How To Find A Technical Co-Founder - <AUTHOR> http://girdley.com/2013/05/25/how-to-find-a-technical-co-founder/

<comment><USER2> What is worse are idea people whose pitch to technical people is "I have this great idea that will revolutionize industry X" and/or "I will take on megacorps X, Y and Z with this idea", and then continue immediately with: "But I cannot tell you anything until you commit and sign an NDA." That's very poor salesmanship, which is the exact opposite of what I need from a non-technical co-founder.

It also tells me straight away that the idea has never left the idea person's head. He hasn't talked with technical people to understand if it's feasible, he hasn't talked with potential customers to understand if his idea is attractive to them and if they're willing to pay for it, and he hasn't pitched to anyone for funding. In fact, he is probably guarding his idea so tightly because he knows that idea alone is all he has to contribute. I have drawers full of those kinds of ideas I could build, I don't need an idea person for that.

If all the idea person brings to the table are things I could do myself with a trivial effort, then they have no value at all. The real value comes from things that are difficult to achieve and take hard work. Like relationships with customers, deep understanding of what is the simplest possible technical solution that will satisfy those customer's needs, and the ability to bring in highly skilled employees, partners and funding.

<comment><USER3> "I have drawers full of those kinds of ideas I could build, I don't need an idea person for that."

"I could do myself with a trivial effort"

This is ridiculous, you know that?I'm a programmer too but I can't say I have a drawer full of super-mega-awesome ideas.If that were true you would be a billionaire by now.

So how about we stop bragging about it?Because in reality most of us don't have those revolutionary ideas.You know why?Because we overthink it too much.Sometimes an outside mind can see things clearer even if it's not technical.

Arrogance kills innovation all the time.

<comment><USER4> There are two types of "awesome idea" 1) a truly awesome idea, which if executed properly will lead to me becoming a billionaire 2) a sucky idea that will make me work on a project for two years for pretty much no financial return.

The problem is that nobody knows the way to tell the difference between the two without actually trying to execute. The GP apparently understands this, that's why he only has a drawful of ideas rather than Google. The GP is right to say that creating type 2 ideas is relatively trivial.

Which is not to say that the "ideas" guy might not have a type 1 idea in his pocket, but nobody (including the ideas guy) can actually tell, and the odds are that he has more of a type 2 idea than a type 1 idea.

<comment><USER3> I agree with you in some points.What I was trying to say is, we should stop the thinking that we, as technical people, have the best ideas and the best thinking and we are the ultimate SELECTORS when it comes to building a team and creating a startup.

Now, I don't know how everyone sees an "idea guy".For example, for me an "idea guy" = someone who is not involved in the startup/business world at all and suddenly comes up with a "brilliant idea" in a domain he does not understand at all.Now, of course I wouldn't work with him.But if a non-tech guy comes to me with a clear idea and he knows his stuff around the product and his familiar with the startup/tech scene, of course I would work with him.What I want from him is not really programming but insane passion, creativity, dedication, hungry to learn anything relevant to his product etc. And let me tell you, I rarely fail with this strategy.But who asks these questions nowadays?Nobody.Everyone is interested if the non-technical guy is a technical guy...No wonder there is so much terror when it comes to these people.

<comment><USER5> Nice reply Cardeck, echoes my sentiments exactly, in my reply to MGirdleys post.I should have asked you if your interested in being a co-founder lol!! I dont understand why there is so much hostility between tech and idea/biz folk, whose got the bigger b*lls etc

I think being an "idea" person is about knowing the market your going in, understanding your application and development in that market, the sales, finance etc Remember often what you go onto develop will not be used by tech guys so you also perhaps need an outside looking in perspective...but maybe I'm just saying that as the "idea" person

</comment></comment></comment></comment></comment><comment><USER6> I would sum all of these good thoughts up into one bundle:

A developer will be expected to work their ass off turning ideas into awesome software. If you're not a developer, you must be prepared to bring an equal amount of energy and expertise to the table.

If you can communicate that commitment to your potential developer (technical co-founder), I suspect you'll have a much easier time getting them interested.

</comment><comment><USER7> _"If you're an Idea Person, lock yourself in a room for a couple of months and teach yourself the basics of the relevant technologies. For example, if you're doing a web app, learn Ruby on Rails. Build something."_

Alas, I learned this after my first failed venture. Now I'm a developer and love it.

Note to all awesome business people that think they can kill it if only they had a developer... Go learn to code. At the very least you will learn something to throw under your project management belt. An even better outcome will be that you figure out if the venture is actually worth the trouble- It will happen a lot quicker than if you are trying to manage the idea with another person.

<comment><USER8> "they can kill it if only they had a"

Nine times out of ten, if you find yourself thinking in this pattern, you're making excuses not to start.

Find a way to get started anyway. Do something. Make a mockup out of pieces of paper. Find and talk to potential customers.

There are things you can do now, and they're usually things you really should do before bringing on a developer, or taking investment, or whatever you're blocking yourself with.

If you get to "if only" and stop, you may be in love with the idea of _being_ a successful startup founder, but you're finding excuses to avoid what it means to actually _become_ a startup founder.

Or a jazz musician. Novelist. Whatever.

<comment><USER9> You do really get that in every single human pursuit though. I could be so sucessful with girls only if I had a better pad/ more charisma/ more money / more hair in places it belongs. 99 out of 100 of these things will be just phony excuses, you could frankly do without. For example with hair, look at this guy: [http://www.absoluteability.com/wp- content/uploads/2012/05/ne...](http://www.absoluteability.com/wp- content/uploads/2012/05/neil-strauss-before-and-after.jpg) Hair was really not his problem, and he realized that.

</comment></comment></comment><comment><USER10> The nightclub analogy is appropriate. The truth is that the idea person isn't even necessary. It's easy enough for two technical co-founders to play that role, the rare exception being an idea person with unique experience in a niche industry.

The idea person who invests a few months in learning a language is infinitely more attractive to a technical type. Nobody wants to be in a partnership, knowing that someone is depending on them 100% to accomplish the overwhelming majority of the work involved.

PS- What's up, Michael. :) ~CJS

<comment><AUTHOR> I don't think two devs can always do what a biz guy and a dev could do.

There are often things that "Business People" will do better by specializing. For example, developing a direct, high-touch sales model. Most devs have little interest in that. So, a business guy is often good to have on the team there.

(Hey Joey!)

</comment></comment><comment><USER11> I've seen this question before, and it always seems to be phrased in a way that implies a) that tech people aren't ideas people, and that b) tech people are just a 'resource' that the 'idea man' (aka. the 'real' founder) owns. As in 'Oh yeah, look at my awesome software. Oh that guy? He's just the one that, you know, wrote it all'. I think we as techies owe it to ourselves to be flipping this on its head, and asking questions on business sites like "How to find a business cofounder?" I recently started working in a coworking space full of startups. I occasionally overhear ludicrous conversations where an 'idea' person, with a lame idea, is trying to find a 'tech' person for some piddling share of the equity. I definitely think there's a huge advantage to being two instead of one, but I also think it should be a balanced one, where both people contribute to expanding an idea, and both truly own the idea, despite who initially started out with it.

</comment><comment><USER12> The best advice I ever got about how to hire people and fill gaps in your team is to do the job yourself first - this applies to everything, not just tech.

The advantages of this approach are enormous - it helps you understand what you're looking for, helps you evaluate candidates and helps you understand the needs of your own company better than anything else ever could. And you're no longer desperate - you can afford to wait until you've found the best person to work with. It means that when you do start talking to people, they will respect you more because you took the time and effort to work out exactly what it is they do and how valuable they are.

It might even turn out that you don't even need that person, that the company is doing just fine because you worked out you can do it yourself more cost effectively than bringing on someone else.

Develop your skills so you can be the tech co-founder until you can get someone better than you.

<comment><USER13> _The advantages of this approach are enormous - it helps you understand what you're looking for.._

That's true, but keep in mind that the disadvantages are relevant too: you lose maybe 10x time doing something you were not supposed/skilled to do, so your time-to-market is way longer AND you're not doing other stuff that are needed (customer/product validation - marketing - fundraising etc..)

</comment></comment><comment><USER14> My personal opinion is that by the time you have a business you want to build, you should already be close to several people who you'd like to work with. The feeling should be mutual. That means building a relationship -- trust, rapport, history, etc. -- _before_ there is any extrinsically motivated _need_ to find and know someone, whether they are technical or otherwise.

I'm sure some people can make things work with a team that is in essence a group of mutually hired guns [1]. I don't think _I_ can succeed in that kind of relationship, and so I actively shun it.

[1] admittedly, I can see how such an arrangement can at times be valuable.

</comment><comment><USER15> Funny that you are in San Antonio. I had the pleasure to work with Richard Ortega @ PickGrapevine. We meet in college and he always had these crazy ideas. While we were building PickGrapevine he would take time to do his own research about the tech stack we choose to use and seem genuinely interested into learning more about development. I wasn't able to say on become one of the founders but Richard went on to become a great CTO in the process ,he picked up some ruby and to my knowledge is doing great with it and the company seems to be doing good.

<comment><AUTHOR> Richard had the funnier quotes in the blog post. Thankful he took the time.

</comment></comment><comment><USER16> It's an interesting problem, looking for a solution to it myself: <https://news.ycombinator.com/item?id=5767447>

I think a platform which allows you to work on smaller projects to build up your credibility could be useful.

</comment><comment><USER17> Hmm, technically there's nothing in there that helps you _find_ a co-founder, just stuff that might make you look more attractive once you have.

<comment><AUTHOR> Good point.

</comment></comment><comment><USER18> "Someone has to make it rain"

this made me laugh!</comment>


Introducing Replays in Super Smash Brothers Melee - <AUTHOR> http://www.youtube.com/watch?v=9GWkY5sQpE8 <comment><AUTHOR> This was made by a person I was once friends with in high school. I would consider this to be one of the most interesting technical achievements in ROM Hacking, due to the slew of features he has created using just assembler, such as:

1) Slow motion or faster replays

2) Ability to take control of the characters mid-replay

3) View hitboxes of the character types

4) Store the replays for use in emulators (enabling wide-screen or full-HD videos of professional matches)

and so forth.

Reddit Discussion here: [https://www.reddit.com/r/smashbros/comments/3kawbn/melee_is_...](https://www.reddit.com/r/smashbros/comments/3kawbn/melee_is_getting_native_replay_functionality_with/)</comment>


First YC Fellowship Virtual Demo Day - <AUTHOR> http://blog.ycombinator.com/first-fellowship-virtual-demo-day <comment><USER2> Pramp is particularly interesting, though I'm not sure if there are ways for the Pramp team to maintain good levels of quality as the user base grows.

When compared to YC companies, the YCF companies seem a little earlier stage by demo day.

Nit picking: A lot of the websites of YCF companies use RapidSSL, Comodo or GoDaddy domain validated certificates. Why not Let's Encrypt?

<comment><USER3> > Why not Let's Encrypt?

Because if you're really running a business then any decision other than just paying the $200 to not have to think about certs more than one day every three years is probably not justifiable.

<comment><USER4> > Because if you're really running a business then any decision other than > just paying the $200 to not have to think about certs more than one day > every three years is probably not justifiable.

From the same data I came to the reverse conclusion, having auto-renewing certs from LetsEncrypt is awesome. Combined with bog standard cron jobs you now don't have to worry about any manual intervention down the road.

Compare that with creating a new key, creating a CSR, comparing SSL cert prices, getting aggravated at paying $10/year for 1ms of compute time (to sign the cert), grumbling to yourself, buying the cert, waiting for email confirmation, confirming domain ownership via insecure SMTP email, waiting for the cert to be issued, downloading a zip of the cert that somehow isn't the same name/format as your notes from last time, unzipping the zip file, figuring out the order for the cert chain, uploading it via SCP to your server, copying it over the old cert yet also accidentally keeping a copy of the cert/key in the default ubuntu@myhost home directory with 644 permissions, and finally testing it from your browser (only to find that you didn't send a SIGHUP to nginx so it's still providing the old cert).

So yes, having to think about certs more than one day (the day I set it up) is not justifiable.

PS: Why the hell are you paying $200 anyway? At most it should be $30, i.e. $10/year x 3 years. That looks more in line with wildcard SSL prices.

<comment><USER3> > That looks more in line with wildcard SSL prices.

Because I'm buying a wildcard cert. (Which Let's Encrypt doesn't currently offer.)

</comment></comment></comment></comment><comment><USER5> > Bulletin - Airbnb for Retail

A marketplace to setup popup shops is something new.

It looks like they're augmenting that with something like their own Etsy, but with less homemade and more well designed objects.

<comment><USER6> Storefront - [https://www.thestorefront.com/](https://www.thestorefront.com/) \- raised almost $10m for a similar idea, and just shut down last month after four years, so I wonder how/if Bulletin will approach the market differently.

<comment><USER7> It's not a "similar idea", it was the exact same thing. Google "AirBnB for retail." :)

This company is going to face a really tough road ahead if they don't execute properly. Including convincing Storefront's old customers that they're going to do it right.

</comment></comment></comment><comment><USER8> > _realistiic_ reloading, slide action, [0]

Typo alert, right on front page, first paragraph

[0] [https://iliumvr.com/](https://iliumvr.com/)

</comment><comment><USER9> It's exciting to see these companies execute on their ideas. But can we have a little fun with it?

\- Crimson Labs: Fitbit for Period Sex

Your turn.

<comment><USER5> "So what's your market size?"</comment></comment>


RSpec-2.0.0 is released - <AUTHOR> http://blog.davidchelimsky.net/2010/10/10/rspec-200-is-released/ <comment><USER2> The big takeaway from this for me has been how much I'm enjoying reading the cucumber tests!

<http://relishapp.com/rspec>

Tests as documentation are really coming around.

Sincerely, A cucumber convert

(ps: For those not familiar with cucumber, it provides a DSL to describe application behavior in plain-text, which is then translated into runnable tests. <http://cukes.info/>)

<comment><USER3> More like a DSL to describe application behaviour in not really plain text from which you then manually copy your assumptions into slightly less plain text DSL shim to actually run the tests.

So wasteful.

<comment><USER4> It's far from wasteful for us. The stories we write are exactly plain text which we have successfully had clients help us write. Unfortunately some programmers don't speak "plain text" and insist on writing code-like stories using "tables" instead which then can make it very, very wasteful.

For us, the mere excercise of writing the stories with customers has been very useful in getting the requirements out of their heads. We can then say "You helped us write these, the app does what you said you wanted it to" and there are less issues with communication.

It's saved us time and money. Here's just an example of how we use it, using EmailSpec.

        Given I'm logged in to the central authentication service as "bphogan"
        And I am on the home page
        Then I should see "Welcome, Brian"
        When I select "Administrative Information"
        And I follow "Change Address"
        Then I should see "Fill in this form to change your address"
        When I fill in "Address 1" with "123 Fake Stree"
        And I fill in "City" with "Springfield"
        And I select "OR" from "States"
        And I fill in "12345" for "Postal Code"
        And I press "Change Address"
        Then I should see "Your address has been updated"
        And I should receive an email
        When I open the email
        Then I should see "We have updated your address"

That alone tells a client so much about what we're doing, and tells the developers what real tasks need to be extracted from the story to make it all pass. Things like "select" and "fill in" are already done for you. There are only two custom tasks in this scenario, and we wrote those once and share them across projects.

See <http://elabs.se/blog/15-you-re-cuking-it-wrong> and <http://mislav.uniqpath.com/2010/09/cuking-it-right/>

<comment><USER3> The language used is not plain text, it is limited and formulaic (which is fine, the description was just inaccurate).

I take it that EmailSpec generates the other half of the implementation for you?

<comment><USER4> It's plain text, it's just not freeform. But that's nitpicking either way. It's human readable, and I took issue with the 'such a waste' comment, because it's proved value for us many times over.

EmailSpec gives me step definitions for dealing with opening emails in a "virtual" email box. Very handy stuff.

<comment><USER3> I thought my wastefulness comment was clearly tied to the duplication of work you have to do. Sorry if that was not clear.</comment></comment></comment></comment></comment></comment>


Wasabi: A Framework for Dynamically Analyzing WebAssembly - <AUTHOR> http://wasabi.software-lab.org/ <comment><USER2> Daniel here, PhD student working on this. Ask away if you have any questions :)

For now, this is in an early stage, so probably mostly interesting to researchers or as inspiration. But I am working on making it more usable (adding documentation, examples).

<comment><USER3> Hey there! I work on Spidermonkey (not specifically the wasm part, but I've touched it a few times due to other work).

First off, nice work - this is really cool. One of my big hopes for WASM is that it provides a real low-level semantic model to start talking about program analysis. It takes away a whole lot of the platform-specific skullduggery you need to do to perform these sorts of analyses on machine code, and the whole model is a lot simpler than something like CLR or JVM since it's so low-level.

I've been keeping my eye out for program analysis tools on top of wasm for a while now. Very happy to see your work.

Have you gotten in touch with any of the wasm folks at Moz? I'm sure they'd be happy to talk with you about it (I know I would definitely not mind picking your brain a bit on some high-bandwidth comms chan - learn a bit about the implementation challenges and issues you ran into).

Cheers :)

<comment><USER2> Thanks for the warm words, happy to hear that others are interested in this project and WebAssembly in general!

Regarding your question: No, I have not yet contacted the WebAssembly people at Mozilla. But it's definitely a good idea to talk to the implementation experts. Before I do that, I just wanted to collect more "concrete" questions/problems to ask about.

One of those questions is about the performance overhead of the WebAssembly <-> JavaScript interop. In Wasabi, we have a lot of this, because the "analysis hooks" are written in JavaScript and we insert roughly one hook call per original instruction into the wasm binary. Even without any analysis code, just adding these calls can have a runtime overhead >30x. I would like to optimize this, but before that I need to find our where the overhead is coming from. Possible reasons are (just guesswork, input from people working on this is greatly appreciated):

\- that many calls are just inherently expensive, be it cross-language or not (possible solution: be more selective about when to insert calls to analysis hooks) \- Wasm <-> JavaScript calls are more expensive than Wasm <-> Wasm ones (possible solution: compile analyses to Wasm, or: hope that this gets optimized better by engines in the future) \- the added instructions inhibit some wasm compiler optimization(s) (e.g., inlining is no longer performed because the function bodies are larger than some threshold) \- ...

So far, I found working with WebAssembly very pleasing. The spec is compact but still easy to follow. I wrote my own de-/encoder and "high-level representation" of the binary format, which was straightforward and is abled to roundtrip all test files from the spec repo. The most surprising bit was about validation of dead code (i.e., code after an unconditional br is type checked, but the br is assumed to "produce any possible value").

As for personal communication: I am happy to answer any in-depth question via email or so (see [http://software- lab.org/people/Daniel_Lehmann.html](http://software- lab.org/people/Daniel_Lehmann.html)).

<comment><USER3> > Even without any analysis code, just adding these calls can have a runtime > overhead >30x. I would like to optimize this, but before that I need to find > our where the overhead is coming from.

That thought entered my head immediately as soon as I noticed you were instrumenting every instruction.

> \- that many calls are just inherently expensive, be it cross-language or > not (possible solution: be more selective about when to insert calls to > analysis hooks)

This is definitely true, and hard to get around. The wasm instructions will be compiled to machine instructions, and the calls will still be calls, and calls are expensive.

One possible approach to mitigate this cost might be to collect and batch calls into the hook functions. Basically your instrumentation would be a trace-dump of execution and data to some in-wasm memory, and periodically you call out to JS for analysis once the buffer fills up.

This should reduce the call overhead and replace it with a single write to a well known location.

Now, if your analysis functions expect to be able to peek at memory and get a consistent view of memory at the time of the instruction being analyzed, you'll need to do some special magic to re-compute the memory state at that time from the recorded trace, but that can be done on-demand when analysis requires, so 0 cost if the hooks are not present.

Please note that I'm not sure how well this would work exactly, but it seems promising.

> \- Wasm <-> JavaScript calls are more expensive than Wasm <-> Wasm ones > (possible solution: compile analyses to Wasm, or: hope that this gets > optimized better by engines in the future)

It's getting optimized now. My impression is that the big cost here is marshalling wasm numbers into JS values. I don't know of a good way to avoid this aside from not calling into JS when you can avoid it (i.e. you know there are no analysis hooks attached to something).

I wonder if a simple runtime flag check within wasm, guarding the call-out, would significantly reduce the overhead cost.

> \- the added instructions inhibit some wasm compiler optimization(s) (e.g., > inlining is no longer performed because the function bodies are larger than > some threshold)

This shouldn't be the case too much. Most of the heavyweight compiler opts happen before emission to wasm, including a good chunk of inlining. I'm not even sure if Odinmonkey (our Wasm impl) does any extra inlining on top of that - it might just expect the compiler to take care of that.

I'll get in touch. I think you'd get more confident answers on these from the direct WASM crowd. My answers are a bit speculative, and lack concrete details about the latest implementation status.

</comment></comment></comment></comment><comment><USER4> not to be confused with fog creeks legacy compiler which is also called wasabi: [https://www.joelonsoftware.com/2006/09/01/wasabi/](https://www.joelonsoftware.com/2006/09/01/wasabi/)

</comment><comment><USER5> Just an aside... One thing I've been wondering for ages - How is WebAssembly any different to/better than the clusterfuck that Flash became? The security model/ sandboxed isolation?

<comment><USER6> It's an open standard. Designed with security in mind. That can reuse a lot of the things already made for Javascript. That is intentionally small and simple. That doesn't try to reinvent things such as UI (web browsers already have everything we need).

</comment></comment><comment><USER7> for some reason I was reading it as a framework for dynamically analyzing webpack.</comment>


"Problem Solvers" vs "Theory Developers": The Two Cultures of Mathematics. [pdf] - <AUTHOR> http://www.dpmms.cam.ac.uk/~wtg10/2cultures.pdf

<comment><USER2> This observed pattern can be described by personality typing. I like to think of it as 2 classifications of how our brain explores - depth-based vs breadth- based search. Problem solving vs random walk. Directed vs discovered. Convergent vs divergent, etc. Essentially, one type enjoys digger deeper (defined by getting closer towards a goal) into a topic, while another enjoys expanding outward (exploring a topic, no goal required).

The majority of people enjoy doing one type of thinking and hate doing the other, which causes this culture difference. Depending on the class of problems that a field has to tackle, the community may be dominant in one or the other. Mathematics is a field in which a random walk style of exploration can yield fascinating results, while an engineering field is much more likely to benefit from a focused approach. Usually, the type of thinking that yields more results becomes dominant in the community and gets the right to snub the other.

The difference and contention, I think, arises purely out of the dislike of doing the type of thinking that you're not naturally inclined to. This dislike is rooted in unfamiliarity and a strong sense of worth that parallels our inclinations. The contention is rarely settled by arguments of logic, efficiency or practicality - it is not that people don't believe in logic, but rather because the arguments don't address the core issue. The core issue is our natural inclinations, which at its roots, are innate or at least solidly ingrained in us by the end of childhood.

</comment><comment><USER3> I know Tim. In additional to being a phenomenally good mathematician, his clarity and elegance of expression spills over into his writing and his lectures. Some people take a dislike to his style, but I can't see why.

He's also a really, really nice guy, and it's been a privilege on occasion to work with him. My contributions were miniscule, but he was fantastic to work with. I hope to do so again.

</comment><comment><USER4> Isn't this more of an age thing? Mathematicians start out as problem solvers and later become theory developers?

As you age, it becomes harder to solve difficult problems but easier to develop theories due to greater experience.

<comment><USER5> I don't think so, based on historical evidence. At least it doesn't seem to be like before- and after-45 or other midlife age. From all great theory builders, we rather see like this age being closer to late twenties. They start out by solving some minor problems, often ambitiously taking the labourous technical ones, and then boom, out of nowhere new stage-setting theory, not necessarily much related to previous work. These frameworks open new hard problems which then are becoming mainstream, while frameworks that emerge by accretion of facts and experience hardly make such impact. I give Alain Connes as an example; man steadily, for most of his academic life i.e. last 30 years, outlines theories at a rate of one per two or three years.</comment></comment>


Google's Doors Hacked Wide Open by Own Employee - <AUTHOR> https://www.forbes.com/sites/thomasbrewster/2018/09/03/googles-doors-hacked-wide-open-by-own-employee/ <comment><USER2> Many years ago at Georgia Tech, a student noticed that the network controlling the magnetic ID card-controlled doors was trivially controllable. He scheduled a talk about it at a local hacker conference, and what followed was the company that installed the system, Blackboard Inc, filed cease and desists and a lawsuit alleging violations of the DMCA, theft of trade secrets, violations the Espionage and Sedition Act, and presumably maritime piracy.

<comment><USER3> Coverage at the time: [https://www.geek.com/news/more-on-the-blackboard-hack- vs-dmc...](https://www.geek.com/news/more-on-the-blackboard-hack-vs- dmca-551061/)

<comment><USER4> Wow that website shows full page ads while reading mid sentence. That's one way for me to nope off their site and never return.

</comment></comment></comment><comment><USER5> > Tomaschik also discovered he could do all this without any record of his > actions.

> A Google spokesperson said there was no evidence the doors had been > exploited by any malicious hackers.

Hmmm...

</comment><comment><USER6> "Tomaschik also discovered he could do all this without any record of his actions." ... "A Google spokesperson said there was no evidence the doors had been exploited by any malicious hackers."

</comment><comment><USER7> In my (tbh quite limited) experience, I have found that physical security devices are some of the worst offenders when it comes to connecting to anything more complex than a simple RFID-tag. I wonder why there are no (or few?) companies that get their devices properly audited before release. I personally would pay much more for devices that have an independent audit published.

</comment><comment><USER8> As the article says, it's a much broader problem. Maybe the title ought to be "Software House security devices compromised by Google employee".

<comment><USER9> It's not clear if this was a scheduled vendor security review or if Tomaschik just looked into it out of personal interest. Google has done a lot of the former, for many years, even for physical security. The reports can be brutal. Think of Tavis Ormandy and his AV research, perhaps crazier. I remember a couple that were particularly bad and made me rethink everything I ever assumed about "security" systems.

</comment></comment><comment><USER10> > Tomaschik also discovered he could do all this without any record of his > actions.

... three lines later ...

> A Google spokesperson said there was no evidence the doors had been > exploited by any malicious hackers.

Yeah no shit.

</comment><comment><USER11> [https://news.ycombinator.com/item?id=17902753](https://news.ycombinator.com/item?id=17902753)

</comment><comment><USER12> IMO this is very bad to release as a news article.

> _...he could simply replay legitimate unlocking commands, which had much the > same effect. ... And he could prevent legitimate Google employees from > opening doors._

This is script-kiddie material. You don't even need the mental chops to reverse the encryption being used, you can just quietly sniff the corporate LAN and you're done.

> _Tomaschik also discovered he could do all this without any record of his > actions._

The obvious interpretation of this is that, if there's any logging at all, it's being done at a higher level. But I realized this might also mean that the locks communicate via UDP broadcast packets, which explains why this person was able to do this research _in situ_.

> _... problems likely remain for others using the vulnerable Software House > tech. Tomaschik said Software House had come up with solutions to fix the > problem, though to switch to TLS, it'd require a change of hardware at the > customer site. That's because the Software House systems didn't have enough > memory to cope with the installation of new firmware, Tomaschik said._

The reason I think this is bad to discuss is that infrastructure like this is generally installed and expected to work for years. Obviously a bunch of sites have quietly upgraded to the v2 boards that now do TLS (yay, capitalism...?), but many many more won't. Indeed, as of the time the article was printed, even Google hadn't yet!! See:

> _Meanwhile, Google has segmented its network in order to provide protection > for the vulnerable systems still in its properties, the spokesperson added._

I expect they'll be upgraded soon enough, and that VLANing building infra was something netops could just do immediately.

But what about all the sites that aren't told? They'll surely all be high- value targets, if I presume that Google are going to use systems appropriate for high-value enterprises.

I guess my (unanswerable?) question now is what kind of contract wording is used to stipulate security updates and full disclosure to clients.

<comment><USER13> >> I guess my (unanswerable?) question now is what kind of contract wording is used to stipulate security updates and full disclosure to clients.

None. They generally install security systems to reduce their insurance premiums.

<comment><USER12> Ah. Of course.

<comment><USER13> I don't really see anything out-of-the-ordinary here.

The fact that security guys haven't yet managed to organise themselves into a consultancy to be used by insurance companies as security advisors is appalling.

</comment></comment></comment></comment><comment><USER14> It seems that Google employees have nothing to do so they just play around trying to hack stuff around the office. Obviously it took a lot of time to research this.

It's disturbing to think how much they get paid to do nothing.

<comment> tushar-r >It's disturbing to think how much they get paid to do nothing.

Identifying serious vulnerabilities is a "nothing"?</comment></comment>


Keybase, we've got a privacy problem - <AUTHOR> https://www.whiskey-tango.org/2019/11/keybase-weve-got-privacy-problem.html <comment><USER2> Tangential (but implicitly privacy-related): How does Keybase earn its money? Their site doesn't make this clear to me.</comment>


Airbnb and eBay will end forced arbitration for sexual harassment claims - <AUTHOR> https://www.buzzfeednews.com/article/daveyalba/tech-companies-end-forced-arbitration-airbnb-ebay <comment><AUTHOR> The original title was a little too long: _Airbnb And eBay Just Said They Would End Forced Arbitration For Sexual Harassment Claims_.

From the article, Buzzfeed received statements from Apple, Lyft, Pinterest, Reddit, Oath, Intel, and Netflix saying that each of them either never used or no longer use forced arbitration.

"Meanwhile, Snap, Spotify, Netflix, and Salesforce, did not respond to BuzzFeed News' question."

"Three companies, Tesla, Twitter, and Slack, declined to answer."

</comment><comment><USER2> It's interesting that eBay has no mention of this on their corporate site or in press releases. It would likewise not surprise me if they don't apply this policy in their subsidiaries, like StubHub.

[https://www.ebayinc.com](https://www.ebayinc.com)</comment>


AWS Frankfurt, Germany Region - <AUTHOR> http://aws.amazon.com/blogs/aws/aws-region-germany/ <comment><USER2> This is pretty significant, because in Germany many corporations do require their data being hosted on German soil and protected under German consumer protection laws.

As a result the Cloud provider market is currently split into three categories: German corporations (e.g. Telekom) promoting themselves as truly compliant, US corporations with German hosting (Microsoft and Oracle) that self-promote themselves as compliant and US corporations such as AWS and Google that are aggressively attacked by German Cloud providers as violating German consumer protection law.

In the past I personally have lost customers in Germany because my services use App-engine and CloudSQL in Ireland. Thus, I hope Google follows with a German server for their cloud services.

<comment><USER3> I can see in-EU vs. out-of-EU making a legal distinction, but how is it possible for German consumer protection law to require servers actually in Germany, vs. say in Ireland or Denmark? That seems like it would violate EU treaties on freedom of trade and services within the common market, which usually prohibits both direct and indirect restrictions (e.g. Denmark can't ban EU food imports by imposing unique food-safety requirements). Or is that just a marketing position (people prefer German servers) rather than an actual legal position?

<comment><USER2> Basically Germany has their own set of consumer protection laws (Bundesdatenschutzgesetz) that are more stringent than the EU laws. There is an ongoing struggle if these laws should be regulated at EU level or at national level since some countries vastly differ in their attitudes in this space and common ground is difficult to establish.

In my personal experience the 'requirement' of some companies that data must be hosted in Germany is their own internal policy rather than something that is prescribed by their reading of the law. However there have been some court rulings where servers hosted in Germany are applied additional restrictions over servers hosted in Ireland.

A lot of this may also have to do with own interests. In the 80s and 90s every EU country wanted US silicon fabs in their underdeveloped regions. Now every country wants hosting farms.

<comment><USER4> _There is an ongoing struggle if these laws should be regulated at EU level or at national level since some countries vastly differ in their attitudes in this space and common ground is difficult to establish._

Oh dear god let it be at the EU level. The only way small EU countries full of semi-corrupt conservatives get decent consumer protection law is when it's an EU law.

<comment><USER5> As far as I know it is already an EU law and, as with the vast majority of EU laws, each member state can decide to override with additional restrictions (usually under some limitations).

In this specific case, I think Germany is the only exception, but to me it makes perfectly sense: sensitive personal data like medical records should not circulate outside the country.

Even at EU level, how could Germany as a nation guarantee privacy if data is physically maintained in Ireland, where most of the US companies have offices just because of cheaper taxation...? As a country I would't promise that, and as a citizen I wouldn't trust such a promise (side note, I'm Italian so I have no gain/part into this).

<comment><USER6> > In this specific case, I think Germany is the only exception, but to me it > makes perfectly sense: sensitive personal data like medical records should > not circulate outside the country.

Having a computer on German soil does not mean that

1) the packets themselves will not travel outside Germany (hint: AMS-IX);

2) people interested in the data contained in that computer will not read it, store it, use it outside Germany.

From the technology point of view, country borders do not exist. (Unless you force a country-wide firewall).

If sensitive data must be properly encrypted. Once it is encrypted you can store it everywhere you want.

<comment><USER5> I see your point, but the reality is different. Data stored is not data in transit. Both must be protected, but the attacker models are different.

Unfortunately real-world (meaning, not theoretical) encryption is not perfect, thus the sole fact to encrypt is not sufficient to let you store any data wherever you want. At least not in Germany, and at least not from my pov.

To remain in topic with this specific law, data in transit can exit Germany soil, provided that the recipient gives guarantees on its usage (including not store it). This kind of laws should be seen to regulate sensitive (user) data as managed by (big, multinational) organizations, that are thus required to enforce security for both stored and in transit data.

I understand that this may seem silly, but without such laws the landscape would be way worse (consider, e.g., how many personal data are actually traded across the world for ads reasons).

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > AWS is fully compliant with all applicable EU Data Protection laws

As long as the NSA can request data from US companies in foreign countries this is not at all compliant with EU Data protection laws at all. Under the current situation ANY US company providing services is not compliant and German companies with sensitive data would be stupid to put this data on US owned servers - wherever they are.

<comment><USER8> Yep, and exactly that is why I completely moved away from US companies for my hosting. Will I be a target for 'surveillance'? Probably not. Do I want to do everything I can to make the US fuck off from my data? Hell yes.

</comment></comment><comment><USER9> That's great news! As a german based SaaS company, we get many requests from customers asking where the data is stored. Even hair dressers (one of our main customer segment) are very conscious about where their data is stored. I'm looking forward to migrate.

<comment><USER10> Curiosity peaked. What do you do where one of your main customer segments is hairdressers, yet requires a cloud platform?

<comment><USER11> Me too. this? [https://cutterslounge.de/](https://cutterslounge.de/)

<comment><USER9> Yes, Cutters Lounge (yes, a weird name for native english speakers :) is an appointment booking software. In the beginning we focused on hair dressers, but as we've learned from them in the past years we are about to expand to other industries as well.

<comment><USER12> So you are competing with patio11, although currently targeting a different vertical ?

Edit: and a different linguistic area

<comment><USER13> FWIW, this is one of those cases where two services might appear competitive unless you're in one of them. There exist other US-focused companies which do "booking." This is a customer-facing function, and they have to compete on ease-of-use, conversion rates, embeddable widgets, and the like. AR does not do booking and will _never_ do booking.

Why not? Well, you have to have very standardized services which the customer understands to adopt a booking solution. For example, if you're a customer and can say "I want a 45 minute shoulder massage from Cindy", then Cindy's shop can use a booking platform. Most AR customers can't, because the client can't predict how long a dental appointment last, doesn't know that Joe can't come out to his house unless Frank gets the van back in time, etc etc. This is disproportionately the case for upmarket services businesses, which is where AR is moving. (e.g. We want customers with a $100+ value per appointment -- more "professional services" like accountants/medical/HVAC than "personal services" like hair care/massage therapy/etc.)

(I should mention that, even in the hypothetical case that a HNer were in direct competition with AR, I'd be more than happy to see other options available.)

<comment><USER14> My company is somewhat involved in booking and we've found it to be very specific to the vertical. We looked at building something that integrated with Quickbooks, but found that it's nearly impossible to come up with something that works for enough customers to make it profitable. From what I can tell, people on the Quickbooks team tried it too and decided against it. The long tail just has too many differing needs.

The problem you've listed (not knowing how long a dental appointment will last) isn't really a problem for a booking system...a dental office with a receptionist scheduling patients will run into the exact same issue and the same rules that the receptionist uses can be programed into a booking engine. The bigger problem for a dental office is that the calendar is locked in a management system that's probably running on a Windows computer somewhere in the office. Maintaining two calendars is almost never going to work and the one in the cloud will never be the calendar of record. Short of going the ZocDoc route and having practices reserve certain spots for appointments booked online (businesses hate doing this), you're always going to run into problems with conflicting appointments. The interesting thing is that most dental practices won't care about conflicting appointments since the only patients that will book online will be new patients and patients that have fallen out of the typical schedule. Everyone else will schedule their appointments with the receptionist at the end of their previous appointment. So most dental practices will happily juggle appointments to fit those specific types of patients into their schedule.

But that's the dental industry and almost every other industry has just as many quirks as the dental industry does, if not more. And that's why the market will most likely be filled with smaller, specialized vendors that target either one or possibly a handful of verticals. I'm betting the winners will be the companies that make the management systems used by the businesses, but that's not happening quickly since most of them are small ISVs that only understand Windows development and think cloud computing is something that meteorologists do.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Will having servers physically located in Germany really satisfy the privacy concern of German clients given that Amazon is still an American company subject to american laws?

<comment><USER16> Amazon operating in Germany is subject to German laws.

Legally, all asses are covered, and for 90% that's all that matters, regulatory compliance.

Germany, unlike Ireland, comes with the added bonus that if privacy protection is violated, shit will hit the fan. But that's all it is, a bonus.

Most assume the NSA can get to the data wherever it is, and those very few genuinely worried about that look for protection in encryption rather than legal jurisdiction.

</comment></comment><comment><USER17> For those who are curious, this is called "eu-central-1" (Ireland is "eu- west-1").

<comment><USER18> These namings seem to suggest they don't plan a lot of future expansion (not down to the national level)?

<comment><USER19> _These namings seem to suggest they don 't plan a lot of future expansion (not down to the national level)?_

Not at all. Look at the US, which has:

us-west-1 US West (N. California)

us-west-2 US West (Oregon)

Or Asia/Pacific:

ap-southeast-1 - Asia Pacific (Singapore)

ap-southeast-2 - Asia Pacific (Sydney)

<comment><USER18> You're correct. My mistake. :)

</comment></comment></comment></comment><comment><USER20> For those in London wondering where is best for UK based customers, here's an EC2 ping [1] comparison of Frankfurt and Ireland AWS:

        Europe (Ireland: 25 ms   27 ms   24 ms
        Europe (Frankfurt):	 39 ms   39 ms   42 ms

Suggests Ireland is slightly faster. Obviously just a sample of 1 (more data required), but given Dublin is roughly 300 miles away, and Frankfurt is roughly 400 miles away, it makes sense.

[1] Hitting ec2.eu-west-1.amazonaws.com vs. ec2.eu-central-1.amazonaws.com.

<comment><USER21> The channel is a good rule of thumb. For consumer isps eu-west should be faster in the uk. On continental europe, africa, and the mideast eu-central will probably be better. The notable exception is france, there it depends on the network as to whether eu-west or eu-central is less latent. Either way its normally +/\- 20% or 5ms.

Or just ignore all that and use route 53 latency based routing for your dns records. It will return the record for the least latent endpoint, per client.

</comment></comment><comment><USER22> Its an 18.57% premium up over US-EAST-1/US-WEST-2 and a 8.57% premium over EU- WEST-1

In case anyone cares

</comment><comment><USER23> There seems to be an error on the DynamoDB pricing page: [http://aws.amazon.com/dynamodb/pricing/](http://aws.amazon.com/dynamodb/pricing/)

Selecting EU (Frankfurt) I get:

Write Throughput: $0.000702 per hour for every 10 units of Write Capacity

Read Throughput: $0.0001404 per hour for every 50 units of Read Capacity

This is strange as every other region has equal pricing for Write (10) versus Read (50).

Also, Frankfurt's Writes would be ~10 times cheaper than Ireland (Write Throughput: $0.00735 per hour for every 10 units of Write Capacity)

<comment><USER24> Hi nnx, we are fixing this ASAP.

</comment></comment><comment><USER25> Maybe I overlooked, but I can't seem to find any information regarding how many Availability Zones it has.

Edit: thanks for the replies, it seems that the '/pt/' localized version of the page hadn't been updated yet. I was able to find the informatin on '/en/'.

<comment><USER26> The global infrastructure map mentions 2 availability zones: [https://aws.amazon.com/about-aws/global- infrastructure/](https://aws.amazon.com/about-aws/global-infrastructure/)

</comment></comment><comment><USER27> This is great from a data storage perspective, but i've always struggled to figure out the best approach for utilizing multiple regions to comply with legal issues like this.

That brings me to my question: How do you store your data so that you comply with the laws of a country, when you actually export your product to several countries? Having multiple instances of your system seems impractical and sharding data by country across regions could be rather hard. I.e. I am in Canada, we have US clients who desire their data to be in the US and Canadians who want it in Canada. Either we add complexity or someone doesn't get what they want.

</comment><comment><USER28> I've always wondered why Amazon put their first EU DC in Ireland, so far away from everything. While Germany is great and all, somewhere more central like Amsterdam would have looked like the obvious choice.

Whatever the location, it's still terribly expensive. Just looking at the Internet traffic charges makes my wallet hurt. I could not affort to serve traffic at any volume from AWS. Luckily there are a lot of other options in Germany.

<comment><USER29> Ireland was probably chosen because of low corporate tax rates.

This might have been more important when the first location was chosen than it is now, and latencies in Europe are mostly pretty minimal anyway.

<comment><USER30> Also, highly skilled English speaking work force. A huge amount of other US firms based in the area.

<comment><USER28> erik_sub, you have been hellbanned and your comment (reproduced below) can't be seen by anyone.

> Ireland was probably chosen because of low corporate tax rates.

Perhaps you are right. It just sounds incredibly short sighted if true. That's like, to use notax's example location, locating your startup in North Dakota because the rent is cheap over there.

Amsterdam would have been a much better location with better and cheaper bandwidth from a much larger selection of providers. In addition to better infrastructure, Amsterdam has a wider and deeper talent pool for datacenter talent. I also have a hard time really buying the tax argument as Facebook and Google have European datacenters outside Ireland and they seem to manage their Irish tax strategy just fine. Even Apple is reportedly eyeing a datacenter in the Netherlands and I doubt they would consider one if it messed with their Irish sandwitch.

> This might have been more important when the first location was chosen than > it is now, and latencies in Europe are mostly pretty minimal anyway.

From experience I can tell you that there is plenty of latency to go around in Europe. Part of that is Amazon's dubious choice of location and part of it is their network. Cloudping easily gives you latencies comparable to east coast - west coast ping times when testing from various European location to AWS Ireland.

Unlike popular entertainment would have you believe, Europe in not a country and neither is it the size of a postage stamp. You'd also be advised to consider that previously Ireland was Amazon's closest location to Russia and that in itself is a pretty big country.

Amusingly enough Amazon's Irish location is almost exactly like putting your datacenter in North Dakota as notax quipped.

Just look at this map: [http://www.powercycle.net/wp- content/uploads/2012/03/FireSho...](http://www.powercycle.net/wp- content/uploads/2012/03/FireShot-Screen-Capture-006-Europe-and-US-Country- Size-Comparison-Map-How-Big-is-Europe-Compared-to-the-US_- goeurope_about_com_od_europeanmaps_l_bl-country-size-comparison-map_htm.jpg)

</comment></comment></comment></comment><comment><USER31> Welcome to Frankfurt. I've found a first sign of a upcoming germany zone some month ago. Here is the posting of it: [http://www.nilsjuenemann.de/2014/07/new-aws-region-eu- centra...](http://www.nilsjuenemann.de/2014/07/new-aws-region-eu-central-in- germany.html)

</comment><comment><USER32> You can check your latency to the new region with [http://www.cloudping.info/](http://www.cloudping.info/)

I'm getting 165 ms from San Francisco to AWS Frankfurt eu-central-1.

</comment><comment><USER33> More ip ranges to block - are they published yet?

Don't see them here or the subforum, yet

[https://forums.aws.amazon.com/ann.jspa?annID=1701](https://forums.aws.amazon.com/ann.jspa?annID=1701)

<comment><USER34> Why do you block AWS?

<comment><USER33> They have unlimited free inbound.

Some people there will destroy your servers with insane spidering rates.

iptables conntrack helps but there are just too many and eventually the firewall takes more resources than the rest of the services you are providing

<comment><USER35> Are you hosting stuff that's particularly prone to crawling (and by crawlers that don't respect robots.txt)? Of the spider traffic we see, the vast majority of it comes from Google and the other major search engines.

<comment><USER36> One example: there are several people who apparently scrape the front page of HN (and proggit, etc.) and then proceed to download all of those links repeatedly every minute (or second!) for several hours. Same link, over and over and over. I can only imagine what get rich quick scheme would require such behavior.

<comment><USER8> Woah, that suddenly explains why sometimes websites go down so quickly after they get linked on reddit. Surely most hosting won't be able to host 100's of requests, but some times I've seen it happen that websites linked from smaller subs went down quickly.

</comment></comment></comment></comment></comment></comment><comment><USER16> Of all the services not (yet) available in this reason, the absence of Elasticache seems the most conspicuous. It's a stable mature services with no regional complications.

Can anybody think of any reason for that?

(Maybe it's just me, it's the only missing piece that would stop me from migrating from eu-west-1 to eu-central-1.)

<comment><USER37> Same here. Maybe they just haven't done it yet.

</comment></comment><comment><USER38> This is great news.

Does anybody know if there are significant differences between Ireland and Germany, concerning things like privacy and copyright protection? Perhaps there are same laws in EU, which are just enforced less in one country?

<comment><USER4> _Does anybody know if there are significant differences between Ireland and Germany, concerning things like privacy and copyright protection? Perhaps there are same laws in EU, which are just enforced less in one country?_

Yes. Irish data protection law is not as strong as other countries. And the government only care about jobs, and promoting the "smart economy". If big tech companies get annoyed at data protection law, they can tell the government that they'd pull out unless things quiet down. The Irish government don't want to "destroy jobs".

<comment><USER38> Thanks, but I've heard stories about the german Hetzner hosting lots of suspicious stuff and not caring. Especially in minds of russians and other eastern-europeans, Germany has been considered a safe harbor for grey and outright illegal stuff. That was during the 2000s as far as I know.

Is there an up to date german side to this story?

<comment><USER39> You can even host a Tor relay on Hetzner without issues, but if you receive a SPAM complaint, you'd better reply within the 24 hours they give you...

</comment></comment></comment></comment><comment><USER40> The s3 buckets in this new region require v4 signing of API requests, FYI. I found that out when adding Frankfurt support to Arq.

</comment><comment><USER41> Interesting that they don't have m1 instances, which is a problem if you need cheap disk space.

</comment><comment><USER42> I think some German corporations will still be reluctant to use it due to replication, etc.

<comment><USER43> I'm not sure what you mean?

<comment><USER42> Data is usually replicated across datacenters.

</comment></comment></comment><comment><USER44> any IPs for pinging? I'm curious what the latency is compared to Ireland from here (Eastern Europe).

</comment><comment><USER45> Pretty rad!</comment>


Technologically Illiterate Students - <AUTHOR> http://www.insidehighered.com/news/2010/07/16/techliteracy

<comment><USER2> I teach at a small liberal arts university. I too witness the observations made by the article author more and more. It is especially apparent in one of the final classes for our degree plan, a class meant as a professional development and practical prep seminar course. I see students list Microsoft Word and Windows as a skill on a resume. These same students have no skill with managing their online identities. Until reading this post I had assumed this was due to peculiar circumstances of the university, students and major. While this may still be a factor this article compels me to address this situation aggressively. Any material from educators who currently address this?</comment>


Intel: Object Programming Language User's Guide (1981) [pdf] - <AUTHOR> http://bitsavers.trailing-edge.com/pdf/intel/iAPX_432/171823-002_Intel_Object_Programming_Language_Users_Guide_Aug81.pdf

<comment><USER2> Wait.. This is a Smalltalk?!

<comment><USER3> No.

But there seems to be some similarities. Smalltalk was implemented on the 432, and this feels heavily influenced, but I don't think there was an implementation in 1981.

Edit: added information.</comment></comment>


On the Analogy Between Mind/Brain and Software/Hardware (1992) - <AUTHOR> http://www.massline.org/Philosophy/ScottH/mindsoft.htm <comment><USER2> The article makes an interesting point in fleshing out an analogy between (a specific reading of) the concept of "software" and the mind, but does so in a needlessly condescending tone, which is very distracting.

Take this example: _" To begin with you may think of software as a series of instructions to the whole system (including both the hardware and the rest of the software) [...] This is as far as programmers in business data processing centers usually get. That is why so many of them keep insisting that "no computer can possibly think; if you know anything at all about computers you should know that they just follow directions". This is an incredibly naive view which only reflects the narrowness of their own conceptions and programming practices."_

I would argue that defining software as "a series of instruction to the whole system" is perfectly valid. The author, instead, takes "software" to mean the functional properties of dynamic states of the system. Which also sounds like a valid definition, which leads to the mind / brain analogy.

edit: formatting

</comment><comment><USER3> This 1993 article definitely reads like the Mind/Brain concept in the era of Gofai (good old fashioned AI).

It's quite interesting just for its historical outline, even if the outline is pretty sparse (you gotta start somewhere). The main thing that I think modern AI/Machine-learning has discarded is the concept that intelligence is based on logical specification.

And I think it's entirely reasonable to say that a mind isn't "like software" if you mean human-constructed, top-down, logical-intentions based software.

The thing is, though, that neural networks and similar advances haven't left us with any alternative analogies for the mind/brain relationship. Should we come up with a new one?

<comment><USER4> Also, the mind isn't like software in that it doesn't get copied to other minds or mediums. Yeah, there are sci fi scenarios or futuristic predictions for this sort of thing, but it's not a reality at this point. Another difference is that there is no machine code for the brain. There isn't some set of primitive instructions programmers could target to instruct the connectome.

<comment><USER5> > There isn't some set of primitive instructions programmers could target to > instruct the connectome.

I wouldn't be so quick to rule that out. Think about the difference between short term memory and long term memory. Short term memory is on timescales far shorter than synaptic formation, so it stands to reason that it might take the form of electric patterns held in buffers in the brain (i.e. it is not encoded using synapses). If that is true, then why can't buffers that hold electric patterns also hold a set of instructions that can be retrieved from storage?

E.g. maybe short term memory is more like an FPGA (easily reprogrammable circuits) and long term memory is more like an ASIC (hardwired synaptic connetions that are far more dense and long-lasting).

</comment></comment></comment><comment><USER6> A fascinating subject. From a medium can come a new system of patterns. Like waves, really hard to figure their math, if you study water molecules. Plus waves are medium independent, and it gets really interesting as waves cross into a different medium (it bends).

Software is like waves, it needs a compute medium, but is independent from it. And software in the broad interpretation as information processing, indeed your brain seems like a compute medium, your mind is the information processing.

As for consciousness, the article mentions a follow up, anybody know if that exists somewhere? Personally I think consciousness is a pattern of information processing, a lot like reinforced learning[1]: keeping a history of observations, actions, and plans, and continuously introspecting and judging those plans.

So I wonder, if you run such an algorithm on a computer, would that feel like something to that program?

[1] [https://en.wikipedia.org/wiki/Reinforcement_learning](https://en.wikipedia.org/wiki/Reinforcement_learning)

</comment><comment><USER7> The article is interesting but the historical overview seems dubious to me and quite biased to show that "originally" people already thought it was a physical thing.

What about ancient egypt for example? It has extensive philosophy about the afterlife and the "soul" yet is not mentioned at all.

<comment><USER8> The author states that:

      > Until recently there were really no very good analogies available

On the contrary, our theories of mind have mirrored our latest technology for thousands of years. First, a hydraulic model, with "humours" flowing throughout the body's plumbing; then a mechanical model with tiny machinery; then an electo-chemical model with charges and currents.

This article argues strongly that our present computer-based metaphor is likewise off-the-mark: [https://aeon.co/essays/your-brain-does-not-process- informati...](https://aeon.co/essays/your-brain-does-not-process-information- and-it-is-not-a-computer)

<comment><AUTHOR> > This article argues strongly that our present computer-based metaphor is > likewise off-the-mark

Well, it is a metaphor, so, by definition, off the mark. The article only does well to hammer home the fact, as does the OP (at least, early on).

The metaphor eventually breaks down when you take it too far, too literally, otherwise it wouldn't be a metaphor. It will be the exact same thing.

The brain-as-hardware-mind-as-software is a useful model for dealing with the mind-body problem, and giving us a fair idea of how a virtual mind can exist in (on?) a physical brain.

Of course, you can't fault earlier ideas of thinking about the brain: it is only natural (and beneficial) to think of the mind in terms of the most complex man-made (or man-understood) technology currently available, without necessarily holding fast to it dogmatically when a better model is found.

Think of it as necessary stepping stones to the destination.

If anything, it is naive to think that the brain/mind works exactly like our current computing architecture. It is also naive and premature to completely banish the idea that the brain is some sort of computing mechanism.

<comment><USER9> Whenever this topic comes up in HN, a sometimes quite large fraction of the comments do make, or are predicated on, what seem to me to be unjustifiably specific analogies to current software technology (I guess that's no surprise.)

<comment><USER10> I imagine it's because they're implemented in PHP.

<comment><USER7> That's totally flawed thinking.

The brain is of course written in JavaScript.

</comment></comment></comment></comment></comment></comment><comment><USER11> I think this should have a [1992] tag on the title

<comment><USER12> Good point. It sounds very similar to the mind/brain stuff in Snow Crash.

</comment></comment><comment><USER13> I doubt that somebody's else mind (the program) would run well on my brain (the hw) and viceversa. Mind/brain are probably more like the first computers, programmable by manually reconfiguring their hardware. So, more like FPGA than general purpose CPUs. Interestingly we're moving in the direction of blurring the difference between hw and sw. Example: all the stuff that Apple is moving in custom made processors on their phones that once was run by the main CPU.

<comment><USER14> I'm curious as to why you think this

<comment><USER13> Because even if our brains share a common general design they grow and become different. Synapses connections are created or destroyed according to our personal history, the experiences we had etc. To upload your mind into my brain would mean to rewire my brain at least down to the synapses. There could be some excess neurons left or not enough neurons for you to be there. Not to talk about possible preexisting damages that would prevent recreating the exact structures that let you be you. Plus, all the connections with the rest of the body and the influence that my other systems (endocrine, hormones, etc) could have on the way your mind is allowed to perform. In the best case we should have to find an alternate configuration of my brain that would produce your mind. That configuration would be different from the configuration of your brain. I concede that's not impossible, but it's not how we're doing it with computers and I wonder how we're going to test that. Make the two copies talk together for a while until they agree they're the same person?

Compare that with computers which are built from standard parts. Every processor of the same model is the same down to the nanometer scale, every RAM, bus, HDD or SSD are the same. Reboot with a different OS or image and you get a totally different system. Boot two equal systems (because they can be equal) with the same OS and you get two exact copies. After all we've built general purpose computers to be general purpose, didn't we?</comment></comment></comment>


Ask HN: Can you recommend a MOOC provider? - <AUTHOR> I am hoping to get some feedback from HN users who have taken online course on one or more MOOC providers.<p>I have a couple of questions:
 - What courses have you taken?
 - Did you pay for any of them?
 - How did you rate the courses? <comment><USER2> It's very popular question on HN. You can scan past posts: [https://hn.algolia.com/?dateEnd=1595455566&dateRange=custom&...](https://hn.algolia.com/?dateEnd=1595455566&dateRange=custom&dateStart=1435708800&page=0&prefix=true&query=mooc&sort=byPopularity&type=story)</comment>


Why we should stop using Grunt and Gulp - <AUTHOR> http://blog.keithcirkel.co.uk/why-we-should-stop-using-grunt/ <comment><USER2> This article seems super weird -- do people actually use Grunt/Gulp to run a single command at a time? Most uses that I've encountered are along the lines of 'we've got this huge build process involving compass, sass, uglify, ng- annotate, and 13 other things', and Grunt/Gulp allow you to do the whole thing, automatically re-running on file changes, with a single command.

<comment><USER3> No, like you said Grunt/Gulp is useful when you are automating multiple tasks that are done repeatedly. The title of this article is total click bait.

<comment><USER4> The author's argument is actually "NPM is a better build tool than Grunt or Gulp."

He followed up with an extensive tutorial on how to do complex builds with NPM [1]. The tutorial concludes with an example where NPM is used to:

* Take my JS and lint, test & compile it into 1 versioned file (with a separate sourcemap) and upload it to S3

* Compile Stylus into CSS, down to a single, versioned file (with separate sourcemap), upload it to S3

* Add watchers for testing and compilation

* Add a static file server to see my single page app in a web browser

* Add livereload for CSS and JS

* Have a task that combines all these files so I can type one command and spin up an environment

* For bonus points, open a browser window automagically pointing to my website

He accomplishes this with ~20 lines in the "script" object of package.json. The whole process is initiated with a single _npm run dev_ command. He asserts that "to do the equivalent in Grunt, it'd take a Gruntfile of a few hundred lines, plus (my finger in the air estimate) around 10 extra dependencies."

[1] [http://blog.keithcirkel.co.uk/how-to-use-npm-as-a-build- tool...](http://blog.keithcirkel.co.uk/how-to-use-npm-as-a-build-tool/)

[2] [https://github.com/keithamus/npm-scripts- example](https://github.com/keithamus/npm-scripts-example)

</comment></comment></comment><comment><USER5> I simply use Make for all my web projects, whether it's a Ruby JSON API, or a React front-end. It's reliable, pre-installed everywhere, and can wrap anything in one consistent CLI. Why have to remember whether to type _lein repl_ , _pry_ , or _rails console_ , when _make repl_ will do everytime? Ditto, _bundle install_ , _npm install_ , _lein deps_ => _make deps_. _make server_ can easily wrap whatever command launches the server, _make dev_ can easily use a filesystem watching tool to restart _make server_ on any change. And beyond that, _make_ can be used as usual to "compile" the project, ie. run whatever static analysis and preprocessing is necessary in the web world (jshint, jsx etc.).

<comment><USER6> keep in mind that make isn't going to work on Windows. For a lot of people, that's okay (including myself). Still, a ton of developers still work on Windows.

<comment><USER7> Actually make isn't even fully portable across POSIX systems.

Unless you make sure only to use these features

[http://pubs.opengroup.org/onlinepubs/009695399/utilities/mak...](http://pubs.opengroup.org/onlinepubs/009695399/utilities/make.html)

Same thing for any external tool used in the scripts.

<comment><USER8> Thankfully most of us can safely disregard all but a tiny subset of POSIX-like systems.

</comment></comment></comment></comment><comment><USER9> Regarding plugin dependencies, gulp maintains a blacklist of plugins that are not recommended for various reasons (bloat, poor design, unnecessary, etc): [https://github.com/gulpjs/plugins/blob/master/src/blackList....](https://github.com/gulpjs/plugins/blob/master/src/blackList.json) They also link to an article about why you should resist the urge to create gulp plugins on their wiki: [http://blog.overzealous.com/post/74121048393/why- you-shouldn...](http://blog.overzealous.com/post/74121048393/why-you-shouldnt- create-a-gulp-plugin-or-how-to) Additionally, they maintain a collection of examples of common use cases that tend to send people searching for plugins unnecessarily: [https://github.com/gulpjs/gulp/tree/master/docs/recipes](https://github.com/gulpjs/gulp/tree/master/docs/recipes) Other popular projects also recommend against plugins for integration into gulp, such as browserify and karma test runner. There are a number of great support packages for gulp that handle the handful of special file stream manipulations that you may need to perform (vinyl-buffer, vinyl-source-stream) and since gulp operates on node streams (object mode) many useful npm packages already apply.

</comment><comment><USER10> I found all build systems for all platforms to be a total PITA and eventually i just resort to using a shell or python script to invoke the commands i want. With this method you can very easily add user promting (do you want to build debug or release?), database reporting of build and test results, source control integration etc. Whatever i learn here can be applied and reused for new things in the future instead of knowing all the 150 flags of whatever build chain of the day.

This does not mean invoking compile manually on every file but you you invoke the _smallest possible_ build file for your intended platform just for building and absolutely nothing else. Compiling c projects without make would otherwise take hours instead of minutes.

Really, Gradle requires you to read the first 12 chapters of the manual before you can even begin doing something more advanced than running compile. Msbuild likewise, it's like a completely new programming language just that it's written in xml. Bamboo is just like imperative programming except you have to drag and drop boxes that invokes commands or plugins (yep, another plugin hell). CMake works kindof painlessly but it also requires a lot of black magic when you want to add dependencies outside of the c buildchain.

The only one that actually doesn't make you cry is 'make' because it's so simple, it's just doing one thing instead of trying to tie itself into the entire ecosystem badly. Make also has it's problems but when you start hitting those it's more of a sign that you are trying to add too much weird logic that should not be in the build script to begin with.

<comment><USER11> You cannot compare something like Maven/Gradle/SBT/Leiningen to Make.

Make doesn't do incremental building and testing, it doesn't do test coverage reports, it doesn't download the dependencies for you, it doesn't build the Javadoc documentation for you, it does not package and publish your signed artifacts on Maven Central, it does not wrap your stuff in an OS specific installer, etc, etc...

And you know, these things are standard stuff that one would like to do for every project. It's unfathomable why anybody would want to do this manual plumbing for each project with Make. You call Make "simple", I call it "dumb" and it's the reason for why people end up with aberrations of nature, such as Autotools.

> _Gradle requires you to read the first 12 chapters of the manual before you > can even begin doing something more advanced than running compile_

You're exaggerating. Compiling a project is a hello world of a couple of lines. What "advanced" usage are you talking about anyway?

<comment><USER8> > Make doesn't do incremental building

Say what? That's one of the main purposes of make.

> it doesn't do test coverage reports, it doesn't download the dependencies > for you, it doesn't build the Javadoc documentation for you, it does not > package and publish your signed artifacts on Maven Central, it does not wrap > your stuff in an OS specific installer, etc, etc...

... without the appropriate rule supported by whatever tools you prefer. Which you, once you have a workflow that works for you, can put in a file and include by reference in your makefiles going forward.

It's perfectly possible it's simpler for you to use one of the tools you list than doing so, but the nice things about relying on basic make is that very often people will want to tweak your assumptions about what "one would like to do for every project":

> And you know, these things are standard stuff that one would like to do for > every project.

Most of what you listed is stuff that I rarely want to do, and some of them are things I've never done.

> I call it "dumb" and it's the reason for why people end up with aberrations > of nature, such as Autotools.

The reason people end up with evil stuff like autotools is usually to (try) handle platform API differences, not usually to handle any of the stuff you listed. We seem to agree that Autotools is an awful mess, though.

</comment></comment></comment><comment><USER12> The author has a follow-up post that addresses a lot of things that are also popping up in the comments here: [http://blog.keithcirkel.co.uk/how-to-use- npm-as-a-build-tool...](http://blog.keithcirkel.co.uk/how-to-use-npm-as-a- build-tool/)

EDIT: Also a HN submission by the author himself: [https://news.ycombinator.com/item?id=8721929](https://news.ycombinator.com/item?id=8721929)

<comment><USER13> Looks like he just traded grunt/gulp for browserify which is also a build tool with lots and lots of configuration and plugins and I'd rather be using webpack in that category.

Just switch to webpack and you don't have to bend npm or browserify to your will either.

Relevant presentation: [http://adrianrossouw.github.io/webpack-uber- alles/](http://adrianrossouw.github.io/webpack-uber-alles/)

</comment></comment><comment><USER14> What NPM can't do is the async workflow of Grunt watch (or serve) and dynamically trigger specific (sub)processes in real-time. Turns out, this is the main way I'm using Grunt.

Also some plugins are complicated (or dynamically) to configure. His examples were very simple, he could just put it into a batchfile aswell.

<comment><USER4> The author addresses this issue directly in his follow up post [1]. He describes two ways to get watch functionality when using NPM as a build tool.

First, "most tools facilitate this option themselves - and usually are much more in tune with the intricacies of the files that should be listened for. For example Mocha has the -w option, as does Stylus, Node-Sass, Jade, Karma, and others." These options are simply invoked when the tool is called from NPM.

Second, "not all tools support this, and even when they do - you might want to compose multiple compile targets into one task which watches for changes and runs the whole set. There are tools that watch files and execute commands when files change, for example watch, onchange, dirwatch, or even nodemon."

[1] [http://blog.keithcirkel.co.uk/how-to-use-npm-as-a-build- tool...](http://blog.keithcirkel.co.uk/how-to-use-npm-as-a-build-tool/)

</comment></comment><comment><USER15> I can fully understand not liking Grunt, it's configuration is impossible to read and doesn't make a ton of sense to me. Gulp on the other hand is VERY easy to read and I haven't have any issues with my colleagues adding/editing the gulpfile.

Is running `gulp jshint` similar to running `jshint __.js`? yes but this is not a fair comparison. First of all one of those can be run in the root of the project while the other needs to be run in the right location (or have the folder in the path) so that we don 't jshint libs we didn't write. Also the author glosses over the fact that people rarely run `gulp *` and in fact will run `gulp build` (or similarly named task) that will call ALL of the other tasks you need to run. Also the author doesn't mention how wonderful `gulp watch` (or similarly named task) is for watching files for changes and then running tasks when certain files change.

I can tell you with 100% certainty that without gulp we would not be jshint- ing our code, we probably will still be using regular CSS and not SASS (SCSS- style), would still have a large gross master.js file instead of multiple js files with logic cleanly separated out, etc. Could we use make? Yes but having worked at a company that used make to build various parts of their web app I can tell you that this get really gross really fast, feel free to disagree with me but after seeing how bad it can get I won't touch make for web projects again.

Gulp (I won't argue for Grunt, I don't like it at all) is easy to write and easy to read and running the programs/tasks Gulp does for us individually would have been a non-starter. As far as npm/make goes it would have been harder to do everything we are doing and I'm not even sure `gulp watch`-type features would have been possible without escalated privileges to install other software.

</comment><comment><USER16> I am very comfortable with make, my coworkers however are not. Every preprocessor comes with a command line interface, easily accessible and understood. The only useful feature of these build tools is hot reloading. `npm gaze` even provides a somewhat working fs.watch interface which works good across platforms.

I am not sure if that justifies 70mb of additional dependencies and the "we can solve that with a grunt plugin" mentality devs get. Our Gruntfile is 440 lines long :/

<comment><USER17> I'm a novice-ish web developer with decent UNIX knowledge. For my latest Angular project which involved some CSS-preprocessing, I spent a few hours on learning the and setting up one of these tools.

Then I found out what it was actually doing, and replaced it with a small shellscript that NPM calls.

</comment></comment><comment><USER18> I don't understand the attention this is getting - sure, you don't need grunt on a lot of projects, I never start a personal project with it and only a fraction of my personal projects ever have me add it.

However for work, it saves a stupid amount of time. grunt watch - that's enough of an argument alone for me to use it. Then add it in with a less compiler and live reload, and less now is magically being compiled to css and appearing in my browser a fraction of a second after I save a file.

Sure, you could write a script to do that, but by the time you've got it working, you essentially wrote a grunt plugin, albeit one that isn't extensible and doesn't have a community of thousands of developers writing plugins and documentation for it.

</comment><comment><USER19> I think the use case of this author is very trivial. I don't see how I could use npm for a much more complicated build process with different targets (live, staging, local) or piping (coffee -> js -> min.js etc).

<comment><USER20> Not very familiar, but shouldn't those tools write to stdout?

</comment></comment><comment><USER21> I'm still waiting for the day when the JS community will discover tup [1]. Tup's greatest strength is that is can discover build dependencies automatically by file I/O monitoring in any kind of compiler or build script.

Many source formats eventually gain the capability to include other files (e.g. jade partials) or reference them in other ways (e.g. you can check the size of an image while you are generating a Sprite CSS fragments) as part of the build process and this is where Grunt or Gulp or any other naive build system will fail immediately. Specialized build systems can handle the dependency checking for particular build targets (e.g. Cmake for C++), but tup makes it extremely easy to have proper minimal re-builds with any kind of compiler.

There is also an automatic re-build mode that's triggered as soon as you save the source file in the editor and it's a joy to use in web projects.

[1] [http://gittup.org/tup/](http://gittup.org/tup/)

</comment><comment><USER22> Why don't people just use make?

<comment><USER7> Because it isn't portable, not even across UNIX/POSIX systems.

Each make has it own set of extensions outside of what POSIX requires.

Additionally, for almost every task you need to call out to external tools that also have their own set of compatibility issues across UNIX/POSIX systems.

Ideally everyone writing a Make script would need to read the POSIX standard and only use common features, but since that isn't the case, scripts break across systems.

This is what lead to autotools/autoconf creation.

<comment><USER23> > Because it isn't portable, not even across UNIX/POSIX systems.

How many realistic development choices fall in that category? Is anyone actually doing development on IRIX or UNICOS?

<comment><USER7> You left out HP-UX, Aix, Tru64, Solaris, BSD, QNX, Mac OS X, IBM i, z/VM, eT- Kernel/POSIX, LynxOS...

There are lots of POSIX systems out there.

<comment><USER23> I know people who develop (and use make) on BSD and OS X (I do), but, seriously, is any OS on our lists (OS X, (Open)Solaris-derivations and *BSD excepted) likely to be the target for the kind of software Grunt is used to develop?

<comment><USER7> Most likely not, my point was just to pass the information specially to those stuck in GNU/Linux, that it isn't as portable as many think it is.

<comment><USER23> GNU Make is probably available on all those platforms.

<comment><USER7> If it does, doesn't mean it is possible to use it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> > Of course, to get this Grunt configuration to work you'd still have to run > grunt jshint in the terminal, which as it turns out is no shorter than > jshint __.js.

That's only true if you're not using task arrays. I'm not sure what most people are doing but that's covered all my bases so I run Grunt once and done. Is installing a plugin really bloated? It's only 5 lines in the example but they provide flexibility needed since many projects have different directory structures and need different options.

I'd say that even if the plugin you wan't doesn't exist (and most do for reasonably popular tools), well, make one for yourself. There's plenty of documentation and countless examples.

It's strange that the author seemingly criticizes having to write a plugin for yourself and then goes on to suggest something like you writing your own (if you want dynamic options, etc you will be writing a wrapper around your package.json).

</comment><comment><USER25> I use Gulp to build all of our frontend dependencies and it's great. Before that I was using Grunt, and it was alright. My only complaint was how unbearably slow it was.

It's true that when you're just doing one-off things you probably don't need something like Grunt or Gulp. For doing certain stuff, it's usually a lot easier to call programs directly than trying to call it from Gulp, for example: protractor.

What I do is I put all my tasks (some of which are Gulp tasks, others which are just calling the executable directly) inside of the npm scripts section, so you end up with a really nice consistent interface.

A lot of people get too caught up in small details when really most people just wanna get their job done. Our build/dev processes are complicated enough that using Gulp alleviates a lot of pains.

</comment><comment><USER26> Being able to automate and coordinate our complex build system at work is pretty much the only thing that keeps us all sane.... thanks to Gulp.

</comment><comment><USER27> If you actually need to maintain well-used JavaScript projects, tools like Gulp are extremely important and time-saving.

Here is what the build process looks like for the faker.js project:

return gulp.src('../index.js')

      .pipe(browserified)

      .pipe(rename('faker.js'))

      .pipe(gulp.dest('build/'))

      .pipe(gulp.dest('../examples/browser/js'))

      .pipe(rename({ extname: ".min.js" }))

      .pipe(uglify())

      .pipe(gulp.dest('build/'))

      .pipe(gulp.dest('../examples/browser/js'))

      .pipe(rename('../examples/browser/js/faker.min.js'));

});

[https://github.com/Marak/faker.js/blob/master/build/gulpfile...](https://github.com/Marak/faker.js/blob/master/build/gulpfile.js)

If you ask me, Gulp provides a pretty elegant syntax. Before using Gulp we had a custom script to build the project. Using Gulp has been _much_ better.

His comments about the Gulp ecosystem not fully supporting streaming is true. The onus of implementing streaming correctly in plugins is on the plugin author. Unfortunately, there are a few plugin developers who are making bad plugins. You have to understand which libraries you are installing before blinding running npm install.

Something which is very interesting about Gulp is it's underlaying Virtual File System (Vinyl) [https://github.com/wearefractal/vinyl](https://github.com/wearefractal/vinyl) The entire ecosystem is now improving as more Gulp plugins are being decoupled into vinyl virtual file system adapters ( think sftp / http / ftp / webdav )

</comment><comment><USER28> I decided to code my own build library ([https://github.com/jeswin/fora- build](https://github.com/jeswin/fora-build)) instead of Grunt. Documentation needs to be better, so don't use this yet.

a) I wanted to use simple shell commands, like cp and mv. b) Instead of trying to learn how to use a plugin, it's often easier to just write a few lines of code. c) Wanted to use async goodness with generators. d)The important task the build library does is "watching".

Couple of example build scripts:

1) [https://github.com/jeswin/fora/blob/master/server/build- conf...](https://github.com/jeswin/fora/blob/master/server/build-config.js)

2) [https://github.com/jeswin/fora/blob/master/www- client/build-...](https://github.com/jeswin/fora/blob/master/www-client/build- config.js)

</comment><comment><USER29> In a project I worked recently we started using it because it was just "cool". It only had a jshint task. but gradually as the project evolved we added lot of tasks including minifying assets, configuring build for different API endpoints ( prod.api/dev.api ) , creating a zip file and deploying the code .

</comment><comment><USER30> No. I refuse. I use CoffeeScript and SCSS and often install components via bower. I like grunt watch+serve+livereload to drive my development server environment. I like continuous testing with karma. Grunt helps me manage all of this centrally. npm simply does not have the functionality to be a legitimate replacement.

<comment><USER31> Agreed.

</comment></comment><comment><USER32> I've found Grunt useful as I ended up using it for a large variety of tasks mostly related to building. However I also decided to stop using it but for a different reason than the article.

Grunt and Gulp kinda create a siloed set of tasks that are annoying to run in- line with the rest of the node application (different contexts). I never think I'm going to run into it until I somehow run into a situation where I want to run or re-run a specific task on an application that is already deployed. To do so now I have to install grunt in a production system and restart the application...or I simply code up my tasks into reusable bits of JavaScript that the normal application can use plus I can use npm to run them under normal conditions.

Honestly Grunt does help get things going really quickly but there are a lot of immature things about it and Gulp.

</comment><comment><USER23> I have some similar feelings about buildout ([http://www.buildout.org](http://www.buildout.org)). Both Grunt and Buildout (and Maven and so many others) can do many things beyond running commands based on their dependencies and that's what makes me uncomfortable with them: they violate the do-one-thing principle. They try to do everything, be The One Tool To Do It All.

I am myself guilty of somehow abusing make ([https://github.com/rbanffy/testable_appengine](https://github.com/rbanffy/testable_appengine)) and convince it to do things it was not really designed to do, but that's only because make is so easy (and because it's already there on every machine I touch - or shortly after I touch them).

</comment><comment><USER33> Dude's big example was running a single tool with their Grunt/Gulp setup. Who does that? I kept expecting the article to explain why using Grunt or Gulp was a bad thing when I want to do multiple things at once without running multiple scripts. What if I want my JavaScript to be hinted/linted, concatenated into one file, and minified every time I save a JavaScript file, plus tests should be run, plus I want the final JavaScript file to be saved in my build/ directory?

</comment><comment><USER34> Just skimmed through the article and wanted to point out that it's a joy to read. Clear, readable fonts, good use of spacing, great code snippets with proper syntax highlighting, bravo to the author, I wish more technical articles were going the extra mile like that.

</comment><comment><USER35> The author's npm scripts approach is great for a small scale project needing to run just jshint but if you start getting into something serious, running more than one task multiple times is a serious dent in your workflow.

<comment><USER36> I agree with that. I use npm commands for simple tasks.

And grunt/gulp for complex projects. grunt, cause it is simpler than gulp, but only when it match the projects use case.

gulp for "live" things, like livereload or quick partial builds on developement.

Startet now to use webpack too, it is comfortable (campared with grunt), it does many build-stuff that you define in grunt by your own.

Like always, use the right tools to get the job done.

It exist not THE one and only tool that solve all problems in the world.

</comment></comment><comment><USER37> This guy has obviously not built a large JS app if he thinks he can rely on NPM for building. I actually thought he would promote Make, which would have made much more sense.

</comment><comment><USER38> The title of the article is just a big click bait. Of course it's not worth it using Grunt/Gulp when you are running one task at a time.

</comment><comment><USER39> So how would I do a watch task, recompile less and minify js when files changes? These tools are there for a good reason.

</comment><comment><USER40> tl;dr: The author meant to say "Use Browserify instead of Grunt/Gulp" but then got all confused and wrote some unrelated stuff about how npm has a case..esac statement built in.

While we're at the subject, might I suggest using webpack instead of browserify? It's roughly the same, but less buggy.

<comment><USER37> How is Browserify/Webpack a replacement for Grunt/Gulp? Genuine question.

<comment><USER13> It isn't a replacement for Grunt/Gulp. It is a replacement for browserify or perhaps require.js.

It builds your javascript and css (and images!) into one or more bundles which does overlap with what people often use grunt for. In my experience it generally obviates the need for grunt because what's left to do once you've packaged and minified your js, css and images and you have your source maps, etc.?

I suppose the rest can be done with npm scripts, but simple tasks like running tests could even be done from bash or a makefile anyway.

Here's a good recent presentation on webpack: [http://adrianrossouw.github.io/webpack-uber- alles/](http://adrianrossouw.github.io/webpack-uber-alles/)

</comment></comment></comment><comment><USER41> If you want something like grunt but simple you can try the thing I made which is called 'bild'.

</comment><comment><USER42> i've used gulp for building frontend dependencies, as well as running automated tests whenever a file changes. It's been working well, with the exception that sometimes it just dies, and sometimes there's a failure and some streams dont work properly.

</comment><comment><USER41> My vote is for bash scripts. If you are in Windows then you can use babun or preferably get off Windows.

<comment><USER14> babun looks really interesting. So far I've worked with PortableGit + ConEmu which works quite fine - just updating is not the nicest experience.

</comment></comment><comment><USER43> I found it funny that people are arguing something I've never heard about.

</comment><comment><USER44> segway -> segue

</comment><comment><USER45> Good try I suppose. This didn't really click with me.

</comment><comment><USER46> As long as you're not trying to make the world's most complex build file do not feel that you need to use overly complex build tools.

A better approach is to learn the basics of writing Makefiles.

Simple tools are good.

And Make is reusable.

Make also has the benefit that you can copy-paste lines into your shell to test them. This is something that is very awkward to do with Grunt or Gulp and it makes it a lot easier to debug problems.

Generally when I say it to people they say "but if you have a complicated build process you need these tools!", and my response is "what business value did your 400+ line build process create and will it be worth the inevitable problems you will have to debug later?"

It might be unpopular advice but if you create a project with far less dependencies then there is less that can break later on.</comment>


Ask PG: What are those little blue question marks ["?"]against each comment? - <AUTHOR>

What are those little blue question marks ["?"]against each comment? <comment><USER2> Probably a browser artifact.</comment>