San Francisco Bans Cashless Stores - <AUTHOR> https://www.sfgate.com/news/article/Cashless-ban-FAQ-food-truck-amazon-go-no-cash-14373909.php <comment><USER3> I pay electronically almost everywhere, but I do recognize that cash payments are a basic human right. Going 100% cashless opens doors to all sorts of monopoly/distopia scenarios.

<comment><USER4> Not to mention privacy issues. I like using Square, but now my email gets sent around to any store I visit. Even with a regular credit card, they already get my full name from any transaction.

Plus with cash, you've made the payment and you're done. You don't have to check if the charge was correct, or if you bank account has enough money to cover it, or if the purchase will affect your credit utilization significantly.

<comment><USER5> > or if you bank account has enough money to cover it, or if the purchase will > affect your credit utilization significantly

You're still doing this with cash since you need to be certain to have sufficient funds in bills and coins before making each payment. And there is more safety in a high credit limit or checking balance than carrying large quantities of cash.

</comment></comment></comment><comment><USER6> Now can we please also stop the cops from confiscating cash if they find more than a certain amount in a person'a vehicle? People shouldn't be penalized for using legal tender.

<comment><USER7> I really don't mean to be glib, but really: Only in America.

Sure, you may have a hard time opening a bank account with half a million unexplained cash, but just confiscate somebody's life savings, especially when poor, unbanked and possibly black is a very American concept.

In any other civilized place the onus is on the authorities to prove that the money is dirty. Not the other way 'round.

<comment><USER8> The UK does it too:

[https://www.theguardian.com/society/2010/apr/25/prostitution...](https://www.theguardian.com/society/2010/apr/25/prostitution- police-ecp-gangs)

> In November 2008, 20 police officers broke down Finch's front door and > searched her house, taking £700 from her purse that she says had been put > aside to pay the mortgage. Her laptop computer, mobile phone, driving > licence and passport were also taken. No receipt was given.

> Under the Proceeds of Crime Act, the police keep 25% of any assets > confiscated from raids, the Crown Prosecution Service keeps another 25%, and > the Inland Revenue the rest.

[http://prostitutescollective.net/wp- content/uploads/2017/07/...](http://prostitutescollective.net/wp- content/uploads/2017/07/Prostitution-What-You-Need-to-Know.pdf)

> The burden of proof is reversed so people have to prove that any money they > have was not earned through "criminal activity"

<comment><USER9> OP specified civilized countries.

</comment></comment></comment></comment><comment><USER10> Usually laughing at SF regulations - but this is eminently sensible - <USER2> they had added a printed receipt as well

</comment><comment><USER11> Can we get sales tax to be included in the price on the shelf? The main reason I don't use cash is because I have having change, and sales tax always ends up with me having odd change. In Oregon, I use cash a lot more often because prices tend to avoid weird change.

Some restaurants include tax on the shelf price ($3 for hotdog instead of $2.99 + tax or whatever), and if that were more common, I might forgo credit/debit cards.

</comment><comment><USER12> I disagree that every store must accept cash. Life-impacting transactions such as grocers and transportation sure, but if a ritzy boutique or Apple store wants to make things more streamlined by only accepting card so be it. It's better as a customer.

I'm also wary of what I would consider to be ADA-styled protections for the Homeless by forcing businesses to accommodate them in increasingly fringe ways (IMO the rally cry for cash accepting stores WAS that it would hurt the homeless otherwise). Already in San Francisco the homeless are not prosecuted for petty crimes and receive free health services via frequent use of emergency care facilities. I worry the increased privileges for the homeless will attract more homeless to San Francisco, a city which has already proved it cannot alleviate the problem.

<comment><USER7> You're free to open your cashless business anywhere else, where it's legal.

Just don't count me in as a customer. I may not even necessarilly pay cash. But I try to avoid doing business with assholes.

And a _physical_ store not accepting cash is, in my book, pretty high on the asshole scale.

edited to clarify: I'm not refering to the parent as an asshole, but to physical busines' who won't accept cash.

If you still find this outlandish, downvote away.

<comment><USER13> In Amsterdam, the cashless option is for security reasons: too many violent, & armed robberies on the smallest of shops. They need to protect their employees, and since only the hardly visible police and criminals are armed: what can you do?

As much as I dislike it (you will loose me as customer too), I understand their logic.

<comment><USER7> What can I say? You definitely make a valid point.

Living in Zurich, I have to admit that such considerations don't really play a role. But yeah, there are other places where even bus drivers get robbed.

As a side note: The famed coffee shops must have quite advanced logistics, since they (at least I assume so) mostly deal in cash and present a juicy target since there must be a lot of it.

It's weird: Nowadays I visit Amsterdam for museums and culture, not for coffee shops. So what do I know? :)

<comment><USER13> > Living in Zurich

I live in Bern, so I know what heavenly security feels like.

> The famed coffee shops must have quite advanced logistics

They do, but that starts with the (ridicules) law that (permited) coffeeshops can not hold more then 500 grams of the stuff they sell at any given moment. This means there is a constant flow of new material coming in from safe houses, which are prime targets for rippers & pissed of police.

So the quite advanced logistics start there. Know where to hide your surplus, protect it, transport it and on return take the money to a safe place.

> It's weird: Nowadays I visit Amsterdam for museums and culture

That dates you. The (Amsterdam) locals recognize 3 age & target groups. <25 coffeeshops, >25 Red light district, >35 the arts ;)

</comment></comment></comment></comment></comment><comment><USER14> The problem here is that there isn't a non-private-enterprise privacy sensitive (although accessible with appropriate warrants etc) cashless money system IMO.

Cash enables so many problems in the world I'll be happy to see the end of it.

<comment><USER15> All that darned privacy! If you have nothing to hide, you have nothing to fear.

<comment><USER14> I'm saying it would need to be private, but still able to prevent money laundering, payments for sex trafficking, drug trade, weapons trade.

I'm aware such a thing doesn't exist and may never, but this would be the ideal state IMO.

<comment><USER16> > it would need to be private, but still able to prevent money laundering

That's like the big screen TV that is small enough to for in your purse.

Let's not pretend both these things are possible.

<comment><USER14> I'm an optimist that it's possible. There are systems that are private but for legitimate government requirements with sensible public oversight. Maybe not in your jurisdiction, that would vary more than just about anything.

</comment></comment></comment></comment></comment><comment><USER17> So they install one self pay cash box? Not a big deal, and probably required for ADA. Not all seniors have access to electronic payment.

<comment><USER18> Seniors or not, the most important thing to me is this: cash is issued by the government, and can be used without incurring any additional cost. Credit cards require you to sign contract with a bank, which is a private company, that makes money on every transaction. Government should never force you to sign a contract with a private entity, for any reason, so if they ever want us to go cashless, then I would expect they provide government-issued, free of charge credit/debit card for everyone first.

<comment><USER19> But the law in question isn't about the government requiring people to go cashless; it's about whether private businesses (stores) are allowed to require their customers to go cashless.</comment></comment></comment>


Side channel attacks against ECDSA/EdDSA signature generation in smart cards - <AUTHOR> https://minerva.crocs.fi.muni.cz/ <comment><USER2> It would be nice if these reports also listed implementations they analyzed carefully and concluded were not likely vulnerable.

In this case, they do show openssl-- but it's burred under a generic titled click through. I would guess they also found other apparently secure implementations, but none are listed.

Providing this information would have several benefits:

(1) People could look and the correct implementations and learn what choices they made which helped them avoid the issue.

(2) The incentive for making secure implementations would be increased.

(3) Effort could be conserved in identifying already correct implementations. In particular, correct implementations get asked over and over again if they're vulnerable ... and it can be a bit exposed-feeling to give an emphatic 'no' without the benefit of the assistance of the researchers and their test setup.

Also, if an error was made in identifying a correct implementation, then someone writing another paper refuting the that sub-result would likely have an easier time getting published than someone who just did the same attack against more implementations-- increasing the incentive to continue this line of research.

Anyone know why they bother listing github "stars" on the vulnerable software list?

<comment><USER3> We considered listing implementations we tested and deemed secure, however this is really hard to do in practice. See also the answer in the second question in the Q&A.

Most libraries have several implementations of the scalar multiplication algorithm, which they choose from dynamically, based on build options, the chosen curve, the platform, the cryptosystem/operation being performed, the current phase of the moon, etc..

We tested the libraries listed here:

[https://github.com/crocs- muni/ECTester/blob/master/docs/LIBS...](https://github.com/crocs- muni/ECTester/blob/master/docs/LIBS.md)

as we had those implemented and so testing meant just running our tools and analyzing the results. However, even this could have missed stuff, as at first we did miss the Java vulnerability, as we focused on prime field curves and did not test binary field ones. We then analyzed most other cryptographic libraries with ECC support one could think of, but only via source code analysis.

Regarding the stars, we put those in to give some context of why we listed those particular vulnerable implementations on GitHub. We searched through GitHub repositories mentioning ECDSA, ordered by their stars as a measure of popularity and analyzed the source code of their scalar multiplication for the vulnerability. One could choose just random hobby ECDSA implementations and list them as likely vulnerable, these are just a few that are worthy of listing because of their popularity.

Edit: We have added the list of tested implementations deemed secure [https://minerva.crocs.fi.muni.cz/#secure- impl](https://minerva.crocs.fi.muni.cz/#secure-impl).

<comment><USER2> Thanks for the clarification!

Even a "we tested this specific function, and didn't find an issue" would usually be helpful.

The situation I've faced as an implementer is that people show up asking about a paper (e.g. [https://github.com/bitcoin- core/secp256k1/issues/238](https://github.com/bitcoin- core/secp256k1/issues/238) ) I read the paper, it discusses a risk vector we were aware of and believe we avoided and I find myself somewhat surprised at the list of vulnerable implementations. This makes me worry that I didn't actually understand the issue-- maybe the countermeasures we had weren't really good enough-- and uncomfortable giving the really strong "not vulnerable" that the requester was looking for.

This is especially the case because the results in papers like yours aren't against toy implementations, but in implementations that I know are written by extremely competent persons.

The end result is usually that I go and read the changes that fix the vulnerability, if possible-- sometimes they're made somewhat surreptitiously and hard to disentangle from the other changes--; and convince myself that it really was the issue I understood it to be... and rest back on my prior constant time testing results and our design countermeasures to be confident that no similar issue exists.

> One could choose just random hobby ECDSA implementations and list them as > likely vulnerable, these are just a few that are worthy of listing because > of their popularity.

Fair enough. I think actually searching to see how many other projects have copied the vulnerable code might be a better proxy than stars, since there is no particular reason to click the star button if you're using a piece of code. Often end users will pick up vulnerable code via a popular program that links or embed it, and the bulk of users never directly see the repo for the crypto library.

For years searching for "python eddsa" yielded an extremely vulnerable first result (including setting K to H(private key), using double and add, non- constant time infinity handling, etc.) that by all appearances was some random hobby project but because it was the first google hit, it actually got used in a fair number of places.</comment></comment></comment>


Ask:  How do you actually launch a beta? - <AUTHOR>

So recently we finished up our platform (finished in the sense that we locked the features down and cleaned up all the loose ends, as opposed to 'truly' finished).
We have a business plan, fantasies about investors, dreams of adding and doing 1000x more than we've already done and conquering the world, bla bla bla.
So how do you "launch" a beta, what do you to do interest the relevant startup blogs and generate some publicity and attention for your freshly baked business?  Or do you just skip that and quietly launch while you go fund-hunting?  What do people here suggest? <comment><USER2> _So how do you "launch" a beta, what do you to do interest the relevant startup blogs and generate some publicity and attention for your freshly baked business?_

I don't know why you're targeting startup blogs unless you are intending on selling your services to startups (which has its own problems, chiefly that a million other people are chasing after the same $600 dollars in their bank account). Michael Arrington will have, to a close approximation, the entire population of Silicon Valley send him an email today. Your odds of getting even fleeting attraction are low. Should you get fleeting attraction, you'll find your site crushed under a wave of looky-loos who will make disparaging comments on everything they can before abandoning it.

By comparison, the people you made your application for might actually, you know, want to _use_ it. Why don't you target their blogs? Speak to the people you know in their community? (You do know people in their community, right? If not, turn off the IDE and go meet some people in their community.)

I'd also start your SEO efforts, if you haven't already. (If you haven't, turn off the IDE and...) That is a deep subject when starting from nothing, but the short version is think of ways that linking to you will improve the lives of people who don't want to buy your software, then, tell them that.

Oh, and this comment is going to sound like a broken record from me, but launch is not a one-time event. 99.9999999% of people who see your site will not see it on launch day. For someone who comes in on day 4 or day 40 or day 4,000, your site JUST launched. Optimize for their experience, not Michael Arrington's.

</comment><comment><USER3> For mine I just asked on the relevant subreddits to come check it out and give feedback. Got my first 100 users that way. + they helped me design the site: <http://styleguidance.com>

As far as bloggers, unless you invented Google(or worked there) or have millions in funding, it's probably not worth bothering since you won't get much coverage(from the bigger sites). And the type you'll get will most likely get you a few hundred visitors. i.e. a 50,000/mo blog, sent me 5 people.

And the traffic you get from doing a "launch" is usually garbage anyways. And will evaporate within a few days. Unless of course your core users are entrepeneurs who read tech blogs. Then you might have some luck.

Basically a launch doesn't really get you anywhere, you should see "launch" days, as a way for you to declare for yourself that you are open for business. So that you can get serious about marketing.

i.e. for my launch date, we got 5 stories, and a total of 668 visits. That was November 18th, and last month we had 35K visits, Page Rank 5, Sub 100K Alexa Rank, Sub 20K U.S. Alexa Rank, 2K questions(content), 1550 twitter followers, 960 Facebook Fans.

So don't worry about planning for a spectacular launch, just do it, and then get to work.

<comment><USER4> I wouldn't mind reading about how you "got to work" after the launch and managed to build that traffic in about a month. Care to go into more detail, either here or on your blog?

<comment><USER3> mostly promotions and SEO.

I'll see if I can write something up later, since it takes a while

</comment></comment></comment><comment><USER5> I wrote down a few tips I'd collected a while back: [http://david.weebly.com/1/post/2008/02/press-for- startups-10...](http://david.weebly.com/1/post/2008/02/press-for- startups-10-tips.html)

The landscape may have changed on the embargo bit (TechCrunch claims not to respect them), or not -- they still seem to respect ours and most startups I know.

</comment><comment><USER6> do what you did here, but provide a link;)

Ideas:

1\. put beta in your logo and make submit feedback forms as prominent as possible without being annoying

2\. maybe include a countdown in days until official launch on the site. reinforce in peoples minds that they will want to come back later or keep an eye on the site.

3\. Since you want it to be a 'beta launch', just launch it now. Start pulling users in, they will be able to help you make a bigger media bomb for when you decide to 'launch launch'. hit up all the aggregators and even if you dont get a big impact you can hit them all up again when you decide its no longer beta with a 'launch' story

</comment><comment><USER7> I feel like you should hand select your first 25-50 users, a user base that size will give you plenty of feedback.

Once you've done that, I suppose it's time to get more serious about acquiring users.

<comment><AUTHOR> Yeah we've been 9 months in development and ~6 months in private beta, got a few dozen users who've really helped shape the direction of the system and turned it into something amazing.

It's really the "what happens next" bit that I'm not sure about.

<comment><USER8> I'm not a fan of stealth or private beta. I think the best plan is to not have a beta launch.... just start organically collecting users.

No one of significance will notice your software sucks, but when your software is good, investors, customers, and partners will notice.

<comment><AUTHOR> It hasn't really been "stealth", it's been "controlled", it's an analytics service (not for websites) and we wanted to be sure it worked + not get raped by traffic we couldn't afford to scale for during development.

<comment><USER8> I think your fears are unwarranted. Every entrepreneur seems to have these happy fears. Oh no, what if my site crashes under terrific load! What if super-VC Paul Schmaltz sees a bug in my website!

Even if you get enough traffic to knock down your server, that will just be a boon.

And it's better to get your software out there half-working and get feedback than to build something nice and have to rebuild it after you find out the average user wants something else.

</comment></comment></comment></comment></comment><comment><USER9> re: launching

I soft launched <http://newsley.com> in November via comment here on Hacker news. I wasn't interested in a big splash, but I was really interested in getting a couple of beta users that could give me some good feedback, and that's what I got. It's a good crowd to get some feedback on what's broken and what works.

Since then, I've posted a few more links here in the comments, and prakash posted a link in one of his comments on a thread regarding economic social news sites (thanks). I've also posted a link asking for beta users on Craigslist San Jose, and I've posted a couple links in economic blog comments where appropriate.

Traffic stats so far for 2 1/2 months: 1200 uniques, and close to 5000 page views.

My future marketing plans include buying some more beta users off of Mechanical Turk at $0.05 a pop, and using a $100 credit I have with Adsense. I have a hunch, I'm going to get a lot better traffic with Mechanical Turk than Adsense.

re: funding

The scuttle butt in the Valley is that funding is slowly starting to flow again, but it's still pretty hard to come by unless you have traction. Traction == customers signing up and loving your product and possibly revenue.

I'd focus on making your users really really happy, and slowly build up a customer base from that rather than go for a big splash and hope that things take off.

</comment><comment><USER10> There are some great comments here. I don't need to repeat what's been said, but would like to add that you should not go for a big launch yet. Instead, invite some people who fit the definition of your core audience and ask them to test the site out. Use services like uservoice.com and survey.io to collect user feedback and make sure your product has a solid market fit. Doing this will make sure you don't miss the mark at launch, while at the same time providing some key insight for messaging to be used with a more prominent launch. Good luck!

</comment><comment><USER11> I think you should ask yourself if you really need funding in the first place.

<comment><AUTHOR> The only way we could go it alone would be with no free trial, but that's a pretty tasteless option since we're selling something that's never really existed before to a market that's going to want to play with it before they pay for it.

It's an analytics service for casual / social games and in some cases we're talking games that get millions of plays (we've got several like that in our system already) which can translate into tens of millions of events being logged, and while we've spent tons of time making everything as streamlined and cost-efficient as we can there are unavoidable expenses that might predate our ability to pay for them by ourselves.

<comment><USER12> Hi Ben,

I appreciate your concern about scaling your service but I think you should consider a fremium business model that allows you to accommodate more free users at lower cost.

Instead of logging tens of millions of events for free users, you could log just a subset, which will allow you to use far fewer servers whilst allowing free users to "evaluate the usefulness of your new service".

It will also make sure that the future of your startup is not wholly dependent on external investors.

We've done something similar with Trafficspaces. We run our service off Amazon's cloud system, which gives us a lot of flexibility.

If you need assistance on how to structure your freemium model to make sense, send me an email at niyi [at] trafficspaces [dot] com.</comment></comment></comment>


Hi, I'm a web-dev from the year 2005, and I am full of shame - <AUTHOR> https://www.reddit.com/r/webdev/comments/3jdidp/hi_im_a_webdev_from_the_year_2005_and_i_am_full/

<comment><USER2> Luckily I started doing web develpoment in 2007, when PHP had classes.

I looked into Rails before creating my first web-app.

But many of my fellow students already worked in the field for years and all of them had build their own CMS in PHP and they were like it is described in the Reddit post.</comment>


Andy Rooney, Force for Technological Innovation - <AUTHOR> http://www.theatlantic.com/technology/archive/2011/09/andy-rooney-force-for-technological-innovation/245855/#.ToOikzUWueo.hackernews <comment><USER2> I couldn't agree with this article more. We need people like Andy Rooney to remind us that technology is supposed to serve us, not the other way around.

For some reason, this article reminded me of one of my favorite Douglas Adams quotes:

"Technology is a word that describes something that doesn't work yet."

</comment><comment><USER3> Andy Rooney sometimes offers solutions.

</comment><comment><USER4> I hated the article and though it was stupid until I read the last paragraph. I'm the pedantic engineer who'll tell you that if you don't like "planned obsolesce" (angry words for advancement of technology?) , you'd still be working with computers the size of rooms. If you don't like passwords, use keypass, or good luck doing your banking on a typewriter. AAAnd then, the author makes a BIG BIG stretch tying it in with Jobs... come on, I love apple, but the Steve Jobs dick sucking has got to stop. He's not a god, and he didn't do it all by himself. I for one would love to go all "Lewis Black" on both Rooney, and the clown that wrote that article.

<comment><USER3> People who don't like planned obsolescence when it comes to computing don't understand Moore's law. On the other hand, there is planned obsolescence in stuff like tennis shoes that makes less sense to me. I have to buy new tennis shoes every few months. And why do they call them tennis shoes? Most people these days don't play tennis. My feet stopped growing years ago. I have an uncle whose shoes seem to last forever. He's 65, I'm 28 and most of his shoes are older than me!</comment></comment>


Why enterprise agile teams fail - <AUTHOR> https://medium.com/startup-patterns/why-enterprise-agile-teams-fail-4ae64f7852d6 <comment><USER2> Hah, every one of these applies to my current project. That can't be good.</comment>


Sisu - <AUTHOR> http://en.wikipedia.org/wiki/Sisu

<comment><USER2> As a Finn I see wikipedia article very well written and balanced even though authors are not born in Finland. Just few remarks: -To really understand why Sisu is in Finns heritage and DNA you should study longer perspective (hundreds of years), the conditions like 1)climate, what it takes to settle into country totally covered big trees and soil full of broken stones after Ice Age broke the mountains and and very short growing season, bears, wolves etc. 2)events in the long history with Wikings, Swedes, Russians. -More recently Winter War (linked in wiki article) demonstrated in population level what can happend when whole nation has had enough, unites and hits into 'Sisu mode' where nothing can come in your way. -As article and references points out Sisu, even trationally found amongst Finns, is a quality of many populations. I can recognize reminders of it in old stories of first white people settling to North America, exploring wagon routes to west or exploring Klondike. Even more recent climpses can be seen in todays light reality series like 'extreme makeover', 'undercover boss' where good hearted people are working 2-3 jobs just to provide their family and kids.

Should we all then try to reach 'Sisu mode', my answer is no or only when really needed. As in that Wiki article famous Finnish rock singer compares Sisu and adrenaline, I partly agree with him. Adrenaline is not Sisu, but probably when you are in 'Sisu mode' adrenaline is pumping full. That means extra cortisol in your body (also stomach), which is not healthy in longer doses as we know.

<comment><AUTHOR> Thank you for the thoughtful response!

So Sisu is born out of necessity, more so than a quality that should be emulated in everyday life?</comment></comment>


Freelancer hourly rates – a crowdsourced spreadsheet - <AUTHOR> https://docs.google.com/forms/d/153HRp3cKx2wMWckCOGGJIttLDX2Z6K5uZpWRTphoEn0/viewform <comment><AUTHOR> It's hard to know what you can/should charge as a freelancer based on your experience, your or your client's location etc. and it's kind of tricky asking other people in person how much they charge, so I thought making an anonymous crowd-sourced spreadsheet where everyone can enter data would be a nice way to help people make better decisions. So, let's gather the data :)

Inspired by the salaries post that made it to the front page earlier today:

[https://news.ycombinator.com/item?id=11331223](https://news.ycombinator.com/item?id=11331223)</comment>


Ex-Facebookers launch MemSQL (YC W11) to make your database fly - <AUTHOR> http://gigaom.com/cloud/ex-facebookers-launch-memsql-to-make-your-database-fly/ <comment><USER2> I've seen a lot of these new SQL databases, and they all seem to compare themselves to MySQL. That seems like a particularly easy target, since MySQL's main strength is speed, and it's a fundamentally old-school (ie slow) design which has sacrificed everything else to get half-fast. What I'd like to know is how any of these compare in features and reliability to the featureful, reliable databases like Oracle and Postgres.

(For specific examples that I've run into recently: does it have geo-spatial extensions, and does it crash and burn and corrupt all its data if a malloc() fails)

<comment><USER3> It still uses a transaction log, but seems to make snapshots of the logs at a period of time to create compressed snapshots of the data itself.

You can turn off durability, but then you risk losing _everything_.

For features... forget about geo-spatial extensions - they can only do read- committed isolation level... but as they only allow for one SQL statement per transaction I suppose this might not be such a big concern.

If you were using this for something like a session management database, or something where durability is not so important then it's probably fine. Not sure I'd use it for anything that relies heavily on transaction management features.

I see other limitations, like it cannot support CHANGE COLUMN, and it can't do joins on more than 2 tables. Actually, it doesn't look like it can do FULL OUTER or RIGHT OUTER joins, either. :(

<comment><USER4> Memsql is a database that does some things incredibly well: deliver on high throughput for on small transactions and some things not as well (surface area).

Of course a new product will have certain limitation which will be removed as the product matures.

<comment><USER3> No probs, like I've said elsewhere, not attacking the product. Looks very interesting! I guess I'm trying to work out what sort of market you are trying to target here.

</comment></comment></comment></comment><comment><USER5> This company was probably an extremely easy investment decision:

1) Facebookers: Check

2) Data Scaling experience: Check

3) In-Memory with SQL semantics: Check

4) New-York based software that can be sold to quant funds: Check

I'm excited. It's downloading now.

<comment><USER6> Is it just me or does this entire product smell like it was designed for the sole purpose of extracting money from less than tech-savvy investors and clueless institutions?

The bullshit-bingo-lingo on their homepage is mindnumbing.

Meanwhile their actual software seems rather underwhelming, bordering on SnakeOil.

<comment><USER5> If you've ever tried to use SQL on a large, but fittable-in-memory dataset on existing row databases, then you would not be underwhelmed. Existing non- finance-industry solutions suck for things like mid-size trading queries, or (in coinlab's case) work setups that require periodic, frequent table scans.

You can buy something like kdb, but that costs $70k a year and requires that your engineers learn some extremely new semantics if they're only used to SQL and (choose any popular language here, Python to C++).

<comment><USER6> So, MemSQL is a ColumnStore now? The docs didn't make that clear for me.

Anyway, why is there not a single benchmark available to support the sales- pitch?

(In your favor I'll just pretend you didn't mention kdb here...)

<comment><USER7> _In your favor I'll just pretend you didn't mention kdb here_

Please explain. What's bad about kdb, besides how nonstandard it is?

<comment><USER6> There is nothing bad about it (other than the price). It just seems an outrageous claim that MemSQL, with all its constraints, is even in the same game.

At the least they should come up with some seriously impressive benchmarks before dropping names like that.

</comment></comment></comment></comment></comment></comment><comment><USER6> Is this a joke?

Data must fit in RAM, no joins over >2 tables, no transactions, no builtin support for clustering/sharding/horizontal scaling whatsoever.

What is the advantage over memory-tables, MySQL on a ramdisk or something purpose-built (redis)?

<comment> old-gregg On the other hand, if your data fits in RAM and you don't need to join more than two tables and you don't need clustering/sharding whatsoever and you need the full power of SQL, what would you use?

 _> ..something purpose-built (redis)?_

Errr maybe "features" like GROUP BY with HAVING? I think you're trolling, Mr Moe.

<comment><USER6> _trolling_

Says the guy who resorts to selective quoting to make a point? You may want to review my original comment where I mention two other options.

<comment><USER8> nope. you're definitely a troll

</comment></comment></comment></comment><comment><USER9> MemSQL does not yet support JOINs on more than 2 tables. [1]

1\. <http://developers.memsql.com/docs/1b/sql/join.html>

<comment><USER3> Nor transactions with more than one statement. And only read committed isolation level. [1]

1\. <http://developers.memsql.com/docs/1b/isolationlevel.html>

<comment><USER9> This seems really confusing and like it might be a maintenance nightmare <http://developers.memsql.com/docs/1b/memory.html>

Do you need to ensure that all of your data fits in memory? It's easily possible to have ten gigs in your db but only need a small amount of it to be hot in ram. Does it take a really long time to restart if it has to warm all the data?

<comment><USER3> Good questions - no idea! Can one of the developers of MemSQL clarify this? How long does it take to startup a large database of several 100 GB?

<comment><USER4> Recovery on the system restart is going at the speed of hard disk.

<comment><USER3> Can you pin how much data from a table can be placed into memory, or does the whole table need to be placed in memory? I can see settings that limit the transaction log memory usage, but no way of reducing the actual amount of data in-memory.

<comment><USER4> The whole table has to fit in memory. RAM is getting very cheap, you can buy 1Tb for 12K today.

<comment><USER10> Recovery on the system restart is going at the "sequential scan" speed of hard disk.

<comment><USER11> The "sequential scan" speed of a generic SSD is pretty good. It's even better on something like FusionIO.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> How it compares to VoltDB, which used similar approach and already "combines the proven power of relational processing with blazing speed, linear scalability and uncompromising fault tolerance" (according to VoldDB website) ?

<comment><USER4> There are few differences with VoltDB. 1\. It's much easier to use (MySQL compatibility, ad-hoc sql no java dependency) 2\. It doesn't have any issues with data skews. We are using lockfree skiplists vs b-trees partitioned by core. 3\. I believe we are faster on a single box, however this claim should obviously be verified by a third party.

<comment><USER13> Congrats to the MemSQL team. It's always validating to see more entrants into the space. The comparison between the two systems is fascinating; the approach taking is really different than VoltDB, but the systems share some similar choices as well.

As for your comments:

1\. Ad-Hoc SQL in VoltDB is a current area of focus in VoltDB development. We use similar compilation and expect them to be no slower than our stored procedures in the 2012 timeframe. Starting with our release next week, we'll also support multiple SQL statements in a serialized/ACID ad-hoc transaction.

2\. On a single-node (or a several replicated nodes), VoltDB doesn't really have many issues with data skews. Rebalancing a distributed system is also in development, but hasn't turned out to be much of an issue with our production customers.

3\. Faster at what? Single statement non-durable transactions? That's probably true for simple SQL operations for the time being. It gets murkier once you consider VoltDB features like materialized views that avoid table-scans altogether. I am also curious how durability affects performance though.

But I'm really interested to revisit this comparison once MemSQL supports real transactions and replication/sharding. For the time being, most of the VoltDB use cases we target won't run on it.

</comment></comment></comment><comment><USER14> There's another in memory mysql replacement whose name escapes me right now. How are they doing?

Ycombinator seems to have backed a few of these next-gen databases. It will be interesting to see who wins.

EDIT: Rethinkdb. But it looks liked they've dumped their mysql engine and gone to a pure key-value store.

<comment><USER15> Xeround looks really interesting (<http://xeround.com/>). Seems to do everything in RAM and takes care of any replication / backup & scailing for you. Looks like it would get expensive with large amounts of data though... anyone using this in production?

<comment><USER4> One of the things that separate us from Xeround is the fact that you can see the benefit of super high throughput on any linux box, including your laptop. You can download the software and use it by yourself.

Xeround is a sas model, where you can't get exact same experience as on your local machine.

</comment></comment></comment><comment><USER16> I'm obviously missing something. Is SQL really the bottleneck for SQL performance? I'm not sure how much compiling down to C++ will help.

Is there more to this than the article suggests?

<comment><USER17> I think its that its an in memory database, optimised for memory as opposed to disk. The SQL to C++ seems a bit of a confusion to me, I guess it means it has a JIT SQL compiler to optimise the query to native opcodes. Meh. But the in memory and mysql wire compatibility are big wins.

<comment><USER3> I don't believe this is the case - it's not an in-memory database.

Even if it is (and I can't see anything on their developer website) then if it's ACID compliant, like they say, then it will have to be writing to the disk at some point - at the very least it will need a transaction log. Otherwise, it's not really usable for anything you need to persist to long term storage!

<comment><USER17> Yes, its not clear on their site, but the gigaom article states: "As its name implies, MemSQL achieves its fast performance in part by keeping data in memory".

Yes, it does write to disk (append only logging I think) but my point was, that if you are keeping ALL your data in memory, you can optimise the storage for fast queries, as opposed to a hybrid / paged memory and disk system.

<comment><USER3> Oops, sorry - I'm wrong. Actually, according to their documentation:

 _"By default, MemSQL runs with full durability enabled: transactions are committed to disk as a log and later compressed into full-database snapshots. The snapshot and log files are stored in the datadir directory configured in memsql.cnf. When MemSQL is restarted, it will recover itself into the state it was in before the shutdown, by reading the snapshot and log files in datadir"_ [1]

I missed that piece of documentation on their website. I think they could do better to explain better the advantages and how their technology works. Their product overview doesn't really tell you much of anything, except that they have an enhanced query parser. [2]

1\. <http://developers.memsql.com/docs/1b/durability.html>

2\. <http://developers.memsql.com/>

</comment></comment></comment></comment></comment><comment><USER18> Why should I use this over MySQL Cluster?

MySQL Cluster is lock-free, distributed, HA, and has better performances:

[http://mikaelronstrom.blogspot.com/2012/05/mysql- cluster-72-...](http://mikaelronstrom.blogspot.com/2012/05/mysql- cluster-72-achieves-43bn-reads.html)

[http://mikaelronstrom.blogspot.com/2012/05/mysql- cluster-727...](http://mikaelronstrom.blogspot.com/2012/05/mysql- cluster-727-achieves-1bn-update.html)

And MySQL Cluster has been used in mission critical apps for years.

What does MemSQL give me that MySQL Cluster doesn't?

</comment><comment><USER3> Question - how well does the query parser handle stale queries? SQL Server for the longest time had issues with plan stability in that the plan became _too_ stable. When the data distribution changed dramatically, the queries didn't age out of the cache and the queries would do such things as use the wrong index, or not work out the correct cardinality of a table and then use an index where really a full table scan would have been better... and so on.

How does the database handle this sort of thing?

<comment><USER4> Right now you can handle this with query hints. The plans are stable, but they are attached to the query text. When you throw a hint in there memsql generates a new plan since the query text changes.

<comment><USER3> To clarify - if you add the query hint, run the query, then remove the query hint then has the original query's plan expired?

 _Edit:_ I know I'm asking a lot about the plan cache, but as it's a core selling point, then I'd like to know how data distribution changes will affect performance. Stale queries will potentially adversley affect performance under certain circumstances.

<comment><USER10> No, original query plan will only expire if indexes are dropped or new ones are created.

</comment></comment></comment></comment><comment><USER19> It looks like this is a fork of MySQL. Did they actually pay Oracle for a proprietary license or is there a source release hidden on the website?

<comment><AUTHOR> yes, we have commercial licensing agreements in place.

</comment></comment><comment><USER17> Looks useful. Drop in mysql compatibility is a huge plus for many projects that are tied to mysql (for whatever reasons).

Does anyone know if there are any plans for having MongoDB style replica sets (e.g. sharded and replicated databases in a cluster)?

Also, it would be great if it supported the native mysql replication, so you could have MemSQL replicas of a master mysql DB.

<comment><USER20> Sharded/replicated MemSQL is in the works. And yep, the replication will be compatible with MySQL replication to enable grouping MemSQL and MySQL nodes.

<comment><USER17> Excellent! Good work!

Side note: IMO, If you want to completely dominate this space, make it super easy to add new nodes and replicate the existing DB without having to take a snapshot from the master.

<comment><USER4> Thanks! This is absolutely on our minds.

</comment></comment></comment></comment><comment><USER21> Looks promising. Love how it inter-operates with MySQL driven apps.

I should be able to try it for one of my apps over this weekend!

</comment><comment><USER22> Congrats guys on the launch! Looking forward to giving it a spin.

</comment><comment><USER23> Looks like they're using jQuery Knobs: <http://anthonyterrien.com/knob/>

<comment><USER4> Yes, for the workload simulator :)

</comment></comment><comment><USER24> Congratulations, Eric!

</comment><comment><USER25> Why not just use objects in your favourite shitty OOP language as usual and take regular snapshots of the data in memory and save them to disk as rollback points instead? Bam! Nothing new to implement in the application. Bam! Lightening fast access and write times. Bam! Data persistence.

Bam!

</comment><comment><USER26> Wow, HN is harsh. This is probably a really solid product that solves a specific problem and you all nit-pick at it's trade-offs and poo-poo it.

<comment><USER27> HN is not harsh. HN is one of the main marketing channels for YC-funded projects such as this.

<comment><USER26> Sorry some commenters on HN are harsh

</comment></comment></comment><comment><USER28> Congrats!</comment>


Gently Advise HN: Flexport hiring posts need this chance to go meta - <AUTHOR> Either all the Flexport hiring posts that hit HN are working great, they are hiring like gangbusters, and all is rosy (if this is true, write and share [another? date-less?] blog post about how great this process is on their blog!)...
Otherwise they should probably stop posting hiring posts (especially abusing to post links to random articles about Flexport instead of actual job listings?!!)
Keep up the good work rogue squadron! <comment><USER2> You could contact Flexport, and let them know that someone is spamming the HN boards with random "hiring" post that point to news articles about Flexport.

If you politely point out that it looks like another company is trying to sabotage their hiring by giving them a bad reputation, I would bet that someone would take notice.

If they are a legitimate company, that is... It is always possible that they don't give a damn about their reputation because the company does not actually care about their tech hires. In which case, anyone who isn't desperate and has a little sense would know to stay away from Flexport at all costs.

</comment><comment><USER3> hey guys, Ryan Petersen here, CEO of Flexport. Sincerely appreciate this feedback. I'll make sure I always link the posts to our careers page going forward, and will try to cut back on the hyperbole. Apologies just trying to stand out in a crowded space and it's easy to get carried away.

I was lucky this time that a member of the community cared enough to call this thread to my attention.

Email me anytime if you have more feedback ryan@flexport

<comment><USER4> Thanks for the calm and reasoned response. I don't have a dog in this fight but it's nice to see this instead of reactive combativeness.

</comment></comment><comment><USER5> I gently agree with the "links to random articles about Flexport instead of actual job listings" part. Otherwise it feels like HN is experimenting with running ads.

<comment><USER6> Pretty sure that isn't the case, since they always put something like "Join our Team" in the post title - looks like whatever approval process HN has they are gaming

</comment></comment><comment><USER6> Additionally to not being job posts, the titles are heavily editorialized, someone that would break the rule for a normal post.

</comment><comment><USER7> Might be worth talking with the moderators regarding the concern.</comment>


How many friends do you grown ups have? - <AUTHOR> http://www.reddit.com/r/RedditForGrownups/comments/37nwzf/how_many_friends_do_you_grown_ups_have/

<comment><AUTHOR> The comments on Reddit are depressing and relatable. There's definitely a selection bias though.</comment>


Storia – Airbnb for storage - <AUTHOR> https://www.storiaus.com/ <comment><USER2> Very clever idea! Nice way to help people out! Storage for one person, a little extra income for another.</comment>


Bill Gates releases mosquitoes into audience - <AUTHOR> http://www.msnbc.msn.com/id/29022220/ <comment><USER2> Already posted:

Here: <http://news.ycombinator.com/item?id=466613>

Here: <http://news.ycombinator.com/item?id=466533>

</comment><comment><USER3> You know, "The Road Ahead" I think I would rank up there with "The Selfish Gene" as being among the most influential books in my life. So I have huge respect for Mr. Gates. But I wonder if he might be going a little too far with this foundation thing. Releasing live mosquitos into an audience? Sort of up there with another talented person I could mention jumping on Oprah's couch. Sad, really.</comment>


Design Thinking- Ideation as a Skill - <AUTHOR> https://adolos.substack.com/p/design-thinking-ideation-as-a-skill <comment><USER2> Is it that creativity does not come naturally for people, or that it is striped from people through schooling, and lived dedicated to employment where the boss has a monopoly on it.</comment>


American Express Says It Will Buy Revolution Money  - <AUTHOR> http://www.bloomberg.com/apps/news?pid=20601087&sid=auBvYLlL7kXQ&pos=6 <comment><USER2> Either AmEx has an incredibly long-term view here, or Revolution Money is toast.

Rev's whole business model was this: do what the major legacy credit card companies do, but cheaper. This is achievable because a business that used to require massive proprietary machinery can now run on cheap commodity PCs and networks. They'd lure retailers with transaction cost savings, and crush the legacy credit card companies by undercutting their profit margins.

For a big retailer like Whole Foods, these transaction costs are a direct cut of their profit. AmEx takes around 5%, Visa/MC take 2%, Revolution takes 0.5%. If you can run the business cheaply enough, you can get a lot of retailer market share by offering to cut these costs, and maybe even divert some of those savings into features that make your card better for consumers.

So there are three reasons I can see for this deal:

1\. Hastening the failure of the Revolution card means AmEx can sustain its absurd transaction costs a little longer.

2\. AmEx is thinking ahead many many years, and thinks that the Revolution approach will get them some new markets, and are willing to accept the risk that they'll be cannibalizing some of their existing retailer/consumer market.

3\. AmEx thinks it could save a ton of money by adopting more current technology, and wants the folks who built Revolution to help them do it.

These are listed in order of decreasing likelihood. I would bet that the Revolution Card's growth slows significantly, very soon. I wonder also if there were other problems impeding the company's growth, and pushing the investors to sell now rather than hold out until the market really was more disrupted.

On the bright side for startup folks and consumers, this deal suggests that now is a great time to start another credit card company based on low transaction costs. Revolution already figured out a lot of the hitches, and retailers ought to be suspicious now that they're owned by the industry's biggest usurer. The industry is even riper for disruption now than when Revolution started, and hardly disrupted at all.

<comment><USER3> In the UK there are two key factors:

\- Consumers pick the cards.

\- Retailers are (in general) barred from charging different prices for cash vs card payments.

Therefore it makes sense for any customer to pick a card with a high reward/cash back scheme (1% back on everything you buy is nice) as you are essentially taking a share of the profit your card issuer is making on each transaction, at the expense of the retailer and cash buyers.

The retailer has essentially no power to avoid this, as long as the card issuer's take remains below the point at which it would be unprofitable to service their pool of customers.

<comment><USER4> "The retailer has essentially no power to avoid this, as long as the card issuer's take remains below the point at which it would be unprofitable to service their pool of customers."

AMEX is really on the brink of this point currently in the US. A lot of places simply do not accept AMEX and a lot of AMEX customers carry different cards because of that. Since merchants know that the average AMEX customer usually carries another card as well they are often ok with not accepting AMEX.

Currently the main selling point of AMEX are rich people that swear by their black amex card and are really annoyed when somebody makes them take out their lowly visa. So places that cater to rich people or hope to cater to rich people usually try to take the hit and accept AMEX.

</comment></comment></comment><comment><USER5> As the existing player, you have to kill this stuff off before it starts cutting into your profit margin. My guess is that we won't be seeing AmEx- branded cards with lower processing fees anytime soon.

<comment><USER6> That's not necessarily true. AmEx has always been a weird creditcard company. Traditionally, unlike MasterCard and Visa, AmEx encourages you to pay off your bill in full each month. They instead charge you a yearly fee, and used to offer better rewards to cover it. While this has changed a lot with the creation of branded AmEx cards and AmEx Blue, I could see RevoluionCard as a return to their traditional business model--but now backed by float, rather than monthly fees.

I could of course be entirely wrong, but there's at least the chance here that AmEx is _not_ interested in killing a competitor.

<comment><USER5> OK, good point. I always think of AmEx as "expensive", but not "not evil". But they are definitely not evil, which is why they are the only credit card I actually use. (I had a card from my bank, but I didn't use it enough and they charged me a $30 "you didn't use it enough" fee. That is pretty evil, especially as they had never sent me a statement until then.)

</comment></comment></comment><comment><USER7> Merchant psychology has to be a big part of it. If Visa is charging you 2%, and Amex is charging 4%, Amex looks pretty expensive. If Visa is charging you 2% and Revolution is charging 0.5%, Amex at 4% looks outrageous, and you're going to start thinking more about dropping it. Once enough merchants drop Amex, people get frustrated that merchants won't take their Amex, and start reaching for their Visa first because everyone takes it.

<comment><USER8> I was at a U-Haul and was trying to pay with my Amex card. Kept getting denied (I don't have payment issues) and I finally had to pay cash. All the other customers used Visa/MC. The guy at the checkout counter later told me that Amex cards get denied _a lot_.

</comment></comment><comment><USER9> Is it just me or does it bother anyone else that as a viable alternative to overpriced, almost malicious credit card companies begins to gain some modicum of success, it is immediately bought out by none other than one of said evil credit card companies?

Am I being short sighted here? Missing something? I don't view this as AmEx eventually lowering their rates. I view it as Amex ensuring their rates can remain high.

*spelling, typo

</comment><comment><USER10> 3 years, $300M acquisition.

As noted below, there was quite a bit of investment in the company. Breaking into the retail payment processing industry is definitely not an easy task. Still, the relatively quick acquisition shows there is value to be had by taking on the incumbents. Perhaps a more capital-efficient indirect assault on the sector would be possible.

<comment><USER2> This is a venture with high capital requirements and significant regulatory and competitive barriers. If it were the sort of thing that a couple of hackers could tackle effectively, we wouldn't be paying such a large fraction of all retail transactions to a handful of companies who succeeded at setting up payment networks in the 80s.

Don't take that as discouragement -- you should go at them, right now. Just pick partners that know the payments industry, can negotiate the regulatory issues, and can raise and spend the money you need to market a consumer product that won't be profitable until it has reached very large scale.

</comment></comment><comment><USER11> I'm just amazed the Case actually managed to make something work, given the way things went with Revolution Health.</comment>


What is your ideas for these domain names? - <AUTHOR> Hey there, What are your ideas of a website for domains like : Allures.net And Urls24.com<p>It will be really nice to share some useful ideas,thanks <comment><USER2> To be honest, Allures.net sounds like a knock off of adultfriendfinder and Urls24.com sounds like one of those TV infomercials where they tell you to enter a number at the end of the URL so they can tell how well their commercials are performing in different time slots. Those are just my initial opinions however.

</comment><comment><USER3> [https://en.wikipedia.org/wiki/Allures_(film)](https://en.wikipedia.org/wiki/Allures_\(film\))

<comment><USER2> Ah forgive me for not catching the 1961 reference</comment></comment>


Quebec's National Assembly continues, focus shifts to religious symbols bill - <AUTHOR> https://www.cbc.ca/news/canada/montreal/as-marathon-weekend-sitting-of-quebec-s-national-assembly-continues-focus-shifts-to-religious-symbols-bill-1.5177587 <comment><USER2> The title of this submission broke the site guidelines quite badly. They ask: " _Please use the original title, unless it is misleading or linkbait; don 't editorialize._" We take away submission privileges from accounts that do that, so please don't do that.

Submitted title was "Québec will ban hijab & other religious symbols to be worn by govt. employees."

</comment><comment><USER3> The title of this link is so grossly sensationalized. Nothing has been set yet, and Quebec hasn't banned anything. Politicians just proposed a bill and will likely face steep opposition since this sort of thing has happened before.

In Canada, everyone must wear helmets when operating a motorcycle; riders who wore turbans were exempt from this rule. A bill was proposed to ratify the exemption, ppl cited discrimination and the bill was shot down.

<comment><AUTHOR> > Quebec hasn't banned anything. Politicians just proposed a bill and will > likely face steep opposition since this sort of thing has happened before.

The bill is passed on June 16, 2019 (yesterday).

Source: National Assembly of Quebec. [http://www.assnat.qc.ca/en/travaux- parlementaires/projets-lo...](http://www.assnat.qc.ca/en/travaux- parlementaires/projets-loi/projet-loi-21-42-1.html)

</comment></comment><comment><USER4> It's disgusting, and most of the rest of Canada is against it.

The part that really bugs me about it is that Christian symbols are allowed- because that's "a part of our culture".

<comment><USER5> Christian symbols aren't allowed either.

<comment><USER4> Really? My understanding was crosses were to be allowed.

</comment></comment></comment><comment><AUTHOR> > The Coaliton Avenir Québec government wants to pass a bill today that will > bar public-school teachers, government lawyers, judges and police officers > from wearing religious symbols while at work.

> The bill also invokes the notwithstanding clause in an effort to spare it > from court challenges about its constitutionality.

<comment><USER6> > The bill also invokes the notwithstanding clause

What's that ?

<comment><USER4> [https://en.m.wikipedia.org/wiki/Section_33_of_the_Canadian_C...](https://en.m.wikipedia.org/wiki/Section_33_of_the_Canadian_Charter_of_Rights_and_Freedoms)

> The Parliament of Canada, a provincial legislature or a territorial > legislature may declare that one of its laws or part of a law applies > temporarily ("notwithstanding") countermanding sections of the Charter, > thereby nullifying any judicial review by overriding the Charter protections > for a limited period of time. This is done by including a section in the law > clearly specifying which rights have been overridden. A simple majority vote > in any of Canada's 14 jurisdictions may suspend the core rights of the > Charter.

Basically, imagine if states could pass temporary laws that were not allowed to be challenged as unconstitutional. For some reason, Canada allows that.

<comment><USER7> > Basically, imagine if states could pass temporary laws that were not allowed > to be challenged as unconstitutional. For some reason, Canada allows that.

One argument in favour is that it preserves the ability to pass emergency acts without contorting the definition of 'rights'.

As a negative example, look at current US rhetoric regarding a "national emergency" over immigration. That is being used to justify acts that might under other circumstances be unconstitutional, but the only way the courts can allow it is to also allow broad, ad-hoc "national security" exceptions to constitutional rights.

If the US had something similar to the notwithstanding clause, the line of authority would be much clearer. An act that would otherwise be unconstitutional can still pass and become effective if the elected government certifies the need, on a temporary basis.

While this clause (and similar language in s.1 of the _Charter_ , which states that rights are guaranteed to "such reasonable limits prescribed by law as can be demonstrably justified in a free and democratic society.") ostensibly weakens the strength of rights in Canada, I believe that this presence invites courts to paradoxically take a _stronger_ view of rights on a day-to-day basis. In particular, they're much more likely to truly inquire whether government actions are reasonable.

</comment></comment></comment></comment><comment><USER8> If Quebec wants to ban "religious symbols" for its govt. employees, then they must affirmatively put forth a strict "this is what _everyone_ must wear" uniform similar to grade school/military codes. I personally wouldn't have a problem with that, but I wonder if that could pass through the political process (hence this backdoor bill shenanigans I suppose).</comment>


Ask HN: Good book on resilience of natural systems, for non-biologists? - <AUTHOR> I find the way how natural systems (animals, plants) organize and respond to outside influences interesting and would like to learn from that - is there some good book that is understandable for engineers with just common understanding of biology? <comment><USER2> This isn't a biology book but does tall about resilient systems in an accessible way:

[https://www.chelseagreen.com/product/thinking-in- systems/](https://www.chelseagreen.com/product/thinking-in-systems/)

</comment><comment><USER3> Try _Wood: The Internal Optimization of Trees_ [1], or anything else by Mattheck.

My background is more bio than eng, but it's very digestible despite being dense.

Truly one of my favorite reads.

[1] [https://g.co/kgs/ACnrCS](https://g.co/kgs/ACnrCS)</comment>


MonoTable: Zero-admin, No SPOF, scalable NoSQL data-store in Ruby - <AUTHOR> http://monotable.org/

<comment><USER2> That's quite a mouthful for a project that doesn't even seem to have a working prototype.

[https://github.com/imikimi/monotable/blob/master/lib/monotab...](https://github.com/imikimi/monotable/blob/master/lib/monotable/router/server_client.rb)

</comment><comment><USER3> The competition table is lacking, I think Riak hits all the points the author is aiming at: <http://www.basho.com/products_architecture.php>

(I don't want to diss creation in general or an open source project in particular, but the presence of a "competition" table implies that this is going to fill a gap)

<comment><USER4> There's some other areas where Riak is significantly ahead, such as already having Map-Reduce (allowing the map and reduce functions to be in javascript, even), scaling up and down are both already implemented, and riak supports multiple backends, including in-memory databases, leveldb, bitcask and innostore.

In a matter of days, Riak will also be getting secondary indexes, full text search fully integrated, and riak-pipe, a great way of building workflows.

If these people want to be working in Ruby, there's Ripple-- a ruby library supporting Riak, and adding Ruby style functionality (I believe, I'm not too familiar with Ripple.)

I think if you want to go your own way and build your own thing, that's fine, and good for you, if its' a learning exercise. But if you want to advance the state of the art, either do something different from the rest, or join an existing open source project that is further down the pike and help it go even further.

I say that, of course, while myself I'm working on something I've been thinking of as "ruby on rails done right" (namely, a web platform where you write coffeescript for the server, and you have scalability and database built in via close integration with riak)... but I hope that I'm cutting some new ground. (namely, letting you make coffeescript run concurrently...)

</comment></comment><comment><USER5> Genuinely asking this...is this a joke?

</comment><comment><USER6> What's the consistency model? I assume eventual consistent, if not then what the availability model?

The description of distributed data store should specify the tradeoffs w.r.t. the CAP theorem.

</comment><comment><USER7> Classic Dunning–Kruger effect.

<comment><USER8> Worse, they appear to be (poorly) mimicking Riak without being aware of it.

That evaluation is admittedly, based on a rather specious list of "features".

<comment><USER9> The Competetive "Survey" doesn't include MongoDB, the most popular NoSQL database.

</comment></comment></comment><comment><USER10> I am a committer to this project, which is its infancy. We got some premature attention to our homepage, which was not clear on the specific use case we are seeking to solve with Monotable. We've updated the README to address most of the questions we received here and on reddit. <https://github.com/imikimi/monotable> . Thanks for all the feedback and questions.

</comment><comment><USER11> In Ruby?

<comment><USER12> For speed

</comment></comment><comment><USER13> I assume it's completely in memory?

<comment><AUTHOR> I don't think so, just from quickly glancing at the source. The Ruby GC (at least in MRI) doesn't deal well with even moderately sized heaps (>500MB), so I imagine they are fairly dependent on the OS disk cache for keeping things in memory.

</comment></comment><comment><USER4> I'm confused by mono table (which implies a single table) and how mono doesn't mean single point of failure. They talk about a cluster, and adding machines, so I guess mono table lives on multiple machines... but how? Is it replicated to every machine? (EG: every node in the cluster contains a complete set of the data?) IF so, this would mean that as you scale, the updates of writes to replicate the changes across the cluster could possibly become quite a problem, in terms of bandwidth and latency. I can imagine each node spending most of its time handling updates from other nodes.

Also, unless you're locking the table on every node simultaneously (the thought of dealing with that gives me headaches) you're going to have consistency issues.

I think their goals are excellent-- zero admin, no SPOF are really important features to me. If they've got a new architecture, then it could be a really important and innovative project.

Would love to see an architectural description.

<comment><AUTHOR> That's just, like, your opinion, man.</comment></comment>


Diamond Blockchain Initiative - <AUTHOR> https://www.iafrikan.com/2018/01/29/de-beers-group-progresses-development-of-first-blockchain-initiative-to-span-the-diamond-value-chain/ <comment><USER2> I've seen many claims that the blockchain can be used to provide traceability for various goods but I don't get it.

For one thing this isn't trustless, the blockchain doesn't know what a diamond is so if a person entering a new diamond to the blockchain "database" decides to lie there's no way to prevent it "trustlessly". How do you prevent the same diamond to be entered twice in the chain? How do you prevent somebody from entering a diamond that doesn't exist in the chain? How do you make sure that some physical diamond you have in your hands matches an entry in the blockchain (and one only)? The ledger is immutable but diamonds aren't, what if a diamond is recut and the blockchain entry is not updated to match? What if I decide to "launder" some blood diamond by adding a transaction on the blockchain saying that it was destroyed, followed by a brand new clean entry pretending that I've just mined a new one?

In the end you'd have to trust some sort of authority to put the diamonds on the chain honestly.

So if you have decided to trust some authority, what do you need the blockchain for? Just have the De Beers cartel digitally sign a certificate for each diamond like an HTTPS certificate authority and bundle it with the stone. Exactly the same trust model and you don't have the overhead of the blockchain.

Is there a use case that I'm missing or is it just yet an other occurrence of "let's say we do blockchain stuff and people will throw money at us"?

<comment><USER3> You are correct. Humans will be the weakest link in this security link, specially at the origin. Bitcoin etc solve this by using PoW. But here there can be issue if there is a malicious first entry

That said, a case might be made for a traceable and immutable book which shows the movement of each diamond. But that might run into privacy issues. This can be solved by using a private blockchain but then again it goes back to trusting someone who has the blockchain with them.

<comment><USER2> I agree with you but I want to point out that "a traceable and immutable book" is perfectly achievable without blockchain. Just have De Beers (or the authority of your choice) publish their signed "immutable" ledger publicly at regular intervals. Anybody can mirror it (like the "nodes" of bitcoin mirror the blockchain). If the authority decides to cheat and rewrite history (for instance to change the origin of a diamond) any of the 3rd party mirrors can detect the conflict and blow the whistle.

<comment><USER4> Interesting point, thanks for sharing. But, anyway:

What incentives do those mirroring nodes have to store regular data blobs and process requests from clients?

Who will decide the privilege to be such a 'mirroring node'. The origin can run several such 'mirroring nodes' and rewrite history on all (some of) them: how would you know who is giving you the truth in case of conflicting information?

I bet if you solve those questions, you will be simulating a blockchain system. Do you agree?

</comment></comment></comment></comment><comment><USER5> There's something very poetic about this, as the similarities of diamond cartels [1] and cryptocurrencies [2] effectively granting a small amount of people the control the majority of supplies of artificially constrained assets both of which have vastly inflated prices relative to production costs.

[1] [https://en.wikipedia.org/wiki/De_Beers#Diamond_monopoly](https://en.wikipedia.org/wiki/De_Beers#Diamond_monopoly)

[2] [http://www.businessinsider.com/bitcoin- inequality-2014-1](http://www.businessinsider.com/bitcoin-inequality-2014-1)

</comment><comment><USER6> Doomed to be subsumed by whichever Chain-of-Custody/Certification-of-Origin blockchain project wins out in the long run. And there are lots of them -- this is an obvious and compelling use of the technology. It's just a case of waiting to see which solution dominates, but I'm pretty certain it WON'T be a proprietary or vendor-owned blockchain since that violates the very thing a blockchain solution brings to the table -- trustless verification.

<comment><USER7> I'm not sure; it doesn't seem obvious that the certification chains of unrelated products should be on the same blockchain, and it doesn't seem obvious that users of this system will want to pay the high energy prices of proof-of-waste.

<comment><USER6> Seems to me that once you've solved the problem, applying it across a variety of unrelated products is an easy thing to do, with the advantage that your solution is already proven, has gained some traction in another sector and is not something new and untried. It's one of those things where the first one to win is likely to win big (unless they fuck it up along the way somehow.)

Not sure how your comment on PoW applies, though (despite agreeing with you.) Plenty of the solutions in developments are using PoS/other/hybrid consensus mechanisms.

</comment></comment></comment><comment><USER4> I wonder how one may prove that a thing originates from some specific place? I mean, you have to have some kind of trusted by all parties external observer who will assure that fact. Am I wrong here?

</comment><comment><USER8> This is the probably one of the first non-crypto currency uses for blockchain I've seen that i like.

It's a shame as diamonds aren't really worth that much, just a monopoly.

</comment><comment><USER9> I'm wondering:

1) Do diamonds have unique digital fingerprints? How do I know if the diamond I see in front of me corresponds to the record the dealer shows me on the blockchain?

2) What happens when people (inevitably) put bad information in the permanent digital record? Does anybody have the authority to correct it?

<comment><USER10> With regard to your first question, I was wondering the same too. Found this Coindesk article which might be helpful ([https://www.coindesk.com/everledger- blockchain-tech-fight-di...](https://www.coindesk.com/everledger-blockchain- tech-fight-diamond-theft/)).

"Before a stone like this can be digitised, pricey or not, it needs a unique identifier – a fingerprint – that allows it to be tracked on Everledger's platform as it changes hands.

This is calculated from 40 data points related to each stone – alongside the Four C's. Any diamond over 0.16 carats will also have a serial number inscribed on its girdle during the grading process.

While a criminal could reshape a stone to distort its 'digital fingerprint', Kemp explained that diamonds are not, in fact, the sum of their parts. The cutting process results in a lot of wastage, so any attempt to alter a diamond, or split it into two, will drastically reduce its value."

<comment><USER4> Thanks for that quote!</comment></comment></comment>


Show HN: My first Rails app - <AUTHOR> https://www.westoq.com/ <comment><USER2> Are you from SB?

Lived there for a few years and it may be the greatest little town in the world.

<comment><AUTHOR> Nope. I'm from Philippines!</comment></comment>


Fingers are lot more active on iOS than Android - <AUTHOR> http://www.blog.errnio.com/#!single-post/cu6k/2774F466-352D-4C8D-8CCE-7117DB297D6B

<comment><AUTHOR> I took some data off our network database. We measure a lot of gestures as part of the product. I found this quirky data nugget which i think is worth a comment.

According to our network data, and it might just be skewed, we see a lot more gestures per visit being performs on mobile web in iOS than in Android.

Why do you all think that is?</comment>


Rustler – Safe Elixir and Erlang NIFs in Rust - <AUTHOR> http://hansihe.com/2017/02/05/rustler-safe-erlang-elixir-nifs-in-rust.html <comment><USER2> This, IMO, is quite possibly the best instance of "best tool for the job" I've ever seen. Rust is great for writing high-performance code, and Erlang is fantastic for distributed systems.

<comment><USER3> code like this gives me polygot chills. Rust + Go = love :DDDD.

</comment></comment><comment><USER4> I've been very excited at Rust's prospects as an alternative to C for extending all sorts of higher-level languages, but I'm most excited at the prospect of combining Rust with Erlang given the latter's focus on reliability. I'd love to figure out where Erlang programmers hang out to ask them what they think about using Rust for NIFs.

<comment><USER5> Mostly the Erlang mailing list. [http://erlang.org/mailman/listinfo](http://erlang.org/mailman/listinfo)

As an Erlanger, and maker of a NIF -> Rust library I wasn't allowed to open source (sadly), I can tell you I think this is excellent. My current science project is trying to rebuild some small components of BEAM and the Erlang Runtime System in Rust that are currently in C.

Mostly the above is an exercise in understanding the internals of BEAM better, because my ideal end state is to figure out what it would take to make an Erlang/OTP-like library for Rust (with task/thread/process/whatever preemption)... which is actually what originally drew me to Rust 3-4 years ago back when it was shaped more like a systems-Erlang (task supervision hierarchies, etc) and less like a renovated-safe-C/C++.

<comment><USER6> >Rust 3-4 years ago back when it was shaped more like a systems-Erlang (task supervision hierarchies, etc) and less like a renovated-safe-C/C++

Wow, any chance Erlang-like supervision and actor model in general might make a comeback in Rust? I'm sure the Erlang guys has thought about this, but no static type checking makes me a bit nervous. Erlang can be surprisingly strict (a good thing) in some ways, but as far as I can tell, you only discover any failures at runtime.

<comment><USER2> > any chance Erlang-like supervision and actor model in general might make a > comeback in Rust?

As a library, sure, but like green threads, actors aren't ideal for a systems language.

<comment><USER7> The guys at ETHZ thought otherwise with Active Oberon.

<comment><USER2> Interesting. Were actors available at the kernel level? If so, how?

<comment><USER7> Not actors. I should have been more explicit, as I was referring to green threads.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Really nice to see this linked here, I was chatting with hansihe about getting the html5ever parser from servo into a nif and he magically created it here:

[https://github.com/hansihe/html5ever_elixir](https://github.com/hansihe/html5ever_elixir)

It shows how create a threadpool and avoid the 1ms maximum nif execution time too.

</comment><comment><USER9> NIFs are the fastest method to call external code from Erlang/Elixir, as far as I understand. But I wonder how high the actual overhead is.

My understanding is that if I still want to ensure that the Beam VM can continue to schedule all processes efficiently, these NIFs shouldn't calculate forever, but return quickly to avoid blocking all other processes. So the straightforward way to ensure this for longer calculations would be to split the calculation in smaller, parallelizable jobs, if that is possible. But then the overhead of calling NIFs might actually matter, if you split them into chunks that are too small.

I've no idea how big the overhead actually is, I'd be interested in a rough estimate. Is it small enough that I can just ignore it entirely?

<comment><USER10> If you look at what NIFs exist up to this point and where Erlang itself tends to use that mechanism, they are all for very tiny uses, like type checks and such. But that's probably precisely because they're too scary to use for anything very large. The existence of a provably-safe and practical mechanism for writing them may cause and/or require some changes in the ecosystem to account for the fact it's now possible to write NIFs that may take a long time to run.

I wouldn't be surprised that at least one of this library or the Erlang VM itself develop an official way to easily use a NIF to run a longer-running process safely. There hasn't been a need up to this point because there hasn't been a such thing as a long-running NIF.

At the moment, if you're looking at something that may take several seconds you're probably still better off coordinating something over a port to an external process or something. Or working with this project to make it feasible to run a long-running native process.

Trying to write a NIF that could somehow yield back and then be "continued" later would be a royal pain. Cooperative scheduling was enough of a pain when we were in the hundreds of processes mostly doing nothing on OSes; trying to use it on an Erlang server is probably just infeasible.

<comment><USER11> it is almost trivial to write nifs which yield and continue, enif_schedule_nif exists for this purpose.

nifs are ideal for operations which mutate binaries, eg hashing or unmasking a websocket frame

<comment><USER10> I didn't just mean the mere ability to yield, which isn't that complicated; I meant code supporting the common use cases around having a long-running NIF, such as the person I replied to's comment about having some sort of build in support for being able to answer back to a PID or something. I could easily imagine a NIF library that provided an easy ability to set up an independent thread pool and work sharing mechanism specific to that NIF, which sends answers back to given PIDs, has timeout support or the ability to query it for progress, etc. All fairly straightforward stuff to expect to develop over time, but in a world where long running NIFs are too dangerous to hardly even contemplate, they haven't developed yet.

There's some some parameters in there that are going to be tricky to set up correctly (number of workers in the pool for a given NIF has a lot of implications at scale), but in the end it's not significantly different than communicating to a separate process on the some machine; it's all the same resources being used.

</comment></comment></comment></comment><comment><USER12> > This means you can write and run totally safe code in Rust, no worrying > about segfaults.

This is not quite accurate; you can still segfault rust writing 100% safe code, for example if you have a large stack overflow ever since __morestack was killed.

Though these cases are fortunately rare

<comment><AUTHOR> That's very true.

Do you think I should have written it differently? I might want to add a clause in the caveats section at the very least.

<comment><USER12> Nah, just nitpicking. Though I guess the point is that AFAIK there's no documentation for all the ways that safe rust code is allowed to segfault; the distinction between a in-rust panic is that a segfault would probably crash beam, whereas an in-rust panic might be recoverable?

<comment><USER4> _> there's no documentation for all the ways that safe rust code is allowed to segfault_

I wouldn't say "allowed" to segfault. :P The behavior you're referring to is currently due to a deficiency in LLVM for non-Windows platforms. Here's the bug on the Rust repo tracking it: [https://github.com/rust- lang/rust/issues/16012](https://github.com/rust-lang/rust/issues/16012) Its resolution is long-awaited, to say the least, but it requires someone proficient with LLVM to do the legwork...

 _> an in-rust panic might be recoverable?_

Anytime you're writing an interface where code is going to be calling into Rust via C FFI, you ought to be using [https://doc.rust- lang.org/std/panic/fn.catch_unwind.html](https://doc.rust- lang.org/std/panic/fn.catch_unwind.html) , which is specifically intended to prevent panics from crossing FFI boundaries.

<comment><USER13> > This function only catches unwinding panics, not those that abort the > process.

How do you expect a stack overflow to unwind? I have difficulty imagining the implementation

<comment><USER4> Anytime our guard pages detect a stack overflow, an abort is issued with no chance to unwind. (The segfault bug mentioned above is caused by crafting data on the stack such that you bypass the guard page, which would go from a segfault into an abort in the presence of stack probes.) I did not intend to imply that there was any chance that a stack overflow wouldn't bring down your process, only to clarify Rust's stance on the theoretical memory safety implications. :)</comment></comment></comment></comment></comment></comment>


India's street children bank on the future  - <AUTHOR> http://www.france24.com/en/20120705-indias-street-children-bank-future-0

<comment><USER2> _"I ran away from home at the age of 11 after my father beat me for stealing a kitchen appliance," said Samir who works in a sweatshop._

[snip]

 _"I have saved 4,000 rupees (70 US$) in the last seven months. It's a good feeling to have some money. I will buy a shirt and a watch for my father and send it to him to seek his apology."_

 _"He might forgive me and ask me to be with him at home."_

For me it is heartbreaking that this child was beaten and still feels that he owes his abuser an apology.

(edit: formatting)

<comment><USER3> Yes, I would have rather reported him to the police for stealing and put him in a juvie where he could master the art of thieving. <\- this is the western solution isn't it?

Abuser? my foot! Western society is good transferring responsibility to the society at large.

<comment><USER4> If you're a a bad parent, particularly in a poor inner city family, that's the western solution. If you're a good parent the solution is to teach your kids moral lessons without using violence.

</comment></comment></comment><comment><USER5> Really, really impressive (or, depending on how you look at it, embarrasing) but that savings rate is way above what most westerners save.

<comment><USER6> Interest rates for Fixed deposits are around 8-9% for a year in some Indian banks. There were times when it was more than 10% too.</comment></comment>