The secret life of NaN - <AUTHOR> https://anniecherkaev.com/the-secret-life-of-nan <comment><USER2> Javascript doesn't have the same richness of NaN as other language specs, FWIW. [0]

> the 9007199254740990 (that is, 253-2) distinct "Not-a-Number" values of the > IEEE Standard are represented in ECMAScript as a single special NaN value. > (Note that the NaN value is produced by the program expression NaN.) In some > implementations, external code might be able to detect a difference between > various Not-a-Number values, but such behaviour is implementation-dependent; > to ECMAScript code, all NaN values are indistinguishable from each other.

> The bit pattern that might be observed in an ArrayBuffer (see 24.1) or a > SharedArrayBuffer (see 24.2) after a Number value has been stored into it is > not necessarily the same as the internal representation of that Number value > used by the ECMAScript implementation.

[0] [https://www.ecma- international.org/ecma-262/8.0/index.html#s...](https://www.ecma- international.org/ecma-262/8.0/index.html#sec-ecmascript-language-types- number-type)

<comment><USER3> Could this be used to hide data in Javascript programs?

<comment><USER4> As per TFA, some implementations use NaN-boxing to represent other values (all values are encoded into NaN). In those implementations, you will have pretty strange behaviour. V8 doesn't use NaN-boxing so it will work there.

Of course NaN-boxing is the reason that the ECMA spec specifies that all NaNs are treated equally. If you are encoding all of your values in NaN, you still have to have one NaN value that is _actually_ NaN. The spec doesn't specify which one that must be.

BTW, I highly recommend reading TFA and the links within, because it's really fascinating (the "tagged-pointers" used in V8 and other languages like Guile are also really interesting).

</comment></comment></comment><comment><USER5> Careful, some engines deal w/ NaN bits differently. E.g. the JVM doesn't guarantee non-NaN bits won't move (I had trouble with this at one point [0]). For specs like WebAssembly (and their conformance tests), they expect the backends preserve the bits during some reinterpret ops[1] IIRC.

0 - [https://stackoverflow.com/questions/43129365/javas-math- rint...](https://stackoverflow.com/questions/43129365/javas-math-rint-not- behaving-as-expected-when-using-nan) 1 - [http://webassembly.org/docs/rationale/#nan-bit-pattern- nonde...](http://webassembly.org/docs/rationale/#nan-bit-pattern- nondeterminism)

</comment><comment><USER6> > the double-precision format has 52 bits for the mantissa, which means there > are 51 bits available for the payload.

I have seen data passed through the NaN payload in C in a signal processing application. It was both vile and genius at the same time. Vile because of how hackish it was, genius because it avoided a larger redesign of the application.

<comment><USER7> First thought I had when reading about this is that the unused bits would be perfect for potentially reporting a cause of the NaN. A bit hackish, sure, but potentially useful, especially in C where you don't have exceptions that can carry human readable explanations of what wrong to arrive at a NaN.

</comment></comment><comment><USER8> Incidentally, I found a cool way of checking whether NaN occurred:

Just do:

void some_function(float number) { if(number != number) number was passed in as <NaN> }

Took me a little bit to get my head around it but if the number is not equal to the number, then a problem occurred. I used this to stop camera code (driven by floats) from crashing when receiving non-sense input coordinates. It still doesn't work properly, but it doesn't crash now either! (at least not for that :)

<comment><USER9> I thought JavaScript has isNaN function

<comment><USER10> That's not JavaScript.

<comment><USER11> JavaScript does have isNaN() function: [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Global_Objects/isNaN)

<comment><USER12> Better to use Number.isNaN(): [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Global_Objects/Number/isNaN)

</comment></comment></comment></comment></comment><comment><USER13> The x86_64 address-space size is currently 49 bits. There are two 48-bit halves. It could get bigger eventually. So NaN-coding (or Nan boxing, or whatever you want to call it), is risky.

I remember Solaris had a problem because it would put anonymous mmap()s in one 48-bit range and the heap and stacks in the other range, and this broke some ECMAScript implementation that used NaN-coding with the assumption that all data would be in the top 48-bit address space.

<comment><USER14> No, there are two 47-bit halves. (But see my other comment about 57-bit address space.)

<comment><USER13> Ay, sry.

</comment></comment></comment><comment><USER15> This is timely. There's some problem/difference between RISC-V and other IEEE implementations around propagating NaNs. It causes issues with numpy and R.

[https://groups.google.com/a/groups.riscv.org/forum/#!topic/i...](https://groups.google.com/a/groups.riscv.org/forum/#!topic/isa- dev/O7GOQmq80Dc)

</comment><comment><USER16> "for instance, the C standard defines and requires the SIGFPE signal to represent floating point computational exceptions.".

The C standard does not define and/or require this. What you link and refer to is the POSIX standard.

<comment><USER17> Not quite -- the C standard does define SIGFPE, and sort of requires it. C99 says "C does require that SIGFPE be the signal corresponding to arithmetic exceptions, if there is any signal raised for them." See clause 7.14 ("Signal handling") and H.3.1.2 ("Traps").

</comment></comment><comment><USER18> > Double precision NaNs come with a payload of 51 bits which can be used for > whatever you want — one especially fun hack is using the payload to > represent all other non-floating point values and their types at runtime in > dynamically typed languages.

That is _genius_! It'd be a little weird using a system where the most positive fixnum is 51 bits, but it wouldn't be _terrible_ — and of course that's why bignums exist. And 50 or 49 bits are certainly more than large enough for realistic RAM sizes for quite awhile — the latter is roughly half a petabyte.

It seems from the article that it's a pretty common technique; I'm surprised that I've not heard of it before.

</comment><comment><USER19> NaN is one of the reasons IEEE floating point numbers don't have a fully defined order.

<comment><USER7> Sort of like ANSI NULL in databases. They're purposefully not supposed to equate (or not equate) to anything, even theirselves.

</comment></comment><comment><USER20> A little "fun" fact about NaN: they are never equal to each other, even if it's the exact same value and variable.

How can you check if a variable is NaN then? Well, if it's not equal to itself then it must be NaN!

</comment><comment><USER14> > 48 bit pointers (the current x86-64 pointer bit-width)

For completeness: Linux supports 57-bit address space on x86-64: [https://lwn.net/Articles/117749/](https://lwn.net/Articles/117749/)

I don't know if there's any real hardware that supports this, though.

<comment><USER14> Oops, wrong link. I meant this: [https://lwn.net/Articles/717293/](https://lwn.net/Articles/717293/)

</comment></comment><comment><USER21> My first encounter with Javascript: Not a Number is a Number.

In my youth, I spent days wondering how in the world numbers in animation scripts are not "NaN" strings the moment something causes zero division, but are still numbers called NaN.

<comment><USER22> Can arithmetic be applyied to NaN a la i? (e.g. 5 + 2 * NaN = 5 + 2NaN)

<comment><USER23> NaN is sort of viral. Any math operator (afaik) returns NaN if any of the operands is NaN. That means `5 + (2 * NaN)` becomes `5 + NaN`, which just becomes `NaN`.

Still, `5 + 2 * NaN == 5 + 2 * NaN` would return false, because it becomes `NaN == NaN`, and NaN is not equal to NaN.

<comment><USER24> what about 0 * instead of 2 * ? On one hand by the viral property it would seem to also be unequal? On the other hand having zero NaN is something every equation already has :D it seems fair to silently remove a 0 * NaN term.

<comment><USER25> "0 * NaN" makes as much sense as "0 * Blue". It's NaN because you're trying to do something that is fundamentally not multiplication.

<comment><USER24> thanks - makes sense and is a clear explanation.

</comment></comment></comment></comment></comment></comment><comment><USER26> Go is sort of the opposite of this. If you do something like:

func sum(a, b float64) interface{} { return a+b }

It will allocate memory for the float, because an interface type always contains two pointers. [1]

It's pretty crazy that the second word in a Go interface has to be a pointer. But I suppose if dynamic types were used more, they would be optimized more.

[1] [https://www.darkcoding.net/software/go-the-price-of- interfac...](https://www.darkcoding.net/software/go-the-price-of-interface/)

<comment><USER27> I think it's more about not having exceptions. If the second word is always a pointer then you can make code that blindly assumes such and optimize for that.

If it may not be a pointer you have to branch, which can be add some overhead to the lucky path (every pointer deref will have to wait for type comparison in machine code)

If the float has just been written, the data _should_ be in cache so the performance penalty is probably not too bad in most cases.

<comment><USER26> Well, the problem is when you have a []interface{} that contains a lot of float64 mixed with other things. If the size of the slice is large, I don't think you can assume it's all cached.

<comment><USER27> If the slice is large, it's less likely to be cached either way.

<comment><USER26> True, but there is also locality of reference (having everything in a contiguous block uses less cache than pointer-chasing) and garbage collection pressure.

In principle, using NaN boxing or a similar technique to store non-floats, you should be able to store floats in an []interface{} as efficiently as in a []float64. Scripting languages do this, but not Go.

</comment></comment></comment></comment></comment><comment><USER28> Another similar NaN-boxing approach, available as an option in mruby:

[https://github.com/mruby/mruby/blob/d6cb4f9cf2027eb20f67238a...](https://github.com/mruby/mruby/blob/d6cb4f9cf2027eb20f67238aa6c051448602e7e6/include/mruby/boxing_nan.h#L31)</comment>


Qualcomm Snapdragon 835 Performance Preview - <AUTHOR> http://www.anandtech.com/show/11201/qualcomm-snapdragon-835-performance-preview <comment><USER2> Still 1.5 year old Apple A9 chip in the iPhone 6S is thrashing the Snapdragon in multiple test. That shows (1) the quality of the team designing the A-series processors, (2) Apple is will to spend more money to put a larger chip into the iPhone...</comment>


India bans ecommerce companies from selling their own products - <AUTHOR> https://venturebeat.com/2018/12/26/india-bans-ecommerce-companies-from-selling-their-own-products/ <comment><AUTHOR> The title does not fully specify the ban is on Marketplace. Along with this various other things have been added like limits on cash back, etc.</comment>


On the Relation Between Unit Testing and Code Quality - <AUTHOR> https://arxiv.org/abs/1904.04748 <comment><USER2> > The sample consisted of data from both Brazilian and Swedish companies, > comprising IT departments at one large online media and social networking > company with around 5,000 employees, one smaller software life-cycle > consultancy company with around 35 employees, and one company that offers > programming courses to individuals and companies (around 100 employees), one > multinational networking and telecommunications equipment and services > company (with around 115,000 employees), an aerospace and defence company > (with around 14,000 employees), and an automotive parts manufacturing > company (with around 160,000 employees).

I may have read the article wrong, but it seems they are evaluating the impact of unit testing on code quality at fairly well-established companies where unit testing is already part of the workflow (along with versioning, bug tracking, etc...)

To me, this seems like it would introduce a strong bias: these companies are more likely to employ experienced and highly skilled developers than non-IT shops. What I would be interested in seeing is the effect of introducing unit testing in a team that does not currently use it.

I remember that as a junior dev, starting to practice unit testing was incredibly profitable in terms of discipline and code clarity/quality. Of course now, I can certainly write reliable and clear code without unit tests. But I don't think I would be able to do so as effectively and quickly had I not been unit testing my code for most of my career.

I don't think companies that do not practice unit testing are a minority, even nowadays. As a consultant I've worked for Fortune 500 companies (non IT, but finance, banking, entertainment...) that did not even have a git nor a bug tracker and where most of the team had never heard of testing. I've also found this to be more common than I would have expected among data science teams. To me these are the shops that would benefit the most from switching to a TDD approach, and this is where the measurement should happen. Not at a "social networking company with around 5,000 employees" where everybody has been practicing it for years...

</comment><comment><AUTHOR> Interesting that the authors concluded there's no strong causal relationship between unit test coverage and the number of defects or perceived code quality.

I felt that perhaps defects detected by tests during original coverage might have been overlooked. It seems they were examining the defects detected by only increasing coverage.

Maybe some of the code coverage they studied were simple smoke tests without much granularity.

Code quality perception is probably very subjective.</comment>


Ask: What are the Mechatronics related startups that I can work for? - <AUTHOR>

I have completed my undergrad in Mechanical Engg. plus I have deep interest in start-up/entrepreneurship. So I wanted to get involve with mechanical startup <comment><USER2> Cruise (self-driving cars)

[1] [https://www.jobscore.com/jobs2/cruiseautomationinc?sid=68](https://www.jobscore.com/jobs2/cruiseautomationinc?sid=68)</comment>


Georgette Packaging (YC W16) Makes Custom Branded Boxes and Cups for Bakeries - <AUTHOR> https://blog.ycombinator.com/georgette-packaging-makes-custom-branded-boxes-and-cups-for-cafes-and-restaurants <comment><USER2> This is a great idea.

A huge part of the success over the last 10 or 15 years in the cafe and coffee industry has been about branding and design.

Starbucks knows this: bright green straws, red holiday cups, etc. You can see a Starbucks cup from 100 feet away.

Why should Starbucks, Blue Bottle, Coffee Bean, and Dunkin all capitalize on this, while a lot of the mom n pop shops that make the best coffee are serving their brews in 16 oz paper cups that they buy in bulk from Costco?

<comment><USER3> Inversely, why should you have to pay extra to get your great craft brewed coffee in a fancy paper cup? Branding like this is much less important for local businesses than national franchises/chains.

<comment><USER4> Totally agree. This is aimed at small runs, but for a small run of a standard box it was $2.24 per 6 cupcake box (much more for one with an actual design). What small shop can afford $2.24 a box?

Quick look online found plenty of nice ones for $0.20 a piece that you could put a sticker on with your logo. This is what a lot of smaller places do in Seattle and it seems to work just fine.

<comment><USER5> Yes, a lot of small businesses use generic boxes and a sticker. When I owned my bakery, I did the same. That's not to say that this solution is ideal; most of the generic boxes are flimsy, tedious to assemble, and give your customers the idea that your product is ... humdrum, not something you'd pay much for. If you're working super hard to bake something amazing, your packaging should complement and introduce your product in a splendid way too -- you need to do something a little different from everybody else. Larger brands don't invest in beautiful, branded packaging for kicks -- it has a major influence on the perception people have of their wares, and contributes a lot to the customer's experience of their product. In terms of unit price being high at low volumes -- we're constantly working to get that down! :D Our minimum quantities for custom packaging are some of the lowest on the market, and our pricing very modest by comparison, because we invest in tooling on behalf of our clients. I think it's hard to see how great our pricing actually is, because it's near impossible to find other packaging companies that do what we do, or put all their pricing online.. :)

<comment><USER6> My experience growing up was that the flashier the box was the cheaper the cake tasted. The best cakes came from the bakeries that invested 100% into their products. I loved getting really great products in terrible packages, it had a certain feeling to it.

That being said, I love branding and really hip bakeries and coffee shops with awesome branding will always woo me too.

<comment><USER7> My experience too.

To add to that, the bakery I'd like to buy my bread and cakes from is the one that probably closes due to no branding. In fact it probably looks like a holdover from the fifties inside and specialised in just being a shop, not a brand.

It's a little sad to me that brands have become so much more powerful than the product, though I'm not immune either. I do try though - I'll risk the bad experience and try the family cafe or unknown coffeeshop in preference to a starbucks or costa. Does mean I get something rubbish occasionally.

Ironic that Starbucks such are a huge success but make terribly bland coffee. I've several friends who collect their mugs, but will never drink their coffee!

</comment></comment></comment></comment></comment></comment><comment><USER5> Hi guys :) I'm Sarah, the founder of Georgette. Super excited to be on Hacker News and to answer any questions anybody might have...!

<comment><USER8> Whenever I'm walking around the North End and I see a blue and white Mike's pastry box with the string, I reflect on how genius good branding and packaging can be.

Would you be able to speak to where the boxes are made? Is it one central location somewhere? I always assumed craft packaging was a pretty decentralized industry...especially the niche bakery/cafe market where transportation costs might break your margins on highly custom, low volume orders.

<comment><USER5> We work with a variety of factories in Southwestern Ontario, Canada, which is a big packaging manufacturing region. Packaging manufacturing is very fragmented - most factories are small-ish, like $10m in sales or less, often family-owned, several generations old, and in small towns. So depending on the exact size of order and special requirements, we'll work with one or several of our partner factories. For example.. the boxes might be printed in one location, then transported to another for metallic foil work, then transported back to the original factory to be die-cut and glued with a bunch of other identically-sized boxes we're making for other clients. We're always trying to make it more streamlined. Transportation isn't a huge cost -- raw materials are though, and labour, since a lot of what we do is set up major machinery to do quite small runs, such as lithographic printing presses. They take a lot of fine-tuning to get the colours and graphics perfect - and that's not a shorter process just because the total run is small.

Long answer, sorry! :)

<comment><USER8> Thanks for the information. Sounds like you are learning a ton about a space that is ripe for supply chain/logistical disruption. Good luck!

</comment></comment></comment></comment><comment><USER9> While I understand purpose of of these boxes, I can't stop thinking "what a waste".

I am private labeling several products and have to do the same, because customers would not accept something in simple reusable zip-lock as something serious...

So here we are - customers shopping for most value for their buck, but yet - almost no one would by product without fancy packaging.

</comment><comment><USER10> Awesome looking site and a real opportunity I think.

My ex-wife is a cupcake and deco cake maker and I sent her the link, she is really interested and will be contacting you guys soon.

Best of luck to you!

<comment><USER5> Thanks very much! :D My e-mail is email@example.com, I'd love to hear from her :)

<comment><USER10> Just as a follow up, Stephanie says she ordered some stuff from you guys, so I'm really happy I got you connected and it worked out.

She is crazy talented at her baking and decorating crafts and obviously you both are as well, so hopefully a longterm working relationship was created between ya'll.

</comment></comment></comment><comment><USER11> Not that I buy many cake boxes, but the base unit cost, unprinted / coated seems pricey? $1.32 for a box, we must be taking really pricey cupcakes?!

<comment><USER12> The box though is not just a container to hold things. It is a marketing tool. For example after reading the story of Newman's Own on the back on one of their boxes, I am now more likely to pick them up. And now I'm writing about them providing even more marketing ROI.

<comment><USER5> Haha yes!! :D This is great.

</comment></comment></comment><comment><USER13> This seems very similar to Pakible (YC W15) [https://blog.ycombinator.com/pakible-yc-w15-makes-it-dead- si...](https://blog.ycombinator.com/pakible-yc-w15-makes-it-dead-simple-for- businesses-to-design-ship-packaging)

<comment><USER5> Pakible is awesome and we love them! :D They specialize in corrugated shipper boxes. We do paperboard retail boxes.

</comment></comment><comment><USER14> This seems like a niche that has been ripe for occupying for a while. Packaging for products has become more and more ornate and is a design job that needs a full team. Good luck to Georgette.

<comment><USER5> Agreed and thanks for the support :)

</comment></comment><comment><USER15> My girlfriend owns a fragrance company and it's crazy how hard it is to find a good box manufacturer. The minimum quantities are often too high for a startup like hers (5k minimum for each product), or a place can do rigid boxes but not another style she needs, or they mess up an entire order because everything is still done over the phone.

It seems like an outrageously stressful process and I've been wondering why someone hasn't been doing it better. Glad to know someone finally is.

</comment><comment><USER16> As seen on Next Gen Den[1]. Great idea!

[1] [https://www.youtube.com/watch?v=rl6XZ- cLwkw](https://www.youtube.com/watch?v=rl6XZ-cLwkw)

<comment><USER5> Thank you!

</comment></comment><comment><USER17> Amazing! I think Georgette Packaging can be an enabler for smaller businesses to cost effectively address some of these branding issues

</comment><comment><USER18> Amazing! Very useful idea for SMBs

<comment><USER5> Thanks! :)

<comment><USER19> Your /hiring page is broken

<comment><USER5> Hmm can you tell me where you found that link?

<comment><USER19> Linkedin</comment></comment></comment></comment></comment>


Show HN: Launch your own hosted SelfStarter without writing a line of code - <AUTHOR> http://www.crowdhoster.com/ <comment><USER2> Thank you. I have some ideas for you guys. KickStarter doesn't want to go the route of "being a store" and selling pre-sales. This is EXACTLY what a lot of us want and the direction I think you should go in.

In fact set it up in a way that makes Pre-Sales the main attraction. It would make things so much easier.

When I was running my ToDoCal kickstarter the biggest pain in the ass was trying to set up prizes and calculating the cost to fulfill them. Because kickstarter isn't set up like a store that accepts pre-sales I would have to double the cost of all my "prizes" so as to buffer the cost of fullfilling expensive orders. Shipping to Chicago would be $6, shipping to San Francisco was $10, international shipping was $16. But I can't charge different people different prices, so I had to forcing everyone to pay a higher price to keep it safe.

By designing Crowdhoster as a pre-sales store you can eliminate that completely. USPS shipping api's can calculate the exact cost each backer should pay down to the penny. You could offer your backers discounts based on bulk orders and have an idea of where your products are going so you can design packaging to be more efficient.

Basically make a pre-sales store with minimum order requirements where anyone can place orders and their card is charged only when the minimum order is reached after X amount of time.

<comment><USER3> Chris - love your ideas here. I head up our API at Crowdtilt and spearheaded the CrowdHoster project. We're psyched to get cracking on features like this.

Product pre-sales drove Lockitron to create SelfStarter in the first place...clearly a huge use case. With our API we'll be able to get more creative with the payment flow, allowing dynamic cost calculation like you describe with different shipping scenarios.

</comment></comment><comment><USER4> One day self-crowdfunding will be as easy as hosting a blog. Not yet, but this is a good step towards that direction. I certainly wouldn't mind it if in 10 years crowdfunding is what powers the internet.

</comment><comment><USER5> We built the exact same service last month <http://www.jumpcrowd.com/> The hosted SelfStarter movement will open up crowdfunding in the same way services like Blogger and WordPress opened up blogging platforms. KickStarter probably won't survive in its current form.

<comment><USER6> You would seem a lot more professional and trust worthy if you didn't have the word SHIT in your tagline.

<comment><USER5> You're probably right but this was a side project we hacked together just to see if we could do it. My partner put it up there and I thought it was funny. We're not taking ourselves too seriously.

</comment></comment></comment><comment><USER7> Hey, this is Yancey from Kickstarter here. We think projects like this are great, which is part of the reason we open-sourced the Amazon FPS code that we use at Kickstarter, which was then used in Selfstarter and Crowdhoster. It's on Github here: <https://github.com/kickstarter/amazon_flex_pay>

For us, Kickstarter is a big experiment and we're constantly learning what works, what doesn't, and making changes as we go. We want to provide the best possible space for creators to share their projects and for people to connect with them. We think we're doing a pretty good at that, but of course there's always more to learn.

If you're curious, we have many of our stats available (live) here: <http://www.kickstarter.com/help/stats>

</comment><comment><USER8> This is fantastic!

16 hours ago, I asked this: <http://news.ycombinator.com/item?id=5138705> and now you just conveniently come along with the perfect answer!

Awesome.

<comment><USER3> Nice! Psyched to work with you on your project.

<comment><USER8> Is this new framework your baby? I really love the idea of being able to tailor a kickstarter style effort more to product pre-orders instead of trying to shoehorn it into kickstarter's model.

For instance, I absolutely intend to deliver a product to each person if it gets funded. None of this wishy-washy garbage. I have a design, I have quotes from the factory that will make them, and if you preorder a light you will receive it. If you don't you have every right to sue me or ask for your money back. I also think it's totally reasonable that if the project meets the goal, to switch it from "preorder mode" to "order mode" since at that point I'd rather just have the cash so that I can start the procurement process. No sense waiting for a month before ordering, right? Not with quotes on hand sitting on my computer waiting for my approval.

What kinds of constraints does your system have? Are the types of things I mention above possible in your framework?

</comment></comment></comment><comment><USER9> I read somewhere that the challenge with posting your projects with Kickstarter is getting the attention of people and hence most of them do not reach their funding goal.

<comment><AUTHOR> I think as an entrepreneur, you are gonna need to do your homework and figure out how to get the attention to your project regardless of using Kickstarter or not.

Lockitron was a perfect example that used Selfstarter to fund their project and got a lot of attention from users without the help of any organization like Kickstarter.

<comment><USER10> i agree with this ^. if you're going to launch a project that you hope builds the momentum to fund +$100,000 of your capital needs, it might be worth putting aside $5k or so for strategic PR or hiring a PR person for the launch of your own crowdfunded project.

And Lockitron proved with a product people want and getting people to notice it, you can do really well without Kickstarter (+$2,000,000 to date I believe).

<comment><USER8> Thanks for this advice, I will be taking it to heart. I know I'm not good at PR, and think that people will really want to get my product if only I was able to tell them about it. I mean, it's a fully programmable, 10W RGB+white LED light with a built in arduino core, microphone for audio responsive mode, and has extensibility to allow for wifi, DMX, or any other communications you want. Not to mention hallucinatorator mode:

<http://youtu.be/Nu21KK0iyFU>

which uses the ganzfeld effect to make crazy hallucinations happen.

I don't even care that someone could completely steal my design because it's open hardware and open source; I would _happily_ pay $70 to get one of my own lights!

So then the question is... since I've been working so hard on this that I haven't been working enough real job to have savings to speak of, I wonder if there is a good PR person I could hire that would defer payment until after a project was successful...

Let me know if anyone knows someone who might be interested!

</comment></comment></comment></comment><comment><USER11> This is great to see. I'm working on something similar which has a few more features is focused on integrating into other brands websites or social networks.

I think this is going to be an exciting arena with a lot of market potential. The current marketplaces support a small percentage of the audience and free form platforms can let anyone crowdfund.

</comment><comment><USER12> This is just a great project. Thank you! I submitted my own proposal.

I was going to use kickstarter, but it simply did not match very well with what I plan to launch. This however, fits just right.

Also, great landing page. I don't know what is your conversion rate, but from experience I can tell that it just works.

</comment><comment><USER6> As a user I would feel more comfortable buying from a trusted source such as kickstarter because I feel like there is more of a guarantee of getting my money back if the project never gets off the ground

<comment><USER10> There's no guarantee of getting your money back if a project fails on Kickstarter though... [http://venturebeat.com/2013/01/22/why-this-jilted- kickstarte...](http://venturebeat.com/2013/01/22/why-this-jilted-kickstarter- backer-decided-to-sue-why-he-was-right/)

<comment><USER8> There could easily be _more_ of a guarantee if you host it through your own website. If you don't finish the project, and didn't explicitly state that funding was to "try" rather than a preorder, I'd see it as far more likely to be finished.

</comment></comment></comment><comment><USER13> I don't know a ton about crowdfunding... but what could be the downside of using Kickstarter? Seems to me that it comes with free audience and offers some security for the backers.

<comment><USER14> It has no problem to run a crowdfunding campaign on Kickstarter until Kickstarter disallows you to do that on their platform.

SelfStarter was created by the Lockitron team to run their own crowdfunding campaign because Kickstarter didn't allow them to run their campaign on Kickstarter.

Eventually, I still see Kickstarter as the main/most important crowdfunding platform. Like many closed platform versus opened platform plays, it seems like most of the closed platforms win eventually.

I might be wrong on this but I would like to see example on the opposite case.

<comment><USER10> Wordpress?

</comment></comment></comment><comment><USER15> Are there any hosted SelfStarter services that work with bitcoin?

<comment><USER16> <https://github.com/lockitron/selfstarter/pull/22>

<comment><USER15> Thanks! I'll test it out..</comment></comment></comment>


The Folks Who Sell Your Corn Flakes are Acting Like Goldman Sachs - <AUTHOR> http://www.newrepublic.com/article/114577/commodities-trading-hedge-funds-spook-wall-st-banks

<comment><USER2> I'm skeptical about the ban on insider trading in general. Now this author wants to extend it to a new sphere.

Basically, an oil company, which knows a lot about the oil market, shouldn't be allowed to speculate in oil.

Isn't this the mandated destruction of valuable market signals?

Should we also ban car mechanics from buying and selling used cars, because their special knowledge gives them an unfair advantage?

<comment><USER3> There's a huge difference between special knowledge and expertise and material non-public information that you know will move markets.

Martha Stewart didn't go to jail for having any specialized knowledge, she went to jail because someone tipped her off that a company she was invested in was about to go south. She sold those shares to someone who _had no reasonable way of knowing what she knew_ which is essentially a type of fraud.

<comment><USER4> No. The reason that trading on insider information is illegal isn't that some third party is injured (if anything, martha's sales caused the third-party get a better price than he would have otherwise!) It's illegal because the officers of a company and the employees of a company are supposed to be doing the job of _running a company for the benefit of the shareholders_ , and there's opportunity for some pretty massive conflicts of interest if they're also playing games trading stocks / stock-tips instead.

And also because people think it's "unfair", like the stock market's supposed to be a game or something rather than a place that you can buy and sell stock for a price which is well-correlated with the company's prospects. :P

<comment><USER5> That is the agency problem and bans on insider trading do not directly address that. The agency problem is addressed through bans short-selling and put options, as long as the officers and directors have along exposure to the share price, their interests are aligned.

The ban on inside information is intended to attract capital by ensuring that stock markets are fair and transparent. If the investing public believes that the stock market is nothing more than a con to take rubes' money capital will stay away, and keep capital from flowing to productive firms.

<comment><USER6> > If the investing public believes that the stock market is nothing more than > a con to take rubes' money capital will stay away

No way - now 401ks are the only retirement savings vehicle aside from striking it rich through lottery or stocks. Guess how many people translate their investment in a mutual fund to the actual stock market shenanigans?

</comment></comment></comment></comment></comment><comment><USER7> Here's why this exists:

Say I'm Kellogg's. I make Cornflakes. I pay $x/ton for corn and I sell Cornflakes for $3 a box. Now say that due to a drought, the price I pay for corn is now 2x. I have to raise the price of Cornflakes now. Consumers don't want to pay $5 for a box of Cornflakes, and my sales drop.

But if I buy corn futures when the price of corn is low, then when it goes up those become more valuable, canceling out some of my increased supply cost, therefore my business is less exposed to risk in price volatility of raw materials.

In other words, it's for hedging.

Now, there are various ways to exploit this unethically, for example if I as a commodity trading bank, _actually have control over the prices_ of the commodities. We're right to be concerned about that. But commodities hedging itself is a good thing for the economy and we shouldn't spread FUD about it.

<comment><USER8> Correct, and to be clear, that is exactly what Kellogg's, General Mills, Coca- Cola, and other big food companies have been doing for years now. It's not uncommon whatsoever -- if anything, it's considered a best practice -- to hedge on commodities prices if your fundamental business depends on them.

In and of itself, that big food companies deal in commodities futures (call _and /or_ put) is neither surprising nor irrational.

Things start to get scary when speculators dominate the markets for those commodities, and when commodities houses corner markets. The reverberations across various sectors of the economy would be frightening if anything went to shit at even one commodity shop.

</comment></comment><comment><USER4> What? People who use commodities to power their business are trading commodities futures on the futures exchanges??!?? Perish the thought!!!

<comment><USER9> The difference is whether they're using them for speculation or (real) hedging.

<comment><USER10> Actually that doesn't make a difference.

The entire point of the free market is to provide for speculation. People buying and selling goods for real dollars where they have real risk is called 'price discovery.' It incentivizes discovery of information relevant to the market and dissemination of that information to the market via price.

Lets take the example of corn flakes, I'll be a speculator, every day I watch the corn fields, one day I see a fire start on one of a field ostensibly representing half of that year's corn, I buy corn at any price knowing it will go up because the world's supply has just been cut in half. Next week I sell all that corn and take the profit as fruits of my labour.

People who trade Wal-Mart stock will often request satelite images of Wal-Mart parking lots to estimate sales. Just imagine the ingenious ways commodities traders use to discover information about supply and demand.

Farmers are completely free to sell their corn direct to consumers, but most prefer not to because that isn't an efficient or effective way of selling. Don't blame Cargill, blame farmer John down the street who wants the best price for his corn.

<comment><USER11> For big commodities like corn, that might not be a solution, but I'd like to build a startup that covers some huge market inneficiencies - for example, peppers grown 500 km from the city I live in are sold at U$ 1, while they cost U$ 4 at the supermarket.

<comment><USER10> Do you mean as in 500km from your city you can buy peppers for $1 and they cost $4 in the city?

Or did you mean that there is a $3 price discrepancy for peppers between the supermarket and the fruit stand?

<comment><USER11> I meant that in 500 km from my city you can buy peppers for $1 and they cost $4 in the city.

they're about $3 in the fruit stand and $4 in the supermarket.

</comment></comment></comment></comment></comment></comment><comment><USER12> Isn't the title of this a bit misleading? Cargill doesn't sell corn flakes, it (possibly) sells physical grain to Kellogg's, or derivative products to hedge Kellogg's exposure.

<comment><USER13> I would say the title is an indication of how bad the article actually is. It is a shame they wrote such an information free article.

Cargill is a fairly interesting company and like all big and small grain companies, they hedge their inventory. Grain is a very low margin business and it is very important to protect both the company and the farmer from market volatility. This does tend to put these companies in the financial instruments business and they do tend to expand past agriculture.

disclaimer: worked for Cargill at one time and will not go into any depth other than to say the article is a bit information lite and the title is horrible, ill-informed dreck that I expect.

</comment></comment><comment><USER14> "Last year, the Global Financial Markets Association, a lobby group for banks, commissioned a study on whether trading houses are "too-big-to-fail." Hoping it might convince officials to regulate these companies like banks, GFMA abandoned the study after Pirrong, its author, reached a different conclusion."

<comment><USER11> Seems like Pirrong was intellectually honest :)

I looked up some links on his study:

[http://www.bloomberg.com/news/2013-05-15/commodity- trader-](http://www.bloomberg.com/news/2013-05-15/commodity-trader-) failure- seen-as-limited-economic-risk-in-study.html

[http://www.cato.org/publications/policy- analysis/inefficienc...](http://www.cato.org/publications/policy- analysis/inefficiency-clearing-mandates)

</comment></comment><comment><USER15> Can we please stop it with the breathless conspiracy theory posts here? Especially from sources like the New Republic.

</comment><comment><USER16> This was extremely difficult to read. Let's start with: Goldman has not just _become_ a commodities trader. It has been one since 1981! And the article goes downhill from there.

And secondly, [http://en.wikipedia.org/wiki/Futures_contract#Origin](http://en.wikipedia.org/wiki/Futures_contract#Origin) "The first futures exchange market was the Dōjima Rice Exchange in Japan in the 1730s"...

</comment><comment><USER5> This article is dramatically light on specifics and historical context and heavy on innuendo and fearmongering.

</comment><comment><USER17> As everyone else is saying, this article is spreading fear for no reason. Working with financial markets is a key technique for commodities companies and always has been, particularly to hedge. The net result is that food prices are lower and more stable.

The exception is onions. Onion futures were outlawed 50 years ago for "reasons" given in this article, and onions are more volatile than oil, which is the _most_ traded, speculated-on, and manipulated commodity.

In summary, the author of this article is calling for forcible action that would hurt peoples' lives, potentially even disrupting world food supplies.

</comment><comment><USER18> I'd like to point out that this is a perfect example of how not to build mobile versions of a site. Due to changes in how iOS 7 Safari hides and shows the tool overlays when scrolling, they are now permanently displayed on this site. You never know when the browser interface will change like this.

Also, Apple has really screwed up with this feature change in Safari. There's so much to like about iOS 7 but not this. I've been working with the beta since it launched and have been hoping for this feature to be reverted but it looks like it's going to production now.

<comment><USER19> Meh, Chrome on iOS has had peekaboo interface elements for a long, long time. It works fine 99% of the time until you run across a site like this one.</comment></comment>


Protect Your Cloud-Hosted Web Applications from DDoS Attacks - <AUTHOR> http://hivewind.com/overview/

<comment><USER2> Price: $Low. WTF?

Edit: I see, on the other page it states [http://hivewind.com/pricing- signup/](http://hivewind.com/pricing-signup/) (~$70-260 a month).

</comment><comment><USER3> Creator here, feel free to hit me with any questions.</comment>


New Amazon EC2 Competitor: Cloudlayer's pricing announced - <AUTHOR> http://www.softlayer.com/cloudlayer_computing.html <comment><USER2> I'm glad to see SoftLayer getting into this space. However, there are still some things I'd like to know more about.

For example, Amazon's Elastic Block Storage can be snapshotted to S3 (with at least 3 copies in at least two availability zones) very easily. Does CloudLayer's SAN storage offer such ease of backups? I see EVault is offered for about $1/GB which is really expensive compared to Amazon's backups. Can IP addresses be transferred between boxes? What if the boxes are in different data centers? Is the billing only monthly or will it be pro-rated hourly? Can CloudLayer instances be used in conjunction with SoftLayer's hardware load balancing and other services like that which Amazon doesn't offer?

<comment><USER3> EVault is a backup appliance, it has a software agent running on your server and a dedicated web interface to manage backups. Probably overkill if you just need snapshots.

We use their iSCSI storage space for that, which is about 75c/GB (free server- to-server bandwidth). Their cloud storage appears to be even cheaper 25c/Gb

</comment></comment><comment><USER4> Higher prices than EC2? I was hoping for something that would make Amazon cut their prices or beef up their RAM offering.

To compare:

        CloudLayer: 1 Core + 1GB RAM + 100GB SAN Storage - $99.00
        EC2: 1 Core + 1.7GB RAM + 100GB Elastic Block Storage - $82.00

<comment><AUTHOR> Cloudlayer also includes _unlimited_ inbound bandwidth and 2000GB outbound. The outbound bandwidth alone would set you back $340 with Amazon.

<comment><USER2> Not just that, but when you look at the higher-end instances, CloudLayer's pricing becomes even more attractive. At $300, you get 8GB of RAM and 8 cores. Considering that Amazon's EBS has I/O usage charges, this is cheaper than Amazon's Large instance (7.5GB RAM and 2 cores with 2 compute units per core) with any I/O usage.

EDIT: SoftLayer is also saying that their base CPU is 2.0GHz rather than the 1.2GHz that Amazon's compute units are based off of.

</comment></comment></comment><comment><USER5> From a little investigation, it's not really an Amazon EC2 competitor. I'd consider it closer to Slicehost and Linode.

It turns out the instances are only offered on a month-to-month deal, not by- the-hour.

<comment><USER6> The 'Key Advantages' sidebar lists "Pay As You Go or Monthly Packages". I assumed they haven't yet announced their pay as you go pricing. Did you ask somebody at Softlayer about this?

<comment><USER5> That's what I originally assumed, so I used their sales chat thing.

Apparently the Pay As You Go only refers to the storage and CDN.

</comment></comment></comment><comment><USER7> What kind of IOPS/transfer speeds are people getting from Cloudlayer or similar "disk clouds"? This storage with its encryption sounds secure, robust but slow. Would one use NFS or some SAN/iSCSI/networked blocked device and put some kind of distributed file system on that?

Or perhaps one needs to plan an architecture where you never block on any disk read, writes being usually buffered?

I'll note that my app probably relies a lot on files for data access rather than throwing everything in an SQL database (and I wonder how Postgres would fare on such a shared disk system)

</comment><comment><USER8> I'm actually shopping through these different hosting services today, so this is very timely for me. What I'm really liking about CloudLayer is their ability to expand my HD storage capacity (a feature which is important to me as I operate a crawler). Linode and Slicehost don't seem to offer that and, so far, CloudLayer is looking pretty competitive with EC2. Does anyone know of any other services that offer that?

The unlimited incoming bandwidth is great too.

</comment><comment><USER9> regardless of price and features, any new competition is good for the consumer

</comment><comment><USER10> Others should learn from this: free/unlimited inbound bandwidth encourages people to upload data into the cloud. Sounds like a nice platform for building crawlers.</comment>


"Startup comedy" on Hollywood's radar (view Land of OpportuniTV video) - <AUTHOR> http://www.veoh.com/channelVideos.html?c=UTAOnlinesubmissions <comment><AUTHOR> The takeaway point: marketing plans soon may have to describe how a startup will run marketing _as a profit center_. So when you're done (re-)reading On Lisp, you'll probably want to crack Robert McKee's Story, as it is the bible for screenwriting (e.g., sitcom design) :-)</comment>


SpaceX Interplanetary Transport System - <AUTHOR> https://www.youtube.com/watch?v=0qo78R_yYFA <comment><USER2> TL;DR - Big rocket launches, refuels, and heads to Mars on solar power.

I'm hoping there are more details about living conditions, habitats on planet, and other aspects of such a trip. While other companies may eventually provide solutions to those parts of an expedition, I fully expect SpaceX to have to figure it out for the first few trips...

<comment><USER3> The solar panels seems to be designed to catch some solar wind (if that's even viable), in addition to generate electricity, but the engine works with fuel. There is no (yet) any full electric space engine.

</comment></comment><comment><USER4> Ambitious, but it feels like science fiction right now. The principles seem reasonable, but we have no reason to believe that SpaceX is capable of pulling this off in the foreseeable future. We'll see if Musk can convincingly explain it in his speech in 40 minutes.

Also interesting to note how close fan speculation actually got to the truth: [http://imgur.com/a/87OOT](http://imgur.com/a/87OOT)

<comment><USER5> > _but we have no reason to believe that SpaceX is capable of pulling this off > in the foreseeable future_

Based on what they've achieved so far, I see no reason to believe they are not capable.

It's been their goal since day one, so it seems they will go after it as hard as they went after their achievements to date, which has far surpassed expectations.</comment></comment>


Ask HN: Is the ER Accelerator (NYC based YC clone) worth applying to? - <AUTHOR>

<comment><AUTHOR> Their site is: <http://eranyc.com/>

I'd love to hear from anyone with direct experience.

</comment><comment><USER2> TechStars run a NYC batch. Probably the best accelerator you will find in NYC.

</comment><comment><USER3> In what sense is it a YC clone, other than being an accelerator?

<comment><AUTHOR> A small amount of money for a few months, followed by a demo day in the end, etc.

It's not as established, though, and I haven't read or heard much about the startups which come out of it, though, which I why I posted the question.

</comment></comment><comment><USER4> I know some people who did it. If you want, I can connect you.</comment>


Machine learning tries to predicts World Cup winner - <AUTHOR> https://www.technologyreview.com/s/611397/machine-learning-predicts-world-cup-winner/ <comment><USER2> 0% of world cup end up without any surprising game result. Which takes the probability of this prediction being right down to ... 0%. No AI can ever be useful here until it doesn't take into account the movement of the wings of the butterflies flying around the stadiums.</comment>


Don't Steal Ideas, It Is Discouraging - <AUTHOR> http://mikegranados.com/its-discouraging.html

<comment><USER2> I couldn't disagree more unless you want to clarify in greater depth what an "idea" is. People who think of ideas as property are literally the personification of selfishness. Their anti-altruistic thought is a stunt to creativity. We are were we are today scientifically/culturally because of the continued improvement of other people's ideas and research.

If you submit an idea, it immediately becomes public domain and can and _should_ be copied or replicated if it can be made better and more open for the benefit of society. (To my regret), I studied law and spent as much time as I could in Intellectual Property because it was the most interesting field to me; what I learnt from my studies is how broken the entire system is.

If you are offended when someone steals you idea, then you should go invent your own internet. With blackjack, and hookers. Because ultimately, you are only where you are because of the contributions that other people have made, and if something can be clones in 11 hours, from svbtle to obtuve, then all it is is an idea.

Steal ideas, copy them, make them better, and encourage _EVERYONE_ to pay it forward by pushing up the bar of expectations.

* =

Edit:

I came across some idea a while ago, I can't remember what it was called, something about "boycott commits", or along those lines.

The general premise is that every time you ever touch a file, you have to make it better in some way.

If you are going to do a commit to some open source project, you should make it better. Either by commenting something with more verbosity, or by optmizing how the project handles some ternary condition.

It's up to you, just make it better.

Now, imagine the entire world is an open source project, we are all in it together, we might all be running our own branches, but we all work from the same code base. When you commit you have a good chance of making my fork better too!

Want a more tangible example? Google and Facebook.

Whether or not you want to believe it, Google and Facebook are each making themselves better by copying and competing each others ideas. Google started out by looking at what Facebook had, and spotting what they are missing out in.

They then spent time developing features to fill these gaps.

They came up with Circles. They came up with Hangouts. They came up with high resolution pictures. They up with FooBar.

Well, now, Facebook came up with lists, Facetime, and recently included high resolution pictures. Whether you agree or not, this competition is all benefiting us.

So what if Obtvse copied an idea. Lets hope that is spurred dcurtis into making his platform "better".

</comment><comment><USER3> I empathize with what you're saying, and in this case the notion of "stealing an idea" was a bit more blatant than most, but I still think two versions of Svbtle is better than one.

Let's look at some positives of what the clone did: 1) It generated buzz for both sites. And forced people to consider this idea as a legitimate product, instead of a weekend hack. 2) It validated the market. More people doing similar things suggests there's a valid space there. 3) Provided that both sites continue to operate and grow, they will continue to push eachother to do better.

I don't think the fact that the core product was copied is discouraging at all. I think it helps. I think the real problem you have is the manner in which it was copied. You nailed it with this line: "Real creative comes from a personal connection to a project or idea." <\-- this is true. If the idea started with you, and you have the passion to continue executing on it, you'll stay the long haul and it will become a great product, it's your baby. Why does it matter what else is in the market? Shipping a product is half the battle - especially when you're dealing with space where there's no proprietary technology powering the product. Where real differentiation occurs is marketing execution, and that's where innovation is forced to occur.

</comment><comment><USER4> Children get upset when someone copies from them. Adults realise that there's no such thing as an original idea, but there is such a thing as validated product-market fit.

The 99c vampire romance novels on the Kindle Store don't undermine Stephanie Meyer, they reinforce her status as a thought leader. The waves of Apple- derived industrial design (here's looking at you, HP Envy!) entrench the status of Jony Ive as the only designer that matters. Counterfeit designer clothes and accessories are the reason that luxury department stores in London are now employing Mandarin-speaking staff.

If you're not _delighted_ that people are ripping off your ideas, you've badly misunderstood the modern market. On the internet, the worst thing you can be is ignored. Imitation means that not only is your idea good enough to notice, but that it's good enough to slavishly copy. The clones might get a few hits or a few bucks, but the social capital is all yours.

<comment><AUTHOR> Interesting point. Thanks.

</comment></comment><comment><USER5> Everything's fair in love, war and business.

Ideas are meant to be "stolen". That's how progress is made. If you want to protect your idea, make sure that you've got the best execution. There is no benefit for society from protecting subpar executions.

</comment><comment><USER6> This makes no sense at all. Ideas should be copied, redistributed, and refined by multiple parties. The execution best matched with its audience and context will do well. This post suggests that it is somehow not right for a person to draw inspiration from the work of others and then _do the work independently to realize the idea_. Why should I have to ask permission to access any idea or to do work by myself?

</comment><comment><USER7> I truly believe in taking the core concept of an idea and making it better -- if companies and start ups lag behind and leave room for innovation, why not capitalize on it?

If a company is always progressing and improving upon it's product or service, then this leaves less room for people to come in and steal their idea and "improve" upon it. Even if there are copycats that come into the market and try to improve upon the core concept, the fact that you're working to build upon your business inspires loyalty and reach among your base of users. I think it's these types of companies that are the hardest to compete with, making stealing their idea even tougher to execute.

</comment><comment><USER8> A guy who implements a closed source idea as an open implementation usually ends up getting credit for taking the pain to implement the idea rather than coming up with the idea. The guys who created GNOME/KDE do not get credit for inventing the GUI. They get credit for making a usable opensource implementation of ideas that were born at XEROX PARC and even before that.

Anyone who creates a clone of a closed app is providing the starting point for derivative work. Even if the "first author" did nothing more than clone functionality, subsequent authors shall build new awesome features on top of that.

If you want to prevent OSS from getting in your way of making money, all you need to ensure is that you care about delighting customers. For Eg consider Google. they use android for controlling the platform on which search happens. The linux kernel hackers actually care very little about whether ur mom can use the phone. The non cool aspects of project get very little attention. To run a business, all you need to do is pay as much attention to the non cool parts of a project.

Apple still sells devices with huge margins. So all Dustin Curtis needs to do is "be the steve jobs" of his niche. He can make money off of it, if he chooses to, and get credit for what he creates true value from and the open implementations can co-exist.

</comment><comment><USER9> I think the concept of "stealing an idea" itself is a sort of tribute to the person who originated it. But actually speaking ideas cannot be stolen.

What wiener did is commendable in its own right without taking any credit away from curtis.

But before this turns into a huge thing, please, come back to the ground. This blog idea or the style is pretty trivial. Its not as if this is linux or a programming language or anything like that.

Were I to be in curtis's position, I might feel like I should have been in control of all aspects of unveiling it to the public and noone must take any credit for anything. But then I would be childish now, wouldn't I?

Have we heard from curtis yet? Maybe his opinion is completely different than that of the article's author.

</comment><comment><USER10> The value of dcurtis's idea was exclusive content from a carefully selected bunch of people. The (IMO ugly) design of the blog or the idea of the ideas panel are not valuable.

If dcurtis had announced his blog platform; announced his blog network; and released the code I think he would have had a very different response. But his approached trashed the "brand" that he wanted to protect. Just read the comments in anythread mentioning the two products; words like "dick" occur many times.

</comment><comment><AUTHOR> I've added an edit as of 2:45 PST. Thanks for reading and I appreciate the dialogue.</comment>


Flaws in deterministic password managers - <AUTHOR> https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers <comment><USER2> I'm the creator of visionary[0], a deterministic password generator that the article links to. When I thought of the idea (quite a while ago), I thought it was a good idea, and I thought I was the first one there. I was wrong on both accounts.

The points that the article makes are right, and people should use conventional passwords over deterministic ones.

But I guess it appeals to a certain small subset of people. For some servers and things that I own I find myself using it sometimes: it turns a relatively strong password into a monster of a password.

Another useful use is that it's good at sharing passwords for things with friends, and for that, it's surprisingly handy.

For the average person however, the disadvantages and the things that could go wrong outweigh the advantages. Keepass is what you should be using.

[0] [https://libeclipse.me/visionary/](https://libeclipse.me/visionary/)

<comment><USER3> Funny, I also implemented mine a while ago (mostly un-maintained but I still use it): [https://pypi.python.org/pypi/virtualkeyring/](https://pypi.python.org/pypi/virtualkeyring/)

I also thought I was clever and the first to do it ;)

I have been thinking about adding support to keep some state info in a yaml file to deal with revocation and specific varying password policies (e.g. in a dropbox synced folder) but I was too lazy to implement it. If someone wants to do it please feel free to send a PR.

The compromised master password issue is a real issue though.

<comment><USER4> Use a photo as the master password. It can't be confused with text.

</comment></comment></comment><comment><USER5> Two extra advantages of vault based password managers:

1\. The manager can automatically change old passwords for you. LastPass support a big set of websites, when Dropbox was hacked this was very handy. I like to change social media passwords every few months and this makes it very easy.

2\. You can store passwords that you can remember if necessary. Sometimes I need to access a password for a service or a site in an environment where I don't have an easy access to my password manager, for example when I'm using a friend's phone or when I SSHd into another machine. In those cases is handy to have some passwords that you remember, but are stored in the vault just in case you forget them. I only do this for a few passwords, but it's a nice feature to have.

</comment><comment><USER6> I've been surprised by how negative the opinions of deterministic password managers have been since I've been using one for over two years and it has been a much better experience overall than using KeePass on Dropbox, and I also think that it's more secure than cloud-based systems (see point 4).

My take on the points in the post:

1\. Out of the 100 or so sites that I use, only a few have password policies that require tweaks, and it usually just requires disabling symbols and or adjusting the length. These tweaks are cached in my browser, so this hasn't been much of an inconvenience.

2\. My passwords are rarely revoked, and when they are it is just a counter bump. This is state, but again it is cached in the browser.

3\. It's true that they can't store existing secrets, but this can be viewed as out of scope for a password manager.

4\. For the application I use, it's not true that exposing just the master password exposes all of your site passwords. There is a 512bit private key that is synchronized once between devices using a QR code. An attacker would need both the master password and the private key file to generate any passwords. Because the private key only exists on devices I physically own, this should be harder to obtain than an encrypted database that lives in the cloud, so I view this system as more secure than KeePass on Dropbox, Lastpass, or 1Password.

My experience over the past two years has been that the advantages are more significant than the disadvantages.

<comment><USER7> If your browser is caching all of your passwords, I think you've got security problems well outside the scope of your choice of password managers.

<comment><USER8> I'd guess he doesn't mean cached, but instead means that his web browser works with this system keyring (or has its own) to save/use the passwords.

<comment><USER9> Which is bad. I've reverse engineered script kiddie malware far too many times to find them shipping "iStealer" and similar, which basically just dump browser password stores and send them to a gmail or FTP account. Often these pieces of malware include the SMTP credentials to the same gmail account or FTP access to download the results.

And having seen their results, let me just say, these script kiddies can do damn well with this tactic.

Do not use a browser/system keyring store under any circumstances unless you can be 100% positive that you won't accidentally run that sketchy exe you came across.

If you use Keepass, it presents another layer, they have to actually get your keepass password too, or dump your database when it's logged in. Often something like that won't be hit by script kiddies but certainly would in a targeted attack. The best practice here is to run Keepass on a separate machine to prevent an all-at-once dump. Even a separate machine on the same network where you use Synergy or similar to sync the clipboards would probably be sufficient.

Anything worth more than dirt should of course have 2FA, which is why I also suggest a tiered password system (ie: junk password for common and worthless sites, separate passwords for banking, etc) and 2FA as an alternative to a real password manager.

<comment><USER10> Neophyte to all this. What is a browser password store? Do you mean never letting Chrome (or whatever) save a password?

<comment><USER9> Yes. If you want to see how vulnerable you are to this sort of attack, Nirsoft ships a good tool called WebBrowserPassView:

[http://www.nirsoft.net/utils/web_browser_password.html](http://www.nirsoft.net/utils/web_browser_password.html)

Be aware, this may be detected as malware or a "hacking tool" by your AV for obvious reasons.

<comment><USER11> How is this to supposed to show "how vulnerable you are to this sort of attack"? This runs standalone.

1\. As a general rule, if you download and run an untrusted standalone program, it could probably steal your passwords even if you use a password vault (although that would certainly make it a little bit harder).

2\. You can just go into the Chrome password manager and click "show" to see any stored password. No tool needed.

Chrome uses sandboxing and process isolation extensively. Using the default browser password store certainly presents a ripe target if someone manages to totally own the browser, but technically there's not a huge leap from owning the browser to owning an external password store, and certainly not grabbing any and all passwords entered into the browser via a password vault.

I'm not disagreeing that a standalone password vault encrypted with a master password is effectively more secure than the built-in manager. I do think it has been exaggerated both how much more so it is. Saving strong passwords with the built-in password store is generally much less bad than, for instance, using a common memorized password, or using very weak passwords. Both of which are likely outcomes of "never use the password store."

<comment><USER9> Yeah, this is not an attack itself, just one of the most common post exploitation routes to easy profit. So common that if you have amateur people who try to pirate things, cheat at games or click on the big flashing red banner ad, they're almost certain to come across it and they're almost certain to have common accounts stolen.

Using even a separate password manager, even an integrated one like LastPass raises the bar beyond this extremely basic level and takes it from easy target to medium target, eliminating every common stealer malware I've seen. This definitely doesn't rule out targeted ones of course, like you say, on an objective level there doesn't seem to be much of a difference. At a practical level though based on what's in the wild for non targeted attacks, it's huge.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Today I learned that many people on Hacker News have really insecure web security practices. :(

I don't understand the resistance to using a vault-based password manager. Is it inertia? I mean, if you're using the same one or two passwords on every site, then sure, it may not seem worthwhile to us 1Password. But then, enough password hashes have been leaked this year alone to suggest that you need to do something better.

<comment><USER12> For me it was a case of thinking I know better. As in, "no way I'm giving you my passwords" and "who knows how tight their opsec is" ... never even tried anything like LastPass or 1Password until six months ago.

Now I cannot imagine going back. My LastPass subscription is among the most vital services I pay for and the sheer freedom of having to remember _one_ diceware-style master password instead of maintaining my own local database is just too nice.

I'm using banking software with a HBCI card and have set reasonable limits on all things like PayPal. So if you cracked my LastPass vault - good luck with that, 2FA considered - you'd be well able to ruin my digital life. But you would not get much out of it.

The attack surface I offer in total has shrunk a lot, too. Unique, maximum allowed length passwords for every unimportant little account and no need to memorise a single one.

It's to Web logins what pubkey auth is to ssh for me personally. Just such a freaking blessing.

<comment><USER13> > For me it was a case of thinking I know better.

I'm deeply curious: _why_? When virtually every reputable security practitioner on this site and others has echoed the advice to just use a password manager for years, how do you come to the conclusion that you know better than them?

If it sounds like I'm asking judgmentally, please don't interpret it that way. Your experience mirrors that of many others, and if I can understand how this line of thinking happens then maybe we can find ways to combat it.

This is just one battle amongst many where, despite endless warnings and examples to the contrary, people seem to think they are qualified to go against encouraged practice for password storage, password management, encrypting data at rest, encrypting data over the wire, etc. And in almost all cases, people come to the conclusion that they know better, when they absolutely do not.

<comment><USER14> >I'm deeply curious: why? When virtually every reputable security practitioner on this site and others has echoed the advice to just use a password manager for years

I think the disconnect is "perfect use" vs. "typical use".

With perfect use, generating a unique passphrase for each service and storing it only in your head is more secure than using any kind of remotely-syncing password manager. It's also more convenient - wherever you are, whatever you have with you, so long as you have an internet connection you can identify and verify yourself. You don't need your phone or an app or anything else.

With typical use, people use weak passphrases, reuse passphrases and forget passphrases, so using a remotely-syncing password manager is more secure, even if it's less convenient.

Some people (possibly wrongly) think they can achieve close enough to perfect use that they're better off not using a manager. Security experts know that virtually no one can achieve perfect use, so they recommend using a manager (which is almost certainly the correct advice to give to a wide audience).

But your apparent absolute confidence in the superior security of password managers, especially closed-source cloud-based password managers, seems to me to be overplaying your hand a little. The failure mode of a closed-source cloud-based password manager, even if very unlikely, is absolutely catastrophic.

<comment><USER13> > But your apparent absolute confidence in the superior security of password > managers, especially closed-source cloud-based password managers, seems to > me to be overplaying your hand a little. The failure mode of a closed-source > cloud-based password manager, even if very unlikely, is absolutely > catastrophic.

In fact it's you that's overplayed your hand.

Open-source vs. closed-source is a red herring. Did you download compiled binaries published by the authors of an open source project? Would you be able to tell if they had published backdoored binaries that didn't match the source? Would you be able to tell if they cleverly added backdoors to the source code itself? You might argue that such deception would eventually be discovered. Maybe, but by then the "catastrophic" scenario has already unfolded.

Similarly, if you're downloading and running a third-party deterministic password manager, open-source or not, you're giving the author of that project the ability to run arbitrary code on your machine. Unless you're running it in a container with no network access or access to storage, the failure case is identical — regardless of what the software claims to do on the label, it may do something wildly different (e.g., send all of your passwords to the author).

</comment></comment></comment></comment></comment><comment><USER15> I have an irrational(?) fear of vault password managers. I see it as a single point of failure.

Furthermore, the more "useful" they become, with browser extensions etc., the greater the attack surface becomes.

Because of this fear, I generate random passwords and memorise them, which is not ideal.

<comment><USER16> > the more "useful" they become, with browser extensions etc., the greater the > attack surface becomes

Also, the more popular the password manager becomes, the more valuable cracking it becomes. One exploit can yield the email, banking, workplace, confidential document, and other passwords for many millions of people. If you are an attacker, it would be worth it to have the exploit on file, proactively, for the next time you attack someone using that password manager.

<comment><USER17> This is only true for cloud based password managers. I recommend using 1Password or KeePassX with Dropbox.

<comment><USER18> Maybe I'm paranoid, but it still doesn't feel "safe" to me. Let's assume that KeePassX is truly unbreakable at the moment. I still fear losing my kdbx file, as if someday it will become vulnerable (maybe for technical reasons, or maybe just because of master-password exposure) I'd lose much more than any single of the accounts there: even if passwords there will be outdated already, it will be exposed that all these accounts belong to one person with known identity. All bank accounts, credit cards, email addresses, messengers, accounts on some shady forums. And if passwords are not outdated — oh my God…

It may be unlikely, but it's still putting all eggs in one basket. Just one failure, and you are truly fucked.

<comment><USER19> I guess you have to balance the probability of that kind of breach in Keepassx against the probability of fucking up and forgetting a password or reusing passwords (I still see this) across multiple services.

If you have an eidetic memory and can remember 20 digit random passwords for every service after securely generating them then keepassx increases your risk.

If however you behave like a 'normal' user and use the same one or three passwords on everything I'd estimated keepassx improves your security.

<comment><USER18> FWIW, I do use a password manager. But what you say is pure speculation. I don't see any formula for how should I estimate risks here, and the common narrative amongst security folks is "hooray password managers!". I'm often giving that advice myself, but honestly, I'm doubting it more and more.

The truth is that I don't give a fuck about losing 90% of accounts I use (and I guess I'm not the only one). Many of them I could even give you myself as a birthday present. Using password manager as a rule of thumb would imply that these accounts are as important as the most important ones. Which is nonsense. Even if we discard all the disposable accounts, I still doubt that losing your twitter would hit you nearly as hard as losing your main email account or bank account.

However, exposing that all these trash accounts are _mine_ might make me feel uncomfortable.

If that makes sense, then we must actually stop using the rule "password managers FTW" and start using the rule "consider how important is every given account to you, and treat it accordingly, chosing between several kdbx files". Which is much more complicated rule, obviously. I would even say it creates much higher mental load than remembering several sufficiently complicated passwords.

</comment></comment></comment></comment></comment></comment><comment><USER20> I thought I'd make an account on contribute on this issue as the author of a (probably pretty bad) password manager [https://slaymaker1907.github.io/password/](https://slaymaker1907.github.io/password/), source code at [https://github.com/slaymaker1907/password- hasher](https://github.com/slaymaker1907/password-hasher).

There definitely is an issue with some websites having strange requirements, but the way I get around it is keeping an drive sheet with all information used to generate the password (except for the master password of course). This does add some state, but I find that for common passwords I memorize the method of generation very quickly.

There is a central point of failure if the master password is compromised. However, this can be mitigated by first choosing and memorizing a very strong master password as well as versioning passwords by storing the name of the master password used with the rest of the info (though obviously not the master password itself). Additionally, I find the threat model under which such compromises to not be very convincing assuming you choose a strong master password compared to the common case of simply needing to change a password key on the site from linkedin1 to linkedin2 in case of a password database breach.

One weakness of password vaults is that they don't have the advantage of working without access to the vault. While my method can store state as mentioned above, it is very easy to memorize this state, particularly for common/important passwords and has actually saved my bacon before.

Finally, something that I think is a significant strength to a manager but a weakness for managers is that I can and do use my manager for passwords that I need to type out, most often using a feature that translates the password into a password similar to a diceware password (I use a significantly shorter dictionary since dictionary length does not affect the entropy density of a password very much and it makes them easier to type/remember if only using common words). Using this feature, I've been able to create separate passwords for my desktop, laptop, and phone that are both easy to remember as well as having good entropy (when I compute entropy I do assume that an attacker knows the method of generation).

</comment><comment><USER21> I don't agree with the author on many of his points. 1 and 2 are "merely" convenience features. Sure, those things make a truly stateless password manager harder to use and a very niche tool, but they're by no means fatal flaws. 3 is a good argument, but storing existing secrets is by definition out of scope for password generators. It is a usability problem, which makes using a truly stateless password generator as the only password manager harder, but still not a fatal flaw. The fourth one is in my opinion the only one which could be called a fatal flaw. It's probably the thing that has to be considered the most before using a master secret password generator. The hyperbolical title annoys me, but what annoys me probably even more is that the author then recommends (not directly, mentions as his personal choice, but that counts as a "seal of approval" for me) a closed-source cloud password manager, which could possibly be less secure than a password generator.

<comment><USER22> > _Sure, those things make a truly stateless password manager harder to use > and a very niche tool, but they 're by no means fatal flaws._

If the Deterministic Password Generator does not generate a valid password for a given site, it's certainly a fatal flaw for that site, and a usability nightmare - now I have to remember which sites aren't supported and keep a vault anyway.

And I guess point 2 isn't a fatal flaw until you need to change a password for whatever reason, but after that it becomes quite a problem.

<comment><USER21> We both seem to have a different view of what a "fatal flaw" is. For me (especially when talking about a computer security tool), it means a very serious security vulnerability and nothing less. You seem to have a more relaxed view, accepting things that create a bad user experience as fatal flaws, too.

<comment><AUTHOR> Security isn't an end in and of itself, it's a means to an end. A tool which delivers on security but isn't usable still fails to fulfill its purpose, in the same way an unplugged computer is both secure and useless.

I know there's a group within the security community willing to tolerate poor user experiences, or wear them as a badge of honor, "the price of security" or so to speak. But often I find these are the same people scratching their heads wondering why OpenPGP encrypted email hasn't seen more widespread adoption, or why the Web of Trust failed (or perhaps they think it succeeded), while at the same time bemoaning successful encrypted chat systems like WhatsApp and Signal.

I would argue that user experience is just as important a consideration as the security properties of a tool.

<comment><USER12> I couldn't agree more. Getting smart but non-nerd friends set up with OpenPGP is truly an eye opener. The rate of adoption is terrible because of that and nothing else.

Even with a GUI like Enigmail, I needed hour long explainathons to make it work for these friends. Smart, borderline brilliant folk.

The same people now use WhatsApp with encryption and don't even know it. That's what a good crypto UX looks like.

I'd love for a google-free, proprietary-free, facebook-free alternative to exist but if the alternative is painful hours of setting up encrypted mail only to have it cease working after two weeks because the user forgot their passphrase, I'm gonna say I don't care too much.

</comment></comment></comment></comment></comment><comment><USER23> I use a deterministic password generator so all I have to remember is my master password and default password scheme to get access to all my critical accounts (critical ones generally don't have silly password requirements). If I were using something that stored passwords and lost my database somehow, I'd lose access to all of those.

<comment><USER24> "lost my database somehow"

I have mine in Dropbox and at least 3 devices. I'm really not concerned I'll lose it.

<comment><USER23> If I were out of country and my laptop got stolen, for example, I'd lose it. Sure, you can use a separate password for your Dropbox/email/etc. that you remember, but that's pretty much the same thing as generating based off a master password.

(With the exception of your master password being brute-forceable based on any password you generate, but you just use a master + KDF combo that's unbreakable to prevent that.)

</comment></comment></comment><comment><USER25> I agree with the author's opinion with the master password being compromised, you're done. I have found an elegant solution for managing my passwords with [http://masterpasswordapp.com/](http://masterpasswordapp.com/) the iOS app is a breeze and I also use the export feature to backup my login names, hashed passwords, custom passwords, and stored secrets. This app in particular solves the author's third point. For the second point, I save the iteration X of a password as a stored secret when I need to revoke a password. It doesn't sacrifice the user experience in my opinion.

</comment><comment><USER26> Another flaw: deterministic password managers are inherently vulnerable to brute forcing-- it's basically like sending your password database to every site you log into. Ideally they use a very expensive KDF, but I've seen implementations that use weak derivations like 10,000 round PBKDF2.

<comment><USER23> Use a master password that's impossible to brute-force, then. (128 bits.)

</comment></comment><comment><USER27> Do people really complain that size is an issue in syncing password data? The author of this article's file was 512 KB, personally mine is 10 KB. That's basically none.

</comment><comment><USER28> On a related topic, a number of Bitcoin wallets have moved to hierarchical deterministic (HD) addresses and they market that as a positive.

</comment><comment><USER29> This is a good one (from what I've heard) [https://github.com/habnabit/passacre](https://github.com/habnabit/passacre)

</comment><comment><USER30> When will we stop using passwords?

</comment><comment><USER31> The only deterministic password manager you need is your own mind. Come up with a set of password rules that are generic enough to accommodate all these issues. For example my deterministic password manager might be:

1\. random english wordx2 + first 4 letters of registered domain, all caps + remaining lowercase + number of letters in domain (integer) + symbols associated with digits of the integer digits

2\. If site doesn't allow special characters, remove them

3\. If site requires a shorter password than the generated one, trim the minimum number of characters from the front of the password until the criteria is met.

So, using my above rules my password for Ycombinator would be:

coppercopperYCOMbinator11!!

If the site restricts passwords to max 12 characters, it would become:

Mbinator11!!

<comment><USER32> > If the site restricts passwords to max 12 characters

The problem with this is that most sites are designed by idiots and don't state their pointless password rules on the login page - only on the 'change password' page. So you can be trying your coppercopperYCOMbinator11!! password and thinking "why the hell doesn't this work?", then after 10 minutes you give up and go to change it and see "Your password must be between 8 and 12 characters and contain a symbol." So infuriating.

<comment><USER31> That's very true. I forgot to mention that I also have a spreadsheet that has site-specific password rules so that I can do a lookup and see how I need to adapt my generated password.

Maybe what we really need instead of deterministic password generators is an authoritative database that tracks the password rules of all the different sites on the internet so we can easily look it up and/or publicly shame companies with asinine password policies.

<comment><USER22> > _I forgot to mention that I also have a spreadsheet that has site-specific > password rules so that I can do a lookup and see how I need to adapt my > generated password._

So you do have a password manager.

> _Maybe what we really need instead of deterministic password generators is > an authoritative database that tracks the password rules of all the > different sites on the internet_

I'm glad to hear you volunteering to look up all of these policies, and keep them up to date!</comment></comment></comment></comment>


Show HN: Napkin app, calculator meets notepad (Android) - <AUTHOR> https://play.google.com/store/apps/details?id=com.waffleware.calc <comment><AUTHOR> A friend of mine had the idea of combining a text editor with a calculator. Turns out that being able to annotate your calculations makes them much more valuable and reusable. Whilst the idea itself isn't completely new I was curious if and how it could work out on mobile.

</comment><comment><USER2> what are the in-app purchases?

<comment><AUTHOR> The app is free (also ad-free.) The in-app purchase merely resembles a buy-me- a-buy approach.

<comment><USER2> thanks! but i think its worth noting somewhere on your site what exactly the optional purchase is; without that info it seems a bit sketchy to read the app is free but see a message from google that "something" in the app could cost $7.99 -- that stopped me from downloading it.</comment></comment></comment>


2019-20 flu season: 0.02% total excess deaths in Europe - <AUTHOR> EuroMOMO tracks mortality statistics from european countries.  I went to EuroMOMO.com, and looked at their charts.  By adding up the number from 2019 week 40 to 2019 to week 20, which covers the usual flu season, I came up with 100,804 excess deaths.  The same period in the 2017-2018 winter season gave me 59,718 excess deaths (the 2018-19 flu season was less deadly).
The population of countries that participate in EuroMOMO is 468 million people.  This tells me that the excess death rate this flu season was 0.022%, compared to 0.013% for the 2017-2018 season.
This was a bad season, but not apocalyptic by any means.
Should health agencies take credit for a successful intervention, or is covid-19 just not as deadly as first feared? <comment><USER2> Whether you believe that COVID-19 is more deadly or not, there is no disputing the horrendous after-effects that up to 40% of survivors are suffering. Every physician is saying the same thing: You do not want this virus.

<comment><USER3> 40% of all survivors including the people who had no or mild symptoms?

<comment><USER4> The citation needed anti-science crowd comes out hard in any HN COVID-19 discussion. I don't know about you guys but the only sources I need are Joe Rogan and Elon Musk. Scientists are just trying to mind control us with scary science!

</comment></comment></comment><comment><USER4> You've done some math.

But consider that virus scientists, epidemiologists, front line health care workers, and hospital administrators have concluded that COVID-19 is much worse than the seasonal flu.

Your math does not explain full ICUs and government officials begging for medical ventilators. It's not the flu.

Have you considered reading the thoughts and opinions of people paid to be experts on this?

<comment><AUTHOR> I agree that covid-19 symptoms are much worse than the flu, and that hospital ICUs sometimes strained to keep up with the number of cases. But ultimately the number of deaths has to be considered as a kind of ground truth.

On officials begging for ventilators: I did see NY state governor Cuomo's press conferences, where he complained about shortages of ventilators. I think that he is fascinating and charismatic. I would vote for him. But it's widely acknowledged that 80% of people on ventilators eventually die. Ventilators themselves may be deadly, at least for the kind of pulmonary edema that covid-19 causes. Much better survival rates have been reported by laying patients face down, with oxygen, and without forced ventilation. It's quite possible that some of the deadliness of this disease can be put down to misguided treatment protocols.

This disease is dramatic and sometimes deadly, but it's not the Spanish flu by any means. There has been a lot hysteria and over-reaction.

</comment></comment><comment><USER5> URL is [https://www.euromomo.eu/](https://www.euromomo.eu/) (not .com)

<comment><AUTHOR> This is true.</comment></comment>