, which means you can get overwhelmed by just trying to manage SSL if there's many connections at once.

Recognizing that difference -- that there _is_ a difference in how you're processing those things -- is the first step to doing it better.

Autistic people are literally wired differently: [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4688328/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4688328/)

(Also, note that the paper uses the phrase "typically developing" to denote non-Autistic people.)

<comment><USER25> Again I believe that it is the concept of not achieving typicality that is the driving force of continuously deepening the autistic's state of alienation, even when typicality itself is an abstract "average" state that no person actually embodies.

edit: Just wanted to add, I'm not saying that autistics are not clearly at the avant-garde edges of personality, I am just suggesting that the source of the difference is created by the autistic's self-understanding.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> This is here because it applies on some level to us all.

I have a couple autist friends and they are awesome, and I understand that their emotions calibrate differently, but are still there and meaningful. After a while, you learn to calibrate to them, and can connect on another level. But this takes both sides letting down their guard and assuming good intentions. Something rare enough in love, let alone friendship. The time spent is worth it in either case.

<comment><USER28> Indeed. Autistic people are often extremely loyal, non-judgmental (in particular ways), and lacking in much ego. If you can get past the problems that this 'miscalibration' cause, there are a lot of benefits to having an autistic friend!

I don't blame people who are not up to the challenge, but I do hate it when people aren't even willing to respect the differences and instead choose to cast moral judgment.

</comment></comment><comment><USER29> >It's unsafe for me to react authentically to anyone.

Not sure if that's a problem of our society or of the individuals themselves. I feel like we have extremely low tolerance for nonstandard behaviour.

<comment><USER30> Compared to other nations, I find Americans extremely standardized. It must be the repressive schooling combined with the extremely regimented college experience. They have a great need to belong.

<comment><USER31> The 'how are you doing' you always seem to get from total strangers always baffles me when I visit that country. Whats, worse, it's not a real question, but just a protocol that demands the "I'm fine, thank you" type of answer in all cases. Neither party gets anything out of it, and instead of being some sort of prelude/preamble it's just something on it's own with no use whatsoever.

<comment><USER32> This had bothered me in the past despite growing up in a culture that demands it. Yet many things in language are far removed from their original intent, and we accept them (i.e. irregular verbs).

Personally I try to use less invasive openers, or at least take a moment to genuinely respond with how I feel at the time.

</comment></comment></comment></comment><comment><USER26> I want to read this, but it's slightly too wide for my phone screen (the start of words is cut off with no way to scroll) and I can't figure out how to adjust it.

It starts loading where it fits, then jumps to too wide woth no ability to fix by zooming.

Edit: Works on desktop site, so I'm sure it's just the mobile version being "clever". But seriously, annoying.

(Left in case anyone else has the same issue -- requesting desktop site fixed it for me.)

<comment><USER11> It's not just you, it started happening to me on Tumblr a lot several months ago. Something has gone badly wrong with their mobile layout. I wouldn't be surprised though; I can't imagine Veri-hoo considers Tumblr a priority.</comment></comment>


Curve fitting A: Linear Least Squares - <AUTHOR> https://terpconnect.umd.edu/~toh/spectrum/CurveFitting.html <comment><USER2> Would be interesting to see how he treats Voigt lineshape

</comment><comment><USER3> Replacing "Signal Processing" with "Regression" or "Least Squares" in the title would make more sense.

<comment><USER4> We changed the title from "Introduction to Signal Processing: Curve fitting".</comment></comment>


Ask HN: Whitepaper v Academic Paper: What's the best way to share breakthroughs? - <AUTHOR> Hey HN,
I'm a graduate student and I've been working on an interesting side project: building brain inspired modular neural nets. I'm not doing this under the purview of a professor, but there are some interesting preliminary results.
Generally, is it the sort of thing I should just share as a White paper or try to formally publish. Or should I just share a blog post about it <comment><USER2> Fortunately, this may be a false dichotomy.

Many journals are fine if you post something on a blog or a 'working paper' on an open site like arxiv while you put it through the peer review process.

if you are doing something that is timely, be aware that academic journals can take over a year to go through the peer review + revision process (months to hear back, month to revise, months to hear back, scheduled for several issues ahead -- not uncommon).

you're definitely better off having gone through the other side, though -- even if the paper doesn't turn out to spread virally (most ideas, even good ones, don't) -- the validation of the academic review can stay with you + your CV.

</comment><comment><USER3> (trying to) publish in CS conferences isn't as painful as in other disciplines, but without help from someone with an academic background, it's likely your work will not receive much attention, as you might lack paper- writing skills / knowledge of prior work.

If you can't find a local professor whom you can trust and who is willing to help (which you should try _first_ ), you might want to ask on r/MachineLearning. Many users there are grad students / researchers working in ML/AI, and I've seen someone in a similar situation (asking for endorsement to submit on arXiv) received help.

</comment><comment><USER4> I've published a couple conference papers. I found the process to be slow and frustrating. The quality of feedback from reviewers was extremely low. The effort to write a paper in the ultra-dry, tedious style of academia was great with the payoff of making the papers almost unreadable while obscuring the ideas presented.

Also, there's some expense involved. When I wrote papers I had an employer that paid my way to conferences. That is no longer the case. Journals don't require the same expenses, unless you want your work to be available through open access rather than locked into a single issue that will be read by maybe three people, ever. Open access usually costs the author money, meaning it's not really open.

For my next publications, I'm not going to go the academic route. It looks good on the CV but otherwise doesn't serve my purposes. YMMV of course but think about what you want before committing to an approach that these days appears to be designed more to boost the publication credits of academics than to actually spread knowledge.

</comment><comment><USER5> I recommend going through the academic paper route and aiming for the highest journal first. This process will give you free feedback from the experts in the field. You can always fall back and publish a blog post but you won't get the high quality feedback that going through peer reviewed journal does

</comment><comment><USER6> By graduate student do you mean masters or PhD. If PhD clearly (try to) publish academically. If masters, and you have interest in a PhD, also academic.

If you're a masters student with no intention of serious further academic activity then it doesn't matter much, arXiv + blog post seems reasonable.

</comment><comment><USER7> Are you working with a professor on other things? They are probably interested in seeing what you have. As a grad student you're definitely in a position to reach out to someone relevant and ask them what they think about your work.

If you're not planning to spend more time on it, and are just looking to share your interesting preliminary results, then a whitepaper might be the way to go. But if you have the time and believe your design has potential then it may likely be worth pursuing. Who knows, maybe some of us will be reading about it a year or two from now.

</comment><comment><USER8> I would suggest publishing it if you think it can get accepted at a refereed venue. It's never bad to add an extra paper on your CV as a grad student.

</comment><comment><USER9> White papers are not peer reviewed so are faster. If your goal is speed, white paper. If your goal is ip or prestige or sharing knowledge, academic.</comment>