Show HN: I'm a college student and this is what I've made. - <AUTHOR> http://app.sonic.al

<comment><USER2>
        The address wasn't understood

        Firefox doesn't know how to open this address,
        because the protocol (itmss) isn't associated
        with any program.

        You might need to install other software to open
        this address.</comment>


What does it take to raise capital, in SaaS, in 2019? - <AUTHOR> https://medium.com/point-nine-news/what-does-it-take-to-raise-capital-in-saas-in-2019-26829debef29 <comment><AUTHOR> Trying to answer that question, on a napkin.</comment>


A PHP Guy's Look At Python - <AUTHOR> http://websites.datawinds.net/2008/06/a-php-guy%E2%80%99s-look-at-python/

<comment><AUTHOR> I have drunk Python's kool aid and i am stuck on it</comment>


Ask HN: Statistics for hackers? - <AUTHOR> Hi again HN,
I've been trying to learn more about statistics of late, motivated by some really fantastic applications I've seen, like automated composition of music, medical models, and stock market tools.
Atm I've been going through the book Elements of Statistical Learning, which I got from the frontpage a few days ago. But it's kind of slow going, since without really knowing how things relate to each other all I can do is go through it sequentially. What I want is to jump in with both feet, and start writing cool code.
Does anyone know of good books or articles for someone in my situation? Or you give me sort of a minimal spanning roadmap for what I need before I can start having some fun?
I know about basic probability theory, bayesian text classification and hidden markov models, but that's about all. <comment><USER3> I can't speak highly enough of "Programming Collective Intelligence" by Toby Segaran. It's not everything, you'd need other books, but it covers "fantastic applications" of techniques. It has really clear explanations from real-world scenarios, followed by extremely clear python code and with a second explanation with code and maths of each technique used in the appendix. Check out the contents on Amazon.

<comment><USER4> some other helpful books:

\- Data Mining, by Witten and Franke; describes basics with rigor, including how to use Weka, which they wrote

[http://www.amazon.com/Data-Mining-Practical-Techniques- Manag...](http://www.amazon.com/Data-Mining-Practical-Techniques- Management/dp/0120884070/)

a couple java-based books from Manning:

\- Collective Intelligence in Action (by Satnam Alag) and

\- Algorithms of the Intelligen Web (Marmanis, Babenko)

-

</comment></comment><comment><USER5> Sounds like you're more into probability modelling and machine learning than statistics in the traditional hypothesis testing sense. Besides ESL, a book I'd recommend is Bishop's Pattern Recognition and Machine Learning. It starts from the beginning of probability theory applied to computer science problems, and covers every modern topic.

videolectures.net is filled with lectures on CS-flavored probability modelling and machine learning topics. The best bet is the multi-hour "tutorial" lecture series and minicourses; it may take a while to choose the right starting point.

For serious stats and probability without the CS flavoring (not useful for the quick-road-to-hacking-power agenda):

For classical deep stats theory, everyone I know begins with Cassela and Berger's Statistical Inference. Don't expect algorithms in this though.

On the probability side: Feller's An Introduction to Probability Theory and Its Applications. Deep, readable, sometimes funny, full of "whoa" insights. Would be hard to actually grok every chapter in both volumes, but you read it for insight into the power of probability and then use it as a reference.

(grad student in stats, among other things)

</comment><comment><USER6> Try this:

<http://www.bmj.com/collections/statsbk/index.dtl>

The examples you gave make me think you've done some applied things with those specific techniques, but haven't covered the theory and related areas in depth. That's fine; the Square One series is simpler but comprehensive, so you'll be in good shape after that to investigate more on your own.

<comment><AUTHOR> Thanks! I'll give it a shot!

</comment></comment><comment><USER7> Go download David MacKay's Information Theory, Inference and Learning Algorithms (free book). Go through the part on Bayes and the part on Neural Nets (and the info. theory part if you want to, which is fascinating but not as directly relevant), which is a total of roughly 20-30 chapters, some very short. Do as many exercises as you can do (i.e. try them all, fail and come back later if necessary), and try implementing those algorithms. That will get you boned up on this stuff generally.

From there:

Standard references are Hastie and Tibshirani which you already have, Pattern Recognition by Duda Hart and Stork, and PRML by Chris Bishop (though I found it boring - too many unmotivated equations). All of Statistics and especially All of Nonparametric Statistics by Wasserman are both excellent books which will fairly rapidly get you introduced to large swaths of statistical models. Papoulis (1993) is quite a good reference on statistics in general, and Joy & Cover is the usual reference of choice for information theory (which is very relevant to what you're interested in), but neither of those are much fun to actually read.

You seem less interested in classification/ML problems and more interested in straight-up stats and/or timeseries stuff. So some slightly deeper references:

\- Given your interests you might absolutely love Kevin Murphy's PhD thesis on Dynamic Bayes Nets, which are excellent for describing phenomena in all three fields you mentioned.

\- Check out Geoff Hinton's work, especially on deep belief nets (there's a Google tech talk and a lot of papers).

\- Hinton and Ghahramani have a tutorial called "Parameter Estimation for Linear Dynamical Systems", which could be directly applicable to the models you're talking about

\- If you're interested in these dynamic, causal models you'll want to learn about EM (which you should know already since you know HMMs), and its generalization Variational Bayes. MacKay has a terse chapter on variational inference; <http://www.variational-bayes.org/vbpapers.html> has more. One of those is an introductory paper by Ghahramani and some others, which is nice.

\- Pretty much everything on <http://videolectures.net> will excite you.

Some of those references (esp. the VB stuff) can get slightly hairy in terms of the maths level required (depending on your background). Bayesian Data Analysis with R (by Jim Albert), or Crawley's R book (for a more frequentist approach), can get you started using R which can avoid you needing to implement all this stuff yourself, as much of it is already implemented. This might be your fastest route to writing code that does cool stuff - <USER2> what the algo is, use somebody else's implementation, apply it to your own problem.

</comment><comment><USER8> Here (perhaps for onlookers more than for your exact case) are more two favorite recommendations for free Web-based resources on what statistics is as a discipline, both of which recommend good textbooks for follow-up study:

"Advice to Mathematics Teachers on Evaluating Introductory Statistics Textbooks" by Robert W. Hayden

<http://statland.org/MyPapers/MAAFIXED.PDF>

"The Introductory Statistics Course: A Ptolemaic Curriculum?" by George W. Cobb

[http://repositories.cdlib.org/cgi/viewcontent.cgi?article=10...](http://repositories.cdlib.org/cgi/viewcontent.cgi?article=1002&context=uclastat/cts/tise)

Both are excellent introductions to what statistics is as a discipline and how it is related to, but distinct from, mathematics.

A very good list of statistics textbooks appears here:

[http://web.mac.com/mrmathman/MrMathMan/New_Teacher_Resources...](http://web.mac.com/mrmathman/MrMathMan/New_Teacher_Resources.html)

</comment><comment><USER9> This isn't directed at the author of the top post, but _The Cartoon Guide to Statistics_ is actually pretty good. It's a quick read (cartoons, hey), but works well as a quick refresher, or would be enough of an intro to pick up terminology for more pointed questions. (It's also fairly cheap, libraries might have it, etc.)

</comment><comment><AUTHOR> If it helps, the sort of questions that interest me are: what types of sounds are pleasing to the ear, or, what rules do I have to constrain randomness within before I can generate music that sounds like _____, or (presumably with a factor model) what team is most like to win the world cup =P

<comment><USER10> You could try looking at existing generative music schemes. This one is classic[al]:

<http://en.wikipedia.org/wiki/Musikalisches_Würfelspiel>

</comment></comment><comment><USER11> I've been pretty impressed by the O'Reilly book on statistic: [http://www.amazon.com/Statistics-Nutshell-Desktop- Reference-...](http://www.amazon.com/Statistics-Nutshell-Desktop-Reference- OReilly/dp/0596510497/ref=sr_1_1?ie=UTF8&s=books&qid=1256505041&sr=8-1)

<comment><USER12> I am pretty ambivalent about that book. It covers a lot of territory with pointers to deeper literature with a clear emhasis on using these techniques with a statistics program like SPSS (or R), which is nice, but it still wastes a lot of space printing intermediate tables for simple examples which don't do much except filling pages.

But the real bummer is the editorial quality. There aren't any three consecutive pages without major typographical or editorial errors like missing parantheses in complex formulas or cases where they obviolsly replaced examples with simpler ones but forgot to change the illustrations together with the text.

</comment></comment><comment><USER13> This is a site that's really good for beginners:

<http://www.statisticshowto.com>

And it's really relevant here because the approach to everything is step by step -- the author of the site probably doesn't realize it, but the tutorial steps practically read like pseudo code... seems like it could really help you.

Also, there are some calculators on there, and I've seen the code, which isn't bad, and it's not obfuscated so if you want to get an idea of how to implement something, you can just look at the source directly.

</comment><comment><USER14> One of the things EoSL emphasizes is that simple methods can often give very good results. If you have been through the first few chapters of the book, you should be able to do some cool stuff with nearest neighbors or linear classifiers. (The reality is that on most problems, fancy methods give a slight increase over simple, especially when they are implemented by someone really skilled at getting good performance out of simple methods.)

Nearest neighbors methods can be implemented in something like 3 lines, so you have no excuse!

</comment><comment><USER15> Hidden Markov models are serious stuff. If you already understand them, leverage that power and go build an application! No point in learning the theory if you aren't going to apply it.

<comment><AUTHOR> I've built some text generators, and a POS tagger. But, for much of the more interesting stuff I want to do, it seems like I need things like time-series, or regression models -- which elude me entirely at the moment.

</comment></comment><comment><USER16> The trick for me is to learn a good foundation in statistics but to know that you don't need to learn everything.

A friend who founded a startup that makes heavy uses of statistics likes to trawl academic papers for algorithms that help his business.

Think of research papers a bit like a well documented private object/library -- you know what data it accepts, you know what it returns, but you don't need to know how it works.

Just make sure your code reflects exactly the formulae/model documented in the paper and you're good.

<comment><USER17> And the assumptions in the paper.

</comment></comment><comment><USER18> I'm in a similar situation, as I'm trying to decide whether or not to minor in statistics on top of computer engineering. From a hacker's perspective, I've found that playing around with the language R is the best way to relate to the field. Check our the tutorial _R for Programmers_ linked from here: <http://heather.cs.ucdavis.edu/~matloff/r.html>

</comment><comment><USER19> <http://news.ycombinator.com/item?id=902478>

</comment><comment><USER20> As far as application of statistics to automated composition goes, definitely check out the EMI project over at UC Santa Cruz.

</comment><comment><USER21> iTunesU has some courses for stats, but they may not be suitable for learning in a hurry.

-jc

</comment><comment><USER22> You should write a book, statistics for hackers. I would buy it. Make sure it explains things really well. The best person to teach someone is a beginner _, because they understand the beginner's perspective. So you are in a unique position to create this.

O'Reillys statistics in a nutshell is a good _reference* book, but not quite a textbook. Here you go. Including my refid. [http://www.amazon.com/gp/product/0596510497?ie=UTF8&tag=...](http://www.amazon.com/gp/product/0596510497?ie=UTF8&tag=httpwwwhiph02-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=0596510497)

*True masters have beginner perspectives, so they are good teachers as well.

<comment><AUTHOR> I'm tempted. Though might a blog be better? Also, it might be nice to have someone to do it with, as then I could get explanations for things that befoggle me.

<comment><USER22> It'd be better to have it with a table of contents. You could probably get sufficient explanations through a combination of research on wikipedia and then probing #math on freenode.

<comment><USER23> Just out of interest, how long does it generally take for a question to get answered on #math? Does it vary quite a lot, or is it fairly stable (assuming someone can actually answer it)?

<comment><USER22> i typically get answers immediately, but i've only asked questions up to college algebra

</comment></comment></comment></comment></comment><comment><USER24> That's a lot, actually.</comment>


Please rate my app - <AUTHOR> http://31337.it/

<comment><USER2> Why the "leetspeak" URL? It implies there is something alt.2600-y about the site that I don't get.

Can't/won't test it. It tells me to send an email, but I have no idea what that email will do. Does my email address get published? Stored? Can people send me emails or reply to me? Are the email headers visible/can someone see my source IP?

No _clear_ value-add to me makes me shy away from something that is so poorly documented. Of course, with traction 95% of my questions would be answered and it would be more obvious what the site is/does. Kind of chicken-and-egg I guess, but you should post a demo or some bette descriptions first.

<comment><AUTHOR> You are right. I should add this to the home page. To be sincere, i did not think a bit about this stuff :)

I answer you here:

\- your mail address will not get published

\- it will be stored

\- people will not see it so nobody can reply

<comment><USER2> OK, so I sent something and got this page: <http://brk.31337.it/210>

Now, what do I do with that? (semi rhetorical question, it _seems_ like some kind of social-ish, easy-blogging site)

Also, not sure if this is the intention or not, but if I enter <http://brk.31337.it/209> I see someone else's post. That is a confusing behavior. I would expect to see my own immediately prior blog post (if I had one), not another users stuff.

<comment><AUTHOR> _That is a confusing behavior_

Yes, I guess I should overwrite the to_param method of the post model to return text instead of the id.

That's a really good idea, and is more seo friendly too.

</comment></comment></comment></comment><comment><AUTHOR> I had quite some fun in the last two weeks implementing this site. Configuring postfix, adding some queues, piping mails through spamassasin to my script that imports them, parsing mails, formatting html, making sure it's at least halfway valid. Working with rails subdomain routing, learned a lot of jquery too.

I developed this to scratch my own itch, but since it's here, you may use it if you like.

</comment><comment><USER3> wow, really nice! Now, you homepage claims 'have fun!', but where's the fun when you don't have access to the css or the page template, and can't start tweaking those immediately? :o)

</comment><comment><USER4> You appear to have chosen a domain that is invalid in DNS. RFC1034. Whoops.

</comment><comment><USER5> Perhaps I am old school but I cannot understand what your application does.

A brief description other than "Post your content on the web" would be nice. Additionally when you want people to send an email to you, you might want to have a Privacy Policy link to state what you will do with the email addresses that you will collect.</comment>


GameTrailers Is Closing Down After 13 Years - <AUTHOR> https://www.facebook.com/gametrailers/posts/10153542220089285 <comment><USER2> I wonder what happened. Looking at their youtube page, most recent videos have between 10k-20k views. This is nothing compared other popular video game channels. What killed it? Streaming? Bad writing? Low production quality? They still got the same awesome narrator at least.

[https://www.youtube.com/user/gametrailers](https://www.youtube.com/user/gametrailers)

<comment><USER3> I lost interest years ago when it became apparent that their positive or negative news coverage of games was based less on the actual content of the games, and more presumably on whether they were paid to give it a positive or negative review. There's some really blatant examples of them bashing some very high quality titles, and vice-versa with writing glowing reviews for unplayable garbage.

It's good to see them finally go. I only wish it could have been sooner.

<comment><USER4> That's exactly why I stopped following them. The quality of their reviews really dropped at some point, they were praising some titles too much (mainly PlayStation ones), with very little criticism.

</comment></comment></comment><comment><USER5> Kotaku has a round up of related tweets and postings:

[http://kotaku.com/video-game-website-gametrailers-closes- aft...](http://kotaku.com/video-game-website-gametrailers-closes- after-13-years-1757939279)

I don't want this to sound like a snarky _" Oh [some company the Twiteratti thinks is lame] is still around?"_ comment, but I truly had thought GT _was_ dead, because of its notable layoff announcements in recent years:

[Layoffs hit GameTrailers day after E3 (2014)]([http://www.polygon.com/2014/6/13/5807898/gametrailers- layoff...](http://www.polygon.com/2014/6/13/5807898/gametrailers-layoffs))

[GameTrailers, GameFront and The Escapist Hit By Layoffs (2015)]([http://www.craveonline.com/culture/813763-gametrailers- gamef...](http://www.craveonline.com/culture/813763-gametrailers-gamefront- escapist-hit-layoffs))

But looks like this really is GT's epitaph; this forum post dated today comes from GT's associate editor (according to Kotaku), and alludes to this being a sudden development:

> Hi everyone, Ben here. I just wanted to confirm that GameTrailers is > shutting down officially today. Everyone is being let go. We all found out > mere hours ago, so we're still reeling a bit. Sincerely, thank you all for > the tremendous support.

[http://www.neogaf.com/forum/showpost.php?p=194642343&postcou...](http://www.neogaf.com/forum/showpost.php?p=194642343&postcount=6727)

Best of luck to the GT former employees.

<comment><USER6> It does seem very sudden.

They just launched a complete site re-design/re-write (which went pretty horrible) and according to their shows they just (weeks ago) moved to new offices.

The launch of the new website was absolutely horrible. Player often didn't work, comments broken, etc. and in retrospect the office move seems sub optimal as they did not appear to be happy with the new space they got.

</comment></comment><comment><USER7> I hope the guy who speaks their reviews gets to continue doing that job somewhere else. His voice is cool.

<comment><USER8> Brandon Jones! I always loved this blooper reel of his: [https://www.youtube.com/watch?v=bei_xzstrtU](https://www.youtube.com/watch?v=bei_xzstrtU)

</comment></comment><comment><USER9> I'll still always remember Haloid back in 2007, the best Halo + Metroid mashup video ever [https://www.youtube.com/watch?v=cL- mR79GErU](https://www.youtube.com/watch?v=cL-mR79GErU) (re-uploaded on YouTube, it was originally on GameTrailers)

It was created by the late Monty Oum (creator of RWBY and art director for RvB) and apparently it's still the most watched video GameTrailers ever had [0]

[0] [https://www.youtube.com/watch?v=WJC5Ct9vXMM](https://www.youtube.com/watch?v=WJC5Ct9vXMM)

</comment><comment><USER10> That's a very sad news for me. I am long time GT audience, and still stop by there website for video reviews(no other videos).

Also I've always found Brandon Jones's voice very soothing. I hope he continues to do game reviews.

</comment><comment><USER11> Jeeze, what a shame.

The thing about Gametrailers was that their video reviews were never fantastic, they were just _competent_ , which is more than I could say for the awful Gamespot and IGN video reviews.

Also, their Retrospective features were top-notch. Seriously, go watch the Diablo retrospective now. I'll wait:

[http://www.gametrailers.com/shows/gt- retrospectives](http://www.gametrailers.com/shows/gt-retrospectives)

</comment><comment><USER12> Damn, this is a shame. I loved their reviews - I just watched the Firewatch review a couple of hours ago. Turns out it was their last review ever.</comment>


Show HN: I built a website to check performance of top websites in the world - <AUTHOR> https://simpleops.io/websites <comment><USER2> What is the use case?</comment>


Secrets, lies and a child: On Chekhov's marriage - <AUTHOR> https://www.theguardian.com/books/2018/aug/20/secrets-lies-and-a-child-william-boyd-on-the-truth-behind-chekhovs-marriage <comment><USER2> If you see a marriage laying on the table it will go off by the third act?</comment>


HBO Max taking on Netflix with human curation instead of relying on algorithms - <AUTHOR> https://www.theverge.com/21268972/hbo-max-design-recommendation-human-curation-friends-kids-profiles <comment><USER2> As Netflix has moved away from carrying lots of other people's movies to largely producing their own in-house TV shows, it feels like they barely have enough content to need an algorithm to curate it. They just show the same new Netflix originals over and over in ever category.

I'm sure Netflix has piles of data that shows this is the best strategy. It just seems like a differentiated curation strategy doesn't matter that much in this battle. It will come down to who is producing the most popular original content most consistently.

<comment><USER3> It feels to me like the balkanization of streaming services was inevitable and Netflix getting into the content game was just a logical response to remain relevant. If the catalog is what garners subscribers then a streaming service without its own catalog is basically fucked in the long term.

<comment><USER4> This balkanization is a good thing. I'd far rather have the choice between many competing providers each offering a service at £8/month, than have the choice to take or leave a single expensive all-in-one subscription, like cable.

It's also good that market forces are driving content-creation.

<comment><USER5> No, it is not.

Not when they compete with exclusive content.

It would be good if they had the same content but compete with the UI (in such case Netflix would win, and HBO would loose, as they have the worst possible UI), streaming content etc.

<comment><USER6> Most (all?) of that exclusive content only gets produced because of exclusivity, I'd think. I.e. we get a greater number of shows because of exclusivity.

<comment><USER7> The gaming industry has move (largely) away from exclusives and that has been a net improvement for content.

I suspect the pendulum will swing away from exclusive content for television shows. Producers might make more money up front from the deals, but the long game favors those who establish brands with broad market appeal, and the way to do that is to get your content in front of as many eyes as possible.

<comment><USER8> Huh? The most popular console (Nintendo) is almost entirely exclusive games. Playstation and XBox are less exclusive than they've been, but not by much (FF7 Remake was PS4 exclusive as well).

<comment> Fire-Dragon-DoL Timed exclusive is not the same as permanent exclusive though.

Ff7 remake is coming to pc, they just haven't figured out when.

<comment><USER8> Sure, permanent exclusives are generally only first party. Bungie/halo was one but thats because MS at the time didn't have enough first party studios.

<comment> Fire-Dragon-DoL Well the big difference is Nintendo, they have a large amount of permanent exclusives.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment> j-kent Lately it feels like Netflix's algorithm is "just show Netflix produced content". Maybe I'm being nostalgic but I really miss the old shooting star recommendation system where you rated content and got similar likes from other viewers.

<comment><USER9> Nostalgic? No, you're displaying a reasonable response to a screwy situation.

Did everyone just forget about the Netflix Prize? [[https://en.wikipedia.org/wiki/Netflix_Prize](https://en.wikipedia.org/wiki/Netflix_Prize)]

There was a brief time when they had the _absolute best_ recommendation algorithm on the planet. It was intentionally replaced by something utterly different which is geared to simply steer everyone to IP that they own. It is not remotely similar. I have absolutely hated every change they've made to their UI since they ditched the old ratings system, too (forces you to use the mouse and sets you up for fumbling what should be clear actions, so you spend more time browsing - which costs them almost nothing - and less time watching). My guess is, research indicated they'd make more money with these changes than by licensing content audiences actually prefer and building a sane interface.

As it turns out, the Netflix golden age was a short-lived anomaly if not outright farce. If you want decent curation of content and also to be able to watch it, you will have to pay through the nose or pirate. Same as it ever was. It's consumer hostile, but the system is working as its overseers intend. Whether it's really the best long term strategy is still an open question in my book.

<comment><USER10> The problem with a recommendation engine is that it breaks down when content options are limited. In Netflix's early days of streaming, they had a similar approach to content as they did with DVDs, i.e. capitalizing on the long tail and offering an enormous selection. That proved to be inefficient for streaming because there's a minimum bar at which rightsholders will sell licences, and it's far higher than just the price of a few DVDs. Thus, Netflix switched to a more limited acquisition model, and then began a more aggressive program of content creation to effectively gate its offer from competing services. The upside of this for consumers has been a shift by many talented creators into series-style content; the downside is that the market for independently-produced films has bottomed out considerably.

</comment></comment></comment><comment><USER11> It makes sense to me because HBO doesn't really have the same type of catalog. They also don't have the data. In my experience, people subscribe to HBO because they have the content and people are already aware of their content. It makes curation way easier. HBO Max is going to exclusively have the entire Friends collection and Ghibli collection. I know and am aware of what HBO has to offer.

On the flip side, Netflix is creating their own content. People have no idea what content is on Netflix. They have to try really hard to push content and generate engagement. I've never heard of Outer Banks, but they keep pushing it to me and so I saw the pilot and now I'm watching the series. I watch one comedy show and now they keep throwing comedy shows at me so I saw and enjoyed another. Their need to create is different.

<comment><USER12> HBO Max has the entire WB + others back catalog, and represents some of the most productive studios out there. Rumor has it, they're also going to be making exclusives.

Even knowing what they have across brands is nontrivial.

</comment></comment><comment><USER13> I doubt they will completely remove algorithms from the curation process. In my experience what is incredibly powerful is human curation ability multiplied by the leverage of algorithms.

The most straightforward example of this is for curation candidates to be proposed by algorithms, and then finalized by humans.

That approach works really well for things like creating digital maps from signals, and is employed pretty extensively by mapping companies as productivity multipliers.

Or even more familiar, it's what's behind things like smart select and magic wands in image editing tools.

<comment><USER14> I couldn't agree less. Netflix suggestion: horrible. Gave justwatch.com a try: nothing for me.

OTOH take 5 people selecting 15 movies every month [https://cinetree.nl/over- ons](https://cinetree.nl/over-ons): excellent selection, no algorithms. Or every week 1 or 2 top movies at [https://www.vrt.be/vrtnu/a-z/#filter=categories%3Afilms](https://www.vrt.be/vrtnu/a-z/#filter=categories%3Afilms). Or idfa.nl, etc, etc. None _proposed by algorithms_ , only humans.

</comment></comment><comment><USER15> One area where curation will fail is in "fancy bias". As in, the same bias that keeps crowd pleasing entertainment from winning awards.

People who are in the curation business (critics, reviewers, etc.) tend to favor things that make themselves look good to other people in the curation business. That is often opposite what the "unwashed masses" of people enjoy.

Prime example - Michael Bay movies. Michael Bay makes big, loud, entertaining movies with lots of explosions, bright lights, shiny objects, violence, and sex appeal. A "curator" is usually too snooty to recommend a movie like that.

An algorithm doesn't much care if a movie is artfully crafted, it only cares if people watch what is recommended. In the long run, an algo is more likely to give people what they want than a curator is.

If anything, curators over the long term seem to make a living telling people what they aren't supposed to like (or have access to).

</comment><comment><USER16> "Curators, ranging from WarnerMedia editors to celebrities, put together a list of movies and TV shows they're watching"

ok so how do I know which human's taste is the same as mine. If only there was a recommendation engine for that.

<comment><USER17> You beat me to it. I certainly want to be able to watch things recommended by $celebrity2.

<comment><USER18> Well, with a decent catalog, and if it's not really marketing bullshit, I would certainly like to see a list of <my-favorite-director>'s favorites.

</comment></comment></comment><comment><USER19> There's a joke I saw somewhere. When you can Netflix someone picks up the phone and says "your show is greenlit, who am I talking to?"

Their overall quality feels like it's gone down and their non-netflix content feels incomplete (many movie series are only partially available). In that way Netflix has replaced basic cable for me.

Whereas HBO and Amazon Prime still produce shows that have a certain wow factor in terms of quality.

<comment><USER20> I believe that was a bit on South Park.

</comment></comment><comment><USER21> I wasn't old enough to remember it, but when search engines tried to do this in the 90s, it became clear that people preferred machine recommendations. See yahoo directory, look smart.

<comment><USER22> I don't think it became clear people prefer algorithms, I think the fundamental problem was with the millions of websites Yahoo couldn't scale.

HBO is operating on a much more tractable problem. Human curation may work better here.

<comment><USER23> And it's not obvious that people want to discover art the same way they want to discover information (obviously not implying that Google can't be used to discover art).

</comment></comment></comment><comment><USER24> If they could show the IMDB rating, it would be enough for me.

<comment><USER25> Why do streaming services tend to show the Rotten Tomatoes score instead of IMDb? I trust the IMDb score a lot more...

<comment><USER26> Prime uses IMDB, because Amazon owns IMDB.

</comment></comment></comment><comment><USER27> Is there any halfway decent third party recommendation system? I've got a list of everything I've watched in the last year or so since I've started tracking it, plus older TV shows I've seen in full. I'd be interested in manually inputting that with ratings into some system where it can recommend what else I'd like given everyone else's data.

<comment><USER28> I've had some success with JustWatch [https://www.justwatch.com/](https://www.justwatch.com/) As far as ratings go, you can 'like' or 'dislike'

<comment><USER14> I gave it a try, not much success for my taste.

</comment></comment></comment><comment><USER29> Netflix doesn't care about what you like. Their algorithms are centered around the concept of what are you most likely to binge through.

Similar to Youtube recommendations and how they are simply videos are most likely to watch through.

</comment><comment><USER30> This is a hard problem. And it makes a great interview question too!

 _Recent PM interview question I 've been using: You're the PM at Netflix handling the home screen. How do you determine how shows get promoted editorially vs algorithmically recommended? Walk through metrics/principles/trade-offs and how it impacts various parts of the biz._

[https://twitter.com/sriramk/status/1222547047846297600](https://twitter.com/sriramk/status/1222547047846297600)

<comment><USER31> This is a great question and I might steal this for future interviews. It's surprising how many of the people responding, despite being told optimizing for engagement is a cop-out, still jump to some kind of metric-based prescription. Or just jump right into throwing percentages for each content type (I mean, it's twitter, so sure, have a go).

My personal stab at this: this is really a strategic question. What are Netflix's long term goals? To be seen as HBO is, as a content-creator, or merely a content-provider? Both? What are the typical engagement rates for Netflix content vs purchased? What is the real, intangible (unmeasurable) objective we are maximizing for? Total hours watched? Or perceived value by consumer? Someone spending 25 hours a week with Netflix on still might perceive it as lower value than HBO that they spend 2 hours a week watching (and thus be more likely to cancel). Some forms of entertainment are easily substituted, as someone who uses TV for background noise wouldn't particularly mind to use Hulu for that purpose instead of Netflix. But a "must watch" show on HBO is just that, a must watch. Which customer do we want more of? More "background noise" customers implies a marginally higher infrastructure cost, while a more content focused strategy implies a higher cost for content production (and possibly a much more variable revenue stream, as people subscribe/cancel as their favorite show starts/stops airing). Maybe we want both, and we want to identify what kind of watcher a customer is, and then tailor their home screen to suit. Maybe one person has 90% Netflix Originals and the other has 10%.

If there is an answer here, it's to carefully weigh these strategic objectives and only then make changes to show promotion. Even then, it would be important to have some system of monitoring in place that allows you to confirm your changes are actually making measurable impact the objective in question (this may be very difficult, given an intangible goal of something like "increase Netflix mind-share". Probably a lot of marketing surveys and focus groups.) Straight-up engagement rate is just one of the many things to track here, and increasing it at any cost might not even be in Netflix's long term best interest.

<comment><USER30> You're hired! Great strategic answer that gets to the heart of the question-- it's less about the solution and more about how you frame the problem and the underlying goals and assumptions.

Do you work in this space? It seems like you have a lot of context around OTT/streaming.

Your answer also brought to mind this podcast episode I came across this morning: [http://investorfieldguide.com/shishir-mehrotra-the-art- and-s...](http://investorfieldguide.com/shishir-mehrotra-the-art-and-science- of-the-bundle-invest-like-the-best-ep-175/)

It introduces a nice concept of "marginal churn contribution" framed with bundling, but I think is also relevant to this discussion. Maybe more on the content sourcing/production side, but bleeds over into long-term goals (reducing churn/maximizing ltv/etc).

<comment><USER31> Thanks! I actually don't work in streaming/OTT, I manage a data science team for an auto insurance company. We end up thinking a lot about these kinds of questions from different business units that aren't quite sure what they want to be optimizing for, so I'm somewhat used to making the connection between high level strategy and measurable objectives. And as you might imagine churn/bundling/LTV are also very important concepts in the insurance space, which probably gave me a leg up in my response. The revenue model is at least superficially similar.

Thanks for the podcast link, it looks very relevant and will give it a listen. I see insurance is even explicitly addressed @ the 23 minute mark.

</comment></comment></comment></comment><comment><USER32> I wish they would take on Netflix with some better UI functionality. I can't even fast forward at hbogo.com without picking up the mouse. The only keyboard commands that work are Spacebar to pause and play and F to get full screen.

Another problem is that if I watch 2 episodes in a row and I bookmark the page of the 2nd episode to finish it later, the URL in the address bar is actually still the URL of the 1st episode.

</comment><comment><USER33> This is like when Apple said their Music platform would be more human curated rather than algorithms like competitors such as Spotify. But the reason why I love Spotify's recommendations and not Apple's is because Spotify focuses on algorithms and does them so well.

Same with Netflix, in my experience they truly know what I will like to watch, they seem to know what shows I'll love and what shows I won't love but will help pass the time, and seem to show it to me just when I want it.

I imagine it takes a lot of time and lots of past history and data on users to create those algorithms so when starting out the human curation method is required. And for companies like Apple, may be the long term strategy because the alogrithm method that YouTube and Spotify comes at the cost of potential tracking and privacy concerns.

<comment><USER34> In contrast to other commenters, I loved manually curated Apple Music playlists, I found so much great music through them in first 6 months of using their service. You could really feel that they were created by people with real passion for underground and experimental music, on par with best user- curated Spotify playlists. When they switched to algorithm based recommendations its quality tanked and I moved back to Spotify because it has better overall user experience on desktop and social features. Spotify's algorithms has never, ever introduced me to interesting new artist, it only suggest to me things that I either already know and like, already know and dislike or new things that pretend to be good but there is no original though behind them. Fortunately, a lot of independent music critics and enthusiasts have their own playlists with good, deep cuts - but you need to find them outside of Spotify, because their discovery features are so bad. I miss early Apple Music so, so much. It reminded me of prime years of Last.fm.

</comment></comment><comment><USER35> just weaponise YouTube content creators.

My kids used to laugh at Villager News, a dumb but occasionally funny skit show using 3D animation to copy Minecraft. Amazon Video now runs the show on its streaming service.

Basically YouTube became a method to make pilots for tv series.

Imagine all the weird but low cost documentaries i try and find on YouTube - Tods Workshop, Primitive Technology. There will be a thousand such people in thousands of niches.

Google could just flip on a content arm and hand each channel a producer and a decent camera and just own half the content. The other half is documentary / reportage rather than essays.

Honestly thinking of content as action shows or sci-fi 100 episodes is missing the point entirely. Content here on in is still high quality but aimed at a 100,000 people not 20 million.

<comment><USER36> > _Amazon Video now runs the show on its streaming service._

In that scenario you're competing against YouTube, a place with abundant content with very different expectations for quality. People already go to YouTube for this content.

<comment><USER35> But the curation of lifting it out of youtube and into "mainstream" has a major discoverability effect - if youtube is just pure anarchy, selecting and promoting off youtube is ... feudalism?

</comment></comment></comment><comment><USER37> I don't know if netflix has enough content for curator aglorithms, at first it was recommending me some good older movies which was great but if netflix ever moves on to only originals and then only starts recommending those i will definitely cancel my subscription.

</comment><comment><USER38> They should work on their search. I was trying to find the movie "Paul" and typing "Paul" in the search had the exact match as the fourth or fifth result in the upper right corner of the screen. It took me a while to find it.

</comment><comment><USER39> I stopped really paying attention to Netflix's curation algorithms when I saw "The Santa Clause" categorized under "SciFi". I mean, I guess technically, but that's not really what I was looking for...

</comment><comment><USER40> It's pretty funny that even this headline shows the bizarre marketing problem WB created in choosing "HBO Max" as their streaming service name: HBO isn't taking on Netflix, the service is for all WB content.

<comment><USER41> Yep, and keeping the other services running at the same time is just stupid.

Its obvious HBO Now could be merged completely into Max since you get access to both if you have Now but the fact they still keep Go around still is a joke.

</comment></comment><comment><USER42> As someone with both, both have their place, but HBO is a strong offering. HBO in-house content is way better, and they have a lot more good movies available to watch on demand. I'd say Netflix wins strictly at UI, and variety overall.

That said, I'm curious how the future will play out. I already have Hulu, HBO, Disney Plus, Netflix, and Amazon Prime. The cost and variety is getting out of hand, and I don't even have time to watch them all(I use Hulu the most, and Amazon the least, fwiw). Are we going to soon see reconsolidation of services, back to the cable model?

</comment><comment><USER43> This reminds me of some comments Quentin Tarantino once made about Netflix: [https://www.youtube.com/watch?v=5NbxVZC9CJQ](https://www.youtube.com/watch?v=5NbxVZC9CJQ).

It wouldn't surprise me if we see more of a trend towards content curation that isn't based on AI recommendation engines, but rather humans who are either friends or celebrities/experts.

Some ideas: * My friends are watching this * Martin Scorsese's film influences * Cinemassacre Monster Madness watch list

</comment><comment><USER44> Netflix, has low quality shows not because of their recommendation algos. but their business model. serve everyone some acceptable shit with a good chocolate here and there. And mass production. Netflix shows usually suffer from poor writing, poor cinematography. HBO knows how to hire the right crew for a show, besides the clusterfuck called GOT. Year after year, HBO continues to produce bangers, The Wire, Chernobyl, The Plot Against America etc are some of the finest shows ever made. with the wire #1.

</comment><comment><USER45> As an HBO Now subscriber, I just logged into Max for the first time and was very impressed. Everything I love about HBO and then a ton of large collections covering many genres and as mentioned, many full collections of things. It was already worth it, but this just made it 100% a contender with Netflix for my top streaming platform by adding volume of other content outside of originals, of which I enjoy from both.

</comment><comment><USER46> I think that it can be better with Human curation. Although all recommendations methods can us less tolerant to different views.

Filter bubble is the term for when algorithms select the content you watch instead of you.

Filter bubble [https://en.m.wikipedia.org/wiki/Filter_bubble](https://en.m.wikipedia.org/wiki/Filter_bubble)

</comment><comment><USER47> Can someone ELI5 the difference between HBO Now, HBO Go, and now HBO MAX?

Am I the only one that is completely confused by their apps branding?

<comment><USER48> They have a FAQ at the bottom: [https://www.hbomax.com/](https://www.hbomax.com/)

> The biggest difference is what you can stream. HBO Max is a stand-alone > streaming platform where you can stream all of HBO together with even more > of your favorite series and blockbuster movies, plus new and exclusive Max > Originals for everyone in the family.

> HBO NOW and HBO GO are your options for streaming all of your HBO favorite > series, plus hit movies, specials, and more. HBO GO is a streaming service > included with your paid HBO subscription through a TV or mobile provider. > And HBO NOW is a stand-alone streaming service that lets you stream all of > HBO without a TV or mobile package.

</comment></comment><comment><USER49> HBO is betting on their content to be superior right now, but there are some obvious areas where the streaming experience isn't on par with Netflix. No 4K/HDR, one plan costing a premium that limits simultaneous streaming to only 3 screens, etc.

Hope that they catch up eventually else it's gonna be hard to compete solely based on content.

<comment><USER50> Netflix, Disney+, and Apple TV+ have also realized that adding more language tracks to their content is a _must_.

My family's viewership of Amazon Prime Video is severely limited because they refuse to add Spanish audio to their content. They have a few Spanish-language shows and movies but it's slim pickings.

HBO has no excuse on this, imho. I _know_ they have Spanish audio for every single one of their shows and movies - when we had cable TV we could switch language track in seconds, and this is not counting their Spanish-language channel that played in Spanish by default.

<comment><USER51> Why not just use subtitles? I can't stand dubbed live action content (anime is a little better though), so I stick with subs exclusively.

<comment><USER50> I enjoy subtitles, my wife doesn't. I don't think I would enjoy subtitles when we're late-night binging until 2 or 3am.

Regardless, do Netflix, Apple and Disney have better engineers than HBO (and Amazon)? Do the latter two not care about offering Spanish (or non-English)? Do they have some contractual obligations to not offer the options online?

Turns out I don't care what the reason is. They don't offer extra language options, so I don't subscribe.

</comment></comment></comment></comment><comment><USER52> As long as AT&T's HBO continues to pursue quantity over quality I don't see any reason to go back.

</comment><comment><USER53> Are there any examples to counter argue the vast superiority of computational curation?

Walmart (active merchandising) > Amazon (passive SEO)

Mutual funds (active picking) > ETFs (passive baskets)

It seems like a one directional shift. Every time I see human curation, it just ends up being long term worse.

<comment><USER54> Might not be an apples to apples comparison, but Costco vs Amazon is the example I tend to use for curation vs SEO. The reason it might not be the best comparison is that Costco tends to be for bulk items while Amazon tends to be for one off purchases, but anecdotally I know of many who consider Costco's experience to be the better of the two.

<comment><USER53> I guess my argument is more does Costco have humans merchandise? I feel like the fact that they just put skids of overstock out into the isles randomly is more passive than the fancy facing work that most retailers do. Likewise, does Costco carry SKUs because they feel right, or because of some kind of clinical calculation they did about most popular CPG?

</comment></comment></comment><comment><USER55> Reminds me of how Yahoo! tried to differentiate itself from Google. There are companies that think they are in media, but really they are in search. I think the explosion of good quality content is turning the streaming services into search companies.

</comment><comment><USER56> This is what sold me on an Apple Music subscription. Apple Music's human curated playlists introduced me to a lot of new music that I liked, and hadn't come across by any machine generated recommendation, e.g. Genius.

</comment><comment><USER57> The Netflix algorithms are so good though, more often than not it recommends me something that I am glad it did. It almost, almost, makes up for not being able to easily look up content by genre and such.

</comment><comment><USER58> Does anyone actually think that Netflix solely uses algorithms to suggest and or design content?

It seems like to me that they use analytics to inform what kind of content to make but there are humans making decisions.

</comment><comment><USER59> All that curation stuff is hugely overrated. I simply want content.

If I need curation, I'll check the movies on IMDB first.

</comment><comment><USER60> I subscribed to HBO Max for $11 and just see they don't have a Roku app (the most popular streaming platform)??

<comment><USER61> Blame Roku's "walled garden". They won't let an app be on their service without making a deal that gives them a cut.

[https://variety.com/2020/digital/news/why-hbo-max-not- availa...](https://variety.com/2020/digital/news/why-hbo-max-not-available- roku-amazon-fire-tv-1234615984/)

As much as people complain about Apple's 30% cut, Apple doesn't get a cut of third party content apps if a user subscribes on the providers website.

No, Apple doesn't force content app makers to offer payment through Apple - see Netflix, Spotify, Hulu Live TV, Sling, ATT Now, etc.

<comment><USER60> I just canceled HBO Max ... there's not much there and I cant watch it on my Roku TVs.

Compare Disney Plus's launch with any streaming product ATT launches is day and night. One is all about the consumer experience while the other is all about penny pinching and tons of red tape/too many cooks in the kitchen. They already destroyed Direct TV with their stupidity next is HBO.

</comment></comment></comment><comment><USER62> HOOQ (now liquidated) followed the same approach and it ended up as an operational nightmare.

</comment><comment><USER41> "human-first platform"

Yeah because netflix loves those robots it serves. At least netflix doesn't have a name problem... Three different HBO products... yeah that's gonna work. /s

<comment><USER63> HBO Max is just their newly renamed HBO Go and Now unification. If you had either Go or Now before, you now have Max. It's not really that complicated.

<comment><USER41> Actually you are incorrect, HBO Go and Now still exist as separate products. It is complicated for people that already have trouble tracking where their shows are on several different services. Even if they intend to merge Now into Max completely which likely is the case they still are making it confusing as hell for the common user.

<comment><USER63> I'm not sure that confusion will really exist, or that it would be warranted if it did. At least for HBO Now, the existing Android app updated and is now named HBO Max. I just logged into Max using my Now credentials, and it seems to have all the content from Now, plus some extra stuff. I think Max is just a renamed superset of Go/Now (which were basically just two names for the same thing anyway). There seems to be no reason to use Now anymore, and Go seems to only exist as a separate site to appease cable companies that HBO isn't offering a competing streaming service vs what they're giving "for free" to HBO cable subscribers.

</comment></comment></comment></comment><comment><USER64> so basically upvoting?</comment>


Ask HN: Can I become a programmer with a Computer Programmer Analyst course? - <AUTHOR> I am attending Sheridan College (Ontario) for Computer Systems Technology – Systems Analyst and want to become a dev. How hard will it be for me to move in this direction if all the jobs ask for "BA/BS in Computer Science or related field". <comment><USER2> You can become a programmer without anything at all. I went to Uni for Music and Math... what matters is you want to be a programmer. Pick up a few programming languages relevant to a project you can write as a demo of currently relevant technologies. Do a couple of paid or unpaid internships to figure out what business really requires because lord knows they don't teach much of that at college or university. Get references from your tutors and relevant people (example: Team Lead, Managers and Directors) at your internships and start applying for programming jobs. Congratulations, you are now a programmer. Despite what people will tell you, you don't need a degree certificate to get a job. What you can demonstrate you've done and who will vouch for you goes a lot further than a bit of paper. Learn everything you can from your course, the education will surely be useful at some point but don't get hung up on what the degree is or where the bit of paper is from. The most relevant thing you have by taking the course is open access to material, tutors and staff that you can pepper with questions to your hearts content.

</comment><comment><USER3> Hi, I'm a developer working at a startup and I graduated from a Computer Programming course at Fanshawe College in London, Ontario. I hear from recruiters constantly.

So ultimately it depends where you're applying. When I started out, I mostly did freelance work on sites like Guru.com. This let me set up a portfolio of work I could point to, and got me to the point where my lack of a BS could be overcome by "equivalent experience". If you can find enough gigs, you'll get to that point pretty quickly, after which you'll find that most employers won't care that you don't have a BS. Smaller companies will care less as long as you can show that you will be able to do the work. Bigger companies will probably care more / might filter you out (although I will say that I have been contacted by internal recruiters from "big four" software companies, but only more recently, with experience). You additionally might get filtered out later in your career when you try to move into management, but I suspect this doesn't happen as much as you might think.

Also, what does your course cover? If it doesn't teach C++, Java, or Python (and possibly others but mostly at least one mainstream programming language), you might want to consider a different course. There should ideally also be a database architecture segment.

Edit: I looked into your program, looks good, similar to the one I took. I would look at the articulation agreements they have to upgrade to a BS after program completion (one bonus being that you'll still save a lot of money vs. entering into the BS right away). If you can, see if you can get into Waterloo in particular since they have a local Google office. And for the love of God, take the co-op! It's the single greatest way to differentiate yourself from the rest of the students in the program.</comment>


When Yahoo Reigned Supreme - <AUTHOR> http://priceonomics.com/when-yahoo-reigned-supreme/ <comment><USER2> I'm old enough to remember gopher, then mosaic, then netscape navigator, and a web that had only a few dozen sites. Then there was altavista and metacrawler, and of course yahoo. In our (physics) department of 20 people back in the 90s and 00s, no-one ever used yahoo: its 'directory' listing of websites never sat well with any of us, and we never used it: it just felt wrong and cumbersome. In fact the longer yahoo stayed around the more we joked about it. I am still astonished yahoo is still around now, I always felt it was doomed to failure back in the 90s.

</comment><comment><USER3> I wonder if we will be reading this site in 10 years (or its successor) and see a title "When Facebook Reigned Supreme" about how a monolithic social network was seen as a gateway to everything having to do with your friends and interests.

<comment><USER4> Facebook can exploit the network effect. Yahoo, not so much. However, whenever Facebook will be dethroned, it will be because it has become "infrastructure" people take for granted.

Is it just me, or does the graph of VC investment look like fading ripples?

<comment><USER5> Yeah Facebook is able to leverage peer pressure in a big way, yahoo had email but with facebook messenger if you cancel out you lose access to communication with a lot of people. Not even google was able to make a dent in facebook, google plus turned into a broken joke.

<comment><USER6> It didn't help that when the buzz and hype was greatest for Google Plus they... didn't let people join Google Plus without a difficult-to-obtain invite. By the time they cut that out nobody gave a shit anymore.

Turns out Cartman's "you can't come" technique doesn't work so well IRL.

<comment><USER7> It worked for GMail though.

<comment><USER6> Yeah, it did get some buzz going iirc. Gmail doesn't rely on network effects tho.

</comment></comment></comment></comment></comment></comment><comment><USER8> This article is from 2014. A few things have changed since then. For example, Google now does offer ads in the Play Store: [http://adwords.blogspot.com/2015/07/launching-search-ads- on-...](http://adwords.blogspot.com/2015/07/launching-search-ads-on-play.html)

</comment><comment><USER9> People seem to forget that overture (bought by yahoo) was the first to do SEA in auction model like google does now

</comment><comment><USER10> I miss the old Yahoo TV commercials. Those were fun.

</comment><comment><USER11> I never understood the main selling point of Yahoo.

<comment><USER12> Yahoo was a gateway to doing more or less everything you could do on the Internet. With a single account and familiar user experience. You could play games, email, read the news, buy and sell things (stores, auctions, shopping), chat, search, plan travel, share files, have a home page, send money, have a pet (do you remember Yahoo! Mash? neither does anyone else) or find a pet, find somewhere to live, get internet service, listen to music / watch music videos, call your mom, etc, etc, etc.

In 2004 when I went through employee orientation, the company had a clear goal: be a the top 3 online site in as many categories as possible. When I left in 2011, nobody knew what they wanted to do. Now they don't even know how to put a ! after their name!

<comment><USER11> 2004? Interesting. I thought their prime time was earlier.

I started using the Web in 2001 and didn't have much to do with Yahoo.

On the other hand, we had something like Yahoo in German, called "web.de" they were pretty big back then. So I got my infos from Google, my mails from "web.de" and the rest from MySpace haha.

Anyway, Yahoo seemed old school even when I started back then.

</comment></comment></comment><comment><USER13> it's still a pretty big deal in japan, but it's unclear how much of that is a result of the ymobile cat.</comment>


Textillate.js - - <AUTHOR> http://textillate.js.org/ <comment><USER2> While this is pretty awesome, I hope this doesn't become a design trend for usability reasons. Reminds me of `<blink>` in a way.</comment>


Show HN: Valhalla, an open source routing engine - <AUTHOR> https://mapzen.com/projects/valhalla <comment><USER2> How does this compare to Project OSRM [1]?

[1] [https://github.com/Project-OSRM/osrm-backend](https://github.com/Project- OSRM/osrm-backend)

<comment><USER3> this blog post explains some of the major differences in the two architectures: [https://mapzen.com/blog/valhalla- why_tiles](https://mapzen.com/blog/valhalla-why_tiles)

<comment><USER4> The OSRM routing engine appears to focus on contraction hierarchies; is that also the case for Valhalla? [http://en.wikipedia.org/wiki/Contraction_hierarchies](http://en.wikipedia.org/wiki/Contraction_hierarchies)

</comment></comment></comment><comment><AUTHOR> Also, source code is here: [https://github.com/valhalla](https://github.com/valhalla)

<comment><USER5> Since most routing software is proprietary, I think it would be good to combat it by using a strong copyleft on the Valhalla components. GPLv3+ for client software and AGPLv3+ for server software would be awesome.

<comment><USER4> Glancing at the Valhalla repos, it looks like the MIT license across the board: [https://github.com/valhalla](https://github.com/valhalla) ; [https://github.com/valhalla/thor/blob/master/COPYING](https://github.com/valhalla/thor/blob/master/COPYING) ; [https://github.com/valhalla/chef- valhalla/blob/master/LICENS...](https://github.com/valhalla/chef- valhalla/blob/master/LICENSE.md) ; etc...

Also, it's not so much that the routing engines are proprietary -- the best ones are not. The underlying databases are the secret sauce.

<comment><USER6> what are the best ones?

<comment><USER4> For speedy street routing, the Open Source Routing Machine: [http://project- osrm.org/](http://project-osrm.org/) Like Google's proprietary routing engine, it leverages the scale of local and regional travel (via contraction hierarchies, arterial travel is suited for precomputed cacheing); result: the system can be tuned to give near instantaneous results. OSRM had been led by Dennis Luxen of Mapbox, though he just moved to Apple. The OP (Mapzen's Valhalla) appears to have a similar approach as OSRM. Good libraries for other scenarios exist; e.g., cycling and multimodal planning -- see: [http://wiki.openstreetmap.org/wiki/Routing](http://wiki.openstreetmap.org/wiki/Routing) and OpenTripPlanner [https://github.com/opentripplanner/OpenTripPlanner](https://github.com/opentripplanner/OpenTripPlanner)

There's an academic Thesis on the principles of contraction hierarchies that is worth a look if you're in this space. [http://algo2.iti.kit.edu/documents/routeplanning/geisberger_...](http://algo2.iti.kit.edu/documents/routeplanning/geisberger_dipl.pdf) My favorite is actually a Master's thesis that steps through the process of using contraction hierarchies to build a routing engine (MoNav) on OpenStreetMap data. [https://code.google.com/p/monav/downloads/detail?name=thesis...](https://code.google.com/p/monav/downloads/detail?name=thesis.pdf&can=2&q=)

For nuanced or complex problems, set up your objectives and constraints against a good solver: [http://en.wikipedia.org/wiki/List_of_optimization_software](http://en.wikipedia.org/wiki/List_of_optimization_software) I'm partial to Google's OR Tools [https://github.com/google/or- tools](https://github.com/google/or-tools) (Apache License).

<comment><USER7> Just curious: Where did you heard about that Dennis moved to Apple :) ?

Some clarification:

* the process of the route finding is done by Dijkstra or A* or with a preprocessing (CH)

* valhalla does not use CH to my knowledge

* route optimization requires a completely different technique and valhalla does not do this

> "The OP (Mapzen's Valhalla) appears to have a similar approach as OSRM"

no :) ! OSRM is limited to CH (really fast) and valhalla is limited to Dijkstra/A* (really flexible).

<comment><USER4> @karussell,

For a public source, Dennis Luxen updated his Linkedin profile.

Thanks for adding your knowledge about the internals of Valhalla code.

<comment><USER7> ah, easy, thanks :) !

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I'm a bit confused. This doesn't seem like free software after reading the web page. It seems that the client is free, but the server component is proprietary SaaS and you have to get an API key through MapZen? I see several repositories on their GitHub account, but it's not apparent if this is all that is needed to self-host.

<comment><USER8> There is no proprietary component, if you want to self-host it's all here: [https://github.com/valhalla](https://github.com/valhalla)

But there is a free hosted service (with API signup) for convenience.

<comment><USER5> Awesome. Thanks for clarifying.

</comment></comment></comment><comment><USER9> Looks great! I really like the norse themed repository names ... though I'm not familiar with "demos" and "conf", are they some sort of mythical norse figures as well?

<comment><USER10> Demos, the great God of demonstrations and examples. He preferred to teach other Gods, as opposed to humans. Usually he could be found skulking nearby or with API, the God of documentation.

Conf, the lesser known God of configurations and setups. He made sure that everything was well defined in a single place in a concise format, such as acceleration due to gravity, etc.

<comment><USER11> How do you pronounce API?

</comment></comment></comment><comment><USER12> I think I may have found an issue with this. I tried to get directions, and it fell off a random road and then proceeded to have me swim across the San Francisco Bay:

\- [http://i.imgur.com/wWilOoC.png](http://i.imgur.com/wWilOoC.png)

<comment><USER13> Having worked in the routing space (not on this project) and reviewing the code, the implementation is professional-grade. Where as OSM data is rich and challenging to work with for routing purposes.

Your feature/bug: the router told you to take a ferry. You'll see the ferry route represented here: [http://www.openstreetmap.org/search?query=SF%2C%20CA#map=13/...](http://www.openstreetmap.org/search?query=SF%2C%20CA#map=13/37.7862/-122.3625)

</comment></comment><comment><USER14> There doesn't seem to be any priority on freeways. I could route across the entire U.S. and never get on a freeway....

</comment><comment><USER15> A quick question: I have a list of 100+ million points with their geographical distance, but I want to improve it and calculate the "driving distance". How expensive in terms of time/ops would that be?

I'm scanning the different subprojects on Github and I think Tyr is the one I need, but I'm not entirely sure..

<comment><USER16> Are you a salesman by any chance?

<comment><USER17> Nah. Ebay already solved that problem.

<comment><USER10> Obligatory: [https://xkcd.com/399/](https://xkcd.com/399/)

<comment><USER17> Heh, I liked it better when it was implied.

</comment></comment></comment></comment></comment><comment><USER18> Neat project.

There is also a Postgres/Postgis extension pgRouting ([http://pgrouting.org/](http://pgrouting.org/)) that will do routing in the database.

</comment><comment><USER19> Any plans to add public transport support?

<comment><USER8> Yes -- if you're at State of the Map US in NYC this weekend, we'll be demoing it live. Stay tuned.

<comment><USER19> Looking forward!

</comment></comment></comment><comment><USER20> Does anyone know how good the OpenStreetMap data is? I thought I'd heard that it was pretty incomplete.

<comment><USER21> Try it for some routes you are familiar with:

[http://www.openstreetmap.org/directions?engine=osrm_car&rout...](http://www.openstreetmap.org/directions?engine=osrm_car&route=25.774%2C-80.194%3B42.440%2C-76.497#map=5/34.615/-79.080)

It varies around the world, for the US (which I'm more familiar with) intercity is pretty solid, last mile stuff you might be missing a street.

Searching for a specific address can be an issue, but road data is pretty good.

</comment></comment><comment><USER22> Excuse me if this sounds irrelevant, but why name it after Nordic mythology?

</comment><comment><USER23> WE SHALL RIDE THROUGH THE GATES OF VALHALLA, SHINY AND CHROME!

<comment><USER24> Oh what a website.. WHAT A LOVELY WEBSITE!</comment></comment>


New ways to teach young children to code - <AUTHOR> http://www.wsj.com/articles/new-ways-to-teach-young-children-to-code-1455049777 <comment><USER2> My son's been doing Robot Turtles for awhile now and mostly gets it. The next step is to get him to do multiple cards at once rather than one card at a time.

I've heard about Scratch many times, but have never looked into it in detail. Anyone have experience with it for their kids?

My dad taught me GW-BASIC when I was young. One thing that's different now: when I wrote a GW-BASIC program that just printed text, or maybe outputted some CP437 characters, or drew some lines in 4 color mode, it didn't look all that different to "real" programs we ran on an IBM XT. But if my son gets older and I teach him Python or whatever, sure we can write a console app that does something, but it's not going to look anything like most of what he sees a computer doing.

(Though that said, he does like watching me play Brogue, so if we had an @ that moved around the screen getting in fights with r's and j's and B's, then that would be familiar to him after all.)

</comment><comment><USER3> I'd rather teach them to play with blocks. They can learn to code later.

</comment><comment><USER4> Give them a paywall to hack past?

<comment><USER5> Click on "web" below the title of this post and it will get you a link via google that will bypass it.

<comment><USER6> Interesting, I know about the click on 'web' link to bypass paywall. I did that as I usually do but this time clicking though the google results still put me on a paywall.

I wonder if WSJ has changed their policy on visitors from google.

<comment><USER7> Worked with private browsing mode for me.

</comment></comment></comment></comment><comment><USER8> Why does this needs to go into HN when you need subscription to access it.

<comment><AUTHOR> Interesting it was not a subscription article when I first read it</comment></comment>


The Rascal Metaprogramming Language - <AUTHOR> http://www.rascal-mpl.org/ <comment><USER2> It is a niche that needs filling for sure, but I'm concerned that the code analysis and transformation talent is going to continue in the current path, namely, spread out thinly across many environments, languages, and toolkits. What we need is not only a wonderful tool for static code analysis, generation, and transformation, but also an energetic juggernaut of a foundation to evangelize and drive adoption of it. Otherwise, talent will end up corralled in to the Eclipse SDKs of the world.

</comment><comment><USER3> Interesting! Can anyone comment on how it fits in compared to XTRAN ([http://www.xtran-llc.com/](http://www.xtran-llc.com/)), Xtext ([http://www.eclipse.org/Xtext/](http://www.eclipse.org/Xtext/)), or Epsilon ([http://www.eclipse.org/epsilon/doc/eol/](http://www.eclipse.org/epsilon/doc/eol/))?

<comment><USER4> Goals are often similar, but methods very different. Epsilon and Rascal share many design decisions. Rascal is based fully on immutable data, including relations, while the EMF is based on objects.

<comment><USER3> Thanks! That's exactly what I wanted to know.

</comment></comment></comment><comment><USER5> Curious how people who use this find it compares to an environment like Racket?

<comment><USER6> I'd like to ask the same. Most PL research is done with Racket; I imagine this might have a steep uphill battle if it wants to gain traction. But maybe it's target application is sufficiently specialized… ¯\\_(ツ)_/¯

<comment><USER7> > Most PL research is done with Racket

A lot of PL research is done with Racket, but I doubt it is even close to being most, or even more than 1 or 2%.

As for Rascal vs Racket, they really are going after different language engineering niches.

<comment><USER8> How would you describe the distribution of languages used in PL research?

<comment><USER7> Very diverse.

</comment></comment></comment></comment></comment><comment><USER9> Reminds me of Coccinelle - a language for writing semantic patches for C (like eg: add close_foo(fooid) in every function that has open_foo for each fooid etc...) , but I see Rascal can do some more.

</comment><comment><USER10> Since Rascal has integrated Context Free Grammars, does this mean it incorporates the Earley Algorithm for parsing ?

<comment><USER11> Like many things from the Netherlands, it uses SGLR parsing (scannerless GLR, where GLR = generalized LR), which actually handles a class slightly more general than CFG s.

<comment><USER12> How is GLR more general than CFGs?

<comment><USER4> GLR, GLL and Earley's parser (with the tree construction) are labeled "context-free general" parsing algorithms because they can handle _any_ context-free grammar while the other algorithms associated with sub-classes of CFGs, such as LR, LALR and LL do not implement all CFGs. In particular this comes in handy for languages which are unambiguous yet require a lot of lookahead or context to avoid parser action conflicts. The context-free general algorithms are popular among people who have to rapidly prototype languages or implement many different language processing tools without the opportunity to spend months on a parser. We pay in speed. GLR and GLL typically run nearly linearly on normal files, while Earley has a bad average case behavior which is often quadratic.

Another benefit of context-free general implementations is composability of grammars. Since CFGs are closed under composition you can implement modular grammar formalisms using a context-free general parser.

Another main drawback is that (un)ambiguity of context-free grammars is undecidable, and so prototypes generated using GLR, GLL and Earley may produce more than one tree, and in release mode you migh report an unexpected static error to your user in that case. We deal with this drawback using random testing/fuzzing and some static analysis.

</comment></comment></comment></comment><comment><USER13> I'm getting the sense that this project is building something that appears to be complete gibberish to me right now but that in 3 months time it will become absolutely important that I learn it quickly.

Bookmarked so that future me doesn't get angry at losing this.

</comment><comment><USER14> OMeta was here

</comment><comment><USER15> I wish they made their licensing clearer. Their website has nothing to say about this. There is no "LICENSE" file at the top-level of their main source repo, nor any discussion of licensing in their README.

Many of their actual source files have a copyright notice at the top including an EPL (Eclipse Public License) grant, so it looks like this is licensed under EPL. But they could make that fact clearer. (Also, I haven't actually checked every single source file, so there is some risk some of them might be under different license terms.)

<comment><USER4> What was developed in IBM time and what was written as Eclipse plugin is EPL. The rest is BSD2.

</comment></comment><comment><USER16> Situation: "many different tools, possibly even written in different languages."

Many different languages?! Ridiculous! We need to develop one universal system "for any kind of metaprogramming task: to construct parsers for programming languages, to analyze and transform source code, or to define new DSLs with full IDE support. "

Soon:

Situation: many+1 different tools, definitely written in different languages.

<comment><USER4> Working with code Analysis and transformation techniques at the same time was always about glueing database and logic progressing tech to functional programming and algebraic specification tech for us. Just having those linguistically integrated before you start thinking about a language progressing tool makes working with Rascal a lot of fun.</comment></comment>


Show HN: Turbo Boost Switcher – Keep your Mac cool and quiet - <AUTHOR> https://github.com/rugarciap/Turbo-Boost-Switcher <comment><AUTHOR> Someone posted this in the Mac thread yesterday. I gave it a try and it has worked well for me so far. I spun up Divinity 2 and could play it on low settings without fan noise or excessive heat. That hadn't been possible before.</comment>


Secretive – macOS native app to store SSH keys in the Secure Enclave - <AUTHOR> https://github.com/maxgoedjen/secretive <comment><USER3> For anyone not aware, you can use macOS's keychain to store ssh key passwords and have them unlock at login. This way you can have the benefits and convenience of password managers in the command line for SSH certificates.

[https://apple.stackexchange.com/questions/48502/how-can-i- pe...](https://apple.stackexchange.com/questions/48502/how-can-i-permanently- add-my-ssh-private-key-to-keychain-so-it-is-automatically)

<comment><USER4> Does it have touch to authorise (doesn't seem to support that), or is it just going to send on all of one's currently-loaded SSH keys whenever one connects with -A (seems to)?

> You can configure your key so that they require Touch ID (or Watch) > authentication before they're accessed.

That, to me, would be a key thing to want to have: something that tells me "hey, Terminal just wanted to access your Github key. Is that okay?"

If I'm git pushing, that's fine. If I just connected to a random server... that's not okay. What is that trying to do? Deny.

<comment><USER3> After researching this for a while, it seems there is no documented, native option to do this. The only option is to unlock all SSH keys all the time, which makes them less secure than the passwords for websites managed by the exact same keychain. Which, in my opinion, is _weird_.

Do they employees at Apple use a different system altogether? Because the built-in one doesn't seem very secure. Or maybe I am using it wrong, who knows.

In a similar vein, is there an exhaustive manual for macOS? It bugs me that Apple machines cost a small fortune, the OS is full of nifty features, but there is no non-superficial manual shipped with it.

<comment><USER5> _> which makes them less secure than the passwords for websites managed by the exact same keychain_

That's NOT true. While giving out _less_ information to untrusted parties is obviously better than more, the private key itself is not transmitted directly to the server. This means that connecting to an attacker's SSH server doesn't give them a copy of your private key, so they _can 't_ then connect to your SSH servers.

<comment><USER6> The scenario here is with -A (agent forwarding). This means as long as you're connected to a server with that enabled, that server can auth as you to a bunch of other stuff by having your client do it silently.

</comment></comment></comment></comment></comment><comment><USER7> For anyone interested in a standardised/Linux-compatible version of this, check out PKCS11 tokens. Smartcards can and do implement this spec, and if you use PKCS11, the secret is used from the token to sign an SSH login (for example), without being revealed.

This means the secret itself stays on the card. You can combine this with certificates if needed; the smartcard handles the authentication. Using PKCS11 tokens is supported in recent openssh versions. You can also use them for client certificate authentication in web browsers. For anyone familiar with DoD CACs, this is similar - I believe they use a particular card with a proprietary PKCS11 driver, but you can use opensc with any card running a PKCS11 applet.

Some refs:

[https://zerowidthjoiner.net/2019/01/12/using-ssh-public- key-...](https://zerowidthjoiner.net/2019/01/12/using-ssh-public-key- authentication-with-a-smart-card)

[https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...](https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html)

<comment><USER8> You can also do it with PGP smartcards like the open-source NitroKey [0].

For a more analogous equivalent though, there's the tpm2-pkcs11 project [1] that uses anything conforming to the TCG TPM2 spec [2], which includes a surprisingly wide variety of hardware, including many motherboards. My XPS 13 for example has one.

What I'd really like to see though is something that uses the TPM for __host __verification rather than client verification. I 'd love to be able to ensure that the only way for a machine to give me the host key I expect is for that machine to be hardware I own running verified software (e.g. verified by Secure Boot with a custom key).

[0]: [https://www.nitrokey.com/](https://www.nitrokey.com/)

[1]: [https://github.com/tpm2-software/tpm2-pkcs11/blob/master/doc...](https://github.com/tpm2-software/tpm2-pkcs11/blob/master/docs/SSH.md)

[2]: [https://trustedcomputinggroup.org/resource/tpm-library- speci...](https://trustedcomputinggroup.org/resource/tpm-library- specification/)

<comment><USER7> Indeed, PGP smartcards should work too, as should cards using the open-source ISOApplet.

I also played around with tpm2-pkcs11 last year and it worked nicely, and has support on a lot of devices like the XPS (which works really well on Linux!)

Your idea for using TPM as host verification makes a lot of sense to me - <USER2> it stands right now, I'm playing around with this for a side project right now, and a TPM-backed key which is bound to the right PCRs should give you assurance secure boot is enabled, with your own custom keys, and that it loaded your signed Grub, booting your signed kernel.

Got all the secure boot stuff working, now need to figure out what to use the TPM for - options are remote attestation, where server verifies the attestation signature (but this wouldn't be particularly standardised), network level authentication (actually easier - IIRC NetworkManager supports 802.1x authentication using PKCS11, so you can use tpm2-pkcs11 for that), or disk encryption.

Assuming you mean for the remote-end host key, and assuming your server has a TPM available, I reckon that could be quite interesting, but it doesn't look like openssh supports using PKCS11 for HostKey access. Would need to see if the key is used often, or if it's just used to establish connections (since PKCS11 crypto is usually pretty slow, but fine for one-off authentications).

As a closing note for time-travellers from the future etc, worth remembering TPM is far from perfect, and there's quite a few nice attacks if you can "sniff" the serial lines from the motherboard to the TPM itself. And if using the fTPM (firmware TPM), the regular Intel SGX/TXE holes will likely compromise the TPM security properties.

</comment></comment></comment><comment><USER9> Cool but the enclave only supports the secp256r1 curve, whose coefficients are NSA chosen.

<comment><USER10> While I don't think that this is relevant for my personal thread scenarios, I think that this is unfortunate at least and Apple should change it with new hardware.

<comment><USER9> Ya problem is it's all NIST "approved" and US companies love that because it means the government is happy to use their products.

</comment></comment></comment><comment><USER11> Does this mean that the Secure Enclave is accessible by the user? If so, it prompts so many questions. How much disk space is available on the Enclave, for example.

<comment><USER12> Totally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage

<comment><USER13> I wonder what a better term for disk storage would be. Block storage, in the way that cloud services refer to it? Just plain "storage"?

<comment><USER14> Non Volatile Memory

Volatile Memory gets "erased" when powered off

<comment><USER13> Accurate, and in usage in technical circles already. But I've always found it awkward, and names based on what something is not are always unsettling to me.

<comment><USER14> Then just Memory. That's what elderly and nontechies usually call it. And it's correct. Even more correct with always-on-computing and automatic state saving

</comment></comment></comment></comment></comment></comment><comment><USER15> I've been using a YubiKey device for SSH using yubikey-agent [0] and it's been great since it's not possible to extract keys from hardware keys and the device is carried with me. The agent is also integrated with pinentry so it requires a pin code for the session.

[0] [https://github.com/FiloSottile/yubikey- agent](https://github.com/FiloSottile/yubikey-agent)

<comment><USER16> You don't even need the agent with the latest SSH versions, SSH can now use U2F natively, which is wonderful.

<comment><USER15> Oh cool didn't not know that. That's awesome.

</comment></comment></comment><comment><USER17> A similar product that works on macs without a secure enclave by storing keys on the secure enclave of your iPhone is krypton.

[https://krypt.co/developers/](https://krypt.co/developers/)

<comment><USER18> Been using this since the beginning and it's great. However, there has been no updates ever since they were acquired by Akamai. A bit worried it'll suddenly stop working one day...

<comment><USER19> Thankfully (i believe) everything that goes into it is open source [https://github.com/kryptco](https://github.com/kryptco)

<comment><USER20> The github repo seems to be updated only to version 2.5.6 (according to commit message) or 2.5.7 (according to a tag), whereas the latest version on the app store is 2.6.0.

But also, the LICENSE file simply says "All Rights Reserved".

</comment></comment></comment></comment><comment><USER21> From the FAQ:

> Q: How do I import my current SSH keys, or export my Secretive Keys?

> A: The secure enclave doesn't allow import or export of private keys. For > any new computer, you should just create a new set of keys. If you're using > a smart card, you might be able to export your private key from the vendor's > software.

I don't get it. If so, how am I supposed to back up my keys in case of a hardware failure or hardware theft?

<comment><USER22> Like the others have said: You just use multiple. You can just add multiple keys to the authorized_keys file.

This is actually the perfect scenario because an attacker can never get hold of the private key. That means that the key is unique: If it's in your hands, it means an attacker doesn't have it. Most smart cards work this way, they generate the private key inside and it can never leave the hardware, you can only prove you have it by using it to sign or encrypt something.

This is very different from SSH keyfiles on disk which can be stolen in many ways, and as such can be compromised without you ever knowing about it.

It's really cool that we can now use this functionality for SSH too. I currently use Yubikeys in OpenPGP mode for this but I might switch to this once I get a T2-enabled Mac.

<comment><USER21> By "you just use multiple", you mean I would have to generate extra private keys, add them to authorized_keys, and store them somewhere other than my mac, right?

Because just by using multiple keys I would still be locked out if all of them were stored in this 'Secretive' app.

<comment><USER23> If you only have a single SSH key as the only method of authenticating somewhere, you already have a dangerous single point of failure.

<comment><USER24> Not if you have multiple copies of the private key. But yes, there are advantages to having any given key only exist in one place.

<comment><USER25> If you are making multiple copies of a private key in different places, why wouldn't you just keep a _different_ private key in each of those places along with its corresponding public key though?

That way, you can remove trust from just one of them if you (e.g.) have your computer stolen.

</comment></comment></comment></comment></comment></comment><comment><USER26> I have been using sekey for this for a while. Its pretty nice, I mean you do need to auth quite a bit if you use git clone over ssh a lot, but it does mean you know when keys are used.

<comment><USER27> Yep, it's so much better than just key files: keeps key material in a secure system (Secure Enclave), you know when a key is used (standard macOS security prompt), and requires a physical interaction (Touch ID) to use a key.

<comment><USER28> So, a non-portable YubiKey?

<comment><USER29> More like a built-in YubiKey. It's a convenience. When using one's MacBook, you don't need to pull your YubiKey out of your bag/drawer/etc to authenticate, and if you're traveling you can just leave YubiKey at home/the office, giving you one less thing to lose.

</comment></comment></comment></comment><comment><USER30> Does anyone know of a way to guard rclone passwords that would be stored in rclone.conf? Is it possible to leverage the keychain or this tool for this? Typically passwords for sftp logins are stored with a reversible hash (see `rclone reveal`), which isn't ideal.

</comment><comment><USER31> Is a similar service available for yubikeys connected to linux machines?

<comment><USER32> There is:

[https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on- yubike...](https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/)

[https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...](https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html)

The yubikey (at least some models) can work as a smartcard.

<comment><USER31> Thanks.

</comment></comment></comment><comment><USER33> > Auditable Build Process

> Builds are produced by GitHub Actions with an auditable build and release > generation process. Each build has a "Document SHAs" step, which will output > SHA checksums for the build produced by the GitHub Action, so you can verify > that the source code for a given build corresponds to any given release

What will stop an attacker from hard coding code source file hashes? I'm not saying they will, just that it's a bad method of making binaries auditable

<comment><USER34> Nothing. The point is that you can replicate the same steps on your local machine and the hashes should be the same. If they're not it means either github actions and/or the repo owner has been compromised.

</comment></comment><comment> old-gregg For the love of God, please stop using SSH keys. Almost every "company X is hacked" title on HN can be traced to leaked SSH credentials.

Use auto-expiring certificates that are issued after a proper SSO+2FA flow:

[https://gravitational.com/blog/how-to-ssh- properly/](https://gravitational.com/blog/how-to-ssh-properly/)

<comment><USER35> > Almost every "company X is hacked" title on HN can be traced to leaked SSH > credentials.

I don't think that's anywhere close to true but I'd be interested if you have reason to believe it is or some examples. Or maybe it's intentional hyperbole?

<comment><USER6> Intentional hyperbole to sling blog spam. That link is to a site the OP claims in profile.

</comment></comment></comment><comment><USER36> This is the sort of thing I would have expected Apple to do back when they didn't care about macOS at all. Or that they should do now that they are refactoring it.

</comment><comment><USER37> So, macOS keychain simply doesn't have the ability to store in secure enclave?

</comment><comment><USER38> Could this be possible on iOS devices, which also have a secure enclave?

<comment><USER39> You could check [https://krypt.co](https://krypt.co)

(not affiliated)

<comment><USER38> Thanks, that reminded me of upcoming iOS 14 support for WebAuth/FIDO. Perhaps that can be extended to SSH auth.

<comment><USER40> Do you mean with Face ID? Since WebAuth/FIDO already work with iOS 13. I have been using U2F with my YubiKey (whichever one has NFC).

<comment><USER32> Not quite. The point is to use just the iPhone as the authenticator, without an external token.

See announcement here: [https://developer.apple.com/documentation/safari- release-not...](https://developer.apple.com/documentation/safari-release- notes/safari-14-beta-release-notes)

I think it was posted on HN a few days ago, but I can't find it right now.

</comment></comment></comment></comment></comment><comment><USER41> Is is possible to recreate this using Windows Hello and TPM?

<comment><USER42> hmm, interesting question. should be. Windows Hello generates RSA keypairs I think. Can you just use those as SSH keys ? The OS will take care of securing them in TPM if available.

If you wanted to use conventional file-based keypairs and secure the "passphrase" instead, maybe use the Hello private key to encrypt the passphrase into the credential store ? I am not up-to-date on whether there's a newer more secure way to store credentials, but seems like forcing a Windows Hello action to decrypt the data in the store should be sufficient.

I could be missing something though. Otherwise you'd think there'd be a solution from Microsoft already.

</comment></comment><comment><USER43> Nice to see this going mainstream after only

 _checks almanac_

... a quarter-century of standards and practices.</comment>


Hitting the Memory Wall: Implications of the Obvious (1994) [pdf] - <AUTHOR> http://www.di.unisa.it/~vitsca/SC-2011/DesignPrinciplesMulticoreProcessors/Wulf1995.pdf

<comment><USER2> They don't consider a simple solution - static RAM. You can trade cost for memory performance at any time. Although interconnect is becoming a bottleneck, so we build bigger SRAM caches.

They also don't mention how compute requirements often scale faster than the memory size. Some algorithms can be written in very cache friendly ways which take advantage of this.</comment>


A study out of thin air - <AUTHOR> https://www.medicineuncensored.com/a-study-out-of-thin-air <comment><USER2> Summary: Because of one report in the Lancet By a shady corporation called Surgisphere the WHO stopped all further research into hydroxychloroquine.

The article makes a strong case the Surgisphere is shady and the study is badly made but other than timing (paper published 22, ban started 25th) the article does not provide any further information that the Surgisphere study was the source of the WHO decision.

I quoted the unsupported accusation below.

Instead of performing its own due diligence, the WHO immediately relied on an observational study cloaked in the reputation of the nearly 200-year old medical journal The Lancet.

<comment><USER3> And people scoff at reporters and journalists that they don't check their sources... Apparently almost nobody does. We have copy/paste information ecosphere.

<comment><USER2> To be fair, finding out all the information about Surgisphere probably took a lot time. Working on free projects myself there just comes a point where I've spent all the energy I was willing to put into a piece of work.

Edit: Nevermind. The author of the article is the bit-coin investor how first tweeted about Chloroquine being a potential cure, [https://www.wired.com/story/an-old-malaria-drug-may-fight- co...](https://www.wired.com/story/an-old-malaria-drug-may-fight-covid-19-and- silicon-valleys-into-it/)

<comment><USER4> He's not the only one pointing this out, though: [https://www.theguardian.com/world/2020/may/29/covid-19-surgi...](https://www.theguardian.com/world/2020/may/29/covid-19-surgisphere- hydroxychloroquine-study-lancet-coronavirus-who-questioned-by-researchers- medical-professionals), and the "study" is very easily verifiable as horseshit.

</comment></comment></comment></comment><comment><USER5> This site's front page has got a lot of red flags on it. There's another treatment of this over on sciencemag: [https://www.sciencemag.org/news/2020/06/mysterious- company-s...](https://www.sciencemag.org/news/2020/06/mysterious-company-s- coronavirus-papers-top-medical-journals-may-be-unraveling)

This would be a pretty serious black eye for both The Lancet and the WHO, which has already been under scrutiny from multiple countries.

However, it's worth pointing out that this wasn't the only study on HCQ. There have been others: [https://www.cidrap.umn.edu/news- perspective/2020/05/studies-...](https://www.cidrap.umn.edu/news- perspective/2020/05/studies-find-further-lack-covid-benefit- hydroxychloroquine)

 _If_ the Surgisphere observational study turns out to be erroneous, it could knock another leg out from under the WHO, and if it turns out to be fraudulent, everyone involved with it deserves jail time. It'll be terrible in either case that it resulted in a bunch of other trials and studies being canceled.

<comment><USER6> Lots of hydroxychloroquine studies or preprints have been published, and they mostly observe that the effect is close to zero (in good or in bad), either because there is no effect, or the study size was too small to detect other than large effects. But this now infamous study was the only one to suggest a clear and large negative effect.

<comment><USER7> So, if hydroxychloroquine is not effective, what explains an extremely low COVID death rate such as what Bangladesh (a country with endemic Malaria [1]) has?

Bangladesh population: 161 million [2]

Bangladesh COVID deaths: 811 [3]

Bangladesh COVID death rate: 811/161m = 0.000503%

1\. [https://www.thelancet.com/journals/langlo/article/PIIS2214-1...](https://www.thelancet.com/journals/langlo/article/PIIS2214-109X\(13\)70176-1/fulltext#:~:text=Malaria%20is%20endemic%20in%2013,Program%20\(NMCP\)%20in%202007).

2\. [https://www.google.com/search?q=bangladesh+population&rlz=1C...](https://www.google.com/search?q=bangladesh+population&rlz=1C1CHBD_enUS798US798&oq=bangladesh+population&aqs=chrome..69i57.4075j0j7&sourceid=chrome&ie=UTF-8)

3\. [https://www.google.com/search?q=bangladesh+number+of+covid+d...](https://www.google.com/search?q=bangladesh+number+of+covid+deaths&rlz=1C1CHBD_enUS798US798&oq=bangladesh+number+of+covid+deaths&aqs=chrome..69i57.8348j0j7&sourceid=chrome&ie=UTF-8)

<comment><USER8> It really worries me how people are aggressively framing the pandemic as something in the past, and using talking points that are based on a month or two ago. It's necessary to pay attention to what's been happening in May and June.

Bangladesh indeed has a much lower case and death rate so far than the hardest hit countries. But the number of daily new cases is rapidly increasing and in fact is now within the top 10 countries in the whole world. Total cases are increasing 5% a day, which is among the highest growth rates.

</comment></comment></comment></comment><comment><USER9> Trademark filings tell a similar story [https://uspto.report/Search/Surgisphere](https://uspto.report/Search/Surgisphere)

</comment><comment><USER10> The trials are beginning again as per WHO decision now.</comment>