GitHub's Public Speaking Culture - <AUTHOR> http://zachholman.com/posts/github-speaking-culture/

<comment><USER2> "More importantly, you want to to be there for other companies, too. Form those relationships with others so that you can be there for them when they're facing those hard problems. Fuck the business reasons; be good stewards of your community. There aren't many things that can make you happier than helping someone else get through a rough patch."

I love this sentiment. It's 100% why I get up for work in the morning. It's cliche, but I'd say don't "be there for other companies," but be there for other _people,_ whether they're your customers or your co-workers or your colleagues.

</comment><comment><USER3> To me a company that encourages public speaking is a big perk for my own career development. When I was interviewing a year or two ago, no company had a good answer to my question about my career path. With flat organizations, it's even worse because there is less room for you to grow. If the company is helping me build a name for myself and get experience with non-technical skills, they are at least mitigating this problem a bit.

</comment><comment><USER4> I remember a GitHub'er speaking at RailsConf a few years back (possibly '09 in vegas?). I thought it was one of the best talks of the conference, both in terms of content and pace/delivery. I learned things, it kept my attention, I still remember it today.

All that to say–excellent point. Having your employees speak is good for them and good for the company.</comment>


Damn Cool Algorithms: Quadtrees and Hilbert Curves - <AUTHOR> http://blog.notdot.net/2009/11/Damn-Cool-Algorithms-Spatial-indexing-with-Quadtrees-and-Hilbert-Curves <comment><USER2> This might be obvious to many, but spatial indexes are good for more than just "show me the restaurants within five miles of me". It's a good technique to know for efficiently searching _any_ two columns simultaneously. If you have, for example, a database of people, their hometown, and their favorite color, and you want to know all people from Chicago that like green, a spacial index over color and hometown will be vastly more efficient than a "regular" single- column index over any one of those columns. (The reason is that an index on one column doesn't efficiently produce a small resultset. If we index on color and there are five colors, an index over color only reduces the dataset by 1/5th. Similarly, indexing over hometown might reduce the size of the dataset by 1/1000th. But if we index over both columns at the same time, then the only results that the index will ever produce are results that are the exact answer to our question. No unnecessary scanning!)

Anyway, lat/long might be the easiest "pair" of columns to imagine when discussing anything "spatial", but most other two-column pairs work the exact same way.

<comment><USER3> Yes - I remember using these techniques addressing 2d dense matrices. The specific case was when the matrices involved grew so large that the linear access operations were causing page faults for sequential row or column access. This was a perfect example of pathologically bad memory accesses when data was stored in row-major or column-major layouts.

Very impressive speedups for these interleaved data layouts. The end goal was to embed these layouts into the compiler tools, so that the programmer would do normal two dimensional matrix allocations and would get the optimized layout based on analysis.

I wrote terrible C to accomplish these layouts and minimize the instruction counts.

</comment></comment><comment><USER4> Whilst I was an intern at Google I worked with Hilbert Curves. Range queries are something BigTable and Cassandra excel at and are the core database component of any Hilbert Curve based spatial index.

The real issue is building the database queries. Google released Uzaygezen[1], a Java library for multi-dimensional indexing, that handles the majority of this for you.

[1]: <http://code.google.com/p/uzaygezen/>

<comment><USER5> I did not get this in the article - how exactly do we construct range queries (which the Hilbert curve improves on) here? Is the quadtree range resolved into actual coordinates, or is the datatype of the index bound to be integer, so we can query a range over the index (0110110 to 0110111 = 54 to 55, so the query range is [54, 55])?

</comment></comment><comment><USER6> This technique is simultaneously cool and depressing. Remember all that cool stuff you learned in computational geometry? Throw it out.

Just associate geometry with a set of well chosen ids, and you can stuff it into really simple, conventional data structures and do all of the spatial operations you wanted to quickly and simply in practice.

</comment><comment><USER7> I'm a bit confused. I've naively put axis-aligned bounding-boxes (AABBs) in my octree without any kind of thought. I put them in the smallest box that contains them. I also keep a byte using bits to mark the sectors they intersect, a cache that greatly cheapens things.

It works very well. I even keep small things like bullets in my octree (most game engines keep them separate), putting them in an AABB representing their position for some duration.

I am doing my queries in nanoseconds.

Its worth saying that for big worlds (think minecraft++), octrees don't work as well as zoning systems e.g. pages. You can of course use a hierarchy, using pages or zones with octrees in them.

</comment><comment><USER8> Does anyone know if there's a commercial database using quadtrees or hilbert curves? (Aside from the libraries mentioned in the comments, I mean something more productized)

<comment><USER9> Oracle used to use a similar fractal curve system for their spatial index, but has since moved to R-trees.

I believe MongoDB is using a geohash system for their spatial queries as well.

</comment></comment><comment><USER10> Thanks, I had never heard of geohashes before, but it sounds like they might really help with a problem I've been having lately.

</comment><comment><USER5> How would someone implement this, then? Is it really just an index column besides the data tuples, containing the recursive quadrant position (111111 for bottom-right in a 3-level grid)? And, what datatype would you use for this - clearly, an integer is not long enough if you have a great number of levels..

<comment><USER5> Ok I just wrapped my head around it. For querying to work here, the datatype HAS to be integer or long, or else queries on higher levels would not return the tuples associated with lower-level-quads.

</comment></comment><comment><USER11> The Wikipedia description of Geohashes is a bit odd in that its base32 decoding uses the alphabet with some letters (a, i...) left out instead of simply using [0-9a-v]. Anyone know why that would make sense?</comment>


Music for Games – Looking for a Composer? - <AUTHOR> Hi everyone,
My name is Jon, I'm a composer based in Melbourne - my focus is writing immersive interactive music for games. I'm just starting out and looking for experience.
Does anyone have any games that they are currently working on that needs music? In terms of budget, I'd be happy for the experience and opportunity to promote my name, so my working terms are negotiable.
At the very least does anyone know of any websites that might assist me in networking with game developers and their associated audio directors?
If you're interested in working together (or know of somebody that might benefit from my skills), please have a look at my website (www.jonforest.com.au). On it, you will find a few samples of my music.
Look forward to working with you!
Thanks
Jon <comment><USER2> Shoot me an email at the place listed in my profile--I know a team that might be interested.

EDIT: Also, never work for free. Include a quote in the email and that'll help.</comment>


Mass-generating fake Twitter accounts for profit - <AUTHOR> http://www.f-secure.com/weblog/archives/00001773.html <comment><USER2> Twitter is a great platform for these spammers:

* Can reach a large amount of users by mentioning popular events (like trying to get high page ranks on google for spam pages). * Users expect short (and not fully descriptive) messages with a link. * The link is shortened to obfuscate where you are really going. * No spam filtering yet (Is there even enough data given in 140 characters to make effective spam filtering?).</comment>


Hosting Maven Repos on Github - <AUTHOR> http://cemerick.com/2010/08/24/hosting-maven-repos-on-github/ <comment><USER2> I am developing a website that provides Maven microrepositories at <http://repo.si>.

I found this both cheering and depressing. Cheering because it seems other people are also not happy with the current status quo when it comes to Maven repositories. Depressing in that the solution discussed is quite workable.

I also see that the Sonatype public repository has had more take up since I lasted looked. Should I cut my losses and stop now or is there room for another repository provider?

<comment><USER3> The github-hosted Maven repo process I described works, but it's far from the ideal of _just having a proper repo_. I'd like to see Sonatype's OSS repo become the obvious choice (they certainly know what they're doing in that arena, and have a privileged position vis á vis their maintenance of central, and probably what will replace java.net and kenai), but they're not making it as easy as it should be. See my reply to Brian Fox's comment on the original post.

As for whether you should cut your losses or not -- that's a tougher question. I'd love to see a properly competitive market for repo hosting services. On the other hand, I wouldn't want to try to compete with a company that quite literally sets technical standards based on how their products are implemented. Sorry, that's not much help, is it? :-/</comment></comment>


Stealing unencrypted SSH-agent keys from memory - <AUTHOR> https://www.netspi.com/blog/entryid/235/stealing-unencrypted-ssh-agent-keys-from-memory <comment><USER2> I've upvoted this because I want to see what really smart people have to say about it. That said, I've always been of mind that if someone gains unauthorized root access to my box, then nothing on it can ever be trusted again. This includes things in memory. In other words, this feels obvious to me, once pointed out.

Is there something novel about this that I'm missing?

<comment><USER3> I agree with you, but in case you missed the author's rationale:

 _" However, this causes the attacker to have to wait for the target to type in their passphrase. This might be hours, days, or weeks, depending on how often the target logs out. This is why obtaining the SSH key from memory is vital to pivoting to other machines in a speedy fashion."_

I'm not sure how you would solve this problem while providing the functionality ssh-agent provides, aside from perhaps a HSM or something.

<comment><USER4> Anyone keeping SSH keys in an ssh-agent process for weeks on end is doing it wrong. You can use the -t option to ssh-agent to specify a maximum lifetime for identities added to the agent. I would set it to less than a day.

<comment><USER5> if you unlock it as soon as it expires im not sure what that gives you. all the attacker needs anyway in that scheme is 24h, its not a big difference.

</comment></comment></comment></comment><comment><USER6> I wish SSH had a narrow kind of delegation capability... E.g. if instead of ssh-agent having access to the key, it used the key to sign a tuple like {time-limit, [host-ip], ephemeral_pubkey}, then forgot the private key, and used the ephemeral key to actually authenticate to hosts— but they'd only accept it from the listed host ip set and during the specified time limit.

Obviously if the attacker has access long enough they'll capture the passphrase and private key eventually, but it would be nice to narrow the window.

Right now the best you can probably do is use a gpg smartcard with the ssh- agent/gpg-agent shim stuff, (random tutorial here: [https://github.com/herlo/ssh-gpg-smartcard- config/blob/maste...](https://github.com/herlo/ssh-gpg-smartcard- config/blob/master/YubiKey_NEO.rst))

<comment><USER7> Your scheme could probably be implemented using certificate based SSH: Your users log onto a CA which gives out user-certificates with a specified lifetime, they copy that to their desktop-machine(s), or maybe add it to a ssh-agent like intermediate key-storage and can do their days work.

Tomorrow, they'll have to get new certs (automatically, after authenticating to the CA using appropriate means).

Here's a tutorial showing cert-based ssh auth: [http://neocri.me/documentation/using-ssh-certificate- authent...](http://neocri.me/documentation/using-ssh-certificate- authentication/)

Obviously with secure key storage (smart-card) prohibiting accidental loss of the private key, and a working cert-revocation infrastructure it's not necessary in the first place.

<comment><USER8> That's essentially Mozilla Persona, but for SSH instead of the web. The people at Mozilla are in fact already discussing such possibilities: [https://hacks.mozilla.org/2013/04/mozilla-persona-for-the- no...](https://hacks.mozilla.org/2013/04/mozilla-persona-for-the-non-web/)

</comment></comment></comment><comment><USER9> So, as someone needing to run unattended scripts across a wide variety of hosts, what's the best practice for managing SSH keys? I've been using ssh- agent. Is there a better way?

<comment><USER4> Make sure that the SSH keys are tightly restricted in the authorized_keys file so they can only run the commands that need to be run unattended. If possible, also restrict them by source IP address. Here's an example authorized_keys file that I have in production for doing unattended backups:

      command="/usr/local/backups/backup_server /etc/snapshot_backup_list",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty,from="10.70.0.0/16" ssh-rsa AAAAB...

I wouldn't worry unduly about protecting the keys themselves - since they need to be accessible for unattended operation, there's not much you can do to prevent them from being accessible to an intruder.

<comment><USER9> This is hard, since there is such a large number of them. It would be very painful to maintain this list. For a while I had the keys expire in ssh-agent, but that didn't work because you can't extend the expiration before you run a set of unattended commands. That is, if it's 11.5 hours into a 12 hour expiration, and I need to run commands that will span the expiration, then I'm screwed, since 1) I can't query when the keys will expire, and 2) I can't extend it another 12 hours (from now, not from the expiration).

I feel like ssh-agent is essential to my life but it's badly designed and I have this nagging feeling it's insecure (and articles like this feed this fear).

<comment><USER4> That sounds like a bit of a quandary. One thing I'm not clear on - if these run unattended, how do you enter the passphrase?

ssh-agent isn't insecure, it's just not magic. If an attacker gets root access to a box, they can examine the system's memory, and the memory of ssh-agent necessarily contains the unencrypted private keys.

Edit: if you're really concerned about private keys being exfiltrated, you can always use a smartcard (the OpenPGP card[1] in a Gemalto USB Shell Token[2] works well with SSH). But if the smartcard is online all the time, then an intruder can always simply _use_ the smartcard to SSH wherever they want, even if they can't actually get the private key itself.

[1] [http://shop.kernelconcepts.de/product_info.php?products_id=4...](http://shop.kernelconcepts.de/product_info.php?products_id=42&osCsid=bdf5854d9214419637adcf0c5215e6fe)

[2] [http://shop.kernelconcepts.de/product_info.php?products_id=1...](http://shop.kernelconcepts.de/product_info.php?products_id=119&osCsid=bdf5854d9214419637adcf0c5215e6fe)

<comment><USER10> I think the point is that they enter the passphrase once to load the keys into ssh-agent, and then the unattended process can use them forever.

<comment><USER4> If that's the case, then I would start a dedicated ssh-agent process just for the run, add the identities (without expiration), and later kill the agent when the unattended run is over.

<comment><USER11> That's fine for that kind of scenario, but often "unattended run" means something spawned by cron, like a daily backup, or a CI system that spawns build jobs on slave machines. There's not a lot of options there.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> The technique of using gdb to attach to ssh is pretty old.

Here's an example from 2005, which was presented (iirc) at Defcon as well: [http://www.blackhat.com/presentations/bh-usa-05/bh- us-05-boi...](http://www.blackhat.com/presentations/bh-usa-05/bh- us-05-boileau.pdf)

In that case, SSH-Jack would just piggyback on existing (user-level) ssh connections, which is also pretty serious, though that's not as exciting as stealing keys.

<comment> void-star Yep. The general technique of scraping memory for private keys and certificates a pretty well-known and established. Particularly in forensics and malware circles.

I don't point it out to engage in the "who was first" thing. But to point out that this is very much an applied attack in the real world. Real attackers (includes "forensics analysts", incase you don't consider them "attackers" too) have been using this technique in malware as well as countermeasures/investigations for quite a while, now.

See: [http://www.trapkit.de/research/sslkeyfinder/](http://www.trapkit.de/research/sslkeyfinder/)

[https://github.com/emonti/yara- ruby/blob/master/samples/sslk...](https://github.com/emonti/yara- ruby/blob/master/samples/sslkeyfinder)

[http://volatility-labs.blogspot.com/2013/05/movp- ii-21-rsa-p...](http://volatility-labs.blogspot.com/2013/05/movp-ii-21-rsa- private-keys-and.html)

EDIT: actually a much earlier discussion is from '98 by none other than Shamir

[https://www.cs.jhu.edu/~astubble/600.412/s-c- papers/keys2.pd...](https://www.cs.jhu.edu/~astubble/600.412/s-c- papers/keys2.pdf) [PDF]

</comment></comment><comment><USER13> This is exactly why SSH has agent forwarding.

Do not copy your private key to other systems.

ssh -A is your friend.

<comment> m-app Well, it prevents your private key from being compromised but an attacker with root on the intermediate box can still authenticate to other servers using your SSH agent socket.

If you really want to do secure SSH hopping, use the ProxyCommand directive with `netcat` in your SSH config.[1]

[1]: [http://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Ju...](http://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#ProxyCommand_with_Netcat)

<comment><USER13> Nice. Thanks for sharing

</comment></comment></comment><comment><USER14> So, is there a big advantage to running ssh-agent vs unencrypted 0400 keys in your ~/.ssh directory?

<comment><USER4> Yes. ssh-agent prevents non-root users, _including the user running ssh-agent_ [1] from being able to extract the private key. That's much more secure than storing unencrypted keys in ~/.ssh.

[1] ssh-agent uses some tricks, like making itself setgid, and/or using prctl(PR_SET_DUMPABLE, 0) on Linux to make its memory undumpable.

<comment><USER15> And on OSX, it integrates with the keychain as well!

<comment> void-star You're better off not storing your passphrase in the keychain and just typing it in that one first time, though. But it's still marginally better than an unencrypted private key for automation if you need a 100% unattended setup.

<comment><USER16> "In the keychain" doesn't necessarily mean in the _login_ keychain. You can create as many user keychains as you want, with different passwords. Also, add the keychain app to your menubar (via preferences) to get a quick way to manually lock one or all keychains (and alternatively, the whole computer).</comment></comment></comment></comment></comment>


'I must fundamentally change and grow up': Uber CEO Travis Kalanick's apology - <AUTHOR> https://www.washingtonpost.com/news/morning-mix/wp/2017/03/01/i-must-fundamentally-change-and-grow-up-uber-ceo-travis-kalanicks-big-apology/ <comment><USER2> Active discussion: [https://news.ycombinator.com/item?id=13760405](https://news.ycombinator.com/item?id=13760405)

</comment><comment><USER3> I watched the video 3 times, and did not find anything wrong with the CEO's behavior. And don't understand why the CEO should be issuing any apology at all for this video. Might be just because of the bad-media coverage.

He was explaining the situation very politely. As a CEO, making business decisions amidst uncertainty is hard. Its when the driver started placing his $97K bankruptcy charge on the CEO - the CEO lost his cool, asked him to take responsibility for his actions and walked out.

<comment><USER4> Yeah, the driver was the one yelling and jabbing his finger at Kalanick. He obviously did not want to have a constructive dialogue, so Kalanick left. Seems reasonable enough to me.

I mean, blaming your purchase of an expensive car on Uber? Really? You're bankrupt because you put all your eggs in one basket buddy, not because Kalanick is an asshole.

That being said, Kalanick has acted like an asshole in the past, but this is not one of those times.

<comment><USER5> Yes, it is. Uber isn't the driver's employer. Uber is a _vendor_ to the driver. The driver is complaining that its vendor made commitments, on which the driver depended, and then reneged. The driver might be right or might be wrong, but in no discussion with a vendor in the history of the Fortune 500 has it ever been OK for the vendor to accuse their customer of "not taking responsibility for their own shit".

What the video shows isn't wrong on the level of the Fowler post. It just shows Kalanick as petty and deeply unserious about his role, which is an alarming look for someone whose company is embroiled in scandals about mismanagement.

<comment><USER4> That's not accurate either. Uber has maintained from the start that their driver's are independent contractors. You can make all sorts of verbal/casual agreements, but if "we will ensure you have X amount of work at Y rate for Z amount of time" is not written into your contract, you have no right to complain.

Uber or any other company are not responsible for any tools a contractor might buy in order to complete their work, unless explicitly stated in a written agreement.

<comment><USER6> I really hate this notion of "you have no right to complain." The only thing that your contract takes away from you is your right to pursue legal action on things that fall outside of its scope. If you have a contract and the company begins doing things that you believe are outside of the spirit of the agreement, you should absolutely complain. This driver is even maintaining the terms of his contract by continuing to drive.

The idea that you shouldn't be allowed to express your grievances because you work at the pleasure of your employer/company is toxic and regressive.

<comment><USER5> Again, not an employee; in fact, the standing here is almost the opposite; it's Kalanick who has most of the obligation in this relationship. (I think we agree about the rest of this).

I keep bringing this up because it's crucial to Uber's business model and something that has been repeatedly disputed. Uber badly wants its drivers not to be employees but instead partners. Kalanick can't get huffy when his business partners have grievances for him.

</comment></comment></comment></comment></comment></comment><comment><USER7> Someone made an interesting point on a discussion I saw yesterday: _Travis has never worked at a company that he hasn 't started himself_[0]. He had a short stint at Akamai when one of his companies was bought but it was shorter than one year.

The take away is that _he has never worked at a place with a rigid corporate structure or real HR_. While that might be good for a startup that needs to move fast, it's not good if you want to learn on how to cultivate a healthy company culture, or have any empathy for your employees.

In other words, he has been running a college frat house for the past 7 years and it shows. He's probably more ignorant than mean-intended.

And too many entrepreneurs/co-founders in Silicon Valley are in the same position.

[0] [https://www.linkedin.com/in/traviskalanick/](https://www.linkedin.com/in/traviskalanick/)

<comment><USER8> > He's probably more ignorant than mean-intended. And too many entrepreneurs > in Silicon Valley are in the same position.

This is a common excuse that holds no water with me. "Good intentions" are worth absolutely nothing, in fact I'd prefer a CEO who is an asshole on purpose to one who is just naturally a piece of shit and can't see it until his company gets bad press.

It's an issue of maturity and responsibility and ethics with people's livelihoods at stake. There can't be excuses.

<comment><USER7> I didn't mean it as an excuse, but as a way to explain and understand the problem. I'm not even considering whether he had "good intentions" or not. I have no way of judging that.

Understanding is the first step on fixing it and preventing it in the future. Pointing fingers at someone as if they're the root and the single cause of the problem might feel good, but it's too easy an explanation.

In your case of an asshole CEO and an ignorant CEO, I wouldn't prefer either. Both are just as bad. But the ignorant CEO just never learned empathy and might be able to become a better human; the purposely asshole CEO is irreparably broken.

<comment><USER8> You wrote that he was probably more ignorant than ill-intentioned. That implies good intentions or no intentions.

The intentional asshole makes good decisions for the company, think Bill Gates in the 90s. These days he's shown that that was business, now with the Foundation he's choosing to not be that guy. TK does not appear capable of a change like that.

<comment><USER9> I think being an asshole and being demanding can also get really misconstrued, lots of people who have worked for me think I'm demanding, probably annoying, and sometimes an ass, however I'd like to believe they would also say they have grown because they were pushed, and I don't think they would say I'm unkind, or a jerk, or hurtful. I don't believe that's what is going on with TK.

</comment></comment></comment></comment></comment><comment><USER10> This would be grounds for termination for a mere peasant. When you're the boss at Uber, however, you can just apologize for condoning sexual harassment and move along your merry way.

This is a good reason for people who think sexual harassment is wrong to remove Uber from their phones.

<comment><USER11> I wish to hell there was a good alternative where I live. I'd pay more for it.

<comment><USER12> Are there not taxis where you live? They may be slightly less convenient (or they might not be!) but sometimes that's the price for doing the right thing.

<comment><USER13> depending on where you are, taxis can be much, much worse. "no I won't bring you there, it's not on my way" is just one tiny example.

<comment><USER14> Similarly, "no, those two addresses aren't the territory of the same company, there's no way to get there from here by cab."

</comment></comment></comment></comment></comment><comment><USER15> You are 40 years old and run a startup valued well into the billions. You are probably far beyond the growing up stage. This is who you are Travis.

For context, many people said Steve Jobs needed to grow up during his first stint at Apple (and no one ever accused him of running a company that has major issues with sexual harassment). Jobs was 29 when the Mac came out, and this was after the big success with the Apple II. By the time Steve Jobs came back to Apple in the 1990s and performed an amazing turnaround of Apple, he was in his early 40s.

<comment><USER16> Like you mentioned there are fundamental differences b/w a CEO who creates a culture where sexual harassment is OK to where a CEO will bully employees occasionally, steal their ideas as their own and park in the handicapped parking lot. I mean, both sound terrible, but the first one is definitely on a different level of nastiness.

<comment><USER17> FYI "Are you a virgin? You look like a virgin." during an interview may have been sexual harassment.

<comment><USER15> Well, it's only sexual harassment if its true and not just some line from a Hollywood movie: [http://www.idownloadblog.com/2012/04/17/ken-segall-steve- job...](http://www.idownloadblog.com/2012/04/17/ken-segall-steve-jobs-virgin/)

</comment></comment></comment></comment><comment><USER18> Kalanick is 40 years old. Demographically, he must have been surrounded by "grown-ups" for more than half of that time, i. e. people who don't consider sexual harassment a fun hobby for his brand of overachievers. If he didn't get it before, I doubt he will now.

But, if he's seen the light, great. It's obviously tainted by being motivated solely by his effort to safe Uber. If he's sincere, his newfound believes would be best served by resigning, or switching to a role at Uber where he's no longer responsible for managing people.

Not that it matters – Uber isn't much more than a bro-themed ponzi scheme anyway. Their investors are subsidizing each ride on the order of 100% of the fare, there's no economies of scale to grow to, nor are there barriers to entry. Maybe consumers will continue to use the service. But investors, employees, and drivers won't. It's anybody's guess as to how long they can survive without fresh cash, but I bet this apology stems from Kalanick's ability to see the end of the runway.

<comment><USER19> Their self driving cars is the end game.

<comment><USER18> "End game" indeed. Self-driving cars shed the only competitive advantage they have: efficiently organizing thousands of drivers.

Surely self-driving cars will also be available to consumers. It's just a software update from there to a mode that lets your car earn some money when you don't need it. The manufacturers will be the first to offer the remaining booking/billing/insurance service, but there'll be plenty of competitors.

Uber, meanwhile, will start with >100 billion already burned in a 5-year mission to obsolesce.

<comment><USER16> If they're smart (and for all their dipshit culture they do have a good product) they will use all the data they have gathered on rideshares to possibly improve that experience. Or pivot into something else.

</comment></comment></comment></comment><comment><USER20> It's all PR. The CEO statement, their businesses plan so far, etc.

It's all PR until they IPO and stop subsidizing rides.

Then, we'll see if they'll really survive as a taxi company.

<comment><USER21> Uber is not a taxi company. They do not compete with Taxis, but with car ownership.

EDIT: I knew if I won't make my point explicit it will be misread. I was referring to:

> Then, we'll see if they'll really survive as a taxi company.

They are building self-driving cars to create a logistic company. They have a limited interest in being a taxi company(in a classical sense), therefore they don't care much.

<comment><USER22> Don't taxis as a business compete with car ownership?

<comment><USER23> No, they're too expensive. UberX is cheap enough to compete with car ownership.

</comment></comment></comment></comment><comment><USER24> "Some people don't like to take responsibility for their own shit, they blame everything in their life on somebody else."

The ungratefulness of this guy... saying this to one of your drivers, one of the people who is directly responsible for the success of your business.

Without him and the thousands like him, Travis would be nothing.

<comment><USER25> Travis is nothing, he never was anything. People got momentarily confused by his alpha ego and the big pile of money, but they're catching up fast.

</comment></comment><comment><USER26> This guy has Gavin Belson written all over him: super-polished and charismatic when the Valley is watching him, and coldly detached when they're not.

<comment><USER27> What you're describing is one of the traits of a psychopath

[http://www.telegraph.co.uk/news/2016/09/13/1-in-5-ceos- are-p...](http://www.telegraph.co.uk/news/2016/09/13/1-in-5-ceos-are- psychopaths-australian-study-finds/)

</comment></comment><comment><USER28> Only in the world of American business can a 40 year-old billionaire with a history of threats, intimidation, and blatant disregard for the law, come out and say "I need to grow up" and have people nod along approvingly.

I used to think the idea that Americans see themselves as "temporarily embarrassed millionaires" was a grotesque caricature. But then I saw people watch a video where a wealthy guy, known for his history of exploiting the poor, scream "personal responsibility" at a bankrupted immigrant. And they overwhelmingly identify with Kalanick.

It's really pathological at this point.

<comment> gingerbread-man Put another way, only in the US do businesspeople have to publically apologise for not-being-nice. Towards the end of the video, Kalanick was brusque and even demeaning, but I don't think his position as CEO grants me the right to get high-and-mighty on my keyboard and demand he "grow up." Nor do I expect much insight into anyone's character can be gleaned from a 30-second argument in the backseat of an Uber.

I'm not saying Kalanick is a good (or a bad) CEO. But his job is to build the company, not to serve as its' Mascot-in-Chief.

<comment><USER29> This was not a mere failure of niceness, as if he didn't say please and thank you.

He was also unkind, arrogant, self-centered, thoughtless, ungrateful, and foolish. As well as failing to demonstrate compassion and moral responsibility.

You're also wrong on what CEOs are supposed to do. Companies are made out of people. His primary job is as a leader of people. The way you build a company is mostly through getting a hundred thousand small interactions with people right. He visibly failed as this guy's boss, just as he's been privately failing to build a sane company culture.

An important secondary job is being the public face of the company, the human representation of the brand. Even if you are a terrible human being, it's your job to get up there and simulate being the kind of person that people would like to associate with your brand.

</comment></comment></comment><comment><USER9> I'm sorry but any good exec coach can point you to Patrick Lencioni or whatever... That man does not need leadership help, he needs how to act like a human help.

</comment><comment><USER30> There is an interesting theory [1] that Uber's value prop to consumers is dependent on subsidizing 59% of the cost of each ride. Over time they have to remove this subsidy to stem the Billion $ annual losses. The relationship with drivers will undoubtedly be more strained over the coming years, whether it happens as a financial necessity or due to Uber's push into self-driving. Managing the nuance of this transition will be one of the greatest challenges for Uber and require strong skills in empathy, communication and strategic thinking.

[1] [http://www.nakedcapitalism.com/2016/11/can-uber-ever- deliver...](http://www.nakedcapitalism.com/2016/11/can-uber-ever-deliver-part- one-understanding-ubers-bleak-operating-economics.html)

</comment><comment><USER30> I wonder why he is even apologizing. I assume he can't be fired because of dual class voting structure. I don't think he actually cares about the driver.

<comment><USER9> You can be "fired" by virtue of your top people walking out on you, though. Better for him to placate the ones who might have a spine.

<comment><USER30> I have talked to numerous Uber people over the past month and there are many that are locked in because they can't trade the stock and can't afford to exercise the options because of the valuation. Very unhappy .

</comment></comment></comment><comment><USER31> I don't know whether I'm more embarrassed or sad for the company as a whole. There's a lot of people with their entire lives wrapped up in a company run by a guy who's probably going to headline /r/cringe today.

</comment><comment><USER32> It's just too easy to jump on Uber hate bandwagon but I seriously hope their bubble will just burst in 2017, then the whole "economy of sharing" will take a hit and similiar services will start show some maturity. Contract of employment would be a good start.

</comment><comment><USER33> I am a user of Lyft and (very rarely) Uber. As a passenger in these services, I had an expectation of privacy---I would not expect that the driver could record me. I've certainly had conversations on the phone that I would expect to be private.

Travis may have had the same expectation.

On the other hand, a CEO of a billion dollar company should have been coached about how to politely react to criticism.

<comment><USER17> > I had an expectation of privacy

You probably shouldn't, and most certainly don't legally have one.

In this case, the recording device was in clear view.

More broadly, the vehicle is owned by a party that has a vested interest in protecting its value. The driver also has prerogative to be able to record incidents / interactions with users so that he can report damage / throwing up. The driver also has prerogative to protect himself from legal liabilities in instances of rape, kidnap, theft, or violence.

<comment><USER34> "You probably shouldn't, and most certainly don't legally have one"

This varies by jurisdiction.

"968.31 Interception and disclosure of wire, electronic or oral communications prohibited." ... "whoever commits any of the acts enumerated in this section is guilty of a Class H felony"

[https://docs.legis.wisconsin.gov/statutes/statutes/968/31](https://docs.legis.wisconsin.gov/statutes/statutes/968/31)

<comment><USER17> See "Intentionally"

A dash cam has the several prerogatives mentioned above.

The court case would be interesting; especially if a government entity argued no expectation of privacy and no intentionality in the recording.

<comment><USER34> "See "Intentionally""

Hmmm, interesting. I would have thought a dash cam would be intentional, but I guess you could forget it was on. Now that I read that statute a bit closer, I see it is about the interception of communications. I really don't know what interception of oral communication is? I wonder if I am reading the right statute, lol.

"The court case would be interesting"

Yes indeed.

Edit: Here is some more relevant info, if you are in Wisconsin and want to know more; [https://docs.legis.wisconsin.gov/statutes/statutes/995/50](https://docs.legis.wisconsin.gov/statutes/statutes/995/50)

[http://wislawjournal.com/2010/06/21/commentary-laws-vary- on-...](http://wislawjournal.com/2010/06/21/commentary-laws-vary-on-whether- recording-is-allowed/)

<comment><USER17> > in a place that a reasonable person would consider private or in a manner > which is actionable for trespass.

It would be hard to prove that a reasonable person would consider a ride share private.

\- You know the driver can hear you

\- Not your vehicle

\- Others have recently ridden in it

\- In some cases, you're sharing with another unknown party (Pool/Line)

</comment></comment></comment></comment></comment></comment><comment><USER35> Uber CEO aside, is it me or is it weird to ask how on earth that Uber driver lost 97k?

<comment><USER36> I figured he was referring to the cost of buying an Escalade for Uber Black driving

<comment><USER21> Yeah, but how you can lose 97k? Did he crash it on the first day? If the black is not doing great I trade it for a Prius and lose 25k?

<comment><USER17> How does one afford 25k (+ interest)?

</comment></comment></comment></comment><comment><USER37> Seeing this apology (that I didn't think was necessary) just made me more angry about their failure to acknowledge anything is wrong with their culture of harassment.

Obviously they can't actually acknowledge the harassment issues because it would put them in a terrible place legally, but it's funny how that omission makes this such a negative PR move in my mind. Better to say nothing at all and just keep pretending they can unicorn-horn themselves through the rough patches?

</comment><comment><USER38> It looks like I'm in the minority here, but I honestly don't see what's so bad with how Kalanick reacted. The guy was giving him a hard time and he reacted accordingly, I even think he held back alot more than he could have. Kalanick's right, 'Some people don't like to take responsibility for their own s‑‑‑.' There's alot of truth there. If a company changes their policy, and it affects your income, it's not the company's responsibility to fix that for you. either you find a competing company that can make you more money, or you have to find another way to get your income. In either case, it's your problem to handle. It reminds me of Amazon's recent changes to their affiliate program. There will be people that will maneuver around the policy changes and pull through, then there will be people that will remain stagnant, lose money and blame everyone but themselves.

Kalanick should have doubled down. "Yeah, I was mean, but the guy was a d*ck." Then again, I'm just an armchair analyst. I don't have a multi-billion dollar company to handle.

<comment><USER39> It would work if it wasn't "pot calling kettle." Some people don't like to take responsibility for their own shit? You don't say, Travis, you don't say.

<comment><USER38> It's not Travis' responsibility to give that guy a steady income.

<comment><USER39> Duly noted, but that's not the doo-doo I'm talking about!

</comment></comment></comment></comment><comment><USER40> Maybe he should do a Larry Page thing and hand off a lot of day-to-day stuff for a couple years.

</comment><comment><USER41> > I must fundamentally change and grow up ...

... if I am to keep my lucrative boob magnet.

</comment><comment><USER42> I'll be very interested to see what happens if Uber does decide to go public.

Prior to recent events I'd have thought if they did go public they'd almost certainly follow the recent trend of setting up a class structure that gives little to no voting control to most common shareholders. Will they be able to get away with that if it means Travis retains control?

</comment><comment><USER43> Sorry but the words "I must fundamentally change and grow up" are unbecoming and not befitting of a CEO. As genuine and sincere as it may have been intended - if at all - it just comes across pathetic, weak and a failure. No one wants apologies. You're the fucking CEO, we want ACTIONS.

</comment><comment><USER44> The problem is now that Uber has this reputation for being cynical, people might well discount the apology.

</comment><comment><USER45> I suspect that was the last Uber he'll ever take. Too scared to face criticism from the drivers.

<comment><USER46> I like that the driver rated him one star. How funny would it be if he was unable to get a ride because of his low rating?

</comment></comment><comment><USER47> I think everyone gets one of these. You clearly screw up, you admit to it, and you say you'll fix it (as long as it's not a clearly vicious screw up with irreversible effects).

<comment><USER48> Gimme a break. It's a fauxpology designed to wedge people into a "well, at least he admitted he was wrong" mindset so that it all quiets down and people stop talking about the fundamental problem with Uber: it replaces solid jobs providing public transportation financed from public taxation with a private systems in which the individual peons are powerless, poorly paid and racing to the bottom.

</comment></comment><comment><USER49> He can apologize by resigning and going back to the frat that he came from.

</comment><comment><USER50> Maybe those hashtags are cutting deeper than I expected? :D

</comment><comment><USER51> I didn't see he did anything wrong, he was just a cutting through the crap the driver was spewing. The driver was soliciting the CEO when he should be doing his job and driving, and just shut up. As if a Uber driver knows the business so well that he has the right to tell the damn CEO how the innerworkings of Uber pricing work. The driver just (inappropriately) used the opportunity to lambaste the CEO about his problems.

<comment><USER52> It seems to me the Uber driver should find a different job if he's not able to make a go of it. What possible benefit to arguing about pricing with the passenger, regardless whether he's the CEO? I admit, I'd be intrigued if I knew my passenger was the Uber CEO -- I might ask some polite questions about the direction of the company and so forth but probably not directly argue with the man regardless of the CEO's people skills or lack thereof :)

<comment><USER18> > What possible benefit to arguing about pricing with the passenger, > regardless whether he's the CEO?

How about "getting that CEO so far into a corner, you can rate him one star, shame him publicly, and still get an apology"?

That driver, even though he didn't make the best possible argument for his position, has been tremendously influential.

And the position of "don't complain, you're free to leave" didn't even make sense in the 19th century when it was used against people complaining about child labor or fire safety.</comment></comment></comment>


On being a single founder for 7 years - <AUTHOR> http://www.markentingh.com/home/entry+on-being-a-single-founder-for-7-years

<comment><USER2> Mark, nice project,but don't be scared that the product is not completely finished ... it will never be ...

your most important next steps are now get customers , get customers and get customers ....

so

\- remove the "closed beta" tag

\- have a graphic designer give it a 2013 layout

\- put up an price page

\- buy some adwords to start doing live user testing

\- start optimizing the sales funnel

<comment><USER3> > have a graphic designer give it a 2013 layout

20x this. Or, switch to Bootstrap: instantly have numerous gorgeous pre-fab themes at your disposal, plus an infinite number of web designers who will have an easier time customizing and theming to your and/or your users' needs.

<comment><USER4> >> have a graphic designer give it a 2013 layout

> 20x this.

That page looks great to me. Can you give me an example of a '2013 layout'?

</comment></comment></comment><comment><USER5> This is truly a case of should have launched quicker, if this is really about a business.

It sounds more like a guy has been wandering around the world, living what is surely a very interesting nomadic existence, hacking up a storm, rather than building a business though.

JavaScript like scripting language? Custom markup? Beta for 5 years? This doesn't sound like the path to profits to me.

</comment><comment><USER6> I've noticed there seems to be two definitions of a solo founder.

1) Single hacker trying to build a business and the product at the same time by themselves. They do everything, by themselves.

2) A business where there is a single founder with all the equity. They have employees and those employees are paid with currency.

In the case of 1, I think it's a very hard road. Most software is built by more than one person, and most businesses must involve more than one person. You can of course make pretty good money off of freelancing, but building a business around a product is tough. Of course, not impossible.

In the case of 2, you need to be willing to "put your money where your mouth is" because you'll need to pay people. And even then, if you see any success and want to grow faster, you probably won't be the only shareholder for long. Jeff Bezos started Amazon alone, but they're a public company now so there are lots of shareholders. However, it is interesting to look at eg Sergei Brin's net worth as a ratio of Google's market cap versus the same for Bezos and Amazon. Not splitting equity in the beginning makes a big difference later on if everything goes according to plan (which it rarely does, but hey).

The OP probably falls into definition #1

<comment><USER7> > However, it is interesting to look at eg Sergei Brin's net worth as ratio of > market cap compared to Bezos.

Saving everyone some Googling :)

\-----

\- Google market cap: $260.45B

\- Sergey Brin's net worth: $22.8B

\- Ratio: 0.087

\-----

\- Amazon's market cap: $124.03B

\- Jeff Bezos' net worth: $23.3B

\- Ratio: 0.187

<comment><USER8> Wow...both companies are roughly the same age (Google is 14, Amazon 17), and the one that had two founders is worth about twice as much as the one with one founder, which makes the net worths of the founders nearly identical. That's a freaky coincidence.

</comment></comment></comment><comment><USER9> "This whole time, I worked on the platform source code. I feature-creeped for at least 5 years. I didn't have much of a portfolio to show for it either. "

Congrats on persevering for that long but I almost think this is a case example of the downside to being a single founder...no one to rein in your feature creep time.

</comment><comment><USER10> This is definitely inspiring, and it looks like Mark has developed a very viable SaaS platform if the right demographic is targeted.

With that being said, I would suggest that he seriously consider a pivot in his marketing strategy due to competition which has emerged during his product development; Webs, Weebly and Squarespace come to mind. I would say at this point, small brick and mortar businesses are the most viable market target for a product like this.

Additionally, it might be worth investing a small sum to recreate the UXD, or at minimum reduce the use of gradients and move toward a more simplistic approach graphically. The center gradient overload is almost migraine inducing.

Other than that, I truly hope he's successful with the amount of work and personal funds which he's put in.

</comment><comment><USER11> Too complicated for an average user, too simple for a developer/designer...sorry, doesn't sound good for me. This said, in your shoes, I'd probably try to find a very specific niche, or maybe to turn into a service for instantly hot page creation, like 1 short-lived pages, or something like that...my 2 cents

<comment><USER12> I think it's a bit short-sighted of a comment you're making. It doesn't need much work to make it simpler, nor to make it more advanced for a developer/designer.

<comment><AUTHOR> if you look at the blog post again, I added more screenshots of the back end dashboard. The platform is more advanced than you think. Designers can use a server-side markup language to handle custom skinning of web page content & UI, along with half a dozen other advanced core features. complex applications that can be installed, tableless responsive design, editable web design template for every web site with built-in source-code editor, javascript-like server-side/client-side scripting language, 3rd party widgets, google analytics, near-live-editing of web pages, DNS management.

</comment></comment></comment><comment><USER13> I have to say that at least from standpoint, this seems to be pretty heroic (to use quite a strong word) and kind of inspiring! To be able to believe in and forge ahead working on something you believe in. Regardless of the end result my own sense is that the at the end of the day the writer Mark can really be proud of his accomplishment.

</comment><comment><USER14> I tried it, but I get

Server Error in '/' Application. Object reference not set to an instance of an object.

at <http://www.rennder.com/compelling-web-site-footer/>

</comment><comment><USER15> I had to read this article in Opera using view-source... tldr but I'm assuming this guy failed and I'm not surprised based on his blog code being such an awful mess... better luck next time

</comment><comment><USER16> it's nice to see something that could be left as a side project evolving into a functional and hopefully successful product. Good luck! Did you switch programming languages in the process?

<comment><AUTHOR> I didn't switch server-side languages, but I started from scratch 2 years later, in the beginning of 2008. I had developed my own Flash based AJAX system I called AFLJAX before then, and was using ASP.net 2.0, then started a new project with ASP.net 3.5, Microsoft AJAX and update panels.

</comment></comment><comment> super-serial Reminds me of a pic I sent my programmer friend after not seeing him for 6 months... <http://oi47.tinypic.com/2utk9b7.jpg></comment>


Maru – A self-hosted symbolic expression evaluator (2012) - <AUTHOR> http://piumarta.com/software/maru/ <comment><USER2> If you like this you should check out OMeta and Ohm from the same group.

[https://github.com/alexwarth/ometa-js](https://github.com/alexwarth/ometa-js) [https://github.com/cdglabs/ohm](https://github.com/cdglabs/ohm)</comment>


Lisp: A Language for Internet Scripting and Programming (1998) [pdf] - <AUTHOR> http://norvig.com/lugm.pdf <comment><USER2> As I was reading, I couldn't help but thinking about why the world didn't turn out this way, and I came to the conclusion that in 1998 the only two companies who realized that the future of the web was the browser were Microsoft and AOL. [1] The rough isomorphism between HTML and Lisp S-expressions [2] was an obvious technical advantage over JavaScript and among the Lisps, though tellingly not the case with Scheme, the association list was already in place to do all the work that JSON has come to perform in exactly the same way but for syntax.

AOL of course destroyed Netscape after purchasing it by encumbering itself and all it touched with an East Coast Big Dumb Company mindset. It wasn't until years later when Google started seeing Microsoft as the competition that anyone else treated the browser strategically. By that time, JavaScript had won just by showing up in IE 6 and in the legacy Mozilla carried from Netscape.

What might have happened if Yahoo had decided the browser was strategic instead of living off banner ad revenue at the expense of increasing irrelevance? They had Graham and the Viaweb team, and so some manager decided to port their code to C++ and the rest, as they say, is history that never was.

[1] It is interesting to think that Apple would build its future in ways that treated the browser as a commodity - first with the iPod and then with the app store.

[2] See Slava Akhmechet's _The Nature of Lisp_. It's definitely worth reading: [http://www.defmacro.org/ramblings/lisp.html](http://www.defmacro.org/ramblings/lisp.html)

<comment><USER3> > among the Lisps, though tellingly not the case with Scheme, the association > list was already in place

An association list is just a list which elements are conses. I'm fairly certain that cons, car and cdr were part of Scheme since the beginning and they are all you need to build assoc and friends. Scheme lacked a proper hashtable datatype though, which was present in some other Lisps.

<comment><USER4> he was talking about scope here. hashes do not help much.

assoc lists were important to implement dynamic environments simple and fast, which is not so easy with hash tables. In assoc lists you tolerate duplicates, but by putting new at the beginning you override/"shadow" the old ones, until you leave scope and use the old assoc list. and share the data! with hashes you have to actively delete or copy the tables. non-efficient and very complicated.

<comment><USER5> They're really neat. When I learned about them it emphasised that it's amazing what a handful of cons cells and some thin air can do.

</comment></comment></comment></comment><comment><USER6> > Simple debugging. This is an area where AI techniques could be quite > helpful. Detecting and explaining common syntax and runtime errors is a > crucial step in teaching a new language. Tools which provide this type of > support could increase the interest in this language in the mainstream. Our > current debugging support is minimal and provides only the basic commands: > step, skip, and continue.

I have given some thought to this in the past. Has there ever been a serious attempt at this?

Sometimes the error messages for really simple mistakes (missing semicolon, wrong punctuation, etc.) are obtuse and almost completely meaningless. Of course, if it were easy to give simple, clear error message in such cases, they resulting message would be simple, so it's other complexities that get in the way. The biggest problem I see is that having labelled training data, e.g. source code that fails compilation along with the specific actual error, is unlikely, and having an expert provide small, self-contained examples is unlikely to be useful (really, enough training data to be effective) in real world errors, even when novice programs are fairly small.

Edit: I was just thinking about this, and with prudent use of a VCS, labelled training data would just be pairs of the form <commit that fails, next commit that compiles>. It would be interesting to see if it's possible to pull useful data from exiting history, or if some level of restraint is necessary in practice. Really, I'm just thinking about the precipice of supervised and unsupervised learning here.

<comment><USER7> For syntax errors, check out: [http://research.swtch.com/yyerror](http://research.swtch.com/yyerror)

It's not "AI" but I think it's a much more practical approach that any parser could implement, with enough work and feedback.

I haven't used Go enough to know if this technique makes a qualitative difference on the friendliness of error messages. Interested to hear opinions.

<comment><USER8> I've used Go for a personal project for a bit now and the compiler output is pretty good and consistent; beats Python and C++, I'd say.

</comment></comment></comment><comment><USER9> Here's a link to PG's essay and speech excerpts on why Lisp is great for web- based applications (2001) - [http://www.paulgraham.com/lwba.html](http://www.paulgraham.com/lwba.html)

PG delivered a similar message to my undergraduate CS class in 1996/7 as a guest speaker when he was working on Viaweb and extolling the virtues of LISP for server-side web applications.

<comment><USER10> It's strange that it took so long for someone to mention pg. Viaweb was written in lisp, and the site we're on is in arc, a lisp dialect.

</comment></comment><comment><USER11> > _The syntactic and semantic simplicity of LISP enables non-experts to > quickly master a basic level of LISP programming._

For Scheme this might hold true. But most Common Lisp programs I've seen are beyond hairy.

Plus, the (classic intro-to-LISP) notion that "it has a simple syntax with few constructs so it must be easy to program in" has to die.

Assembly has very simple syntax too. I wouldn't write a large program in it.

<comment><USER12> > _" Plus, the (classic intro-to-LISP) notion that "it has a simple syntax > with few constructs so it must be easy to program in" has to die. Assembly > has very simple syntax too. I wouldn't write a large program in it."_

Suppose we amend that to simple _high-level_ constructs?

I don't think I've ever picked up a language as fast as I picked up scheme. Not even python.

<comment><USER13> Scheme's extremely simple* but it's a perverse simplicity.

My experience from tutoring CS students in Scheme back in the day was that it usually either clicked immediately, or not at all. The folks who'd perhaps never get good at it aren't necessarily poor programmers. I don't know that any of them were great programmers, but that might be my prejudice as someone who was having a hard time teaching them a programming language. Some of them went on to get more impressive ones than the one I have, so probably definitely it was just prejudice. Anyway, the point remains, I've met a lot of people who struggled with Scheme, and it was most certainly not for want of smarts. My best guess is that it's just that the language is only suitable for people who have a certain approach to thinking that's perhaps unusual.

* And beautiful - easily one of the most lovely languages I know.

<comment><USER14> I believe this is where Common Lisp got it right and scheme got it wrong. The scheme designers wanted a more pure language when often, the dirty imperative method is desirable. Common lisp has many features to make programming of real, large-scale projects easy (a great example is looping constructs which are often more obvious and easier than the more 'pure' tail recursion preference of scheme).

<comment><USER15> Scheme has plenty of dirty imperative methods, if you want. Their names end with `!`, like `set!` to mutate a variable. In most cases it's cleaner to be purely functional, but it's not required.

Predicates end with `?`, like `equal?`.

This naming and consistency makes it easier to learn Scheme.

What makes Common Lisp more practical is libraries. Hairy and crufty some may be, but many of them, and many of good quality. You know the old saying about how X is a badly implemented version of half of Common Lisp.

The Scheme-descendant Racket is, however, plenty practical in this regard.

<comment><USER14> I really don't like the Common Lisp naming and the 2-space nature of the language makes this even worse. The conflict of the implementors appears in many places. I like many things about scheme, but I won't whitewash it's problems.

Non-standard, non-portable racket libraries aren't the answer to scheme's basic nature (though I believe r7rs-large will solve a lot of these issues). More serious dealbreakers in my work are the lack of declare, no built-in OOP, and no spec for optional and keyword parameters.

Scheme has other issues too such as the inability to turn off continuations (they are great in some situations, but can cause performance issues and specifically cause increased memory usage).

<comment><USER16> Racket's extensive collection of libraries aren't meant to answer anything about Scheme -- they're for Racket. That's why we changed the name.

Racket is, however, a great answer to "is there a Lisp that's both conceptually consistent and has lots of libraries".

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Note to any future academic paper writers: Please include a date in your paper. Thanks.

Judging from Norvig's employment, this is at least 10 years old. And also from SILK, which later evolved to JScheme, which is now used in e.g. Scheme Droid interpreter for Android.

<comment><USER18> Y2k

</comment></comment><comment><USER19> This is from 1998, and Peter Norvig has long since switched to Python.

      "LISP - a Language for Internet Scripting and Programming",

      Timothy J. Hickey, Peter Norvig, and Ken Anderson

      LUGM'98: Proceedings of Lisp in the Mainstream, Nov. 1998, Berkeley, CA.

As per [http://www.cs.brandeis.edu/~tim/](http://www.cs.brandeis.edu/~tim/)

<comment><USER20> Any lisper who needs to make a living will switch to anything. Usually, that doesn't remove any merit to lisp or the lisper.

</comment></comment><comment><USER21> Browser makers like Mozilla have had the option, at any time, to enable the use of Lisp (or any other language) in the place of Javascript. Nothing uniquely qualifies Javascript.

<comment><USER22> Not even "in place of" but "in addition to". There's a reason that the script tag has a language attribute as part of the standard.

<comment><USER23> I'm afraid you're browser doesn't support XScript, please download Chrome Explorer 310.

On a serious note, JavaScript and the lack of fragmentation is one of the best features of Web. You don't have to download appropriate browsers (in theory and mostly in practice) to run your website.

<comment><USER22> > I'm afraid you're browser doesn't support XScript, please download Chrome > Explorer 310.

But this sort of thing already happens all the time. You don't have the right flash player, or the right silverlight player, or the right version of Java. There would be very little difference in the UX between different scripting languages and the current UX w.r.t. media codexes, and the end result would be the same in both cases: there would be some repertoire of languages and codexes that everyone uses and become standard.

The alternative is to forever have to deal with a language that by design cannot even handle integer math or unicode strings properly.

<comment><USER24> > But this sort of thing already happens all the time. You don't have the > right flash player, or the right silverlight player, or the right version of > Java.

That's exactly the point. Imagine dozens of them.

<comment><USER22> Dozens of what? Browser plugins? I don't have to imagine, that's the world we live in. Dozens of languages? I very much doubt that will happen. Just as we only have a small handful of codexes that actually matter (Flash, Silverlight, H264, maybe ogg) I predict that we will end up with a small number of languages that actually matter: Javascript, Python, Ruby, and Scheme. Maybe CL.

IMHO that would be a better world than the one we currently live in. Javascript is serviceable for its original purpose, but for serious webapps it's broken beyond redemption. NOTE: This is not to say that it is impossible to write serious webapps in Javasceript. Obviously it is possible. What I mean is that at some point the aggregate cost of dealing with Javascript's design flaws becomes greater than the aggregate cost of dealing with multiple browser scripting languages.

<comment><USER25> > Dozens of what? Browser plugins? I don't have to imagine, that's the world > we live in.

That's quite a stretch. There are two browser plugins that are in broad use on the web: Flash, for fallback audio/video support and some casual games, and Silverlight, for Netflix. Both are dead technologies when you consider mobile web; even if you're only thinking about laptops/desktops, both Silverlight and Flash have essentially been abandoned by their creators, and the web platform has almost entirely subsumed their original purpose for existing, currently with the exception of DRM.

Personally, what I'm hoping happens is that we get one, single better compile target, and languages can just target that — giving the web a broader selection of languages without the fragmented nightmare (and security nightmare) of introducing dozens of new plugins. This is something that browser vendors are currently working on: Google with PNACL, and Mozilla (and, to some extent, Google as well) with asm.js. I hope we end up with PNACL, but a sufficiently optimized asm.js would serve the same purpose, albeit with a more difficult debugging / performance optimization story.

<comment><USER22> > Personally, what I'm hoping happens is that we get one, single better > compile target

That is a terrific idea in theory, but the last time anyone tried to do that the result was the JVM.

<comment><USER26> Are you trolling here, or are you really implying that the JVM is bad? Could you elaborate?

I consider the JVM to be the best part of programming in Java. The JVM is fast, lets you write very portable code, and it gives you a great debugging experience. Plenty of other languages chose to target the JVM, like Scala and Clojure, for its quality.

That's not to say the JVM is perfect. I don't like type erasure for instance (I understand C# has 'better' generics). Nevertheless - and this idea comes up frequently - imagine if browsers ran VM bytecode instead of interpreting JavaScript. The browser would be totally language-independent. You could write in any language that compiles to the browser bytecode, and deploy the precompiled bytecode 'object' files. I mean, it is a great idea in theory, and it's exactly what the JVM has succeeded in doing, except that the JVM does it for operating systems and not browsers.

Of course, this is all a fantasy at this point. There's no possible way browser vendors would ever agree on a standardized virtual machine, much less all implement it (see DartVM).

<comment><USER22> > Are you trolling here, or are you really implying that the JVM is bad? Could > you elaborate?

No, I'm not trolling. I was responding to someone who said that the two non- dead browser plugin technologies were flash and silverlight. Java is notably absent from that list. (Can you even interact with the DOM from a Java applet?)

I agree with you that the JVM is the best part of Java, but that's not saying much IMHO.

<comment><USER25> Java applets had a lot working against them from a technical and UX perspective: they were insecure, and popped up quite scary warning notices about security that had to be clicked through in order to run the applets. Java was also poorly optimized for consumer-facing applications: JIT startup and warmup time was sufficiently long that they felt more sluggish than HTML/CSS/JS, despite the fact that in the long run the JVM outperforms JS by a significant margin.

In an aside, the JVM has only relatively recently been an effective general- purpose compile target, and it wasn't designed as such. The JVM's failure for frontends doesn't give much indication as to where the pitfalls of targets like PNACL or asm.js might be: it died (deservedly) because of reasons that apply to neither technology — slow startup time and lack of effective sandboxing. Both PNACL and asm.js start quickly, lean on hardware-acceleration in the browser to react smoothly, are designed from the start as compile targets, and are sandboxed to the point where browser vendors don't feel the need to pop up warning boxes that scare off consumers.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> I was thinking about this too. I am somewhat of a lisp newbie, but one of the people on the LedgerSMB team also maintains Armed Bear Common Lisp (i.e. Lisp in the JVM).

I remember talking with him about teaching languages to kids. Like me he has three kids. I was noticing that many of the beginner languages were quite Lispy, including Logo which I had been teaching my oldest and I asked about the suitability of various lisps beyond this (I would end up going the direction of Rebol instead at this point, but plan to come back to Lisp).

His response was that for a beginner, Lisp is nice, but Common Lisp was, in his words, "too big" to be an early programming language, so one has to start small and work up.

I can't help but wonder at this. "Simplicity in the eyes of the user" is not something I have ever associated with Lisp as a whole but it seems like part of that is jumping into Common Lisp directly.

Now, none of this means one couldn't have a lisp for the web. However, we don't have one right now.

<comment><USER14> Brendan Eich made the statement (speaking of JS as the asm of the web): "Source as 'bytecode' also avoids the big stupid Java bytecode mistake: freezing a poorly designed lowered form of Java, then being unable to evolve the high-form source, i.e., the Java programming language for fear of breaking Java bytecode compatibility. This severely messed up the design of inner classes and then generics in Java -- and then Sun broke bytecode compat anyway!" [Source]([http://www.hanselman.com/blog/JavaScriptIsAssemblyLanguageFo...](http://www.hanselman.com/blog/JavaScriptIsAssemblyLanguageForTheWebPart2MadnessOrJustInsanity.aspx))

We are at a point where JS is following the same path. Ideas like ECMAScript 4 were rejected because they would break compatibility and we are still working around the problems of JS. We need that clean break now rather than later. Such a clean break would be at it's best now rather than later. We could simply continue supporting the current JS compilers 'as is' for old code (or provide a JS to new language compiler) and replace the language with another which is designed correctly (we could perhaps break the DOM too).

While I would like to see a scheme r7rs used (except with support for OOP, built-in actors, and static typing), I suspect that M-expressions (more like dylan) would be necessary (though for the record, I've seen more nested parenthesis/braces in JS code than I've seen in a lot lisp code). Such a language could also be interpreted via JS (or compiled to JS) for old browsers (though I suspect telling people to upgrade or go without would promote suitable updating more akin to telling everyone to change to digital TV or go without).

We need a clean break and lisp is worthy of consideration rather than being cast to the side like last time.

<comment><USER28> > though for the record, I've seen more nested parenthesis/braces in JS code > than I've seen in a lot lisp code

I saw a presentation once, where they compared the amount of parenthesis/braces in mainstream languages vs Lisp, with Lisp having less in most algorithms being compared.

For example,

        func_call(args) vs (func_call args)
        array_access[index] vs (array_access index)

The thing is, since in other languages parenthesis/braces tend to be scattered along the source file, it looks like less than Lisp based languages.

</comment></comment></comment><comment><USER29> I wonder if any teacher already tried to teach LISP as a first language instead of java or C, and what there was to learn about it.

<comment><USER30> MIT is where the legendary "Wizard Book" (SICP)[0] was developed, for teaching their introductory class using Scheme.

A few years ago, MIT restructured their entire CS curriculum (not just the intro class) in a way that required redesigning the individual curricula of each of the classes, including the intro class. As a result, they couldn't use SICP, since it didn't cover the same topics. At this time, they ended up switching to using Python for the class.

This is sometimes presented by people who dislike functional programming as an indictment of Scheme/Lisp, though this is very misleading. Nobody made the decision to "abandon" SICP - "they" made the decision to redesign the entire curriculum (top to bottom), which meant writing new syllabi/textbooks for _all_ /most of their classes, especially the intro class, and _then_ "they" made the decision to write the new syllabus/book for that new intro class in Python[0].

Some schools (University of Minnesota is one) still use SICP.

Personally, I think that SICP is the best way to be introduced to both the fundamentals of computer science and programming. The only caveat is that it requires a certain level of dedication before-the-fact (something that could be reasonably assumed in an MIT intro class). So it's not the best choice for someone who "just wants to dabble" in programming and see if they like it (try Python or Ruby for that), or for someone who wants to understand computer architecture and engineering (try C for that), but for everyone else, it's unparalleled.

The nice thing about SICP is that it focuses very little on learning the nitty-gritties of Scheme (partly because there's so little to learn!), whereas most other introductory materials I've seen have to focus on Java-specific, Python-specfic, etc. features. Reading SICP feels more like reading a math textbook that "just happens" to come with a REPL for mathematical expressions, as opposed to learning the ins and outs of a given programming language or environment.

[0] Of course, "they" refers to many different people, very few of whom would be in the same "they" as it was in the 1980s when SICP was first written, so one has to keep that in mind before concluding that MIT "changed their mind".

[0] [https://mitpress.mit.edu/sicp/](https://mitpress.mit.edu/sicp/)

<comment><USER31> There's a bit more that went into all of this:

MIT's EECS undergraduate enrollment _cratered_ after the "dot.com" crash, more than halved, after being 40% of the student body for decades.

The department panicked.

And it was most certainly ordered that Scheme be _entirely_ purged from the base curriculum, even while they claimed they were teaching SICP concepts and functional programming in 6.005, they were using Java, a language that's "not even wrong" for the purpose (that, at least, has been improved to Python, which is only [fill in the blank] hostile to FP).

Not one of the department's finer moments, from my no direct interest in EE at all viewpoint, but from a less biased one you can safely say a MIT EECS degree now means something quite different. And it's a damned shame for those outside the department, for whom 6.001 was truly valuable, that MIT no longer offers anything in its niche (outside of a rearguard 1 month version of it during January).

</comment></comment></comment><comment><USER32> Well, if using Lisp in the browser sounds tempting, you should have a look at Clojurescript: [https://github.com/clojure/clojurescript](https://github.com/clojure/clojurescript)

</comment><comment><USER33> For a moment, it really appeared LISP is acronym: <L>anguage for <I>nternet <S>cripting and <P>rogramming rather than LISt Processing.

</comment><comment><USER34> LISP is still a great language for web programming! [1]

Lately it seems like more people are doing compile to JS (like asm.js and Mozilla's emscripten work in Odin Monkey [2]) which fits in perfectly with LISP dialects. Programmers can still create their own DSLs, macros, compilers, etc. in LISP and use them for modern web apps today. Just because this is a less popular/documented route doesn't mean it isn't possible. I hope we'll see a rise in LISP web programming pretty soon.

It would be fun if someone could write a compiler for a new ClojureScript dialect that targets asm.js and takes advantage of CPS for recursion like Scheme does.

[1] [https://github.com/jashkenas/coffee-script/wiki/List-of- lang...](https://github.com/jashkenas/coffee-script/wiki/List-of-languages- that-compile-to-JS#wiki-lisp-scheme)

[2] [https://wiki.mozilla.org/Javascript:SpiderMonkey:OdinMonkey](https://wiki.mozilla.org/Javascript:SpiderMonkey:OdinMonkey)

</comment><comment><USER35> OOoh, nice. Is this is a direct intellectual precursor to Clojure (although I have no idea if the authors have had any collaboration)?

<comment><USER36> Rich Hickey is probably not the same as Timothy J. Hickey.

</comment></comment><comment><USER37> I remember when Peter Norvig wrote the first cut at Silk - I think he wrote it in one weekend.

<comment><USER38> I think he wrote it to teach himself Java.

</comment></comment><comment><USER39> I've been working on a Scheme that might be more welcoming to people with a ()-phobia: [http://vijaymathew.github.io/slogan/index.html](http://vijaymathew.github.io/slogan/index.html)

<comment><USER14> What advantage does this have over dylan?

</comment></comment><comment><USER40> SILK - Scheme In 50 KB</comment>


Storing 50M events per second in Elasticsearch - <AUTHOR> https://datadome.co/store-50-million-event-per-second-in-elasticsearch/ <comment><USER2> 3 years ago, I made a simple calendar app in django, and I wanted to use Elasticsearch so users can search and find an event, and to use it to populate an upcoming events list. There's only about 10,000 events in the database.

I quickly realized what a pain it is to use Elasticsearch, for a simple app like mine.

Pain points:

1) You have to setup and recreate part of your database in elastic search. So you essentially end up with two databases. Which now you have to keep in sync.

2) I was getting unpredictable query results from Elasticsearch, which after a few days, and much head scratching turned out to be that I was running out of memory.

3) When a user added a new event, it was not being added to elastcsearch index automatically. I could not figure out how to do this reliably. I could make it work reliably only after a sync of the entire Elasticsearch index. But this meant that it was next to useless, to use for the Upcoming Events List. Since I only wanted to sync the index once a day. Confusing the users, as to why their event was not showing up. And I gave up, and just ended up implementing the Upcoming Events List directly from my database in python.

4) Elasticsearch came without some security settings not set by default, and after a few months it was hacked. I had to download a new version and wasted more time.

I still use Elasticsearch, but only for search, and not the upcoming event list. And I don't think it was worth the complexity that it added to my project.

<comment><USER3> I have been put off by Elasticsearch's complexity a number of times. Can I ask why with searching a limited about of text you didn't juse use Postgres' full- text search?

<comment><USER4> I'm not the person you're replying to, but does Postgres nowadays have a straightforward way to do tf-idf or BM25-style information retrieval?

<comment><USER5> Not op but not that I know of.

I commented below - I highly recommend Xapian for small projects to test the waters. It's the SQLite if search.

<comment><USER6> Or you could use the FTS extension of SQLite. [https://sqlite.org/fts3.html](https://sqlite.org/fts3.html)

</comment></comment></comment></comment></comment><comment><USER7> it appears in this document:

* DataDome is a security company, and gets web traffic in near real-time for clients; a lot of traffic in some cases with very specific numbers given, like daily peak loads.

* DataDome only retains records for 30 days, and the most attention is given to the most recent traffic, to detect attacks

* an ElasticSearch deployment records all of the traffic records downstream from Apache Flink; a new feature added to ES this year, improves the management of ES indexing, and that solved problems that DataDome was having.. things are better! write an engineering blog post !

* re-indexing is done nightly, and implemented in a cloud environment that can handle the (heavy) work to rebuild the indexing.

These numbers are impressive. Earlier criticisms of ES are being addressed, and ES is stable and a cornerstone of the architecture. A company called DataDome is providing real services in near real-time. Congratulations to the team and an interesting read.

<comment><USER8> I was curious about their numbers

> Storing 50 million of events per second

> A few numbers: our cluster stores [...], 15 trillion of events

> We provide up to 30 days of data retention to our customers. The first seven > days of data were stored in the hot layer, and the rest in the warm layer.

15e12 / 50 MHz is 3.5 days.

I guess 50 MHz is the peak ingest rate.

</comment></comment><comment><USER9> I don't think writing a clickbaity title like this is fair. You just write 200k large documents per second, period. Good for you but to be blatantly honest it's actually not a lot.

I'm not saying you shouldn't have written this post, but rather suggest you be fair to your readers (and yourself). Otherwise you could just make up random titles like "Writing 1 trillion log lines per second" (by storing 1,000,000 1-byte, newline-separated log lines per document).

</comment><comment><USER10> This part left me scratching my head:

> We have set "replica 0" in our indexes settings

> Now let's assume that node 3 goes down:

> As expected, all shards from node 3 are moved to node 1 and node 2

No, as there are no shards that can be moved, as number of replicas was set to zero and one node went down. Not sure what they are trying to explain here.

> In order to resolve this issue, we introduced a job which runs each day in > order to update the mapping template and create the index for the day of > tomorrow, with the right number of shards according to the number of hits > our customer received the previous day.

This is a very common use-case(eg. logging), but it's surprising that Elastic has nothing to automate this.

<comment><USER11> > This is a very common use-case(eg. logging), but it's surprising that > Elastic has nothing to automate this.

You can set an index template to be used on new indices that match a pattern, which is a very common thing to do. It sounds like what they did was modify the template daily, which is less common IME. It's not clear why they had to manually create the index, though. That should happen automatically.

<comment><USER10> > You can set an index template to be used on new indices that match a > pattern, which is a very common thing to do

It is, but how can you tell in your template you want to keep shard sizes under 50GB? You can't.

The best thing you can do (as they did) is, based on historical data, update the template, so that the new index will have shards that (hopefully) are under 50GB.

</comment></comment></comment><comment><USER12> >> Each day, during peak charge, our Elasticsearch cluster writes more than 200 000 documents per second

What is this 50M in the title?

<comment><USER13> They state each document has 250 events, 200,000 document/sec x 250 events/document = 50m events/sec.

<comment><USER14> "Each document stores 250 events in a seperate field."

Curiouser and curiouser.

</comment></comment></comment><comment><USER15> Reading this reminds me of the pains of running an ElasticSearch cluster. We just moved to Elassandra. No more red status.

<comment><USER16> Hadn't seen Elassandra before. Thanks for the tip.

</comment></comment><comment><USER17> I've seen elasticsearch clusters like this have consistency problems. Turns out it's a problem in a security setting to have an off-by-one error.</comment>


The Naked Truth About Subscription Startups: The Good, The Bad & The Scams - <AUTHOR> http://www.os-fashion.com/the-naked-truth-about-subscription-start-ups/

<comment><USER2> I like your article and you _do_ bring up some really valid points, however your portrayal of Science seems overly critical in that their subscription products don't make any sense.

You say:

 _"Their strategy has been to focus on unnecessary subscription start-ups with vanity customer acquisition proof points"_

and you talk about Dollar Shave and ELLIE as examples.

Theoretically, subscriptions for razor blades _do_ make sense because it's something you buy often. I'm not a user so I'm not qualified to speak on their product and quality, but as far as the model goes, there's nothing wrong with it and it's not unnecessary.

Subscriptions for clothes on the other hand does _not_ make sense because like you said you don't really need two pairs of workout clothes every month. However, what you failed to mention was that ELLIE is not solely a subscription based company. They do sell their products for set prices, and you can choose to not receive products on a given month and simply roll your credit over.

Note: I'm not affiliated with Science in any way; in fact, my start-up competes directly against one of theirs.</comment>