O'Reilly launches venture fund: O'Reilly AlphaTech Ventures - <AUTHOR> http://radar.oreilly.com/archives/2007/02/oreilly_alphate.html <comment><USER2> As someone who has been funded by O'Reilly AlphaTech (I'm one of the founders of Wesabe), I would recommend them highly. I've known them for many years, and Mark and Tim both worked with me on my last startup (Popular Power).

I can say a lot about why they like them, but when I was talking with a CEO recently I mentioned this Richard Nixon quote: "When you win, you hear from everyone - when you lose, you hear from your friends." I've heard messages of support from these guys in both instances. If you're looking for someone who will understand your idea and back it or not for the right reasons, and then support you all the way if they invest, I think OATV is a fantastic option.

\--Marc Hedlund

</comment><comment><USER3> We know these guys pretty well and we like them. They understand hackers better than most VCs.

<comment><USER4> I assume they are closer to the traditional VCs in their model and not as much seed funders like Y Combinator. Is that your understanding as well Paul?

<comment><USER5> Based on the fund size they are discussing, I'd say that's a pretty good bet. For the startup community, I think that's a good thing. While competition in the seed/angel space is fine and dandy, having a VC firm headed by someone has hacker-aware as Tim O'Reilly seems like a definite win.</comment></comment></comment>


Probabilistic Causation - <AUTHOR> http://plato.stanford.edu/entries/causation-probabilistic/

<comment><AUTHOR> Mentioned in another thread on the main page. A good article on how we determine what causes what from real-world observations.</comment>


The scientific reason you find that Momo picture so creepy - <AUTHOR> https://www.popsci.com/why-momo-creepy-scary <comment><USER2> I've actually literally never found Momo creepy. It's like it's trying so hard to be that it overflows and becomes goofy.

</comment><comment><USER3> Anyone got a link yet to bypass the Adblock at Popular Science?</comment>


North Focals glasses review: a $600 smartwatch for your face - <AUTHOR> https://www.theverge.com/2019/2/14/18223593/focals-smart-glasses-north-review-specs-features-price <comment><USER2> I just realized that if I could use the glasses for music seeking, or various podcast control, I'd probably buy those. That's the number one reason I look at my phone too, as the reviewer said.

That said, I'm horrified by the fact that my texts would be send to North's servers. This seems like another privacy breach just waiting to happen.</comment>


More housing is the answer to less transit - <AUTHOR> https://www.cityandstateny.com/articles/opinion/commentary/more-housing-answer-less-transit.html <comment><USER2> This article is written from the cluelessness of somebody confined to New York. As somebody who lives in one of the fastest growing areas of perhaps the fastest growing large city in the US this issue is incredibly simple.

The more housing there is the more people there will be and thus the more traffic congestion there will be. This is true regardless of availability of public transit or road size. Billions of dollars are spent here yearly to widen freeways and eliminate choke points but it still does not keep pace with the growth in population. The problem is due to numbers that are easy to calculate and simple to forecast.</comment>


Ask HN: Will Greece go bankrupt? - <AUTHOR>

Will Greece be saved by the EU (and/or go bust anyway?)? Will it be thrown out of the Union?<p>What do you believe/know/speculate about the future of Greece and especially the Euro?(I think a lot about this because I do not want to found a startup in a potential european inflation.) <comment><USER2> "If something can't go on forever, it won't" (some famous economist I'm too lazy to look up).

Of course that says nothing about the timing....

The fiscal policies of Greece are unsustainable. Ditto for some of the PIIGS (Portugal, Italy, Ireland, Greece, Spain). A bailout without an austerity program will only delay the end ... that the latter looks somewhere between unsustainable to a non-starter.

A bailout would be _very_ bad for the Eurozone, since it will increase the moral hazard for the rest of the PIIGS (well, maybe not Ireland). A failure to bailout Greece (now or later) will likely put the rest of the PIIGS in dire straits as their sovereign debt is put into question.

Greece can't make its creditors take an implicit haircut by devaluation as long as it uses the Euro. In the long run it's hard to see it both keep the Euro and not give the creditors an explicit haircut, i.e. they won't get all their money back ... which will make the continued borrowing they need harder to impossible.

I don't see any prospect for a soft landing.

However as d2viant implies, there's a good change that any of the above problems can be managed. The world is a rather open place ... things you have to worry about more than an inflation (which will only happen, at least any time soon, if Greece goes of the Euro, and then only for Greece) are problems like currency export controls.

E.g. if you're in Greece, you might find it impossible to pay e.g. Amazon for AWS services, they might impose controls on your ability to remove money from the country. On the other hand, if you keep enough of a presence outside of Greece including payments going into your company and then out to AWS you might be able to pull it off.

It's all very iffy, we just don't know how the various governments in question will handle these problems. Be flexible, try to keep reserves for problem, avoid single points of failure WRT to individual countries. Also don't obsess on inflation, there's enough deleveraging going on or the potential of that continued deflation is very possible.

<comment><USER2> One minor detail I forgot: European bank exposure to the PIIGS is very substantial. So giving them a haircut on Greek sovereign debt would be ... suboptimal (no doubt this is why Germany is playing ball for now after first saying no). Problem is, there are no good options left at this point.

</comment></comment><comment><USER3> Greece and Spain won't pay back. This was a calculated Risk, and a Lesson for the Banking System. What is happening in Greece, is a very well orchestrated show, to get granted €110bn aid, to avert meltdown. The only thing Germans can do is: REPOSSESS 170 Leopard 2AEX Battle Tanks from Greece, and 190 Leopard 2A6E Battle Tanks from Spain. U.S.A must REPOSSESS 170 F-16 Jet Fighters from Greece, … the rest is gone with the wind …forever … Greece must stop paying lucrative pensions with borrowed money, reform the free health care system, and cut down, 4 times the military budged. Greece's problem is too much debt. Greece has a budget deficit of 12.7% of GDP – meaning that the country is spending 12.7% more than the value of one year's economic output. Greece is no different to a serial credit card borrower who can't pay back his loans. But just like a serial credit card borrower, as long as Greece keeps relying on borrowed money to fund itself, the problem won't go away. It will just get worse. [http://www.defenseindustrydaily.com/Greece-in-Default- on-U-2...](http://www.defenseindustrydaily.com/Greece-in-Default- on-U-214-Submarine-Order-05801/) But don't worry; the ECB, the Fed or both will print the money. And all of us will share the pain, with our hard-earned money. Bad is never good until worse happens.

</comment><comment><USER4> Greece will only be bankrupt if they don't get bailed out again either by the EU, the IMF or both.

The measures demanded by the IMF & EU (which is necessary for political will & arguably 'right') will cause the economy of Greece to contract.

There has been much squabbling within the EU about how to structure a loan and the whole thing has been a mess given differences within the EU.

The stability of the Euro is certainly much on the minds of the Germans given their experiences with the mark and the loan can be challenged in the German supreme court if it undermines the Euro.

I frankly wouldn't worry about which way the Euro will go. Especially when compared to the problems other wealthy nations will face.

</comment><comment><USER5> the corruption in Greece is big that even the smallest government run department is infected so the only way out for Greece is either to deal with corruption which I think is impossible the other way to default on the loans and declare bankruptcy and go back to a devalued the greek dragma around 500 drs to the euro which will help the tours men industry and maybe will stop importing everything from abroad and start producing I want to go in a store and see a label made in Greece!!!!!!!!!!! thank

</comment><comment><USER6> If you have a great idea and think you can build a business around it, do it. Don't let macroeconomic issues that are out of your control influence your decision to go for it.</comment>


C and C++ Books You Wish You Read Earlier - <AUTHOR> https://zeroequalsfalse.press/posts/c-and-cpp-books-you-wish-you-read-earlier#.XIEOf_wLno8.hackernews <comment><AUTHOR> If you have any books you think we missed out, please let us know!</comment>


Show HN: Pbd – Protocol Buffers Disassembler - rsc-dev https://github.com/rsc-dev/pbd <comment> rsc-dev Hi,

Thank you very much for all comments.

I am very suprised for the feedback. I need to clarify my intentions for this project.

This tool is a side effect of my main project. I am working on hacking embedded device. During my work, I found out, that device is using Google Protocol Buffers to communicate with Android app and windows C/C++ application. It was my first time with protocol buffers. I was looking for any tool, which would help me analyze protobuf messages. It seems there is none, so I had to learn it by myself :P.

"Protocol buffers are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data – think XML, but smaller, faster, and simpler."

How it works: 1\. Developer wants to exchange data between different applications/systems. 2\. One describes data in human readable form in proto file: message Person { required string name = 1; required int32 id = 2; optional string email = 3; } 3\. This file can now be compiled by protoc. 4\. Generated code (Java, C++, Python) is then imported to an application. 5\. Develoepr can use this code to decode serialized stream.

Now - the most important thing. Protoc output code contains serialized descritor of proto file. This descriptor (in serialized way) is included in every application using protobuffs.

Once extracted (strings, debugger, any other tool), one can run pbd to disassemble it.

In short: Pbd allows to go from point 4. to point 2. Once descriptors are disassembled, one can rerun pbd to generate code and deserialize protobuffs messages.

Hope it clarifies it a bit.

This project is in beta. Further work depends on interest and needs. I am very happy to hear more comments and ideas. Thank you for your interest.

PS. Pbd name was chosen with premeditaion. It is a bit confusing, but hey - hackers need to be focused :P.

BR Rsc

</comment><comment><AUTHOR> A similar project is ProtobufDumper from SteamRE[1]. It's tailored to Valve games and Steam.

[1] [https://github.com/SteamRE/SteamKit/tree/master/Resources/Pr...](https://github.com/SteamRE/SteamKit/tree/master/Resources/ProtobufDumper)

<comment> rsc-dev Thanks - I will take a look.

</comment></comment><comment><USER2> Hey! This is pretty cool.

We worked on something like this for C# protobufs. Check it out:

[https://github.com/HearthSim/proto- extractor](https://github.com/HearthSim/proto-extractor)

I'd be curious to see if we can work together on this stuff.

</comment><comment><USER3> How does it infer the names of fields?

<comment><USER4> It looks that it requires either proto files or somethig like this - [https://github.com/rsc- dev/pbd/blob/master/examples/test.ser](https://github.com/rsc- dev/pbd/blob/master/examples/test.ser)

There is no way to infer attribute names from on the wire representation. In fact, there is no 100% sure way to distinguish between strings and embedded messages.

</comment></comment><comment><USER5> Unfortunate naming for a Python library. It conflicts with a python standard library module: [https://docs.python.org/2/library/pdb.html](https://docs.python.org/2/library/pdb.html)

EDIT: Misread this. My mistake.

<comment><USER6> the fact that you misread this isn't your mistake. it's still a bad name because it's so easy to misread.

<comment><USER7> I also read it as PDB, but in the sense of Windows C++/.NET debugging symbols.

I'd look for a name less likely to be confused with other existing things.</comment></comment></comment>


Leaked cables suggest China Access to Microsoft source used for cyber attacks - <AUTHOR> http://www.winrumors.com/leaked-u-s-embassy-cables-suggest-china-uses-access-to-microsoft-source-code-for-cyber-attacks/ <comment><USER2> I hope the Chinese never get access to the Linux or BSD source code that runs my computers.

<comment><USER3> The difference is that Windows code is closed. Microsoft has given access to that code to allegedly hostile individuals, but not to friendly individuals.

Bad guys can reverse engineer and read code. Good guys can only reverse engineer.

With *nix it's a level playing field, because both sides can reverse engineer and read code, and contribute code.

<comment><USER2> I wanted to give you a non-anonymous +1 on this. Your point about the level playing field is a great one.

My preference is obviously to just avoid the black boxes where I can, but it's not particularly surprising to think that the true color of the box is the inverse of the color of the hat.

</comment></comment></comment><comment><USER4> Meh. No doubt someone in the US government thinks this is a serious issue, but lack of access to Windows source code is little more than a speed bump for professional exploit developers.

<comment><USER5> We've heard these claims ever since MS started releasing source to certain institutions/governments, and my reaction has always been the same: Reverse- engineering non-obfuscated code is absolutely trivial, and can be automated 99% of the way. If you can find vulnerabilities in source code, you can find vulnerabilities in a binary. For some reason, no one ever seems to understand this...

<comment><USER6> I always assumed Windows binaries are heavily obfuscated, is that not the case?

<comment><USER4> The opposite is mostly the case; Microsoft even makes the PDB debugging symbols available for many of its core components.

<comment><USER5> Even for the bootloader, where the signature checks for the driver signing chain occurs. The MS symbols database is a goldmine.

</comment></comment></comment></comment></comment><comment><USER7> This could apply to any of the other state actors with NT source trees, it's not like Israel, France, US etc don't develop their own. China just does it a lot louder. Much of it probably gets bought from third parties anyway, it's just cheaper than developing your own. And microsoft isn't going to be able to sell into any sensitive state platforms without providing source code, for obvious reasons.

</comment><comment><USER8> When source code review is outlawed, only people outside your jurisdiction will review your source code.

</comment><comment><USER9> previous discussion

<http://news.ycombinator.com/item?id=1054791>

</comment><comment><USER10> Back in 1997-1999 it was fairly easy to get access to MS source code on the corp net. Esp if you were in Visual Studio or Windows NT (2000, XP, etc) team. Meaning pretty much anyone could get it. I had a local copy on my workstation I would study. Very readable code the NT 4 codebase. Everyone who wants a copy of codebase X can get a codebase X with a concerted amount of work. It will be impossible to stop this.

Having access to the source can give you insights into the various ways you can attack a system. It saves months if not years of hacking. Yes you can make exploits w/o the source. With the source it is a whole new ballgame.

Firewalls, MAC, separation of concerns, etc. With the proper virus one can bring the whole system down (pick your system).</comment>


So sue me: are lawyers really the key to computer security? - <AUTHOR> http://arstechnica.com/tech-policy/news/2011/07/will-your-employer-get-sued-for-your-security-screw-ups.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss <comment><USER2> I hold an unpopular opinion that lawyers and lawsuits are a great way to motivate companies to "do the right thing", where in this case the "right thing" we're talking about is protecting customer data.

Another great motivator for doing the right thing is knowing that customers will vote with their wallets. Unfortunately this isn't always a strong enough motivation because some markets don't have enough competition, or the cost and hassle of changing the companies you do business with is too high. (Don't you wish customers had left AT&T in droves over the NSA spying ordeal?)

That's where another force comes into play, which is government regulation. I lean libertarian, and although I think some regulation is an absolute necessity (especially on environmental issues) my preference is to have the least amount of regulation necessary. That brings us back to the attorneys. When a company like Sony screws up and exposes their customers' data, I'd rather see them get their pants sued off than have the government step in and regulate. Fear of being sued is a much more compelling reason to "do the right thing" than fear of breaking a law, which might only get you a slap on the wrist.

Do frivolous lawsuits exist? Yes, and they piss me off like the next person. Do scumball attorneys exist? Yes, and I hate them like you do. Ironically, I think some of _this_ problem could be solved with new laws, but I haven't really thought about it enough to more specific. (Maybe something along the lines of the loser having to pay the the other side's legal fees, but I can also argue against that from ten angles. I really haven't spent enough time thinking about how to minimize frivolous lawsuits to feel like I can say anything intelligent about it, other than to say that I bet something can be done.)

Anyway, my point is that companies have different forces that can/should/do motivate them to provide data security, and the threat of lawsuit is an excellent one, right up there with fear of losing customers and fear of government regulation. Too much of any one of these forces is bad, but we wouldn't have a healthy mix without attorneys and their lawsuits.

<comment><USER3> It's going to work for about a year, then when there is a security failure the company will turn around run git/svn blame and sue the individual employee. Hopefully the laws would be written so that when you post security best practices in your TOS and the customer does not follow them the liability can be mitigated (eg. don't reuse passwords on multiple sites)

Re: AT&T where are they going to go? T-Mobile?

<comment><USER2> _It's going to work for about a year, then when there is a security failure the company will turn around run git/svn blame and sue the individual employee._

You bring up an interesting topic which is an extension of the first one. If the forces motivating a company to do the right thing are 1) desire to gain and not lose customers 2) desire to not be penalized by the government and 3) desire to not be sued, then what motivates an employee to also do the right thing? (I'm generalizing the question because this applies to so many things, but I'll switch back to talking about "building secure software" as a specific example of "doing the right thing".)

A software developer should be motivated to build secure code because of these motivators: 1) Desire to build or maintain a good reputation among peers 2) Desire to not get fired 3) Desire to protect employer from harm 4) Desire to protect customers from harm 5) Desire to just do things the right way for the sake of preferring good things over bad. (There's probably a more elegant way to phrase that last one, but it's like how an architect might fight against proposed changes to a blueprint for the sake of the building itself.)

To err is human, and companies are composed of humans. When a company hires a software developer, they are inherently taking on the risk that this human will make mistakes, so I don't think developers should be legally liable for bugs or vulnerabilities in their code unless they are incredibly egregious or intentional. It's the company's responsibility to anticipate the possibility of bugs and vulnerabilities, and to mitigate that risk by hiring good people, and by having good policies, procedures and training. (By having code reviews and conducting security audits, for example.)

I'm sure we're in agreement that developers shouldn't be sued for mistakes in their code, but whether or not they _can_ be sued for honest mistakes is another question. I don't know what the law has to say about that, but if employees aren't already protected against lawsuits for non-egregious mistakes then that should be changed.

 _Hopefully the laws would be written so that when you post security best practices in your TOS and the customer does not follow them the liability can be mitigated (eg. don't reuse passwords on multiple sites)_

I totally agree. Customers have to bear some of the responsibility as well.

 _Re: AT &T where are they going to go? T-Mobile?_

My point exactly! Going back to three motivators I mentioned for companies to do the right thing, AT&T knew it wouldn't lose a significant number of customers over the NSA spying issue because there's not much competition in their space. (That and apathy, unfortunately.) Also, they knew they wouldn't get penalized by the government for, well, forking data over to the government. That leaves the only viable option being to sue AT&T... except that power was taken away by retroactively granting AT&T immunity by FISA. ( <http://en.wikipedia.org/wiki/Hepting_v._AT%26T> ) This is what makes the AT&T/NSA issue so upsetting. All motivations for AT&T and other telecoms to "do the right thing" have been taken off the table.

</comment></comment></comment><comment><USER4> _Still, Halderman warned that too much litigation could cause companies to become excessively security-conscious. Software developers always face a trade-off between security and other priorities like cost and time to market. Forcing companies to devote too much effort to security can be as harmful as devoting too little._

While I suppose there is always some risk of obscure, exotic vulnerabilities that take substantial creativity to find, the breaches that have been making the news lately have not been of this kind; they've all involved "kindergarten security" as Bruce Schneier put it. Securing applications against these kinds of exploits is not difficult!

<comment><USER5> Yes it is. Most devastating bugs are actually trivial. English or metric units? The security problem isn't how hard or simple any one bug is; it's how to eradicate them across entire immense codebases, while still shipping with the market.

<comment><USER6> The vulnerabilities which I'm aware of in regards to the Sony breaches were all SQL-injection based. There are readily available tools which perform automated tests bombing a website with various SQL injection techniques, which I imagine is how they were found by the attackers.

It is negligent to run a website that contains the personal information of thousands+ people and not run a tool like this or do similar analysis to _identify_ these problems. Fixing them may be another matter (although for SQL injection it should be a matter of sanitizing all of your input and parameterizing all of your queries), but I think the ball is in their court in terms of not knowing about them.

<comment><USER5> The idea that every team (in-house and outsourced) in Sony that owns an application has a security resource, or that the central resource in Sony knows about every application, does not square with the reality of _most_ of the companies I've gotten to know.

This is the same problem I mentioned upthread (trivial bugs sneaking into huge codebases), just generalized out one level.

The original comment I responded to asserted that "securing applications against these kinds of attacks is not difficult". Again: yes it is. I know companies who spend huge amounts of money trying to defend against simple attacks, and they are not 100% successful. It isn't just "not not difficult"; it isn't just "difficult"; it's one of _the hardest_ problems in IT.

</comment></comment></comment></comment><comment><USER7> The class action suit against Dropbox sounds frivolous... the claimant says she wasn't even aware of the possible security lapse until days later when she read about it from a news source. That's on top of not being notified by Dropbox, which means her account wasn't accessed during the problem window. What possible damages could she be claiming?

<comment><USER5> 1\. That the unfair competitive practices Dropbox engaged in when they told people untruths about their security caused her and people like her to select suboptimal storage solutions, which is a claim that arises from a California unfair competition law.

2\. That some people in the class had their privacy invaded, the precise number of whom might be found during discovery.

3\. That the negligence involved in opening this hole in Dropbox incurred damages at customers for instance by requiring them to take time off to move files off Dropbox.

4\. That Dropbox breached its warranty and owes its customers a refund.

Happy to help.

</comment></comment><comment><USER8> Rather than drag the lawyers into this, (just more paperwork)why don't we look at it from the perspective of the tools we are using? For SQL injection, what stops databases from building an input scrubber that sits between the database and user input and scrubs input to block SQL injection? Or for that matter, why don't we see languages and frameworks used for web development touting the fact they include robust security that's easy to use?

Part of it is culture, we actually have to care about security and part of it is ease of security. If we build tools that make it easier to create a (more) secure environment and push it by default, we can at least make improving security easier.

<comment><USER5> Nothing stops them from doing that. But they don't. Now what? See, we're back at the premise of the article.

<comment><USER8> Partially because there hasn't been user demand for it to date. Such a change will require the programming community to start clamoring for tools to make things secure. We want speed, easy to use syntax, things like that.

<comment><USER9> You'd be hard pushed to find a framework or language that didn't have, and recommend, ways to access a database that guarantee injection can't happen. If people choose not to use them, there's not a whole lot you can do.

That's just a small part of the puzzle, though, and not every security issue would or could be fixed by solutions of that nature. There is no fix, other than developers being informed, capable, and diligent.

</comment></comment></comment></comment><comment><USER10> I have always believed that it will ultimately be the insurers (through liability insurance conditions) who enforce server security, rather than courts and lawyers. I don't see this as a bad thing.

<comment><USER5> You should. If insurance is going to solve this, wait 15 years and we'll all need certifications to commit code.

<comment><USER11> Something is definitely going to change.If it's not insurance driven, then it will be legislated for some types of code.

In most states you need a license just to cut hair. Software can easily cause more damage than a hairdresser.

</comment></comment></comment><comment><USER12> The lede is rather disappointing on this. These lawsuits are for _services_ being breached, not being the author of _code_ that gets breached.

</comment><comment><USER13> Current computer security for companies is analogous to medieval castles: large crude systems with large support requirements and little concern for the security of small individual contributors. Once computer infrastructure effectively moves to less crude large scale centralized forms and provides effective minimal security for every small contributor will the key be available.

My home is my castle; my community infrastructure supports that implementation. Therefore the community does not require a castle. When personal computing equipment is equally robust, large computing systems will not be as necessary and neither will the legal implementations.

Laws and lawyers at the individual level are the key to computer security.</comment>


Justice Department seeks mandatory data retention - <AUTHOR> http://news.cnet.com/8301-31921_3-20029423-281.html Criminal investigations "are being frustrated" because no law currently exists to force Internet providers to keep track of what their customers are doing, the U.S. Department of Justice will announce tomorrow. <comment><USER2> A no-doubt unfunded federal mandate, forcing ISPs to retain a massive amount of data, and participate in violations of the 4th amendment. And of course, the supposedly freedom-loving republicans now in control of the House will just line up right behind it. (FWIW: I'm a republican).</comment>


Ask HN: Do startups need analysts? What can this 26-year-old semi-generalist do? - <AUTHOR>

I'm looking for advice, suggestions and/or guidance from the learned community here.  This is a throwaway account, as I'm a contributor under my real name…
A quick profile: 26-year-old CS graduate. Two jobs to-date: Five years in a medium-sized specialist financial organisation and just starting my second job in one of the largest banks in the world.  I started my career as a developer before realising that it was not where my expertise lies.  I'm now a business/systems analyst… and a damn good one, even if I do say so myself.
However, I prefer to think of myself as a generalist: I love marketing, design, psychology, and hundreds of other subjects.  I read and write voraciously on these topics in my free time.  I can feel the $75,000 a year sucking away slowly at my soul and have always loved the startup scene.  It's always been a long-term goal, but for the last couple of years I've been eager yet unsure how to proceed for a relatively simple reason:
I read advice to those wanting to go into the startup world here often. However it is almost exclusively aimed at programmers.  Nobody seems to discuss analysis.  Is this a field that only small-to-large (non-lean) companies employ?  Are we needed in startups?
For reference, I've found these slightly helpful but they still show a programming bias: http://news.ycombinator.com/item?id=1447747 (and the comment http://news.ycombinator.com/item?id=1448145) and http://news.ycombinator.com/item?id=1438489 <comment><USER2> At a start-up there are at most only two roles:

Can you build it? Or can you sell it?

In tech start-ups, building it means coding, and that might be only role early on.

"Selling it" is broader than pure sales (E.g. Selling it to investors, to non- paying users, to bloggers, etc.), but you need a track record in selling (I.e. Not "analysis" or "marketing").

There's a reason why there is a programming bias: programming is 90% of the work at an early stage consumer web company. So get back to coding, or try something other than start-ups, because there is no job for an 'analyst' at a start-up (or a community manager, or a head of product, or a COO, or any other job that isn't building or selling).

<comment><AUTHOR> Well, sales isn't a million miles away from some of my responsibilities now. Given that I couldn't build any of my ideas within even a half-decent time- frame I guess I'll need to co-found with a decent coder if I'm looking to start on my own.

For other stages I guess I'll need to expand on any sales-type work I do now while concentrating on my more general business skills.

<comment><USER2> Actually, to be blunt, if it's not _sales_ it might as well be a million miles away.

Startups need people who build, who create, who do. Things like "strategy", setting up deals, introductions, "almost sales", etc. are, by themselves, worthless at a young company.

My advice to you would be this:

Learn to code, or, don't do a tech start-up.

I think it's a little bizarre that people without technical skills (or startup skills) feel compelled or even entitled to start a tech company. These are specific, hard skills (not unlike law or medicine), and if you don't have them you need to develop them or find another line of work.

You could still start a "technology-enabled" company, like HuffPo (a media company), or Gilte (a fashion retail company), but you should probably have specific domain expertise in the non-tech vertical that you want to work with.

If you want to "start the next Facebook", though, (I.e. build a scalable, virtual product) then I have news for you: if you can't code it, you can't do it.

<comment><AUTHOR> _"I think it's a little bizarre that people without technical skills (or startup skills) feel compelled or even entitled to start a tech company."_

Don't worry, I have no such ideas of grandeur, only ambition. Although the lack of startup skills shouldn't be a barrier to starting a startup, right? After all, isn't that the best way to get the skills?

As for technical skills and tech startups: I agree, and this isn't strictly what I'm looking for, anyway. I have enough tech skills to hire a good programmer and to do every-day coding work after the initial core of a system is completed (by someone with better skills than me). Luckily, knowing this is an advantage: it puts me a step ahead of the people in my shoes who don't realise this.

That's great advice in terms of tech startups vs. tech-enabled startups. Thanks for that.

I'd be interested in your thoughts on roles such as 'advisor'? A friend of mine started a small tech company a few years ago and asked me for some advice. Having a good understanding in the theory (that's the CS degree doing its job) I could tell him what was needed and some possible issues... but I couldn't _do_ it. That was enjoyable and worthwhile for all involved. I've no idea how to evolve that, though.

</comment></comment></comment></comment><comment><USER3> I once had a short conversation with Max Levchin (of PayPal fame) and the one thing he said that stuck in my mind -besides all the drivel about how Slide was going to change the world- was that 10% of a start-up's workforce should be metrics people, obsessed with measuring the company performance i.e. if you have a ten person start-up, at least one should should be an analyst, otherwise he said, the company is essentially flying blind.

From my own experience, if you can not only master the technical side of working with metrics, but be the kind of guy who can actually ask intelligent, relevant questions and structure them in a way that gets meaningful answers from raw data, then you are worth your weight in gold to any start-up.

<comment><USER4> I'd just like to leave a comment here, but I wonder if you misunderstood him. It seems more practical to me that every employee in a startup should dedicate time to metrics, and probably more than 10%. For instance, at the last startup I worked for, the CEO put together metrics useful for VC conversations/sales metrics etc. The CTO put together metrics on bug fix flow/hardware throughput etc, the VP of CS put together metrics on turnaround time on customer issues etc. Our architect kept metrics on time based data throughput.

I think it's a poor use of recources to dedicate one person to do all of that. The people steering the company at that stage should have a total hands on feel for the data and a level of indirection seems unnecessary.

I'd like to hear back from founders on this. Were you tracking metrics yourself? Do you think you were more or less effective that way?

</comment></comment><comment><USER5> To answer the title directly, found a company :)

With a background in CS you have the functional hacker skills needed to create a first version of something, but you say your energy lies in marketing skills, so you know what 'something' to build.

I see this as one of the most powerful combinations seen in founders: the skills to get things done, and the soul to see the big picture of what problems people need solving.

On the flip side, the problem you have joining in with another startup is that the founders are often great generalists who need specialist help. Therefore a business/systems analyst is not an obvious fit with a startup, where the hacker-founders shoot first and measure later... at least until they've proven there is _something_ there and they can mature their processes and goals.

<comment><USER5> That said, one huge area of interest would be to (re)specialize in "user experience measuring" to drive product iterations (similar to the hugely successful Sean Ellis). All startups are concerned with understanding their customers - and most suck at it - which would make such a role pivotal in startup success.

</comment></comment><comment><USER6> What is a systems analyst? I've never known what that title meant. What do you do all day? This is an honest question. Sometimes I wish I could move back to the Midwest, but there are few (no) job listings for "hackers" in my home city. There are many for "systems analyst."

<comment><AUTHOR> From my experience in the field, an analyst's responsibilities range considerably between companies (as does the title: information/business/systems analyst).

My work is an almost perfect mix between what a business analyst and a systems analyst does, as defined in Wikipedia [1,2].

I spend 50% of my time speaking to people, 50% documenting and modelling requirements and systems. The people I speak to are either internal business strategists or external clients (large corporations). In my discussions with them I need to figure out their needs for new or existing systems and how this will be implemented.

To some this may sound boring, but I find it fascinating: the difficulty and enjoyment of the job increases exponentially with the complexity of the systems involved (perfect when you're in finance).

Anything else, just ask.

[1] <http://en.wikipedia.org/wiki/Business_analyst> [2] <http://en.wikipedia.org/wiki/Systems_analyst>

</comment></comment><comment><USER7> I am a corporate generalist who is transitioning to software sales with no real experience in the field. The only thing I really understand is what our clients want because I was one of them. Don't categorize yourself. If you are passionate about a startup, it will show, and you can sell it. I would take the advice of noahc and start pitching your idea to companies who would want it, ask how much they would be willing to pay for it and hold them to it. "Bootstrapping your business" is a good book and describes how Greg Gianforte sold a product before he had one.

<comment><AUTHOR> "Don't categorize yourself." Good point. I should let others do that, if they so desire.

I am passionate about it and when the need arises I am able to get this across. I'll take your advice (and noahc's) and pitch what I can do, if only to get some feedback to iteratively improve myself and my skills for the future. Being a corporate generalist is an asset in some respects as there are things that I'm good at that are in demand. I need to work on identifying this and selling it, I guess.

'Bootstrapping Your Business', ordered.

</comment></comment><comment><USER8> Consider getting in touch with a venture capital firm that specializes in technology startups. Often, it doesn't make sense for each company to have a full-time analyst. Instead, it makes a lot of sense for the VC firm to have a handful of analysts that work part-time for a number of the portfolio companies.

I've worked at a couple VC-funded startups where the VCs had us hire one of their analysts part-time. The only catch is that you must prove yourself to the VC firm first, which usually requires a strong track record and good networking skills.

</comment><comment><USER9> You should have no problem finding a job, but you need to decide where you want to be. Something lead you down the path that planted you in a banking environment in the first place. The issue might be that you don't like working in an environment like that as a programmer or that you like the security of working for an environment like that. If that is you then own it. If not then there is life after the 9-5 corporate culture for you. For starters, you are a technical person who wants to do marketing, design and psychology. If that is what you want to do then you have a few really good options. You can work as a product manager (though this is something that you may have to get more experience to do well), as a designer or user interface developer (there is a line somewhere between programmer and user experience architect that many people find to be comfortable), or as a technical marketing person. The technical marketing role might be one of the most rewarding to you based on your experience to date. You have to be able to work with lots of data and be very technical, but you still have to get into the strategy and execution. There is a lot to learn and do there. Whatever you do - good luck. If you would like to chat about this offline I'm @jobmatchbox - send me a note and we can go from there. I know a few people who might be interested in talking about their experiences with you.

</comment><comment><USER10> The reason why advice here is almost exclusively aimed at programmers is because HN is bias towards startups that make stuff that are byproducts of the software discipline.

Startups that focus on Web/saas/cloud are getting a lot of attention lately but by no means is this your only path. Maybe consider a career arch that will value what you would like to focus your energy (research, writing, & marketing)?

For example, I've notice a growing trend of upstart industry analysis boutique shops that are taking market share from the Gartner/forrester/Juniper research mafia. Some examples are redmonk (developers) and altimetergroup (social media). The high value workers of these companies are the analysts (that like tech) and not the hackers.

Bottom line is don't limit build/succeed of a startup to just being a hacker.

</comment><comment><USER11> _I'm now a business/systems analyst..._

I hate to break the news to you, but you describe yourself with a job title that's pretty much exclusive to the enterprise world. For the most part, start-ups don't really have a place for "business/system analysts". Let me explain...

School of Thought A: Call it SDLC (Systems Development Life Cycle), the project approach, or the waterfall approach goes something like this: Define a need, conduct analysis to answer the question "What", conduct design to answer the question "How", program, test, program, test, compare to the Functional Specs from the Analysis Phase, conduct User Acceptance Testing, promote, deploy, repeat anything as required. The more rigorous the documentation and project management, the better.

School of Thought B: Build something ASAP. Get it out there ASAP. Get feedback ASAP. Iterate indefinitely.

For the most part (I'm sure there are many counter-examples), enterprises employ School of Thought A and Start-Ups employ School of Thought B. There simply isn't a need for systems analysis in School of Thought B. By the time you're done analyzing, someone else is servicing the customers you wanted.

My advice: Combine a love for building stuff with your love of systems analysis. They go perfectly together. In fact, we now have a name for that: "programmer/analyst".

The systems analyst who can code is a better systems analyst because he can test/evaluate his ideas.

The programmer who can conduct analysis is a better programmer because he knows what to work on.

This may not be what you wanted to hear, but you're in a perfect position to do both, so do it.

<comment><AUTHOR> This is exactly as I suspected, so thank you for confirming this.

"The systems analyst who can code is a better systems analyst because he can test/evaluate his ideas." This is something I have found from my personal experience and I'm glad I had that background. It truly has helped. Anyone reading this can count this as solid advice.

Moving into programmer/analyst territory is something I've considered only briefly and I'll look at it in greater detail. By brushing up on my dormant programming skills I guess the worst that'll happen is I'll become better at my current job. Never a bad thing.

<comment><USER12> I'm a programmer/analyst at a startup. It is a fun job. I'm always jumping between tasks and have a million things going on all at once. For me, the job is ~70% programming, ~25% analysis, ~5% other. That will certainly very depending on the company and responsibilities, but thats probably a good model of the work from what I've seen. If thats your cup of tea (sure is mine) then I would say this would be a great way to go. There are downfalls though; if you go the startup route that is. More then likely you will be making less then corporate and the hours may be more erratic to, but that depends on corporate culture. I would say give it a shot if your curious.

</comment></comment></comment><comment><USER13> If I were you I'd contact a lot of the smaller startups you hear about on here and see if they need someone to take care of their Google Analytics, especially integrating Facebook Insights data, conversion analysis/funnel, short link campaigns (inbound from Twitter) etc. Propose A/B testing scenarios and work with their engineers to make it happen.

Produce real-world reports and suggest next steps. Be sure to "own" the data and branding by producing your own Excel spreadsheets that contain an amalgamation of all the different data sources, and understand their business enough to personalize it to their industry, i.e., ecommerce revenue vs. freemium signups lost to competitors.

Most importantly: be sure to budget your time properly so you can bill accurately.

</comment><comment><USER14> Analysis is a hot field, so although most startups don't need a full-fledged Business Analyst your knowledge should enable you to spot an opportunity in this sector and to use your knowledge to create something to make analysis for companies easier - or for other analysts. If you are such a fine one and your fellow analysts are not, what can you do, to make them better at their job?

You still need a programmer if you want to create some software, but still you'd have quite a place in a startup as the entrepreneur developing the idea and the business.

<comment><AUTHOR> This is something I'm currently looking into. I have actually spotted a market for something that will make a small aspect of analysis easier. In discussions with analysts at other big companies I notice that they also struggle with the same issues.

There is a lot of competition in the area, but the products are all from bulky enterprise applications that are not quite suitable to the task.

Your comment has made me think that I should flesh this idea out a bit more and hire a decent programmer in the early days to lay some decent foundations to this idea.

</comment></comment><comment><USER15> I work for a startup that sells software to big banks and my role is somewhere in the middle of dev and analysis. Depending on the phase of the project, I do everything from development to analysis to project management.

We work with big banks but are a small company and so I get to experience both worlds, which is great for me because I haven't figured out which one I hate more :-)

We have offices in NYC and South Jersey and are hiring, so if you're looking to make a change, shoot me an email and I can give you more background on the company.

<comment><AUTHOR> That definitely sounds like a direction I would be interested in pursuing: I do miss programming (it's now a free-time hobby) and PM work is something I'm intrigued enough with to try for a while.

While I'm not looking for a change right now, I'll be in contact: this route sounds promising.

</comment></comment><comment><USER16> Here's an idea - you could do consulting work and focus on startups. Metrics are becoming increasingly notable as an important part of running a startup. I imagine that your skills are useful to some folks who are on the fence or don't have the budget to hire fulltime staff for analytics. The experience you would gain from this would probably translate into the kind of job you want pretty quickly

</comment><comment><USER17> There are roles at companies for these skill but they are not a newly founded startup. Once the company has reached about 30 people there will be a need for more generalized skills typically in the business/sales side of the company as sales engineers/consultants.

</comment><comment><USER18> The two main jobs that we have or had open were QA Lead and Game Designer. Both jobs did not require CS degrees and paid decently. There are a lot of jobs like these out there, you just have to the look for the medium size startups.

</comment><comment><USER19> You could become a PM @ Zynga.

</comment><comment><USER20> You haven't talked about anything you've done to act on this desire.

Have you made e-mail pitches to 10 - 15 people/companies offering your services?

What type of reception or feedback did you get from that?

</comment><comment><USER21> drop me a line. email in profile

</comment><comment><USER22> Depending on what you mean by analysis, plenty of startups have them, including two I've worked for. No names here because apparently every word I say represents all employers, past, present, and future : rolleyes :

Nonetheless, in slightly larger -- 30-40+ people -- startups, there is often a need for someone who is good with sql or whatever datastore you have, who can make reports. That sounds a little bland, but it can range from asking and answering questions like how effective is our SEO or SEM, what advertising is giving us the best response, predicting churn rates for customers, etc. Good luck.

If you want to talk to the analyst at my current employer, hit me up over email. She's not a personal friend, though, so I can't promise anything but an intro.</comment>


American Airlines Site Redesign - <AUTHOR> http://www.aa.com/homePage.do

<comment><USER2> CEO: "That's a great design, really great, but you know what that needs to really spice it up and make it _sell_?"

Designer: "Uh, well, I could make the logo a tiny bit bigger. Again..."

CEO: "No, what it needs is the word 'homepage' in the, you know, the link, so when we send the link to people they'll know it's a link to the home page."

</comment><comment><USER3> Here's what Dustin crafted nearly four years ago - <http://www.dustincurtis.com/dear_american_airlines.html>

<comment><USER4> When I saw the headline, I was wondering how it would compare to Dustin's original take.

I think they've done an amazing job of the new site, but I wonder if they'll be able to keep the cleanliness over time or if they'll just start adding 'features' until it gets crowded like the old site again.

Sadly, the clean design doesn't extend into the booking pages, and I think the colour choices are strange on those pages as well.</comment></comment>


Coming Soon: Gut Bacteria That Cure Disease - <AUTHOR> http://www.bloomberg.com/news/articles/2016-06-30/coming-soon-gut-bacteria-that-actually-cure-your-disease <comment><USER3> I have a food intolerance based allergy/autoimmune issue which is under a broad headline of "Non IgE mediated autoimmune disorder".. manifestations are depression, fatigue, chronic skin issues (on my face :-().

I've been told the only "cure" is to abstain from eating about ~160 staple foods that contain proteins that my autoimmune system incorrectly recognises as something to attack, the problem is however you can barely get through a day without eating one of those staples unless you cook all your own food, and don't mind eating tuna, rice, chicken and (some) beans all the time.

I have a lot to look forward to from these treatments. I've had very good experiences with General Biotics' (SFO) product which claims to try and get the gut bacteria back in balance, I have no affiliation with them other than a dependence on their product if I want to be sane, happy and healthy in the short term..

<comment><USER4> Just be careful you haven't been scammed. I did an ALCAT test quite a few years ago, and they told me I was intolerant to a bunch of different foods. More research showed that the test is a load of bunk. Most of these "Non IgE mediated autoimmune disorder" tests are scammy pseudoscience.

From what I can tell, the most likely cause of depression and fatigue is stress/burnout.

<comment><USER5> I did an IgG food allergy test recently that I was extremely skeptical about in advance, but the results were consistent with my own observations over the past few years - namely that I was having severe reactions to some dairy. The tests showed exactly that as my issue. So I've eliminated dairy from my diet and I'm seeing what effect it has.

The general impression I got from my research is that some of these tests can be useful, but only when used in conjunction with other observations and case history. I do agree that some can be pretty scammy though - especially in their claims of the things they can fix. So like the parent poster, I'm really eager to see how these actual science-backed and FDA-approved solutions do for people too.

Also, stress and burnout are certainly a big factor in depression and fatigue, but these autoimmune problems are very real and can also have similar effects. I personally have a diagnosed autonomic nervous system disorder that apparently contributes to both the autoimmune and gut issues I deal with, as well as my severe fatigue and impaired mental state. I don't know that those areas - the gut, energy, and brain - are directly related on their own (the doctor I'm working with thinks they are), but I'm happy to try anything that might help any of them, and see what happens.

<comment><USER4> Just bear in mind that autonomic dysfunction happens in everyone after acute stress, and it is common in chronic fatigue syndrome [1]. It looks like autonomic dysfunction is perhaps just a symptom of fatigue (or, it is caused by the same part of the brain that generates the sensation of fatigue).

I'm not aware of any research showing that dairy intolerance can cause fatigue and depression. There is some stuff about casein acting like dopamine, but it seems to be pseudoscience.

We do know that stress definitely causes gut issues (changes in motility, absorption, and bacteria). Whether there is any causality in the other direction (apart from when you have an active infection), however, isn't really clear.

It can be difficult to definitively figure out whether or not you _are_ actually intolerant to something. I thought for a while that I was intolerant to potatoes, but further research shows that I'm not. (Right now I eat them regularly and have zero problems). If you're interested in really figuring out whether dairy is causing you problems, try introducing small amounts of dairy when you're feeling great and see if anything changes. (Just make sure you're not lactose intolerant before doing that!)

[1] [http://www.ncbi.nlm.nih.gov/pubmed/26420687](http://www.ncbi.nlm.nih.gov/pubmed/26420687)

<comment><USER5> Right, you've described my current plan - to eliminate it entirely for a while to see what happens, then slowly reintroduce things to see if I get any reactions. Besides the IgG test some of my own observations were acute reactions in my mouth from certain cheeses, and things like that - so I'm certain there's some kind of allergic reaction to... something going on. (The test I took specifically did show that casein was the problem in my case. We'll see.)

And agreed that stress can cause those issues with the gut - and for me at a minimum exacerbates other things already going on - but yeah, I'm seeing and hearing a lot about how it goes the other way but I'm not seeing the science or experiencing it yet in my case.

Also - in my situation the autonomic dysfunction has a strong biological component. I have postural tachycardia and peripheral neuropathy caused by a genetic collagen issue (Ehlers-Danlos), so I know that there are major physiological factors going on and contributing to all my various issues. And then stress - which is aggravated in my case by wildly fluctuating heart rate - compounds all of that, creating a whole vicious cycle of impairment. Unraveling this whole web and picking away at parts of it at a time is my current challenge. But I am pretty confident that while depression contributes in some ways to my fatigue, it's also majorly impacted by my heart rate and probably some adrenaline issues common in Ehlers-Danlos.

(I appreciate this discussion and your thoughts, by the way.)

<comment><USER4> >I'm seeing and hearing a lot about how it goes the other way

Well, you need to be careful who you listen to. There are an infinite number of dubious naturopaths (and many MDs) who buy into dubious theories and spread them. There are a lot fewer people who will tell you "stress causes burnout, which causes POTS, ANS dysfunction, depression, chronic fatigue/pain, digestive problems, etc.", even though this is based on a more correct understanding of how the body works. The USA seems particularly bad for MDs believing dubious theories, for a number of reasons.

> acute reactions in my mouth from certain cheeses, and things like that - <USER2> > I'm certain there's some kind of allergic reaction

If it is an allergic reaction, it will show up on an IgE. Bear in mind, though, that some cheeses are just sharp.

>Also - in my situation the autonomic dysfunction has a strong biological component. I have postural tachycardia

The autonomic nervous system is biological/physiological, but is modulated by stress. It doesn't really make sense to separate these systems into "biological" or "psychological".

Postural tachycardia and depressed parasympathetic nervous system are typical symptoms of CFS caused by burnout from stress. I had these symptoms myself, very severely (I had periods where my digestive system didn't move at all, and where I had atrial fibrillation due to the tacycardia). However I've recovered completely from it now and have no symptoms.

>caused by a genetic collagen issue (Ehlers-Danlos)

Did you suffer from these symptoms your whole life? If not, I'm not sure how it fits. Typically CFS comes on suddenly and/or you have relapses and normal periods...if that's how your illness manifests then I don't see how a genetic collagen could explain it. Also, allergies are a different issue to a genetic collagen problem (and neither really explains depression). I have a moderately severe allergy (hay fever), but zero depression or fatigue from it.

</comment></comment></comment></comment></comment></comment><comment><USER6> A microbiome treatment for C. diff (which is what the article mainly focuses on) seems eminently plausible, and an effective treatment can't come soon enough. However, for a lot of the other diseases that the title hints at (and are mentioned in only one paragraph in the article), there's just not that much reason to be hopeful. We have a pretty good handle on what causes cancer, and while you can tell a story about gut->immune system->{cancer, liver disease, OCD}, there's just a lot more places for things to not work.

[1] has a great summary of the current state of research on the microbiome- health connection: "We still don't really understand what these microbes are doing, so we can't infer what their absence or presence implies."

[1][http://www.theatlantic.com/science/archive/2016/06/the- plot-...](http://www.theatlantic.com/science/archive/2016/06/the-plot-holes- in-the-human-microbiome-story/486947/)

</comment><comment><USER7> Mark my words: There will be two new types of "banks" : youthful post puberty blood bank of 15-25yrs old and banks for same age group of fecal deposits. There is nothing like a body at the peak of performance and function. Best case, you would be encouraged to save your own blood and fecal matter for your later years. Worse case, you'll have to buy both. Oh my goodness though... you can actually make $$ from selling your.... but I think it will happen. I believe this is just the beginning of how/what gut bacteria actually does for your body. Ever wonder why something like prozac causes constipation when all it's supposed to do is increase serotonin levels in your brain? Just a brain fart..thinking out loud.

<comment><USER8> At the moment blood isn't cheap or easy to preserve. Then there is a matter of supply. Current research involving parabiosis in mice required a significant age difference and a continuous supply. Meaning you spend 15 - 25 trying to produce double the amount of blood just so you have what you need when you are 70 to 80. Transgenic xeno blood is a more likely solution if not synthetic blood or protein filtering.

Regarding self fecal implants, the case where it could be most beneficial is in post antibiotic treatment. I recall seeing a a before/after graph of gut flora. Antibiotics had the effect of a nuclear bomb. Even years later, gut flora was still a fraction of what it had been.

<comment><USER7> Hi louprado. yes, I understand about blood life but I'm thinking the bank "purchaseable" blood will be a busy cycle so no worry about needing to store long term. however, to my point about long term storage you're right for now.

And as for the fecal "transplant", I think we are at an infancy in understanding. Our gut is so central to our very survival that I'm dumbfounded we haven't discovered this sooner.

I think from food allergies to Ulcerative Colitis to your emotional state to maybe even cancer, any ailment of your entire body OR mind will have a direct link to gut bacteria. I'm sure of it.

No doubt that it does sounds absurd to think that a group bacteria can dictate how well your body AND mind functions, but that's what I'm saying...

</comment></comment></comment><comment><USER9> > "Patients have different preferences," Hecht observes, but "in general, > people don't particularly like enemas."

This is probably the best argument against a competitor's product that I have heard.

</comment><comment><USER10> From what I understand, getting these treatments through the FDA was rather tricky. This paves the way for future treatments.

The money quote:

 _The company has built a microbiome library of 14,000 strains of human bacteria it hopes will help it treat a range of diseases, eventually without needing feces at all._

</comment><comment><USER7> Another unique properties accidentally being discovered from FMT aka fecal implanting is the recipients seems to inherent the donor's properties like being obese to having affinity to certain types of foods. Soon we may discover that if we want muscle growth, we simply get FMT from a bodybuilder or if you want more efficient metabolism you get FMT from an endurance runner. Additionally, you may be able to over come any food allergies like peanuts by getting a FMT from someone who isn't allergic.

I think the possibilities of this yet to be understood cure all of gut bacteria is just beginning.

This could be a GREAT disruptive game in the medical field. Wanna startup? :)

</comment><comment><USER11> However, please be cautious, there are lot of things that are left to be desired out there. I recently read about their use in stroke patients for example. Lots of things about the microbiota is simply wishful thinking.

[http://www.ncbi.nlm.nih.gov/pubmed/26945017](http://www.ncbi.nlm.nih.gov/pubmed/26945017)

</comment><comment><USER12> 'He's not an 'acceptable person' \-- he's like an armed warhead! You wondered about drug factories -- Sticky Thompson _is_ a drug factory."

"What's that supposed to mean?" Laura said.

"I mean his guts are full of bacteria. Special ones -- little drug factories. Where do you think he got that nickname -- Sticky? He can eat a carton of yogurt and it turns him into a killing machine."

"A killing machine?" Laura said. "A _carton_ of _yogurt?_ "

"It's the enzymes. The bugs eat'em. Make him fast -- strong -- feeling no pain, no doubt at all. They're gonna sic him on ... and wow, I feel sorry for that little ..."'

\-- Islands in the Net, Bruce Sterling, 1988

</comment><comment><USER13> It's tempting to say that some proof is not there yet, but considering the amount of studies published every year and inability to read even abstracts of all of them it's often far fetched. It was shown more than once that certain gut bacteria cure certain kinds of allergies: [http://evidenceba.se/answers/17-allergies-can-be-treated- wit...](http://evidenceba.se/answers/17-allergies-can-be-treated-with- prebiotics-answer-to-how-can-you-cure-allergy)

</comment><comment><USER14> It takes far too long to get a fecal transplant for c. diff, especially when it has a proven success rate of about 92%, compared to 50-80% for the antibiotics. This is a big deal.

</comment><comment><USER8> The OP mentions OpenBiome which is the worlds first independent stool bank and supplies feces for transplants. They have a 3% acceptance rate for donors and select only the healthiest individuals.

It would interesting to see how their screening process evolves given the plausibility of all the health affects beyond the GI system of fecal transplants. For example, it may be that mental health wasn't screened beyond a cursory exam but later it could be a significant part of screening.

But if they are already reject 97% of donors and the demand is increasing, the economics encourages lowering the screening bar, not raising it.

</comment><comment><USER15> News like this, and CRISPR, and pending patents on genes, seems eerily similar to the prelude to Gene Wars...

[http://www.lightspeedmagazine.com/fiction/gene- wars/](http://www.lightspeedmagazine.com/fiction/gene-wars/)

</comment><comment><USER16> So you can use yogurt to deliver medicine rather than a pill.

After reading the article this seems to be a piece paid for Seres Therapeutics in order to raise their stock price.

</comment><comment><USER17> Gut bacteria from thin people can help lose weight?

<comment><USER18> Not sure how much gut bacteria will help with weight loss, but it does seem to go the other way.

One of my favorite papers in the field in the last couple years shows a potential causal relationship between obesity and gut biomes by using artificial sweetener and a fecal transplant in mice.

Paywalled version in nature: [http://www.nature.com/nature/journal/vaop/ncurrent/full/natu...](http://www.nature.com/nature/journal/vaop/ncurrent/full/nature13793.html)

Unpaywalled version after googling: [http://www.drperlmutter.com/wp- content/uploads/2014/09/Artif...](http://www.drperlmutter.com/wp- content/uploads/2014/09/Artificial-Sweeteners.pdf)

</comment></comment><comment><USER19> Vice on HBO recently (June 24/2016) did an interesting segment on this subject.

</comment><comment><USER20> Am I the only person that remains skeptical about these claims?

</comment><comment><USER21> Well... that will cure your C. Diff.

<comment><USER22> C. diff. is just the disease first in line. Chronic fatigue syndrome may be lining up behind it: [https://www.washingtonpost.com/news/to-your- health/wp/2016/0...](https://www.washingtonpost.com/news/to-your- health/wp/2016/06/30/new-study-shows-chronic-fatigue-isnt-just-in-your-head- it-may-have-to-do-with-your-gut/)

<comment><USER5> > First, the indicators could be used in the future to help diagnose the > condition, as they were present in 83 percent of the patients with chronic > fatigue syndrome. Second, it suggests that diet and things like probiotics > may be a way to help treat the disease by getting the gut microbiome back in > balance.

This kind of reporting bugs me. They might have found a possible correlation here, that's all. Yes, that first item is a possibility because the correlated indicators could be used to detect conditions related to CFS, but the second item is pure speculation about cause and effect, and is jumping to conclusions about it pertaining to treatment.

Personal anecdotal insight - I have a genetic condition that affects both my gastrointestinal system and causes chronic fatigue-like symptoms. I'm treating both separately but because there's an underlying condition affecting both independently (probably), it doesn't mean that treating one will improve the other. It's a longshot possibility, but saying "may be a way to help treat the disease" is just interpretation and overly-optimistic hype.

The indicators they found do sound really interesting though. If validated it would be an amazing benefit to patients just to confirm that there's a biological factor to these conditions.

</comment></comment></comment><comment><USER23> Not cool... Bloomberg is telling me I am using an additional blocker and literally have no extensions installed.

<comment><USER24> We block one or two ad networks on our local network because of spyware payloads and we get these boxes too from time to time. So, it might be upstream of you.

</comment></comment><comment><USER25> I feel that given trials, regulatory approval, and all the other obstacles facing new drugs (briefly referenced in the article), "Coming Soon" is the height of hyperbole.</comment>


A Sobering analysis of the current Android market share - <AUTHOR> http://nearthespeedoflight.com/article/a_sobering_analysis_of_the_current_android_marketshare

<comment><USER2> The network isn't the only reason to pick an Android phone, though AT&T's lack of coverage in my apt completely eliminated the iPhone for my consideration.

Android, as a platform, is less polished than the iphone. The UI guidelines and interaction patterns are less developed and therefore less consistent. The market is weaker and junk filled, so you have to get app suggestions from some external source.

The plus side is that the google stuff is really, really cool. If you use your phone to look stuff up, being able to long-hold the search button on the phone and say "Directions to 23rd and Broadway" and have it work is truly amazing. Getting a Google Voice account and using it for text messaging allows me to drop texting off my monthly bill. I've never been able to do the whole two thumbs virtual keyboard thing, so replacing the default system keyboard with a swipe keyboard (SlideIT in my case) gets me up to 30wpm from 5-10wpm. The news reader I use overrides the volume buttons on the phone so I have physical buttons to flip through the 400 news items I read every day. My phone automatically turns on/off the wifi and other radios and sets the ring depending on where I am and the time of day (e.g. wifi on, vibrate when I'm at work and silent between midnight and 9AM but only if I'm at home and my family isn't calling).

I started off thinking "yeah it might not be an iphone but at least I'll get coverage" to preferring the experience over the numerous iphones I've tried out. I just wish the apps were better but I'm hoping that's a problem that will solve itself over time.

</comment><comment><USER3> He's right, I'm a Motorola droid owner; it's a fantastic phone first and a so- so "device" second. The Android market has lots...and lots of crap. The game selection is simply dreadful compared to the app store.

The signal to noise (decent apps to cookie-cutter garbage) in the Market is minimal at best.

The phone is absolutely reliable, the gps is fantastic. The app selection, unless you're some crazy who needs 12 apps to tell you about "stuff around you" or you want a puzzle of every pixar/disney movie ever made, is in need of some serious house cleaning.

</comment><comment><USER4> Remember when Yahoo, with its tree structure of topics/directories, was the market leader (for "finding stuff")? Remember when an upstart Google came on the scene with unrestricted, algorithmically selected results?

It wouldn't be the first time Google's taken down a "walled garden" (being a bit unfair to Yahoo's state -- and attitude -- then, for the sake of the analogy).

However, it will depend upon whether Android evokes their serious, long term commitment. And _someone_ will have to provide a better consumer support environment than either Google or the wireless carriers have provided up to this point, and a more open wireless marketplace than the carriers (I'm looking particularly at you, Verizon) have provided.</comment>


The UK has an entire IPv4 /8 that it isn't using - <AUTHOR> http://blog.jgc.org/2012/09/the-uk-has-entire-unused-ipv4-8-that-is.html <comment><USER2> There are lots of stories like this. Many of them are worse; at least you can imagine that the UK is holding these addresses in reserve. There are companies with giant allocations that are holding them so that they can give every desktop and every printer in their enterprise a routable address; others are doing the same thing, but also operating _flat, unrouted networks_.

More evidence for the core problem: fiat allocation doesn't work. If there was a functioning, liquid, accessible market for advertisable IP prefixes, you wouldn't have to convince anyone that a /8 was worth $1bn; it just would be.

<comment><USER3> ...and, anyone who didn't have $1bn to spend would be SOL.

There's plenty of numbers to go around; the sooner we get to v6 and get around this mess, the better.

<comment><USER4> What an embarrassing failure of economic reasoning.

IPv4 addresses are a scare resource. Acknowledging that, and allowing them to be traded at a price that reflects their value, is the surest way to get them out of the hands of those who are wasting them in the way tptacek and the article describe and into the hands of those who will do something more productive with them. Pricing IPv4 addresses would hasten adoption of IPv6 by providing a financial incentive to switch from IPv4 to IPv6 to those who can do so most easily (i.e., cheaply).

In other words, if you want to "get around this mess", stop allocating scarce and valuable IPv4 addresses as if they have no value.

<comment><USER5> But (and someone correct me if I'm wrong), but individual IP addresses are not a commodity. If you broke apart that /8 and auctioned them off, if would be a routing nightmare.

<comment><USER6> Are there any /8 which can't be broken down to at least /16? I think you can often get down to /19 or sometimes /22.

<comment><USER7> Smallest prefix that can be meaningfully used is /24 (you cannot advertise smaller prefix), but I think that everyone advertising random /24s would lead to even larger costs for router upgrades than IPv6.

<comment><USER6> I think there are still bigger than /24s where /24 announcements aren't allowed. People filtered for a while (at least around 2000-2002) in those ranges, so you couldn't just take a random swamp /16 and turn it into a bunch of /24s and expect them to be visible to everyone, although it did work to most. I haven't paid much attention to routing politics for the past 5 years or so though.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm not sure about the definition of 'unused', just because a network is not visible from the Internet and has no publicly registered ASNs doesn't mean its numbers are not in private use (which AFAIK, was always a legitimate use-case for getting an allocation, and in many ways preferable to reusing RFC1918 space).

Added to that, even if it was seeing only minuscule internal use, the UK government's IT project reputation suggests the renumbering would cost at least as much as the block would sell for, assuming the project would even complete prior to the entire planet properly migrating to v6 and the block losing its value.

<comment><USER9> If there are no networks defined, as far as RIPE is concerned, it's un-used.

We just got audited for RIPE for exactly this reason, and they made us specify details for all of the networks we use on our allocation to be allowed to keep our address space.

<comment> X-Istence That's not the case for older legacy networks. Those don't fall under the purview of RIPE as they were allocated before RIPE existed.

I'm wondering if RIPE can even do anything regarding that netblock in terms of possibly pulling it and re-allocating it.

<comment><USER10> As far as I know, they can't.

All they can do (and have already done) is ask nicely for it back.

<comment><USER11> Well, if they were feeling ballsy, they could just declare it unused, break it up, and start assigning it. A lot more network nerds would listen to RIPE than to some random UK pension bureaucracy.

</comment></comment></comment></comment></comment><comment><USER12> No doubt part of the strategic IP reserve :-)

There are a number of ways the IP addresses can not appear to the outside user and still be used as several have mentioned, and of course they can be for some project that isn't yet 'done' (the Coast Guard had a huge block like that as I recall) but the more interesting bit is to track the cost of getting an /24 network its inching up. At the time where the easy stuff has been reclaimed it will shoot up.

</comment><comment><USER13> We need to quit looking back at the v4 space like this, bite the bullet and deploy v6. It's already in use on some networks, and inevitable on 95+% of the rest.

The amount of time spent bike-shedding "well, v4 isn't running out as fast as they say it is" or "NAT will save us" (lol, no) that time is better spent deploying v6. For many installations, its actually not that big of a deal to do.

<comment><USER14> And we will move, but it's not going to happen until 98% of the world's networking infrastructure (both public and private) is IP6 ready, which probably won't be for another decade.

<comment><USER13> That's the thing though. If everyone is waiting on everyone else, nothing gets done.

If your network doesn't already support v6, you're the person everyone is waiting on! You don't need to wait for your upstream provider to supply you with v6, tunnels are super easy to get.

The only exception to tunneling is if you're hosting a public-facing service, don't have v6 connectivity and don't trust existing tunnel providers. In this case: First, why are you at you're current host or colo center? They're probably shit. Second, set up a box at a provider with good connectivity to run the tunnel yourself. This is basically what we already do when we want to use our public v4 space but the ISP doesn't want to let us talk BGP.

<comment><USER15> This is a hackers perspective and doesn't apply to the normal consumer.

<comment><USER13> Thats kind of my point. If you're the type of person to actually know what v6 is, you're the type of person we're all waiting on.

edit: And its not a "hackers" thing, its a "technical competency" thing.

<comment><USER16> It's also a "business competency" thing. Which, sadly, does not overlap very much with "technical competency" in many organizations.

</comment></comment></comment></comment></comment></comment><comment><USER17> Hooray, another /8, that'll last us for a good month or so. Exponential growth people, reclaiming unused IP blocks isn't going to stop it.

And that's ignoring the possibilities that a) it's being used internally by its legitimate owners b) it's being used internally by other people. T-Mobile were seen to be (mis)using the /8 that belongs to the UK MOD for their internal networks, I wouldn't be surprised if they were doing that with this as well.

There aren't that many IPv4 addresses. There are no easy fixes. Just move to IPv6 already.

<comment><USER18> Do you have an idea of how many IPv4 addresses that are unused or not really needed?

Between the bunch MIT got, the bunch that the military got and the bunch that IBM got, we can implement an entirely new protocol before we run out.

<comment><USER19> At MIT a 30 person living group gets 18.n.x.x

<comment><USER20> Posting from our own 18.n.0.0/16 Class B subnet right now. There's a few thousand available IPs for each person who lives here.

<comment><USER21> Which will be great for testing my Raspberry Pi distributed web server. But useless for anyone who doesn't know / care what an IP address is (70% of us?)

<comment><USER19> I would imagine that you'd have more of a problem finding enough ethernet ports than ip addresses.

</comment></comment></comment></comment></comment></comment><comment><USER22> No traces of this block in the public Internet doesn't mean it isn't being used. It may be in use in some internal network(s) instead of a private address range (yes, that happens).

<comment><USER14> Running NAT behind a routable IP address range AND using a totally different range for all servers, VPNs, and various sysadmin crap? I don't believe it.

There's no way they would be so diligent to use that IP range internally without even a tiny bit of evidence externally.

<comment><USER23> This is the government, so it's practically guaranteed that there's at least two layers of firewalls between any internal networks and the internet. If any of those layers was installed by an average IT consultancy then they'll have used NAT (because that's what you always do, right?) and hidden 51./8 completely.

</comment></comment></comment><comment><USER24> Who cares? IPv4 is a dead technology and this is like complaining that the UK has a bunch of fax machines in storage somewhere. 10 years ago, this would have been a waste. Now it doesn't even matter.

Even Comcast supports IPv6.

<comment><USER25> So how do you envision the transition taking place? Given that 6 and 4 talk past each other.

<comment><USER24> The transition has sort of already happened. Most software stacks support IPv6 now, and many server hosting companies are giving out IPv6 addresses like candy. (I think I have a /48 or something for jrock.us. That's 2 to the 48th IPv4 Internets! I have a lot of computers, but not that many.)

All that's left are the clients, and the way I see that transition happening is in the low-cost sector. Sort of like an AOL where you won't have IPv4, so you'll have to access everything through a proxy except IPv6 sites. Eventually businesses will want to cater to this demographic and the stragglers will flip the IPv6 switch. With nobody on IPv4, it won't be a premium value-add anymore, and that era will be a distant memory of the past like BBSes are now.

Right now the IPv4 situation is not bad enough to make widespread IPv6 support critical to one's economic viability yet. Being able to see the animated turtle on kame.net isn't quite enough of an incentive, but the incentives will slowly shift.

(I see the same transition away from fossil fuels. Right now, an investment in alternative energies is pure speculation: it may pay off someday, but we don't know when that day is. When we've run out, though, the payoff will be clear: you will get infinite money the second you figure out some way to give humanity energy. This will encourage more investment than some nebulous LEED certification will. Tax credits are nice, but not as nice as cash.)

<comment><USER26> "The transition has sort of already happened," he says, over IPv4.

Seriously, unless you want to be posting to HN via IPv4 in 2050, there is clearly something major left undone. Don't call it a transition if you think that concept is undone, but it's not yet functionally possible to be on the Internet with no IPv4 stack or (possibly NATted) address, and I don't see that becoming the case anytime soon.

See <http://cr.yp.to/djbdns/ipv6mess.html> for a description of the problem that I mostly agree with. The depressing thing is that those complaints are no less valid a decade later.

<comment><USER24> Only because HN is IPv4-only. I'm sitting in a remote office on my laptop this morning, and it has an IPv6 address. When I visit google.com, it's over IPv6.

It's happening.

<comment><USER26> Why is HN IPv4-only? And why should they bother to spend any effort fixing it? Given that, e.g., techcrunch.com and github.com and everything else linked from HN is IPv4-only, you can't usefully use Hacker News from an IPv6-only connection, so why should HN care?

You're expecting altruism or geekiness on the part of every single website ever -- it's fair to expect that from Google, but not from everyone. The transition may or may not be happen_ing_, but it will never finish.

<comment><USER24> No I'm not, I'm expecting anti-altruism from low-cost ISPs. (Name one consumer ISP that you think is altruistic.) Then, to capture that market, servers will start deploying IPv6.

Today, IPv6 is billed as a premium feature. Tomorrow, IPv4 will be the premium feature.

<comment><USER26> Wait, you expect any low-cost ISPs to offer IPv6-only, and have any customers at all? And that IPv4-only sites will say "gee, better support those IPv6-only users" instead of saying "get a better ISP" (or more likely "We have no idea what's wrong, but it works from Comcast, complain to your ISP")?

I don't think you understand how the Internet works. Or business. There is no foreseeable point at which it makes sense to bill an "Internet" service that's IPv6-only. That's doable _after_ the transition, but expecting that to happen now is not a transition.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> I find this funny. The IANA holds 15 IPv4 /8 blocks, even mentions "Reserved for future use" when whoissing, and nobody cares.

<comment><USER28> Not really. All the blocks that are marked "reserved" are more like "unusable"; e.g. real equipment cannot use class E. People have been over this stuff with a fine-toothed comb. [http://www.iana.org/assignments/ipv4-address- space/ipv4-addr...](http://www.iana.org/assignments/ipv4-address- space/ipv4-address-space.xml)

<comment><USER27> I know, but I still think it's stupid. Nevermind though, it's an endless opinionated discussion.

</comment></comment></comment><comment><USER29> Amateur radio also has an unused IPv4 /8 block as well. That $500 mil could go quite a ways towards building a few amsats.

<comment> X-Istence Hey, some of us HAMS are still using AMPRNet ... not many, but some.

That being said, here is a list of people in charge of allocations: <http://www.ampr.org/oldsite/amprnets.txt>

<comment><USER30> I'm currently enjoying its usage as well. Whoever said it was unused doesn't know what they're talking about.

</comment></comment></comment><comment><USER31> How many mobile phones made per day that support some form of internet access and how many of those use IPV6?

Scary thought is it not!

The first real opertunity to move to IPV6 in any way would be mobile smartphones and there like and yet that is not happening. It realy is a case of the ISP's and mobile telco's that need to start initiating the IPV6 move and until they do nobody will be dragged into following.

Maybe if it was illegal to sell devices that don't at least support IPV6. But of a messy situation when you can buy devices made brand new that still dont offer IPV6 support, criminal realy.

Still when you look into the history of British railways and the better modern alternatives you can see how some legacy designs just carry on with there limitations of capacity oversight.

Another aspect is cunsumers have in many respects forgotten how to complain to a company and let there frustrations out on the internet in area's were the companys offering the services will completely fail to notice and allow you to complain and vent of without them even knowing or indeed having to care.

How many of you have asked there internet service provider if they support IPV6 or indeed what there plans are to offer it? Reason I ask is that I can bet it's lower than 1 in 100 or indeed 1 in 100,000. I can't even recall any one of my friends or anybody I know or have dealing with ever mentioning they had made such an enquiry. I know I have, please tell me I'm not alone at least.

<comment><USER28> Verizon and T-Mobile are running quite a bit of IPv6 but nobody noticed since it just works.

</comment></comment><comment><USER32> When looking into unused IPv4 /8 blocks besides private companies, could somebody please explain how much of the 201,326,592 addresses (12x /8) allocated to the US DoD have ever been used

<comment><USER28> They'll never tell you and it doesn't matter since they'll never give those addresses up.

</comment></comment><comment><USER33> How much does it cost to "produce" an /8? Nothing. In the "magical" world of the internet, you don't even need to build a network to use the addresses on. Nor do you need to prove that you actually have any sort of "rights" (as the legal kind) over the addresses. Because there is no one who can grant you such rights. Hate to spoil the magick trick, but no one owns the internet. The whole scheme works on cooperation of network admins and acquiescence of everyone else.

And the top post claims it would be worth $1BB. Keep dreaming.

The truth is that the value is not in addresses, the value is in the network, and those who own the infrastructure, but of course there is no single infrastructure for the internet because it's a network of networks, owned by various parties.

The telephone company can charge you for a telephone number. It owns the network that you're going to use it on. If it didn't own the network, you would not pay for the number. You are paying to use the network. The number is just a formality.

This same is not true for the internet and IP numbers. The RIR's don't own any networks. There isn't even a clear line to the source of their authority to "allocate" address space. Does the US Government own the internet? Good luck with that argument. RIR's charge fees to "allocate" addresses, an administrative job, but we have no idea how the fees are spent. Maybe to pay the CEO's generous salary? How much work is it to keep track of some numbers? Maybe we should ask IANA. The whole scheme works based on cooperation and acquiescence.

No organisation ever paid $1BB for an /8. They got theirs for "free" (inconsequential maintenance fees notwithstanding).

</comment><comment><USER34> 220.127.116.11/8 the secret IP block otherwise known as Block 51.

</comment><comment><USER35> The argument is that if our government disposed of this 'asset' now, they'd rake in almost £1bn.

IPv6 is still not mainstream, so this figure can reasonably increase over time with the increase in IPv4 scarcity.

Thus it stands to reason not to sell out just yet.

</comment><comment><USER36> Can IP blocks actually be sold?

<comment><USER37> Yes. Privately and normally as part of bankruptcy proceedings. The most famous recent example is probably Microsoft's purchase of Nortel's addresses, <http://www.bbc.co.uk/news/technology-12859585>

</comment></comment><comment><USER38> Eventually in the future, people will come to realize the over-exaggeration of running out of ipv4 addresses. The unused blocks will come out of woodwork from everywhere. Well, I hope my opinion is wrong.

<comment> SG- By future do you mean right now where NAT is being used by some providers already? I know Rogers in Canada has all mobile devices going through NAT unless you pay a nice "VPN" fee.

Also the assigned but unused IPv4 blocks don't do anything for other providers that actually need addresses.

<comment><USER39> and that's extremely profitable for them. Why would they switch to a format that doesn't give them the easy out to gouge customers?

<comment> SG- Profitable? I guess, but it doesn't make them much or any revenue since i'm pretty sure 99% of their mobile customers don't really care.

</comment></comment></comment></comment><comment><USER40> I have my own /24 routed to my basement. Back in the early/mid 90's could get their own provider independent block.

If I knew now what I knew then, I would've gone for a class B block. lol.

</comment><comment><USER16> This is why organizations should pay $1 per year for each IP address they own.

</comment><comment><USER41> what if IP addresses were allocated / confirmed by a bitcoin-like network?

<comment><USER30> You mean completely unstable and essentially useless? No thanks.</comment></comment>