How I gained commit access to Homebrew in 30 minutes - <AUTHOR> https://medium.com/@vesirin/how-i-gained-commit-access-to-homebrew-in-30-minutes-2ae314df03ab <comment><USER2> From the Homebrew post about the incident: "The security researcher also recommended we consider using GPG signing for Homebrew/homebrew-core. The Homebrew project leadership committee took a vote on this and it was rejected non-unanimously due to workflow concerns."

How is PGP signing _not_ a no-brainer. What kind of workflow concerns would prevent them from signing commits?!

<comment><USER3> If you make PGP signing easy enough, at some point you end up with a Jenkins with a trusted PGP signing key, and you haven't actually solved anything.

The problem isn't making it easy to sign things, the problem is making it sufficiently _hard_ for unauthorized parties to sign things without affecting any workflows you'd like to preserve - that is, the real problem is a workflow problem. The real problem is figuring out how to secure automation so it has the privileges to do what it needs but isn't leaking access. The Jenkins instance was designed to do authenticated pushes - it needs automated write access to the Homebrew repos.

Also, signing _commits_ doesn't help you if the risk is unauthorized pushes to master. You can pick up someone's test commit and push that to master, or push a rollback of OpenSSL to a vulnerable version, or something, and still ruin many people's days.

<comment><USER4> Are there any OSS maintainers who use air-gapped computers to sign packages (at least for major versions)? I would expect this level of precautions be taken for projects that may have large-scale repercussions in the event of a security breach.

<comment><USER5> While not OSS the Debian packages of Tarsnap are built and signed on an air- gapped machine: [http://mail.tarsnap.com/tarsnap- alphatest/msg00033.html](http://mail.tarsnap.com/tarsnap- alphatest/msg00033.html)

<comment><USER3> How much review does 'cperciva do of the source code and build-dependencies that are copied to the air-gapped machine, which presumably originate from internet-connected machines?

Also, how secure is the kernel on the air-gapped machine against malicious filesystems on the USB stick? (If it's running Linux, the answer is almost certainly "not;" I could imagine FreeBSD is better but I don't know how much people have explored that.)

To be clear I'm not opposed to air-gapping if the maintainer is excited about it, I just suspect there are many much weaker links on the way to/from the air-gapped system, and fixing those is a much harder project that almost nobody is excited about.

<comment><USER6> _How much review does 'cperciva do of the source code and build-dependencies that are copied to the air-gapped machine, which presumably originate from internet-connected machines?_

I verify that the source code being compiled is the source code which is published in a signed tarball. Yes, someone could have tampered with the internet-connected system where I do Tarsnap development, but their tampering would be visible in the source code.

Build dependencies are verified to be the packages shipped by Debian. If someone has tampered with the Debian gcc package, we've lost even without Tarsnap binary packages.

 _Also, how secure is the kernel on the air-gapped machine against malicious filesystems on the USB stick? (If it 's running Linux, the answer is almost certainly "not;" I could imagine FreeBSD is better but I don't know how much people have explored that.)_

I don't use a filesystem on the USB stick I use for sneakernet, for exactly this reason -- I write and read files to it using tar. (Yes, you can write to a USB stick as a raw device just like you would write to a tape drive.)

<comment><USER7> The 'malicious file system' on a USB stick is not something to worry about - the firmware of your USB stick is. People (ie for-fun hackers) modified firmwares on USB sticks to make them look like HID keyboards and send commands to target computers - it is well enough in the capabilities of a determined adversary to own your internet machine and implant something on your USB stick.

For secure airgapped computers I'd use one way low tech comm channels with no side bands, maybe IR or sound? (if you trust the device drivers)

<comment><USER8> What happened to CD/DVD (or floppy)? Too small?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is an interesting example of a long-standing problem which is that in general we make use of huge amounts of software and trust our security with it, whilst knowing very little about the security practices of the people developing it.

The article makes a good point that it's very hard for small projects, like the team running Homebrew, to fund their security, yet they are likely to be a target for quite high end attackers, given the access that can be gained by getting unauthorised access to package repositories.

As a side note it also shows that Jenkins tends to be a tempting target for attackers as it often has access to a wide range of systems to carry out it's functions.

<comment><USER10> > As a side note it also shows that Jenkins tends to be a tempting target for > attackers as it often has access to a wide range of systems to carry out > it's functions.

This. I'd really love to stop us using Jenkins but none of the hosted macOS CI services scale to meet our needs (i.e. having jobs that run for multiple hours on better hardware). The ideal solution for me would be for us to have some sort of modified Travis or Circle CI setup. We can even pay for it now we've got Patreon money coming in.

<comment><USER11> Jenkins is not the problem, we have quite a few secured instances which wouldn't leak secrets like this, or at least not to non-admin or unauthenticated users.

It's just often misconfigured because there are a plethora of plugins and ways to store and use secrets, and nobody audits it enough to look at the console output or build artifacts for leaked secrets.

The project is simply missing someone familiar enough to configure Jenkins properly.

<comment><USER12> > The project is simply missing someone familiar enough to configure Jenkins > properly.

I would say that this is a specific case of the far more general one. Substitute "any small organization" for "the project" and substitute any configuration familiarity (i.e. Ops skill) for Jenkins configuration familiarity.

Even in "Devops" job postings for startups, when mentioning CI/CD tools like Jenkins, the main desire seems to be to hire someone who's more Dev than Ops, to create the code to run the CI/CD pipeline, with something like configuration or security a mere afterthough, if that.

</comment></comment></comment></comment><comment><USER13> > I want to give special thanks to Mike McQuaid for his quick and professional > handling of my report while on his paternity leave.

Kudos on that. Specially when the all team make only around $700-800 per month. [1]

[1] [https://www.patreon.com/homebrew](https://www.patreon.com/homebrew)

<comment><USER10> Thanks! To be explicit though: that money all goes to the project and not to individuals. I've never made a cent from working on Homebrew.

</comment></comment><comment><USER14> One would think that Apple would be a prime candidate for contributing to Homebrew security funding, since in practice it is a project with security implications for so very many OSX developer workstations.

<comment><USER15> Unfortunately, it has become increasingly clear that developer workstations are not on their radar as a primary target market.

<comment><USER16> I wouldn't say that. Apple's hardware neglect is not a privilege only developers experience.

<comment><USER17> I don't think the 2018 MacBook Pro leaves much to be desired unless you want features that would turn it into a ThinkBook-like brick. For $50 you get a charging USB-C hub that allows you even to leave your power brick home. The iMac Pro is pretty great.

Power Mac is a different story.....don't know how and when they're going to fix this. That's a real shame.

<comment><USER18> > unless you want features that would turn it into a ThinkBook-like brick.

Yeah literally all many of us want is a standard keyboard with function keys instead of the touchbar. A couple regular USB ports would be nice as well so we can plug in a mouse and keyboard without needing dongles. Neither of those things would turn their "pro" laptop into a brick.

<comment><USER17> MacBook 2015: power brick (with broken irreplaceable cord) + Ethernet dongle

MacBook 2018: USB-C dock with replaceable cord

So in my use case I actually got rid of one dongle at a price lower than a replacement MagSafe 2 adapter. I really liked MagSafe though.

Never used the F-keys really. ESC is not that hard for me to live without but that's all personal. But the difference in performance is quite noticeable.

<comment><USER19> >I really liked MagSafe though.

The Surface line by Microsoft has a very similar magnetic power+docking connector. The only issue I have with it is that the LED doesn't change color when the device is fully charged.

The line includes:

\- Laptop,

\- Pro (tablet + typecover)

\- Book (tablet + keyboard + GPU + battery)

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> I think that publicly exposing your build/deployment system is a very bad idea. It contains too much sensitive and valuable information (credentials, commits, commit author names, paths, hostnames, scripts etc.) and it is too hard to make it secure the right way.

Unfortunately, many people do that. For example, here in New Zealand there is a new startup Onzo (bike sharing). When they launched, I tried to google about them (just out of curiosity). And in 1 minute I found their Jenkins server exposed to everyone as well. I could see how their build process works, who commits what etc. I decided to try to login using simple credentials (something like admin:password) and it didn't work. But there was a Register button. "Why not?" I thought and clicked it and created my own account. And voila, it gave admin permissions by default - I could delete their projects, change variables etc. Emailed them about that.

Moral: never expose your build/deployment systems. If you really want to expose some parts (for whatever reason), then use/write client/UI that has no permissions. 'Build Status' badge is a good example -- it exposes build status info, but doesn't show too much and doesn't give any permissions whatsoever.

<comment><USER21> Jenkins sucks for a lot of reasons but it does have a perfectly serviceable credentials store exactly for hiding these kinds of secrets from the parameters page and the build output. Any release engineer with the slightest inclination to avoid incidents would have set it up, this just looks like a lack of experience at breaking everything for everyone.

<comment><USER20> But that's the thing: many people don't bother configuring it properly (or they don't know how?). So why risk it?

<comment><USER21> sometimes the risk analysis comes out in favour of providing a service for your users ahead of studiously avoiding making mistakes

</comment></comment></comment></comment><comment><USER22> This is an excellent piece. I often wonder about adversarial security issues in large scale OSS projects like Linux kernels. You don't even need to hack commit access to repo. One can _intentionally_ wrap malicious code out in plain sight in an otherwise what would appear as benign change (thanks to undefined behaviour in C/C++). What if a black hat hacker climbs up in Linux contributors hierarchy? What if a person who is already higher up in OSS hierarchy decide to defect and plant a logic bomb? Given that Linux kernel now runs majority of our world from servers in data center to mobile phones in our pockets and hospitals to war machines, security issues like this is a huge deal.

<comment><USER23> It's a pretty scary prospect, to the point that I have to imagine it's already happening to some degree. If a nation state wants a backdoor, what better way than to bribe the cash-strapped OSS maintainer of that little project that every company depends on.

<comment><USER7> The problem is that the type of engineers that work on OSS takes own integrity very seriously, and they build their network of trust on that integrity.

</comment></comment></comment><comment><USER24> I bet it's just what the guy wanted to find out he had to deal with while on paternity leave!

<comment><USER10> Thank god for naps.

</comment></comment><comment><USER25> This is a fundamental problem of doing CI for open source. Running tests for random people's changes means giving them RCE in your test environment. Sandboxing rarely gets approached with the seriousness it requires.

</comment><comment><USER26> > "On Jun 31st,"

As said in _Raiders Of The Lost Ark_ , bad dates.

</comment><comment><USER27> Lol, always jenkins (CI).</comment>


Conway's Game of Life in APL - <AUTHOR> http://www.youtube.com/watch?v=a9xAKttWgP4

<comment><AUTHOR> We did our weekly hackathon this week and for some reason chose J as our language of choice . . . we watched this afterwards and laughed maniacally. We all want APL keyboards now.</comment>


Indian courier service hires only deaf workers - <AUTHOR> http://springwise.com/non-profit_social_cause/miraklecouriers/

<comment><USER2> Aside from the obvious reasons, this is also great because it allows the deaf to work in a deaf-friendly work environment; everyone or most there probably sign.

Much of a deaf person's life is spent watching, in silence and isolation, as the hearing people around them communicate freely. Depending on the area, socializing a deaf family member can be a real challenge. Finding a job like this would be a huge help.

<comment><USER3> Agreed, deaf people are often forced to have later social developments. I believe I received my defining social development at around 15 (note: graduation is much younger in the UK where I'm from) when I was reaching graduation and the shit was about to hit the proverbial fan. I realised that there's a time and place for friends, and certain people are just not friend material (this lesson is still helping me).

Deaf people are often stranded until their mid-twenties or even later to reach these developmental milestones in social relationships. Landing a job in a deaf-friendly workplace would place the deaf person in an ideal situation to develop many of these social milestones long before they ordinarily would.

We're an auditory species by nature, so I can only imagine the isolation one must feel being surrounded by audiophiles when you're forced to be a visuaphile(?).

<comment><USER4> I've often wondered what would be harder, be blind or be deaf, and since I love music and love to program I really am stuck in the middle, no matter what I'd lose something that makes me in to who I am. Pretty disturbing.

<comment><USER5> You can program if you lose your sight. TV Raman and Peter Lundblad both work as programmers for Google and are blind.

</comment></comment></comment></comment><comment><USER4> A friend of mine (Nicolette Mak) has done something similar in the Netherlands, a courier service for handicapped people called 'Valid Express' ( <http://www.validexpress.nl/> ). It's a huge success, she now has about 50 vehicles on the road with people that have 'challenging bodies' as she calls it, each vehicle is adapted to it's driver.

<comment><USER6> Just FYI, I used the word 'handicapped' in conversation recently and brought it to a grinding awkward halt. The preferred term is 'disabled', apparently due to the 'hand in cap' associations of 'handicapped.' YMMV :-)

<comment><USER4> Thanks, it's always nice to find someone that wants to help you polish your use of a second language, it's appreciated.

Subtle changes like that are hard to get right, I don't usually use that word in English and in dutch it is 'gehandicapte', and I translated that literally.

I sympathize with 'ars' though, whatever you call it the truth is someone has a body with bits and pieces not working the way the rest of us have.

What always bothered me about this, is when a dog loses a leg, the dog _instantly_ transforms into a three legged dog, still competes with his litter mates as though nothing has changed, no special allowances given, none expected. It's literally just another dog. We humans seem to continuously compare the people around us with the 'norm' and we like to label those that are visibly different in a negative way, and those that are visibly different like to draw attention to that fact in demanding we level out the differences.

<comment><USER2> Interestingly, it's a popular viewpoint in the deaf community (at least here in the USA) that deafness is not a handicap at all and, in the opinion of a minority, is in fact an advantage over those who are hearing.

</comment></comment></comment></comment><comment><USER7> A free-flow toll road operator in Melbourne did something similar for the licence plate verification operators - they only hired deaf people, and their bosses learnt to sign.

The system automatically identifies the licence plate for tag-less vehicles using digital photography and OCR, but they are supposed to be verified, so the operators flip through the images quickly and look for mismatches.

</comment><comment><USER8> In Denmark there is a company called Specialisterne (The Specialists) that only hire people with autism as software testers. It's a huge success as some types of autism is perfect for extremely repetitive work as it both improves the actual testing and even better the autist loves it.

<http://www.specialisterne.dk/>

</comment><comment><USER9> Neat. There's a group in Cambodia that teaches blind people massage so they can make a living. It's great to help people use the abilities they have.

</comment><comment><USER10> Good stuff. In my small town one of the two super markets hires people with disabilities and that is one reason I do my shopping there.

A good friend has been deaf since she was about 4. She has accomplished a lot in her life, but many things are difficult for her.

</comment><comment><USER11> It's inspiring to see entrepreneurs fill gaps that many governments leave behind when it comes to accessibility and the workplace. Thanks for the great post.

</comment><comment><USER12> Toronto has a similar courier service that only hires people with mental health issues: <http://www.awaycourier.ca/>

They use public transit for pick-ups and deliveries.

</comment><comment><USER13> That is a _great_ idea assuming they're not bicycle couriers - that seems pretty dangerous in a city like that.

</comment><comment><USER14> This is _awesome_.

<comment><USER15> yes, it is.

"social element is embedded in the commercial operations" is something I want to remember.

Can't help but think that, should this happen here, someone would try and sue - which is sad.

<comment><USER16> i saw muhammad yunus (grameen bank) speak a couple years ago and "social element is embedded in the commercial operations" is almost verbatim how he said he thinks about building his businesses.</comment></comment></comment>


Corrupted initramfs during boot (2012) - <AUTHOR> http://blog.krill.se/2012/12/06/corrupted-initramfs-during-boot

<comment><USER2> That's a pretty good one! There are many ways for the bootloader to screw you even after it has passed control away from itself. I think my favorite similar story is when Matt Garrett discovered this on a Mac which forgot to shut off its wireless card's DMA controls before passing control into a UEFI client: [http://mjg59.dreamwidth.org/11235.html](http://mjg59.dreamwidth.org/11235.html)

</comment><comment><USER3> Great debugging work there! (Try doing that on a closed-source OS!)

</comment><comment><USER4> Sounded like too small of a debouncing cap/s on/around the nic, undersized vcc/gnd planes and/or too small of a power supply to handle peak current.

The other thing, once a system is booting, is always make sure RAM, storage, CPU and nics are all working, so test those individually: memtest86+ (or rowhammer or latest memtest86 non-plus), iozone, prime95, iperf or their equivalents.

<comment><USER5> The real explanation is near the end of the post -- the Ethernet controller was inadvertently left doing DMA to a buffer that overlapped with the initramfs.

</comment></comment><comment><USER6> I'd go ahead with debugging without the debug symbols - it's not hard at all if you know Asm and have the source code available as it's usually quite easy to figure out where in the source you are.

Then again, gdb is a relative pain to use without source so it does seem to discourage doing that.

</comment><comment><USER7> Sometimes it makes sense to start from the kernel level and work downward. With symbols and source loaded, it's often faster to fully debug a complex userspace problem. You can jump in and out of kernel space easily.</comment>


Palantir Pricelist (page 27) [pdf] - <AUTHOR> https://www.gsaadvantage.gov/ref_text/GS35F0086U/0MII0P.2RKUT8_GS-35F-0086U_PALANTIRTSCS012814.PDF <comment><USER2> For folks who've never seen one of these.

132-33 - Price for a Palantir server, priced per core. $141k per core. Includes 1 year of "maintenance" (support and software upgrades).

132-34 - This is the maintenance for second year on. $28k per core.

How many users can a core support? I dunno. But let's say you can serve 50 people off of a 4-core system (you can redo the math for the number of users).

You initial purchase is $564k. Or about $11k per user.

Each year after that, if you want software updates, it'll cost you $113k or or about $2.2k per year per user.

So let's say you use the system for 3 years. That's over $15k of software per user over that time.

Plus there's training ~$2k per user. Or another $100k in training costs.

And then who knows how many hours of engineering and "ninja" services. But a CONUS (within the U.S.) FSR is billed at about $300k per year for a full-time person on staff. Let's say you need two of them to support those 50 users.

Added up for 3 years of Palantir: $1.5million

I'll let you decide if that's good value, but that works out to around $30k per user partial TCO (not including power, security, networking, local IT staff support, etc.).

<comment><USER3> I've done a bit of work with Palantir. This is basically spot on. They're really cagey about the core/user requirement in real life so I'd be comfortable in saying most customer over purchase cores. They usually staff 2-3 full time guys for every 30-50 people and the implementation takes _forever_. I know of more than one place that didn't have a working system a full year after purchase. Meaning the maintenance had already expired on that first year.

Your later comment about the crack model is also spot on. There's a fairly long list of disgruntled places that bought on discount and are now being hit with huge O&M maintenance fees and are looking for a way out. I think they're government customers are slowly going away.

They're starting to show up more overseas here. Palantir recently opened up a Seoul office. But how much of whatever business they get out of it is government and how much of it is commercial is anybody's guess.

<comment><USER4> Sounds... Actually doesn't sound as bad as SAP, Europe's largest software package/manufacturer for... IDK, business software. IIRC, every implementation requires you to hire half a dozen SAP engineers for a decent hourly rate just to set up the system, then keep them on to train and maintain the system.

<comment><USER5> Former SAP guy here. Yup, on the surface Palantir appears to be cheaper and more specialized. Slightly different business model - Palantir does the software/hardware/implementation whereas SAP focusing mainly on software.

</comment></comment></comment></comment><comment><USER6> All right in line with just about any sort of "Enterprise" software. Training and implementation services are downright cheap. Maintenance is the standard 20%.

The last big vendor PO I had to look at put every professional services line item at $300-360/hr with $320 being about average.

<comment><USER7> Also Palantir's software actually does something more challenging than a lot of enterprise software.

People should go and see what small packages from Oracle, HP, Tibco & IBM cost. It's incredible.

<comment><USER3> Funny you should mention that. Palantir's main competition in the governmeent, i2, is now IBM.

i2 was selling their software at some fraction of Palantir's and in the DoD space it's basically as ubiquitous as Microsoft Office. Palantir is everywhere, but it doesn't end up being used nearly as much.

</comment></comment></comment><comment><USER8> Favourite part: "Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien."

<comment><USER9> Funny, but necessary. The Zaentz company is notoriously litigious. From Zaentz' Wikipedia article: "In 2011, Zaentz's company began several legal actions against small businesses in the UK to enforce their "Hobbit" trade mark, including the Hungry Hobbit cafe in Sarehole, near Birmingham[13][14] and a pub in Southampton, England, which had traded as The Hobbit for twenty years.[15] This raised the ire of many British correspondents such as Stephen Fry, who described it as "pointless, self-defeating bullying."

<comment><USER10> As a somewhat frequent visitor to The Hobbit in Southampton, the litigation is laaaame.

</comment></comment></comment><comment><USER11> Do not confuse the GSA schedule with actual implementation cost (or TCO as mentioned below). The prices are a starting point and as with any relationship, they can (and will, if the buyer is smart) be negotiated.

Source: sold & implemented alot of software for the gubbmint.

</comment><comment><USER12> _Agencies can browse GSA Advantage! by accessing the Internet World Wide Web utilizing a browser (ex.: NetScape)_

</comment><comment><USER13> You can't do diddly with an off the shelf install. They get you on the Implementation Ninjas and Support.

<comment><USER3> Their implementation periods are horrendous. Their marketing speak and sales drones make it sound like a turnkey appliance...like you just drop it in, point it to your database URLS and you're now playing with knowledge management. But in practice there's months of custom backend Java development (the entire tech stack is Java 1.6 or something horrible) to build the connectors and map the data into their backend, then months of ontology management meetings to build up the one-true-model (TM) for all your enterprise needs.

Then months and months of post deployment tweaking and continuous work to keep the system alive and fix issues when some of the data sources change schemas or something.

I've heard things like average time from purchase to full deployment is something like 9 months. But from my time dealing with them I think it's much longer.

<comment><USER14> That is simply FUD – Palantir guarantees to customers that their software is working within 90 days AND has generated results. They offer a refund if not. Their homepage said this for a while!

<comment><USER3> Well, feel free to buy a core and let me know how long it takes before you're up and running. Having been on the inside during 3 of their deployments, and on the outside of 2 more, I can definitely say 90 days is wildly optimistic.

 _edit_ never mind, after reviewing your comment history, it looks like you probably work for Palantir. You should probably disclose that. I stand by my comments about deployment times.

</comment></comment></comment></comment><comment><USER15> So what exactly do you get for those prices? Some data munging and analytics? Just hire a few data scientists and give them a map/reduce cluster. But this is the government so that might be more expensive than forking over the cash to Palantir.

<comment><USER2> It's less automated data analytics and more chart drawing and semantic knowledge base management tied to a federated search system.

Their principle competitor is [http://www-03.ibm.com/software/products/en/analysts- notebook](http://www-03.ibm.com/software/products/en/analysts-notebook)

They used to have a free trial you could run via java webstart on their website, but they've taken it down.

Here's a video [https://www.youtube.com/watch?v=f86VKjFSMJE](https://www.youtube.com/watch?v=f86VKjFSMJE)

It's big data in the sense that using google's search box is big data. But from my time using their demo a couple years ago, the actual tool is fairly small in focus. I don't even think the chart view can show more than a few hundred things.

<comment><USER16> It's still up: [https://analyzethe.us/](https://analyzethe.us/)

<comment><USER2> Oh okay cool. That's a different demo. The old one was Operation Tradewinds or something.

<comment><USER16> Tradestop is what you're thinking of.

</comment></comment></comment></comment></comment><comment><USER17> was this link not meant for the public? getting a 404 now.

mirror: [http://web.archive.org/web/20140916215429/https://www.gsaadv...](http://web.archive.org/web/20140916215429/https://www.gsaadvantage.gov/ref_text/GS35F0086U/0MII0P.2RKUT8_GS-35F-0086U_PALANTIRTSCS012814.PDF)

</comment><comment><USER18> 132-51 | IMS | Implementation Ninja Services

</comment><comment><USER19> If you read between the lines, notice how the "Palantir Gotham Appliance" for 151,042.82 includes "Palantir recommended...database software licenses."

I would bet Oracle (or MS/IBM) is getting a hefty chunk of that.

<comment><USER20> Yeah but it's only $10k a core more. This job posting lists Oracle and PostgeSQL:

[http://www.palantir.com/careers/OpenPosDetail?id=a0m80000002...](http://www.palantir.com/careers/OpenPosDetail?id=a0m80000002LiKaAAK)

</comment></comment><comment><USER21> 132-51 CONS CONUS FSR Support hourly rate. CONUS rates will be billed for Services performed outside the continental U.S. unless in a warzone. Normal business hours are defined as an 8-hour work day (rate is 15% more outside of normal business hours). $ 146.60

132-51 OCONS OCONUS FSR Support hourly rate. OCONUS rates will be billed for Services performed in a warzone. Normal business hours are defined as a 12-hour work day (rate is 15% more outside of normal business hours). $ 195.47

<comment><USER2> I'm actually surprised how cheap their OCONUS warzone rates are. Many contractors will pay hazardous bonuses, time in theater bonuses and living condition bonuses on top of the CONUS base pay. Added up it can far exceed this kind of rate.

But this is probably helpful for people getting into consulting to see what hourly rates are for this kind of work. In my experience these rates are actually fairly cheap. I'm used to seeing $170-200 for most things billed to the government.

But I've also heard Palantir has fairly conservative pay caps, that might account for the low rates.

<comment><USER22> What's a "time in theater" bonus? Never heard of the term & can't find it on Google either.

<comment><USER2> It's a bonus paid after spending n months in a warzone.

e.g. After 4 calendar months, $5000, after 8, $10,000.

Hazard pay is usually some percentage on top of base pay and if you're "lucky" and qualify for "living condition pay" it's another percentage on top of that. I have some associates here in the D.C. area that tell me at the height of the Iraq War they were pulling down ~$300k/yr all added up, on base salaries of $80-90k.

</comment></comment></comment></comment><comment><USER23> How do they get such precise prices? If I was selling something for 140k, I would sell it for 140k. But they sell it for $141,015.42.

<comment><USER24> It's GSA price. My guess is the retail price is somewhat rounder, and after tax and other specific discounts it comes down to that.

<comment><USER25> Strictly speaking, being on the GSA schedule and being able to offer products/services for sale to the federal government requires that you not sell that product/service anywhere else for less than that GSA price.

This is actually one of the reasons that doing business with the government is less lucrative than the commercial industry (for products and services which are comparable, many are things only sold to the government, so there is no hesitation about pricing them through the roof).

As you can imagine, one of the ways that duplicitous federal contractors get around the idea of having to sell to the government for less than their normal prices is to structure their products/services as different (and therefore not apples to apples comparable).

I still would bet that the price that they charge Goldman Sachs (just as an example, I don't actually know which investment banks are using their product) is higher than what they charge for any individual government client.

Also, I think it's probably worth noting that the maximum addressable customer base for their products for federal agencies is way smaller than the equivalent number of financial customers. There's really only a handful of agencies that have this capability (I'd guess more than a handful, but probably less than a dozen).

</comment></comment></comment><comment><USER26> So Palantir is hiring if you have a clearance :-). Time to get your tax dollars back. Looks like SAIC all over again.

<comment><USER27> You don't need a clearance. We have large commercial deployments.

<comment><USER2> I did some consulting work with the NYPD and heard you guys also have some deployments with them and other large police forces. Those are nice non- clearance, but cool, jobs as well.

<comment><USER28> "Cool" I guess, if you consider working for the NYPD to be cool.

[1] [https://en.wikipedia.org/wiki/Death_of_Eric_Garner](https://en.wikipedia.org/wiki/Death_of_Eric_Garner) [2] [https://www.aclu.org/blog/tag/nypd-muslim- surveillance](https://www.aclu.org/blog/tag/nypd-muslim-surveillance) [3] [https://en.wikipedia.org/wiki/Stop-and- frisk_in_New_York_Cit...](https://en.wikipedia.org/wiki/Stop-and- frisk_in_New_York_City)

<comment><USER2> I do.

All big organizations do bad things in specific cases and have problems that need to be addressed - the NYPD is no different. For every one of these examples I can point to a hundred cases where some officer put their life on the line to do their job and help do their part to make NYC a decent place to live.

To give you an idea of how big the NYPD is as an organization, it's about a third larger than the active duty _Army_ of Australia.

My couple times working with them showed most of the officers I encountered to be genuinely concerned about their city and a strong desire to do a good and fair job.

And yes of course there's lots of rallying together and supporting each other, even when that support often doesn't make sense to an outsider. But they really don't have anybody else they can rely on for their safety and support. And they take enormous flak and disrespect from the public on a daily basis for pretty much exercising any aspect of their function.

But as a large police force, the NYPD is basically a model for other large municiple forces and are heads and tails above deeply problematic large forces like the LAPD.

<comment><USER29> This conversation is totally beside any point, but stop-and-frisk has happened over 5 million times since 2002 (9 out of 10 leading to nothing), and a community of thousands were monitored based on their religion over a period of years, although it never generated a single lead.

>For every one of these examples I can point to a hundred cases where some officer put their life on the line to do their job and help do their part to make NYC a decent place to live.

Over 500 million times?

[http://www.nyclu.org/content/stop-and-frisk- data](http://www.nyclu.org/content/stop-and-frisk-data)

<comment><USER2> > Over 500 million times?

Yes, congratulations, you know how to multiply. You _know_ it was a figure of speech.

Anybody can make lists of good and bad deeds about an organization and point to why that list exemplifies some preconceived notion you already have.

Here's my list after 2 minutes of barely looking

[http://www.huffingtonpost.com/2014/03/02/nypd-saves- baby_n_4...](http://www.huffingtonpost.com/2014/03/02/nypd-saves- baby_n_4884928.html)

[http://www.nydailynews.com/new-york/nyc-crime/nypd- hospital-...](http://www.nydailynews.com/new-york/nyc-crime/nypd-hospital- village-shootout-article-1.1885720)

[http://7online.com/news/exclusive-hero-cop-speaks-out- about-...](http://7online.com/news/exclusive-hero-cop-speaks-out-about-wild- shootout-video/69315/)

[http://www.nydailynews.com/new-york/obama-praises-hero- nypd-...](http://www.nydailynews.com/new-york/obama-praises-hero-nypd- girlfriend-ceremony-article-1.1341515)

[http://nypost.com/2014/04/10/smoke-from-williamsburg- blaze-s...](http://nypost.com/2014/04/10/smoke-from-williamsburg-blaze- sends-2-hero-cops-to-hospital/)

[http://www.theblaze.com/stories/2011/12/13/nypd-hero-cop- kil...](http://www.theblaze.com/stories/2011/12/13/nypd-hero-cop-killed-by- recently-released-violent-felon-with-a-warrant/)

[https://en.wikipedia.org/wiki/Emergency_workers_killed_in_th...](https://en.wikipedia.org/wiki/Emergency_workers_killed_in_the_September_11_attacks)

[http://www.wnyc.org/story/nypd-includes-officers- died-911-il...](http://www.wnyc.org/story/nypd-includes-officers- died-911-illnesses-wall-heroes/)

[http://www.theepochtimes.com/n3/610520-hero-cop-dies-nypd- of...](http://www.theepochtimes.com/n3/610520-hero-cop-dies-nypd-officer-hurt- in-apartment-fire-dead/)

[http://www.silive.com/obituaries/index.ssf/2014/03/peter_mcp...](http://www.silive.com/obituaries/index.ssf/2014/03/peter_mcpolin_53_retired_cop_a.html)

[http://www.breaking911.com/hero-nypd-cops-save-man-from- jump...](http://www.breaking911.com/hero-nypd-cops-save-man-from-jumping-off- brooklyn-bridge-full-details/)

[http://epicvictories.com/nypd-officer-becomes-a-hero- after-h...](http://epicvictories.com/nypd-officer-becomes-a-hero-after- helping-a-barefoot-homeless-man/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> Archived version of this file on the Internet Archive.

[http://web.archive.org/web/20140916215429/https://www.gsaadv...](http://web.archive.org/web/20140916215429/https://www.gsaadvantage.gov/ref_text/GS35F0086U/0MII0P.2RKUT8_GS-35F-0086U_PALANTIRTSCS012814.PDF)

</comment><comment><USER31> pretty affordable compared to most enterprise software packages

<comment><USER32> "per core"

<comment><USER33> with 90 days warranty :) Can it rot?

Anyway, from their Gotham page [https://www.palantir.com/palantir- gotham/](https://www.palantir.com/palantir-gotham/)

"Working closely with the customer, our engineers integrate and map all of the relevant source data—regardless of type or volume—into a single, coherent model.

...

Once the model has been created, data flows continuously from its sources into the Palantir Gotham platform.

...

They can search across all of their data sources at once, visualize relationships, explore divergent hypotheses, discover unknown connections, "

Pretty much my 2009 pitch, and in the hindsight i see that my main weakness was that i couldn't even imagine $150K/core. Man, it is imagination what separates losers from winners! :)

<comment><USER34> > it is imagination what separates losers from winners! :)

Imagination and lucrative government contracts.

<comment><USER35> And a billion dollars that was used to pay off a competitor after stealing their technology.

</comment></comment></comment></comment></comment><comment><USER14> Pretty affordable considering many other things on the GSA don't work once you buy them!

<comment><USER36> Luckily for Palantir whether or not it works is classified. I have my doubts. I'm sure it "works", but I'm also sure it's a giant waste of money and Americans are not safer because we're funneling millions of dollars to Palantir.

<comment><USER2> I messed around with the demo they used to have on their website. It seems to be very much an answer to the 9-11 failure to connect the dots problem.

Unify search, build semantic links.

It was a _very_ manually intensive tool based on what I saw. Very little automation, more like those pictures and strings you see in crime shows on TV...but on a computer.

</comment></comment></comment><comment><USER37> Can't access gsaadvantage.gov via Tor. hmm</comment>


QuakeCon 2011 - John Carmack Keynote - <AUTHOR> http://www.youtube.com/watch?v=4zgYG-_ha28

<comment><USER2> The guy basically wrote an operating system (That's what megatexture really is, a complete OS VM and scheduling system) he's remarkably calm about it. Lesser men would be brag left and right about 1/10th of that sort of accomplishment.

</comment><comment><USER3> This guy is just awesome, i can only imagine how broad his knowledge as a graphics programmer must be going through all this from the very beginning, always delivering next generation gaming engines. Also love the fact that hes still a die hard coder after 20 years of doing this and doesnt want to stop anytime soon. Not to forget that he is a part-time rocket scientist :) Love this man!

</comment><comment><USER4> He mentions that he would like to use Haskell or OCaml at 1h10m25s (<http://youtu.be/4zgYG-_ha28?t=1h10m25s>).

</comment><comment><USER4> This was pretty different from most keynotes you usually see - he is very sincere about what could be better, that the game could have looked better if they ran it at 30fps instead of 60fps, what Intel could do better on their graphic chips, differences of developing for the PC vs consoles, how they could use being able to distribute more data than they can, ... Perhaps because he can do that because he's the boss?

</comment><comment><USER4> He talks about static code analysis tools around 55 minutes.

<comment><USER4> tl;dw: he looked at Coverity, found it expensive. They are now using Microsoft Analyze tools (appears to be something that comes with higher end versions of Visual Studio, Pvs Studio and PC Lint.

<comment><USER4> More excerpts:

\- "We're trying to write better code from the beginning in some ways."

\- "One of the lessons we took from Doom3 is that script interpreters are bad from a performance, development, debugging standpoint."

\- "Rage _still haves_ a little bit of script, from Doom3" (he means that in a bad way).

\- "In Doom4 we have something call Superscript, its scripting in a subset of C++..." (???)

\- "I'm all about trying to be nuch more restrictive about what we can do."

\- "I'm very tempted to wanna move to a functional language, Haskell or OCaml or something. But that is not a credible thing to do in the game industry. Because again, 49 people on our list.. I could probably convince a handful of them that we should move to a new language... but then, we're back to having performance issues, having a huge educational and hiring problem... so we got to stay with something that is C/C++ish based on there. But I think that it would be worthwhile to have restrictions to 95% of our code limit us to essentially the Java subset of C++, no unchecked arrays..."

\- "I write all my new code in pseudo-functional, but unless something is made impossible it will still creep into your codebase."</comment></comment></comment>


Startup Metrics - <AUTHOR> http://a16z.com/2015/08/21/16-metrics/ <comment><USER2> My colleague Ed made a cheat sheet for SaaS metrics [pdf] [https://chartmogul.attach.io/NkqgtF8H](https://chartmogul.attach.io/NkqgtF8H)

<comment><USER3> This is handy; thanks!

</comment></comment><comment><USER4> Just curious, did something happen during Demo Day presentations that made both Sam and AH write a blog post about this problem?

<comment><USER5> I don't think so... I think a lot of people screw it up though.

</comment></comment><comment><USER6> > "How and when revenue is recognized is governed by GAAP."

Being a CPA & coder this statement really annoys me, GAAP for those that don't know simply means "Generally agreed Accounting principals" and there is really no acceptable reason for this acronymn to be used outside of the (accounting) profession. Maybe it wasn't the authors intent but it smacks of those people who use jargon to help aggrandize their position when a simple inclusive explanation would have been more appropriate.

<comment><USER7> You're talking about two different issues:

1) Whether or not people outside the accounting profession should use the acronym 'GAAP'.

2) Whether people use the term as jargon to help aggrandize their position.

I have no comment on point 2. On point 1, though, my position is the polar opposite of yours. Business people in general (and especially CEOs!) should understand the principles of accounting, the ways in which transactions are recorded etc. If they don't understand these things, how are they meant to understand their company's financial statements? If they can't understand their company's financial statements, how are they meant to manage the company?

BTW - I am also a qualified accountant, although this is not related to my current job. I feel so strongly about these issues, though, is that I periodically run an 'Intro to Accounting and Finance' course for interested colleagues, and have delivered similar training courses at other large tech companies in the past.

<comment><USER6> Actually I agree with your points, my comment was made in a rush and on reflection is full of hubris. My complaint was with the article which is attempting to define terms for newcomers not defining this term. I didn't mean non accountants shouldn't use the term, I meant that use of this term as an acronymn without definition in a definitions of things article seemed inappropriate.

</comment></comment></comment><comment><USER8> As an engineer turned PM who might start a company some day, I've always seen financial literacy as one of my weaknesses. Companies are ultimately judged for their finances. Ignoring this subject is dangerous for a company's prospects, and illegal if it causes you to make misleading statements to investors.

If anybody is looking for further reading on this subject, I enjoyed "Financial Statements" earlier this year([http://www.amazon.com/Financial- Statements-Step---Step-Under...](http://www.amazon.com/Financial-Statements- Step---Step-Understanding/dp/1601630239)). Quick and straightforward, it starts with the vocabulary and explains the major financial statements (Income, Cash Flow, Balance). The majority of the book follows a company from inception to dividend disbursement, explaining how various business activities (e.g. signing a lease) hit the financial statements.

<comment><USER9> I would recommend a course in micro economics. Learning micro economics really changed how I think about finance. Anyone who plan to start a company some day should know how markets work, marginal return, opportunity cost, sunk cost, etc.

</comment></comment><comment><USER10> I really like the fact that this post first distinguishes "#1 Bookings vs. Revenue".

I hear it almost everyday among startups, where they talk about bookings, revenue and incoming payments interchangeably. And sometimes even in the same sentence such as "We made 100 k in the whole last year [meaning revenue], we currently make about 50 k per month [meaning bookings] and just last week we made another 30 k [meaning incoming payment]."

This makes it way to hard to properly communicate with founders. So great stuff this post.

</comment><comment><AUTHOR> Does anyone have an estimate on the average burn rate for a startup in San Francisco? Seems important these days, given talk of the end of easy money (see @bgurley)

<comment><USER11> [https://medium.com/@DanielleMorrill/is-my-startup-burn- rate-...](https://medium.com/@DanielleMorrill/is-my-startup-burn-rate- normal-882b2bd20f02)

<comment><USER12> It's abnormally risky to raise only enough money for 17 months of runway. I wish Mattermark the best, but this level of burn is not the most confidence inspiring.

<comment><USER13> From what we understand from investors, it is actually pretty typical to raise enough money for 18 months of runway. Additionally, we still had ~1.5m in the bank when we raised.

I will certainly report back on how it goes though!

</comment></comment></comment></comment><comment><USER14> I believe one of the tricker question is whether your revenue is truly recurring.

E.g. you may say consulting services or just charge monthly support subscription.

Especially in short term it is easy to convince yourself that it is recurring (e.g. monthly access to tutorials) when really churn is so high, since people use it on-need basis rather than long-term.

</comment><comment><USER15> Two questions:

How do you deal with refunds? Let's say a customer buys a product, for whatever reason their expectation not met, and a refund is issued. Do you adjust revenue in the month the revenue was recognized? Or do you add negative revenue to the month in which the revenue was received? Or something else?

And for average monthly growth rate, that can vary a lot for the same company depending on where you start. If a company has monthly revenues of 1, 6, 10, 12, 14, 15, 16, it has an average growth rate of 58% over the past 6 months, but 10% over the past three months (and 7% over the past month). I see startups using arbitrary start dates to inflate average growth rates, and am wondering if there's something standard when presenting this metric.

<comment><USER10> 1.) Refund: Yes, I would adjust the revenue in the month it was recognized.

2.) Monthly growth: It is actually really simple, you just caculate:

(16/1)to the power of (1/6) which equals: 1.58 This means the average growth rate was 58 %.

16/1 is the total growth rate for all 6 months. And to the power of (1/6) because it is calculated among 6 months

<comment><USER15> 1) For a business with consistent refunds in prior months (e.g. money back guarantee), this has the odd effect of always being able to show growth compared to previous months, even if revenue is constant.

2) Right, that's how I calculated 58%, but does it really make sense to calculate the base off of some arbitrarily low first-month revenue? Does it make sense that a company with strong first month sales should have a much lower growth rate than a company with abysmal first-month sales, given a certain current monthly revenue?

<comment><USER10> 1) If you expect a certain refund quota, lets say 20 % within 6 months, then you should already account for it: only account 80 % of the actual revenue and adjust this number after 6 months when you now the actual refund quota. This makes it more complicated but it would be the right thing to do and will help you get a somewhat decent financial plan.

2.) If your growth curve flattens out than this approach obviously does not really give you a good representation of how well you are currently doing.

</comment></comment></comment></comment><comment><USER16> > Active Users

What is a typical or good (active users)/(total signups) rate for a SaaS company?

<comment><USER17> This is sensitive to your definition of "active user", and what service you're selling.

It's normal to see a lot of attrition right after users sign up, especially if the lowest tier of the service is free. More interesting is how many users you retain after the initial kicking of the tires.

</comment></comment><comment><USER18> While great, this seems like not-so-easy work. Perhaps this is an opportunity for a company to charge a couple of hundred dollars monthly and create semi- automated reports for your investors.

<comment><USER19> Totally agreed. I've been consulting in this area for the past year now and it's a very common problem. One of the most powerful things you can do with these metrics is pull them on a regular basis and write updates. For example, write about how the week went and send it to the team. Or write about how the month went and send it to investors. Even if no one reads the updates, the exercise of just looking at the data and explaining yourself can really help you focus on what matters.

Tools like BareMetrics and ProfitWell do a nice job pulling revenue data via Stripe. Out of the box, tools like Mixpanel and Amplitude do a good job pulling giving you product and engagement metrics. It's up to you, though, to send all of the data over to those packages correctly and learn how to understand and interpret their reports. Other data, like burn rate, is often calculated back-of-the-napkin.

I'm working on a tool called Growth Report and shipped an MVP a little over a month ago. Hit me up if you want to check it out. email@example.com.

<comment><USER18> I do not have a product, and I have not raised any money, but if you have an MVP you should definitely post it here. This solves a real problem both VCs and entrepreneurs currently have. To the point where YC CEO and partners at A16Z (both leaders in their categories) have to write about it.

</comment></comment></comment><comment><USER20> unpopular amongst hackers, but really it takes a couple years of business school to learn real accounting, finance

</comment><comment><USER21> Regarding ...

> #5 LTV (Life Time Value)

Shouldn't the calculation factor in the time value of the money over the estimated life time?

[https://en.wikipedia.org/wiki/Time_value_of_money](https://en.wikipedia.org/wiki/Time_value_of_money)

<comment><USER22> It's a pure summative estimate, as I understand it.

I imagine that it's taken as the input for a net present value calculation by many investors.

<comment><USER23> Two equal LTVs could results in pretty different NPV results depending on the expected lifetime, and using both averages for the discount definitely has some error.

<comment><USER22> That's a good point. I'm reminded of von Neumann's quip that "with four parameters I can fit an elephant, and with five I can make him wiggle his trunk."

</comment></comment></comment></comment><comment><USER24> Since there's so much accounting in these metrics, anybody has a recommendation for good accounting software, or knowledgebase? Especially for hardware startups (e.g. building physical stuff, inventory, keeping track of component and parts)...

</comment><comment><USER25> great response to sama's blog post from earlier today

</comment><comment><USER26> Thanks for that, brilliant. Sticked!

</comment><comment><USER27> This is Entrepreneurship 101</comment>


Udemy is infringing upon my content [video] - vanilla-almond https://www.youtube.com/watch?v=K7snZrsKdGU <comment><AUTHOR> Troy Hunt had some problems with Udemy reusing his content too: [https://www.troyhunt.com/the-piracy-paradox-at- udemy/](https://www.troyhunt.com/the-piracy-paradox-at-udemy/) please do a quick google before paying them any money!

The blog post was from 2015 here more recently on the same topic: [https://twitter.com/troyhunt/status/922734598420815872](https://twitter.com/troyhunt/status/922734598420815872)

</comment><comment><USER2> I've bought courses on Udemy, and they have some quality content. But they've always seemed kind of shady with the whole "$200, now $10.99 with 2 days left". If you buy something, make sure you buy it in incognito mode, ublock, etc, so they don't jerk you around.

But I'm going to have to rethink my patronage of Udemy after this stuff.

<comment><USER3> > But they've always seemed kind of shady with the whole "$200, now $10.99 > with 2 days left"

I read about this from frustrated training content developers all the time. The pricing in particular, esp. w.r.t. programming / technical content which takes a lot of effort to put together, only to find that udemy forces you to list it at 10, 20$ at 70, 80% 'discounts'.

Don't want to re-hash but here are a few links....

Less than 24 Hours on Udemy as an Instructor and I Am Close to Leaving: [https://nickjanetakis.com/blog/less-than-24-hours-on- udemy-a...](https://nickjanetakis.com/blog/less-than-24-hours-on-udemy-as-an- instructor-and-i-am-close-to-leaving)

Why I stopped selling courses on udemy - The Udemy Pyramid Scheme: [http://osherove.com/blog/2014/5/7/why-i-stopped-selling- cour...](http://osherove.com/blog/2014/5/7/why-i-stopped-selling-courses-on- udemy.html)

My Revenue Increased 300% After Leaving Udemy: [http://www.courseminded.com/why-i-left- udemy/](http://www.courseminded.com/why-i-left-udemy/)

Why I Won't Be Releasing More Courses On Udemy, And Neither Should You: [https://www.linkedin.com/pulse/why-i-wont-releasing-more- cou...](https://www.linkedin.com/pulse/why-i-wont-releasing-more-courses- udemy-neither-should-mike-stemple-/)

</comment></comment><comment><USER4> Udemy has had this issue for years. Pluralsight & other authors complain on a regular basis. I personally refuse to use it.

<comment><USER5> YouTube has the same issue: people upload copyright-infringing material there all the time. Do you refuse to use YouTube as well?

In fact pretty much any platform that allows users to upload content has that sort of issues. The most common approach is to rely on other users to report violations and then take content down.

Why do some people feel they have to "boycott" some sites but not others? Genuine question, I'm interested to understand the reasons.

(Disclaimer: I published a few courses, including on Udemy. And I filed my fair share of takedown notices when unauthorized copies showed up on various sites, including YouTube.)

<comment><USER6> The difference is that a big part of YT's appeal is how open it is. Anyone can post pretty much anything.

With something like Udemy, where you have to pay for courses, Udemy needs to review every course before selling them. You need to check them for accuracy (which would mean having them reviewed by experts in the field), as well as verifying the author's identity and doing at least a cursory check for stolen content.

If Udemy /wants/ to be as open as YouTube, that's fine. It just means that it's no better in terms of guaranteeing accuracy, which doesn't make much sense considering you have to pay for courses. If Udemy and YouTube offer basically the same minimal guarantees that their content is accurate and not stolen, why would you ever use the paid service?

Because you have to pay to access courses in Udemy, you may not even be able to tell if a course is stolen or not without paying for it. Obviously, you'd be able to tell if it was stolen whole cloth, but if it's been paraphrased, you'll probably want to be able to look at more of the course to make sure it wasn't just a coincidence because someone else decided to do the same topic. Do you want to pay just to check if it's your own stolen work?

While I haven't done it myself, my understanding is that reporting stolen content on Udemy is unnecessarily difficult, and that Udemy generally takes a long time to take it down. Now, maybe that's not true (or maybe it's not true anymore), but that doesn't reflect well on them if it is/was.

<comment><USER5> I think many people just don't realize that Udemy is a "marketplace"[1]. Yes, anyone can publish a course there, provided it meets some requirements. In the early days, Udemy's stated goal was to "democratize online education"[2].

There is an "Instructor Identity Verification Process"[3] which should make sure publishers own the content. No idea why it didn't prevent this case.

There is no "review by experts in the field". Whoever publishes a course is responsible for its content. If a course is inaccurate users will give it bad reviews and it won't sell. And in any case buyers get a 30-day money back guarantee.

There is an online form to report copyright violations[4], which looks simple enough to me.

[1] [https://about.udemy.com/](https://about.udemy.com/) [2] [https://readwrite.com/2010/05/11/online-learning-startup- ude...](https://readwrite.com/2010/05/11/online-learning-startup-udemy- launches-with-plans-to-democratize-online-education/) [3] [https://support.udemy.com/hc/en- us/articles/229234067-Instru...](https://support.udemy.com/hc/en- us/articles/229234067-Instructor-Identity-Verification-Process) [4] [https://copyright.udemy.com/hc/en-us](https://copyright.udemy.com/hc/en-us)

</comment></comment></comment></comment><comment><USER7> I really wish some of the successful authors there would sell via their own websites. There's a few that I really like their courses and teaching technique, yet Udemy courses (always at $10-12 for courses that could sell for $200) are their only offerings.

<comment><USER8> Does anyone actually pay for those courses at the 200 Euro rate? They seem to be permanently knocked down from 200 Euro to 10 sort of like JC Penny or Penny's -- always on sale.

<comment><USER7> Years ago I think I may have before Udemy jumped the shark with the perma- discounts

</comment></comment></comment><comment><USER9> Ironically YouTube showed a Udemy ad to me before this video. So I guess at least he got paid indirectly by Udemy, even if it's a negligible amount and unrelated to the content they infringe upon.

</comment><comment><USER10> I use pluralsight, I've considered using Udemy, but certainly not after this, you should definitely be seeking legal counsel.

Dispicable of them.

<comment><USER11> Pluralsight has been my favorite training platform for some time now, luckily my company bought my subscription. Speed controls on video (typically do 1.5-2x speed) and ability to download a series to your mobile device. I like all the instructors I've come across.

<comment><USER12> Being able to watch at double speed is one of the main selling points of online video tutorials/MOOCs. Saves so much time not having to travel to the course location and then also getting the info twice as fast as natural pace.

</comment></comment></comment><comment><USER13> Read: [https://www.udemy.com/terms/copyright/](https://www.udemy.com/terms/copyright/)

If conditions satisfied, file DMCA complaint here: [https://copyright.udemy.com/hc/en-us](https://copyright.udemy.com/hc/en-us)

<comment><USER14> A company's "copyright usage terms" doesn't override law, so regardless of what are on those pages, the copyright owner can ignore it and take the proper, typical legal path to protect their IP.

<comment><USER13> Udemy's copyright usage terms and reporting requirements are in compliance with DMCA safe harbor provisions (specifically Section 512, including "notice and takedown" procedures) thereby limiting their liability to copyright claims.

[https://www.law.cornell.edu/uscode/text/17/512](https://www.law.cornell.edu/uscode/text/17/512)

Disclaimer: Not a lawyer. Not your lawyer.

<comment><USER15> Right which is why you start off by suing Udemy then you get your lawyer to give a legal demand to hand over the course uploader's information. Then you sue the uploader directly for piracy. They are not protected by DMCA.

Then again the uploader is probably a professional pirate who has concealed his identity wisely or they are just a foreign person who isn't even located in the USA.

<comment><USER16> Ironically:

[https://www.udemy.com/copyright-how-to-protect-your-work- fro...](https://www.udemy.com/copyright-how-to-protect-your-work-from-piracy/)

</comment></comment></comment></comment></comment><comment><USER17> Here is the course 'authors' page [https://www.udemy.com/user/niharika-23/?src=sac&kw=master%20...](https://www.udemy.com/user/niharika-23/?src=sac&kw=master%20code%20online) Interestingly no domain name or author name.

</comment><comment><USER18> DMCA takedown? Or if you can afford it, call a lawyer.

</comment><comment><USER19> We lost a six-figure affiliate deal last year because we unknowingly participated in their mass-discount package and the affiliate hauled us over the coals for having two deals going at once (which we had no idea was happening on Udemy). Painful.</comment>


Show HN: Find the Control Points of a Bezier Curve with Gradient Descent - <AUTHOR> http://nhq.github.io/beezy/public/ <comment><USER2> Great project. I don't think I've ever seen this visual of a representation of machine learning algorithm, specifically not a regression algorithm.

<comment><AUTHOR> Thanks!</comment></comment>


Ask HN: Good looking news/social media sites? - <AUTHOR>

The wired article about the craigslist redesign has got me wondering. We've all come across beautiful photography and design portfolios, but what about news and social media sites? Which ones would you consider to be efficient and aesthetically pleasing at the same time? <comment><USER2> <http://news.ycombinator.com>

</comment><comment><USER3> Since a couple aggregators were listed--the thing that troubles design for aggregators in my mind is that they are all just lists. You can put some color, some thumbnails on a list, but in the end, it's still a list.

What I find much more attractive and intuitive, when it comes to news, is a real front page, that echoes the old print newspaper front page, but pulls in extra real-time information boxes from other parts of the paper. There is a clear idea of a headline story, the size of each summary is varied, and it's full use of 2D space, instead of just going linear straight from top to bottom.

What I'm thinking of in particular is the New York Times <http://nytimes.com> ; since its last major redesign it has become very attractive and I have found myself spending more time clicking around within the site whenever I read it.

For comparsion, check out this old twin-list front page version of NYT: [http://web.archive.org/web/20031203020804/http://www.nytimes...](http://web.archive.org/web/20031203020804/http://www.nytimes.com/index.html)

This does also have to do with their strategy for fighting the aggregators (so it's not just a design question): 1) writing their own blogs and 2) syndicating blogs where they are short. Sort of out-aggregating the aggregators.

<comment><USER4> As a matter of personal opinion, I prefer lists to newspaper style layouts. With the new york times site, my eyes wander, never actually reading anything. I lose focus very fast and move on. With HN, though, I will invariably read every title. Lists are not overwhelming to me like many other layouts are.

</comment></comment><comment><USER5> <http://www.kontain.com/>

</comment><comment><USER6> <http://popurls.com/> and <http://alltop.com>

</comment><comment><USER7> <http://www.newspond.com/>

Some may argue that it isn't efficient enough, though.

</comment><comment><USER8> I really like <http://www.oursignal.com/> In fact, it's how I came across this.

<comment><USER9> That looks very cool. I just don't think it's a very efficient way of getting the information across.

<comment><USER8> It may be inefficient, but it's an easy way to find out popular new posts and filter through the noise on, not one, but multiple websites.

</comment></comment></comment><comment><USER10> For more of a niche:

<http://windycitizen.com>

</comment><comment><USER11> I've always been impressed by Newsvine.

<http://newsvine.com>

They fit a lot of content on the page in a well laid out manner that I haven't seen on many sites.

<comment><USER12> Hm, I find that page horribly crowded with way too many boxes and way too much small text.

</comment></comment><comment><USER13> <http://beta.thehindu.com>

disclaimer: I work for that company.

</comment><comment><USER14> <http://www.ted.com/>

</comment><comment><USER15> I like <http://mixx.com>

</comment><comment><USER16> the browser: <http://thebrowser.com/>

</comment><comment><USER17> nowpublic.com

</comment><comment><USER18> <http://faircompanies.com> (sustainability stuff.)</comment>


Roche CEO's says some Covid-19 antibody tests are a disaster - <AUTHOR> https://www.reuters.com/article/us-roche-results/a-disaster-roche-ceos-verdict-on-some-covid-19-antibody-tests-idUSKCN2240JS <comment><USER2> "Chief Executive Severin Schwan said on Wednesday as he prepares to launch the drugmaker's own antibody test next month."

chevy calls fords new car garbage.

<comment><USER3> But he still has a point.

Pushing all manners of unreliable tests will makes matters worse for everyone.

Any test will need a very high degree of reliability or you'll end up with large numbers of people being quarantined for nothing or, worse, large numbers of people with the virus allowed to roam free as they believe they are not carrying it.

<comment> Spartan-S63 The other issue is that we don't know what concentration of antibodies is required for immunity. We know these things for other diseases, like influenza, chickenpox, etc. We have no point of reference, so we can only test for the presence of antibodies.

I think antibody tests are still likely to be useful, especially in collecting data on the pervasiveness of the disease and getting information to find out what threshold immunity occurs at. The messaging around them is rife for misuse, though.

Everyone is looking for a silver bullet, but all we can do right now is the long, slog of science to get to a place where it's truly safe to try to return to a semblance of normalcy.

</comment></comment></comment><comment><USER4> I agree, the people who want "the red tape eliminated — lives are at stake" are nuts. Garbage data is garbage data and getting it sooner doesn't help.

False negatives can cause someone contagious or sick to go out and infect others; false positives can cause unnecessary treatment and take up hospital resources that should have been spent on actual patients.

<comment><USER5> From what I gather a false positive for an antigen rtPCR is essentially impossible. The primers are extremely specific and can't find something that isn't there.

A false positive for an antibody test is unlikely to take up hospital resources. They admit people to the hospital for symptoms like dyspnea/hypoxia. Not because the patient tested positive on either the antibody or antigen test. The danger in a false positive for an antibody test IgG or IgM, means gives the patient a false sense of security that they've already gotten the virus and are thus immune in the short to medium future.

<comment><USER6> >a false positive for an antigen rtPCR is essentially impossiblee. The primers are extremely specific and can't find something that isn't there.

I read somewhere that among the reasons for a false positive would be cross- contamination among samples.

Just because the primers find something in the sample, doesn't mean that that something isn't in fact merely a bit of cross-contamination from another, true positive, sample.

<comment><USER7> I was watching this video earlier tonight:

[https://youtu.be/Vat-PKdQ13A?t=30](https://youtu.be/Vat-PKdQ13A?t=30)

That looked like some really sloppy lab technique, and I hope that's not how it is really done in practice. If real tests are done by hand like this, with distractions, open air, and no mask on the technicians, it's easy to imagine false positives.

</comment></comment></comment></comment><comment><USER8> So how statistically independent is the error between serological tests? If we make 5 tests on the same blood sample and go with 3 or more out of 5 rule, would that help with FP and TP?

</comment><comment><USER9> Proportionality frequently seems to escape journalists, why be satisfied with reports being confined to the qualitative and non-quantified realm? Give us some background please. In this molecular diagnostics domain what are typical figures for sensitivity and specificity? FDA lays down requirements for such things right? Anyone know off-hand what percentages are required for a diagnostic testing product to be released? For these tests in question how far off from those marks are we exactly?

<comment><USER10> There is no "typical" I'm afraid. Whether a test is useful or not depends on error rates, priors, and application of the result.

For example, consider this scenario:

\- Virus has R0 of 2.5

\- the test for the current infection (i.e. not antibody) is cheap and abundant

\- the test has 20% false positives

\- the test has 20% false negatives

\- Application: test every single person and confine everyone who tested positive to their homes, releasing the rest. Repeat weekly. Take no other action.

Result #1: 20% of the population are in isolation. 20% of your economy is stalled, rather than 100%.

Result #2: 1 in 5 infected will go undetected. Still 4 out of 5 are isolated, reducing the number of infected out there by a factor of 5, therefore your R0 drops from 2.5 to 0.5 The number of infected people on the street gets cut in half every week. Epidemic fizzles out.

So even low-precision tests are useful. What is useless is tests that do not have a reliable metric for false positive / negative. Which is what many of the AB tests are.

<comment><USER11> "Result #1: 20% of the population are in isolation. 20% of your economy is stalled, rather than 100%."

This bugs me, because in this hypothetical, you're implying something as a point of comparison which is nothing like reality. 100% of the population is _not_ in isolation - the only people who are in isolation are those who have had such severe symptoms they've been tested and it came back positive, or they're really obviously linked to such a person. And obviously 100% of the economy is not stalled; it may not be precisely clear what the impact is so far, but people are talking about _single digit_ GDP percentage point declines. If you frame that as the worst economic news since the great recession, or put it in context with the job losses, it's pretty bad, but it clearly could be ten times worse and it's not.

I get that maybe you meant it as just an example and specifics aren't important to your point about statistics, but I feel like I've read similar posts to yours that kind of get the nonsensical scenario out there, that we've shut down "100%" to where people kind of get used to it even though it's not reality.

<comment><USER12> US's isolation started very late in Q1. It requires a very large decline to average out to 'just' 1%.

<comment><USER11> I don't feel that makes a difference to what I just wrote. But I can do some very rough arithmetic along those lines to see what the decline would have to be.

The GDP figure just reported is -4.8%. Based on what I recall, the inflection point was about halfway through March. Friday the 13th is when the state government in NY finally said anyone who can, work from home. That's 0.5/3 months or ~17% of the quarter I'd assign to "shutdown".

0.83 * 1 + .17 * x = .952

...I don't trust myself to do high school algebra, so I asked Wolfram Alpha and it said x = 72%. Ok, so the reported figure of nearly -5% probably equates to a little over a quarter of the economy missing.

I don't think I need to concede my point about a 100% stoppage not happening.

<comment><USER12> The larger point stands it's just 'but people are talking about single digit GDP percentage point declines' that I was correcting. That said, Pennsylvania and several other states waited until April to order a shutdown, but the observed GDP decline was annualizing a ~1% though there was growth in the ready of Q1.

Long story short, that 4.8% is absolutely worthless.

<comment><USER11> The bit you quote from me seems strictly accurate; by single digit I mean < 10%. That is what the news is reporting. It is factual, and my inference that the economy is not shut down hasn't been questioned.

Saying that the difference is larger when you consider only part of the quarter is correct too, but 4.8% is not "absolutely worthless", it just needs to be interpreted properly.

As in my previous comment, you can approximately derive the actual amount of decline, which is a fraction of a complete shutdown.

<comment><USER12> By absolutely worthless I mean it's a meaningless calculation. They take the actual change averaged out over a quarter, and then assume 4 more quarters will have exactly the same thing happen.

It's a common calculation used to make quarterly numbers seem more important, but it's at best misleading if not actively deceptive.

<comment><USER11> Wait, wait, wait. Nothing is "meaningless" if it contains information. And "misleading" depends entirely on context.

It sounds as though you are suggesting I made an error that _increases_ the apparent size of the shutdown, meaning it is actually _smaller_ and my claim is _stronger_ than I thought.

If the figures are annualized (I checked* and I think you're right) then it improves my original point - the 4.8% decline becomes 1.2% un-annualized, and the normal trend of +2% becomes +0.5%.

The equation should then be something like .167 * x + .833 * 1.005 = .988, "x" being the percentage of the economy active in the last half month, or about 90%.

I'm confident that there is information in the reported figure and that no reasonable calculation can show the economy was shut down completely.

*[https://www.bea.gov/data/gdp/gross-domestic-product](https://www.bea.gov/data/gdp/gross-domestic-product)

<comment><USER12> You're ignoring information that you disagree with. Yep, of the multiple errors in your calculation, one of them lowers the estimate. But, I never said anything about a 100% shutdown just that single digit comment.

Going in the other direction, picking the earliest possible starting date underestimates the impact as does ignoring panic buying. Layoffs where also not instantaneous, and people's final paychecks are delayed etc. All of this is going to show up in Q2 numbers even if many states are scaling back their shutdowns.

As to being a meaningless calculation, you're describing a reversible calculation not a useful one. I can type a message in ROT13 and the result contains the same content, that does not make me doing the ROT13 useful.

<comment><USER11> "You're ignoring information that you disagree with"

You're the one saying information is "meaningless", and at the same time I don't see any alternative data that you've provided. You're just making general statements that sound to me like the fallacy that imprecision means no information.

In your first reponse to me, you wrote: "It requires a very large decline to average out to 'just' 1%"

So, "very large" is subjective, but I don't think 10% is "very large" _in the context of people talking about 100% of the economy being down_.

<comment><USER12> > imprecision means no information

It's imprecise enough that you're better using other means to estimate the decline. I am between 1cm and 1 mile tall, is true but does not convey new information.

Similarly without knowing how fast was the economy was growing or shrinking before the decline, the decline hit, when peak decline hit, it's impossible to say how bad things where at the end of the quarter beyond well it's worse. I mean presumably when news of the outbreak hit but before the shutdown there was some effect, but I don't know if it was a net positive or negative.

If you want numbers I would say 10+x larger is objectively a very large decline relative to 1%. Anyone talking about a 100% shutdown while still buying food is being using hyperbolic or simply does not understand what their words mean. It's at best symbolically true in that net wealth is being destroyed so the engine of human progress has shut down.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> So do we have any data showing that the presence of antibodies equals immunity? What exactly is the test telling us as of today?

<comment><USER14> Antibody tests also help estimate how many people have been exposed to sar- cov-2, which helps in making more accurate epidemiological models...</comment></comment>


What's the use of if __name__ == '__main__': in Python? - <AUTHOR> https://dev.to/wangonya/what-s-the-use-of-if-name-main-in-python-3eo5 <comment><USER2> Does not run the entirety of the script UNLESS it's the main program.

So if you're using the script as part of something else, it isn't main. It won't run. It'll instead be run through another script that references it.</comment>


New York's Uptown Rats Are Genetically Distinct from Downtown Rats - <AUTHOR> https://www.citylab.com/environment/2017/11/new-york-city-has-genetically-distinct-uptown-and-downtown-rats/547088/ <comment><USER3> > Rats, although abundant, are not easily fooled into traps. They're wary of > new objects. To entice them, the bait was a potent combination of peanut > butter, bacon, and oats.

They pulled out the big guns. Bacon!

<comment><USER4> Unless they plant to study them alive or release them when done (ha!) they could have just shot them. It would have been a far better use of everyone's time (and the money of whoever paid for the research) and allowed a more accurate sample of the rat populations as opposed to a sample of the rats that like bacon and don't hate new objects quite so much (the difference in samples is probably negligible but it's still something that must be accounted for).

[https://en.wikipedia.org/wiki/Rat-shot](https://en.wikipedia.org/wiki/Rat- shot)

<comment><USER3> I don't think the police would appreciate it if you started firing off guns in the middle of the city. It would be a far better use of everyone's time and money to just set traps. Are you thinking people would pitch tents and wait for rats to show up so they could shoot them? That seems harder than setting traps and checking in a day later.

<comment><USER4> >I don't think the police would appreciate it if you started firing off guns in the middle of the city.

We're talking on the order of a hammer on steel here.

I was under the impression. trapping was happening indoors. Go somewhere you know there will be rats, pop a few, toss them in a bucket, wash rinse repeat. Depending on who the research is being done under it would only take a call to whatever department (probably something having to do with trash) you want the undergrads to tag along with for a shift to collect rats.

>That seems harder than setting traps and checking in a day later.

Going to where you know rats will be once to shoot them is easier than going twice to set and retrieve traps.

<comment><USER3> Rats aren't just sitting around waiting to be shot. They're very cautious and often hard to spot.

Where you can see them scurrying about there's often lots of people and other distractions, equipment or other obstacles that would make shooting them impractical.

I don't think the NYC subway crew would take too kindly to people shooting up their equipment to get rats.

</comment></comment></comment></comment></comment><comment><USER5> A few weeks ago there was a post about Crowded Cities, a startup trying to train crows to pick up and throw away cigarette butts in the city for a food reward. I'm sure it'd be harder, but could crows also be incentivized to somehow pick up rats?

[http://www.crowdedcities.com/](http://www.crowdedcities.com/)

<comment><USER6> It would be amazing if they could get the crows to collaborate, e.g. two crows carrying away a rat. Probably impractical but I love the idea.

<comment><USER7> They'd have to have it on a line.

</comment></comment></comment><comment><USER8> Isn't there a Billy Joel song about this?

<comment><USER9> That song popped into my head when I read the headline!

<comment><USER10> _Uptown mammal..._

<comment><USER11> If only this article were about squirrels :P

</comment></comment></comment></comment><comment><USER12> No mention of the infamous Pizza Rat, the unofficial mascot of NYC?

Or the Avocado Rat - Pizza Rat's hip cousin living in Williamsburg?

<comment><USER13> Pizza Rat is mentioned in the first paragraph, with a link to a Buzzfeed article on it.

"New York City is a place where rats climb out of toilets, bite babies in their cribs, crawl on sleeping commuters, take over a Taco Bell restaurant, and ___drag an entire slice of pizza down the subway stairs._ __"

</comment></comment><comment><USER14> I wonder if this is true for other city species. Are there distinct raccoon populations? What about birds and cockroaches?

<comment><USER15> Before considering rats, this research group started by looking at white- footed mice. [1]

> The mice have become so genetically distinct from one another that if you > show Munshi-South a DNA sequence randomly selected from a white-footed mouse > in NYC, he can tell you where it lives. At the same time, city mice as a > whole also seem to be evolving new traits that mice from rural areas outside > the city lack…

[1] [http://nymag.com/daily/intelligencer/2015/01/uptown-mice- are...](http://nymag.com/daily/intelligencer/2015/01/uptown-mice-are- different-from-downtown-mice.html)

This is an older article, from when their first studies were coming out.

[2] [http://www.nytimes.com/2011/07/26/science/26evolve.html](http://www.nytimes.com/2011/07/26/science/26evolve.html)

Both articles also discuss other species, but it seems like the focus is usually on genetic differences between urban and rural populations, or polluted versus not polluted, and not on intra-urban genetic variations.

<comment><USER14> Your quote stopped right where I started to get interested, so for the benefit of others:

> _At the same time, city mice as a whole also seem to be evolving new traits > that mice from rural areas outside the city lack: genetic mutations that may > help them neutralize toxic metals in polluted soil, for example, or speed up > their sperm in response to the intense sexual competition in their > overcrowded metropolitan homes._

I wonder why they seem to be a little hedgy around the toxic-metal-mutation bit. I'm guessing they suspect that that's what the mutation does, but don't particularly want to feed the poor mice toxic-metal laden soil just to confirm.

<comment><USER3> Some populations of city mice are ridiculously hardy. They can eat warfarin- laced poison food like it's candy.

It's like the roaches in some Washington D.C. buildings that are immune to virtually every chemical used for pest control. It's so bad that chemical companies test new compounds on those populations first. That's what decades of selective breeding has brought about.

<comment><USER16> > They can eat warfarin-laced poison food like it's candy.

question : where does such food come from, and why?

<comment><USER3> It's a common rat/mouse poison. Cheap to manufacture.

</comment></comment></comment></comment></comment></comment><comment><USER17> I guess a similar thing will happen with the various Orca ecotypes, given that they don't inter-breed: [http://uk.whales.org/wdc-in-action/meet-different- types-of-o...](http://uk.whales.org/wdc-in-action/meet-different-types-of- orca)

</comment><comment><USER18> Maybe they should compare the city mouse and the country mouse next.

<comment><USER19> That's actually linked in some of these comments. Yup, there are some differences there too : )

</comment></comment><comment><USER20> Can mods update this to link to the original article? [https://www.theatlantic.com/science/archive/2017/11/rats- of-...](https://www.theatlantic.com/science/archive/2017/11/rats-of-new- york/546959/)

I doubt The Atlantic would have given citylab permission to republish it like this.

<comment><USER21> The Atlantic and citylab are the same company. Of course they are cross- posting.

</comment></comment><comment><USER22> Not rats but humans, very interesting : [https://www.amazon.com/Troublesome- Inheritance-Genes-Human-H...](https://www.amazon.com/Troublesome-Inheritance- Genes-Human- History/dp/0143127160/ref=sr_1_1?ie=UTF8&qid=1512152139&sr=8-1&keywords=troublesome+inheritance)

</comment><comment><USER23> Is a matter of time that we'll start seeing rat hair as proof in the trials.

</comment><comment><USER24> This article made me laugh, I can't help but wonder if this is some kind of fake news story to promote a class based agenda. I guess it could be true but it seems very odd that these rats traveled all the way from Europe, made their way into the city from the docks, yet somehow decided to stay put for half a millennia once choosing a Manhattan burrough.

<comment><USER25> The article doesn't say anything like that at all. The rat "neighborhoods" do overlap, but not densely (think of the islands of wooded areas in a ski resort). In such a case it's not unreasonable to see speciation. (which is not described in this article, thus implying continued interbreeding.)

You don't need a lot of territory for this to happen. The lice that specialize in humans have split into two distinct species: one for head hair and one for pubic hair. (and allegedly the latter is under threat).

<comment><USER26> Human lice haven't split into two distinct species; the "human" lice - <USER2> ones that have been with us for as long as we've been around - are now head lice, and we picked up pubic lice from gorillas after we "lost" most of our body hair. (It's still there, of course, but not in a way that's useful to lice.)

<comment><USER27> > we picked up pubic lice from gorillas after we "lost" most of our body hair

Can we, uhh, not mention this to any alien species we may encounter in the future?

<comment><USER28> We should present it early in hopes that they never go out of quarantine.</comment></comment></comment></comment></comment>


A Guide to Undefined Behavior in C and C++, Part 1 - <AUTHOR> http://blog.regehr.org/archives/213

<comment><USER2> What is particularly interesting to me is the part where he describes why the "I should be able to expect two's complement semantics when 32-bit signed integers overflow" line of reasoning is incorrect.

When I first learned about two's complement, I honestly didn't believe that that is how negative numbers were done. So I wrote a C program to test a bunch of integer operations and printf("%x") the result.

It was neat - here I learned something in assembly, I was curious, I observed the same behavior in my C program, and formed the connection between C, the underlying assembly, and how the architecture worked.

And then this article came along and said that _even if_ your C program behaves a certain way, that is no guarantee that that is how the program will work in the general case. The C specification doesn't mandate that two's complement be used.

Which is a weird feeling; in programming, we can construct a program to test any assumption we want ("I wonder what would happen if..."). But even that is of limited value in telling us how the language works or how the program behaves in the general case, even if the language itself is intended to be cross-platform.

The "just write a program and see what happens" is not as reliable of a way to find a language's boundaries as I'd once thought!

<comment><USER3> For me, the second stage in the evolution as a C or a C++ programmer after a discovery like this was to start relying heavily on language standards. After all, it's the ultimate reference about how the language should work on all platforms and compilers.

But then I learn that not all compilers behave exactly the same way, or implement only a subset of a standard for a variety of reasons (every compiler would implement different subsets), and I return full circle back to experimentation with individual implementations.</comment></comment>


So you want to be a "real" programmer?(2011) - <AUTHOR> http://www.gamefromscratch.com/post/2011/06/05/So-you-want-to-be-a-%E2%80%9Creal%E2%80%9D-programmer.aspx

<comment><USER2> yet its so difficult to find the good technology to learn & adopt, since several languages & frameworks are created and fail everyday.</comment>


Ask HN: how to read HN on iPhone/iPad and save links on Pocket? - <AUTHOR>

I use 'Hacker News (YC)' (https://itunes.apple.com/us/app/hacker-news-yc/id713733435) and 'news:yc' (https://itunes.apple.com/us/app/news-yc/id434787119?mt=8) to read HN on my iOS devices. I used these apps to save the links I read & liked on Pocket (so I can share it later on Twitter with my own blurb from the desktop). However, the iOS 7 versions of the 'Hacker News (YC)' and 'news:yc' no longer have the 'Save to Pocket' functionality. Any ideas for the replacement? <comment><AUTHOR> Flipboard doesn't work for me as it shows links from twitter.com/hnycombinator and doesn't keep the original order (sorted by <# of points/exp^time since submission>).

</comment><comment><USER2> My app does:

[https://itunes.apple.com/us/app/news- yc/id592893508?mt=8](https://itunes.apple.com/us/app/news-yc/id592893508?mt=8)

</comment><comment><USER3> Follow any HN twitter handle and use [http://ctrltwit.com](http://ctrltwit.com) to save to pocket via twitter replies.

</comment><comment><USER4> Copy the URL then switch to the Pocket app and it will offer to save it.

</comment><comment><USER5> HackLater. Pocket integration is its primary feature.

</comment><comment><USER6> Set bookmark on Chrome or Safari browser</comment>


Track Record In China Sets Cisco's "TOS" Scandal in More Sinister Light - <AUTHOR> http://techcrunch.com/2012/07/08/track-record-in-china-sets-ciscos-tos-scandal-in-a-more-sinister-light/ <comment><USER2> Cisco is untrustworthy, that's absolutely true, but it's a bit of a stretch to tie this to the China stuff.

They enthusiastically jumped at the chance to sell Chinese-law-enabling hardware to the Chinese government. Juniper or Extreme would certainly have done the same, and Cisco probably got a promise to clamp down on counterfeit hardware out of the deal.

It's beyond my personal threshold for ethical behaviour, but corporations don't always have the luxury of standing on principle. Neither do individuals, for that matter.

I'm not absolving them. They did the wrong thing and it makes them untrustworthy. They did what the Chinese government asked them to do, and took the carrot offered. In other countries, it might have been done with a stick instead.

But the inherent difference here is that the government will always get your packets (and voice datagrams) if they want them. Carrot or stick, hardware manufacturer or service provider or common carrier, they will get them. You have to accept that on some level to exist on the Internet.

This Cisco TOS scandal is something else entirely. They think they can do something valuable (for Cisco) with your data, and your permission (not necessarily your awareness). This is just run of the mill abuse of customer privacy -- which we see everywhere and usually tolerate -- and very typical almost boilerplate content restriction rules for any image-conscious hosting service.

The important difference is that customers don't get or expect anything of personal and specific value out of their Linksys router. Contrast to Facebook, Google, etc.

Cisco really really doesn't want to be commoditized, either. They have spent many years in their enterprise markets going up-stack. They aren't satisfied with being easily replaceable in consumer markets either now, apparently. This is new, and troubling.

</comment><comment><USER3> Oh and if your thinking I can install dd-wrt then check it out as currently they don't support the chipset inside the ea3500 and have no plans to either. Currently.

Kinda sad though that to use yoru own router saftly you need another router infront of it filtering out the extra overheads.

Personaly not keen on linksys since they were purchased by Cisco and been a happy draytek customer for over 5 years. Though next upgrade I might go homecrafting again having previously run a OpenBSD p90 box for 5 years prior to the draytek.

Think is nomatter what you get, if you don't have control of the firmware then there is nothing to stop them changing it later on down the line or the company get brought up and the same pattern playing out. That all said you don't have to upgrade blindly. Check out what the chanegs are and then decide.

Think is though this whole story reoslves around Cisco being able to see what websites you visit and it's not like your ISP can't do that already and in alot of cases has to by law and keep that on record for x amount of time.

Guess John Smith will be buying routers and internet connections for some from now on.

<comment><USER4> _> Oh and if your thinking I can install dd-wrt then check it out as currently they don't support the chipset inside the ea3500 and have no plans to either. Currently._

A better strategy is buying a router based on whether it is supported by FOSS firmware or not. Just eliminate any router that isn't, and pick from what's left.

Even if you end up with older hardware, you get the benefit of highly tuned software for it which can compensate for the hardware. I'm still mind-blown by how good my Linksys WRT54GL [1] is running Tomato Speedmod [2]. Best, most trouble-free router I've ever owned.

I get the strong impression that the corporate firmware is produced to be just good enough, whereas something like Speedmod has been continually tweaked, tuned, and improved over ~8 years. Like a late-cycle console game squeezing every ounce of performance out of older console hardware.

1.a. <https://en.wikipedia.org/wiki/Linksys_WRT54G_series#WRT54GL>

1.b. [http://www.amazon.com/Cisco-Linksys-WRT54GL-Wireless-G- Broad...](http://www.amazon.com/Cisco-Linksys-WRT54GL-Wireless-G-Broadband- Router/dp/B000BTL0OA?tag=duckduckgo-d-20)

2\. [http://touristinparadise.blogspot.com/2008/04/linksys- wrt54g...](http://touristinparadise.blogspot.com/2008/04/linksys-wrt54gl- routers-improving.html)

<comment><USER5> > A better strategy is buying a router based on whether it is supported by > FOSS firmware or not. Just eliminate any router that isn't, and pick from > what's left.

This strategy doesn't work for routers people have already bought.

And trying to buy a router based on open source firmware support is not as simple as you imply - the hardware pages are out-of-date as a rule. It's rare that new hardware is listed.

<comment><USER6> What part of

 _Even if you end up with older hardware, you get the benefit of highly tuned software for it_

were you having trouble with?

And if you want support for newer routers it's easy to arrange - buy two, and ship one to your nearest Tomato/DD-WRT/Hyper-WRT dev :)

<comment><USER5> But then I end up with a WRT54GL again.</comment></comment></comment></comment></comment>


13M plaintext passwords compromised - <AUTHOR> http://arstechnica.com/security/2015/10/13-million-plaintext-passwords-belonging-to-webhost-users-leaked-online/ <comment><USER2> I used them a long, long time ago. Apparently my stuff is in this leak. Not really concerning given I don't use the same bank info and never reuse passwords, but still...

They also booted me off of their service after my site started to get more traffic than they wanted to deal with... Terrible company.</comment>


Announcing Charcoal, the easiest way to create Ember.js projects - <AUTHOR> http://www.thomasboyt.com/2013/05/02/announcing-charcoal.html

<comment><USER2> Nice, but I find ember.js with <http://github.com/component/component> more convenient.</comment>