Is Venture Capital Worth the Risk? - <AUTHOR> https://www.newyorker.com/magazine/2020/01/27/is-venture-capital-worth-the-risk <comment><USER2> In short, this article can be summarized: "VC used to fund R&D-heavy startups like Genentech and Intel, now it's used to make startups grow as fast as possible at any cost, just like cancer". Mostly agree with this.

<comment><USER3> For greenfield plays, the benefits of being market leader are so extreme that "grow as fast as possible" is almost always the right strategy.

<comment><USER4> Benefit to whom?

There are at least 3 parties involved in every VC funded startup, the company, the investors and the customers.

Growing as fast a possbile and becoming a market leader benefits 1 perhaps 2 of those. I would argue usually benefits 1.

<comment><USER5> I think it's hard to argue growing fast doesn't benefit customers. Becoming a market leader means almost by definition that a lot of customers are convinced you're selling the best thing on the market.

<comment><USER6> From another perspective, becoming the market leader might mean that a lot of consumers are convinced you're selling the best thing on the market because you're the only thing on the market because you bankrupted all the other choices. The venture capital growth-at-all-costs model results in monopoly or near-monopoly conditions, which is horrible for consumers. If your business doesn't have competition, you're probably hurting your customers.

<comment><USER5> I suppose I can imagine the scenario, but have any VC-backed companies actually grown big in that way? Doordash is the closest example I can think of, but unless you're considering restaurants rather than end users as their customers, it seems pretty uncontroversial to say that it's been good for customers. Alternatives exist, and both Doordash and the alternatives have significantly expanded the range of foods most people can get delivered.

<comment><USER7> uber's model is/was essentially putting their competition (taxis) out of business with VC subsidized rides.

<comment><USER5> Taxis are still in business in every city I'm personally familiar with. Are there other cities where they're gone?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Sometimes I wonder why people spend all this energy to bash VC. It's a 4,500 words article and there's only have 5-6 companies to mention as failures of the model in the past decade, compared to the tends of thousands that raised money, and all of those are consumer-facing products.

The New Yorker uses Parse.ly (Venture backed company), GitHub (Venture backed company), BrowserStack (Venture backend company), Asana (Venture backed company), Hipchat (Venture backend company), just to name a few they listed on their Stackshare profile [0] (another venture backed company). I'm sure they are glad those were funded :)

[0] [https://stackshare.io/new-yorker/new-yorker](https://stackshare.io/new- yorker/new-yorker)

<comment><USER9> Completely anecdotal and subjective, I know:

Personally I try to steer clear of venture-backed startups when I can for the following reasons.

The first is out of fear of the dreaded announcement about the exciting next steps for the team because they got acquired yay (which typically translates to either the product I was relying on being shut down, merged into a shitty bigger product and/or my data being used by Big Co which is possibly what I was trying to avoid by using a small companies product in the first place. Basically, a service provider being acquired has never translated to a positive to me the customer in my personal experience). Especially if the company gets bought by google: now I can look forward to both having my data taken by google (something I'm going to great lengths to minimise!) and an above average chance of the product getting cancelled.

The second is the pressure to make the big return on investment (not just sustainable profit), which in consumer products usually means advertisement and in b2b often means aggressive analytics.

Finally, if the company wasn't successful enough fast enough it often gets shut down.

Either way, the business pressures usually mean it ends up negative for me, the customer.

<comment><USER10> > dreaded announcement about the exciting next steps for the team because they > got acquired

This announcement usually means it was an acquihire, and the company was already dead, so you have to stop using the product either way.

<comment><USER9> Right, but if they didn't focus on hyper growth because of VC pressure and focused on sustainability instead, then it wouldn't be a problem.

</comment></comment></comment></comment><comment><USER11> Are there any good guides on how to take VC funding but not lose your majority stake or control in your company?

How can you raise multiple rounds but still come out like Zuckerberg? He still returned a lot to investors without ceding control to the board.

Has VC plugged those holes?

<comment><USER12> Grow really fast. It's fairly one-dimensional: if you are growing at +50% month/month, then you will be able to raise substantial rounds with minimal dilution.

If you are not posting exponential growth, then you will likely give up more and more control with each subsequent round.

<comment><USER11> Do you need to raise fast, then?

</comment></comment></comment><comment><USER13> I have a different take on VC and what it means. It's one of the reasons I'm where I'm at in my career. VC-backed companies are worse for employee and the technology community, because they'll optimize the use of open-source software but not the giving back. So your career in a VC backed company (at least in Ops) is mostly cobbling together multiple disparate open source projects into something that "works", but you're restricted from sharing your work publicly to give back to the community.

Contrasting that with large public companies or small bootstrapped companies, both have been much more willing to allow me to open-source my work or contribute to existing projects in a public way. I'm very happy to work for a bootstrapped small company that only produces 100% pure open-source software these days. Something which was always out of reach when I was bouncing between VC-backed startups.

<comment><USER14> very noticeable change in Silicon Valley culture pre-2007 and post-2008 on this topic ; it appeared that there used to be a detectable, "moral" element to FOSS contributions by stakeholders, but post-2008, pure ROI drives have changed that argument .. they stay silent, don't communicate and don't reciprocate.. Apple Inc, who always was in that direction anyway, embraced the change and stopped pretending to give back, too.

</comment></comment><comment><USER15> "Is having money better than not having money?"

<comment><USER16> There are multiple possible funding models for technology companies. VC is not the only way for "having money."

<comment><USER17> Such as?

<comment><USER16> Bootstrap, private equity, angel/friends+family investment

</comment></comment></comment></comment><comment><USER18> In the article it says 80 percent of the investments fail. If you can have that risk, I genuinely don't see the problem.

Heck for my personal angel investments I use 95 percent will fail. Yes it's risky, but the entire point was to find something that returns in the hundreds of percents rather than 7%.

The math works out.

I only worry about evil businesses getting this VC money or uneducated people making bad decisions on investments.

<comment><USER19> Genuinely curious how this works for an angel investor if the failure rate is 95%. How many companies do you have to invest in in order to spread the risk of that 95%?

<comment><USER20> Angel investors are not VC funds. They can approach risk very differently. They don't really need to spread the risk or mitigate it if they don't want to. No one is auditing their investments (besides the tax man). The angel investors I spoke to when I was running my last startup _really_ didn't _need_ to make a profit. They _wanted_ to make a profit because that meant success for a business they thought should exist (and would use in their other businesses in my case), but if they didn't they've only lost some money that they could afford to lose.

<comment><USER19> I get that but, how much money do angel investors have? How long before the 95% failure rate drains their capital?

You'd need at least 20 investments to even think about maybe beating that 95% failure rate, that seems like a very high number of investments for one person to find, evaluate, fund and wait before the 95% catches up to you.

<comment><USER21> You don't need 20 before it's more likely than not that you get a success. And I'm doubtful that the majority of angel investors actual have a net positive return.</comment></comment></comment></comment></comment>


How to work an 8-hour day - <AUTHOR> http://www.philosophicalgeek.com/2008/04/14/how-i-work-8-hour-days/ <comment><USER2> "Don't waste time."

You know what I finally did? I installed this cool little Firefox plugin called "Leechblock". I set it up so that I can only visit Hacker News, Digg, Reddit and all other time consuming websites between 8am-9am, noon - 1pm, and 5:30pm on, Monday through Friday <https://addons.mozilla.org/en- US/firefox/addon/4476>

I have a tendency to read one article which leads to another article which leads me to look something up on Wikipedia which leads me to tell my co- workers about my useless fact finding mission.

Not my browsing habits are restricted to very specific windows and it's really helped productivity wise.

Of course, I could always fire up Sarfari if I really needed to, but I just need to block out that temptation for now.

</comment><comment><USER3> 8 hour work days go against my natural time clock. I got my boss to agree to let me work when Im ready (around 9.30am and get off when Im ready 3-5pm) ... and it has been mutually beneficial

<comment><USER4> Sounds like a pretty good deal, especially for US.

On the other hand, living in Europe generally gives you 8-hour workdays by default.

</comment></comment><comment><USER5> On another note, Desktop Tower Defense is AWSOME!

<comment><USER6> I think the creators of these casual games operate under the theory of relative productivity: You can feel more productive by making everyone you know less productive.

</comment></comment><comment><USER7> "Don't waste time" -- good luck with that one! Might as well rewrite this how- to as "just do it, you lazy bums!"

"How to make a million dollars: 1. Work diligently at something that will make you a million dollars. 2. Just buy a winning lottery ticket."

Admonishments regarding discipline are fairly useless without instruction on how to go about doing so, which is obviously needed if you have to advise someone to be disciplined -- if they already knew how to do it they wouldn't need your how-to.

<comment><USER8> "Do the Right Thing."

"Be smart, not dumb."

I think I've just solved the world's problems.

<comment><USER9> My professor just offered us this piece of advice as we prepare for the final:

When in doubt, put down the right answer.</comment></comment></comment>


Show HN: Hacker News Daily Newsletter - niels-ole http://nielsole.github.io/ycombinator_newsletter/

<comment><AUTHOR> Hi Niels-ole, It's great that you are doing this and it looks very cool. I noticed that you were using freelist.org for creating the list. Is it easy to use and manipulate?

I am asking this because we are also building a tool named pickot (www.pickot.com). We do list watches as well and you can very easily change the filters and criteria. We current do not have a ranking system for list but can very easily adapt one if you wish.

Would you like to take a look and see if it is useful to you? Let me know and I'll be more than happy to help!

Best, Wa

</comment><comment><USER2> Blue links on bright orange background. Nicely done.

<comment> niels-ole The resulting emails do not contain an orange background.

The link color is now gray-ish. :) Thanks for the feedback

</comment></comment><comment><USER3> Very cool!</comment>


Please help me find a specific blog post, you're my only hope (see inside) - <AUTHOR>

Here's the gist from my skype sesh with my buddies
ok, how do I find a random blog post from two years ago dude interviews for a management position and a developer position at a bank I can't look for "interview manager developer bank"
can I just ask on hackernews haha
Homeboy is a programmer working in a bank. Finds out there's a job opening at a different bank for either a management pos or a developer pos. He gets told by his manager he should apply for both. Goes for the technical interview, it's rather technical, it's hard, he isn't so sure about his likely being hired. Goes for the managerial interview, it's all laid back, everyone's talking about going and getting drinks, and it's more about the fit and less about the technical details.
Blog entry is probably about 1-2 years old, I would estimate around 18mos <comment><AUTHOR> And of course my buddy finally finds it after I post a (now that I look twice, horribly formatted) hackernews question

thanks all [https://michaelochurch.wordpress.com/2014/07/13/how-the- othe...](https://michaelochurch.wordpress.com/2014/07/13/how-the-other-half- works-an-adventure-in-the-low-status-of-software-engineers/)</comment>


Why a Hedge Fund Started a Video Game Competition - <AUTHOR> http://nautil.us/issue/54/the-unspoken/why-a-hedge-fund-started-a-video-game-competition <comment><USER2> Annoyed to see a unit error in the first paragraph.

Bulgaria nominal GDP is $50 billion PER YEAR.

Two Sigma assets under management is $50 billion. (Not per year).

If your car goes 100km/hour, and Shelbyville is 100km away, your car is not the distance of Shelbyville.

<comment><USER3> Hyperbolic comparisons like these are very off-putting for me too, but I see them everywhere, presumably "for effect". The effect in this instance is that I stopped reading.

<comment><USER4> I'd saying having the yearly GDP of Bulgaria as AUM is still pretty impressive. And the point is more to contextualize. It's hard when you get past the millions to understand exactly how much we're talking about.

<comment><USER5> It's a bit odd though because I doubt the majority of readers will have any direct experience with Bulgaria to put it in context. It's like trying to explain X in terms of Y, when Y is equally unfamiliar.

<comment><USER4> "The yearly GDP of a sovereign nation, albeit a relatively small and poor one" is a lot more meaningful than $50b without context, I'd think.

<comment><USER6> It is 1/4th of Toyota's or Volkswagen's revenue of one year, so not that much. And last time I checked they did not create a game for recruiting tech talent either.

<comment><USER4> Oh, _only_ a quarter of the yearly revenue of the world's fifth-largest company by revenue, or the second-largest if we exclude state-run enterprises (c.f. [https://en.wikipedia.org/wiki/List_of_largest_companies_by_r...](https://en.wikipedia.org/wiki/List_of_largest_companies_by_revenue)). Alright then.

<comment><USER7> Still stock vs flow.

<comment><USER4> So what? I'm not trying to claim they're bigger than Bulgaria.

If somebody compared the distance traveled by some object to the length of a football field, you could similarly object that the football field is stationary, the object isn't as long as that, etc., but none of those things are the point of the comparison, right?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> So the hedge fund started a video game competition to gain recognition and acquire talent. Well, they are at the top of HN now, so they have achieved their goal.

<comment><USER9> im actually not sure why this article is doing so well. HN ranking is weird.

<comment><USER10> I found Alfred's answers insightful and elegantly stated.

</comment></comment></comment><comment><USER11> An OK marketing piece for Two Sigma, but I don't see why being a Hedge Fund has anything to do with it. BTW, Robocode has been there for years and there is a huge community behind it.

P.S. I work in finance and sometimes find companies in this industry try way too hard to appeal to the younger generation. Lots of marketing pieces sound like dad jokes.

<comment><USER9> i am new to robocode but from skimming through it it seems you are just controlling one tank? this two sigma game involves controlling a swarm of bots with colonizing involved so its a different problem. in any case, just 'cause something exists shouldnt block you from trying your own twist on it.

<comment><USER12> Yeah, I agree that Robocode is very different from Halite.

There are some competitions that are somewhat similar. \- Visually, generals.io is pretty similar to Halite-I, but in actuality ends up being a pretty different game. \- Halite-I is most similar to the Ants AI Challenge of 2011 (which inspired it). \- Halite-II was conceived of as sort of a mix of Halite-I and Planet Wars. \- MIT Battlecode is similar in controlling lots of pieces, but the style of game is very different because Halite is all about emergent behaviors in the game whereas traditionally Battlecode hasn't been. They're also very different from the implementation side for the end-user. \- Codingame can range from somewhat similar to very, very different.

</comment></comment></comment><comment><USER13> Does anyone have a good feel for what real compensation/career trajectory looks like for a software developer at Two Sigma? I always hear about how great the compensation is in finance, but it doesn't look like that extends to software engineers. Glassdoor[1] says ~130k base/~180k total comp, which is good but not great for a software developer in a major metro area.

[1]: [https://www.glassdoor.com/Salary/Two-Sigma-Software- Engineer...](https://www.glassdoor.com/Salary/Two-Sigma-Software-Engineer- Salaries-E241045_D_KO10,27.htm)

<comment><USER14> Maybe they're trying to become more of a tech company so they can pay lower wages relative to finance firms. :v

</comment></comment><comment><USER15> If the goal of this was looking smart to attract smart talent, I feel it didn't work particularly well. At least, by reading the article, I didn't get that feeling.

Any game where the last survivor wins are based on the idea to get involved as little as possible early on (unless extremely high rewards are given along the way).

<comment><USER12> From the 2016 competition, there was at least one Two Sigma hire directly resulting from Halite and several more that were probably resulted indirectly.

Regarding your point about the last survivor winning, that's partially true, but partially not. What you're essentially describing is a proto-version of the non-aggression pact we saw develop in the last weeks of Halite 2016 (and which was indeed largely successful). However, even there, it wasn't quite so simple; competition winner mzotkiew had an excellent write-up of his strategy at [https://github.com/mzotkiew/HaliteBot/blob/master/writeup.pd...](https://github.com/mzotkiew/HaliteBot/blob/master/writeup.pdf). Halite-II makes non-aggression even more difficult due to the lack of discretization found in Halite I.

source: conceived of and co-developed Halite.

</comment></comment><comment><USER9> I recently discovered halite too and I think the origin story is pretty interesting.

from [https://halite.io/about/](https://halite.io/about/)

> Halite I was conceived of and developed by Benjamin Spector and Michael > Truell in 2016. Two Sigma, having had a history of playful programming > challenges for its mathematical and software-oriented teams (e.g., see the > Robotic Air Hockey Competition) retained Ben and Michael as 2016 summer > interns to develop Halite, run an internal Halite Challenge, and ultimately > open Halite up to human and non-human coding enthusiasts worldwide. Halite I > was a great success, developing a flourishing community of bot builders from > around the globe, representing 35+ universities and 20+ organizations.

> As a result of the community's enthusiasm, the Two Sigma team decided to > create Halite II, an iteration of the original game with new rules but a > similar structure and philosophy. With Ben and Michael as creative advisors, > Halite II was developed by David Li, Jaques Clapauch, Harikrishna Menon, > Julia Kastner as an evolution of Halite I. The team considered simply > reviving Halite I, but given the progress the community made and the number > of open source bots that had been published, the team decided to create > Halite II with new game mechanics and a fun background story that fleshes > out the Halite universe. Halite involved moving pieces around a board with > only up-down-left-right options. In 2017's Halite II, bots battle for > control of a virtual continuous universe, where ships mine planets to grow > larger fleets and defeat their opponents.

not bad for just a second iteration. cynical people can view it as just a marketing thing, but you can also think of it as a very successful intern project that I personally would find hard to pull off. in particular i am surprised that there are more "professional" players than university/high school players. ([https://halite.io/programming-competition- leaderboard](https://halite.io/programming-competition-leaderboard))

in the forums there are high schoolers doing well in this game and the fund is choosing not to work with them. i think this is shortsighted. ([https://forums.halite.io/t/two-sigma- interview/312](https://forums.halite.io/t/two-sigma-interview/312))

disclosure - am interviewing with 2sigma.

<comment><USER16> That's interesting because both of the developers attend Horace Mann (still)

<comment><USER9> odds on them having a job when they graduate? :)

<comment><USER12> Ben Spector here; both Michael and I are planning to attend college, but we'll see in ~five years! :)

<comment><USER9> Hey Ben! i'm going to start at 2Sigma soon. would love to meet up with you if you are ever in new york. firstname.lastname@example.com

</comment></comment></comment></comment></comment><comment><USER17> What I _thought_ this was going to say was that they had built a system that translated market actions into a video game context and conversely in real time, such that someone playing the game would actually be trading, without knowing it. Then they could pay people to play the game with some small fraction of the profits they were making.

How's that for an evil scheme? BWAHAHAHAHA

<comment><USER18> Then someone realizes what you're doing and "plays" your game to play you. If you outsource your brain, don't expect your bodies sanctity to stay intact. How's that for an evil scheme.

</comment></comment><comment><USER19> It's a marketing gimmick. Along with a ridiculous algorithms heavy whiteboard interview process (think Manacher's, graph algos)... all for average compensation and you'll probably end up babysitting a database at most. Try talking to someone who actually works there before believing these fluff pieces.

</comment><comment><USER20> Those first two paragraphs make me feel like there's a good TV show about this industry that hasn't been written yet.

<comment><USER21> Billions on Showtime

<comment><USER22> Good the first season, with the tension building up to a peak in the season finale, with the two main characters revving their engines to clash in battle. Perfect for a second season to erupt with unrestrained fighting, and eventually resolve and end the series. Instead, the makers began the "let's draw this out" procedure. :-|</comment></comment></comment>


Operating a Tor Relay - <AUTHOR> https://birb007.github.io/blog/2020/06/06/operating-a-tor-relay.html <comment><USER2> I often wonder what incentives drive people to run TOR exit nodes; the risk even if remote of getting raided is enough to stop most I'd imagine. Got me thinking on the legal implications and interestingly TOR doesn't recommend running an exit node at home -

Found this FAQ quite interesting [https://2019.www.torproject.org/eff/tor- legal-faq.html.en](https://2019.www.torproject.org/eff/tor-legal-faq.html.en)

Particularly

~ _Has anyone ever been sued or prosecuted for running Tor?_ No, we aren't aware of anyone being sued or prosecuted in the United States just for running a Tor relay. Further, we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is legal under U.S. law.

~ _Should I run an exit relay from my home?_ No. If law enforcement becomes interested in traffic from your exit relay, it's possible that officers will seize your computer. For that reason, it's best not to run your exit relay in your home or using your home Internet connection.

<comment><USER3> I think that is one of the reasons why in Germany a registered association named "Zwiebelfreunde e.V." (can be translated to "Onion friends") was founded.

By this it is a legal entity and legal trouble can be handled better than if its against a person but the members of the board still gets trouble with the law. Not long ago they were raided because they were treated as witnesses in a case. (Yes, in Germany even as a witness you can be raided ...)

<comment><USER4> Not just in Germany. US providers can also be forced to hand over data to be used in cases against others. It's just usually not done with a raid since providers will turn over data when asked.

<comment><USER5> Just for context: This is relativly new in Germany. In 2017 there was a change which has as consequences

\- witnesses _have to_ appear in person if requested (by police or DA)

\- witnesses _have to_ make statements regarding the case at hand

This is quite a nice tool if you lack moral. You might request the suspect to appear as a witness and try to leverage the new requirements to make the suspect reveal damaging information.

Maybe this was the reason that Germany was mentioned before.

<comment><USER6> >This is quite a nice tool if you lack moral. You might request the suspect to appear as a witness and try to leverage the new requirements to make the suspect reveal damaging information.

Germany doesn't have protections against self-incrimination? Or does this rely on the suspect being _too_ cooperative for his own good?

<comment><USER7> Germany does have such protection. Parent was probably wildly speculating:

[https://de.m.wikipedia.org/wiki/Auskunftsverweigerungsrecht](https://de.m.wikipedia.org/wiki/Auskunftsverweigerungsrecht)

<comment><USER8> I think you meant to link to [https://de.m.wikipedia.org/wiki/Aussageverweigerungsrecht](https://de.m.wikipedia.org/wiki/Aussageverweigerungsrecht) . Auskunftsverweigerungsrecht, according to the article, is a right of _witnesses_.

<comment><USER7> We were talking about the rights of witnesses?

<comment><USER8> I was referring to this question by the grandparent which I read as being about a suspect's (not a witness's) rights:

> Germany doesn't have protections against self-incrimination?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I have doubts about running a relay on a VPS, or on any other machine that I don't physically control for that matter.

Tor security relies on multiple nodes being hard to seize synchronously. This property goes away if the majority of people run their nodes as virtual machines on infrastructure provided by a few cloud providers.

<comment><USER10> There are thousands of VPS hosters, not a few.

<comment><USER11> How many of those VPS hosters rely on infrastructure from OVH, Hetzner, ColoCrossing, Azure, AWS, or GCP?

<comment><USER12> > OVH, Hetzner, ColoCrossing

Maybe a third or so?

> Azure, AWS, or GCP?

0.1% at best

</comment></comment></comment></comment><comment><USER13> I have run a relay/entry node at home for a while, just to figure out how all of this worked and with symmetrical gigabit I have bandwidth to spare.

The network never promoted my node to an entry but it operated as a relay.

One thing I noticed that my IP must have suddenly been in some lists. I can't prove it but on multiple forums my IP was blacklisted an I had issues accessing some services from telco providers. Never had these issues before and never again after I stopped running the relay... maybe I'm just paranoid.

<comment><USER14> Yes, this happens. Some companies blindly block any IP that's part of the Tor network even if they're just relays. Apple Discussions used to do this, I don't know if they still do.

I consider it a good filter for companies I don't want to do business with.

<comment><USER15> my old company had some bad stuff come out of tor nodes, hired a company to do some analysis, they found i ran a relay at home (employee vpns to work from home from a tor node, is what they said) and thought it was suspicious. so i was called to security and given the grief. sometimes its not worth running a relay from home...

</comment></comment></comment><comment><USER16> Another interesting project I've learned about recently is Snowflake [0] using WebRTC datachannels to use the browser as a proxy to help with additional entry nodes. Technical details are at [1].

I have no experience using it for any extended period of time so use at your own risk.

[0] [https://snowflake.torproject.org/](https://snowflake.torproject.org/) [1] [https://trac.torproject.org/projects/tor/wiki/doc/Snowflake](https://trac.torproject.org/projects/tor/wiki/doc/Snowflake)

</comment><comment><USER17> The screen shot at the bottom of the post is an i3 window manager with title bar hidden. Did not knew titlebar can be hidden in i3 window manager. Its 2 line configuration [https://gist.github.com/lirenlin/9892945](https://gist.github.com/lirenlin/9892945).

<comment><USER18> I love HN for this. Read a blog post about Tor, come to the comments, and learn something new about i3. Thank you for sharing.

</comment></comment><comment><USER19> Why you need balls of steel to operate a tor exit node: [https://lists.torproject.org/pipermail/tor- talk/2009-Septemb...](https://lists.torproject.org/pipermail/tor- talk/2009-September/019511.html)

Why you need balls of steel to operate a Tor exit node

By calumog

I became interested in Tor in the spring of 2007 after reading about the situation in Burma and felt that I would like to do something, anything, to help. As a geek and lover of the internet it seemed the best thing I could do was to run Tor as an exit node to allow those under jurisdictions that censor the internet free access to the information they need. I had a lot of unused bandwidth and it seemed like a philanthropic use of it to donate that to Tor.

Tor is a system of anonymizing proxy servers which allows you to visit resources on the web, not just web sites, without revealing your ip address. This is extremely useful for those who are compromised in their access to the internet because it means, rather than attempting to connect directly to the resource in question, say Wikipedia, which might be filtered by their government, they connect to a Tor relay which ultimately routes the request to the resource in question via an exit node. Exit nodes are special kinds of relays which proffer the request on behalf of the original client revealing their ip address, not that of the original requestor, to the destination resource. I sometimes imagine how exciting it must be for soemone in Burma, say, or China, to load up Tor and browse to a web site they have never been able to see before. And to know that there is nothing, nothing, that reveals who it really is who is visiting.

I totally believe in Tor. I think it is a magnificent force for the circumvention of internet censorship but there is a problem. I was visited by the police in November 2008 because my ip address had turned up in the server logs of a site offering, or perhaps trading in (I was not told the details of the offence) indecent images of children. The date of the offence was about one month after I started the server so it looks as though the site in question had been under surveillance for more than a year. It was what is known as a 'dawn raid' and, amazingly enough, my children were still asleep when it occured. Thank God. I explained to the officers, who we had heard threatening to break the door down before we let them in, about Tor but they had never heard of it. My wife says she thinks they were about to arrest me before that. I was not arrested. I was told not to touch the computer and it was placed, considerately, in a black plastic bag and taken away for forensic examination. I was OK at first. I knew that somebody had gone through my server to access that material and that I was not guilty of any offence but as the weeks wore on it started to get to me.

I was overwhelmed by horror to be implicated in such a thing. I was desperately worried about my family. One of the officers had told my wife that Social Services would be informed as a matter of course and there was a possibility that my children would be taken into care. The low point came about two weeks after the visit by the police when I totalled my car. I was distracted, stressed and unable to accurately assess the road conditions. I ploughed into a hedgerow at speed, destroying the car which we had just bought, but, luckily, walked out of it with only bruised ribs. I didn't have the money to hire a lawyer so I just sat the thing out. From time to time the police called with an estimate of when the investigation would be finished but none of that meant very much because those dates came and passed with no resolution.

Eventually, four months after the visit, I picked up a voice message from the police inviting me to call back. When I called I was told that no evidence had been retrieved and the machine would be returned to me. I think, in retrospect, I was desperately naive to run a Tor exit server on a home computer but I didn't believe that an ip address in a server log would be enough evidence to warrant seizing equipment. My wife, God bless her, was absolutely marvellous throughout the whole thing and never doubted me. I have read with interest about the need to make Tor faster and that that largely depends on having more nodes but there is no way I can contemplate offering my ip address as a service to internet anonymity any more. It was very frightening for me to be implicated in a serious crime. As a parent of very young children I have an extensive network of friends and contacts in my neighbourhood who also have children. As we know the subject of paedophilia is not one that can be debated with any rationality at all in the UK. It is surrounded by hysteria. I was terrified that people would find out that my computer had been taken because of that – 'no smoke without fire'. I don't know what can be done about any of this. To my mind running an exit node is extremely high risk. I think Tor is important but I don't have any ideas about how to support it at the moment.

<comment><USER20> I would have to assume that plenty of home computers, routers, and Android devices are involved in botnets as well. Do unsuspecting people with malware on their device get visited by the police if criminals are using their computer as a relay?

<comment><USER21> Actually, yes. I don't have the source on me right now (so you can take what I say with a grain of salt), but I recall a story of someone whose router had been caught in a botnet. This person was visited by the police in much the same way, with their router being confiscated and eventually returned to them.

</comment></comment></comment><comment><USER17> I have a lot of bandwidth but don't want to spend money on hosting. Has anyone successfully hosted on rasberry pi ?

<comment><USER15> I used to run a relay at home until two things happened. 1) my bank blocked my home internet as it was a listed tor relay node even though it wasn't an exit node. I just told my wife to use the app and disconnect from WiFi so that wasn't a big issue. 2) getting called to security at my company as they had some abuse from tor nodes and saw I used a "tor node to vpn to work" and it was pretty brutal. Nothing came of it (because I did nothing wrong) but I obviously stopped running a relay. Just a warning.

<comment><USER17> The probability of that minor inconvenience is very low and i am going to order Pi's. Today i saw the following news and i don't want this to happen to my country(or any other).

[https://news.ycombinator.com/item?id=23557475](https://news.ycombinator.com/item?id=23557475) [https://yro.slashdot.org/story/20/06/17/142204/china-is- coll...](https://yro.slashdot.org/story/20/06/17/142204/china-is-collecting- dna-from-tens-of-millions-of-men-and-boys-using-us-equipment). I am morally obligated

</comment></comment></comment><comment><USER22> I ran a exit relay outbound over a VPN Tunnel for its internet access, I was mostly just interested in what kind of traffic people are doing. (Its one of the downfalls of Tor, the Exit Nodes are prone to sniffing) and the sheer amount of porn was amazing.

<comment><USER23> I'd be interested to know statistics on Tor usage. I get that people espouse it's intended legitimate privacy purposes, but I would expect that even the most ardent supporters would acknowledge that it's probably 1% "legitimate" use and 99% illegal or gray-area use (the latter being things like torrents, or porn that's not illegal but embarrassing if people knew about).

I wonder at what point the supporters of Tor would continue to support it. What if it were 0.0001% genuine needs for privacy, and 99.9999% illegal stuff?

Perhaps I'm totally wrong though. Do such statistics exist?

</comment></comment><comment><USER24> Tor is a project I _want_ to like and support, but can't. I feel (and I have no evidence) that for every 1 person using it to protect their privacy, 20 are using it for despicable purposes. I would love to be proved wrong on this.

I don't want to shut it down, but at the same time I don't feel I can personally or technically support it.

<comment><USER25> e-crimes are victimless crimes

<comment><USER26> Sometimes there are victims. [https://nakedsecurity.sophos.com/2020/06/12/facebook-paid- fo...](https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-for-a-0-day- to-help-fbi-unmask-child-predator/)

<comment><USER25> I really can't consider that man a victim.

<comment><USER26> Maybe I want clear, if maybe you're joking. I was thinking of his victims.

<comment><USER25> Ah fair enough then. Yes, I had not considered this case of blackmailing.</comment></comment></comment></comment></comment></comment>


Watch the world currencies flow into BTC in realtime - <AUTHOR> http://fiatleak.com/ <comment><USER2> The idea is nice, but this thing is a complete nonsense. The required information to create such a map is simply not available.

Some are wondering about the lack of activity in certain regions: There is trading activity in these areas.

Disclaimer: Former exchange operator

<comment><USER3> > The required information to create such a map is simply not available.

All the major cryptocurrency exchanges have open APIs that offer access to completed USD/BTC exchanges- Of course there's gaps in the information, why would anyone expect otherwise?

<comment><USER4> What gogeek means is that this site pretends to show what countries Bitcoin buyers are located, but we simply don't know that. For example if GDAX's API shows a BTC purchase in USD, this site will show the buyer as being in the USA, in reality the buyer could be in any of the numerous countries where the exchange operates ([https://support.gdax.com/customer/en/portal/articles/2425188...](https://support.gdax.com/customer/en/portal/articles/2425188-which- countries-and-states-can-access-gdax-))

<comment><USER5> I don't think that is the premise of this, though - it's not showing where the purchasers are located, but what currency is being traded.

</comment></comment></comment></comment><comment><USER6> Nothing happening in the Eurozone? or Japan?

<comment><AUTHOR> It seems that (for obvious reasons!) the bulk of the action is happening in US and China. However, I am also surprised that currently transaction volume in currencies of Brazil or Russia exceeds those in Euro or Yen...

<comment><USER7> The bubble is strong here in Brazil. I've recently had lots of nontechnical acquaintances talking about bitcoin these last months.

<comment><USER8> People also talk a lot about amazon, Facebook, and google. Doesn't make it a bubble.

<comment><AUTHOR> JOE KENNEDY, a famous rich guy in his day, exited the stock market in timely fashion after a shoeshine boy gave him some stock tips. He figured that when the shoeshine boys have tips, the market is too popular for its own good, a theory also advanced by Bernard Baruch, another vested interest who described the scene before the big Crash:

"Taxi drivers told you what to buy. The shoeshine boy could give you a summary of the day's financial news as he worked with rag and polish. An old beggar who regularly patrolled the street in front of my office now gave me tips and, I suppose, spent the money I and others gave him in the market. My cook had a brokerage account and followed the ticker closely. Her paper profits were quickly blown away in the gale of 1929."

</comment></comment></comment></comment></comment><comment><USER9> im starting to think bitcoin should probably be illegal. its perfect for criminals, with very little value for anyone else. its also potentially catastrophically destabilizing for states. you are welcome to change my mind, but know that im not ignorant of it and have been "using" it since 2012.

<comment><USER3> You would probably like the Economist Kenneth Rogoff and his book "The Curse of Cash": [http://press.princeton.edu/titles/10798.html](http://press.princeton.edu/titles/10798.html)

It argues that cash, precious metals, and alternative currencies should be done away with and that we should all become dependent on digital bank accounts controlled and monitored by the government- That way, if a bureaucrat is confused by any transaction you are doing they are free to just freeze all your funds at a moment's notice.

Hope you enjoy living in that world!

<comment><USER10> > The world is drowning in cash—and it's making us poorer and less safe.

> So what is all that cash being used for? The answer is simple: a large part > is feeding tax evasion, corruption, terrorism, the drug trade, human > trafficking, and the rest of a massive global underground economy.

Don't expect me to be automatically convinced that tax evasion and corruption are making me poorer and less safe. Tax evasion makes everyone except the government richer and corruption makes it possible to buy freedom (such as in countries with drafting).

States may profit from trade restrictions individually, but if everyone restricts trade of whatever he wants, world is just driven into Nash equilibrium, where everyone is poorer than without restrictions. Corruption makes it possible to bypass these restrictions by bribing the customs. So corruption also makes us richer.

<comment><USER11> >Tax evasion makes everyone except the government richer

Oh, really? The alternative to modern taxation is not no taxation, but rather massive taxation where it's hard to evade (for example customs) of the kind we had in the middle ages. While we can come up with arguments for and against this, there is a strong positive correlation between tax evasion and poverty, which means that the burden of proof lies on you.

>So corruption also makes us richer

So, would you say that the music industry's lobbying in Washington makes the US richer? Corruption is the mechanism by which established players stack the deck against newcomers, avoid environmental and health regulation and so on and so forth.

Listen, governments make the world go round. Countries with bad governments become poor. Countries with good governments become rich.</comment></comment></comment></comment>


A Strange Form of Life Could Flourish Deep Inside of Stars, Physicists Say - <AUTHOR> https://www.sciencealert.com/physicists-argue-that-life-based-on-cosmic-strings-may-be-possible-inside-stars <comment><AUTHOR> >Can Self-Replicating Species Flourish in the Interior of a Star?

[http://journals.andromedapublisher.com/index.php/LHEP/articl...](http://journals.andromedapublisher.com/index.php/LHEP/article/view/166/85)

</comment><comment><USER2> Whenever I see stuff like this I can't help but be reminded of something Rupert Sheldrake has proposed for decades... [https://www.youtube.com/watch?v=SFhsObpja8A](https://www.youtube.com/watch?v=SFhsObpja8A)

</comment><comment><USER3> Ahem: [https://news.ycombinator.com/item?id=13906315](https://news.ycombinator.com/item?id=13906315)</comment>


Exploring portable ratings for gig workers - <AUTHOR> https://medium.com/doteveryone/exploring-portable-ratings-for-gig-workers-5632fd9b262e <comment><USER3> Not sure how I feel about "portable" ratings. Sometimes people just need a fresh start and a chance to reinvent themsleves with a new gig in something totally new. If enough folks start carrying around their stars from one gig to another, employers are going to expect it.

Gig workers who find themselves in a rut of poor performance for one reason or another just aren't going to be able to escape the old judgements of their performance for much longer periods of time. It's oppressive.

<comment><USER4> It's a double-edged sword. I've hired some pros on Thumbtack and Taskrabbit that were industry veterans and had to struggle to re-earn their reputation when starting from fresh on gig sites. They probably really would have benefitted from being able to carry a reputation from other systems.

Making reputation-follow "opt-in" makes a lot of sense. (Perhaps with egregiously negative reputations being weighted at least somewhat.)

<comment><USER5> Sure, that would make sense for the top 10% of performers. But most people aren't in the top 10%. They're already working in the "gig" economy, which is notorious for its instability and continued deleveraging of the worker. Wouldn't this just amplify those issues over time?

<comment><USER4> I don't see how it would amplify over time - in fact maybe the opposite. If you could opt-in to carry over, you build your reputation over time even as various gig marketplaces come and go. It encourages new marketplaces because workers don't have to worry about building up a good reputaion all over again on a new site, so they're probably gonna be more likely to try out new sites.

It discourages scammers because customers know even workers that are new to the platform have built up a good reputation elsewhere, and they know that anything seriously bad will follow them.

I see primary difficulty in how to communicate the "egregiously bad reviews will follow you" effect and how to determine which reviews are egregious. Plus it's like 100% probability of it being gamed with bad-actors somehow...

(Personally I'd define the "egregiousness scale" to be a time-weighted average that's also weighted by the percentile of the reviewer's average rating - <USER2> you give all your gig workers 3 stars, then 3 stars is effectively 5 stars for you so workers see that benefit, and reviews further in the past count less against you both pro and con. But I'm not qualified to know if this would actually work out.)

<comment><USER6> It makes someone new to the economy have to work even harder to get a start.

If there is a new gig platform and I have 0 rep, that's fine because everyone has 0 rep.

If there is a new gig platform and I have 0 rep, and a lot of people brought their portable reputation with them, it means I have a disadvantage.

It does provide more knowledge to consumers, and it does allow people to make different choices about who works for them.

<comment><USER4> I like your notion of a level playing field, but I think you're basically saying we should ignore past experience on other marketpalces because it favors people with an established track-record? Isn't someone with a proven track-record exactly the kind of person we _want_ to favor?

Gig marketplaces come and go. If you spend 5 years working dozens of jobs a week to build up thousands of positive reviews only to have the marketplace go belly-up and now you have to start at zero, how do you think the gig economy can retain actual talent that expects to get paid well for their proven track- record?

Or put it another way: I personally like the option of being able to pay more for people with a long history of positive reviews. I'm willing to pay much less to hire an untrusted worker. I don't think I'm alone. If everything starts at zero every few years, then all the wages reset to baseline every few years as well.

Sure let people start at zero, but also let them get paid like an untrusted worker. And sure, let people bring over their experience. But let them get paid and charge like they have that experience.

<comment><USER6> Describing who benefits from properties of one policy (non-transferable reputation) is not an inherit stance in favor of that policy.

Every policy has winners and losers. I just felt like on this discussion thread there was a loser (people entering the gig economy) not mentioned.

<comment><USER4> Good point.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> The fundamental problem of the rating systems is how to prevent one party or another (those who receive and those who write reviews) from abusing the system for their own advantage? The two obvious problems are: 1) fake reviews 2) blackmailing ("give me free stuff / discount / do what I say or I'll give you 1 star").

While the first problem is obvious, the latter is especially hard and I have yet to see it solved properly. The only place that comes to my mind that has somewhat mitigated it was early eBay that had ratings for both sellers and clients, so dishonest client would receive low ratings. But it also tended to discriminate new users as there's no way to distinguish between a honest, new user and just another single-use account for a scam. Furthermore, it only works on an established system, as you need to have many ratings to filter out noise, so it's a chicken/egg game ("nobody uses platform, because there's not enough users" / "there's not enough users, because nobody uses the platform").

I don't see how these problems could be solved without a 3rd party arbitration, but to do this you have to move back to square 1 (centralized service).

<comment><USER8> Bi-directional reviewing from verified transactions seems to work well in dark markets on both of those problems, which are probably one of the marketplace structures with the least amount of in-built trust. You also see 'also find us on xxx market as yyy' which is an attempt at transferring reputation.

<comment><USER7> Yes, but as I've mentioned, you need a 3rd party arbitrage/platform on every transaction to achieve that which counters the "portable" idea.

</comment></comment></comment><comment><USER9> This is so indicative of the difference between the US and China.

So in China they're looking at a Social Credit System (which has been talked about here before [1][2]) which is a government program which would apply to all Chinese citizens and rate their trustworthiness. It's seen as authoritarian, providing no way to start over, etc.

Here in America we've got this post and it's implication that we're going to institute a similar social credit system except it will come from corporations, not government and it won't apply to everyone, only gig workers. It's seen as an interesting technical problem and a way to increase market efficiency.

A tale of two viewpoints.

[1] [https://news.ycombinator.com/item?id=13201926](https://news.ycombinator.com/item?id=13201926)

[2] [https://news.ycombinator.com/item?id=9445538](https://news.ycombinator.com/item?id=9445538)

<comment><USER10> Reminds me of Black Mirror episode where everyone is rated by the number of stars they receive and are obsessed with the likes or dislikes. 0 stars end up in a dungeon even if they've broken no laws. Very cypberpunk/dystopian.

<comment><USER11> If you look at the practice of redlining the extension of credit within the boundaries of black urban communities for home and business loans this was basically applied at a neighborhood wide scale. The negative effects are still seen today. One would essentially lose stars for living in a certain area or being a certain race.

<comment><USER12> I pay double for insurance because of my age and genitals but that's ok because statistics /s

<comment><USER13> Devils advocate: since insurance is a business of pricing risk, isn't the point of it to use statistics to charge more to higher risk people? I've been in that group/situation before and it sucks to pay more, but, in a sense it is _more fair_ if you pay more to be a higher risk, otherwise you end up charging lower risk people the difference.

<comment> temp-dude-87844 The point of insurance is to group recipients with different likelihood of risks into the same risk pool, such that it's very unlikely that many of your insured will need a payout at the same time. How you set pricing is largely a different matter.

Now, as an insurer, you have a monetary interest in ending up with as few riskier clients as you can. You can try to use pricing or exclusions to try to achieve this, but regulations often step in, because otherwise only the least risky clients could obtain insurance, and everyone else would have to fend for themselves. However, the least risky people often don't even want to purchase insurance, because they perceive its utility to be low, and the incidence of catastrophic events to be unlikely.

This generally means that clients who perceive themselves to be low-risk will place a lower value on insurance, necessitating a lower price, or they'll take their business elsewhere or nowhere at all. People who perceive themselves to be higher-risk will "accept" a higher price, because they expect to have a better outcome with insurance than without. Since companies want to _avoid_ this type of customer, prices can creep higher than they need to be just by factoring in their risk.

<comment><USER14> This discrepancy happens because insurance works well for unknown risks that are independent from the entity being insured and for uncorrelated events. Similar to healthcare, vehicle collisions are highly dependent on the driver, and so some of the risk is not unknown, and hence can be priced.

Pretending you don't know the risk factor when you do (perhaps in the name of fairness) can also cause problems.

<comment><USER12> The low risk group (older, married, men and women) are the best positioned to absorb a rise in premiums so I'm not sure what problems would be caused.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> > we felt like we had a sense that reputation portability was a real issue for > some gig economy workers

But it wasn't an issue for the "gig economy" platforms. They are happy to lock in workers by not exporting ratings. On top of that, accepting imported ratings would provide a boost to the competitors that export ratings. So, what's the business case?

Pretty design, but I'm amazed somebody could write an article covering so many detailed questions and not even touch on this rather fundamental one.

It reminds me a bit of the heady OpenID days where every piddling website was an OpenID IdP (identity provider), but next to no websites actually accepted OpenID logins.

</comment><comment><USER16> Since these systems all attempt to extrapolate future performance based on past experience, they are almost by definition an affront to free will.

The problem is that when something as important as someone's livelihood depends on factors outside their control (like someone else's subjective impression of their performance) then it opens the system up to corruption/gaming/extortion.

It's probably valid to keep a log of someone's employee history. But it must be under that person's control and they must have avenues for disputing its contents or expunging it in its entirety (similar to a bankruptcy).

If we go down this road, then it must be balanced by employer ratings such as payment followthrough.

</comment><comment><USER17> >> "Cab" drivers didn't have visible habits around their ratings, weren't checking them frequently and when we spoke about them, they told us that this wasn't something they'd considered before or something they were particularly concerned about. They were confident in their skills and ability to find work outside of their platforms, and viewed ratings more as performance indicators for their platform owners — the main fear being a drop below 3.5 stars, where they might be dropped from the platform completely.

This is a shorthand way of saying the drivers themselves aren't even checking their ratings, as long as they're above the performance threshold! This paragraph gives away who 'ratings portability' is really serving, and it is not the drivers.

<comment><USER18> It's neither the _drivers_ nor the _customers_ , either. When I need a Lyft, I don't get a choice between three drivers with various star ratings - I enter my location, and someone accepts the ride. The rating is only good for the _employer_.

<comment><USER19> The rating also benefits the customers. You don't get a choice between drivers, because only drivers with a high enough score will be allowed to continue on the platform. This might be harsh to the drivers, but it makes for a good customer experience. It's one of the reasons why the experience of using Uber/Lyft is so much better than the experience of using most traditional cabs.

<comment><USER20> Unless Uber/Lyft decide that below-4-stars rated drivers can keep working for them... they just receive a smaller cut of the price paid by the customer.

</comment></comment></comment></comment><comment><USER21> Social credit imposed by corporate rather than state power isn't any less of a bad idea. Perhaps there are reasons why every decision a person has ever made shouldn't follow them forever such that they need to show it to their future employers.

A better system would be to just force people to wear their overall positive rating percentage visibly on their clothes in large red print. We can call it... the scarlet number.

</comment><comment><USER22> There's a Black Mirror episode for this isn't there?

</comment><comment><USER23> From a technical standpoint, this is largely the same problem as the portability of other user data, with the added complication that the data must be signed by an identifiable originating party other than the user that the receiving party can correspond -- and establish a trust relationship with -- to verify the lack of tampering.

Online services have been around for a long time and yet very few implement data portability. Often, it's part of their moat against competitors and ensures lock-in. Few incentives exist for incumbents to offer data export.

From a social standpoint, this raises some serious issues. Distributed reputation systems exist informally, whose lack of universal applicability give them _some_ protection against trivial malice. In the financial world, various credit scoring systems use trusted third parties to aggregate information from entities one has transacted with, and offer a service for other parties to obtain this information on the user's request. In some places government-issued strong authentication is used to establish identity, but in the US, weak identification and publicly available information is used as a challenge to the user to establish their identity. Both of them come with a host of issues that ought to be cause for concern.

If no link to some "higher form" of identity is implied, then the problem becomes almost trivial: each user of 'Service A' can become a cross-referenced user on 'Service B' by proving control over their account in 'Service A'. But this too is vulnerable to credential theft, and new guises can be created at any time by just creating additional accounts in 'Service A'.

</comment><comment><USER24> Definitely not. I saw the Black Mirror episode.

</comment><comment><USER25> The biggest problem is objective metrics. Did someone try to make contact when something came up? Were they on time? Did the work get done properly? Did the provider behave in a professional manner? All of the most important judgments are inherently subjective and biased. This then leads up the chain into the problem of rating the rating reputations of the raters.

</comment><comment><USER26> Why would you need this for these "gig" economy jobs as they are all low/no skill jobs all that's required is that you have no alternate job and are desperate.

</comment><comment><USER27> I was recently reading [1]. In Chapter 2, this kind of 'ratings sharing' is detrimental to your own employment. Didn't work so well at the last place? The software remembers and won't hire you for the new place. If that's where this is headed, it won't be good.

[http://marshallbrain.com/manna1.htm](http://marshallbrain.com/manna1.htm)

</comment><comment><USER28> Can we call it "day labor" from now on?

</comment><comment><USER29> We need portable data for everyone and everything, but we also need to be careful to do it in a way that doesn't become oppressive and centralized or inflexible. So there should be some compatibility but not a single system or rating.

</comment><comment><USER30> How do you keep it from being gamed against women and minorities[0]?

[0] For example.

</comment><comment><USER31> Hey it's The Circle but even more naive.

<comment><USER32> Please don't post snarky dismissals here. An informative comment can be critical while teaching the reader something, but this just puts down someone's work.</comment></comment>


Ask HN: Famous Programmers' Editor Choices? - <AUTHOR> Dennis Ritchie used and Russ Cox and Rob Pike use acme.
Ken Thompson, Bjarne Stroustrup, Doug McIllroy, Tom Duff and Brian Kernighan use sam.
What editors do other famous programmers use? Do other famous programmers also use mouse-based editors like sam and acme? What other editors are used by famous programmers?
Why do so many Hacker News readers have such an aversion to using the mouse when editing if these luminaries of computing have all moved on to mouse-based editors? <comment><USER2> > Why do so many Hacker News readers have such an aversion to using the mouse > when editing if these luminaries of computing have all moved on to mouse- > based editors?

Because most of the HN readers (those who are programmers, anyway) are down- in-the-trenches programmers, and as such, they choose whatever editor/environment makes it the easiest to edit source code. If it is Vim, it is Vim then. If it is Emacs, Emacs it is. Nano, Elvis, ed, Sublime Text, LibreOffice Writer, Inkscape, Gimp -- whatever helps to write. It's the code that is published on SvnHub or whatever, after all, not the environment's settings.

<comment><USER3> Totally agree. Hacker News readers like to promote their favorite, but I think most of us are ultimately pragmatists. For example, Vim is a personal favorite, but I've been using Microsoft Office's built-in VBA editor for most of my recent programming because it fits the problem I'm trying to solve best.

</comment></comment><comment><USER4> A lot of famous programmers, or programmers in general, use whatever tool was most comfortable for them at the time they were getting established, and many stick with it from habit/familiarity/power user features.

So use what you like best.

</comment><comment><USER5> Using the same brushes as Leonardo da Vinci will not make you a better painter.

<comment><USER6> But knowing the reasoning behind using certain thickness/brands of brushes might make you learn a thing or two and apply them to yourself. This is the same reason people share workflows.

<comment><USER7> However that still will not make you a great painter.

</comment></comment></comment><comment><USER8> > Why do so many Hacker News readers have such an aversion to using the mouse > when editing if these luminaries of computing have all moved on to mouse- > based editors?

What someone else uses doesn't enter into my decision of editor to use. I also tend to work on systems remotely. Using a mouse is generally not an option. There's a flow that I like about not needing to switch back and forth between two input devices when I'm doing something.

</comment><comment><USER9> The one you are most comfortable with.

Sometimes you don't have a choice and have to use what your employer has. I used edit.com and Notepad before for C editors and they had no highlight of syntax or not.

Really hard to beat Visual Studio languages though.

</comment><comment><USER10> Here's a few of them that use Emacs: [http://wenshanren.org/?p=418](http://wenshanren.org/?p=418)

</comment><comment><USER11> Bjarne uses Notepad++. Another interesting thing, these Unix hackers, Bjarne, Dennis Ritchie, eventually have switched to Windows for everyday tasks.

</comment><comment><USER12> All roads lead to Emacs

</comment><comment><USER13> Linus Torvalds used/uses micro-emacs.

(off topic, he used/uses Pine/alpine for email).

</comment><comment><USER14> Think about the cognitive load of using just keyboard all the time VS using mouse and keyboard alternatively.

</comment><comment><USER15> Who cares what those people use? Use the tool that's right for you.

<comment><USER11> Well, you may not be aware of what is best for you...

</comment></comment><comment><USER16> Two words: Emacs. Vi.

Boom.</comment>


Ask HN: I'm confused - <AUTHOR> I am confused. Let me explain.
I have been a software developer for around 20 years. I started writing software commercially after high school.
I am in my forties and since last 3 years I've been heavily involved with AngularJS. Even though I have been working with AngularJS for some time, I feel that soon time will come when companies will move away from Angular. This is already happening. React seems to be where everyone is heading.
At time I feel that I should just give up chasing new fads and maybe get myself into something more long term. What should that be? I'm not able to figure out. Should I get myself into Python or perhaps a data technolgy. Or should I continue going after the latest JS framework which most likely be taken over by the next latest and greatest?
I enjoy my work and I feel that software development is my true calling. Out of frustration at times I decided to change my occupation but one look at code or reading about some latest technology has pulled me straight back in. <comment><USER2> Are you in a financial position to take some risk? If there is a certain technology that you love, there may be a niche market for maintaining older code. I know someone who has been doing Smalltalk exclusively for almost 20 years. He works remotely from his home. I know someone in their 70's who was hired to port code they wrote in their 20's.

<comment><AUTHOR> I can take some risk.

That would be ideal for me. How would I go about getting myself into such a situation? I feel that I have wasted too much time chasing new and sexy.

<comment><USER2> Might be a good time to renew some old business connections from the past, that could be a good way to start.

<comment><AUTHOR> Thanks. I have started the process. Step 1 is to update the resume :)

</comment></comment></comment></comment><comment><USER3> The Python community will welcome you with open arms. And there's plenty of demand for "Python and JavaScript" so your JavaScript won't become useless if you start doing lots of Python.

<comment><AUTHOR> Thank you for your kind words. Funny enough, today I got an email saying that the role I'm interested in is too junior for me. This was an AngularJS role I applied for. I think the perception is that Angular/React/LatestJS-Framework are for younger lot.

As you suggested, the combination hopefully should put me in a good position. Thanks again for encouragement. I really need it.

</comment></comment><comment><USER4> Angular, React, what's the big difference? "JS on the frontend" isn't "short term", and there's always fads to navigate.</comment>


Professor suspended for using Chinese word that sounds like Racial Slur - <AUTHOR> https://www.insidehighered.com/news/2020/09/08/professor-suspended-saying-chinese-word-sounds-english-slur <comment><AUTHOR> This man has done nothing wrong.

What I find problematic is that for the sake of racial sensitivity universities are willing to remove teachers even if the teacher hasn't done anything wrong. I agree that racism is a sore point in the current American social atmosphere, but we should not engage in an appeasement doctrine that sacrifices the innocent.

<comment><USER2> So woke they are unable to learn foreign languages.

</comment></comment><comment><USER3> The comments here so far seem to be jumping to conclusions. Commenters are being quick to defend the professor. I'm not sure that the full situation is being understood.

It seems there are three important points being overlooked.

\- It seems that the phrase he said was not directly related to the course material.

\- He was politely asked to stop saying it.

\- He was likely not even pronouncing the phrase correctly and the correct pronunciation does is not easily confused with a racial slur.

> The students said some of them had voiced their concern to Patton during his > lecture, but that he'd used the word in following class sections anyway. > They also said they'd reached out to fellow Chinese students, who "confirmed > that the pronunciation of this word is much different than what Professor > Patton described in class. The word is most commonly used with a pause in > between both syllables."

This seems to me that there is an underlying problem/tension between this professor and his students who are people of color.

<comment><USER4> I am currently learning mandarin and my wife is chinese. This word, Na Ge (sometimes pronounced Ney Guh), can be said in rapid succession with little to no pauses between syllables, like an english speaker saying "um-um-um-um" or "yeah-yeah-yeah". Difficult to find a spoken version of this online, but please have a listen to this song [0] timestamped to the appropriate point.

A course on business communication in a segment apparently about "filler words" seems completely appropriate.

What concerns can these students have beyond "I am unable to handle foreign languages spoken in my presence"? These people better not visit a macdonalds in china because all the children around them will be shouting na ge whilst pointing at the menus.

[0] [https://www.youtube.com/watch?v=xNRgHUs17vY&t=15s](https://www.youtube.com/watch?v=xNRgHUs17vY&t=15s)

</comment></comment><comment><USER5> This is the height of stupidity. And a good example of why I endorse being "woke" but not "Woke", if you get what I mean. This is just rampant, over-the- top, completely unjustified hysteria.

</comment><comment><USER6> [https://news.ycombinator.com/item?id=24397574](https://news.ycombinator.com/item?id=24397574)</comment>


Just launched my first product - Earbuds you can wear on your wrist - <AUTHOR> http://www.fluxaud.io/shop/magbuds What do you guys think? <comment><USER2> This is a pretty cool idea. If you actually do free shipping to New Zealand, I'll pick some up next paycheck.</comment>


Principles of Chaos Engineering - <AUTHOR> http://principlesofchaos.org/ <comment><USER2> There is no mention of Netflix on the site, but the term Chaos Engineering, and the popularization of the technique, seem to come from Netflix. The Chaos Monkey README even links to this site.

[https://github.com/Netflix/chaosmonkey](https://github.com/Netflix/chaosmonkey)

[https://medium.com/netflix-techblog/chaos-engineering- upgrad...](https://medium.com/netflix-techblog/chaos-engineering- upgraded-878d341f15fa)

[http://www.oreilly.com/webops-perf/free/chaos- engineering.cs...](http://www.oreilly.com/webops-perf/free/chaos- engineering.csp)

[https://en.wikipedia.org/wiki/Chaos_Monkey](https://en.wikipedia.org/wiki/Chaos_Monkey)

<comment><USER3> i think you are indeed correct on stating that.. the chaos monkey, cool naming :)

</comment></comment><comment><USER4> A related Ask HN (from 2016) that I submitted: [Ask HN: Who uses Chaos Monkey in production?]([https://news.ycombinator.com/item?id=12749597](https://news.ycombinator.com/item?id=12749597)). A couple of interesting responses there.

</comment><comment><USER5> This sounds like the kind of thing that would be very powerful if built in from the start, but an absolute nightmare to try and retrofit to an existing system.

It reminds me of the Amazon "everything must be a network service" architecture. Painful to institute but with great payoffs later in terms of robustness and scalability.

<comment><USER6> We started our current project running chaos monkey from almost day one, and a few weeks ago, someone fucked up a tag enforcement script on our dev aws account and started shutting down every single instance, while all of our asgs kept restarting them. So basically every single service from consul to kafka to our microservices was down to a few or sometimes even no instances.

Because we had already been dealing with chaos monkey, everything recovered by itself within a few minutes of the script stopping, and we barely had any alerts from any services going down.

Also, when aws was pushing our meltdown patches, we just ignored all the notifications because we didn't care about instances being shut down, because they go down randomly all the time.

It's a pain in the ass at first to deal with, but it definitely forces you to fix a lot of potential problems unless you want to spend all your time manually fixing stuff every day.

Even just aside from chaos monkey, we build new base amis and push out rolling updates _daily_. That'll also quickly suss out problems with not having version numbers locked, etc.

</comment></comment><comment><USER7> Very considerate that they mentioned negative impact for users in the last point. I wonder though how well that is measured and controlled in real-world applications of this design style.

<comment><USER8> I too wonder if any of these experiments actually affected real customers.

<comment><USER9> Not affecting real customers is kind of the point of controlled experiments.

<comment><USER10> You can very much impact real customers, but the idea is that you should be able to only apply the experiment to a small subset of customers and abort it in case something goes wrong.

For instance, you may want to check that the authorization service can function without access to the A/B testing service, so you cut the network connection between them. If authoritazion errors start rising, you stop the experiment and investigate why this happened. You may also find that clients did not retry properly on unexpected errors from the authorization service (e.g. http 500 error codes)

</comment></comment></comment></comment><comment><USER8>
      improper fallback settings when a service is unavailable;
      retry storms from improperly tuned timeouts; outages when a
      downstream dependency receives too much traffic; cascading
      failures when a single point of failure crashes;

I don't see how one couldn't replicate those in an environment other than the production. They all involve bringing down complete services and sending some unexpected high load to other services.

<comment><USER10> You can start finding and fixing issues in non prod environments, but eventually you have to run this in prod if you want to find the good stuff. Nothing is going to replicate the particular configuration, load, mix of requests and client behavior that you have in prod

</comment></comment><comment><USER11> So did this come about based off Chaos Theory? Then the main goal of chaos engineering would be to "create order out of chaos"?

</comment><comment><USER12> I'm not affiliated with Netflix, but the negative tone of some of the comments here is hilarious. Would the critics care to share how _their_ traffic/uptime ratio compares to Netflix's? On weekends, Netflix is responsible for about 50% of the packets on the Internet. On Earth. Netflix is down how often? But please, do share how you once replicated a MySQL database from prod to a staging environment.

</comment><comment><USER13> Chaos Monkey and Kyle Kingsbury's work on the Jensen tests inspired us to make this ([https://github.com/gundb/panic-server](https://github.com/gundb/panic- server)), which lets us simulate all sorts of failure cases. It should be extremely useful to others if they enjoy stuff like Chaos Monkey, etc.!

<comment><USER14> ^Jensen^Jepsen

Kyle Kingsbury == Aphyr

[https://jepsen.io/](https://jepsen.io/)

<comment><USER13> Sorry, thanks, my phone autocorrected!

</comment></comment></comment><comment><USER15> It says something about the engineering maturity of the industry that destructive testing in production environments is among the _more_ sophisticated practices.

<comment><USER16> Seems analogous to load testing a physical structure. At first, that probably seemed unnecessarily risky, but in retrospect, you want to build robustly enough that even fairly excessive/destructive loads have no real impact.

<comment><USER17> Yeah, when hardware failures are expected, simulating hardware failures is no different from simulating trucks driving over a bridge.

</comment></comment></comment><comment><USER18> I don't like the name. It's sounds too much like it's the Engineering of Chaotic Systems, but there is no reference to Chaos Theory: [https://en.wikipedia.org/wiki/Chaos_theory](https://en.wikipedia.org/wiki/Chaos_theory)

Are they using the formal definition of chaos, or just a colloquialism?

<comment><USER19> I'm not sure I can agree.

> Are they using the formal definition of chaos, or just a colloquialism?

Is it a colloquialism to use a word in its normal English sense? Chaos as a word precedes Chaos Theory by some thousands of years. If I write a theory and take over an existing word in everyday use, it seems a bit much to accuse every one else of colloquiallism when they use an existing but less strict definition?

<comment><USER20> > If I write a theory and take over an existing word in everyday use, it seems > a bit much to accuse every one else of colloquialism when they use an > existing but less strict definition?

It does, but engineering is a technical profession and it's practitioners are likely familiar with the mathematical concept.

I've read about applications of chaos theory in system design, and I expected 'Principals of Chaos Engineering' to be about that topic.

<comment><USER18> The problem I have with the name is that it feels like their audience is people not familiar with the mathematical concept. In other words, not engineers; in other words, non-technical managers. And that marks it as the latest marketing fluff being pitched by management consultants.

<comment><USER21> People familiar with the mathematical concept will almost always be talking about something like "nonlinear dynamics" instead, anyway.

<comment><USER18> Funny you say that. I had to restrain myself from using that term. Technically, chaotic systems are only a subset of nonlinear systems. For example, solitons are nonlinear, but neither are they chaotic.</comment></comment></comment></comment></comment></comment>