NIST declares the age of SMS-based 2-factor authentication over - <AUTHOR> https://techcrunch.com/2016/07/25/nist-declares-the-age-of-sms-based-2-factor-authentication-over/ <comment><USER3> I don't think eliminating SMS authentication is a good idea. While it is vulnerable to social engineering attack (and sniffing if you are near the receiving phone), SMS authentication has proven to be invaluable for most ordinary users. Those users are everything but eager to use anything more secure then their 6 letter password. With tricking many users into using SMS authentication, companies like Google have improved the overall security of most account by a lot. While it is possible to remove an SMS authentication mechanism, it is a lot harder and probably not worth for most accounts.

Most people will not bother to install Google authentication and just not use 2FA (who wants to steal their account anyways /s). Even if they did install it, recovering their authentication codes if they have lost their phone is incredible hard (because too many won't use backups – even if it is as simple as apples iCloud backup).

What I think companyies should do is give their users a choice not to use SMS authentication. Power users (and hopefully most high profile users) will make use of that and normal user can just use SMS.

In the end it is always a trade off between convenience and security and sadly convenience almost always wins for most users even for easy solutions. So we (the developers) should provide them with the most convenient way they accept which offers the maximum security and SMS does just that.

<comment><USER4> SMS auth is atrociously bad compared to offline 2fa:

\- Requires a telecom provider in the first place (in some countries, that legally requires a passport/national ID tied to the phone number)

\- Offers no means of backup

\- Forgot to disable 2fa on that one account you log into once a year, before changing your phone number? have fun with that

Nevermind Google Authenticator. Android and iOS should have a high quality TOTP app installed _by default_. One that permits backups. "Users won't install it" should NOT be a factor and if Apple/Google want their users to start using 2FA it's in their own interest to do this anyway.

<comment><USER5> It's still better than no 2FA, which I imagine is the alternative for the vast majority of people.

<comment><USER4> Meta: Why is it that in one thread, I'm saying "same-machine 2fa is better than no 2fa" and getting "but but it's not secure!" as replies, but when I complain about sms auth being insecure, impractical, nonstandard and more expensive than TOTP I'm getting "it's still better than 2fa" as a reply?

<comment><USER6> I agree, it _is_ bizarre to be taking different sides of the argument in different threads...

<comment><USER7> I want to call this out, because I feel it's a big issue we have as humans trying to engage in reasoned debate - the idea that an inconsistent or changing view is somehow "weak" or invalidates the argument.

If someone is changing their opinion, that's a good thing. It means they are taking on board new information and not blindly following their original opinion.

If someone appears to have an inconsistent view, perhaps their position is simply more nuanced than the simple "for or against" buckets the debate actively tries to lump all participants into?

<comment><USER6> Yeah, I was sarcastically pointing out the absurdity of bitching about different people on HN having different responses whilst he himself has slightly different perspectives on subtly different issues...

I don't care that his view is inconsistent, I just think the complaint of people disagreeing with him (in a comment format which encourages disagreement more than agreement) was kinda ridiculous :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> This is the perfect being the enemy of the good.

They should be calling for secure, validated SMS.

Thinking that "Joe and Jane Six-Pack" are going to use Google Authenticator, is frankly laughable to anyone who does end-user support. But everyone understands "get a text and enter the code here"

<comment><USER9> Moreover, did you ever try to port Authenticator data from one device to another? There are rumors it's possible. I work in the industry since forever, if anybody can be called qualified for such simple task, it's me. I gave up, too much trouble. Imagining that a regular person would even think about getting into these woods is laughable.

Sure _Google_ allows you to port authenticator data with an easy 5-step process. Almost nobody else does even this.

Without portability, it means losing access to your Facebook, Instagram and Pokemon Go when you change your device? People would revolt if you do that.

So what's the alternative? We either use SMS, or we use email (which will have like order of magnitude higher failure rate with no added security) or we don't use 2FA at all. Or we think really hard and invent better 2FA than SMS that works on every mobile device and is simple for the user. _Then_ we can deprecate SMS.

<comment><USER10> I always refuse to use the "scan QR code" thing, and everybody I've tried that with (at least Google, Amazon, Github, Dropbox, Linode) give you a TFA secret to type in as an alternative - I then store these in 1Password and can back that up and use them to key Google Authenticator on additional devices. (I've never tried to extract or backup.reuse secrets from Authenticator.)

<comment><USER11> This only works for services using TOTP mode; HOTP prevents replay/cloning attacks.

<comment><USER12> The HOTP counter is something you can increment yourself if needed when storing it somewhere?

Proper implementations of TOTP do not just rely on expiring the codes. From chapter 5.2 of RFC 6238: "Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP."

<comment><USER13> Yep, right at the top of page 7 of the RFC: [https://tools.ietf.org/html/rfc6238](https://tools.ietf.org/html/rfc6238)

If it accepted the same token more than once, it couldn't possibly be called a "one-time password".

</comment></comment></comment></comment></comment></comment><comment><USER14> One of the biggest weaknesses of SMS 2FA that I didn't see the article cover is when an attacker can socially engineer their way into your account with your cell service provider.

I'm thinking of a high-profile example when an attacker tried to take over h3h3's YouTube account by requesting his SIM card from T-mobile by pretending to be a T-mobile employee: [https://youtu.be/caVEiitI2vg](https://youtu.be/caVEiitI2vg)

<comment><USER15> The other day I forgot my Github password. When I went to go through the password reset process, it must have triggered the 2FA because it asked for my code. I use Google Authenticator, but I had switched to a new phone since the last time I used GA with Github, and never scanned the code on the new phone.

So now I'm at an impasse. How do I get the code? Well, Github has a backup -- it will SMS the code to your phone! When it said this I just kind of chuckled to myself as I also had seen the h3h3 video. Sure enough, it texted me the GA code and I got back in control of my account.

Github actually provides a list of emergency codes that you can print out and use as a last resort. I had printed these before and actually had them available, but forgot about that process.

Github is trying so hard to have your account secure, but yet the SIM card cloning threat is still there.

<comment><USER10> Hint: don't just scan the QR codes on one device, switch to the "type in the TFA secret" mode, and store that in your password safe (this makes it easier to add the key to all your devices too - I have thew Google Auth app in two phones and an iPad. I'd advise against doing that without at least considering something better than a 4 digit pin unlock for your devices).

<comment><USER16> _Hint: don 't just scan the QR codes on one device, switch to the "type in the TFA secret" mode, and store that in your password safe_

I just don't use an authenticator app at all. Some password managers (e.g. 1Password) have support for storing TOTP. So, as long as I can access my 1Password vault (use a strong password!), I can access my TOTP codes.

Besides that, I prefer U2F, which is supported by GitHub.

</comment></comment></comment></comment><comment><USER17> The problem with 2FA apps is that they don't also serve as an instant notification you when someone is trying to log in as you. 2FA SMS does. This needs to be addressed somehow before we declare the former superior.

<comment><USER18> Instead of SMS, wouldn't email notifications suffice? Apple (iCloud), Gmail and Salesforce does this when there's a new login on a new device.

Furthermore, I'm not too in favour of using SMS... I have two numbers and when I don't have both phones with me, it's a huge hassle. I end up setting up my phones to auto forward such smses.

I use 1Password OTP support and love how it works seamlessly across my phones.

(Edited for clarity)

<comment><USER19> When my Origin account was hacked, I found out that hackers used a very basic vulnerability in Gmail - they've logged into my Origin account, changed the language to Russian, and then changed the password - I received the "your password has been changed" email, but because it was in russian, gmail automatically put it in Spam folder and I never saw it(when I eventually found it the message shown by gmail was "this email is in a different language than used normally for this email address so we've automatically marked it as spam".). Obviously by the time I realized, the "I didn't do this!" link in the email has expired and I had to call EA to recover my account(surprisingly, I did!).

So yeah, now I have 2FA enabled on my origin account, but I still wish I received a text message telling me my password was changed.

</comment></comment></comment><comment><USER20> When I think of NIST, the first thing I think of is the old National Bureau of Standards (now NIST) WWV Time and Frequency broadcast on 2.5, 5, 10, 15, 20, and sometimes 25 MHz. (You old-timers can probably hear the radio voice already!)

This came to mind because I just read a great PDF with a detailed history and technical description of WWV and its sister stations WWVH and WWVB:

[http://tf.nist.gov/general/pdf/1969.pdf](http://tf.nist.gov/general/pdf/1969.pdf)

Not directly related to 2FA, of course, but that PDF is recommended reading. These people were hardcore hackers before any of us were born!

<comment><USER21> The suffix of my amateur radio callsign is WWV. A few decades ago, when I actually talked on the radio, there would always be somebody who would ask me what the time was.

Ironically/coincidentally, nowadays I run several stratum 1 and stratum 2 time servers.

</comment></comment><comment><USER22> > the verifier SHALL verify that the pre-registered telephone number being > used is actually associated with a mobile network and not with a VoIP (or > other software-based) service

Is that possible to do this reliably in any country right now? I know you can easily migrate numbers and the oldschool block assignments don't mean anything in a few countries.

<comment><USER23> I moved out of the country and depended on my number being on Google voice to use existing services. I'm also curious how to check if a US number is associated with a VoIP services.

I worked for an international Telecom whose SMS gateway would just broadcast messages to the two other national providers if the number wasn't there's (the other providers would drop messages that didn't belong to them). That was one of my first assignments; writing a task that would check the ported number database and only send the SMS to the correctly ported provider.

</comment></comment><comment><USER24> Github repo for the working documents: [https://github.com/usnistgov/800-63-3](https://github.com/usnistgov/800-63-3)

Issue tracker (discussion/request for comments): [https://github.com/usnistgov/800-63-3/issues](https://github.com/usnistgov/800-63-3/issues)

</comment><comment><USER25> > "...the verifier SHALL verify that the pre-registered telephone number being > used is actually associated with a mobile network and not with a VoIP (or > other software-based) service."

Now this bothers me. I deliberately use a service (RingTo, discontinued for new users) to park a handful of numbers and be able to exchange SMS and MMS with them. One of the things I do not do is give out my actual mobile number to every random web service that wants it for "2FA," primarily because that now opens me up to even more phone spam. With RingTo, I just set that number to always go to voicemail but am still able to use SMS through their app.

It is arbitrary to say "one number type is acceptable for SMS verification but another is not." I'm actually _more_ concerned that my mobile carrier will cough up my account to an arbitrary attacker than I am about some out-of-the- way number parking service that I log into using credentials that are not able to be easily discovered (an alternate e-mail address and such). My mobile carrier is a much larger target _and_ has scores of fallible humans working for it just waiting to be socially engineered.

<comment><USER26> I agree. Namecheap currently only supports SMS 2FA. I'm abroad with a local sim in my phone so I registered my Google Voice # with them. It would really suck if I had to carry my USA sim at all times and swap it anytime I wanted to login to those accounts.

Ideally they'd support the standards so I could just use one of the many standard OTP apps

<comment><USER27> Same problem. Don't know why namecheap doesn't support 2FA app like FreeOTP. Would make it so much simpler and more secure at least.

<comment><USER28> They've been promising to implement a better 2FA option for ages. I just got tired of waiting and moved to another registrar.

It's a shame because in general, I've never had any problems with Namecheap.

</comment></comment></comment></comment><comment><USER29> It's about time. Phone numbers change too much to be used as part of a reliable 2FA. You go on a business trip or a vacation, you of course get a pre-paid SIM card with a local number in your country of destination. It's simple and straightforward, most airports are lined if kiosks of vendors. But then you can't access any of your services. You can't do your work. 2FA should be based around something that isn't tied your location and doesn't change so regularly.

<comment><USER30> For international travellers, I imagine its a problem. Within a country - <USER2> is less a problem. In india at least, we have number portability between providers, so there is little reason to change your number.

</comment></comment><comment><USER31> Good riddance. I live in a basement. I can't tell you how many times I've been scrambling to log into a service that only allows SMS-based 2FA, requiring that I then run upstairs or outside, waiting for my phone's signal to get strong enough that it will receive the SMS, then dash back down before the code expires.

</comment><comment><USER32> I'm curious, do people still consider it "two factor authentication" when you have a mobile device generating (or receiving via SMS) one-time codes and that same mobile device syncing passwords?

For example, if your web browser or password manager is syncing your passwords to your mobile phone, and that's the same phone the SMS codes or TOTP app runs on, is this completely circumventing the whole concept of "two factors"?

Asking for a friend, because I'm sure no HN readers would be dumb enough to do this...

(also, The Register covered this same story yesterday, here's my dupe submission: [https://news.ycombinator.com/item?id=12157529](https://news.ycombinator.com/item?id=12157529))

<comment><USER33> See wikipedia:

> Multi-factor authentication (MFA) is a method of computer access control in > which a user is only granted access after successfully presenting several > separate pieces of evidence to an authentication mechanism - typically at > least two of the following categories: knowledge (something they know); > possession (something they have), and inherence (something they are).

So as long as your phone is sufficiently password-protected, that is is still 2fa.

<comment><USER32> So a laptop or phone with a fingerprint reader and TOTP app would qualify as well I suppose. I think many people assume that two separate devices are necessary for proper security, and I wonder if this is true?

<comment><USER13> Yes, it would qualify. While having additional devices does increase security (harder to break into both the laptop and a phone, or laptop and smartcard/yubikey/RSA SecurID token) its not entirely necessary.

Many physical security systems utilize multiple factors of authentication for access that are tied into a single reader. They often have a badge reader (something you have) and a fingerprint/eye scanner (something you are) or a PIN pad/digital combo dial (something you know) all built into the same device stuck on the wall. Sometimes they'll use separate systems for this, but the combo units are very common.

</comment></comment></comment></comment><comment><USER34> I love Google Auth, and SMS really does have security problems, but you need a 2FA method for dumb phones, don't you? Are there Java apps for it?

<comment><USER24> Or a hardware token. It doesn't have to be a software token running on your existing phone.

That being said, several companies [1][2][3] have in fact made software authenticators that run on J2ME.

[1] [https://guide.duo.com/j2me](https://guide.duo.com/j2me)

[2] [http://www.aradiom.com/SolidPass/2fa-OTP-security- token.htm](http://www.aradiom.com/SolidPass/2fa-OTP-security-token.htm)

[3] [http://www.eset.com/us/products/secure- authentication/](http://www.eset.com/us/products/secure-authentication/)

<comment><USER35> > Or a hardware token

The trouble is with the user (the user is always the problem). What happens if they lose their hardware token? You _must_ have a way to recover that is not exploitable by bad guys but usable by the good people just trying to get back into their account.

SMS fills this pretty well despite its security flaws. I'm not convinced hardware fixes this, at least not in any current form I've seen.

<comment><USER36> My bank gives out hardware tokens. It's super easy to use, and I trust it way more than using SMS, even though they tried to push me over to using SMS (probably cost cutting move on their part). When it gets lost, they can replace it.

<comment><USER35> That sounds like a pretty miserable user experience though. People are forgetful and lose things. Doing something online for the ease of it only to have to wait for something physical seems like a big step backwards as far as UX is concerned.

Until you make good security dead simple it'll never be used by the majority.

</comment></comment></comment></comment></comment><comment><USER37> One possible impetus is the rise in SMS phishing like this: [https://twitter.com/maccaw/status/739232334541524992](https://twitter.com/maccaw/status/739232334541524992)

How do you verify that the SMS is really from your service?

<comment><USER35> > How do you verify that the SMS is really from your service?

The way the phone system works I don't think there is an actual way. It's inherently insecure from multiple angles. Unless there is a way to verify it, reliably, that I don't know about but I tried looking into this before and found essentially nothing useful.

</comment></comment><comment><USER38> The problem with 2FA is that quite often it will turn into (a weaker) 1FA when users gets a possibility to restore their primary password by the SMS.

</comment><comment><USER39> Wouldn't PUSH notifications over the Google and Cloud networks resolve this? I know Google Prompt and Authy do this already because of SMS. Authy posted this a couple weeks ago: [https://www.authy.com/blog/security-of-sms-for-2fa-what- are-...](https://www.authy.com/blog/security-of-sms-for-2fa-what-are-your- options/)

<comment><USER40> Interestingly, when you sync a new device with Authy, one of the options to verify is SMS.

<comment><USER13> IIRC, Authy uses this SMS challenge to authenticate users to allow you to download the database of secrets. This db is encrypted by a passphrase which never leaves the device. So, Authy is using SMS as one part of a multi-auth system to get to the final unencrypted data.

That said, anyone with a SIM card able to get messages for your phone number can download the encrypted database and attempt offline passphrase recovery. It might take a while to brute force, they seem to use a lot of hashing rounds as it takes a couple of seconds to verify the passphrase on a 2014 Moto X.

</comment></comment></comment><comment><USER41> It's annoying in a lot of services I can't use my google voice number to authenticate.

</comment><comment><USER42> Reading through the draft, the level-2 authentication and upwards (AAL-2 [https://pages.nist.gov/800-63-3/sp800-63b.html#sec4](https://pages.nist.gov/800-63-3/sp800-63b.html#sec4) ) spec is encouraging. NIST is encouraging eliminating the password and fully embracing cryptographic authentication (like SSH public-private keys).

</comment><comment><USER43> The biggest threat that other people have mentioned is using social engineering to get a new SIM card that works with your telephone number. I have a google alert for "sim swap fraud". It's oddly under-reported in the US, but quite common everywhere else. How bad is this?? Well, what if at attacker obtained more information about you (ie security questions possibly obtained from a keylogger), then was able to get your phone number, then contacted your bank or other investment broker and drained your accounts? Yes it happens- all the time. It's about time that NIST declares this form of 2FA insufficient. Hopefully the rest of the world will take notice, soon.

I prefer OTP... hopefully there aren't any other RSA-type hacks in the future.

</comment><comment><USER44> What's wrong with SMS to virtual number? I mean how it's less secure than regular number?

</comment><comment><USER45> Coinbase, too hasn't gotten the memo yet.

[https://community.coinbase.com/t/can-i-use-google- authentica...](https://community.coinbase.com/t/can-i-use-google- authenticator-instead-of-sms/1104)

</comment><comment><USER46> In South Africa, this scenario is becoming a big problem: A victim's cell phone, in their possession, is triggered to go into no-signal state which is sometimes not noticed for hours. During this time, criminals are somehow able to capture communication that would have originally gone to the cell phone. Communication like 2FA passwords. This is then used to transfer money out of the victims bank account. How can 2FA over sms be considered safe if this is possible?

</comment><comment><USER47> It's fine that there are flaws with using SMS, but the alternatives -- proprietary apps, proprietary dongles -- aren't any better. They also just create more parties you have to trust.

And if it comes down to using public/private keys, there's no reason an open source SMS app couldn't authenticate encrypted text messages or something.

If SMS in the clear is bad (and it probably is), then whatever is okay needs to be broadly accessible, open, and usable.

<comment><USER48> «It's fine that there are flaws with using SMS, but the alternatives -- proprietary apps, proprietary dongles -- aren't any better. They also just create more parties you have to trust.»

TOTP and HOTP are both open OATH moderated standards. You can use any app or dongle of your choice with any provider that follows the standards. This is a way better alternative than SMS.

</comment></comment><comment><USER49> Here's a story about a friend whose phone number was hacked in a banking Trojan attack: [http://williamedwardscoder.tumblr.com/post/24949768311/i-kno...](http://williamedwardscoder.tumblr.com/post/24949768311/i-know- someone-whose-2-factor-phone-authentication)

In this case it was a land line, but it's still a relevant empirical data point for those weighing options.

</comment><comment><USER50> The list of drafts and request for comments on a range of topics can be found here: [http://csrc.nist.gov/publications/PubsDrafts.html](http://csrc.nist.gov/publications/PubsDrafts.html)

Other than the SMS-based 2FA work, see: \- Identity and Access Management for Smart Home Devices \- Multifactor Authentication for e-Commerce: Online Authentication for the Retail Sector

</comment><comment><USER51> So what exactly is the alternative? I should carry around a physical security token with me for every single account I ever made?

<comment><USER52> Get U2F FIDO USB key ([https://www.amazon.com/s/ref=nb_sb_noss_2?url=search- alias%3...](https://www.amazon.com/s/ref=nb_sb_noss_2?url=search- alias%3Daps&field-keywords=u2f+fido&rh=i%3Aaps%2Ck%3Au2f+fido)) [standard, works with Chrome & Firefox for Google, GitHub and more] and/or install Google Authenticator on your smartphone [works with anything supporting TOTP].

</comment></comment><comment><USER53> Any 2-factor auth is better than none.

</comment><comment><USER54> I'm somewhat surprised NIST is using github (a private company) rather than self-hosting.

</comment><comment><USER55> Does anyone have any experience of using hardware tokens (like the sealed key- fobs) running TOTP?

For some services, I would much rather have a key-ring-ful of these devices rather than an app on my phone which I also use for reading websites.

<comment><USER56> I use a mix of

\- Google two-factor

\- Service-specific two-factor (e.g., Steam authenticator, which provides other features beyond TOTP)

\- Non time-based authenticators; Yubikeys are great, and appear to be made of some indestructible material that survives multiple trips through the wash.

</comment></comment><comment><USER57> Eventually the government will issue identity cards with certificated key pairs.

</comment><comment><USER58> My bank uses SMS based 2FA. I'll send them this link and reiterate they should support U2F, or at least TOTP supported by Google Authenticator.

If SMS is problematic for 2FA, why isn't it problematic for account recovery?

</comment><comment><USER59> I never used SMS 2fa because I don't want my phone number out there.

</comment><comment><USER60> And still in "secure" messengers like Telegram SMS is primary authentication method, not even secondary for 2-factor. Despite documented cases of account hijacks this way.

</comment><comment><USER61> "For now, services can continue with SMS as long as it isn't via a service that virtualizes phone numbers"

How much of an affect will this have on companies providing such a service.

</comment><comment><USER62> I failed to find in the article the reason why it's frowned upon, are there reasons published in the guide?

</comment><comment><USER63> The headline seems a bit click-baity. It seems to merely add some suggested guidelines to how this is done.

</comment><comment><USER64> If SMS is out, any form of verification or identity tied to phone numbers should be too.

</comment><comment><USER65> > To avoid red tape, the Institute is trying out a new method for reviewing > and commenting on the guidelines that isn't quite so official: GitHub.

Ironically, GitHub uses SMS-based 2-factor authentication...

<comment><USER66> Or alternatively authenticator based 2FA, which is their suggested way.

<comment><USER67> Or alternatively U2F, which uses a dongle and is phishing-proof.

</comment></comment></comment><comment><USER68> I will never ever use 2FA if it's not via SMS. I just don't care enough to be bothered.

<comment><USER10> You've never had anybody try to seriously take over the email account you manage domains names with, have you?

(Try owning a domain name with the word "anonymous" in it, and watch the skript-kiddies descend en-mass...)

<comment><USER69> Well, I didn't (I'm not the OP). I host my own e-mail myself.

<comment><USER10> I've been forwards and backwards on that one myself many times...

Do you seriously think you're more capable of securing your mail server than Google/Microsoft/Apple?

Is the time/effort you'll spend maintaining it worth the privacy tradeoffs?

How are you dealing with outbound mail? Where are you hosting your email that isn't already on half the spam blacklists already?

(That last one was the killer for me last time I ran a mail server of my own, neither my home ip address, nor any of the Digital Ocean/Hertzner/Linode/AWS vpses I could easily use/afford to make outbound mail connections with were ever trusted by the big email providers. A self hosted mail service that couldn't reliably get mail into the inboxes of 80+% of the people I correspond with didn't end up being of much use... I've ended up back with Gmail and hating myself for it.)

<comment><USER69> > Do you seriously think you're more capable of securing your mail server than > Google/Microsoft/Apple?

I don't know about Apple, I stay away from them.

I also stay away from Microsoft, but I had to go through some of their products in my time, so there's good chance that I'm more capable.

And Google? Extrapolating how they interact[1] with the rest of the world, it's not improbable, too.

[1] Did you know, they were a source for backscatter for _several years_?

> Is the time/effort you'll spend maintaining it worth the privacy tradeoffs?

Wrong question. The correct one would be: why would I give up access to server logs (yes, I use them sometimes) just to give up my privacy on top of that?

> Where are you hosting your email that isn't already on half the spam > blacklists already?

In a place that is not a known spam source? (Yes, this excludes AWS and Digital Ocean.)

<comment><USER70> >In a place that is not a known spam source?

Examples? Shall we take turns guessing the names of these elusive spam-free providers? Your non-answer reads to me as, "Just don't use any providers that you can actually afford, and you'll be fine!"

(Sorry if this comes across as grouchy--I can't sleep, and I have to get up early tomorrow.)

<comment><USER69> Well, there are smaller companies with own server rooms that offer VPS-es.

I use one in my country (Poland), and I use it since a little longer than Amazon entered our market. I don't think such a regional provider would be of much use to you, unless it operates in your region, of course.

What my comment boils down to is to avoid big hosting places.

</comment></comment></comment></comment></comment></comment></comment><comment><USER71> The double-speak and quack-speak is getting a little thick for me lately.

Government bodies frown heavily on end-to-end encryption, but also frown heavily on authentication methods that are less secure.

Why, whichever directive shall I adhere to? The more secure behavior or the less secure behavior?

Maybe I should just do whatever benefits everyone else but me.

<comment><USER72> Remember this is the same NIST that backdoored the EC coefficients [ [http://safecurves.cr.yp.to/rigid.html](http://safecurves.cr.yp.to/rigid.html) ]. And before that devised the "explanation" of how WTC7 collapsed. [ [http://www1.ae911truth.org/en/news- section/41-articles/927-n...](http://www1.ae911truth.org/en/news- section/41-articles/927-nists-wtc-7-reports-filled-with-fantasy-fiction-and- fraud-intro.html) ].

NIST is a political organisation more than a scientific one.

Here come the down votes.

<comment><USER73> No.

NIST is legally required to collaborate with NSA on crypto. It was widely reported that NIST people fumed about NSA undermining heir standard and they removed the offending crypto from the stNdard quickly.</comment></comment></comment>


Chaosnet - <AUTHOR> http://dspace.mit.edu/bitstream/handle/1721.1/6353/AIM-628.pdf?sequence=2 <comment><USER2> Here's a better copy: [http://bitsavers.trailing- edge.com/pdf/mit/ai/AIM-628_chaosn...](http://bitsavers.trailing- edge.com/pdf/mit/ai/AIM-628_chaosnet.pdf)

<comment><USER3> Thanks. Really helpful. It was hard to trying to make sense of some words.

</comment></comment><comment><USER4> This is "IoT" and "the cloud", circa 44 years ago

> Chaosnet was originally developed in 1975

> The Lisp Machine system is a multi-processor in which each active user is > assigned a "personal" computer consisting of a medium-scale processor, a > suitable amount of memory, and a swapping disk. Files are stored in a > central file-system accessed through Chaosnet. This shared file-system > retains the traditional advantages of a time-sharing system, namely inter- > user communication, shared programs, and centralized backup and maintenance. > At the same time, by giving each active user his own processor, the Lisp > Machine system is much more capable than a time-sharing system at executing > Lisp programs several million words in size efficiently and with rapid > interactive response. Because Chaosnet is taking the place of the file disk > in a conventional system, it must be fast (both in response and in > throughput), it must be reliable (this is the reason why there is no > centralized control), and it must allow connection of several dozen > machines. However, it does not need to operate over long distances. Chaosnet > is used to access other shared resources in addition to the file system; > these include printers, tape drives, and one-of-a-kind specialized > processors and I/O devices.

</comment><comment><USER5> NB: from 1981

</comment><comment><USER6> (PDF) please?

<comment><USER7> The actual URL (stripped of parameters) even ends in .pdf.

The code to add the PDF tag must be very, very simple.

</comment></comment><comment><USER8> Beyond the Abstract, can anyone give a TL;DR on novel or interesting things covered in this paper?

<comment><USER9> Nothing really these days. It was a thicknet (10BASE5) LAN similar to PUP with service names (strings) rather than port numbers. We used it at MIT pretty much only inbetween the AI and LCS machines (which were all in the same machine room and building) but was never really commercialized except that early machines from Symbolics and LMI were just CADRs which had chaosnet interfaces in them so if you had any of those early lispms you needed chaosnet to talk to them.

There were other experimental LAN systems around as well, some commercial some not.

It was all superseded in the mid-late 80s by IEEE ethernet.

It's a little bit of a nostalgia trip for me but if you never used it there's not much to learn in retrospect.

<comment><USER10> It was used way beyond the 9th floor of 545 Tech Square. To the west, the longest cable run was to the NW16 Plasma Science and Fusion Center, I think there were only 2 taps on that cable, it was marginal. To the far south the Mathematics Department in Building 2, and it went east to Building 20 at minimum.

<comment><USER9> True, I'd forgotten that it went to Building 20, but Building 2? Someone wanted to use MACSYMA?

In any case by 83 or so they were building out Athena which was ethernet based.

<comment><USER10> > but Building 2? Someone wanted to use MACSYMA?

As I understand it, they just wanted to be connected to the rest of the world, which their RJE connection to NCARs' supercomputers didn't accomplish.

</comment></comment></comment></comment></comment><comment><USER11> the end of each page washes out and isnt readable</comment>


How to launch in a month, scale to a million users - <AUTHOR> http://www.jperla.com/blog/post/how-to-launch-in-a-month-scale-to-a-million-users

<comment><USER2> _We implemented a library that could create complicated AJAX interactions by writing 0 javascript, instead just adding a few extra HTML tags to code._

I don't understand what this means. Can you please explain how this works?

<comment><USER3> It's a clever idea:

\- In your html, you annotate objects (e.g. a button) with the '.actionable' class

\- Then provide a set of arguments in the html alongside, e.g.

            <div class="kwargs">
                <!-- replace #money with the output from /user/3/money/create -->
                <input name="type" value="replace" />
                <input name="target" value="#money" />
                <input name="url" value="/user/3/money/create" />
            </div>

\- The library then parses the html of .actionable objects, and automatically creates the relevant jQuery bindings for you. In other words, you define the behavior in html, without having to write any custom javascript.

We're experimenting with a few ways of extending this on Memrise (Spencer Davis gets most of the credit here). It's early days, but we're an ajax-heavy site, and devolving certain kinds of basic, repetitive functionality to html feels natural and simple. And, by adding new handler types to the library, it becomes much, much easier to create reusable widgets that we can sprinkle throughout the site.

P.S. Currently, most of this work is still on a development branch that will be live within a couple of days.

<comment><USER4> Pls correct my if I'm wrong.

I see the idea: 1) Write htmls (with some rules, e.g. add '.actionable' class) 2) Library turn them to js codes.

Benefits: 1) Write zero js codes. 2) Make basic and repetitive functionalities eaiser.

But, just wondering, why don't you wrap codes which deal with basic and repetitive functionalities into js functions then reuse them, but write a library to turn htmls codes to js codes?

My question is, html has its job and js has its, too. Is it a good idea to mix them?

<comment><USER3> It's a good question. I don't think I'll have an informed opinion until we've experienced what it's like to work in this way for a while.

But:

\- Joseph Perla's suggestions are usually good

\- It just feels better to me... Maybe because it's easier to auto-generate html (e.g. from a Django template). Maybe because now many of our pages won't need _any_ javascript. Maybe because all the custom logic is in one place rather than spread over the html and the javascript. Maybe because writing javascript is harder than html :)

</comment></comment></comment></comment><comment><USER5> The much more important question is, how does one get a million users. Most startups never figure that out. Focus on that, scale later.

</comment><comment><USER6> The influx of posts about "how to scale" is noticeable. Are more startups having this need? Or are more of them prematurely optimizing?

</comment><comment><USER7> Nice post Joe. Good to see you sharing some of that knowledge.

<comment><USER8> I found it helpful as well.</comment></comment>


Practical NoSQL - Solving a Real Problem with MongoDB and Redis - <AUTHOR> http://openmymind.net/2011/5/8/Practical-NoSQL-Solving-a-Real-Problem-w-Mongo-Red

<comment><USER2> I really like seeing people's thought process as they decide to switch something major, but if I were doing this same task, I think I would have tried more on speeding up the sql solution before scrapping the db.

There are several ways you can calculate a rank, and some (e.g. self join) are inherently slow. Maybe the problem is as simple as not having the right clustered index? Or maybe sql dbs can do more optimization if you tell them to use their rank function instead of selecting out a rownum? Postgres 8.4+, sql server 2005+, and Oracle all have rank functions (one of the 'window functions' in the SQL:2003 standard [http://en.wikipedia.org/wiki/Window_function_(SQL)#Window_fu...](http://en.wikipedia.org/wiki/Window_function_\(SQL\)#Window_function) )

<comment><USER3> The critical functionality in this application seems to be online calculation, i.e. he wants to know a player's exact rank immediately after insert. A sorted set is good for that.

In general I agree though. If you relax the consistency requirement slightly you can get away with regenerating the rank table every minute or so. It takes ~500ms on my machine to generate the ranked table for 500k rows on PG9. Unlogged tables in 9.1 would probably make it faster.

<comment><AUTHOR> as sbov mentioned in another thread, the pro-RDBMS/SQL argument is that _if i only reduce my expectation (admittedly slightly), SQL is a great choice_ doesn't seem too convincing. It's true that approach would be slightly less complicated (only 1 store, but now you have transformation jobs).

</comment></comment></comment><comment><USER4> I'm all for expanding our toolsets, but this seems like the wrong tool for the job. Relational databases are excellent at this sort of thing.

<comment><USER3> I am intrigued. I've been thinking about this problem today, but I can't think of an efficient relational implementation in current DBs. How would you do this? I came up with the following:

1) On get_rank() do a count(*) where score < users_score;

2) Store row_number() over() [...] order by score in a lookup table and refresh every so often. Use this for get_rank() lookups.

The problem I have is that you either have to calculate the rank on read using a linear-time count() or on write which means updating n/2 rows on average with their new position.

edited formatting

<comment><USER4> Recalculating ranks for everyone every time the score changes seems like a difficult task no matter how you approach it. I don't think you really need that for most use cases though. Some reasonable simplifications I've seen are don't rank anyone below a certain cutoff score, only calculate rankings periodically, or only calculate rankings for a subset of the data.

<comment><USER5> But if there is a straightforward solution that allows you to not make these concessions and it can do so with great performance, I'm not sure how you can continue to claim that relational databases are the right tool for this job. Sure, it can do it, but it seems like something else does it better.

<comment><USER4> You're right, I don't have much of an argument for relational databases here.

I am concerned about the complexity of this approach though and I don't think the concessions we're doing away with are that terrible. How meaningful is it to be rank 5623 vs. rank 5249, or even rank 2519? I don't think people can make much sense of ranks beyond 100, but maybe I'm wrong. I would rather break rankings into smaller groups. Which is more interesting, being ranked 23,528 worldwide, or being the town champion? I think the latter is much more meaningful to a person.

<comment><AUTHOR> limiting ranks (to 5000 for most games and 1000 for a few particular ones) is the concession we ended up doing in v1. When we introduced the change, no one complained (or has since) - our developers have been great.

As for complexity. The complexity of learning is a noop as far as I'm concerned. Duplicate data? Not concerned. Managing 2 stores...slightly concerning. Agreed. Maintenance? The entire change is largely encapsulated in a new ~30 line Rank class. Sure, I'd rather not have that extra code.

I hadn't considered rank-groups (thanks for the idea though!). I'll definitely give that more thought. Nonetheless, I think I rather have the raw data available and accessible (in addition to any additional abstraction). I don't like making decision for the developers. Maybe 100 ranks isn't enough for them (I've seen them do some pretty creative stuff with the bit of data we're collecting already).

</comment></comment></comment></comment></comment></comment><comment><USER6> Interesting. For <http://greenfelt.net> we have a single PostgreSQL DB and store all our games in one big table. For the score based games (like tetris) we do everything with Postgres's great expression indices to segregate things into daily, weekly, and monthly high scores ("DATE_TRUNC('YEAR',date at time zone 'UTC')"). We use Postgres's windowing functions to get the ranking numbers.

We don't have very high traffic though--we manage roughly 3000 games/hour at our peak times with our one DB server.

</comment><comment><USER7> Maybe a funny question but why have the word device included as part of the unique key? Wouldn't 1-leto, 1-paul, 3-duke and 2-jess been ok entries for the unique key?

<comment><AUTHOR> we don't use the actual word "device"..it's just a placeholder for the sample. Our actual unique key is a hash of the real device id (which is a UUID) + the name. This means 2 users with the same name on different devices have, or 2 users with different names on the same device, are treated differently.

The approach has worked well.</comment></comment>


Hacker News Instant, Etc - <AUTHOR> http://techcrunch.com/2010/09/11/instantise

<comment><USER2> Looks neat, but the HN links are incorrect. I've already informed the creator.</comment>


Ask HN: How much of your career has been building vs. maintaining? - <AUTHOR> Like most developers, I love to build. Unfortunately, the majority of my career has been maintaining existing applications.<p>I'm curious how much others have spent building new software versus maintaining old. <comment><USER2> As time goes by I don't see much of a difference. If I spent six months building something for client A and then a year doing something entirely different for client B, I will have to puzzle out what my intentions were a year ago just as I would have to do maintaining code anybody else wrote.

Truly agile developers approach development by building a working system that can run but is far from the requirements and then making subsequent changes to the code to satisfy them one by one. Each "Sprint" is just a round of maintenance. Even the first release to production would have been rehearsed on a staging environment so that release might not be such an emotionally charged event because it is not a chance to slow down but instead start fixing bugs and adding features...

<comment><USER3> 80% Maintaining.

There was an article on HN. A while back about the value of maintainers over innovators. Keeping stuff ticking along is just as important and under valued (was the gist).

</comment></comment><comment><USER4> 99% maintaining. I think part of the reason is I want to be paid well and so that naturally filters out greenfield stuff. The well paying greenfield requires greenfield experience in whatever hyperspecific stack they are using.

</comment><comment><USER5> Most of my time has been maintaining. I've gotten the opportunity to build a couple of things as well from scratch and that is always fun, but I get more of a kick from maintaining large existing codebases, learning about them, trying to follow good practices and figure out why certain things were done the way they were. While building is fun, maintaining (if you have the opportunity to take the time to maintain _properly_ and really invest in understanding the system) is rewarding in its own way.

</comment><comment><USER6> 80% building. I do specialize in this field of building things quickly and sustainably.

And in a lot of cases, like a "UI upgrade" of a decade old project we had lately, the hardware, the API, and the tech are so different that it's easier to rewrite from scratch.

Some large companies also contract other massive companies to build things for them, where the code belongs to the contractor. Updates can be very expensive, and so people often rebuild.

</comment><comment><USER7> Depends on the job, but usually about 70% building, 30% maintaining.

There have been some exceptions to this, but they usually acted as a warning that the work environment wasn't going to be right for me. Indeed, it often feels like being stuck on maintenance work implies the managers don't believe you'll be around much longer/don't trust you with anything new.

</comment><comment><USER8> You have to advocate for new features and upgrades regularly. Management typically likes new stuff if you can convince them they'll benefit, either in terms of a splashy project success, expanded head count, increased budget, etc.

Whenever possible, pawn off maintenance on junior programmers, too.

90% new for me, a very grudging 10% maintenance.

</comment><comment><USER9> Arguably, most of the work there is to do on software is maintenance. The percentage will only increase as more and more of the software that people find useful or entertaining has been implemented to an MVP level.

</comment><comment><USER10> I'm stuck inheriting other people's messes (when I far prefer making my own).

</comment><comment><USER11> 97.5% maintaining

2.5% building

needless to say I'm not where I began my career anymore as I believe the ratio should be more balanced

</comment><comment><USER12> Probably 60% maintaining, 40% building. large corporate engineering.

</comment><comment><USER13> 99% building.</comment>


Overthinking Design - <AUTHOR> http://www.smallhq.com/blog/your-startup-is-overthinking-design/

<comment><USER2> While I believe that it works for you, your "early product design" process doesn't sound anything like interface design. It's just a subset of branding. Design is solving problems, not just choosing what the buttons on your website will look like before you have your product or any kind of context (the order of which sounds backwards to me.)

> And it's not all about looks, you know.

You say this, and maybe I'm missing the point of your post, but you continue to describe how this process is _entirely_ about how things look.

Additionally, I have an issue with this:

> Over time, you'll build up a collection of "liked" work that you can show to > any designer to give them a concrete idea of the style you like.

This sounds like a horrible idea. Any decent designer out there knows that Dribbble exists and doesn't need you to point that out to them. They likely have their own "style" (if we're reducing "design" to just aesthetics for the purpose of discussion) and won't like you showing them what "style" you want them to adopt. Their job as a designer is to solve problems, not make things look pretty in Photoshop according to your taste parameters. Everything they produce should adhere to your brand guidelines, but that's it.

<comment><USER3> I think the takeaway is that it lets developers be the designers. Most programmers I know are pretty good at solving problems, but they don't always have an eye for visual details aspect of it. The style guide gives them a framework to work in, and can hopefully prevent a UI atrocity.

Maybe hiring an outside designer to do the whole app would get you better results, but if you're going to toss all of that as the app changes, it might not be worth the expense. Assuming your devs aren't bad at user interaction stuff, this gets you most of the way there at a small fraction of the cost.

<comment><AUTHOR> Very well said. Thank you for jumping in.

</comment></comment></comment><comment><USER4> And you're underthinking your selection of the font color with regards to the background color of the page.

<comment><USER5> I was thinking the same thing; the font color in the blog post can use some contrast.

<comment><USER6> Yes, HN has _ruined_ light grey on white for me as I tend to see it as a downvote. Seriously, I'm not being funny about that - I have begun to perceive low contrast light grey on white as something suspect.

<comment><AUTHOR> It's not that light...

You're saying that people downvote sites for having grey text on white instead of black? That's idiotic...

<comment><USER7> No, he's saying that grey text makes him think of a comment on hacker news that has been downvoted.

<comment><USER4> Oh, this discussion is gold! ;)

<comment><AUTHOR> Hahahah whoops - that does make much more sense :-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Some startups are so early in their field and creating a new industry that design isn't important.

Others are later to the game and can use design to differentiate from those early in the game who didn't get around to it.

And finally some need to think long and hard about their design because it's become a hygiene factor.

That pretty much sums up my take on things.

<comment><AUTHOR> Thanks Thom

</comment></comment><comment><USER9> The designers at Salesforce recently wrote an excellent blogpost that relates to this: [https://medium.com/p/c8f3001f709b](https://medium.com/p/c8f3001f709b)

tl;dr Salesforce made a style guide and a HTML/CSS UI kit of the style guide. This allowed them to implement designs faster.

</comment><comment><USER10> Underthinking Design ?

All they've got here is a style guide. Totally ignoring all the rest of the design process when it comes to the interaction, layout etc.

Maybe if they made the distinction to only say 'Overthinking _visual_ design' but really I'm still not sure what to take away from this article...

<comment><AUTHOR> Added that distinction after the fact. The rest of the product "design" is done by me, the founder/dev.

I don't really think someone needs to be hired for the sole-role of planning wireframes, interaction, and flow.

That is a core skill of any maker.

</comment></comment><comment><USER11> I think it's also worth reading "Why you should move that button 3px to the left"[0] article from Medium.

[0] [https://medium.com/design- startups/c012e5ad32f7](https://medium.com/design-startups/c012e5ad32f7)

</comment><comment><USER12> A style guide is an important way to keep everybody on the same page. Not enough products have one. As others (including the OP) suggest, this is not the entirety of design, but it's a great step after something like Bootstrap to help differentiate the product.

<comment><AUTHOR> Well said

</comment></comment><comment><AUTHOR> Curious to get the hacker perspective on this topic...have you tried this method with your products? Tried something else that worked well? Let's chat :-)

<comment><USER13> Do you ask the designer to create the basic styles / example markup as well? General things like buttons, alerts, perhaps some generic layouts. Or just take the template they provide and have your in house devs hash that out?

<comment><AUTHOR> I'm our only dev :-) I did all of that myself, and modify the guide moving forward as things change.

We just need a good push in the right direction as our visual design skills are seriously lacking.

<comment><USER13> Haha, sounds like me. Using bootstrap and playing around with the styles, I can get the project 80% of the way there visually. I never feel satisfied with my designs though... having a style guide to follow would probably be able to bump me past that.

</comment></comment></comment></comment><comment><USER14> And when you pay good money for a style guide that amounts to the iOS 7 theme, you're underthinking design.

<comment><AUTHOR> We love it, and it's been a great launching pad. Which is what matters.

<comment><AUTHOR> We didn't choose that visual up front, we worked with a designer that chose that look based on the product (Minimal Analytics). The brand has defined the product over time and is very recognizable.

Whereas a flat css theme wouldn't have been unique or recognizable.

But I'm not going to change your mind ;-)

<comment><USER14> It's not unique or recognizable anyway. Minimal Analytics looks identical to hundreds of other sites.

</comment></comment></comment></comment><comment><USER15> But, how to teach old dogs a new trick?

<comment><AUTHOR> Can you clarify? :-)</comment></comment>


One of the oldest known human settlements is about to be flooded by a dam - <AUTHOR> https://www.latimes.com/world-nation/story/2019-10-03/ancient-city-hasankeyf-underwater <comment><USER2> It is not just that we flood regions, but that we cause large scale 2nd order events due to population migrations. Ataturk Dam in Turkey is at least partly responsible for the mess in Syria due to severe multi year droughts.

<comment><USER3> From the end of the article:

      The Turkish authorities began filling the reservoir last year but stopped after drought-plagued Iraq requested it keep the Tigris flowing. In this arid part of the world, locals fear the dam will spark "water wars" with Turkey's neighbors who depend on the Tigris.

      Hasankeyf tourist guide Mazlum Yildirimer said he feared the dam will become a source of "endless problems."

      "For the last 100 years, there have been problems with our neighbors because of a lack of water," he said. "Changing the course of rivers changes the world."

</comment></comment><comment><USER4> The same thing was done in the US in the 50s with the oldest continuously inhabited settlement in North America (possibly older than this one it seems):

[https://en.wikipedia.org/wiki/Celilo_Falls](https://en.wikipedia.org/wiki/Celilo_Falls)

The falls still exist and could be restored if the dam was removed.

</comment><comment><USER5> Well it's sometimes better to give people drinking water than to have old settlments.

[https://insamer.com/en/the-middle-eastern-water-crisis- and-t...](https://insamer.com/en/the-middle-eastern-water-crisis-and- turkey_1510.html)

<comment><USER6> Kudos to that article for apparently writing with the general public as the target audience, but still using proper technical terminology (including thalwag, one of my favorites).

But an emerging principle in infrastructure design is that demand grows to saturate supply, and that's not usually sustainable.

This is true for traffic on the interstate (people avoiding rush hour traffic, until a lane is added) or for water availability (the existence of Las Vegas).

Engineers are uncomfortable with the concept, as it tends to veer into public policy. In the case of flood risk management, us policy is catching up with engineering, and FEMA has been offering block grants for relocation of flood prone communities for some time now.

Sometimes the right answer is to help people move to an area that can sustain them.

<comment><USER7> There's nothing unsustainable about Las Vegas or Phoenix. The desert is a good place to put a lot of people.

<comment><USER6> I mostly agree, as it is today. But Vegas would not exist without the Hoover Dam.

And I'm all for improving civic development and people's standard of living, fully knowing that it's at some expense to nature. That still meets my definition of practical sustainability.

That said...

The Hoover Dam does have a design life and an expiration date. From an engineering perspective, that's sustainable as long as we have a replacement or mitigation plan figured out and in place by that date.

As for right now, there are real present day environmental costs, up and down river, and throughout the desert. The low flowrate of the lower Colorado certainly is not sustainable, although it's also certainly not 100% due to the Hoover dam. And Lake Mead is filling up much quicker than expected. Some people see that the status quo can't last forever, and say that's not sustainable.

It's not much different than New Orleans relationship with levees, although I suspect few people have thought of it that way.

Either way, to think that Vegas could survive without the Hoover Dam is flat out wrong. I'm not saying tear it down and move. I think it was the right decision to build the dam when they did. But if it weren't built yet, would it be the right decision to build it today? I doubt it, at least designed as is.

<comment><USER8> How does a dam like Hoover effect the flow rate of water down stream after filling the dam?

My assumption was that after the dam is filled the flow rate can be regulated very close to pre dam levels of at least 95% flow rate factoring in any losses due to evaporation.

<comment><USER6> Because that's literally what it was designed to do. Absorb the floodwaters and release them slowly.

All the water being siphoned out to supply Vegas and irrigation comes from somewhere. And doesn't make it downstream. Plus all the water retained by Urban build out (ponds, vegetation, pools) that normally would flow straight into a river and head downstream.

Over burden pressure from the lake forces water into the ground. The temperature of the water in the lake rises, causing chemical changes and making evaporation downstream more likely. Sediment drops out of the water column, allowing light to penetrate deeper than it normally would.

All of that is before you even get into the flow rate variance. Because winter floods don't "flush out" the canyon, there are problems with sedimentation downstream, which causes water to slow and evaporate more...

And this is just hydrology/hydraulics, before you touch _any_ of the biological / ecological aspects.

It gets complicated, quickly.

Even if you assume it's only 5% evaporation reduction and exclude what's pumped out, there are at least what? 15-20 major dams that feed the Colorado? Even if you assume 3% times 15 dams, that's almost half the flow of the river, before you even pump anything out.

</comment></comment></comment></comment></comment></comment><comment><USER9> Regrettably, humanity is not as advanced or kind a species as we think we are. Politics and war mean that it's not possible to stop this dam.

On the bright side for the archaeology, the water will protect some parts of the city, and in a century when the existing Turkish government is ashes and dust, some of that will remain to be discovered.

That doesn't help the present residents, but given the situation in their country (which we and other countries have contributed to) nothing will.

We're all to blame, because we share the world.

<comment><USER6> I mean technically war (or just a few dropped bombs) _could_ stop this dam. But I know that's not what you meant.

<comment><USER10> The RAF bombed dams in the Ruhr valley during WW2.

[https://en.wikipedia.org/wiki/Operation_Chastise](https://en.wikipedia.org/wiki/Operation_Chastise)

</comment></comment></comment><comment><USER11> If/when the optimism for metal-organic frameworks is realized, we can finally stop doing this.

[https://www.youtube.com/watch?v=XPSYzLZ7xKU](https://www.youtube.com/watch?v=XPSYzLZ7xKU)

[https://www.sciencemag.org/news/2019/09/crystalline-nets- har...](https://www.sciencemag.org/news/2019/09/crystalline-nets-harvest- water-desert-air-turn-carbon-dioxide-liquid-fuel)

<comment><USER12> Deserts are already pretty fragile environments, seems like removing what little moisture there is in the desert air could have some unintended consequences. Large swaths of the USA are a few ecological disasters away from becoming uninhabitable deserts.

</comment></comment><comment><USER13> >Despite local and international objections, the city and its archeological sites are soon to be flooded due to the completion of the Ilisu Dam.

People who object to nuclear power often claim that in the worst case scenario, the plant might blow up and render large area uninhabitable. And yet we routinely flood settlements and fields with water for "clean reusable energy" even before any energy is generated! And in the worst case scenario the dam will burst and flood even more cities! Not sure how seismically active this area is, but a nuclear plant near this town might've been more preferable in all possible ways, including the amount of energy produced.

<comment><USER14> Nuclear power requires that we have safe nuclear storage facilities for the next 10,000 years or so. That's a huge investment. Considering most Western governments change hands every 4 years or so, then the vote to keep the nuclear storage facilities maintained _must_ succeed at least 2500 times in a row.

Also, do not forget that Fukashima is still an ongoing disaster that's only just recently begun to stabilize.

<comment><USER15> Chernobyl was just restabilized after 30 years, and will have to be restabilized again in another 100.

<comment><USER6> No, the design lifespan of the new containment is 100 years, but decommissioning will be finished before then.

</comment></comment></comment></comment><comment><USER16> Can't they build a wall around? It can't be that big. If it's a site that satisfies the largest number of UNESCO World Heritage criteria, maybe it could be financed internationally?

<comment><USER17> Turkey wouldn't allow it even if the money showed up. This dam is all about control of the Tigris, and flooding the city is a bonus strike against the Kurds as far as Ankara is concerned.

</comment></comment><comment><USER18> [http://archive.is/ShW5z](http://archive.is/ShW5z)

</comment><comment><USER17> >Over the millenniums

That's MILLENNIA!

</comment><comment><USER19> dam, this sucks

</comment><comment><USER20> Instead of commenting please use your network to let this be voiced to the right person.

We already sinned Chernobyl.</comment>


Show HN: Convert scanned documents into searchable PDFs - <AUTHOR> http://www.searchablepdfs.org/ <comment><USER2> Is this based on an open-source OCR engine, a proprietary engine running on your own server(s), or a proprietary engine you're accessing as a service?

<comment><USER3> Given that the OCR'ed PDFs use the "GlyphLessFont" font, it seems that tesseract [1] is used.

[1] [https://github.com/tesseract-ocr/tesseract](https://github.com/tesseract- ocr/tesseract)

<comment><USER4> I hope not. Tesseract delivers bad results on high quality scans, far below the same OCR quality achieved by services like Google Books.

What the OCR market needs is someone who will bring that level of OCR quality - or better - to the masses (perhaps some deep learning grad student with time to kill?), not yet another wrapper around Tesseract. We have those already!

<comment><USER5> Have you looked into ocropy[0]?

Here's a nice intro[1] that later talks about how it achieves higher accuracy using an LSTM model[2].

[0] [https://github.com/tmbdev/ocropy](https://github.com/tmbdev/ocropy)

[1] [http://www.danvk.org/2015/01/09/extracting-text-from-an- imag...](http://www.danvk.org/2015/01/09/extracting-text-from-an-image-using- ocropus.html)

[2] [http://www.danvk.org/2015/01/11/training-an-ocropus-ocr- mode...](http://www.danvk.org/2015/01/11/training-an-ocropus-ocr-model.html)

<comment><USER4> I have not. It sounds interesting but raw and unsuitable for end-users. I hope the quality improves and they can get it packaged up in a way that existing document scanners can plug into easily.

</comment></comment></comment></comment></comment><comment><USER6> Very clean UI. But how can one judge the OCR quality of this service? The service presents me a converted PDF, but how good was the conversion?

Is this better than [https://ocr.space](https://ocr.space) ?

For my private documents I would always use offline OCR software like [http://blog.a9t9.com/p/free-ocr-software.html](http://blog.a9t9.com/p/free- ocr-software.html)

</comment><comment><USER7> While interesting, and looks to be a needed services, the page leaves many questions, such as:

What's the privacy model? While the PDFs are deleted, what happens to the searchable content? Is it also deleted?

What's the revenue model? How can we be sure it'll be around in a few months?

Is there an AJAX interface?

Is the quality or performance better than running Tesseract on a server?

<comment><USER8> Also relevant, how do we know they're not injecting a pdf exploit into the final document? There is no real company information to hold anyone accountable. There could be a dozen websites like this for people to use for "free" that will inject malicious script which most antivirus apps won't detect. Not saying it's not useful, and awesome if legit but there should be more accountability. This is almost the internet equivalent of a stranger in a car waving free candy at a child walking down the street. My workplace was hit yet again today with a Cryptolocker variant (second time this month) which required us to restore thousands of files from backup. All from clicking on a link in an email.

</comment></comment><comment><USER9> I would use this service, if I had scanned PDFs where I didn't care about confidentiality. As it stands, though, uploading them to an unknown web resource seems risky.

Thoughts?

</comment><comment><USER10> I use PDFScanner on my Mac. Works great at scanning time or post-scanning. No, it's not free but it's worth it. Pay the $15, ya cheap bastiches! :-)

BTW, how is this news?

<comment><USER11> HN is not just for news. It's for whatever you deem worthy of sharing.

It comes down to how many people agree it's interesting by upvoting :)

</comment></comment><comment> rm_-rf_slash I've had this idea for a while, but as an iPhone app. The case where I could have used it the most was when I would be studying and looking through textbooks for a particular word or phrase. It would be so convenient to just take a picture, input the text to look for, and see a highlight. If this were a mobile app and I were still in college, I would most certainly buy it.

</comment><comment><USER12> I just use the OCR function built in to Adobe Acrobat.

Don't know it the OCR function is available in the reader version.

<comment><USER13> Same here, have been using acrobat x for this purpose for years, very impressed how good the OCR is.

</comment></comment><comment><USER14> Been hanging here in Firefox now for about 5-10 minutes its a receipt for my insurance (no private info) about 2 pages in length.

Either way, super cool idea. My Dad will be stoked about this as he's been OCR'ing his way into oblivion for the past few years.

</comment><comment><USER15> Is this Web site accessible (say, via screen-reader)? Scanned PDFs can be a huge problem for people who are visually impaired.

</comment><comment><USER16> Is this based on tesseract?</comment>


How much money should my company raise? - <AUTHOR> http://jessicamah.com/how-much-money-should-my-company-raise

<comment><USER2> _Budget at least $80k/employee in payroll, benefits, insurance, and misc costs. (you'll have to budget more if you plan on hiring more experienced talent)_

Competent engineers are willing to get hired for what amounts to ~35k / year?

.... What?

<comment><USER3> I think their salaries are 60-65k.

Insurance/benefits for 20 something developers at a startup consists of ramen and free pizza on Mondays.

That's actually a very reasonable salary and keeps out the guys who are looking to collect fat paychecks working 35 hours/week. You want work/life balance and 100k+ per year? fine, go work at Google. If you want the upside that comes with working at a startup you need to be willing to take on some of the risk.

<comment><USER4> _"That's actually a very reasonable salary and keeps out the guys who are looking to collect fat paychecks working 35 hours/week. You want work/life balance and 100k+ per year? fine, go work at Google. If you want the upside that comes with working at a startup you need to be willing to take on some of the risk."_

That's just a steaming pile of horseshit. I'm sorry to be so blunt, but I've been in this world for a while now, and nothing infuriates me more than when entrepreneurs try to delude employees (particularly _younger_ employees) into working for far below market in exchange for promises of fairy farts and equity dreams.

In a city where a one-bedroom apartment costs >$2,000 a month, $100k isn't a "fat" paycheck. It's right about average. And even if you choose to work below market, the <1% equity stake that most funded startups are going to offer you won't make it worth the opportunity cost in anything less than the most exceptional outcome. You say you're working for $60k a year in San Francisco? Yeah, I hope you're getting a founder-level equity, because you're living with roommates and eating ramen.

I suppose the only plus side to this kind of nonsense is that any developer worth her salt will be poached within _months_ by any one of the _dozens_ of local startups that are looking for engineers and willing to pay market wages.

Don't fall for it, kids: you deserve to be fairly paid, _and_ get some equity.

<comment><USER5> > fairy farts and equity dreams.

If your attitude towards the startup is that cynical, then you shouldn't be working for a startup. Go to bigco where they will pay you lots for doing nothing.

Startups are difficult and need people who want to work hard and sacrifice in exchange for greenfield technical development, high responsibility, and high upside. By all means ask for more equity. But a startup is about the future, not about huge comfy salaries in the present day.

This is especially true given that the economy is now headed back into the toilet. Tide is going out and many startups will die. Those that survive will be those in which neither founders nor employees are unduly greedy.

<comment><USER6> 'If your attitude towards the startup is that cynical, then you shouldn't be working for a startup. Go to bigco where they will pay you lots for doing nothing.'

That's just as cynical. There are bigcos that have fantastic projects AND pay you, as well as startups that offer poor pay and little equity in exchange for lots of hot air.

Unless it's Google or Facebook (or any other mature startup), I'd better be getting more than 2% if I'm being paid less than 50% of standard market rate. Otherwise, the equity is more of a nice bonus than the main selling point.

You're right, many startups will die. All the more reason why people have to be careful about exchanging salary for equity.

</comment></comment></comment></comment></comment><comment><USER7> Bravo Jessica! I think people here may be missing the crux of the article: building a real business -- rather than an initial product -- is quite expensive.

</comment><comment><USER8> Why is it 'crazy' to try to raise as much possible?

<comment><USER9> When you've first started out, you haven't generated a lot of value, even if you've got a plan, a great team, and an MVP. Your company just isn't worth very much at this point, which is why early-stage (angel) investors get large amounts of equity for very small amounts of money.

By raising a large amount of money at a low valuation, you limit your options for future financing, as you can only offer a smaller slice of the pie to future investors, and have to do it at a higher valuation in order to keep your initial investment team happy.

</comment></comment><comment><USER10> How much capital do you wish to raise?

</comment><comment><USER11> Whenever I see news about some startup raising $400K or something like that, I just can't think of what to do with this amount of money (in USA at least). It's so little. Good developers are expensive. Great developers are very very expensive. $400K can get you maybe 2 good developers + an accountant + crappy office space for a year + all kinds of expenses.

<comment><USER12> I agree. We're lucky to be building in a desirable but relatively cheap part of Florida (Gainesville, home to the University of Florida and Grooveshark, and in a state with no income tax) and $400k doesn't stretch very far. I can't imagine what it would be like building in the valley or NYC on that.

</comment></comment><comment><USER3> One of the major reasons some of the funding rounds are so big is that a large chunk of the money is going to buy equity directly from the founders rather than going into the company.

<comment><USER13> Not on the seed or A round they aren't.

<comment><USER3> I've seen a couple of cases locally where founders took a bunch of money in the A round (specifically I'm thinking of Kik.) I guess I don't have much more than anecdotal evidence though.

<comment><USER14> You have no idea what you are talking about. VCs wanted a larger % cut, team didn't want the dilution. Founders still drive the same crappy cars.

[http://techcrunch.com/2011/03/29/ted-livingston-kik- velocity...](http://techcrunch.com/2011/03/29/ted-livingston-kik-velocity- donation/)

<comment><USER3> So the 7M raised was ok for dilution, but that last 1M was just too much to bare?

Just because it's in a press release doesn't make it true.

<comment><USER14> Expectations are a bitch. Once you set them, its hard to undo. I sold personal shares because my co-founders didn't want to be diluted by another 1%.

And Ted's a friend, the press release was for your benefit.</comment></comment></comment></comment></comment></comment>


Ask HN: When will the robot revolution occur? - <AUTHOR>

The microchip revolution has happened and still going strong, the internet revolution has happened and still going strong.
But when will the robot revolution begin ??
When will the day where instead of having to pay 25$ for a haircut, I can go to an automated barbershop and have it done for much less ? Or we replace our cashiers with an automated money-taking and distribution system ?
From what I have seen, the robotic technology is used in manufacturing plants, researched in industry and a few products here and there like the Roomba.
But I still feel we are far behind, one metric of success will be when the military will deploy robots as ground forces to minimize human casualties, but that still feels far far away. And of course it will still take some time before it becomes affordable and starts replacing "people" out of a job - sorry for the cynical tone but it's a reality that should happen to stay lean and efficient.
So what are your thoughts on the robot revolution – do you think we will see something successful in our lifetime ?
How do we start preparing, start programming on microcontrollers with servos, motors and actuators ?
Do any of you work in research labs or universities who can provide me some insights ? <comment><USER2> | Or we replace our cashiers with an automated money-taking and distribution system ?

That's an ATM. We did it already for 90%+ of cash-handling interactions.

| But I still feel we are far behind

Far behind what?

It's hard to find things that robots are good for when you factor in the cost. When you optimize for price/performance, you get for example your dishwasher. It's a robot that does 90% of your dishwashing, for cheap. The other 10% is the tricky stuff and you can't afford the robot that can do it. Even if we had the software for cheap, machines that can do accurate manipulation with a strong grip are expensive to make, requiring high-quality motors with strong magnets, for example.

The current killer app for robots is manufacturing. They already do a lot of it, and have done for 20 years. You just don't see them.

The next huge killer app for robots is the self-driving car. This will come eventually, and it'll save tens of thousands of lives every year. It'll come gradually, and at first it will drive you 95% of the time while you handle the tricky bits. This is how Google does it and they have driven tens (maybe hundreds now) of thousands of miles around California.

Otherwise, you'll soon see flying robots doing geophysical surveys, checking power lines, etc. This is current done by people in helicopters and is expensive. UAVs are getting very cheap and we can control them well.

There are opportunities too in labour-intensive business like order fulfilment. Amazon uses lots of people and could replace some of them with robots like Kiva Systems. Amazon is interesting since they will probably do it cheaply and cleverly, now that Kiva has invested and shown that it can be done.

In summary: the robots you see every day are ATMs, dishwashers, etc. The more robot-like robots are hidden away working for you. Down the road you'll see automated cars. You won't think of them as robots either.

</comment><comment><USER3> It's already happening, just not in the way sci-fi movies portray it. It's software.

You asked when will robots become barbers and cashiers? They aren't being built for that purpose because they are much more efficient at mental challenges than physical ones.

Is is appropriate to use AI and robotics for subtracting $2.34 from $10.00 and handing over the change at McDonalds? No. It is more appropriately deployed in a payments company to crunch huge amounts of data looking for fraud.

Look at LegalZoom's software and how much it has replaced the need for lawyers when dealing with legal documents.

The advantages to software deployed over the web, to physical robotics are obvious. Software can be everywhere at once and is cheap to replicate. It can be updated and patched easily. The "brain" is not susceptible to the dangers of traversing around and is kept safe and constantly backed up.

I think software is replacing the sci-fi robotics we've seen in movies. But there are still interesting companies working on modern robotics, In fact Anybots is run in the same office as YC and <http://www.kivasystems.com/> is another great example.

If you are concerned about robotics replacing "people" in jobs, then rest assured barbers and cashiers are safe and sound. It is scientists, lawyers, doctors, and engineers who should be concerned.

Another interesting thing to watch is whether software can be creative and compete with designers, artists, and writers.

</comment><comment><USER2> | How do we start preparing, start programming on microcontrollers with servos, motors and actuators ?

No, get a CS degree and then go to grad school. Mechatronics is cool and all, but the main advances in robotics in the last 20 years have been in software based on exploiting new state estimation techniques. Stanford's robot car was just a normal car and computer.

On the other hand, you could work on battery chemistry. Advances in batteries will make robots better, along with everything else.

<comment><AUTHOR> Hi, sorry for the delayed response, thanks for your detailed responses, I don't want to go to school again but is there specific classes you recommend like AI, microcontroller programming etc ?

Do you work in the industry, you sound like you do...are you working on Google's self-driving car per chance : )

</comment></comment><comment><USER4> > When will the day where instead of having to pay 25$ for a haircut, I can go > to an automated barbershop and have it done for much less ?

It will probably take some time before a robot is cheaper than 4 EUR per hour (hairdresser's collective agreement in Saxony, Germany).</comment>


Mod_social_skills, mod_rationality - <AUTHOR> http://tales-of-an-it-director.blogspot.com/2008/06/modsocialskills-modrationality.html

<comment><USER2> Compared to other professions, I think the _average_ hacker's social skills are worse, and I am a hacker. Hacking requires high intelligence which is correlated with introversion. Introversion, by it's nature means less time and practice socializing. Before everyone gets offended, I'm only talking about _averages_ , not you or your buddy.

<comment><AUTHOR> This is the thing that throws me. At some point, good social skills came to mean "extrovert". I don't accept that definition. I'd much rather spend my time in deep conversation with one or two people than flitting around like a social butterfly having silly micro-conversations with total strangers. I don't think this makes me anti-social, just more selective.

<comment><USER2> I'm not conflating extrovert and good social skills. I'm saying the bucket of introverts, in aggregate, have spent less time socializing.

</comment></comment></comment><comment><USER3> I'm liking this new blog. It's really making me optimistic about the prospects of a startup.</comment>


Making Yeast Produce Deer Milk and Egg Whites - <AUTHOR> https://youtu.be/ZiWnygcYsiQ <comment><USER2> Hello, you replied to one of my comments about planting trees for income. Is it possible to contact you? Thank you.

<comment><AUTHOR> oh hey. Sure. I'll send you a note when I make some time.</comment></comment>