Arm Announces Cortex-R82: First 64-Bit Real Time Processor - <AUTHOR> https://www.anandtech.com/show/16056/arm-announces-cortexr82-first-64bit-real-time-processor <comment><USER2> The best part is actually Peter Greenhalgh, VP of Tech at ARM wrote in the comment section.

>A real-time processor doesn't intrinsically process any differently from a normal applications processor. What differentiates it is that it bounds latencies and behaves deterministically. For example, rather than an interrupt latency on applications CPU taking anywhere from 50-1,000 cycles (or more) the interrupt latency can be bounded to under 40-cycles.

>Tightly Coupled Memories allow certain routines and data to be stored within the CPU so there's never any chance that a cache eviction has taken place which forces a fetch from DDR (or flash). In a phone or laptop, you don't have routines that absolutely must be accessed in 5-cycles and can't wait 250-cycles for DDR. If you're controlling an HDD you can't have the read head crashing off the spinning disk! Or, in automotive, the spark plug firing at the wrong.

>Latency and determinism can be very important!

>Not a R8 derivative.

I cant wait to see a SSD Controller with this tech.

<comment><USER3> What benefit do you believe this is going to bring SSDs? They are full of DRAM buffers and utilize multiple simultaneous NAND channels to mask latency inherent to the tech. It seems a realtime processor would bring little to the table.

Edit: Well looking into it a bit, a lot of SSDs already use realtime ARM processors in their controllers. The main benefit here seems to be being able to address larger buffer sizes going forward and access to more cores.

<comment><USER4> Not having to work around the limitations of 32-bit addressing is a convenience, but the industry has produced 4+ TB SSDs with 4+ GB of DRAM for quite a while now without this core.

The real demand for a core like this in SSD controllers comes from doing more computationally expensive work on the SSD controller than just providing a block storage device abstraction. Stuff like embedding a full key-value database on the SSD or providing more general-purpose compute capability is a hot topic for enterprise storage. There's already at least one company shipping an SSD controller for computational storage with a mix of realtime cores and Cortex-A53 cores. The Cortex-R82 means such a chip could be more homogeneous with just one type of ARM core.

</comment></comment></comment><comment><USER5> So this is basically a CPU with an upper bound on the horrible cases. That's useful for real time. A standard test for real time is to run a hard real time OS like QNX, and have a simple program which receives an interrupt from an input pin and restarts a high priority task that's waiting for the interrupt. The high priority task turns on an output pin. You hook the input and output pins to an oscilloscope. You want to see all the output spikes about the same distance from the input spikes. You don't want to see output outliers way out there, late. If you see that, it's not a hard real time system. You can do this with a standalone program to test the CPU by itself, but you really need to test it when the CPU is also doing other things.

Sources of CPU-level trouble include 1) rarely used CPU instructions that run slow microcode, 2) cases where the pipeline needs a total flush and that's slow, 3) the board manufacturer doing something in system management mode and not telling you. Drivers locking out interrupts too long is the usual Linux problem. It's assumed that all real time code is locked in memory; you do not page real time processes.

<comment><USER6> Is there any upper bound on latency for something to qualify as a realtime system? For example, a system that is guaranteed to compute its output at the end of each week?

<comment><USER4> There's a lot of subjectivity in these definitions. But an overnight batch job run once a week would usually not be considered a realtime task. The duration of the job and the time resolution of its deadline is pretty large compared to the CPU scheduler timeslices used by general-purpose operating systems, and you probably don't need any special hardware support. You just need to provision enough CPU time overall, and not allow the job to be starved by higher-priority tasks consuming all the available CPU time.

A task would usually be considered realtime to some degree if it cannot automatically get its work done on time even when competing with a background- priority long-running job—for example, if your deadlines are operating on similar or smaller timescales to the operating system's CPU scheduler. Then you need to start taking extra measures to ensure adequate responsiveness, not just adequate throughput.

But there's also the aspect of consequences of missing a deadline. Most realtime tasks are concerned with millisecond or shorter timescales, but a job that must be performed once every 108 minutes to prevent the end of the world would also be reasonably considered a realtime task.

<comment><USER6> Yeah, it would be nice to have a real-life example with a relatively lengthy latency. Perhaps with delivering an organ for a transplant or something.

At least wrt soft realtime scheduling for audio, I think users/programmers tend to get severely tripped up because the latencies are simply too small for them to make a clear mental model of the underlying system. That, along with their ineluctable desire for their code to "go faster" drives them to request features or design algorithms which would have to travel "back to the future" in order to work at all.

So it would be nice to decouple "ultra-low latency" from "realtime" to make it clear that, say, you can't put the heart on ice _after_ the helicopter already lifted off to fly it to the hospital.

</comment></comment></comment></comment><comment><USER7> I'm pretty excited by this announcement. Not for storage but for software defined radios. If Xilinx upgrades their RFSOC (which is an Zynq Ultrascale variant with built in ADCs and DACs) to this core from the current A53 core it will allow much more sophisticated base band processing in software that is currently done with FPGA gates in the fabric. And while reconfigurable FPGAs are nice, software can change modes much more quickly than reconfiguring an FPGA can.

<comment><USER8> Question: are GPUs a consideration in the SDR world?

I'm no expert on SDR, but it seems to me that SDRs are the high bandwidth and parallel workloads where GPUs excel in. (GPUs can perform fourier transforms very efficiently)

The only possible qualm would be the latency of a GPU. But I don't imagine that SDR workloads are very latency sensitive? Or am I mistaken there?

GPU kernels are just software, but the parallel nature of GPUs means that it's better if most of the GPU is sharing the same code (very small L1 code cache per thread). So it's far more flexible than a FPGA but somewhat less flexible than a CPU (where different cores and threads can be executing very different code with large and unique L1 caches)

<comment><USER7> Yes! There is a very active community of using Cuda to do signal processing[1].

Latency is an interesting thing, its always part of the SDR pipeline since you have filter delays and processing delays. Most digital streams are uni- directional so you get the bits out, just shifted by 'x' nS. Since the 'x' is deterministic you can plan for it.

[1] [https://github.com/rapidsai/cusignal](https://github.com/rapidsai/cusignal)

<comment><USER9> That's pretty cool. I don't know anyone who does realtime signal processing work in Python, though, least of all myself. Are there C bindings for all of that stuff?

<comment><USER7> Nearly all of the "heavy lifting" as it were are C or C++ libraries. Python is just the 'plumbing' level. It is not dissimilar to using MATLAB where the drivers are all optimized code but the connection between them is MATLAB.

This design pattern is a common of nearly all SDR frameworks (Gnuradio, Redhawk, Pothos, Etc.) The "interconnect" between processing elements is typically shared memory, and that is why it lends itself to GPU work as well.

That said, since my head is most comfortable thinking in C, I tend to write stuff in C rather than Python :-).

</comment></comment></comment></comment></comment><comment><USER10> > "real-time" processors which are used in high-performance real-time > applications.

C'mon anandtech, you can do better than this: "real time" means deterministic, not necessarily faster, and in fact often means _slower_.

As another poster pointed out, ARM's VP of Tech posted a comment and posted what real-time means. I don't know why people jump from that to some idea it would be faster.

<comment><USER11> "high-performance" could just as easily be interpreted as faster response time as compared to faster clock speed. So in that way they are "faster".

<comment><USER10> But real-time systems don't guarantee faster. I was a real-time engineer for years.

<comment><USER12> Faster latency, not faster throughput.

<comment><USER10> Not necessarily even lower latency, just predictable.

</comment></comment></comment></comment></comment><comment><USER13> _" Another big change to the microarchitecture is the inclusion of an MMU, which allows the Cortex-82 to actually serve as a general-purpose CPU for a rich operating system such as Linux."_

That's interesting, but they seem to be removing most of the differences between the A and R series.

<comment><USER14> Not really. The performance-oriented A series can include -- and will continue to include -- features which improve performance at the expensive of inconsistency, such as branch prediction and speculative execution. The R series values consistent behavior over performance, so it won't have those features.

<comment><USER15> R82 is in-order, but does provide branch prediction. [1]

[1] [https://developer.arm.com/ip- products/processors/cortex-r/co...](https://developer.arm.com/ip- products/processors/cortex-r/cortex-r82)

</comment></comment></comment><comment><USER16> The title is a bit ambiguous - this is ARM's first 64-bit real time processor, but it's not the first one out there. All of SiFive's S and U series cores are 64-bit with hard real-time determinism. [0]

[0] [https://scs.sifive.com/core-designer/](https://scs.sifive.com/core- designer/)

</comment><comment><USER17> Realtime capable hardware and software is all super intersting. It makes up for a very different challenge when building that something that has to fulfill a certain task in a certain amount of time instead of just providing a best effort solution. Therefore I'm always curious to learn about products and solutions in that field.

However for this presentation I'm a bit puzzled by some of the marketing slides:

\- Optional NEON accelerates ML.

\- Advanced machine learning support

Is that really a use-case for those processors? Can ML be hard-realtime anyway? I feel like a promotion that one could use those SIMD instructions for e.g. erasure-coding on storage use-cases or e.g. for signal processing on Telco/Audio/Video use-cases would be much closer to typical applications for such a CPU.

Is it just me or sounds the "ML" on these slides more like "we need to join the hype" than an actual use-case?

\- Optional MMU enables Linux and cloud-native software development

I agree - MMU is great, Linux support too. But what is cloud-native again? And is something that runs on a SSD controller in a datacenter now cloud native?

<comment><USER18> > Can ML be hard-realtime anyway?

Sure, why not? The number of instructions needed to run inference on a given neural network is known so I don't see any real issues here.

(Training is of course a different matter)

> Is it just me or sounds the "ML" on these slides more like "we need to join > the hype" than an actual use-case?

You could build query-by-example indexes (for text, sound, images or videos) in the storage hardware with this kind of capability. That'd be pretty interesting.

Imagine something like Isilon, but instead of allowing Hadoop analytics on the storage hardware it could do approximate nearest neighbour across images.

(This is actually a pretty good idea...)

<comment><USER4> > You could build query-by-example indexes (for text, sound, images or videos) > in the storage hardware with this kind of capability. That'd be pretty > interesting.

I've seen demos of this kind of thing from companies like NGD Systems, who use Cortex A53s in addition to realtime cores in their SSD controller. Part of the selling point for offloading this from the CPU is that code running on the SSD controller has much faster access to the dataset and can query it more efficiently, unconstrained by the drive's host interface.

There are also more mundane use cases for ML inside a SSD as heuristics to predict data access patterns or media wearout trends, which can influence how the SSD chooses to store data and tackle error correction.

</comment></comment></comment><comment><USER19> The wheel of reincarnation turns again.

Back in mainframe days, "channel controllers", the subsystems that controlled storage devices, were very programmable. At some points in time, it made sense to off-load as much as possible from the CPU onto the channel controller. At other points in time, the reverse was true.

For a couple of decades, we've had dumb storage devices. Now with some of the NVMe stuff, we're moving back towards smart "storage".

Linux in an SSD is the same idea.

<comment><USER20> Disk controllers have been "smart" for the last 15 years. There's just a desire to run Linux instead of a barebones RTOS.

<comment><USER21> Lot longer than 15 years. There were ISA SCSI controllers that had micro- controllers which could be programmed at some level. The symbios SCRIPTS come to mind which were common on the 53Cxx controllers.

[https://www.manualslib.com/manual/96635/Lsi-Symbios- Sym8953u...](https://www.manualslib.com/manual/96635/Lsi-Symbios- Sym8953u.html?page=12)

This has continued on raid/fibre/nvmeof/etc boards.

</comment></comment></comment><comment><USER22> What would be the advantage of running an RTOS on Cortex-R82 vs any other ARM processor? Doesn't an RTOS give you the hard realtime capability through software?

I feel I must be missing something critical in my understanding. I thought RTOS in software was sufficient to get realtime processing.

<comment><USER23> Your software can only guarantee what the hardware provides/guarantees. If your cpu can take a variable amount of cycles to start processing an interrupt, the RTOS can only guarantee the upper bound. A real time cpu is all about being faster and more importantly more deterministic, therefore enabling the RTOS to guarantee faster reaction times.

If an interrupt can usually be processed in 50 cycles but very rarely will take 500, the RTOS can't schedule for the 50 cycles. If the real time cpu guarantees 200 cycles, the RTOS can actually schedule with that. Depending on the application, that can make a huge difference.

</comment></comment><comment><USER24> For those like me who didn't know what a "Real Time Processor" was: [https://en.m.wikipedia.org/wiki/Real- time_computing](https://en.m.wikipedia.org/wiki/Real-time_computing)

(somebody correct me if this is wrong)

<comment><USER25> I'm also interested --

What's the hardware difference required to support real time? Is it some dedicated parts of compute to support the queueing / prioritization of jobs? And some additional ability to have the "master" must-always-work part be able to interrupt or reset "optional" processes?

<comment><USER26> Deterministic latency. That usually means no cache, speculative execution, or anything else that can't guarantee it will complete in a reasonable time.

Specifically, in many architectures interrupt handling code must be able to yield _very_ quickly in order to continue receiving interrupts (or use reentrant interrupts which are a whole other mess) and even a cache look up, which might fail and have to wait for DDR ram for hundreds or thousands of cycles, makes the system unable to guarantee that it will do what it needs to do in time, like respond to some safety shutoff switch.

I think one of the things ARM did here is make a way for interrupt handling code to stay in cache permanently along with some other determinism guarantees.

<comment><USER25> Thanks! I guess in the designing of the accompanying software then, the people writing it probably spend equal (or more) time in writing what happens if the expected/desired behavior fails, than if it succeeds?

</comment></comment></comment></comment><comment><USER27> This could be an amazing chip, I imagine its a replacement for the R5?

<comment><USER11> The article talks about it like it's a replacement for the R8.

<comment><USER28> It's also called the R82 so I think that makes sense.

</comment></comment></comment><comment><USER29> Does real time mean that there is a minimum time an operation will take as well as a maximum?

Asking because a minimum time could prevent some kinds of timing attacks.

</comment><comment><USER30> Has anyone compared this to real-time capabilities of Intel hardware?

</comment><comment><USER31> Is this just a native way to prevent interrupts on specific cores?

<comment><USER28> I believe it's more determinism than just the interrupt timing.

</comment></comment><comment><USER32> 32 bit versions are used in stuff like your WiFi chip.

</comment><comment><USER33> I wonder how you can get a dev kit for this.

</comment><comment><USER34> If I remember correctly, having a capable RTOS is much more important, and they can be used in regular processors too [0].

I wonder what's so special about this processor that makes it better than dozens of other hardware platforms (both microprocessors and microcontrollers) on which embedded RTOSes are running and doing just fine.

Also if you have a 64-bit processor, but no 64-bit RTOS, you don't have much.

[0] [https://en.wikipedia.org/wiki/Comparison_of_real- time_operat...](https://en.wikipedia.org/wiki/Comparison_of_real- time_operating_systems)

<comment><USER35> You dont really need more than 2GB RAM in RT, it's a huge burden. Not even more than a few megabyte. Also 64bit pointers are twice as slow as 32bit pointers. Just think of randomly jumping around in your terabyte ram. Filling the cache lines cost 50 cycles alone, and your budget is usually around 40-100. A 64bit rtos might be usable for image detection (self driving cars), but not much else. The cpu cannot be general purpose, gpu's can do that much better. I don't really see the market for such a thing.

<comment><USER36> It's not uncommon to have RT workloads where the "hard" RT part can fit in a small amount of tightly coupled memory, but the same processor is also used for "soft" RT workloads that need a much larger amount of memory. 64-bit addressing makes developing this kind of system a lot easier.</comment></comment></comment>


DVR-Scan: Detect and Extract Motion Events from Videos/Security Camera Footage - <AUTHOR> http://dvr-scan.readthedocs.io/ <comment><AUTHOR> Hello everyone, I just managed to get everything finished and tested this week, and am finally proud to release the first public version of DVR-Scan (version 1.0).

The Windows builds include all dependencies, while the source distributions will work on all platforms that have Python, NumPy, and OpenCV installed. The code should work with all versions of Python/OpenCV; the Windows build comes integrated with Python 3.5/OpenCV 3.1.

This was created after a user of my first real open source project, PySceneDetect, contacted me and wanted to know if it was possible to detect movement within a static scene (rather than detecting scene cuts/changes), making this my second "real" project.

One major feature I'm working on implementing for the next release is the ability to use a transparent image as a mask so you can ignore some parts of the frame. That being said, even without masking I've achieved great results thus far, and there are plenty of other detection parameters you can tweak some other software doesn't usually include.

Any comments, suggestions, or feedback you might have is most welcome.</comment>


Ask HN: What startups use Dwolla for payments? - <AUTHOR>

I'm looking into Dwolla for a payments solution for my startup. I'd like to see it in action. What startup use Dwolla for payments? <comment><USER2> Might be a good source for examples/inspiration:

[http://www.redditdonate.com/browse/campaigns](http://www.redditdonate.com/browse/campaigns)

That said, this was a special nonprofit project put out by Dwolla and Stripe, so I'm not sure if the "guest" checkout feature is available for us common folk. If that's the case, as t0 mentions, the transfer/verification process takes quite awhile.

<comment><USER3> The guest checkout feature is available to all. :)

<comment><USER2> Good to know. For anyone that finds this later, relevant API docs:

[https://developers.dwolla.com/dev/pages/gateway/guest](https://developers.dwolla.com/dev/pages/gateway/guest)

</comment></comment></comment><comment><USER4> We're using it where a client requests to pay via cheque. Assumption here is they don't to provide credit/debit card details and frankly I don't mind given the fees Dwolla charge (25c vs. 3%).

Just over 50% of our clients have chosen Dwolla when originally they wanted to pay via cheque to date.

</comment><comment><USER5> Unless the user already has an account with Dwolla, it takes several days to verify bank information and make a transfer. The same applies if you're accepting Bitcoin. Paypal or credit cards are almost always the best option, simply due to the instant transaction time.

</comment><comment><USER3> Quite a few companies/ startups are using Dwolla, check out the 'Startup Crush' posts on their blog ([http://blog.dwolla.com/category/startup- crush/](http://blog.dwolla.com/category/startup-crush/)).

</comment><comment><USER6> MtGox used it when it was startup</comment>


Jury convicts NY man accused of AT&T-iPad hacking - <AUTHOR> http://news.yahoo.com/jury-convicts-ny-man-accused-t-ipad-hacking-023305967--finance.html <comment><USER4> And this my friends, is the fake world of democracy we live in. We are being illusioned to posses freedom that we don't really have. This is a game played by very powerful people at the top, who have the right amount of money at the right time and these people will continue to game this system. We need a change, desperately!

<comment><USER5> Could you please explain how convicting a person that hacked into AT&T means we have fake democracy? I must be missing something here, could you elaborate a bit?

<comment><USER6> Can you please explain how "GET /iccid/12345" is hacking? I must be missing something here, could you elaborate a bit?

<comment><USER7> He knew that he was obtaining sensitive information that he shouldn't have been able to access (through at&t's negligence), however instead of following any sort of responsible disclosure, and reporting the incident to the company, he goes to IRC and talks openly about trying to use the information to benefit himself through insider trading and then gives the information to Gawker (again instead of contacting AT&T).

He probably could have had the charges dropped, had he composed his actions differently.

<comment><USER6> Absolutely. He was a dick about it. I don't think that anyone would argue differently.

But the fact of the matter is, he's been convicted for unauthorized access to a public computer system. Last I checked, being a dick and a braggart wasn't criminal.

I think he was rather stupid about the whole thing, but criminal? The fault should lie with AT&T, who put their customer data on a public webserver for the world to see.

<comment><USER5> Being a dick in general is not criminal. Being a dick by stealing 100K private emails and giving them to press, apparently, is criminal.

<comment><USER6> But it's not stealing if AT&T was just happily giving them away. Which they were.

<comment><USER8> Is that still defensible if you go out of your way to brute force download as many as you can and you then distribute that list?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> From what I just read, he didn't hack anything. He found out that AT&T didn't require a password to check if an email was valid, then just got a list of valid email addresses.

How could a jury equate this with conspiracy to access a computer?

<comment><USER10> The computer held a list of addresses. It did not present that list to the public. He found a trick where he could probe the addresses, and used that trick to extract the list counter to the desires of the owner (and the owners of the addresses). I can't imagine how you think that access was authorized.

Now, sure, it's not much of a "hack" in a security analysis sense. And it was a terribly dumb bug, and a huge security goof by AT&T. But why should criminal law care about how difficult something is? You don't get off of burglary charges if someone's door is unlocked. And if AT&T is culpable for their poor engineering, they are so in a civil sense for damages; it doesn't make the hack less of a crime.

Admittedly there's a spectrum between "full disclosure" security research and grey hat anarchic asshattery, and there are cases where people have been wrongly prosecuted. But this case looks pretty black and white to me.

<comment><USER11> Information whether email is valid or not was made publicly available by AT&T. Shouldn't access to publicly available information be assumed to be authorized by the one who made the information public?

If you forget to wear your pants in public you are the one who is to be charged with indecent behavior not the people looking at you with intrusion on your privacy.

<comment><USER8> What about if you walk around and peek under everyone's coat to see if they forgot to wear pants?

<comment><USER11> Very impolite. Criminal? Only if you check many entities and lots of them notice and it bothers them or you check one for a long time and you bother it. Might be harassment.

I can't see what the coat was supposed to be in AT&T case though.

</comment></comment></comment></comment></comment><comment><USER12> weev is a criminal. He spent many years making a living for himself by stealing from other people. He gets to re-write this past of his because most of his former crew are gone. weevs defenders are people who didn't know him when he was most active (2003-2009).

This particular case is also pretty clear-cut. If you were a whitehat, why would you retrieve so much data? Why would you give the data to someone who was not with that company?

Reserve your sympathy for hackers who get set up by their businesses partners, or people who aren't thieves and backstabbers. weev is just beginning to get what he has had coming to him for ten years...

<comment><USER13> sources please.

<comment><USER14> Regardless of his past, why did he pull so much information? And turning it over to gawker seems a bit wrong. He should have contacted the company. If they didn't do anything then he should have gone to the media.

It seems like he acted irresponsibily with the situation. It wasn't just one misstep, it was a few.

<comment><USER15> To be fair, I doubt most "mainstream media" (ie. CNN, WSJ, NYT, etc.) would have noticed/cared about this information.

</comment></comment></comment></comment><comment><USER16> Why a sad face? Did the article not represent his crime correctly? I don't know this person or his back story but if he committed a crime why shouldn't he suffer the consequences?

<comment><USER17> In case you're not trolling, here's a link to what's currently #2 on the front page, which explains it well: [http://erratasec.blogspot.com/2012/11/you-are- committing-cri...](http://erratasec.blogspot.com/2012/11/you-are-committing- crime-right-now.html)

<comment><USER16> It's my ignorance showing so be gentle. I'm not trolling. I don't read every link on the front page and what piques my interest may not be what piques yours. Having said that, I will read the article you linked to.

<comment><USER17> My apologies, your comment seemed more sarcastic to me when I first read it for some reason. In any case, I hope that was helpful.

</comment></comment></comment></comment><comment><USER18> "Provided the information to Gawker" casts doubt on any criminal intent in my mind

<comment><USER19> Apparently they have IRC logs of him first talking about selling the information to spammers or using it to go phishing, which makes it a little worse.

<comment> guard-of-terra I would have said the same thing after discovering the stash. Not because I actually planned to do this but because the situation is bizzare and that's some sort of humiliating humour.

<comment><USER20> Couple that with how he reported it, the script he used to download the data, and everything else he did. You can't look at each action in isolation.

</comment></comment></comment></comment><comment> k-mcgrady The title of this should be changed. Actual title is:

Jury convicts NY man accused of AT&T-iPad hacking

<comment><USER21> For future reference, the title was "Weev Convicted :-(".

<comment><USER22> (OK, yeah, that title was even worse. ;P)

</comment></comment></comment><comment><USER23> Its a travesty, Weev comitted no real crime.

<comment><USER24> What do you mean? It says he used an account slurper and stole people's personal information.

Should this not be a crime?

<comment><USER6> He wrote a PHP script that downloads incrementing URLs. You know, like `curl -O <http://att.net/iccid/[0-100].xml`>

AT&T put this information on a public interface and relied on obscurity of serial integers to protect it, then cried foul when someone crawled their unprotected data and claimed felony unauthorized access to a computer system because they didn't explicitly authorize him to download the contents of those publicly-accessible pages.

This conviction is a travesty.

<comment><USER25> If I discovered that someone hadn't locked a filing cabinet, and then I rifled through it, found a whole bunch of names and social security numbers, recorded all of them, and then went to talk to a news organization with this list without ever notifying the people whose filing cabinet I'd gone through, do you think that would be OK?

Because that's pretty much the equivalent of what happened here. You say "AT&T put this information on a public interface and relied on obscurity of serial numbers to protect it"; this phrasing puts the blame on AT&T. Yes, they should not have done that. But that's about equivalent to forgetting to lock a file cabinet; it's a mistake that someone made. Weev then took advantage of that mistake to violate the privacy of thousands of people, providing their personal information to a news organization.

Now, I don't necessarily think that they should have been convicted of everything they were convicted of. Unless there are facts that I haven't seen, they haven't come anywhere close to committing identity theft. But you do have to admit that Weev did not exactly handle this responsibly, and did invade people's privacy.

<comment><USER26> The metaphor doesn't really hold up; it's rather like you went to the administrative desk of AT&T 1000 times, asked the person behind the desk "Can I please have document 001?" and they simply handed it over without questions each of the 1000 times. That employee should have stopped handing over documents, but it didn't.

In my opinion the crime isn't in requesting or obtaining that information, it's in the way that he handled that information afterwards.

If he would have used it with the pure intention of showing that the system is insecure, he would have been right and nobody would have been able to blame him of improper conduct.

Instead he sold/handed over that information to Gawker, which is where he went wrong in my opinion, because he took another organisation's information and decided to put that information on the market against their will or consent.

<comment><USER6> Bingo. I think it was a dick move to go running to Gawker with it, rather than practicing responsible disclosure. But even then, I'm having a hard time with the idea of criminal charges for that; he didn't steal this data, AT&T happily handed it to him. He basically ran around saying "Haha, what a moron the guy at the administrative desk is, I just kept asking him for files and he just kept on handing them to me". And while that's distasteful, is it criminal?

Honestly, to me, it feels like he's being run down because someone got embarrassed, and he's being railroaded with archaic laws that can be applied in vague and nebulous ways to make just about anyone a criminal if it's useful.

</comment></comment></comment></comment></comment></comment><comment><USER27> Were they doing it for the lolz? As far as I can tell from the article, they're just regular criminals.

<comment> jack-r-abbit That article's bias is showing. If that is all you read about the incident then sure.. they are just regular criminals. But there is more to the case than that. From what I've read elsewhere, the Feds used a bit of stretching to make that law fit.

<comment><USER5> Could you back it up with some other sources then? if there's more to the case, where this more can be found?

<comment> jack-r-abbit I can't tell if you are trolling or are actually asking me how to Google for more info on this guy's case?

<comment><USER5> I don't ask you how to Google. I ask you to substantiate your claims that the article is biased and the truth is different from what is described there. If you are convinced this is the case, it must be easy for you to provide some evidence. Of course, you may consider this trolling and refuse to continue the discussion. The readers would then left to judge if your bare unsubstantiated claims are proof enough. I was assuming you wrote that comment in order to try to convince the readers in the truth of your claims. However maybe I was wrong.

<comment> jack-r-abbit The article's bias is pretty evident where it referred to them as "trolls". The only "evidence" I have that there is more to the story than what this article said is just what I read in other articles. Sadly, I did not bookmark any of them so I can't easily return to them to provide links to you. I'd have to Google for them. So if you would like to read more than just this one account, you would need to Google as well. But if you want to base your opinion on only what you read in this one article AND what some random guy on the Internet (me) gives you, then I won't judge you for that. Carry on.

<comment><USER5> I think the fact that he was a known troll is just a fact. He himself called himself a troll, one quote: "Trolling can frequently have large economic repercussions as, as I learned when I trolled Amazon.". This is not an evidence of bias. Of course, being a troll does not mean being a criminal, but the fact that Auernheimer was a troll is well established and confirmed even by himself.

The problem with Googling is that you know what to Google for to provide evidence. I have no idea what evidence you have, so how I can Google for evidence that only you know what it is?

<comment> jack-r-abbit You don't Google the evidence. You Google the guy. You have his real name. You have his online name. You have the name of his security firm. Those things alone will provide days worth of reading material. Read some. What I read described his actions a little more. And talked more about the vague language in a 30 year old law. And talked about how the Feds used a very self-serving interpretation of that language.

<comment><USER5> I know all this. I've read his backstory, and his current story, and the court materials, and other materials, and remain convinced that he created a tool to circumvent AT&T access controls and downloaded private information, he violated every standard of responsible disclosure (actually, he didn't disclose it to AT&T at all, he went straight to the press, after doing much more than is necessary for vulnerability demonstration), that he fully knew this is not necessary for demonstrating the vulnerability and that he did it for reasons of personal enjoyment and popularity, if not monetary gain. What I did not find is any evidence that shows the decision was wrong or biased, and so for the article. Since you were repeatedly unable to point to any evidence yourself, I conclude your statement about it was baseless and rooted in personal emotions, not facts. You are still welcome to provide contradicting evidence.

<comment> jack-r-abbit My bias comment about the original article was mostly from them calling the guys "trolls" along with some other things that seemed to have a certain tone. But after rereading it, most of the article is indirectly attributed to "Prosecutors" and "the government" so I will concede that the article may not be "biased" per se. But I maintain that there is more to the story than they reported. And since you are determined to make me Google this all again and point you to specific articles & "evidence" here goes...

[http://gawker.com/5559346/apples-worst-security- breach-11400...](http://gawker.com/5559346/apples-worst-security- breach-114000-ipad-owners-exposed) :

 _Goatse Security obtained its data through a script on AT &T's website, accessible to anyone on the internet. When provided with an ICC-ID as part of an HTTP request, the script would return the associated email address..._

[http://techcrunch.com/2010/06/14/were-awarding-goatse- securi...](http://techcrunch.com/2010/06/14/were-awarding-goatse-security-a- crunchie-award-for-public-service) :

AT&T said: _...wrote software code to randomly generate numbers that mimicked serial numbers of the AT &T SIM card for iPad – called the integrated circuit card identification (ICC-ID) – and repeatedly queried an AT&T web address._

<http://gawker.com/5559725/att-fights-spreading-ipad-fear> :

AT&T said: _The only information that can be derived from the ICC IDS is the e-mail address attached to that device._

[http://gizmodo.com/5559586/should-i-worry-about-the-apple- ip...](http://gizmodo.com/5559586/should-i-worry-about-the-apple- ipad-%252B-att-security-breach-probably-not) :

 _The exploit was a simple script: a hacker could throw an ICC-ID at AT &T's servers, and they would return its registered email address. ICC-ID are easily guessable,..._

<http://security.goatse.fr/on-disclosure-ethics> :

 _We did not contact AT &T directly, but we made sure that someone else tipped them off and waited for them to patch until we gave anything to Gawker._

 _None of us made any money off of this disclosure. We did it in public interests._

[http://www.forbes.com/sites/andygreenberg/2011/01/18/fbis- le...](http://www.forbes.com/sites/andygreenberg/2011/01/18/fbis-lesson-to- alleged-ipad-hackers-dont-be-a-troll) :

 _federal agent Christian Schorle does his best to dig up evidence that Auernheimer is less of an advocate for security and more of a full-fledged Internet miscreant._

All of these things help shape my opinion on the matter:

1) I don't believe the data harvested is that significant. Having a list of email address these days is practically worthless and pretty easy to get. Having an email address matched to an iPad ID number might be a little more useful to someone, but I fail to see how beyond some better targeted SPAM. I was not able to find any articles about that leaked info being to blame for any other iPad/AT&T breaches but I didn't look very hard.

2) I don't believe that any security systems were circumvented to obtain the data. It seems to me that a wget or cURL call on a loop would have done 75% of the work. Calling this a "hack" is kind of an insult to people who actually do hack into secure systems. It is barely even "brute force", if at all. I would put this in the "automated scraping" bucket.

3) I don't believe he committed a crime here. Sure, the guys seems like a bit of a crusty wild man and possibly a bit of a douche. But thanks be to the Earth & Stars that neither of those things are felonies. Unfortunately, it seems they had already determined this guy was bad. And when you start a search with your mind already made up about the results, you are almost always going to end up at that result... no matter if it is wrong or right.

<comment><USER5> 1\. Your belief about significance of the data is immaterial - these emails were private and were not intended for disclosure. The fact that you think they're not that interesting does not matter - I may think the content of your private email account is nothing of interest and will give nobody any useful information - that still doesn't give me the right to access it.

2\. As I noted elsewhere, here the word "hack" is not used in a sense of "cleverly use the technology" but in the sense "used computers to access information he was not authorized to access". Unfortunately, the battle for the former meaning agains the latter is long lost, and the press is using this word in the latter meaning for years now. The fact that he had to write the script which uses special algorithm based on geographic distribution of IDs means the information was not public and he had to commit some work and apply his own ingenuity to access it.

3\. Unauthorized access of private information is a crime. I'd rather it stay so - otherwise I'd have to rely on a good will of people like Auernheimer to keep my private information private. I think the consequences of this would be very grim. The problem is not that this guy was an ass - he was an ass long before that, and still was free to commit his jackassery. Until he crossed the line between being jackass and committing a crime. I agree that it is not the most heinous crime committed in the US ever - it is probably a small crime, like petty theft or trespass - but it still is. I hope he will be punished in accordance with the severity of the crime - not too hard, not too lightly.

<comment> jack-r-abbit > _I agree that it is not the most heinous crime committed in the US ever - <USER2> > is probably a small crime, like petty theft or trespass - but it still is. I > hope he will be punished in accordance with the severity of the crime - <USER3> > too hard, not too lightly._

But he was convicted of a felony. There is no "lightly" on a felony... only varying degrees "You're F'ed!" Fines will be high. Even if probation/community service is used rather than prison (yes, PRISON... not jail), the punishment lasts for a lifetime for a felon. Many, many, many forms have a special check box for felons.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> From my reading of the article, the defendant is being painted to be bigger, scarier target so that AT&T looks like a victim instead of a corporation failing to secure the confidential information of their customers as due diligence demands. From the comments on this thread, the defendant did not have intentions that were completely (as in 100%) benign. In addition, the co- defendant pleading guilty will probably make it harder for his legal team to prove his innocence. However, why is AT&T getting away with what basically amounts to negligence? Specifically, AT&T failed to provide reasonable (industry-standard) security to their users' confidential information (email addresses and other personal data).

It says about 120,000 Apple iPad users were affected, so 120,000 counts of negligence. My "class-action lawsuit" senses are tingling.

Edit: minor reformatting and rewording.

</comment><comment><USER29> Unsuccessful troll.

</comment><comment><AUTHOR> While I agree that his past "clouds" peoples potential judgement of him, I can't help but wonder if it was really understood that this data was in publicly accessible. He didn't need to work his way through backdoors and breach what some would consider traditional security measures.

</comment><comment><USER30> That is an incredible beard, that must be where he draws his power from.

<comment><USER31> This isn't Reddit.</comment></comment>


Show HN: Cloudrun – Numerical weather prediction in the cloud - <AUTHOR> https://cloudrun.co/ <comment><AUTHOR> Cofounder of Cloudrun here.

Cloudrun is a SaaS platform for the Weather Research and Forecasting (WRF) model. WRF is by far the most widely used numerical weather prediction model, but it currently requires access to supercomputers and domain expertise. Our goal is to make custom weather prediction possible for those without access to these resources.

This is our first MVP and we're working on making it more accessible for non- modelers. We greatly appreciate any feedback on how to make this service easier to use!

<comment><USER2> This is _literally_ a cloud service :)

Bad joke aside: I'm curious, what is the "business" need and market/end-users?

Congrats and good luck Milan and Josh.

<comment><USER3> Thank you! We encourage bad jokes at Cloudrun. Our next project thedarkweb.edu is a site for custom-made blackout curtains.

Our end-users are _currently_ mostly students and those working in academia. For these gals and guys, it can be a PITA to use supercomputers to run weather models. Milan can speak more to this.

However, the potential user is anyone who needs custom weather prediction. Renewable energy, commodities trading, event planning (sports, concerts, etc.) to name a few.

We're hearing about new potential industries all the time! Ideas are welcome!

<comment><USER4> Not sure if you envision getting down to a consumer level in some way, but I race sailboats. There's plenty of people who use forecasting services to get a forecast tailored to a very small area for their race course or route (think 10 sq miles).

I'd presume that mountain bikers, kayakers, climbers, and really anyone else who is into sports that are dependent on weather may be interested in similar information.

Delivering the information to a community like that seems like it would be too niche for your service, but for the people that already offer services to those people, perhaps there'd be interest.

<comment><AUTHOR> Thank you for the feedback! At this point we don't target end consumers, but rather small businesses that create these kind of products. However, we do get a lot of requests for specialized and intuitive graphics/visualization and may go further in that direction later this year.

<comment><USER2> Naive question from a semi-beginner about your market: isn't there already a lot of competition for hyperlocal forecast and good accessible visualizations (e.g., darksky)?

<comment><AUTHOR> Most existing services that I am aware of provide nice visualization of existing publicly available datasets (GFS, NAM, HRRR, etc.). Cloudrun allows the user to create their own forecast product/dataset, so it is mainly a power tool and less a graphics/visualization service.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Adding creditcard is broken. Btw - some comments below are asking about use- case and joking that physics grad students are happy. I'm looking for accurate hyperlocal mountain weather forecasts generated with the latest possible data. This is useful for avalanche prediction, planning expeditions, and trips in general. I live in British Columbia btw.

<comment><AUTHOR> Thank you for reporting the CC issue. We are looking into it.

Also, great to know about your use case! We have been looking into applying this for snowfall prediction for ski resorts, but I wasn't thinking about mountain expeditions in general.

What is the typical forecast time window that is important for your use case? Is it < few days or out to a week?

<comment><USER5> Currently we use SpotWx [0] for 12hr. It gives you the choice of whatever numerical model you like. These are very important for mountain trips because rain in the summer will make things very slippery etc. In the winter (ski- touring), precipitation is not a big deal but avalanche hazard is -- so there are avalanche forecasts [1] and [2]. You'll note that they breakdown the forecast by elevation range, below treeline, treeline, and alpine.

The shortcomings of the existing systems is that it is cumbersome to get elevation properly into the model. SpotWx for example, gives you the forecast for the elevation of the square you clicked on, which is the average of the surrounding elevation. This may be irrelevant if you're walking a ridge vs a valley bottom.

SpotWx, however, does something very right, which is very good hourly breakdown. The avalanche forecasts are typically for a very large area, and the timing of precipitation isn't important, but heating due to temperature change or sun is very important.

[0] spotwx.com/products/grib_index.php?model=hrrr_wrfprsf&lat=49.25963&lon=-123.12047&tz=America/Vancouver

[1] [http://www.avalanche.ca/map](http://www.avalanche.ca/map)

[2] [https://www.nwac.us/mountain-weather- forecast/current/](https://www.nwac.us/mountain-weather-forecast/current/)

<comment><AUTHOR> Nice! The terrain issue that you mention is the limitation of the grid resolution. For example, HRRR, the operational model used in the charts in your link, has 3 km horizontal spacing. Individual peaks and slopes are poorly resolved at that resolution.

We are already (internally) experimenting with 1 km and sub-1-km grid resolutions using HRRR as initial and boundary conditions. Creating custom forecast domains at fine resolutions is something that we are currently developing and should be ready in the next 2-3 months.

Thank you very much for your input, it's super helpful!

<comment><USER5> You've got my email address from the email I sent you regarding the malfunctioning CC form. I've got a bunch of super eager UA-testers from BC Mountaineering Club if you're interested.

<comment><AUTHOR> Fantastic, thank you, I will follow up!

</comment></comment></comment></comment></comment></comment><comment><USER6> What's the advantage of this is over running, say, at Penguin scalably on Infiniband nodes if you need the compute? (I wonder how weather researchers work if they don't have access to HPC facilities, or why they don't take it seriously enough to learn how to submit jobs if they do -- though that seems to be a common syndrome these days.)

I don't know weather models; is there something about WRF that allows people without domain knowledge to get sensible results? That's not the normal experience with complex models -- sometimes even with people that are supposed to be domain experts.

<comment><AUTHOR> These are great questions!

> What's the advantage of this is over running, say, at Penguin scalably on > Infiniband nodes if you need the compute?

POD gives you the nodes and a secure shell and you take it from there. In contrast, we are building a SaaS, so the hardware and the configuration of the model (from compiling the MPI libraries to running the model) are abstracted away. The user provides input (files for now, parameters in the near future), and gets output as a result. We scale in parallel also, but don't use Penguin under the hood.

> I wonder how weather researchers work if they don't have access to HPC > facilities

Many meteorologists only analyze existing model data, and not necessarily run the models.

> is there something about WRF that allows people without domain knowledge to > get sensible results?

Yes, in the sense that the output data represents 3-dimensional future snapshots of the atmosphere. So you don't necessarily need to understand the internals of the model (and definitely not the labor intensive setup) to interpret the results. It really depends on what you're after. If you study atmospheric dynamics, you're likely already a meteorologist. However an energy trader knows how to interpret temperature, wind power, or insolation trends, but does not need to know about how cloud microphysics are implemented internally.

</comment></comment><comment><USER7> Is there a guide on how to create runs for someone from a non weather modelling background?

In particular for the input files, 'namelist.input' seems like a list of parameters I could google for/tweak, but I'm not sure where I'd go about sourcing data for the initial/boundary condition files 'wrfinput_d01' and 'wrfbdy_d01.

<comment><AUTHOR> Unfortunately, at this early stage, Cloudrun still requires some level of WRF expertise, needed to create these input files. We are working on automating these steps so you don't have to, but it will take another 2 months or so.

In the meantime, you can email us at email@example.com, let us know your region of interest and time window, and we will happily create the input files for you.

We considered not launching the Beta before the input file creation was done, but we wanted to get feedback as early as possible. I really appreciate your interest and feedback!

If by any chance you decide to go creating these files yourself, the process is tedious but well documented here: [http://www2.mmm.ucar.edu/wrf/users/docs/user_guide_V3/users_...](http://www2.mmm.ucar.edu/wrf/users/docs/user_guide_V3/users_guide_chap3.htm)

We do plan to start writing short tutorials on setting up simulations and geared toward non-experts.

<comment><USER7> Appreciate the link & response, happy to wait a few months.

I've been looking to find a way to get short term localised rainfall forecasts in Australia (for sporting events) and excited to see how this goes!

<comment><USER3> Shoot us an empty email over to email@example.com. We'll send you some free credit to get you started once this is ready!

</comment></comment></comment></comment><comment> d--b A lost opportunity to call this CloudCloud!

<comment><USER3> Geez what a glaring oversight! We'd change it right now if not for the hundreds of Cloudrun beer koozies we had made :(

</comment></comment><comment><USER8> for those who are curious, a teeny bit of googling reveals this to be a hosted version of [https://github.com/NCAR/WRFV3](https://github.com/NCAR/WRFV3), which is a super duper open source numerical computing code base (and the license grant is roughly "this is public domain" but with more words).

i've always wanted to learn about weather simulation models so happy to stumble into this domain

<comment><USER9> I think I was able to run WRF or a similar model on my laptop in 2010 (A Macbook Pro with a Core 2 Duo). It took about a day to compile and run the sample dataset. I gave a presentation about it at my weather forecasting class. I almost got it running with our local sounding data but I ran out of lab time I needed for the class. It was fun though I was reading reddit while it was compiling and running. I was the only person to give a presentation about it in my weather forecasting class.

<comment><AUTHOR> Kudos for sticking through with it for your class project! I have been working with and have contributed to WRF code since 2009, and it's sure not straightforward. Porting it to different HPC systems can be especially painful. This pain point was one of main motivators for building Cloudrun.

<comment><USER9> So, the class was actually structured so that you had to perform ~40 hours of lab work. By using your software I could read reddit and perform lab work by babysitting a compiler. So thank you for allowing me to use up all of that lab time :)

</comment></comment></comment></comment><comment><USER3> Credit card form is back up. Sorry to anyone who tried to sign up and couldn't before!

</comment><comment><USER10> Somewhere, I assume, some atmospheric physics grad students are very happy.</comment>


Eduardo Saverin: What I Learned From Watching "The Social Network" - <AUTHOR> http://www.cnbc.com/id/39675388

<comment><USER2> I thought I had heard the screenplay for The Social Network was heavily based on interviews with Eduardo Saverin. Does anyone know if this is true?

EDIT: from his Wikipedia page (<http://en.wikipedia.org/wiki/Eduardo_Saverin>): _The Social Network is based on the book The Accidental Billionaires in which Saverin served as the main consultant for author Ben Mezrich._

</comment><comment><USER3> Interesting, I finished watching the movie 10mins ago and, entrepreneurially pumped, came here. I thought Saverin came across as a total whiner in the movie. Yes, he was swiped off his shares but, in the movie, he worked to get funding in NY with no results, whereas Zuck and the bad boy team quickly secured funding in Palo Alto. I wonder what percentage of this is the truth, if there is such a thing.

<comment><USER4> You are right, but from the position of a common movie-goer he was basically the only "good guy" in the movie, with everyone else being depicted with huge character flaws. The worst thing he has done in the movie is feeding meat to his chicken, but everyone else were shown as greedy and unreasonable (the Vinklevosses and their friend), genius but socially inept (Zuckerberg), irresponsible and careless (Parker) etc. Saverin is depicted as friendly, hard-working, naive and learning from his mistakes, which are all the qualities that appeal to the average population. He failed at raising money, true, but it's implied that he worked hard and wasn't willing to break his integrity, while those who came to California did raise funding by "selling their souls", i.e. doing parties and drugs.

<comment><USER5> Interesting. I thought he came across as a jealous, stubborn guy who didn't want to learn anything from Sean Parker.

<comment><USER6> But Sean didn't come across as a nice guy at all, so your average movie-goer doesn't care if Sean really knew his stuff or not. The bit towards the end where Eduardo says something similar to "I like standing next to you Sean... makes me feel so tough" is a small 'win' moment for him.

</comment></comment></comment></comment><comment><USER7> I've looked around and can't seem to find what he's been up to since then.

I know the guy is probably well off enough to just do nothing, but a smart kid like that? He must be working on something. I'd love to know.

<comment><USER8> Here's a NYT article: [http://bits.blogs.nytimes.com/2011/01/20/facebook-co- founder...](http://bits.blogs.nytimes.com/2011/01/20/facebook-co-founder- backs-startup/)</comment></comment>


Build Systems Are Stupid - <AUTHOR> http://atilaoncode.blog/2019/04/03/build-systems-are-stupid/ <comment><USER2> Developers fall in to approximately two camps; they either want implicit build tools which do "what they expect", or explicit build tools which don't "do anything surprising". This is a good example of a developer who expects implicit behavior, but has got frustrated and hasn't specified exactly what they expect and considered why that wouldn't work for everyone.

</comment><comment><USER3> Isn't the real advantage of using things like build systems the ability to customize the output build? You don't really see all this stuff going on behind the scenes but stuff like autotools and auto-generating Makefiles is much of the reason why lot of libraries can run almost anywhere.</comment>


GitHub adds code search - <AUTHOR> http://github.com/blog/202-github-code-search Github added a new feature to search through all of their public source code. <comment><USER2> They don't escape the query text field - XSS.

<http://github.com/codesearch?q=%22%3E%3Cscript%3Ealert>(%22Oops%22)%3C%2Fscript%3E%3Cspan%20%22&repo=&langOverride=&language=&x=0&y=0

<comment><USER3> Thanks, fixed.

<comment><USER4> Would be more impressive if the pagination worked too.

Do you test any of this?

</comment></comment></comment><comment><USER5> Thank you! This is why I'm so happy to send real money to this service.

</comment><comment><USER6> The search feature also seems to be somewhat fuzzy, which rocks. Searching for "isnumeric language:c" returns hits for "is_numeric", "isnumeral", etc. Very nice!

My only minor complaint is that the search results page is sometimes displaying the wrong highlighted excerpts of matched files. For example, using the above search, I see highlighted text for things like the "(c)" in a copyright notice, or an emacs "Mode: C" hint. Because it's only displaying the first highlighted region per-file, it's hard to use the results page to see which hit I want to drill down into.

</comment><comment><USER7> Very nice. It'd be nice to see a little better relevance. For example, I searched for "game" then drilled down to one of my projects which was listed in the side bar. Towards the bottom of the results was a hit from "game.rb"... it seems like a hit from a file who's name includes the search term might be more relevant than that.

Or, perhaps a hit like "class Game" should be considered more relevant than "attr_reader :game". Perhaps.

Overall, very nice though.

</comment><comment><USER8> More RSS icon size! Bigger!

<comment><USER9> I have to agree, I love Github but that feed icon is extremely annoying.

</comment></comment><comment><USER10> How about tags for gists?

That would make it quite a bit easier to find a specific algorithm or code snippet.

</comment><comment><USER11> <http://codesearch.google.com>

<comment><USER12> getcpuinfo

<comment><USER12> get cpu info

</comment></comment></comment><comment><USER13> Are there disclosure guidelines on Hacker News? The submitter is on the GitHub team, IIRC, but it doesn't say that in the submission title or in his profile.

Edit: changed from "What are the..." to "Are there"

<comment><AUTHOR> that might make for a long title. i would be happy to add that to the description, but i'm just submitting it as a news item, not providing opinion.

<comment><USER14> no need to provide any extra information, it really doesn't matter who submits something, but any reason you wouldn't mention github in your profile? sometimes i like checking out profiles to see what people are working on.

<comment><AUTHOR> I have a profile?</comment></comment></comment></comment>


Public cloud providers' network performance wildly varies - <AUTHOR> https://www.zdnet.com/article/public-cloud-providers-network-performance-wildly-varies/ <comment><AUTHOR> Direct link to the report - [https://marketo- web.thousandeyes.com/rs/thousandeyes/images/...](https://marketo- web.thousandeyes.com/rs/thousandeyes/images/ThousandEyes-Cloud-Performance- Benchmark-2019-2020-Edition.pdf)

Network performance is strong across all five public cloud providers, yet important variances exist. Cloud providers are continuously optimizing their networks to improve performance, resulting in shifting (and mostly improving) performance baselines. While the overall performance data is encouraging, it's important to remember that cloud provider network connectivity is still generally a "best effort" service. Furthermore, even cloud giants aren't exempt from architectural anomalies and events that can negatively impact performance. Continuous monitoring, data-driven planning and a well-defined operational process supported by thorough visibility are essential to success.</comment>


Ask HN: What are the closest programming language from logic? - <AUTHOR> I'm looking for languages that have the most
 common operations in math/logic from automata calculus to monad, homology... <comment><USER2> Wolfram's Mathematica / Alpha has an extremely wide range of operations at your disposal.

[https://www.wolfram.com/mathematica/](https://www.wolfram.com/mathematica/)</comment>


Metcalfe's Law is Wrong (2006) - <AUTHOR> https://spectrum.ieee.org/computing/networks/metcalfes-law-is-wrong <comment><USER2> I think one of the best ways to understand network scaling (in the human sense) is the warrens and plazas metaphor [0]

Warrens are venues with relatively small size, that are relatively opaque to the outside. In principle, there is no scalability limit to warrens, as warrens scale horizontally.

Plazas are venues with relatively large size that are relatively transparent to the outside. Plazas scale vertically, and so run into all sorts of size based scaling difficulties [1][2].

I'd expect networks like facebook which are very warren-y to have a much lower value growth curve relative to the number of nodes. While it's true that Facebook has created plaza-ish features like Pages, the core function of the network is explicitly warren-y, with a cap to the number of friends any profile can have.

In contrast, a network like twitter should have a value growth curve much closer to Metcalf's law since it is almost completely plaza-ish.

[0] [https://www.ribbonfarm.com/2010/10/27/warrens-plazas-and- the...](https://www.ribbonfarm.com/2010/10/27/warrens-plazas-and-the-edge-of- legibility/)

[1] [https://en.wikipedia.org/wiki/Dunbar%27s_number](https://en.wikipedia.org/wiki/Dunbar%27s_number)

[2] [https://pjammer.livejournal.com/61330.html](https://pjammer.livejournal.com/61330.html)

</comment><comment><USER3> Metcalfe lives here in Austin and is involved in the local startup community in a variety of ways.

One time I asked him how he came up with the law and he said something close to: "It's simple! I was selling network cards! If I could convince them it was more valuable to buy more, they'd buy more!"

As an EE who studied networks, etc in college, it was jarring but audacious and impressive.

 _He was either BSing all of us ~40 years ago or in that conversation a few years ago.. but either way, he helped make our industry happen._

<comment><USER4> Build it and they will come. Scale it up and it will turn to gold. IPO before reality catches up.

</comment></comment><comment><USER5> Metcalfe is an interesting character, still sharp and full of stories. Ferriss did a nice, non-technical, long form interview with him that covers his time at Xerox and 3Com and what he learned about leadership and business. They do discuss his law, if you want to hear it from the horse.

[https://tim.blog/2018/02/14/bob-metcalfe](https://tim.blog/2018/02/14/bob- metcalfe)

</comment><comment><USER6> I'm surprised the Erdős–Rényi model [1] isn't mentioned in this article along with Metcalfe's Law and Zipf's Law. There's a nice phenomenon with random graphs: if the probability of two users being connected > log n / n, then the graph is "surely" connected.

[1] [https://en.wikipedia.org/wiki/Erd%C5%91s%E2%80%93R%C3%A9nyi_...](https://en.wikipedia.org/wiki/Erd%C5%91s%E2%80%93R%C3%A9nyi_model)

<comment><USER7> Erdos-Renyi random graphs aren't mentioned probably because they hold almost no relevance to social graphs and networks, like the ones being addressed by Metcalfe's and Zipf's law. Erdos-Renyi random graphs have a Gaussian degree distribution (or maybe Poissonian degree distribution) [1] which effectively makes the number of edges a proportion of the number of vertices with a narrow band of variation as a result of the finite variance. Social networks tend to have some type of power law or "long tailness" to them, giving them unbounded variance of degree and often giving them unbounded mean degree [2] [3].

Another way to say this is Erdos-Renyi random graphs are not long tailed, power law degree distributed or scale free, which Metcalf's law and Zipf distributions address in one form or another.

[1] [https://en.wikipedia.org/wiki/Erd%C5%91s%E2%80%93R%C3%A9nyi_...](https://en.wikipedia.org/wiki/Erd%C5%91s%E2%80%93R%C3%A9nyi_model#Properties_of_G\(n,_p\))

[2] [https://en.wikipedia.org/wiki/Long_tail](https://en.wikipedia.org/wiki/Long_tail)

[3] [https://en.wikipedia.org/wiki/Stable_distribution](https://en.wikipedia.org/wiki/Stable_distribution)

<comment><USER6> After rereading this article [1], I'd have to agree the Erdos model is ill- fitting — but still disappointed no model was mentioned.

[1] [https://www.quantamagazine.org/scant-evidence-of-power- laws-...](https://www.quantamagazine.org/scant-evidence-of-power-laws-found- in-real-world-networks-20180215/)

</comment></comment></comment><comment><USER8> These 'laws' of network value address only the potential value -- each node could make n*(n-1) connections.

However, the network will never actually make all of those connections. None of us will ever call anything close to everyone on the telephone network, contact everyone on FB or Twitter, etc. Yes, there is value in the larger network of addressable nodes that could potentially be connected, but it seems to me that the yield of connections made also counts.

So, the value of a network should first include the available resources of the nodes connecting, such as time. A telephone network has a different value from a broadcast network. The telephone users can only physically call other people for 86400 seconds/day, etc., so the yield of connectsion made is capped. Vs a broadcast network that can simultaneously reach millions, but only one-way.

Similarly, the friction in making connections needs to be considered. E.g., a telephone network with speed dial has more net available connection time than a network requiring everyone to talk to the operator and get literally patched thru.

Search functions, and discover-ability also come into play. Having the White Pages where everyone was listed in the US would have made its telephone network much more valuable than a Russian network of exactly the same size where no numbers were published. Similarly, DNS adds zero new connections to the Internet, but makes it enormously more valuable.

Obviously, this lacks quantative measures, but these are the sorts of factors I'd want to see in an improved algorithm.

<comment><USER9> Very well said. One would probably have O(log N) potential partners for activities they care about.

</comment></comment><comment><USER10> I was initially skeptical about the _n log(n)_ , but the arguments are persuasive. Specifically about not all connections being worth the same. That they follow Zipf's law specifically is a minor point I think, the overall shape seems right.

<comment><USER11> > Specifically about not all connections being worth the same

Kicker right here. If don't know what makes a network interesting, it is best to just add more links as fast as possible. In a network like Quora, they were initially successful because they curated the link quality.

</comment></comment><comment><USER12> I think you can't even trace all of the effects, so it can be neither proven nor disproven. You would need to study something much simpler than human beings.

And it might be more accurate to say the POTENTIAL is what scales. And this is one more technology that some people don't exploit at all and that others make the most of.

But it is right enough to describe the gist of the situation.

</comment><comment><USER13> Hah from the title I guessed this was an Odlyzko paper.

If you liked this one, also read Content is not King

</comment><comment><USER14> My response to this article, written in 2006:

[http://lumma.org/microwave/#2006.08.23](http://lumma.org/microwave/#2006.08.23)</comment>


Airlines Work to Catch Up to the Digital Age - <AUTHOR> http://www.nytimes.com/2010/06/05/business/05air.html?hpw

<comment><USER2> For all the crappiness, you do have to appreciate the difficulty and complexity of swapping out these systems more or less on the fly.

<comment><USER3> Yeah, and add to that the scale of replacement, and that they need to interoperate and their _users_ need to handle multiple versions in multiple locations... it's a nasty problem.

I feel their pain, but I still must ask "why not earlier?". It's not an _entirely_ unreasonable question, though I'm glad it's underway.

<comment><USER4> At the risk of being flippant, it seems obvious and the article even mentioned it. The airlines are short of cash, and new technology on this scale is not cheap (or quick or easy). I'd bet the airlines are big believers in "If it ain't broke, don't fix it!"

<comment><USER3> And in the meantime people _like_ flying less and less, and seek alternatives.

There's the distinct possibility that the pains of flying are the _cause_ of the shortness of cash. And given what a few choice pieces of bad press has done to some airlines, and that updating a few things would make the problems less likely to occur, the implication that funds have been misspent is pretty easy to derive.

It's not cheap nor easy, I fully agree. And it sucks. But might they have done some of the smaller things sooner, possibly preventing their downturn?</comment></comment></comment></comment>


Mentor Saturday - <AUTHOR>

The previous thread[0] was popular, so I'm creating another one this week.<p>Let's match mentors and mentees and talk about mentoring! Tips for mentees:<p>- It is probably good to be specific in describing potential mentor<p>- It is great if you show/describe some of your work(especially in the sphere where you need help).<p>[0] https://news.ycombinator.com/item?id=7825900 <comment><USER2> I'm looking to mentor a couple people about best practices for web development. I've been building websites and web applications for over 15 years now.

Please get in touch if you're interested. You can see some of the projects I've worked on at [http://mattmccormick.ca/portfolio/](http://mattmccormick.ca/portfolio/)

email@example.com

</comment><comment><USER3> I can help out with marketing/business strategy. If you're in London, we can go and grab a coffee sometime.

You can find out more about me on linkedin: [https://www.linkedin.com/profile/view?id=70827722](https://www.linkedin.com/profile/view?id=70827722)

</comment><comment><USER4> If someone needs mentorship on Ruby / Rails, I'd be glad to help out. You can help me build Huginn ([https://github.com/cantino/huginn](https://github.com/cantino/huginn))!</comment>


Concurrence: a Python framework to create massively concurrent network applications - <AUTHOR> http://opensource.hyves.org/concurrence/

<comment><USER2> The concept is a neat addition toa growing list of python non-traditional concurrency options: Stackless, py.greenlet/eventlet, kamaelia, fibra, and twisted's defer.inlineCallbacks offer similar featuers.

Of that list, Concurrence is most like fibra and kamaelia, which also use python 2.5+ generators to achieve microthread concurrency.

</comment><comment><USER3> Correct me if I'm wrong, but it seems that this solution, like others, is still constrained by Python's Global Interpreter Lock, ensuring that only one thread per process can be executing Python code at any time.

If you want true concurrency of Python code (like if you wanted to run it on multiple cores at once), you'd have to use something like pyprocessing, which spawns off new processes instead of threads.

<comment><USER4> I think "concurrence" here refers to serving many requests concurrently, as opposed to executing concurrently on multiple cores. But yeah, I think you're right, it's not concurrent in the strict sense.

If you wanted, you could probably run as many separate python processes as you have cores. I doubt it would help that much, since the main bottleneck in this sort of application is usually the I/O involved in handling lots of small packets.

When Facebook made memcached multi-threaded (it's also based on libevent), things improved, but if I recall correctly, not that dramatically. They're probably getting more benefit out of it now that they've hacked the kernel to improve the packet/second bottleneck issues, but for most people that's probably not worth it.

</comment></comment><comment><USER5> "It takes a Lightweight-tasks-with-message-passing approach to concurrency."

As someone who really likes Erlang's approach to concurrency, I think it is very cool to see it starting to become available in more and more languages.

<comment><USER6> Unless I'm very much mistaken, this does not implement "no shared state between threads/processes/whatever", which I consider a bare-minimum requirement to actually have Erlang.

You can try to discipline yourself to use such a philosophy anyhow, but Python is going to be one of the worst places to try that. It is mutable to its core, which is one of the reasons it is cool, but doesn't lend itself to this approach very well.

<comment><USER5> Yeah, what I really meant by my comment was it is cool to see this style of programming (lightweight procs & messaging) becoming easier to do in more mainstream languages. While implementation details differ greatly, I think it still gives a lot of credit to the guys who developed Erlang.

<comment><USER7> Are you aware that using channels for communication and synchronisation has been prevalent in languages other than Erlang? Occam was one, and Bell Labs, creators of C, Unix, etc., used it in Alef and Limbo amongst others. They all hark back to C.A.R. (Tony) Hoare's CSP. Here's a good overview. <http://swtch.com/~rsc/thread/></comment></comment></comment></comment>


Tips for creating a R&D culture at a startup - <AUTHOR> http://vator.tv/news/2013-05-20-five-tips-to-drive-r-d-culture-in-a-fast-moving-startup Don't forget that customer value trumps hi-tech cool factor when it comes to actually having your new idea see the light of day <comment><AUTHOR> "what most attracts me (and other "math men") to R&D in a startup is the free flow of creativity across divisions and a culture of innovation"

Creativity begets creativity

Don't forget that customer value trumps hi-tech cool factor when it comes to actually having your new idea see the light of day</comment>


Cook – A Modern Build System Written in Python - <AUTHOR> https://getcook.org/ <comment><USER2> While I appreciate that there's a finite supply of names, Peter Miller's "cook" pre-dates this by a long time.

I'd encourage the authors to rename their project ...

[https://en.wikipedia.org/wiki/Peter_Miller_(software_enginee...](https://en.wikipedia.org/wiki/Peter_Miller_\(software_engineer\)) [https://launchpad.net/~pmiller- opensource/+archive/ubuntu/pp...](https://launchpad.net/~pmiller- opensource/+archive/ubuntu/ppa) [http://ibiblio.org/pub/linux/devel/make/cook-2.25.rm.pdf](http://ibiblio.org/pub/linux/devel/make/cook-2.25.rm.pdf) [http://ibiblio.org/pub/linux/devel/make/cook-2.25.ug.pdf](http://ibiblio.org/pub/linux/devel/make/cook-2.25.ug.pdf)

</comment><comment><USER3> What is modern about it? How does it compare to SCons that is more than a decade old?

<comment><AUTHOR> You could take a look at [https://getcook.org/docs/features/](https://getcook.org/docs/features/) or the examples provided at [https://github.com/jachris/cook/tree/master/examples](https://github.com/jachris/cook/tree/master/examples) to know more.</comment></comment>


You want what? To run where? Without that? - <AUTHOR> http://devcentral.f5.com/weblogs/macvittie/archive/2009/02/04/you-want-what-to-run-where-without-that.aspx

<comment><USER2> One thing that I dislike about this article is that it implies that there is a dichotomy of programmers, and that it falls like this: new web-savvy developers, and old COBOL mainframe programmers.

This is not true. There are still cool things being done not on the web, and still places for more traditional development.</comment>


The Student Bill of Rights - <AUTHOR> http://www.sturights.org

<comment><USER2> Some of these, like the privacy stuff, seem reasonable. It makes sense that student's personal communications shouldn't be monitored. It makes sense that institutions shouldn't accidentally disclose, say, Social Security numbers.

Some are less sensible, like the technology decree. From a teaching standpoint, for example, learning how to invert a matrix by hand is tedious and annoying and something you'll never do in the field but is still useful in learning linear algebra.

Some are outright bad, like the fair assessment section. I shouldn't be able to have a narrative exam in an engineering class instead of showing my facility with the reference tests and calculations.

There's some good ideas in there, but it strikes me overall as sophomoric, self-centered, and childish--basically exactly what we expect from students.</comment>