How to Improve Rails Application Performance on Heroku - <AUTHOR> http://blog.bignerdranch.com/2188-how-to-improve-rails-application-performance-on-heroku/

<comment><USER2> I used to love Heroku but it's just too darn rigid. I hate the fact that everything is done behind the velvet curtain and I'm just assured it's "going smoothly".

Last week I finally bit the bullet and bought a VPS from DigitalOcean and installed the bits and kibbles needed for Rails apps. Specifically Nginx and Passenger. Was it easy? No - but now I have total control over my machine, and my app (which let's face it, will probably never need to scale for millions of users at a time) is in my complete control.

Heroku doesn't even have a local filesystem, what's up with that?

<comment><USER3> There really is a missing link between heroku and aws where one would have more control than on heroku but less devops problems than on aws. And if done right, people would be throwing money at it. I guess that is that elasticbeanstalk and opsworks are trying to solve.

<comment><USER4> I had heard of Elastic Beanstalk but not OpsWorks. Thank you for mentioning that.

I haven't tried it, but Cloud66 is another provider in this middle ground (they don't host, but provide you the devops tools to do so on amazon, digital ocean, etc.).

<comment><USER3> I've heard of Cloud66. Is it any good?

<comment><USER4> I haven't tried it. It does look like a great service. One thing, however, that I don't think it provides is auto-scaling (i.e. provisioning additional servers or removing servers when they are (not) needed). If they were able to provide that, I think it would rule out a need for Heroku completely.

</comment></comment></comment></comment></comment><comment><USER5> Doesn't this overlook the issue of Heroku's random load balancing system?

This article seems to suggest that the number of Dyno's required for more load scales linearly with load but, as Heroku now admits, the routing is random and therefore scales much less efficiently.

I found this great simulator that someone put together to demonstrate the issue <http://ukautz.github.com/pages/routing-simulator.html>

If I'm using it correctly, in his first example using 82 dynos would actually result in requests taking over 9000ms. It takes about 150 nodes to get the average wait times down to around 600ms.

Parameters used:

      1. Nodes 82
      2. Process/Node 1
      3. Requests/second: 338 (20300/60)
      4. Duration request min/max 243
      5. Timeout 100000
      6. Time multiplier 2.00 (not exactly sure what this does)

Using multiple threads per dyno does help considerably. I guess it's equivalent to multiplying your whole dyno pool as well as having intelligent routing within the dyno itself, but problems still crop up if you have slightly inconsistent request times.

Also, one problem that seems to be overlooked is the possibility that multithreading within the dyno itself is less efficient than threading across many dynos since the threads may have to compete for resources. I can imagine that performance may drop across Heroku's platform as a whole as customers switch to threaded application servers and reduce their Dyno counts.

</comment><comment><USER6> The comment has a better point, use Blitz. I think that service is invaluable. It will push your service to the max and to a point where most applications, if seeing real traffic of that level, should be making hands over fists.

I use it to crash my own hobby playground regularly. A simple Flask app (Python) I wrote can handle ~120 req/sec before it biffs it hard (all linked back to db connections allowed on the free Heroku plan.)

</comment><comment><USER7> As someone pointed out in the comments section, Puma (<http://puma.io/>) is another alternative.

</comment><comment><USER8> tl;dr: Use New Relic and use Unicorn. Weren't these two things that the RapGenius post specifically mentioned as problematic? (Cost and memory constraints, respectively, IIRC.)

<comment><USER9> Heroku offers the Standard New Relic tier for free, so there's no reason not to use it. The pro tier has definite advantages, but isn't required to do what is being described in the article.

As for unicorn, unless your application is a real memory hog it should be possible to run 2 workers, which is a big improvement over using thin. But this is now the standard advice being given by Heroku, so there's not much new here.

</comment></comment><comment><USER10> Does anyone know how copy-on-write forking plays into the 512MB limit on Heroku?

If your app takes up 256MB, does that mean you can only fit 2 workers? Shouldn't there be some savings due to copy-on-write?

</comment><comment><USER11> Isn't it better to use percentiles for metrics like response time? Response time might not fit a normal distribution.</comment>


Using Free SSL/TLS Certificates from Let's Encrypt for Nginx - <AUTHOR> https://www.nginx.com/blog/free-certificates-lets-encrypt-and-nginx/ <comment><USER2> The official let's encrypt client is very heavy-weight. In my case I've build a much simpler thing using acmetool ([https://github.com/hlandau/acme](https://github.com/hlandau/acme)) which is mcuh simpler to use and nicely runs without root rights.

In my case, a lot of the routing of domains to customers is stored in a postgres database and a trigger fires an event anyways, so I have a little daemon that listens to these events and the fires off acmetool as needed in order go generate certificates.

I just completed this last week, so when I've seen this article here, I thought that I just wasted some time over this because now there's an integrated nginx solution, but thankfully, this is just an article about doing what I was doing using a tool that's more complicated to use and brings half of an OS installation as dependencies.

For those interested, [https://gist.github.com/pilif/1e2610dd7aa57323e0b2](https://gist.github.com/pilif/1e2610dd7aa57323e0b2) is the script in question. It's really a quick hack, but it works very well for me to auto-create nginx config files.

<comment><USER3> I'm the author of acmetool.

It's quite interesting to know that people are using the design to its full potential. Ideally, I should probably make something more library/daemon-based for these largescale, custom solutions, though of course I'd like to do it some manner of modular way that allows the existing codebase to be leveraged. For the time being only the acmeapi package within acmetool is stable and suitable for use by other libraries. Something to think about...

<comment><USER2> For me, the current interface is perfect (though I wouldn't call our usage large-scale by a long shot), though it would be even better if acmetool would indicate using the exit code whether the web server needs restarting or not after reconciliation.

I know there are the hooks and that's what I'm using now, but if I could get a distinct exit code to tell me that changes happened to the certificate store, then I could get away without needing to also keeping the hooks around.

That said, this should probably be on your github issues, not in here. That also said: This was such a small issue for me that I didn't even want to bother you - but as you're coming here to post, I guess it doesn't hurt :p

<comment><USER3> I can't use the exit code, because a nonzero exit code by UNIX convention indicates failure, which will spam people in their cron jobs. There's only one exit code which conventionally means 'success'.

I could modify acmetool to output a word 'NEEDS-RELOADING' or something, which you could grep for programmatically. But this is another option (it would have to be an option; any output from acmetool is liable to get e. mailed to people via cron) for something which can be, as you yourself admit, dealt with as well via hooks. And probably more robustly, too. So on balance, I don't think it's worth doing.

</comment></comment></comment></comment><comment><USER4> I was hoping this was an nginx module where you could specify something like `ssl_letsencrypt on;` and be done with it.

<comment><USER5> Caddy has this feature and it's amazing. [https://caddyserver.com/docs/automatic- https](https://caddyserver.com/docs/automatic-https)

<comment><USER2> _this_ is how it should work. Very nice. I can't wait for other web servers to gain this ability too. Or at least allow us to load certificates from dynamic locations based on some request data.

All other web servers I looked at (nginx, apache, lighttpd) still require at least a reload for an updated certificate and a configuration file change for a new certificate to be used.

I wonder how caddy works with the very low 5 certificates per public suffix and week limit. Does it automatically bundle domains and request a single certificate with SANs?

<comment><USER6> From what I can see, Caddy also does a reload. With Apache, you can do a Graceful restart and not lose any traffic, plus, using mod_lua you could create a relatively easy way to add this automagically.

<comment><USER2> nginx you can also reload gracefully using the same mechanism. Still. It would be cool if it wasn't needed. I mean - you don't normally restart web servers when a file in the document root changes - why would you still have to do this for changes to SSL certs.

(note: I know that these are two very different things and I know how complicated it is to get all that state correct and to properly re-initialize the SSL context - still, as certificates get more and more short-lived, this would be a cool thing to have)

<comment><USER7> FWIW, Caddy's next version will be able to update the certs without reloading at all.

</comment></comment></comment></comment></comment></comment><comment><USER8> I wrote up my own HOWTO for nginx just the other day.[https://www.uhoreg.ca/blog/20160218-1757](https://www.uhoreg.ca/blog/20160218-1757) I used the acme-tiny client instead of the official client. My post is mostly aimed at Debian-based distributions, but should be easily adaptable to others.

</comment><comment><USER9> Has anyone found a good tutorial for DNS-based verification of a Let's Encrypt certificate? It'd simplify life greatly for those of us with multi-server clusters behind an Amazon ELB or something similar.

<comment><USER10> Not a tutorial, but I was having trouble with that damn 'official' Letsencrypt client and the complexity of adding a .wellknown directory on _every_ site I needed a certificate for.

So I saw the light in the form of a bash-script [0], wrote a short hookscript, and now I can centrally manage through DNS.

There are a couple of example scripts [1], and it really simple to write your own.

[0] [https://github.com/lukas2511/letsencrypt.sh](https://github.com/lukas2511/letsencrypt.sh)

[1] [https://github.com/lukas2511/letsencrypt.sh/wiki/Examples- fo...](https://github.com/lukas2511/letsencrypt.sh/wiki/Examples-for- DNS-01-hooks)

</comment></comment><comment><USER11> Here is my Nginx config for let's encrypt on my case, feel free to criticize or copy it: [https://gist.github.com/alex- min/158f35f604b24e163ae9](https://gist.github.com/alex- min/158f35f604b24e163ae9). I've managed to get a A+ on the ssllab test so it should not be too bad I believe (but I'm not an expert so if you have some idea for improvements, I would be glad).

<comment><USER12> You should also add HPKP (leaf pinning), it insanly powerful and a challange to get right. I have not figured out why the damn ssllabs complains about it to me.

<comment><USER13> I have the same problem, if I use one of the HPKP generators (or copy-paste a 'correct' example & substitute my cert hashes) I always get the SSL Labs error. Everything else is perfect. Depending on what guide I follow, I get Nginx errors, SSL Labs errors, or other third-party test errors. Never a consensus, which is what I would expect once everything is 100% correct.

I'll have to set aside a few more hours to figure this out soon. Even good documentation like this is not working for me: [https://developer.mozilla.org/en- US/docs/Web/Security/Public...](https://developer.mozilla.org/en- US/docs/Web/Security/Public_Key_Pinning)

</comment></comment></comment><comment><USER14> How ironic. I just added https to my site and was searching for a solution to this problem. I ended up using certonly --standalone as described here and it worked like a charm: [https://www.digitalocean.com/community/tutorials/how-to- secu...](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx- with-let-s-encrypt-on-ubuntu-14-04)

<comment><USER15> I ended up still buying my certs because no solution seemed like something i should and could easily automate :/

</comment></comment><comment><USER16> I tried using the official encrypt client on my low spec VPS this weekend (cent os 6). It wouldn't install as when compiling it runs out of memory. Why so heavyweight. Luckily I found a python script which uses the acme tools stuff and that worked fine. Maybe providing binaries would be another option so I don't have to compile everything myself.

<comment><USER17> What were you compiling? The official client is written in Python.

<comment><USER16> The letscrypt auto thing.

<comment><USER18> Yeah, their documentation isn't very clear that auto actually compiles a bunch of stuff on the fly for you. I ran into the same issue as you with my low-spec VPS as well. You can either add some swap space, or run just "letsencrypt -certonly" and skip the auto junk, but it sounds like you did that with the acme client already. :) I've got an open issue on their github page to try and clarify the memory requirements for low-spec VPS..

</comment></comment></comment></comment><comment><USER19> Thanks for the article and the other discusions, especially the pointers to Caddy.

I have been using Cloudflare for https for my main site only and have been deciding whether to use Cloudflare for everything or bite the bullet and set up my own https.

<comment><USER20> You should do both.

HTTPS from user to CF HTTPS from CF to your site

</comment></comment><comment><USER21> I've made an ansible role for deploying many sites from one nginx instance with automatic issuing and renewal of let's encrypt certificates.

It would be accompanied by a blog post to explain how things work but got busy on other fronts.

If anyone's interested, it's at [https://github.com/Landoop/ansible](https://github.com/Landoop/ansible)

</comment><comment><USER22> I had to add some extra nginx config to make this work ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';</comment>


Ask HN: Should I take antidepressants? - <AUTHOR> Hello HN,
I'm 39 years old. During the past ~10 years I find very hard to find joy in the everyday life, when I'm not into a relationship with long-term potential. I'm pretty healthy, ok-looking (far from great), financially independent through my own work.
Even though logically I see a lot of reasons to be happy with my situation, emotionally I find it hard to. I've practiced CBT, I've been in psychological therapy for the past year, I like to exercise, I've even taken a 6 weeks solo trip to Asia. But, without a life partner, life hardly makes sense. And when I (seldom) find somebody I like and we start something together, I tend to cling to her as my source of happiness.
I know I should find more hobbies and get more friends (all my 3 good friends have families/children), but I find it hard to discover stuff that I like, or sustain small talk, or be energetic in interactions. I'm sometimes asking myself what's the purpose to continue living.
My therapist suggested antidepressants for the 2nd time now. I'm tempted to take the plunge.
Would you recommend anything else I could try before that? I'm open to anything.
Do you personally know people that have been helped long-term by antidepressants?
Thanks so much... <comment><USER2> > Do you personally know people that have been helped long-term by > antidepressants?

Yes, several, including myself.

As for the actual question:

> My therapist [...]. Would you recommend anything else I could try before > that?

Nothing against your therapist, but maybe get a second opinion from a medical professional specialized in this sort of thing, i.e., a psychiatrist. As opposed (or at least in addition) to, you know, random people on the Internet.

</comment><comment><USER3> I have suffered from chronic depression since I was a teenager. I have been on anti-depressants for the past decade, although I am about ready to start weaning myself off of them (under a doctor's supervision of course).

It sounds like loneliness is one of your core problems. My guess is that you have difficulty forming and maintaining personal relationships. I would give group therapy a try. It can be awkward and unnerving but it teaches to you how to be part of a community and how to interact with others in a meaningful way.

With respect to the symptoms of depression that you are experiencing, your first move should be to see your primary care physician. There are a variety of physical ailments for which depression can be a symptom. For example, hypothyroid, diabetes, vitamin D deficiency, low testosterone, sleep disorders, etc. Get some lab work done.

If you do end up deciding to take anti-depressants, make sure to continue therapy. Medicine alone won't fix your life. The goal of anti-depressants should be to make you feel well enough that you can start to fix your life. Also, if you decide to take anti-depressants quit drinking, smoking pot, or any other recreational drugs you may dabble in. They do not mix well!

Stay active. Sitting around the house is like suicide in slow motion. Go out a do things. Even if it's just running errands or taking a walk in the park you will feel much better than if you are sitting at home wondering if life is pointless. Get in shape, too. Find some activities you enjoy. Ideally, they should involve some form of "play." Whether it's basketball, surfing, snowboarding, or whatever, you need to have a way to experience being in the moment.

I also suggest reading Joseph Campbell. Start with The Power of Myth. The original PBS documentary series of the same name is available on Netflix as well.

</comment><comment><USER4> Do you exercise? I don't mean go on walks, which people consider exercise for some reason, but things like running long distances/sprinting or go to the gym and lift heavy things on a regular basis. I notice you mention climbing and a trip to Asia but specifics are not mentioned. If you do not, I would try this before trying a pharmaceutical intervention which should be left as a last ditch effort. Exercise helps massively with brain function and mood be releasing endogenous compounds that aren't released in large amounts from other activities.

<comment><USER5> Also, poor people should get more money.

<comment><USER4> I'm not sure what your comment has to do with the subject at hand, it seems to be sarcastic but poorly placed.

</comment></comment></comment><comment><USER6> Sympathies--much of that sounds familiar. Someone else mentioned SSC here. I tried some of the stuff he mentions, and one that probably helped some was tianeptine sulfate, which you can buy legally as a supplement, without a prescription. No withdrawal zaps, etc. Definitely do your homework if you're going to try this. And I'd stay away from tianeptine sodium, which sounds like it has far greater addictive potential.

As far as clinging to women, some combination of age and several really awful breakups/betrayals seemed to rid me of that.

Good luck.

</comment><comment><USER7> "But, without a life partner, life hardly makes sense."

I'm sorry you feel this way. Looks like you already know the answer and a potential fix to the root cause. As with many drugs anti depressants are temporary relief and long term can have side effects. Better to address the root issue.

</comment><comment><USER8> One question to ask is which antidepressant specifically? Not enough people ask this question on top of deciding to take antidepressants to begin with and the risk/reward profile isn't the same for all of them. I would personally steer away from the ones that have more severe side-effects or are more difficult to withdraw from until you've exhausted other options. I've personally used SSRIs (citalopram/celexa) to treat depression - I think it was slightly but not especially helpful for me. The side effects weren't too problematic, nor was coming off it. Some people actually do respond very well to antidepressants but any single antidepressant doesn't perform very well as a treatment on average.

Scott Alexander has a pretty good write up on things to try before and including antidepressants: [https://slatestarcodex.com/2014/06/16/things-that- sometimes-...](https://slatestarcodex.com/2014/06/16/things-that-sometimes- help-if-youre-depressed/). And also some background on antidepressants here: [https://slatestarcodex.com/2015/04/05/chemical- imbalance/](https://slatestarcodex.com/2015/04/05/chemical-imbalance/).

One very promising development in recent years which is missing from the above is using psychedelics for treating depression. This carries its own risks, including legal, but the risk/reward ratio based on early trials actually looks much better than for mainstream antidepressants. I intend to start microdosing soon for my own case. I'd recommend looking up Robin Carhart- Harris and/or Roland Griffiths research here if you're interested, or Michael Pollan's new book on this which I hear is good but I haven't read myself.

I have my own potentially relevant write up of a few different factors, solutions attempted and solutions to try here: [http://black-dog- running.herokuapp.com/depression-things](http://black-dog- running.herokuapp.com/depression-things) although that's more of a stream of consciousness and not very well written (and some of it is just personal and likely not interesting to others).</comment>


Rilla Alexander: Without the Doing, Dreaming is Useless - <AUTHOR> http://99u.com/videos/7268/rilla-alexander-without-the-doing-dreaming-is-useless

<comment><USER2> yeah, and without the dreaming, doing will be in vain. No purpose at all.</comment>


France to experiment with digital euro in 2020 - <AUTHOR> https://decrypt.co/12792/france-to-experiment-with-digital-euro-in-2020-report <comment><USER2> Can't believe it. And here they were bitching about Libra all this time. Typical.</comment>


Legal implications of an encounter with extraterrestrial intelligence - <AUTHOR> http://thespacereview.com/article/2770/1 <comment><USER2> Any species capable of interstellar travel would probably also be capable of harnessing enough power to reduce our entire planet to ashes on a whim. The legal implications would probably be that the concept of human law is no longer relevant if they turn out to be hostile.

Paraphrasing a comment on that site paraphrasing a line from the movie Battleship: "If aliens show up, it'll be like an atomic bomb against an anthill, and we're the ants."

<comment><USER3> Which seems like a paraphrase of a scene in Contact, on why scientists ("egghead types" in the movie) believe aliens would be friendly to us.

Ellie: "We pose no threat to them. It would like us going out of our way to destroy a few microbes on some ant hill in Africa."

Drummond: "Interesting analogy. And how guilty would we feel if we went and destroyed a few microbes on an ant hill in Africa?"

I know many find that movie cliche, but I actually loved it. One of my favorites. The book was superior, but the movie got a lot of my friends talking about science in a non-judgmental way, and as a total space nerd, that made my day.

</comment></comment><comment><USER4> > What is more, conducting life threatening or physically disabling > experiments to examine the biology of extraterrestrial captives ought to be > banned

The choice between the possible extermination of humanity and some vague concept of morality, let's just give it to the aliens because reasons? I wish there was a discussion about this with an eye toward critical thinking. There's nothing that can benefit our species from introducing even a limited number of unknown in/organic elements into our environment. The best case would be extreme militant xenophobia and an attempt at a lunar dissection at the earliest possible convenience. Maybe not even that.

<comment><USER5> Eh. thats if they are militant. what if they want to allow us to use their alien technology as long as we disband our gov, and join their alien alliance.

man ill tell you what, ill see you up there, then we can talk back about it.

<comment><USER6> Depends on how much gravitas their spaceship names have. If it's sufficiently lacking, sign me up.

</comment></comment></comment><comment><USER7> Nice write-up. The first step is to get nations to apply these principles to their interactions with each-other. (i.e. agree that torture is bad.)</comment>


Twitter Could Have Become a Protocol - <AUTHOR> http://blog.austingardnersmith.me/how-twitter-could-have-been-a-protocol/ <comment><USER3> They built it.

They had an experimental project called 'annotations' where you could attach 1k of json to each tweet, like a DIY microformat.

I got onto the beta and created a prototype twitter client which you could attach mini 'apps' to tweets based on the payload type, e.g. you could tweet out a poll, or an inviation to play a game or a job advert or whatever, and you could attach your own app as a listener.

I think it could have been pretty amazing, basically A Message Bus For Everyone. If you build this yourself, you will run into the chicken and egg position, twitter could have pulled it off as they had the eyeballs and the developers.

Unfortunately they pulled the plug on it, around the time they started to close down the ecosystem.

<comment><USER4> It's not surprising really, is being a centralized message bus really attractive when it just means that you'll be responsible for policing it?

If you run a central message bus off which people can produce their own applications, you'll find yourself having to deal with everything that ISPs and mail providers have to deal with. That means being asked to keep logs for years, dealing with DMCA takedowns, filtering the worst of the internet, etc.

And for what? As soon as anyone relying on it achieves scale they'll re- implement it themselves.

Besides, what you've described is the opposite of a protocol: an inner platform.

<comment><USER3> I disagree that anyone else could re-implement it. Once you have a critical mass of listeners, it would become the first port of call for any message you wanted to distribute.

As for policing, I think that would probably be where the money would be made - reputation/quality of the messages being posted.

<comment><USER5> Why would people pay additionally when they don't need to pay now (relative) to distribute/post messages?

<comment><USER3> Suppose twitter had become a giant json firehose, and you could listen to it and, for example, build a jobs listings website from the jobadvert microformatted tweets.

It would end up full of fake job spam, and the listeners might want quality filters. I can imagine that you might pay to validate your identity as not-a- spammer.

<comment><USER5> How would "Twitter" capture that value and not some third-party platform who and offers those filter services? The value and revenue isn't with Twitter then, so then how does Twitter pay bills? Or am I seeing this in a different light than you do?

<comment><USER6> As far as I can tell a simple freemium model would have worked. You charge for the firehose and anything high volume, but you give a generous free allowance to keep the grassroots ecosystem healthy. They could have played all the same pricing games that Facebook is now playing, except across a much wider range of channels.

I'm not saying it was a slam dunk, but a lot of talk about this back in 2007/2008 and there was a palpable excitement about Twitter apps. Within a few years the media-company mindset had taken grasp, the valuations and expectations exploded, and now we have boring old Twitter which is still a damn cool thing in its own right, but which is seen as a failure because of a combination of pedestrian vision and mismanaged expectations.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> A similar complaint came up here recently on a thread called _Next steps for Gmane_ [1], starting with _" I really miss the newsgroups that focused on just the messages, and could be consumed by any NNTP client, stored offline, searched, etc."_

Quoting a portion of a great answer [2] from HN user niftich, that feels very appropriate here:

> _" Not enough people make new running-on-TCP or running-on-UDP protocols > because new protocols are hard to design, they don't work with the one > application where everyone spends 70+% of their time (the web browser), and > they probably get blocked on a middlebox except if you use port 80 or 443 > and fake being HTTP anyway. For all but very specialized use-cases, vomiting > blobs of JSON (or if you want to feel extra good, some custom binary > serialization format like protobuf or Thrift or Cap'nProto or MessagePack) > across HTTP endpoints is pretty okay."_

[1] [https://news.ycombinator.com/item?id=12440230](https://news.ycombinator.com/item?id=12440230)

[2] [https://news.ycombinator.com/item?id=12440783](https://news.ycombinator.com/item?id=12440783)

<comment><USER8> Running over 80 and 443 using an arbitrary protocol often doesn't even work with next gen firewalls because they don't recognize the protocol as HTTP.

<comment><USER9> Curious how that would work on 443, given that the whole point of SSL is that you can't recognize the payload as...well, anything.

<comment><USER10> Payload aside, SSL is identifiable as SSL. The host name is transmitted in clear text (SNI) as well as the protocol version and cipher negotiation.

Just because the traffic is encrypted, it doesn't mean the connection type isn't identifiable.

<comment><USER9> Right, but presumably any arbitrary protocol that plans to tunnel over port 443 would use a standard SSL negotiation, standard HTTPS connection, and then send the application-level protocol as part of the encrypted payload.

My very first job (back in 2000) actually did exactly this - we tunneled arbitrary TCP/IP traffic over HTTPS. The startup died over various management & investor relations fuck-ups, but the product was working - you could do things like make a SourceSafe connection across a firewall without exposing the server to the Internet. There was some concern about whether firewalls would kill the connection if it was open for too long, but it turned out that none of them actually did this (which unfortunately we didn't figure out until we were almost out of money and had wasted several months handling this case; see again re: management fuck-ups).

<comment><USER10> That's a different point though as you're now effectively using HTTP as your transport layer rather than using your proprietary protocol "naked" on port 443. So whether you send your protocol in a proprietary binary format over HTTP or via JSON API's, it's still just HTTP over TLS. You're still sending HTTP headers, just with our own proprietary content as the body. The real problem is if you want persistent types of connections. As websockets have taught us: a great many equipment that supports HTTP don't support websockets and thus why even websites are still often stuck with RESTful APIs even when that doesn't always fit their problem quite right (that situation is improving however).

If one is using HTTP to transport your protocol (and the aforementioned websockets point isn't an issue) then your protocol should work over port 80 as well as 443. Barring any corporate / nationwide web filtering; but as others have already pointed out, that could also be an issue with 443 even with advantage of TLS.

By the way, was it Socks2HTTP you worked on? I remember that project back around the time you described and was quite fascinated by it.

<comment><USER11> > That's a different point though as you're now effectively using HTTP as your > transport layer rather than using your proprietary protocol "naked" on port > 443.

HTTPS is built on top of TLS, not the other way around. You can't (passively) tell if a 443 TLS connection is HTTPS or a proprietary stream. You can take a guess based on statistics (which is what the Chinese firewall does to detect tunneling) but that's about it.

<comment><USER10> I'm aware HTTP is built on top of TLS in HTTPS. I think what you're discussing now is a little different from the HTTPS as a transport vs bespoke protocols running "naked" over TCP/IP (unless I've badly misunderstood any of the previous posts?).

Warning: nonsensical brain dump follows:

However to address your point, you might be able to use SNI (which is sent from the client before the TLS connection is encrypted) to make some assumptions about the content. Granted this would be more in the realm of web filtering where you'd blacklist suspect domains or - in extreme cases - <USER2> terms within hostnames. I wouldn't be surprised if SNI is one of the "statistics" the Chinese firewall uses (I'm not familiar with the implementation details of the Great Firewall of China")

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> > Twitter had a chance to become a sort of de-facto API for lots of other > applications.

The problem I see is that there doesn't seem to be any way to make money from this, for Twitter.

And really if everyone started using it this way, the privacy concerns would be even greater than the concerns people have about Facebook.

<comment><USER13> Yes there is. The same way there is money to be made in providing premium content. You could pay for extra capacity, bandwidth, fault tolerance, indexing, archiving, and many other desirable properties you'd need out of your messaging layer.

Instead the convoluted strategy by the higher-ups destroyed the entire thing. They thought they could make money with ads and "promoted content" but they somehow managed to fumble the execution of that one as well.

<comment><USER14> I think this is the Medium strategy. I think there is a mid size business in it, but one that's hard to defend and will see margins erode with time.

There is absolutely no "moat" in Twitter being a protocol.

<comment><USER13> You'd be surprised what happens when you become a hub and start seeing the effects of 3rd party integrations. That aspect can be turned into a moat if managed properly.

<comment><USER14> I think you are right but there's a time and place for it. I don't think it can save Twitter at this point but could have created a healthy ecosystem if timed well.

But it's very hard to time this well. Even Facebook and their apps ecosystem didn't create enough of a moat.

<comment><USER15> Well, Facebook's "app ecosystem" was dominated by Zynga. For a long time, Farmville was the top app and it was the only app that Facebook's highest engagement users interacted with. As such, when Zynga went downhill, it took the entire ecosystem with it.

</comment></comment></comment></comment></comment></comment><comment><USER16> [http://webcache.googleusercontent.com/search?q=cache:vkzvQD4...](http://webcache.googleusercontent.com/search?q=cache:vkzvQD4TMkkJ:blog.austingardnersmith.me/how- twitter-could-have-been-a-protocol/&num=1&hl=en&gl=us&strip=1&vwsrc=0)

</comment><comment><USER17> Twitter was too busy navel gazing and pushing PR about how they had the ability to incite revolutions.

They were afraid to grow beyond tweets. In life you need to grow or die. Ten years from now, they'll be fondly remembered as the AOL Instant Messenger of the 2010s.

<comment><USER15> >>In life you need to grow or die.

Says who? Plenty of businesses reach a certain size and maintain healthy levels of profitability over the long term.

"Grow or die" only holds true if you receive venture capital.

<comment><USER17> Not just grow in terms of dollars, grow in function and purpose.

If someone knocked you on the head in 2011 and you woke up today and logged into Twitter, you'd find that little has changed.

<comment><USER18> So what?

</comment></comment></comment></comment><comment><USER19> Didn't App.net try to be more of a protocol than twitter? How's that going for them?

<comment><USER20> It worked out great for Dalton Caldwell, who failed upwards to become a YC partner.

</comment></comment><comment><USER13> Yup, and they bungled that one pretty well when they shut down the entire ecosystem. They never recovered after that. They lost all the developer goodwill and any chances of becoming a platform was vaporized at that exact instant.

</comment><comment><USER21> See reddit.com/r/rad_decentralization

All of these technopolies will eventually be superseded by protocols. It just doesn't make sense to continue to rely on monopoly companies to provide core services. That's not to say there can't be variations or companies that build on top of core protocols etc. Just more than one, and not for the most common aspects.

</comment><comment><USER14> I think the author has some good ideas about the things Twitter can leverage once it becomes the de facto method of broadcasting in the world.

However become a protocol would not have helped Twitter get there.

I think the better path is to build and then protect a captive audience. Instead Twitter saw its audience based erode away not once, but multiple times with Facebook News Feed (Twitter for news) then Instagram Video (Vine).

Twitter once had a massive captive audience and unique data. Now their competitive advantages have all disappeared. Opening up more won't help them gain an audience.

</comment><comment><USER22> This is where I think people are still missing the boat on twitter.

Twitter is not an aggregator of data to be passed along. Twitter is a massive un-walled global community. Though people may want access to the data as a bi product of that. The future is in cultivating community, not protocols.

<comment><USER23> I respectfully disagree as to your note about twitter being "un-walled". The easiest test would be: if twitter would shut down right now, and its infrastructure would go dark as a consequence, could you/our/any community on twitter continue? I believe the answer is "no", because its centralized (and proprietary). I do agree with you that cultivating communities are important...though we do need some universally accepted, open, and available protocol to allow for cultivating of communities...sort of like what legacy protocols have done - e.g. email, irc, etc.).

<comment><USER22> I see the power of twitter in its brevity not its depth. Its a content gateway.

I think legacy protocols such as email, IRC, SOAP...have proven time after time that there is no need for an information specific protocol.

Twitter could be more open, but I think they realized that would be giving away the keys to the castle.

</comment></comment></comment><comment><USER24> I think one of the more insidious problems with many of these unicorn startups is that there is no longer the fiduciary freedom to make "modest" plays like becoming a protocol.

A company with $1B in venture funding isn't allowed to aspire to being a $500M business. It must grow as big as the sun, or die trying.

<comment><USER25> I think there's an even more general disdain for commodity offerings, at least in American culture. There's probably a guy who's in the .01% of his ZIP code because the regional store brand paper towels needed some of those cardboard tubes. But "success" looks like Zuckerberg or Jobs, not like that guy.

</comment></comment><comment><USER26> V1 api was awesome and part because i started to love programming, v2 was a pain already" simply took away the simplicity and now i can not even create unlimited accounts anymore, even less use the API with those.

Twitter lost big in that regard imo

<comment><USER27> Indeed, my weather station used to sit and tweet happily all day and all night to all _four_ followers.

Then they introduced rate-limiting ( 60 per hour, when the station generated a Tweet every 48 seconds ), application validation, phone-number verification for accounts... I gave up after that and just resorted to RSS.

</comment></comment><comment><USER28> Wasn't there already Jabber or IRC? But they don't make money. Sad world where we prefer badly coded shit that makes money, to awesome tech that don't.

<comment><USER29> badly coded _fancy/shiny_ shit with a web interface ;)

Apart from the sarcasm, I'm serious on the web part, which is terrible: all around the world people are "porting" protocols to JSON+HTTP ( example: JMAP[1] ). IRC is awesome[2], but it's not GET & POST and the new kids on the block run away if it's a real protocol instead of a HTTP hack.

[1]: [http://jmap.io/](http://jmap.io/)

[2]: [https://aaronparecki.com/2015/08/29/8/why-i-live-in- irc](https://aaronparecki.com/2015/08/29/8/why-i-live-in-irc)

<comment><USER30> It's because of firewalls.

<comment><USER29> Sorry, but this is bs.

You could run any application on any port: IRC on port 80 with SSL would still run just fine.

<comment><USER31> It'll run fine, but I won't be able to connect to it from the inside of a corporate firewall, which doesn't actually grant me access to the internet, but redirects me transparently to an HTTP proxy that only permits HTTP requests to tcp/80 and tcp/443, with SSL interception on the proxy.

You can run whatever you want however you want, but that doesn't change the reality of the enterprise environment.

<comment><USER32> The thing is, you really shouldn't be using your corporate network for non- work-related things. Use your own network service for that kind of thing!

Do you _want_ your boss to see your reddit history?

<comment><USER33> Some of us don't have Reddit histories we'd be ashamed of others seeing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> I've been thinking along the same lines. I really wished there was an open protocol that provides all of twitter's functionality (and no more, to avoid scope creep).

But as much as I hate to admit it, Twitter's value is Protocol + Moderation. I'm not savvy with their operations but having worked with other cloud platforms, I know that any platform that has even a modicum of visibility is immediateley abused in many ways that are hard to forsee. Malicious attacks against the platform itsef are also an issue.

Email is a good example of open and federated platform, which unfortunately carries more abuse & noise than actual signal.

I still think building a protocol that incorporates a form of moderation is possible, but I'm not sure how to solve this.

<comment><USER35> > Email ... carries more abuse & noise than actual signal.

Really? That is not my experience at all. There was a span of years where spam got bad, early-2000's IIRC, but my email is now mostly signal and has been since since at least 2010. I think this is partially due to better spam filters, e.g., gmail was better than average when it went public in 2007ish, but also due to the rising popularity of DKIM and SPF.

I see the abuse and noise out there on twitter and in comments sections, etc. I don't see it with email. I know people with big public personalities do get hate email and whatnot, but I thought for the average person, email was kind of a solved problem.

<comment><USER34> That is indeed due to spam filters. Look at what a typical MTA gets before the filter kicks in.

But to your point, maybe the same mitigation technique can be applied.

</comment></comment></comment><comment><USER36> I was under the impression that the intention was that Twitter would be the largest message bus in the world, but management decided it would become a media platform instead. Clearly as a media platform it has failed and now it's neither.

</comment><comment><USER37> Twitter has restrictions that make perfect sense given its use, but would be really strange decisions for a protocol: ie. 140 character limit.

<comment><USER38> The 140 character limit is so that Tweets can fit in a 160 character SMS, with space left over for a username. SMS was originally a popular way to use Twitter. (And I think you still can?)

<comment><USER39> SMS is actually 140 octets, but the GSM 7-bit encoding that's typically used means you can get 160 characters. If you use characters outside that set, its switches to 16-bit UCS-2 so you are limited to 70 characters.

In reality you can send messages longer than this and they will be split into multiple messages over the wire - however in the US where you had (have?) to pay to receive messages it meant you would be charged for each individual message.

TL;DR; These limits may have made sense for the MVP, but as soon as most people moved to IP clients they were obsolete.

</comment></comment></comment><comment><USER40> Keep in mind that operating Twitter, even if you eliminated all the stuff that's there to support advertisers, requires (bare minimum) roughly 2K servers just to handle the runtime request path. Monitoring those minimally requires another ~500 servers to ingest and aggregate all the log data and metrics. This wouldn't support any analytics platform, wouldn't allow for spam identification (because you wouldn't be able to build any spam models), so if you care about that stuff you need to add another 5K servers or so for the Hadoop ecosystem.

Essentially you can't run an advertising-less Twitter under roughly 10K servers (order of magnitude accurate -- people will want to quibble over these numbers but they won't be able to push it below 5K). I may well be forgetting something important that pushes it higher!

End result: there's no way to monetize Twitter at the scale it operates at without decentralizing it. Many of you will go "yeah, of course -- it shouldn't be a centrally controlled system in the first place." That's a fine sentiment, but many problems you can solve in a straightforward (not easy, but doable) way in a centralized system immediately become much, much harder, and now you are asking ISPs and individual users to operate these resources for free.

Take spam as one example. The main "solution" to spam we use these days is to all use a system that see enough email to power machine models that identify and filter spam out before we have to deal with it. IOW, we use centralized systems. This gets paid for with advertising!

You can fractally reinvent the system or you can just have Twitter.

</comment><comment><USER41> Blaine Cook used to talk this way. Then he "left" twitter, rumors saying it was (among other reasons less interesting but dreadfully predictable) because the management didn't want to try and make twitter a hybrid of a human-to- human and machine-to-machine network.

Blaine even gave a really interesting presentation I remember watching on the subject, about how very challenging such a backplane is compared to a more simple human-human messaging network.

</comment><comment><USER42> I remember a past boss of mine said one time "it's hard to monetize protocols".

It's really the only thing he said I thought was smart, so it stuck with me.

</comment><comment><USER43> So where is the open source Twitter alternative?

<comment><USER44> There are a lot of them.

i.e. [https://www.gnu.org/software/social/](https://www.gnu.org/software/social/)

<comment><USER45> The biggest problem with creating a free software social service is that you can't just apply the old method that GNU has used historically: Just mirror the interface and you're done.

That method works fine for many different tools. But with social apps you need to be able to federate, which means you need to have a proprietary vendor who wants to help, which isn't going to happen.

I'm hoping Matrix will provide the bridging required to be able to send notifications from Diaspora to Twitter (for example). I will always be a hack though. :/

<comment><USER44> I think there's also a whole lot of other issues. The technical part is one thing, but people's feelings are a lot harder to deal with.

We, hackers, think that everything is so sexy with P2P, federation and decentralization in general, but I don't think 'normal' people share that sentiment.

People love brands, they're surrounded by them, and they feel loyalty towards them. If there's no company behind something, it just won't feel right. You won't feel that push towards a thing. The reason why people use Snapchat isn't just because it's a good tool, it's also because it's cool.

I just don't see how something like GNU Social will ever become cool, if there isn't some timely and powerful brand to push it.

<comment><USER23> Good points...tech is no longer enough...we have to have a brand as well as an attraction point; that is, some "place" where people think "the party" is happening (alternatively not a party but for example, where stuff or news happens). I think I've come to the point where - right now - we don;t need _everyone_ to adopt decentralized platforms like gnu social...But, i do feel if there is at least a non-trivial percentage of users who can choose to not be limited to interaction by way of silos, then i think that's a pretty good start. And who knows, maybe in the future, when there is enough to attract the casual users (as well as the tech is easier to setup and use), more folks will slip over to something decentralized, though still be able to interact with the/their communities.

<comment><USER44> Yes, I totally agree with this. We need to improve the tech, to the point of it being accessible and as good as the mainstream offerings.

The thing is also that we don't have any clear incentives to use P2P-services right now, because the silos aren't posing any clear threats to us as individuals. If we see something like a major data breach, or something like a "Snowden for social networks" that change the way we relate to these behemoths, we might just see users getting ready to give them up.

</comment></comment></comment></comment></comment></comment><comment><USER46> One of the things currently regarded as a serious problem for Twitter is abuse. Federation doesn't make dealing with this easier, it makes it harder - look at what happened to USENET.

</comment><comment><USER47> IRC is a protocol. Slack is where the money is at.

(Don't become an software architecture astronaut. IRC is also a terrible protocol. It was still successful)

<comment><USER48> If you feel that it could improve, contribute to the IRCv3 working group! [http://ircv3.net/](http://ircv3.net/)

<comment><USER49> Why is IRCv3 still relegating chat history to "IRC bouncers" instead of making it a feature of the protocol?

Chat history makes chat more usable, and it makes it usable at all on intermittent connections.

<comment><USER26> why would they include that? (Seriously curious)

As far as i can tell it would add no benefit but only overhead to the protocol.

<comment><USER49> Are you okay with missing messages, or do you only ever communicate with people over an always-on wired connection?

<comment><USER26> IMO thats the magic of IRC. Channels i care about i bounce, channels i do not care i dont bounce in. If messages would wait for me that would mean so much overhead for the protocol.

I like IRC because its simple. I've build a IRC out of boredom, and a bouncer because the one i used missed a feature i wanted. Please nobody take that simplicity away :/

</comment></comment></comment></comment></comment></comment><comment><USER50> I'm sorry, I was only able to read about a third of the way through. Around that point, my screen got taken over by something suggesting I subscribe to something. The experience was so jarring that I just stopped.

Please, don't do that! Besides, I'm not going to make a subscribe decision until I've read the whole thing.

</comment><comment><USER51> There was OStatus:

[https://en.wikipedia.org/wiki/OStatus](https://en.wikipedia.org/wiki/OStatus) [https://www.w3.org/community/ostatus/](https://www.w3.org/community/ostatus/)

Never went anywhere though, AFAICT

<comment><USER52> Was? GNU Social is a viable and actively developed and maintained OStatus implementation:

[https://git.gnu.io/gnu/gnu- social/commits/nightly](https://git.gnu.io/gnu/gnu-social/commits/nightly)

</comment></comment><comment><USER53> We've even seen botnets in the wild, using Twitter for their command & control.

[http://www.welivesecurity.com/2016/08/24/first-twitter- contr...](http://www.welivesecurity.com/2016/08/24/first-twitter-controlled- android-botnet-discovered/)

</comment><comment><USER54> Whenever I go to twitter, I think "I wish there were MORE robots and MORE automatically sent spam".

Also tweets from my fridge.

</comment><comment><USER55> Twitter is an infrastructure, not a protocol. Anybody can copy twitter but it's a bit more expensive to actually run it as scale. It took VC money, and a lot of it, which expects a lot of returns. There is already a "Twitter protocol", it's called RSS.

</comment><comment><USER56> The basic problem for Twitter was that they opened up their API for third parties before they had any clue about how to monetize the service. This then shifted the focus from SMS to apps and web virtually over night.

</comment><comment><USER57> It was, they called it IRC.

<comment><USER58> As far as I can tell, the biggest users of IRC in this fashion have been malware and bitcoin (I think bitcoin daemon finally removed this method of peer discovery.)

</comment></comment><comment><USER59> Well, venture capitalists typically do not invest in the hopes of building a free, open protocol for all to use. That's... not really what they're trying to accomplish.

</comment><comment><USER60> Thank the gods for small blessings.</comment>


Openbot: Turning Smartphones into Robots - <AUTHOR> https://www.openbot.org/ <comment><USER2> Similar: I recently built a fleet of telepresence robots that use smartphones to drive them: [https://github.com/dheera/robot- tethys](https://github.com/dheera/robot-tethys)

The nice thing about smartphones for robots is that they have almost everything you'd want for a robot: GPS, IMU, 2 cameras, battery, battery charging circuitry, a high-res display, touch interface. And ALL of that for $60 -- for say a used Pixel 1. You simply cannot get that amount of hardware for $60 for a RPi-based robot.

I actually wrote all the logic in an HTML5 app running on the phone, which communicates with the motors via bluetooth using the experimental HTML5 bluetooth API. I also wrote a "roslite.js" which allows for a ROS-node-like- but-async abstraction from within a single monolithic JavaScript: [https://github.com/dheera/roslite.js](https://github.com/dheera/roslite.js) This wouldn't work for more advanced robots of course, but for simple telepresence and educational robots it can work while being _much_ easier to code than an Android app.

</comment><comment><USER3> I remember my oldest son built a mobile platform with a tablet on it, so he could bother his sister at college remotely! He put his face on it, and the tablet was on a stick that could rotate as well. that was over 5 years ago. He was 15 around then. Anything particularly novel about this platform from other phone/tablet robot projects?

</comment><comment><USER4> The github repository is mostly empty of code. There is a project (empty) for Arduino firmware, and it looks like they are using an Arduino Nano as the device controller. And there's a project (empty) for Android code. I'd love to see actual code.

My questions would be 1) How is the Android device communicating with the Arduino device? My guess would be wi-fi or bluetooth. 2) What image recognition software did they use in the Android code 3) What other sensors on the Android did they actually use and how? 4) Is there any way to port this to IOS? 5) Is it generalizable to other hardware builds?

The hardware looks very simple. As a software developer I would want to know a lot more about how it works from the coding side.

<comment><USER5> It's a thing we've been doing for almost eleven years. Check out the actual Antbot product at [https://www.robots-everywhere.com](https://www.robots- everywhere.com)

</comment></comment><comment><USER6> Why is every link on the site routing via google? Does this project -- cool as it sounds at first bite -- originate from google? Funded by google?

Routing every link through google's tracking panopticon just looks... weird. Raises questions.

<comment><USER7> It seems the website was created using Google Sites[1]

[1] [https://sites.google.com/](https://sites.google.com/)

</comment></comment><comment><USER8> I hope someone will create an online shop where I can purchase the custom parts!

<comment><USER5> Hit up Robots Everywhere, we've been making these for 10 years.

[https://www.robots-everywhere.com/products/antbot-rover](https://www.robots- everywhere.com/products/antbot-rover)

</comment></comment><comment><USER5> This isn't new. The Robots Anywhere system, developed by Robots Everywhere, started doing this in 2010 and demoed at Google I/O.

[https://www.youtube.com/channel/UCwfCldqmzcFZkjjnZi_IHAw](https://www.youtube.com/channel/UCwfCldqmzcFZkjjnZi_IHAw)

Check em out!

</comment><comment><USER9> We've been making and selling these since the HTC G1.

[https://robots-everywhere.com/](https://robots-everywhere.com/)

Go on the wiki for full source code and schematics.

</comment><comment><USER10> Now if someone would just make a large lego type kit with all the robot parts, so you can plug and play and make robots using smart phones for the control unit.

Buy some wheel cubes, a couple basic cubes for a base, plug them together, plug in the cell phone via usb, go.

Instant robots everywhere. Offer arm cubes, sensor cubes, lidar cubes, all plug and play.

</comment><comment><USER11> After watching the video I wanted to build and play with this. Impressive project and the democratization of robotics is a great mission to be on.

BTW if I wanted to buy the body (I dont have a 3d printer) is there a way to do that (or could there be through some collective scheme?)

<comment><USER12> If you're asking about the 3d printed part alone, you could find some stuff on Amazon [1] for a reasonable price and hoist the smartphone with any old phone stand you might have lying around and a couple of rubber bands.

[1] [https://www.amazon.com/wheel-layer-Chassis-Encoder- Arduino/d...](https://www.amazon.com/wheel-layer-Chassis-Encoder- Arduino/dp/B06VTP8XBQ)

</comment></comment><comment><USER13> Intel-ISL (who built this) have lots of really interesting and useful AI/ML projects. It's worth looking at if you work in the field.

</comment><comment><USER14> This looks fantastic! How soon before your github has the code in there? The STL files look great.

<comment><USER9> I don't know about github but the schematics and code for ours has been up on our wiki for years now.

[https://robots-everywhere.com/re_wiki/](https://robots- everywhere.com/re_wiki/)

</comment></comment><comment><USER15> Robotics newbie here - does this work with the ROS software stack?

<comment><USER16> There is not much source code to judge this by, the android dir of the source repo [https://github.com/intel-isl/OpenBot](https://github.com/intel- isl/OpenBot) is currently empty.

But you can run ROS nodes on an android phone and maybe talk to the Arduino through a serial-to-USB port on the phone?</comment></comment>


Show HN: My latest Y Combinator application - <AUTHOR> http://thypope.posterous.com/my-latest-y-combinator-application <comment><USER2> Is this a joke?

<comment><AUTHOR> It isn't. And I'm not bitter or frustrated, either :)

<comment><USER2> With that application, you are sincerely mystified as to why you do not get a reply from YC?

<comment><AUTHOR> Absolutely not :) I was just trying to get them to think more about what they're doing. Then I thought others might want to read the thing. It's that simple.

<comment><USER2> oh ok then. cheers :)

</comment></comment></comment></comment></comment><comment><USER3> way to get their attention hah

</comment><comment><USER4> Bitter?

<comment><AUTHOR> Nope :)</comment></comment>


New Proof Solves 80-Year-Old Irrational Number Problem - <AUTHOR> https://www.scientificamerican.com/article/new-proof-solves-80-year-old-irrational-number-problem/ <comment><USER2> For those that just want the meat, this is about the Duffin-Schaeffer conjecture [0]. Here's the relevant paper:

[https://arxiv.org/abs/1907.04593](https://arxiv.org/abs/1907.04593)

For those that want a little more, the Duffin-Schaeffer conjecture is about rational approximations of real numbers. The setup is this:

Given some real number, we're concerned with its rational approximations. To this we choose some function that assigns an "acceptable error" for every possible denominator.

Thus, we want to look at the set of "acceptable approximations." A priori, we can intuit that if our errors are too strict, we might not have any---or only a handful---that meet our criteria. The Duffin-Schaeffer makes this intuition precise, giving a condition that tells us whether our set of acceptable approximations will be finite or infinite.

[0]:[https://en.wikipedia.org/wiki/Duffin- Schaeffer_conjecture](https://en.wikipedia.org/wiki/Duffin- Schaeffer_conjecture)

</comment><comment><USER3> Slightly off-topic, but for anyone who hasn't encountered them: using continued fractions ([https://en.wikipedia.org/wiki/Continued_fraction#Best_ration...](https://en.wikipedia.org/wiki/Continued_fraction#Best_rational_approximations)), you can easily get the sequence of optimal approximations - where "optimal" means "better than anything else with a smaller denominator".

(e.g. pi -> 3, 22/7, 333/106, 355/113, ...)

This paper is about a different situation (Duffin-Schaeffer), where you don't just want the minimum denominator, but instead have more structured/custom constraints for whether a approximation passes/fails, based on the denominator.

<comment><USER4> Note that that sequence of approximations of pi is not the _entire_ sequence of optimal approximations. That one requires a bit more work.

It is _a_ sequence of optimal approximations though.</comment></comment>


Novels were never the same after Henry James - <AUTHOR> https://www.irishtimes.com/culture/books/john-banville-novels-were-never-the-same-after-henry-james-1.3242726 <comment><USER2> Just a note for HN readers that the author of this piece, John Banville, is himself a writer of great power. Given the audience here I'd recommend trying 'Doctor Copernicus' or 'Kepler' to start. Historical fiction of the richest variety imaginable.

[https://en.m.wikipedia.org/wiki/Doctor_Copernicus](https://en.m.wikipedia.org/wiki/Doctor_Copernicus)

[https://en.m.wikipedia.org/wiki/Kepler_(novel)](https://en.m.wikipedia.org/wiki/Kepler_\(novel\))

</comment><comment><USER3> I wonder how the 'psychological novel' which was supposed to be invented in James' _The Portrait of a Lady_ (1880) (according to the article) is distinct from, e.g., _Crime and Punishment_ (1866) (or _Notes from Underground_ , though I guess that was a novella so it doesn't count). Is _Portrait of a Lady_ more psychologically focused, or is the way it treats the psychological content somehow different?

<comment><USER4> I was thinking the same as soon as I read the article subheading. I can certainly grant the title "Novels [especially English novels] were never the same after Henry James" but Dostoyevsky definitely "pioneered" what one would typically call 'psychological' literature.

I actually have several of Banville's (the author of this piece) own novels sitting in my backlog. A few skims confirm his work is quite interested in psychology as the novel can render it (all his work that I have is in first person), so it's not too surprising he'd focus on that aspect of James's writing.

I'd wager James's central contribution to literature was his intense craftsman's devotion and concern for the _construction_ of the novel as an aesthetic object and his firm conviction literature could be an artform and not merely the stuff of adventure tales and parables--his literary criticism and prefaces to his own works are perhaps even more important to the development of literature than his stories.

<comment><USER5> Dostoyevsky was a master of the genre but there were many others at the time, e.g. Flaubert (Madame Bovary, 1857). Plus, we can hardly stick the label pioneer/inventor of psychological novel on either James or Dostoyevsky when there are works such as Madame de La Fayette's La Princesse de Clèves (1678).

<comment><USER6> Madame Bovary immediately sprung to mind as well. I find that there are plenty of similarities regarding the psychological depiction and psychological narrative of the characters between Madame Bovary and Portrait of a Lady.

</comment></comment></comment></comment><comment><USER7> I read _Daisy Miller_ and _Portrait of a Lady_ , kind've the same book if you ask me. The ending of _Portrait_ is unsatisfying and meant to be. Does she go back to Osmond? But like _Blade Runner_ , there are two edits:

One ends with Henrietta telling Caspar (in a _Graduate_ Hollywood sort of ending)

 _"Look here, Mr. Goodwood," she said; "just you wait!" On which he looked up at her._

[http://www.bartleby.com/ebook/adobe/311.pdf](http://www.bartleby.com/ebook/adobe/311.pdf)

The other continues:

 _On which he looked up at her-but only to guess, from her face, with a revulsion, that she simply meant he was young. She stood shining at him with that cheap comfort, and it added, on the spot, thirty years to his life. She walked him away with her, however, as if she had given him now the key to patience._

[http://www.planetpublish.com/wp- content/uploads/2011/11/The_...](http://www.planetpublish.com/wp- content/uploads/2011/11/The_Portrait_of_a_Lady_NT.pdf)

Even James can't figure out what he wants.

</comment><comment><USER8> I really enjoyed Daisy Miller. It tells a story of wealthy vapid socialites having silly conflicts, and ends with a girl literally dying of "vapors" because she took a walk outside after dark.

Only later did I realize it wasn't a parody. I was horrified.

The less said about Portrait of a Lady the better.

</comment><comment><USER9> Sorry to say, but what I remember most after finishing _The Turn of the Screw_ was how utterly underwhelmed I was by the "great" Henry James.

<comment><USER10> That was the first work of his I read, and I didn't like it at all. "Horror" from the 19th century sometimes doesn't hold up too well, and the same concept's been done to death at this point, arguably more effectively. I'm not sure of the history of that conceit, but possibly _The Turn of the Screw_ is famous more for its novelty than for being particularly good _per se_.

I kept reading him, though, and loved _Washington Square_. Hated _Daisy Miller_. _The Aspern Papers_ was fun if not really very good. I'd started reading _The Liar_ and it was very promising, but one of my kids ruined my copy before I finished and I haven't gone back to it yet.

TL;DR give him another try, TTotS isn't his best stuff, and his quality's kinda all over the place.

<comment><USER9> I greatly enjoyed Poe, Hawthorne, and Mary Shelley, so I don't accept that 19th century horror doesn't "hold up" too well, but you've convinced me to give him another try. I will put _Washington Square_ on my reading list.

<comment><USER10> "sometimes doesn't". I gave myself wiggle room precisely for the few standouts.

My experience of _Frankenstein_ , though (if that's what you're talking about with Shelley) was that it was almost (almost!) entirely ineffective as horror, and is held up mainly by a couple of _really_ good chapters that basically lacked anything horrific or frightening. If I'd approached the book without preconceptions I'd not have been likely to firmly categorize it as horror, I think. It's more like a Greek tragedy with a shifted setting (which is more than hinted at in the full title) and even the other members of that category that contain monsters aren't usually considered horror. I'd probably have placed Frankenstein outside of horror, as more of a Greek-mythology throwback tale, had I lacked the existing bias of "Frankenstein is a horror-genre thing".

<comment><USER11> Your expectations of Frankenstein are largely due to Hollywood's interpretation. Frankentstein is referred to as the work which gave birth to Science Fiction. Not bad for a story that was more-or-less fleshed out over a weekend.

I think you're pretty spot on and fair to the book though. If you're reading Frankenstein and you're expecting a thrilling horror novel then you may be disappointed. If you're interested in the ethical questions raised by the creature being created, abandoned, and left to deal with it's strife over having no companion... then I think it's a pretty great read.</comment></comment></comment></comment></comment>


Chrome Extension to open Hacker News Links in New Tab - <AUTHOR> http://akhil.me/2012/hacker-news-chrome-extension

<comment><USER2> Maybe this is a stupid comment, but I always use my middle-mouse button (wheel) which opens a link in a new tab. Why wouldn't that be the solution, instead of an extension?

<comment><AUTHOR> Even i used to use mouse wheel but it is primarily meant for those who still use Ctrl/Cmd + Click to open in a new tab

</comment></comment><comment><USER3> Suggestion: Only apply to external links, the "More" link is annoying when it opens in a new tab. Otherwise - Good Job.

<comment><AUTHOR> Hi Jake, I noticed that too. Will fix that shortly. Thanks for reporting</comment></comment>


Ask HN: Non-circumvention clauses and distribution agreements - <AUTHOR>

I've been approached by a vendor who wants to negotiate a distribution agreement for a piece of software and associated SaaS services. They claim to have a number of identified customers, etc.
They're asking for (1) a non-circumvention clause, and (2) a geographically exclusive distributor agreement.
I have to admit that I'd never even heard of a non-circumvention clause before this. I've been around the block for a while, and these just do not seem to be common in software or SaaS industries. Even NDAs have gone somewhat out of fashion in many cases, but I'd not even encountered this beast. Perhaps if I'd been in sales or marketing instead of corporate dev and engineering I would have seen them.
The second part I consider problematic just about to the point of being a show stopper. It frankly does not seem to make much sense. Geography for software and Internet services is kind of hard to even pin down. In many cases you don't even know for certain where your users are, etc. It might make sense for a hardware or other physical goods company but I just don't get it here.
I'm curious about whether anyone else has ever encountered such a thing before, and when/if it would ever make any sense. Or is this bizarre to "run away!" levels?
Apologies for the vagueness, but I can't disclose exact details or participants. <comment><USER2> With so little detail that you feel willing to share, how reliable can any answer that appears here be? Either trust your gut or shell out for a lawyer to educate you on it. Trying to validate your feelings here is going to be a fruitless endeavor.

I don't know about the non-circumvention clause; it sounds like a non-compete which is banned/unenforceable in some jurisdictions but it also sounds like you're in a potential supplier rather than employee relationship here, so labor law considerations don't apply. Geographic exclusivity doesn't sound odd to me at all, and if you don't get the concept then it may be worth your while to take a course in basic business law or buy a book on the subject to get a feel for why it matters and why it would make sense; a distributor who wants rights to particular territory is telling you that that's the scope within which they're able to carry on business effectively, and that they don't want to be liable for problems that might arise when dealing with customers from outside that territory.

 _In many cases you don 't even know for certain where your users are, etc._

You will if you give one of them occasion to sue you and you find yourself summoned to go to their jurisdiction. If this concept is foreign to you, then you definitely need to learn more about it. Here's a book that would give you a cheap-but-decent introduction to business law: [http://www.amazon.com/Business-Law- Barrons/dp/0764142402](http://www.amazon.com/Business-Law- Barrons/dp/0764142402)

You should definitely get legal advice; don't make the mistake of thinking that your common sense and skill at logic outweigh centuries of established inter-business legal practice, even though some of the conventions may be counter-intuitive or seem anachronistic.

<comment><AUTHOR> I am getting legal advice, and have asked a few others. Just thought I'd ask here too.

Seems like your advice boils down to 'don't assume it's wrong just because it might seem anachronistic.'

</comment></comment><comment><USER3> Ask for references who have been successful with similar terms. Then you will have a better idea what the arrangement might offer in your situation.</comment>


How to ace your next job interview - <AUTHOR> https://www.timetowalkyourtalk.com/want-to-ace-your-next-job-interview <comment> FLUX-YOU If you get anxious in interviews, don't read this article. Consciously thinking about your body language (and you will if you aren't practiced at it) will hinder you from having a good conversation.

Body language is not a criteria that interviewers should seriously be looking at unless you are hiring someone that will be representing the company publicly or it's a high-level position: PR, executives, marketing, etc.

</comment><comment><USER3> We seem to have a lot of unhelpfully rude comments about TFA, and why it doesn't apply to or help in their specific situations.

Everyone (for large values of most people) thinks that they are normal, and that everyone they interact with has a comparable, rational evaluation mechanism.

Disabusing this notion - and providing some simple ideas to consider when interacting with people who don't know you, but from whom you seek favour - <USER2> one of the more useful aspects of articles like this.

</comment><comment><USER4> My phone screen interviewer asked me this week to implement exponentiation function without using multiplication or addition.

How do i prepare for that :\ ?

<comment><USER5> IMHO if it's for a senior engineer position, you should at least be able to explain how that would be implemented (bitwise operations) even if you wouldn't get it right in a whiteboard.

<comment><USER6> Could you explain it to us? Thx.

I know how bitwise operators works and have a CS degree... But even with googling I couldn't find a straight forward way to implement a general exponential operator using only bit operations.

<comment><USER7> You need some cleverness to code an add(x, y) method with only bitwise operators.

Then, you need to code a multiply(x, y) method using some more bit shifting cleverness and your new add method.

Then, do repeated squaring using your new multiply method.

<comment><USER8> Sure, but that's not a very satisfying answer because it doesn't rely on any special insight about how exponention works. It would be better to just ask someone to code up addition and/or multiplication using bitwise operations if that's what you want to test. That's sort of a reasonable question in the case of addition. Asking someone to implement multiplication using bitwise operations in a phone interview would be pretty crazy, though.

</comment></comment></comment></comment></comment><comment><USER9> The stock images are just distracting and makes me not to take the points mentioned seriously.

<comment><USER10> The text isn't a great deal more helpful

</comment></comment><comment><USER11> As 90% of recruiters I meet start with asking for a required salary (and 40% of them end on that question) just say that you will work for free :)</comment>


Show HN: First startup – A matching game based on your interests and location - <AUTHOR> HN is the best for honest feedback, help me improve my product!
It's not failure, it's only feedback, thanks hackers.
http://gameofchat.com <comment><USER2> While the idea might be interesting to some, you need a lot of work on messaging and UI.

personally I won't ever use it because fuck real time video if I don't even know you. Even though some people are into it, I definitely prefer the flow of text messaging for online interactions.

-That being said (I'm not your target audience, so what?) you should definitely remove the 0 users online, bit. drop that until you have consistently at least 1000+ people online at any given time.

-The colors have to go,

-the "have fun... redirecting you" has to go (surprisingly that was pretty creepy),

-facebook only sign in, meh whatever. I won't use it if its facebook only but again, you shouldn't care about that.

-no ssl? and you want my personal info? fix that asap.

-your call to action is the same color as the rest of your page, you barely see it.

-I have NO idea wtf is happening at 19h-23h eastern time.

-and finally, ditch the WSOP bracelet, why would that be relevant to a dating site?

Go look at tinder, match, eharmony and any other site's home page and see what they are doing. Look at their call to actions, look at what they do to draw you in, etc. And of course, good luck!

</comment><comment> k-mcgrady Remove the 'online users: n' feature. It says '0' and if it says that, I have no interest in using the product as there is no one else there to chat with. i.e. you have the chicken and the egg problem and you're advertising that making it worse.

</comment><comment><USER3> I clicked chat now and it said login with Facebook...that's when I decided to nope out. It also feels like it has conflicting purpose: to make new friends, and for dating. I understand these aren't mutually exclusive.

Anyway, just my $0.02

</comment><comment><USER4> The design is throwing me off a little. It looks like a 2005 website trying to look like 2016.

Just my personal opinion of course, but these seem more modern for example. They're also built with Bootstrap. [https://colorlib.com/wp/best-bootstrap- wordpress-themes/](https://colorlib.com/wp/best-bootstrap-wordpress-themes/)

[http://dribbble.com](http://dribbble.com) also has some nice examples.

Good job though, keep it going!

</comment><comment><USER5> Based only on the landing page: you need people for your service to work, but at the beginning you don't have any, of course. Your launch may be difficult. To create a first community, my 2 cents advice is that you should focus on a more precise type of users (precise in location and in interests) so that you can bootstrap progressively.

And what says it's not going to be a "chatroulette" with people showing their genitals?

</comment><comment><USER6> I think since it's a chat with strangers it should be more aimed toward anonymity and not require to login with Facebook.

</comment><comment><USER7> It would be nice if there was information about what is allowed, what isn't, how you'll handle inappropriate or abusive situations, etc.

</comment><comment><USER8> From reading the landing page I don't really get how it works, is it like Tinder but with videos? If I open the app will it start broadcasting? Is it just with pre-recorded videos instead of pictures?

So you can't really do it anywhere casually like swiping through Tinder because you need to be somewhere where you'll be able to talk?

</comment><comment><USER7> The video isn't working when I try to view it so without it, there's not enough messaging and information to help me understand exactly what I should expect out of your product. Is it a dating site? It is a chat roulette knock off? I don't really know.

</comment><comment><USER9> I think it would be good to display immediately what the purpose of the site is. I have to scroll down to even be able to figure out that it is about chatting/meeting people.

</comment><comment><USER10> Get a good designer !

</comment><comment><USER11> I'm honestly getting triggered by the same, generic, upbeat music in every new product video. Is there research showing it attracts more users?

</comment><comment><USER12> "Chat Now" should be your only CTA

<comment><USER13> Second that!</comment></comment>


Anatomy of a hack: even your 'complicated' password is easy to crack - <AUTHOR> http://www.wired.co.uk/news/archive/2013-05/28/password-cracking/viewall <comment><USER2> First published in Ars Technica:

[http://arstechnica.com/security/2013/05/how-crackers-make- mi...](http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat- out-of-your-passwords/)

and discussed here:

[https://news.ycombinator.com/item?id=5777719](https://news.ycombinator.com/item?id=5777719)

The main point to remember was that the story is to expose the tactics and thinking process of attackers, not to be a perfect representation of true life. They deliberately relaxed some constraints (giving attackers unsalted MD5s, for example) but gave a fixed deadline to impose pressure.

<comment><USER3> They used GPU crackers, not rainbow tables. Salting would not have made a difference.

<comment><USER4> Actually, salting makes a HUGE difference, even without rainbow tables.

Salting does nothing to the difficulty of cracking any individual password, but it makes you crack each person's password INDIVIDUALLY. So you have to crack 123456 + %randomString1%, 123456 + %randomString2%, etc instead of cracking 123456 once for all of the entries on the list. So if it's a list of 1,000,000 password hashes + salt, that will be ~1,000,000 times harder to crack all of them than a simple unsalted list.

<comment><USER3> You don't understand how GPU crackers work, or, for that matter, how Alec Muffet's "Crack" works, from the early 1990s, the original password cracker that everyone used to use to work on Unix password files. Suffice it to say: no, salting does not make a huge difference.

<comment><USER4> Ok, I may be confused. I thought that with an unsalted list, you could try a password (generated by your algorithm of choice, whether that be dictionary based or brute force) and compare it to the entire list of hashes, because Alice's "123456" would hash to the same thing as Bob's "123456". But if the list was salted, Alice and Bob would have different stored hashes - and so you would not be able to parallelise cracking across users.

Yes, if you only want to crack Alice's password, the salt will not slow you down. But if your goal is to crack a million, wouldn't the salt slow you down?

If I'm missing something, I would really like to know. Always good to learn something new!

<comment><USER5> Read the Ars Technica article.

The hole in your logic is: there is no point in guarding against the case where, if two users share the same password, cracking one will crack the other, because the only time that two users share a password is when that password is really weak.

What are the odds that two users share the same password? If passwords were totally random and 24 characters long the answer would be "pretty low". And the odds of cracking one of these passwords by brute force would also be pretty low. If only we lived in that world.

In the real world the odds of two users sharing a password are frighteningly high, but that's because most passwords are awful: they are things like "pizzapizza" or even "password". The cracking programs can crack one of these in a millisecond, because they are equipped with lists of thousands of real- world weak passwords harvested from real websites. And then, if another user shares this awful weak password, that user will also get cracked, a few milliseconds later. There is no point in "parallelising cracking across users" because it's so easy to just guess all the weak passwords for every user.

Another way to think about it: A salt could only help in cases where (a) two users share the same password, but (b) that password doesn't appear in the list of several million other real-world passwords that is built into the password cracker. And that just isn't worth worrying about.

<comment><USER6> But if there is a database of 1,000 unsalted password hashes with no people having the same password. Your password cracking regime does 1 trillion guesses. So you hash each guess then try it against each of the 1,000 password hashes. That is a total of 1 trillion hash operations.

But if the database has individually salted hashes then you need to do each hash operation individually for each user. That means you have to do 1 quadrillion hashes. That will take 1,000 times longer.

<comment><USER5> A factor of 1000 isn't that important.

Really. First, stare at this chart from the Ars Technica article:

[http://cdn.arstechnica.net/wp- content/uploads/2012/08/expone...](http://cdn.arstechnica.net/wp- content/uploads/2012/08/exponential-wall2.png)

This graph shows, roughly, that a short password can be brute forced in seconds using modern hardware. If it is just one character longer, it suddenly takes a week to brute-force. This is the miracle of exponential functions.

Now multiply the y axis by 1000. The long password now takes 1000 weeks. But the shorter one still only takes a few thousand seconds. If you are running your cracking program for a day, you'll get the same results you got before. The weak passwords are still weak enough to crack. The strong ones are still strong.

(Note, by the way, that it doesn't take 1000 times longer to guess 1000 salted passwords, because some of those passwords are super weak and will fall in seconds, after which one no longer needs to guess them. So, for example, once half the passwords have been broken, the new multiple is only 500. The Ars article explains this, but I didn't understand its wording at first.)

It is true that salt makes some difference. But it is not a meaningful difference. The difference between giving up 60% of your passwords and giving up 73% of your passwords is probably moot.

EDIT: And my example number of 73% is too low! That is bad news for MD5! Again, the article: they cracked 82% of a 16k-password file _in one hour_ using only a single commodity GPU.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Moral of the story? Just use a password manager for your accounts if your biggest threat vector is someone getting a hold of hashes on a compromised server. You can make them as long and random as you like. And unless a major breakthrough in crypto occurs the attacker can waste eons trying to break it. Of course, securing the key to the password manager becomes that much more important. But if compromised hashes are your biggest concern, Ars rightly notes that password managers are by and large the best solution.

<comment><USER8> Yes, I agree that using a password manager that auto-generates random password is the way to go for protecting against the attack of a compromised hashed password database table.

Here is the thing I'm wondering though: in the case when brute force attacks is not practical, is using human generated password/passphrases really that bad when compared against randomly generated password? Most decent and important sites would throttle the number login attempts one can try before at least throwing up a captcha or outright blocking.

This implies, to me at least, that in such a scenario using something like 12 character human generated password would give about the same effective security as a longer randomly generated one (e.g. 24 character random password). Yes, the randomly generated password is objectively better from a theoretical standpoint but I am thinking the effective difference in reality is negligible in the case when a brute force attack is infeasible (due to throttling of attempts). Thoughts?

<comment><USER9> > Most decent and important sites would throttle the number login attempts one > can try before at least throwing up a captcha or outright blocking.

The types of attacks discussed in the article are not feasible when the only way to try a guess is to send an HTTP request. Look at how many guesses per second those GPUs are doing. You won't get anywhere near that sending HTTP requests.

Passwords are far, far more likely to be cracked if the database of hashed passwords is compromised. That's what you should really be worried about, and it's the main reason to use strong passwords.

Also be sure not to reuse passwords, even strong ones. A strong password can still be compromised, because there are many types of attacks that have nothing to do with cracking hashes.

</comment></comment></comment><comment><USER10> In case anyone hasn't already seen it: [http://codahale.com/how-to-safely- store-a-password/](http://codahale.com/how-to-safely-store-a-password/)

tl;dr

Use bcrypt.

<comment><USER11> In case anyone hasn't already seen it: [http://www.tarsnap.com/scrypt/scrypt.pdf](http://www.tarsnap.com/scrypt/scrypt.pdf)

tl;dr

Use scrypt.

<comment><USER12> Or even better dont't even store them at all.

If its an internal app use LDAP, Active Directory, or whatever other centralized ID system your company has. If it's a public app then consider using a federated approach like OpenID. It doesn't make sense for everything but if you can avoid storing passwords entirely then it's one less thing that can go wrong[1].

Course if you do store them then yes:

scrypt > bcrypt > PBKDF2 > ... If you get to here then you've got a problem!

Just make sure you choose a same number of rounds. PBDKF2 is fine for most folks _if_ you have a large enough number of rounds. The old recommended default of 1K is not large enough. Ditto for bcrypt with a work factor less than 10 (or better yet 12). Your bet bet is to either use scrypt (who's defaults are paranoid enough) or choose a work factor for bcrypt/PBKDF2 that's has a decent CPU time (say .5 to 1s).

[1]: Though you do have to worry about the risk of compromise of the party your delegating too. For apps where this makes sense (say Google+ login to a Grouppn knockoff) that's a fair enough trade off for you an your users.

<comment><USER8> Not sure why you're downvoted, but the idea of actually not storing passwords seemed intriguing to me, if it was actually possible.

I did a little bit of research and I found the Secure Remote Password protocol [1]. Interestingly, this protocol does appear to protect against the case of a stolen password database. If true, that would mean that when site X loses control of the password database, that would be OK as this is designed to be secure against that attack.

I wonder why it's not been implemented anywhere widely. Anyone more knowledgeable about the security field care to comment.

[1] - [http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol](http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol)

<comment><USER12> Yeah I'm not sure either about the down vote. By not storing passwords I meant delegating to an external authority for authentication services. Whether that's OpenID, Persona, Facebook login, direct OAuth integration with a limited number of parties (ex: GitHub and Google Plus) can be decided on a per app basis. The important thing is the _if_ your app use case allows you to delegate out authentication to an external party (again it's a non-trivial "if" to decide this) then you don't have to store or deal with passwords at all (and by extension don't need to worry about handling password DB leaks or hashing algos).

</comment></comment></comment></comment></comment><comment><USER13> LastPass has a secure password generator that lets you specify character set, length, etc. It has extensions for all major browsers, support for two factor auth, form fillers, one time passwords, great iOS and Android apps.

[http://www.lastpass.com](http://www.lastpass.com)

Big fan here. Just thought I'd throw in a little discussion from the user side of things, as I see some great points about being a responsible maker.

</comment><comment><USER14> The threats to passwords are generally two-fold: 1) SQLi leaking the contents of your database to the public. 2) Malicious insiders with access.

Blocking SQLi should be every web developer's first priority, not debating the efficacy of password hash algorithms, salting, and so forth.

Preventing malicious insiders is more complicated and requires other defenses besides the underlying choice of password algorithm.

scrypt, bcrypt, pbdkf are all fine in preventing the ill effects of #1 as it pertains to passwords, but prevent #1 at all costs nonetheless. Not only are your password hashes at risk, but your entire serving infrastructure and everything you consider sacred behind your firewall. Game over.

</comment><comment><USER15> > "On the corporate side, its so different," radix said. "When I'm doing a > password audit for a firm to make sure password policies are properly > enforced, it's madness. You could go three days finding absolutely nothing."

I don't see how this could be true. Most of the harder ones that were exposed would pass corporate requirements - typical corp thing is like 12 digits and all 4 character classes, and the article included a few of those.

<comment><USER16> +1: I thought the same thing... Maybe the problem would be finding the entry to a "rabbit hole" (as he puts it). If there are no weak passwords it might be more difficult to find the patterns in use... but then again, the patterns from other corporations would still help.

</comment></comment><comment><USER17> Maybe the real takeaway from this article is that password strength meters should do a better job, not only assessing raw password complexity, but also comparing the proposed password to lists of common passwords, etc.

<comment><USER16> Or that password strength meters can't do a good job.

</comment></comment><comment> cupcake-unicorn I wouldn't assume most readers of HN would be using these kinds of passwords for anything important, no?

I've been using SuperGenPass with one of the XKCD 4 random word style passwords for years and it works great. I don't store it anywhere, just type it in to the bookmarklet.</comment>


Accelerated Wound Healing from Wearable Electric Field Generator - <AUTHOR> https://pubs.acs.org/stoken/presspac/presspac/full/10.1021/acsnano.8b07038 <comment><USER2> Surprised this has no comments.

Amazing stuff, hope they can make it production worthy. The gold usage in most nano applications is negligible, the copper film might add up though.

</comment><comment><USER3> Somehow I feel sorry for the little rat.

<comment><AUTHOR> I really wish there was an alternative to testing on rats. They're so regularly put through so many terrible experiments. Hopefully we'll have more sophisticated computer models in the next few decades to reduce the need for animal trials.</comment></comment>


How tiny commuting app Transit is beating Google Maps - <AUTHOR> http://venturebeat.com/2013/06/05/how-tiny-commuting-app-transit-is-beating-google-maps-in-canada/

<comment><USER2> Buried the lead: "Transit integrates tightly with local cities that offer real-time data from GPS-enabled trains and buses. That integration is now easy, but the legal work sometimes is not. And the legal challenges that some cities have had with Google have opened doors for Transit. In one case — I cannot reveal the name, but it is a top-five global city in terms of population — the city has broken off negotiations with Google and approached Transit for an exclusive." (paragraph 12)

<comment><USER3> Its been a while since I looked at this but Google used to encourage cities to publish this data publicly in a structured form. If that's still the case then the "legal" issue is that the city are more interested in royalty income than efficient use of public transport. The use of the word "exclusive" supports this hypothesis.

</comment></comment><comment><USER4> Post title: "How tiny commuting app Transit is beating Google Maps"

From the article: "Ultimately, Vermette knows, a tiny commuter's app that focuses on buses and trains is not going to beat the massive, well-funded, and multifunction Google Maps — in downloads, users, and time spent in app."

???

<comment><USER5> That's right. Sounds like hype.

</comment></comment><comment><USER6> "which provides real-time bus and train schedules in just 37 global cities" yeah, sure, global it is! Dont they teach the meaning of the word global in the US elementary schools anymore?

<comment><USER7> Yeah, like this other paragraph about a future announcement, one of the top 5 cities by population: they are all asian. Is it Tokyo? Only one of these that publishes GPS data for its transit system. Or is it "global" = US?

<comment><USER8> Given Tokyo's huge number of independent transit operators, there's no real authority to grant any "exclusives."

By the same token, getting real-time info out of all of these operators would seem a huge task...

But given the nature of Tokyo transport, it's hardly necessary in most cases anyway—everything runs extremely frequently, and pretty much exactly on time (so scheduled times are usually all you need), and the system's emphasis on rail over buses means that variability due to traffic conditions is rarely a concern.

<comment><USER9> That's good to know for when we launch Tokyo, thank you.

</comment></comment></comment></comment><comment><USER10> "And it never helps to get a boost from partner."

<comment><USER9> Nice typo right?</comment></comment>


Airbnb Said Close to Hiring Blackstone's Tosi for CFO Role - <AUTHOR> http://www.bloomberg.com/news/articles/2015-07-23/airbnb-said-close-to-hiring-blackstone-s-tosi-as-finance-chief

<comment><AUTHOR> This just screams "prepping for an IPO"

1) hiring someone as your CFO that wall street loves.

2) From the article:

> The firm paid Tosi $15 million last year in salary, bonus, stock awards and > a cut of profits, according to Blackstone's annual report. He also holds > partnership units that gave him $1.4 million in dividends.

So if this rumor is true, Tosi is walking away from a lot of money. I've got to assume its because he's got a chance to make a lot of money in the next year or two because I doubt he'd do this because he loves using Airbnb.

3) He is rumored to have turned down the CFO job at Apple a few years back. If he's heading to Silicon valley now, I find it hard to believe that its to be the CFO of a private company</comment>