An engineered PET depolymerase to break down and recycle plastic bottles - <AUTHOR> https://www.nature.com/articles/s41586-020-2149-4 <comment><USER2> The exciting thing about this research is that the authors substantially exceeded the normal bar for publishing a scientific article (even one in Nature). They demonstrated industrial feasibility of their proposed enzymatic process by depolymerizing waste PET then repolymerizing it into a useful item (water bottle) that met industry standards for strength/ductility and coloration. I work in microbiology, and seeing research that connects basic biochemistry to actual industrial implementation (at the lab scale) is really impressive. There are pieces of their process that would need to be refined (and the cost of oil would have to rise) for this to be cost competitive with just manufacturing from virgin PET units, but it's a strong foundation. It's much closer to realization than most "researchers discover enzyme that does X and will revolutionize industry Y".

<comment><USER3> It doesn't need to be cheaper than virgin PET, it just needs to be cheaper than virgin PET plus the cost of landfill/"recycling". With more countries now refusing to be dumping grounds the cost of getting rid of old bottles stands to rise considerably.

<comment><USER4> You may be overestimating the cost of landfills.

<comment><USER5> Landfill costs (understandably) vary between countries. Got a lot of empty space? Cheap. Crowded? Not cheap at all.

<comment><USER6> Even in crowded countries, landfill land area is still a tiny percentage.

Its more environmental laws and how strict regulations are about seepage.

</comment></comment></comment></comment></comment><comment><USER7> I don't have access to the article right now either, but I would like to note to the "this enzyme is going to eat all our stuff!" commenters that, in general, most enzymes don't work very effectively in ambient conditions. The abstract doesn't go into detail into how they acheived the "90% in 10h" metric, but I would assume this was in a precisely controlled solution, incubated at an optimal temperature, with fresh enzyme that hadn't had a chance to start denaturing. You aren't going to be able to spray this on the plastic siding of someone's house and watch it wither away (even if home siding was PET and not, IIRC, vinyl or something.)

I _guess_ I can't rule out at that some recombinant bacterium expressing this enzyme might escape the lab and start causing PET objects to get moldy or develop a patina if left out too long [0]. But that would require that this enzyme somehow benefits the bacterium enough that natural selection wouldn't favor dropping the gene for it.

[0] Hrm, there's a thought - what if your refrigerator needed to be refrigerated?

<comment><USER8> This all sounds sensible and reasonable, but just _at this exact moment_ , it's hard to feel _totally_ confident that something bioengineered can't _possibly_ create a plague inadvertently. And I'm assuming that covid-19 _isn 't_ in fact an example.

It made an impression on me, something I read on HN not too long ago, comparing an epidemic to a nuclear reaction - it's really hard to create a critical mass, and when it's dispersed that's it; the really _acute_ problems are local and temporary, despite peoples' fears of invisible radiation and contamination. But once a global epidemic gets going, essentially the whole world may have reached critical mass and has to be diluted. Maybe obvious when stated, but presenting the comparison in the context of the fears people have of nuclear weapons/power is the point.

The probability is low, but the stakes in the near future of biotech seem higher than anything else people can mess with.

</comment></comment><comment><USER9> It's interesting, I've been helping plastic situation by buying shredded plastic scrap and turning it into filament for 3d printers, you need to mix it with virgin plastic (30-70 or 40-60)

Here's the project details: [https://medium.com/endless-filament/make-your- filament-at-ho...](https://medium.com/endless-filament/make-your-filament-at- home-for-cheap-6c908bb09922)

Communities can setup their own machines and create filament from scrap plastic, this is good enough for 3d printing where your life doesn't depend on it.

</comment><comment><USER10> The exciting thing is that there is real progress in increasing temperature stability of enzymes. That's the point of the article, engineering an enzyme that is still active above the glass transition temperature of the substrate. I remember a paper where they tried random mutations all over some enzyme, it was just mindless make-work for an army of graduate students. This one is different.

<comment><USER11> I can't read the article due to paywall. How did they achieve this thermostability? Supercharging the surface?

<comment><USER10> Site-saturation mutagenesis in the active site followed by introduction of disulphide bridges.

<comment><USER11> Man. I would have guessed that adding disulfide bridges would decrease catalytic conversiom rates by making the protein too rigid.

</comment></comment></comment></comment><comment><USER12> For a layman like me, what does this enzyme decompose the plastic into?

<comment><USER13> PET is formed via the condensation of ethylene glycol (ethane-1,2-diol, aka EG) and terephthalic acid (1,4-benezenedicarbyoxylic acid, aka BDC). In the process, a proton (H, a hydrogen) is lost from the carboxylic acid (COOH -> COO) and a hydroxyl is lost from the alcohol (R-OH -> R). The H and OH combine to form a water (hence "condensation") and leave, and an ester bond (RCOO-R') is formed. Amide bonds (RCONR'), the backbone proteins and materials like Kevlar, spider silk, and Nylon, are similar, but less flexible and harder to break.

This condensation reaction (and others) is reversible. If you heat PET in boiling water, you can begin to depolymerize the polymer into its constituent monomers by having a water molecule consumed in the reaction (RCOOR' \+ H2O -> RCOOH + HO-R').

However, PET is a rigid plastic that acts as a barrier material (that's why it's used for bottles and packaging), and has a high glass transition temperature (the temperature at which polymer chain mobility becomes broadly possible -- the polymer is in equilibrium, while it is kinetically trapped below the Tg). This inhibits the breakdown of PET, particularly at low temperature.

Hence, the sentence from the abstract:

> With a high ratio of aromatic terephthalate units—which reduce chain > mobility—PET is a polyester that is extremely difficult to hydrolyse.

Aromatic rings are just that -- rings. They don't flex a lot and can't undergo a lot of thermal motion, can't change conformation, etc.

> Here we describe an improved PET hydrolase that ultimately achieves, over 10 > hours, a minimum of 90 per cent PET depolymerization into monomers, with a > productivity of 16.7 grams of terephthalate per litre per hour (200 grams > per kilogram of PET suspension, with an enzyme concentration of 3 milligrams > per gram of PET).

> We also show that biologically recycled PET exhibiting the same properties > as petrochemical PET can be produced from enzymatically depolymerized PET > waste, before being processed into bottles, thereby contributing towards the > concept of a circular PET economy.

So, they depolymerize the PET, an subsequently repolymerize the terephthalic acids to produce new PET. I haven't clicked through to find if they recycle the EG as well, though.

<comment><USER14> Yours was a wonderful summary – I've actually favorited this comment. Thank you.

</comment></comment></comment><comment><USER15> See the end of the article, patents were taken out starting 2017, and there is a company [https://carbios.fr/en/profile/](https://carbios.fr/en/profile/)

</comment><comment><USER16> What does this mean for PET already in landfills?

Can we trawl through our landfills for old PET and bring it back to (perpetual) life with this process?

<comment><USER17> It would not make economic sense. You'd spend far more money and CO2 output moving mountains of garbage and trying to sort than would ever be recovered by recycling some scraps of plastic. The supply chain of incoming recyclable material is very important to make any recycling process work well.

But yes, it would be possible.

<comment><USER18> Would spraying garbage or landfill with bacteria that could produce this enzyme work? At least at slowly reducing volumes of plastic in landfills into liquid-y form?

</comment></comment></comment><comment><USER19> Don't have access to the full article so I've only read the abstract, but what's the feasibility of deployment here?

<comment><USER20> [https://sci-hub.tw/downloads-ii/2020-04-09/c8/10.1038@s41586...](https://sci- firstname.lastname@example.com)

</comment></comment><comment><USER21> Its got to be cost-effective. That's the gold standard. Is it cheaper than not breaking the plastic down? E.g. other solutions - burning, burying...

Not a moral argument. Just a practical one - the free market isn't going to use this unless it has a short payback period.

</comment><comment><USER22> There's complicated stuff for figuring out if it's useful:

\- Energy in vs energy out

\- The price fluctuation of the underlying feedstocks

\- Scalability - (chemistry is 1000x harder to scale things than comp sci.)

</comment><comment><USER23> Can't plastic already be melted down and reshaped?

Now the question is how to collect plastic in the wild

<comment><USER24> Yes, but for plastics like PET that downgrades the plastic. This process breaks it into monomers so the recycling can be truly circular.

</comment></comment><comment><USER25> > An engineered PET depolymerase to break down and recycle plastic

Wrong title, and it's not for all plastics. We all complain here about journalism taking the wrong conclusion and I'm just pointing out the factually wrong message in the title.

<comment><USER7> "An enzyme decomposes 90% of plastic in 10h" is more succinct and readable than the real article title, and it's not wrong. A depolymerase is a kind of enzyme [0].

[0] [https://en.wiktionary.org/wiki/depolymerase](https://en.wiktionary.org/wiki/depolymerase)

<comment><USER25> I didn't have any trouble understanding it, but I guess we'll just dumb it down into the factually wrong message...

</comment></comment></comment><comment><USER26> i don't want this anywhere near my home please

<comment><USER27> Because?

<comment><USER28> I have a large number of plastic things inside my home that I hope do not become decomposed.

Garbage, sure, decompose away.

<comment><USER29> Enzymes are proteins. They're applied to powderized plastic in a bio-reactor. It's unlikely that they'd be able significantly attack bulk plastics before they themselves get broken down.

<comment><USER30> Wait until some organism eats them and learns to reproduce.

</comment></comment></comment></comment></comment><comment><USER31> Sounds like a weapon

</comment><comment><USER32> That's alarming. Sounds like an effective way to destroy every modern manufactured good.

<comment><USER33> It only destroys the goods if you let them soak in the solution for hours. How does that make it dangerous? If someone wanted to just destroy goods, fire is way more effective.</comment></comment>


The Secrets of the Wood Wide Web - <AUTHOR> http://www.newyorker.com/tech/elements/the-secrets-of-the-wood-wide-web <comment><USER2> This was also the topic of last week's Radiolab

[http://www.radiolab.org/story/from-tree-to-shining- tree/](http://www.radiolab.org/story/from-tree-to-shining-tree/)

<comment><USER3> I feel like this is happening a lot more recently. A great episode comes out on some podcast I'm listening to, then a slew of articles reiterating the same content comes out the following week. In a way, it feels like theft of someones hard work at researching a new topic.

<comment><USER4> I don't know if this was the case here but what happens a lot of the time is that there's a new book or paper or whatever. Press releases get sent out or stories are otherwise pitched and you end up with different writers or producers creating variants of the same story.

</comment></comment></comment><comment><USER5> On a suspicion, I checked, and yes, this is the son of "morphic resonance" biologist Rupert Sheldrake.

I'd love to be a fly (agaric) on the wall at one of those family reunions!

<comment><USER6> Yes you can. They hold workshops once a year on a small island north of vancouver. You just missed this years workshop: [https://hollyhock.ca/programinfo/sheldrake/](https://hollyhock.ca/programinfo/sheldrake/)

</comment></comment><comment><USER7> Very cool. Coincidentally, I watched this fascinating talk by Suzanne Simard only yesterday, on how trees 'talk' to each other... [http://www.ted.com/talks/suzanne_simard_how_trees_talk_to_ea...](http://www.ted.com/talks/suzanne_simard_how_trees_talk_to_each_other)

</comment><comment><USER8> Interesting to see the scientific pursuits of someone I only know through music! Gentle Mystics is worth checking out -- it's a wild blend of some sort of alternative electro swing with influences of gypsy jazz, hip hop, and chiptune.

That said I think I personally prefer the solo work of Merlin's brother and bandmate Cosmo Sheldrake. You can certainly see the influence of biological science on his work as well, which includes songs about tardigrades and pelicans and moss. I'd recommend giving the _Pelicans We_ EP [1] a listen; it's got some really varied and interesting influences as well.

[1] [https://soundcloud.com/cosmosheldrake/sets/pelicans-we- ep](https://soundcloud.com/cosmosheldrake/sets/pelicans-we-ep)

</comment><comment><USER9> There's also The Hidden Life of Trees by Peter Wohlleben. There was an article about it earlier this year. [1]

[1] [http://www.nytimes.com/2016/01/30/world/europe/german- forest...](http://www.nytimes.com/2016/01/30/world/europe/german-forest- ranger-finds-that-trees-have-social-networks-too.html)

</comment><comment><USER10> That is cool.

I hope the authors of Samorost and Botanicula get to see this article, I'm sure they'll be interested.

</comment><comment><USER11> > Merlin Sheldrake

Nominative determinism.</comment>


Computer Vision Networks - <AUTHOR> http://www.numenta.com/mediawiki/index.php/Community-Created_Vision_Networks

<comment><USER2> This is really cool. Is this something that has an API so you can build it into your own apps?

Are there any objective reviews of the Numenta HTM stuff?</comment>


Show HN: Honeycomb – 10 Minute Podcast Bites, Curated for You - <AUTHOR> https://usehoneycomb.com/ <comment><AUTHOR> I love podcasts and take a lot of notes on them, but my friends/family just want the most interesting snippets of them because (1) they don't have the time to listen to all and (2) there are TOO many podcast episodes.

So I've built an app that curates ~10 minute snippets - not unlike a Pandora for podcast bites.

Curious what it sounds like? Here's an example - [https://soundcloud.com/user-857781619/curatedpodcast- coronav...](https://soundcloud.com/user-857781619/curatedpodcast-coronavirus- impact-on-economy-rude-babies)

Would love to hear thoughts on how I can make this better!</comment>


Grow Detroit founder discusses reviving Detroit as a startup city - <AUTHOR> http://bloom.bg/1bOsimZ#ooid=dhcXdmZDpIa1aj8PewlDROnZrUes3xk0

<comment><AUTHOR> Alex Southern is one of the go to people on startups in Detroit. Most of the startup founders see Detroit's bankruptcy as a positive event.</comment>


Ask HN: How much did you spend on Design of v1? - <AUTHOR>

For those startups that needed a good looking and well-designed website/app from the start (I.e. a $50 template was not enough) How did you find suitable, affordable web designers and how much did you need to spend?<p>I am interested in a level above cheap templates, 99 designs, elance etc <comment><USER2> V1 is not important as far as design aesthetic goes. It can be totally rough and made of standard components. Function is much more important. Then you can test it out in the field and go for customer acquisition.

Once you've gathered feedback and have a proven (somewhat) potentially successful product you can work on design.

Then, once you're in a position that says "Hey! This just might work!" you should have a list of designers you've already identified through their portfolio sites to contact about working for you. Really good design isn't cheap. It's an art. Mediocre design is cheap which means it's really expensive since you'll just throw it all away anyways.

<comment><AUTHOR> I agree in principle, most of the time. Consider though, certain sites will require good design from day one. A 'totally rough' site would not give you the credibility you need to even get started and acquire customer #1.

The MVP mantra is valid, but cannot be applied in every case - especially when your core product involves good design or aesthetics.

Sites where a rough MVP v1 would not work, IMO: <http://sortfolio.com/> <http://dribbble.com/> <http://www.shopify.com/> <http://www.weebly.com/>

I am interested to know about "..you should have a list of designers you've already identified..." i.e. any HN'ers care to share their lists?

<comment><USER3> I'm curious to hear what your definition is of a good looking and well- designed website/app.

In my mind, a well-designed website is simply something that delivers functionality in an unobstructive way. What's wrong about the 4 websites listed above?

<comment><AUTHOR> My meaning is that those sites listed above _are well designed_ because they _need_ to be. A designer won't pay money to list their company on a crap template monster website that you code up in a weekend.

Having a good-looking website is required for the MVP rather than 6 months down the track when the "idea" is proven.

My point is that some sites/startups need to look highly polished from day 1, even before you launch.

</comment></comment></comment></comment><comment><USER4> I suggest partnering with a designer or a design company. Offering them equity might get you a good start in terms of design and of course it continues further as your startup scales up.

All the best!

<comment><AUTHOR> I didn't consider offering equity. I understand it's common but I have a (possibly irrational) aversion to giving away any part of my company. To the point where I would rather do freelance work to get the money and pay the designer.</comment></comment>


Researchers 'Reprogram' Network of Brain Cells with Thin Beam of Light - <AUTHOR> http://datascience.columbia.edu/researchers-reprogram-network-brain-cells-light <comment><USER2> This research from Yuste's lab is really refreshing to me and probably more appealing to the HN audience than a lot of other neuroscience research. The main reason is that it focuses on how the brain carries out information processing and tests predictions made by theoretical and mathematical models of neuroscience proposed ages ago, e.g. Hebbian cell assemblies, attractor networks (Grossberg, Amari, Hopfield, et al.). And of course, there's a feedback loop here that further informs these theoretical models. I believe Numenta uses some of these principals in their models.

</comment><comment><USER3> "I always thought the brain was mostly hard-wired," said the study's senior author, Dr. Rafael Yuste, a neuroscience professor at Columbia University. "But then I saw the results and said 'Holy moly, this whole thing is plastic.' We're dealing with a plastic computer that's constantly learning and changing."

Is this quote being taken out of context or do many neuroscience researchers really think the brain is some sort of static thing? Basic life experience would seem to tell me that this isn't the case. I'm assuming they just mean they haven't been able to observe this reprogramming ability, or do they really think the brain is some sort of immutable object?

<comment><USER4> While there have been monumental breakthroughs in understanding, the core idea of neuroplasticity is nothing new [1], and that quote certainly strikes me as odd. It sounds like what a neuroscientiest would say if he were explaining the concept of neuroplasticity to a toddler.

[1] [https://en.wikipedia.org/wiki/Neuroplasticity#History](https://en.wikipedia.org/wiki/Neuroplasticity#History)

<comment><USER5> As Wikipedia points out neuroplasticity is "an umbrella term that describes lasting change to the brain throughout an individual's life course. "

This is about changing active neurons in matter of hours/days, without necessarily being lasting, just induced ones.

</comment></comment></comment><comment><USER6> Even after several years of studying molecular biology, my mind is still blown by something like "They injected the mouse with a virus containing light- sensitive proteins engineered to reach specific brain cells." Just think of how many people worked hard (and for how many years!) to make this possible.

</comment><comment><USER7> Maybe I'm tired but where is the link to the study? It's their own PR department!

<comment><AUTHOR> Behind the usual Science paywall:

[http://science.sciencemag.org/content/353/6300/691](http://science.sciencemag.org/content/353/6300/691)

<comment><USER8> Can be sci-hubbed for those without endowments to back their studies..

</comment></comment></comment><comment><USER9> The military is already using it. [https://hatmer.github.io/assets/documents/Document.pdf](https://hatmer.github.io/assets/documents/Document.pdf)</comment>


Live Different - <AUTHOR> http://nathanbarry.com/live/

<comment><USER2> "If your finances are in order and you have money in the bank quitting that job isn't quite so scary."

The pivotal point of this philosophy, and yet you make sound so wonderfully trivial.

<comment><AUTHOR> You're right, that quote sums up so much of what makes my lifestyle possible.</comment></comment>


Tesla Model 3 Teardown by Engineering Firm Reveals Flaws Like 'A Kia in the 90s' - <AUTHOR> https://jalopnik.com/tesla-model-3-teardown-by-engineering-firm-reveals-qual-1822678045 <comment><USER2> Most of that seems forgivable but this screams lawsuit: Munro also chides the Model 3's lack of a mechanical door handle in the rear. Up front, there's a little lever in addition to the electric door-opening switch, but in the rear there's not. In the case of an emergency that cuts the car's power, Munro says, you'd have to fold the seats back and exit through the trunk. (Obviously, you could go through the front seats as well).

Someone is going to die because of this.

</comment><comment><USER3> Considering the price of the other models in Tesla's range, obviously they were going to have to cut some corners to bring the price down sufficiently. Some of these are fairly benign, although the idea of the rear doors not having mechanical releases in an emergency sounds problematic. Also, the idea of pulling two bare wires out of the front and connecting a car battery directly to them is a real hack.

The car is very new on the market, so time will tell if these issues become actual problems.

</comment><comment><USER4> The critic in addition to criticizing the fit and finish (fair thing to do) chose to criticize aspects of its emergency design --but according to commenters, same critic swooned over BMW i3 which has similar emergency design choices. Maybe the critic has a point, but then should at least criticize EV MFGs equally.

<comment><USER5> Does anyone ever consider the possibility that the quality of the car reflects the quality of the producer? No, it always has to be some conspiracy

<comment><USER6> I don't know man Tesla brings out the worst in people.

My take: Tesla is a new car builder running into the same problems as every other new car builder. They're not better or worse. Making good cars at volume is hard.

The conspiracy angle is ridiculous. Tesla is NOT disrupting this industry, not until they make 10 million cars a year at a sub $30000 price. Japanese auto makers in the 70s and 80s were disrupting. Although I do think some car makers are jealous of the good vibe the Tesla brand has.

<comment><USER5> Of course, why assume that complaints about quality of their products must come only from dishonest, stupid or otherwise malicious people? Until recently the default strategy of Musk was to attack or discredit the critic instead of addressing the issue</comment></comment></comment></comment>


Ask HN: How does Austin compare to other tech hubs? - <AUTHOR> I am a developer in the Washington DC metro considering moving to Austin because the DC metro area tech seems to be many years behind the other tech hubs. I was if people had insights or stories they'd like to share about moving to Austin.
How do salaries compare?
Is it easy to get a job if you're an average
engineer? (ie. not from Google, etc.)
What is the tech culture like at most companies? (Here most companies wear suits, etc?
Do most people work crazy hours?
Is the technology a few years behind SV?
Please share your thoughts <comment><USER2> A few things I've noticed as I've read about other peoples' experiences:

\- Most startups are B2B, as opposed to those in Silicon Valley, of which the vast majority are B2C.

\- Things move a bit slower - there's more planning, less hackety-hacking. This isn't necessarily a bad thing, and doesn't mean that you'll be twiddling your thumbs.

\- Cost of living is much, much lower, as you might imagine.

\- Tech scene is smaller, but more tight-knit. There aren't a vast array of VCs and companies like in the valley, so chances are you'll bump into the same people over time, and be able to build more personal connections within your network, which is probably better than having a larger, more impersonal network.

\- A lot of big companies have satellite offices around Austin, like Apple, Intel, IBM, etc. You aren't necessarily locked into working for an "Austin company", if you don't want to.

<comment><AUTHOR> > \- A lot of big companies have satellite offices around Austin, like Apple, > Intel, IBM, etc. You aren't necessarily locked into working for an "Austin > company", if you don't want to.

Sounds good to me! I just want to avoid anything government-contractor related after my experience in the DC metro.

</comment></comment><comment><USER3> Austin is modern technically but, small compared to other cities. I moved there in 2005 and moved away in 2010 because the tech companies in my niche went away and I could not even get an interview let alone a job.

<comment><USER4> I assume you moved to Houston since you were already so close.

<comment><USER3> Moved to SF Bay area. Houston is a bit too humid.

</comment></comment></comment><comment><USER5> Generally there are more job opportunities in Washington DC area. Salaries are also slightly higher there ~$110k/yearly vs ~$105k/yearly . You can do some comparison on the salary map: [https://jobsquery.it/map](https://jobsquery.it/map)</comment>


How I think I want to drop modern Python packages into a single program - <AUTHOR> https://utcc.utoronto.ca/~cks/space/blog/python/PipDropInInstall <comment><USER2> This is a solved problem and the solution is virtualenv. Learning how to use venv's would have likely taken less time than the tinkering described in this post. If you're going to regularly develop with python and use 2nd/3rd party code, it's worth knowing.

<comment><USER3> Agreed - I was a virtualenv holdout until recently and even though it's a horrible solution with replication of junk everywhere it's the way to go.

<comment><USER4> Deduplication should happen at the filesystem level.

Databases do it, Git does it, ZFS does it.

Ok the first two examples aren't filesystems but they can store files, so not totally irrelevant?

<comment><USER3> Yeah, agree kind of. But having to resort to duplicating binaries over and over is a sign something isn't right. Not that it's an easy thing to solve.

<comment><USER4> It depends, binaries are just data. You reference that data with a path on the filesystem. In a programming language it would be assigning a value to a variable. For static values, the compiler/interpreter can optimize and do deduplication. And you expect it to do so because you don't want a global variable holding the value 1 to do the optimization yourself.

Relying on abstractions to simplify the architecture is a sign something might be right. Simply because simple things are less error-prone IMHO.

</comment></comment></comment></comment></comment><comment><USER5> With Python the future is here but it is not evenly distributed. In particular, it's been depressing to see that "any answer at all" has so often won out against "a correct answer".

Java has been a safe place to deploy code to because of its xenophobia. You don't expect Java to be linked into endless C libraries, and Java often doesn't come pre-installed thanks to license issues. (Maybe Larry Ellison is rich because you read "INSTALL JAVA TO EXPERIENCE THE POWER OF JAVA". The consequence is that you got a clean copy of Java and that your clean copy of Java won't break all the crapplets that came with your OS that expected an ancient Java that came with the OS.

Python got a boon from being shipped w/ most Linux distros, but it was also a setback... On Linux "python" became a synonym for "python 2" because otherwise you'd break the system scripts. (Today it drives me nuts that Microsoft added "python" to the past on Windows because Windows was the one operating system where you didn't have to hide the system Python to get a good Python)

"venv" is genius but conda got so much mindshare that many people never realized "venv" could do everything "conda" does except for corrupting internal data structures that force a periodic reinstall.

The consequence is that "best practices" haven't been institutionalized in most places, you have to continuously fight bad practices, and people like the poster are always inventing non-solutions to the problem venv solves.

(e.g. for instance, what about the person who uses a Docker container to keep python environments apart as opposed to one who uses venv?)

<comment><USER6> For conda it's an unfair characterisation. Conda is language agnostic and can be (and is) used to ship anything. Packages like GCC/Clang/R will never be accessible for venv. Personally I find it magical to be able to ship complex packages on conda-forge that "just work" on Linux/macOS/Windows/ARM/POWER without requiring users to have special privileges.

<comment><USER5> I'm tempted to say "so what?"

Here's a specific example. In a previous job I had to work with Tensorflow models of various vintages that depended on different versions of CUDA.

Conda (out of the box) did nothing to help with that problem. I think an early version of Conda might have installed one early version of CUDA, but the elephant in the room as that I would need to install as many versions of CUDA as necessary.

NVIDIA uses a lot of intimidation to fool people as to the nature of the drivers. Specifically, CUDA/CuDNN and such don't depend on kernel drivers or Windows installers, but just require that some huge directories full of userspace libraries be on your path. Thus you can have CUDA version A linked into one conda environment, and CUDA version B linked into another conda environment and it all worked.

That is, it worked when I made my own conda packages (conda wasn't allowed to distribute such package by NVIDIA) and it was astonishingly slow because conda stores packages in BZIP2 files that take forever to unpack and because conda wastes more time with it's symlink machine.

In the end it was possible to solve the problem w/ conda but if I hadn't been distracted by conda I probably would have solved it just as quickly by unpacking the userspace drivers once and just setting the path appropriately.

</comment></comment></comment><comment><USER7> I do full time scientific python, and this post has some _painfully_ wrong ideas.

 _> The official oletools install instructions talk about using either pip or setup.py. As a general rule, we're very strongly against installing anything system-wide except through Ubuntu's own package management system, and the environment our Python program runs in doesn't really have a home directory to use pip's --user option, so the obvious and simple pip invocations are out._

No! The obvious and simple pip invocation is as follows:

      python3 -m venv ${HOME}/myvenv
      ${HOME}/myvenv/bin/pip install foo bar baz oletools
      ${HOME}/myvenv/bin/pin install -e /path/to/my/installable/project

and then edit your code in `/path/to/my/installable/project/project-name/*.py` to your heart's content and tell your IDE or editor that `${HOME}/myvenv/bin/python` is the python to use. Activation is strictly optional, but if you like that, `source ${HOME}/bin/activate` (or use direnv to do it for you).

I would also recommend

      export PIP_REQUIRE_VIRTUALENV=1

I divorce what $USER thinks `python` means from the system python as soon as I can with `pyenv global 3.8.5`: [https://github.com/pyenv/pyenv](https://github.com/pyenv/pyenv)

Of course never, ever `sudo pip ... `.

And don't touch $PYTHONPATH unless someone has forced you to use Caffe, who should be shamed on a regular basis for being Bad At Packages.

<comment> hal9000-tng > No! The obvious and simple pip invocation is as follows:

> [complex commands to set up a venv follows]

"All you have to do is... recompile your kernel... check your version dependencies... maybe do that once or twice. It's so simple, I don't know why everyone doesn't do it!"

Ubergeek.tv's classic "Switch to Linux" spoof ad of 2001:

[https://www.youtube.com/watch?v=Xtah_05BOe8](https://www.youtube.com/watch?v=Xtah_05BOe8)

<comment><USER7> I generalized a bit for completeness and to emphasize that contrary to the article's point, you can do all of this in $HOME and never install anything outside your home directory, which was a concern of the author as a usage policy for their server.

      python -m venv myvenv
      myvenv/bin/pip install ...

works just as well, i just needed a concrete path to talk about in the rest of the text.

Compared to "just pip" it's one whole extra line, so I don't think it's amazingly godawful at all.

<comment><USER8> _> you can do all of this in $HOME_

Which the author explicitly said _does not exist_ for the use case he is discussing:

"the environment our Python program runs in doesn't really have a home directory"

<comment><USER7> so put it wherever! it's just a directory, put it where you have write access.

<comment><USER8> _> so put it wherever! it's just a directory_

You can certainly put a directory wherever you like and put the code there. In fact, that's exactly what the author did, as he describes in the article.

What you can't do is just magically have that directory be the "home" directory of a user and have the $HOME environment variable always point to it. You might be able to set things up to do that in principle, but it might not be worth the trouble as compared to other solutions. In fact, that's pretty much the position the author takes in the article for his use case.

<comment><USER7> the position the author takes is "i've never heard of `venv` so i'll do these other terrible 5 hacks instead".

$HOME or not is a red herring, i apologize if it appears more salient than it really was meant to be.

<comment><USER8> _> the position the author takes is "i've never heard of `venv` so i'll do these other terrible 5 hacks instead"._

No, it's "I don't need the full power of venv so I'll just put the code in a specific directory now that I've figured out how to tell pip to do that when it's not a user's home directory". Using pip install's "\--target" option hardly qualifies as a "terrible hack". The designers put it there because there were valid use cases for it. Setting environment variables before running a program is hardly a "terrible hack" either; it's one of the most common uses for shell scripts.

 _> $HOME or not is a red herring_

If all you meant by it is "put the code in any directory you like", then, as I said, that's exactly what the author did.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> > Nor do we want to learn about how to build and maintain Python virtual > environments

This is a shame, because this is one thing that Python gets mostly right. You don't have to fuss around with the shell wrapper, etc. For 90% of cases you can probably do:

        $ virtualenv subdir-name
        $ subdir-name/bin/pip install <package-names>
        $ subdir-name/bin/python your-python-script.py

<comment><USER10> You also lose tested versions from OS. You will either have to do your own QA of working dependency versions and manually keep them updated over time (e.g. security fixes, or stick with what you freeze forever), or just get dump of last versions every time you deploy the virtualenv.

<comment><USER11> Each package owner probably knows much better about the dependencies than the "OS". Save for a handful of Python packages that have extra-Python OS dependencies, relying upon the explicit versions called out by the package owner is generally more reliable.

</comment></comment></comment><comment><USER12> Downloading the package and "vendoring" it can be a useful strategy. The tool basket can help with that, although pip to a folder should work as well.

[https://pypi.org/project/Basket/](https://pypi.org/project/Basket/)

</comment><comment><USER13> The correct solution here is to make a Debian/Ubuntu package out of oletools, that way Chris gets exactly what the wanted.

If he asks nicely on IRC, he might even get someone else to do it for him.

</comment><comment><USER14> poetry, pipx, and pyenv are pretty much all you need to be happy with python project management and sandboxing. They address the issues in the article and are far more ergonomic than plain venv wrangling.

</comment><comment><USER15> There is no real direction in the article. I did not see any takeaway, or some kind of proposition or nice trick?

It can pretty much be summed up as "I don't know much of Python and admittedly don't want to spend time on it, so I did a bunch of hacks to download my dependencies and it worked".

> Nor do we want to learn about how to build and maintain Python virtual > environments

I think the author would have better spent his time learning the basic usage of virtualenv/venv than writing this blog post.

<comment><USER16> > I think the author would have better spent his time learning the basic usage > of virtualenv/venv than writing this blog post.

I don't. Virtualenv is a hack to workaround the mess of Python paths that they won't actually fix. I'd put it in a similar bucket as Docker (hacking around the mess of binary software distribution on Linux).

I don't want to spend my time learning workarounds.

<comment><USER17> But, it's a "hack workaround" that a professional consensus has converged upon. Pythonistas have developed supporting tools & help-texts, & many assume the use of silo'd virtual environments as 'basic hygiene' for serious work. The approach is also highly analogous to other "alternate virtual root" solutions across OSes/containers/user-customization schemes.

So instead of that, you'd rather... make you own custom hack workarounds? That will be idiosyncratic to your installations/projects? That will hit unique errors/tradeoffs the standard convention has already worked around? That will be harder for others to understand?

OK, to each their own!</comment></comment></comment>


Results of May's HN unix command survey (spoiler: lots of Rails) - <AUTHOR> http://jvns.ca/projects/unix-command-survey/graph.html

<comment><USER2> The graphs are nice. But I think raw histograms of the most used commands, and a table with the highest correlations per given command would also useful and more digestible.

If you still have the per user data around, I'd also love to see the most often used commands by the community that I never or very rarely use. Maybe I'll find a gem of a unix command I didn't know about yet.

<comment><AUTHOR> I've spent quite some time looking at those histograms, but I haven't found a good way to display it usefully yet.

The most popular commands are 'git', 'ls', and 'cd', and the table of most used commands is too long to be able to easily digest. Any suggestions would be appreciated, though!

<comment><USER3> It'd be awesome to see a dump of the data so that we can examine it on our own - many people may think of ways to use it that you haven't, or draw different conclusions from it. :D

<comment><AUTHOR> Yeah! This is something that I'm interested in, but there are a bunch of privacy issues with a raw data dump (references to specific files/URLs and possibly passwords), and I haven't gotten around to making sure it's safe yet.

(note: I haven't actually seen any passwords, but that doesn't mean there aren't any)

<comment><USER3> Oh, that totally skipped my mind. Maybe run something to recognize URLs (replace with $URL, or some kind of placeholder), and then try to obfuscate filenames and the like in a similar way? By normalizing the data like this, you could get much better results with regards to command line switches and the like.

</comment></comment></comment></comment></comment><comment><AUTHOR> Someone pointed out to me the 'ls' typo constellation =D

[http://jvns.ca/projects/unix-command- survey/graph.html?cente...](http://jvns.ca/projects/unix-command- survey/graph.html?center=sl&degree=2)

<comment><USER4> Similar to the mysql-semicolon cluster: [http://jvns.ca/projects/unix-command- survey/graph.html?cente...](http://jvns.ca/projects/unix-command- survey/graph.html?center=;)

</comment></comment><comment><USER5> In general, a very nice thing and thanks for sharing! But...

1\. Are you sharing the raw data? (It would be great!)

2\. It would be useful to see frequencies (e.g. as sizes of nodes).

3\. Why we cannot see 'git', 'ls', 'cd'?

4\. At the first glance things like "pytho", "sourc", "worko" look like a glitch. Also, when there is a cluster of commands starting with the same thing, the subgraph is hardly informative. How about scaling text (instead of cutting them)?

5\. When it comes to a measure of co-occurrences, a nicer quantity than correlation is the following - [http://stats.stackexchange.com/questions/6047/does-this- quan...](http://stats.stackexchange.com/questions/6047/does-this-quantity- related-to-independence-have-a-name) with a direct interpretation of "how does the observed coincidence rate correspond to the expected one for independent variables".

I used it a few times (after testing other measures of co-occurrences (also: conditional probability) and being dissatisfied by results, especially ones favouring edges for big or small nodes). Examples (with their recipes) below:

My StackExchange visualization: [https://github.com/stared/tag-graph-map-of- stackexchange/wik...](https://github.com/stared/tag-graph-map-of- stackexchange/wiki)

And my visualization of themes in books: [http://stared.github.io/wizualizacja-wolnych- lektur/polish_b...](http://stared.github.io/wizualizacja-wolnych- lektur/polish_books_themes.html)

<comment><AUTHOR> I've answered 1) and 3) below.

Thanks for the link in 5)! That's really useful.

I really like the two visualizations you've made -- I'll definitely look into incorporating some of those ideas when I have time.

</comment></comment><comment><USER6> This is pretty nifty!

Where is 'git'? I can't seem to find it using the search.

<comment><AUTHOR> good question! The issue is that _everyone_ uses git, so it's not correlated with any other commands.</comment></comment>


$3k Bug Bounty – Twitter's OAuth Mistakes - <AUTHOR> https://shkspr.mobi/blog/2018/12/twitter-bug-bounty/ <comment><USER2> Well done for getting them to pay up!

This looks a lot like the one I found a while back (after falling victim to it myself and spending a few weeks looking for it). Reported it through HackerOne and thanks to a shirty Twitter developer and his boss, got a permanent ban from HackerOne.

Needless to say, if I find anything else of this magnitude, I'll be keeping it to myself.

<comment><AUTHOR> I'm sorry that happened to you. I've had mixed success with the large bug bounty sites. Some companies are clearly there as a fig-leaf, and others are unable to handle the large volume of reports they get. But I've found most to be good.

<comment><USER2> Yeah I've seen a few patterns with the worse companies...

      * "We've already fixed it" (we haven't but we don't want to pay up, and a fix mysteriously appears a month or three later)
      * "This is not eligible" (we don't actually care)
      * Silence
      * Legal threats ("send us your address so we can send you something for this", and a C&D turns up)

</comment></comment></comment><comment><USER3> Why do many popular sites have bugs in Oauth? Isn't there a standard implementation or lib?

</comment><comment><USER4> Just ran across this when browsing HackerOne for fun last night. Bravo, great job!</comment>


Five Myths about 5G - <AUTHOR> https://www.wsj.com/video/five-myths-about-5g-debunked/DF82ECE8-C44B-477C-BE2E-39A1FDCF090D.html <comment><AUTHOR> There's a huge lobbying push for "5G" coming from somewhere. Yet the claims for it are totally bogus. Remote surgery? Self-driving cars? Coordinating agricultural equipment? Huh?</comment>


Boy hides in commercial flight wheel well; rides from NC to CT before falling - <AUTHOR> http://www.nytimes.com/2010/12/11/us/11plane.html

<comment><USER2> You don't just fall straight down. Aside from air resistance, you will keep the horizontal velocity that the aircraft had when he fell.

The kid must have been quite a projectile.

</comment><comment><USER3> That kid was dead within 15 minutes of the plane leaving Charlotte. If the hypoxia didn't kill him quickly, the cold certainly would have. And then there is the hydraulics of the wheels themselves. It's just an insane thing to do.

Seems like anybody with half a brain would have known that this was suicidal, especially after the Payne Stewart crash <http://www.airsafe.com/stewart.htm>

Very sad story.

<comment><USER4> While it is fatal more often than not, survivors are not uncommon: <http://www.slate.com/id/2093341/>

</comment></comment><comment><USER5> Does that mean we are now going to get searched for any teenage boys hidden about our person?

</comment><comment><USER6> text only: [http://viewtext.org/article?url=http://www.nytimes.com/2010/...](http://viewtext.org/article?url=http://www.nytimes.com/2010/12/11/us/11plane.html%3F_r%3D1)

</comment><comment><USER7> Why does the title say CT? Are they implying he continued on momentum to Milton, MA? My gorilla math says yes.

Terminal velocity of 200 mph from 30k ft is ~ 6 min fall x 500mph plane speed = 50 miles max (w/o wind resistance)

EDIT: NE corner of CT to Milton is about 40mi so its borderline - Also the NYT title doesn't say CT</comment>


How to Build a Continuous Delivery Pipeline with Gradle and Jenkins - <AUTHOR> http://gradle.org/videos/continuous-delivery-build-pipeline-jenkins/ <comment><USER2> Nice, We used to Gitlab CI + fastlane for our React Native pipelane, work pretty good.

Algorithm: By-default, deploy into TestFlight and Beta GPlay, with version from git tag ("v1.0.0 e.g."). IF latest commit has a tag "v1.0.0-production", deploy on production too.

<comment><USER3> Glad to hear you're using GitLab CI, is there any way we can improve it further?</comment></comment>


Ask HN: YC 17 Summer – 0 views on our 1 min video - <AUTHOR> I've been monitoring the number of views on youtube on our 1 min presentation video for our YC application. I still don't see any views, we submitted our application on the last day a few hours before the end.<p>We still have 4 days left before they send out invites/rejections. Have you guys noticed any views on your videos? Does YC even watch them? <comment><USER2> Forgive me if this seems brash, but in my opinion, you've got to treat this like courting a love interest. It's a bad idea to constantly check your texts to see if they have read the latest unanswered one. It shows insecurity and that you're willing to wait around for them to call the next shot.

You'll be a happier, more effective negotiator if you treat it like, "I'm going to go start this great company; if they want to be apart of it, I'd love to join YC, but I'm going to make it happen with or without them."

</comment><comment><USER3> I have got 1 view each on our founders and demo video from california on 9th April. Not sure what does that mean.</comment>


Contagious cancer: The evolution of a killer - <AUTHOR> http://harpers.org/archive/2008/04/0081988

<comment><USER2> i haven't read such a powerfully disconcerting and interesting article in a long time.

<comment><USER3> I read about this probably 5 years ago and I did a bit of reading on it.

The fact this can happen is that dogs only have around 13 blood types, where as humans have 26. The reason humans have 26 blood types is likely this exact problem, humans are a highly sexually active and stupid species, I mean look at the propogation of sexual infections in the UK even with free cures and free condoms (I'm not joking, you can get condoms for free and people don't use them!).

The significant thing in canines is that up to 45% of dogs are universal recipients. Basically the cancer has a 50/50 chance of finding a perfect host. No wonder DFTD is so lethal, in most cases the host body will just let the infection in.

However, it's lucky there isn't a feline varient of this disease as IIRC upto 80% of cats in North America are blood type A.</comment></comment>


Stop Hating Scrooge The 'Christmas Carol' curmudgeon is forward-thinking - <AUTHOR> http://www.newrepublic.com/article/116050/scrooge-christmas-carols-forward-thinking-liberal

<comment><AUTHOR> At first you might think this is a political piece, but it's actually a nice historical insight into Charles Dickens.</comment>


Ask HN: How do I come up with a name for programming language? - <AUTHOR> Thank you for the technicalities and legal methods, but I am here for some creative musing. I am currently thinking of 'Anarchy'. The language is heavily mathematical( to put it at best, while at the same time I want to be purposefully vague). <comment><USER2> The typical way to pick a name for a language is to choose a dead mathematician who is obscure enough that only mathematicians are familiar with his name (so, no Aristophanes, Euler, or Godel) & who hasn't already had a language named after him. (This worked for Erlang, Church, Haskell, Ada, and a whole host of others.)

Another popular way is to take a term from mathematics & misspell it. (See: Clojure, Clozure.)

Languages that are derived from other languages often have themed names -- for instance, the various javascript preprocessors have mostly coffee-flavored names, brainfuck derivatives usually include either "brain" or "fuck" in their names, and befunge derivatives usually end with "funge".

Sometimes, languages are named after imperative verbs (such as the approximately 3 languages called 'go') or arbitrary physical objects (Rust, Elm). Language-themed language names are popular, too (LISP, SmallTalk, Guile).

Languages I've made have been named after fictional characters (MYCROFT, named after the computer from The Moon is a Harsh Mistress, himself named after Mycroft Holmes), authors (WILSON, named after Robert Anton Wilson), and descriptive acronyms (GG, the language compiled by GGC, is for generative grammars).

Anarchy is a pretty loaded term (and I say that as an anarchist); chances are you'll turn off a lot of people with that name.

<comment><USER3> I'd go with the matematician, Cardano. > [https://en.wikipedia.org/wiki/Gerolamo_Cardano](https://en.wikipedia.org/wiki/Gerolamo_Cardano)

<comment><USER4> I wouldn't go with the one with a cryptocurrency named after him.

</comment></comment></comment><comment><USER5> Pick a boring name. Do not make your adopters fight an uphill battle trying to sell it to non technical decision makers.

</comment><comment><USER6> It depends what your end goal is. To me, Anarchy reminds me of something like Brainfuck - a hobby project that'll never see serious use. If that's your end goal, call it what you want as there'll never be that many users anyway.

</comment><comment><USER7> I'd use afl or a word mutation engine and the google api, starting with a list of mathematical terms, and mutate them until you got something with zero results that you like.

for example z combined with kmeanset as one word in quotes finds no results.

</comment><comment><USER8> Try smashing bits of related words together. Heavy math: Heath.

</comment><comment><USER9> i would go for obscure planet names from star trek universe, and append a "-lang" suffix ( like Brekka-lang ).

</comment><comment><USER10> Why not Philonist or Philon ?

</comment><comment><USER11> Mathematical + Purposefully Vague ...

Infinity

<comment><USER11> X Y or Z

</comment></comment><comment><USER12> try this name: Sloaken, or the short version Sloak

</comment><comment><USER13> Typic

</comment><comment><USER14> Arman.</comment>


I Made My Own Image Sensor (and Digital Camera)[video] - <AUTHOR> https://www.youtube.com/watch?v=PaXweP73NT4 <comment><USER2> You could move it around taking lots of pictures and construct a more detailed image</comment>


Uber admits ex-CEO Kalanick knew Levandowski had stolen Google information - <AUTHOR> http://www.sfgate.com/business/technology/article/Uber-knew-fired-exec-had-info-at-center-of-Google-11240545.php <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=14612196](https://news.ycombinator.com/item?id=14612196)

<comment><AUTHOR> Is this actually a dupe? Old one says Waymo is making an allegation, this one is saying Uber itself is admitting this...

</comment></comment><comment><USER3> One of the key points is buried a few paragraphs in.

> _" Uber, though, says Kalanick told Levandowski not to bring any of the > Google information with him to Uber... The filing asserts that Levandowski > destroyed the disks containing Google's material not long after Kalanick > told him that Uber didn't want the information on them."_

I have no way of knowing if the above is true, but if so, it paints Kalanick in a far more positive light than the headline suggests.

<comment><USER4> It sounds more like they decided to throw Levandowski under the bus. Whether any of that is true or not, they know that it's already an established fact that Levandowski had the disks with Google information and they can't keep pretending they didn't know. The only reasonable course of action is for them to admit that they knew, but that Levandowski was the sole bad actor, and they didn't want anything to do with the stolen information.

<comment><USER5> I think you mean they decided to throw Levandowski under the self-driving truck.

</comment></comment></comment><comment><USER6> Travis Kalanick is clearly an adrenaline junkie. I understand the start-up CEOs need to be bold but he seems to completely lack the ability to evaluate and minimize risk. Good strategy isn't just about winning every battle, it's also about avoiding the battles you don't need to fight. Travis seems like he's never seen a fight he won't jump into. It's wild.

<comment><USER7> That reminds me of Sun Tzu. It also reminds me of, I forget who, maybe Jobs, who said not to even compete, just make your competition irrelevant. Ie. Find a way to not even have to fight the battles.

<comment><USER8> Uber can't make government irrelevant.

</comment></comment></comment><comment><USER9> Had Kalanick never heard the story of the Monkey's paw before he used the thing?

<comment><USER10> If others haven't heard of it either:

[https://en.wikipedia.org/wiki/The_Monkey%27s_Paw](https://en.wikipedia.org/wiki/The_Monkey%27s_Paw)

</comment></comment><comment><USER11> Way overblown headline relative to the filing that 3 long days ago.

I am no fan of Uber but this AP writer is terribly sloppy in his formulations.

> Uber knew fired exec had info at center of Google theft case

Absolutely not what it says in the filing.

All the filing says is Lewendowski tells Travis he has five "disks" of data from google. It could be a backup of his pst files, roll out plans for Orkut, cafeteria menues, we have no idea from the filing. So the filing is very far away from both Uber "admitting" it knew and that this data is the "stolen information" central to this case.

> The filing asserts that Levandowski destroyed the disks containing Google's > material not long after Kalanick told him that Uber didn't want the > information on them.

So sloppy it's painful.

This implies than Lewendowski propositioned Travis and said "let's go build this dirty LIDAR together" and Travis declined. Not supported by the filings!

The incident this refers to was an email thread between Travis and Lewendowski that had two lawyers Cc'd on. This was perfunctory Dislosure that he has _some_ info, and a perfunctory response from Travis saying "don't bring any info from prior employers."

If you are going to make a dirty LIDAR you hand off a usb drive on a long walk across the city, not plot in front of your lawyers.

Again, I am no Uber fan, but this is one of the worst pieces of reporting I've seen that I can remember. Very misleading article.

<comment><USER12> It is quite unlikely that five disks would contain cafeteria menus. I don't thing that judge would buy such theory as plausible. In any case, it is goggle data even if not related to cars.

Another question, why would you kept lawyer out of loop if planning to do something dirty? It is dumb to do it over mail, but lawyer won't rat you put and can have advice about how best to hide it (in person not in writing sInce lawyer want to keep license).

</comment></comment><comment><USER13> Didn't they originally deny that there was any sort of wrongdoing? If so then why should we believe them now? What I mean is

1\. "There was no problem, nobody stole anything"

2\. "OK fine we knew he stole, but he said he deleted it and we believe him"

Doesn't the flat out lie in #1 completely destroy any sort of admission in statement #2 that conveniently suggests they're off the hook?

<comment><USER14> Well there's a slight difference, it seems like now that Kalanick has left, they want to use him as a scapegoat, and the narrative here is that Uber as a whole didn't know until now. So theoretically, 1 & 2 could both be true, albeit 2 would be more like "Kalanick knew but didn't tell us".

<comment><USER13> True, but if so that's still extremely convenient.

Edit: Pardon my cynicism - I'm just a bit suspicious with things like this :-)

</comment></comment></comment><comment><USER15> Does anyone know how was Levandowski's startup valued at $680M?

Worst case scenario was that Kalanick not only knew this, actually planned it with Levandowski.

Reasoning behind the $680M acquisition could be very important.

</comment><comment><USER16> What's the worst case scenario for Levandowski in this situation?

<comment><USER17> Theft is criminal law.

<comment><USER18> How many million dollars would he keep for each year spent in jail?

<comment><USER19> The civil lawsuit against him would take care of any money he has left.

</comment></comment></comment></comment><comment><USER20> > "The filing asserts that Levandowski destroyed the disks containing Google's > material not long after Kalanick told him that Uber didn't want the > information on them."

A person that takes a trove of proprietary information like that is unlikely to just destroy it. My suspicion is that he'd keep it for reference until it became a liability.

</comment><comment><USER21> Deep in my comment history I called Kalanick shady many times before all these headlines...

</comment><comment><USER17> I suspect this is one of the reasons he stepped down.</comment>


It's time to bust police unions - <AUTHOR> https://reason.com/2020/06/03/its-time-to-bust-police-unions/ <comment><USER2> Perhaps the way to satisfy the libertarians at Reason is to privatize police forces and let them have unions.</comment>


"What I Miss About Counterstrike" - Blog authored by CSS legend JonMumm - <AUTHOR> http://eseanews.com/css/index.php?s=news&d=comments&id=10446 <comment><USER2> If I may, David Foster Wallace (as so often) said it better:

> "But it's better for us not to know the kinds of sacrifices the > professional-grade athlete has made to get so very good at one particular > thing…the actual facts of the sacrifices repel us when we see them: > basketball geniuses who cannot read, sprinters who dope themselves, > defensive tackles who shoot up with bovine hormones until they collapse or > explode. We prefer not to consider closely the shockingly vapid and > primitive comments uttered by athletes in postcontest interviews or to > consider what impoverishments in one's mental life would allow people > actually to think the way great athletes seem to think. Note the way"up > close and personal" profiles of professional athletes strain so hard to find > evidence of a rounded human life — outside interests and activities, values > beyond the sport. We ignore what's obvious, that most of this straining is > farce. It's farce because the realities of top-level athletics today require > an early and total commitment to one area of excellence. An ascetic focus. A > subsumption of almost all other features of human life to one chosen talent > and pursuit. A consent to live in a world that, like a child's world, is > very small…[Tennis player Michael] Joyce is, in other words, a complete man, > though in a grotesquely limited way…Already, for Joyce, at twenty-two, it's > too late for anything else; he's invested too much, is in too deep. I think > he's both lucky and unlucky. He will say he is happy and mean it. Wish him > well."

[http://www.esquire.com/print-this/the-string- theory-0796?pag...](http://www.esquire.com/print-this/the-string- theory-0796?page=all)

(A quote I come back to on occasion, thinking about my essay [http://www.gwern.net/The%20Melancholy%20of%20Subculture%20So...](http://www.gwern.net/The%20Melancholy%20of%20Subculture%20Society) )

<comment><USER3> _He will say he is happy and mean it. Wish him well."_

What's that supposed to mean? He will say he is happy and mean it, but really he isn't?

DFW committed suicide, I don't hold him as a great authority on what kinds of happiness are 'valid'.

<comment><USER4> DFW is comparing one-dimensional geniuses to people who are retarded in some way. (Mental, emotional, social... take your pick.)

The person is happy only because they're so oblivious to the things that they're missing out on, and their very nature prevents them from gaining this knowledge.

Were they able to know what they were missing then they might not be so happy with their limited existence.

<comment><USER5> > Were they able to know what they were missing then they might not be so > happy with their limited existence.

Attaching any weight to what you're missing out is a guaranteed way to make you unhappy and has nothing to do with what you do in life. Even with unlimited resources you'll miss out on most things that require huge time commitment, like being a pro athlete.

</comment></comment></comment></comment><comment><USER6> I spent a fair amount of my youth playing counterstrike and still have fond memories of it. I also learned to program roughly around the same time and found the later far more fulfilling in the long run. I learned skills in programming in those years that I still use today, but whenever I even touch a public counter strike (source) server these days I get hopelessly owned by a new generation.

I now see video games as pure downtime in the same way as watching a movie or something, I used to be very competitive and my scores in public servers and clan matches deeply mattered, despite all of this I really wish I had spent more of my CS time learning programming or taking up a completely different hobby (e.g real sport or music). I sometimes wonder where I would be now if I had spent that time doing something else. The problem with video games is that you are spending your time perfecting something that is useful only in a very specific virtual world which can be radically changed or even destroyed at any time. A very small minority of people may become "professional gamers" but for the most part it feels like almost completely wasted time in hindsight.

Will it make you money? No Will it get you laid? No Will it help you express yourself? No Will it make you healthy and fit? No Will it better mankind in some manner? No

I'm not hating on video games, just if you are going to spend that amount of time becoming _awesome_ at something it does seem like a very poor choice.

<comment><USER7> I always knew there were more worthwhile pursuits and that's why, in hindsight, I struggle to accept the time I spent playing. But I never felt like it was downtime.

I knew I was building skills that I would use again someday. It wasn't about trying to be the best at shooting a gun in a virtual world. It was about outthinking and outmaneuvering my opponent. Analyzing details and figuring out the best strategy.

It was never about my score, it was about how well my team did. CS taught me a lot about working with other people. Managing and recruiting talent, motivating people, and keeping everybody happy.

<comment><USER8> I believe the single most important thing I've learned from playing competitive online games is how to manage the morale of a group. When you have 30-minute experiments, mostly self-contained, it's amazing how easy it is to see how one denigrating comment can ruin a whole match because it ruins the teams cohesion and teamwork. A few well-placed bits of praise, a little humility, and a little leadership will trump raw skill most of the time.

It's a lesson I'm glad I've learned, and now I can use online games as a way to practice.

</comment></comment></comment><comment><USER9> I started competitive play at 15, eventually peaking at 18 with 2 CPL showings. I probably played vs. juan at a couple LANs.

The amount of focus, time, and sheer mental fortitude required showed me what it took to truly master something. When I could drop 35 kills in a half in a tournament, or kill 10 people in a round in a pub, I understood my level of commitment had led to that success.

I spent the past few years at a telecom/networking company doing sales as an engineer. Multi-million dollar deals, complex designs and high-stress situations. Learning to communicate only what was relevant and necessary, eliminating all extraneous information, was essential to success. My co- workers looked to me to quickly prioritize targets, shift strategy, and keep morale high as we focused on the end goal of closing.

Counter-strike taught me that. No other "group project" or random nonsense in college prepared me to work with the most highly regarded and ardent professionals in the world. My team would put egos aside, drop all sense of the individual, and focus on beating an enemy that was composed of the very same caliber.

It taught me the value of "ideal scenarios" or "how it's supposed to work". The immaculate plans leading up to a meeting, that required innumerable changes during practical execution. Without the ability to communicate as fluidly as possible between individuals any slight shift in the plan would create utter confusion and chaos, quickly exploited by a foe just begging for you to make a mistake.

I'd like to grab a beer with JonMumm. There's just something about the high- level Counter-Strike people that has reassured me that there are others out there can place so much of themselves into something that it doesn't become second nature, it becomes you.

</comment><comment><USER10> CSS being counter strike: source, though he may be talented at using cascading style sheets as well.

<comment><USER11> Ahh. The whole time I was wondering: "How is this guy a legend at both counterstrike and cascading stylesheets?"

</comment></comment><comment><USER12> To be the best at anything, means that you must live abnormally and do abnormal things. This is why being the best at everything is nearly impossible, since each thing to master would require different kinds of abnormalities and different ways of living abnormally.

This is why you find "geniuses" in a particular field, like math, or music, and they're usually not-so-genius in most other fields. "Genius" is attainable in my book, it's a matter of being focused and "putting your mind to it" as the article states, and this focus and "putting your mind to it" require being and doing abnormal things.

<comment><USER13> That's what makes the old-school polymaths like Goethe and Von Neumann so amazing to me - they not only did it in a single field, but many, all relatively simultaneously.

<comment><USER12> Many, which are very closely related. Computer science and mathematics are essentially one and the same, or maybe a subset of another (as an example)

<comment><USER14> Goethe did more than math or CS.

</comment></comment></comment></comment><comment><USER15> There is a place called Kota in India. It is a hub of coaching institutes trying to assist highschool students get admission into top engineering and medical colleges(IIT,AIIMS) of India.

>5000 hours of counterstrike is pretty common game-time that students living there spend and you would easily find >25000 kids of age 15-16 such types. Millions of students go there each year. Competition is so tough that hardly top 2% get admissions into IITs.

As a result, >90% do not study.

You see them playing they are experts! Most of them don't even know how to log into a server. The cybercafe would set up the LAN for them. All they do is play, all the time. As per rule the shops are supposed to close after 11 pm. But these shops have eating/smoking and toilet arrangements inside. They pull down the shutter, as if the shop is closed from 11 to 6. Students stay 'voluntarily trapped' inside for a LAN party at a discounted rate of 1-2$ for the whole night. Once the course is over, the gig is too. they go back to their hometowns, never playing again.

I work in Delhi and I see clans participating and even winning international competitions like WCG. But even the gameplay of the best, is only at par average as per Kota standards.

All this time spent for happiness, curing boredom. Rajasthan would be the biggest consumer of CS, DoTA, Tekken, AoE if pirated stuff is counted for.

<comment><USER16> Wow, never knew that about Kota. Had a friend who lived there for a year for IIT studies. He himself admits that he never once attended a single class and was mostly just having fun. Counter Strike in India is certainly big. I only wish Starcraft 2 was as well.

Oh, and can you tell me where in Delhi do these tournaments happen? I don't play much CS but earlier on in school, all I could think about was being a pro-gamer!

</comment></comment><comment><USER17> Thanks for the great article. Counter Strike was the game that really got me interested in programming. I got introduced to it in early 2000 and was blown away that this game was made by hobbyists who created a mod (expansion package) for Half Life which in itself was revolutionary at the time. Eventually Valve acquired Counter Strike and the rest is history. I still think fondly of the many hours spent on de_dust and cs_assault.

<comment><USER18> Counter-Strike was what really got me into programming too, in the form of several small programs that added some neat functionality to CS and other HL mods. As a high school student it was pretty amazing to have tens of thousands of people using the software I was writing.

If you used any of the programs I wrote or know anyone who did, I guess I owe you an apology. One of the programs, Half-Life Sound Selector (HLSS), annoyed countless people by allowing players to blast WAV files over the voice comm system. Really, really annoying. Another program, HLirc, interfaced with HL and mIRC, letting you chat in IRC using the game's console, until VAC started detecting it (incorrectly) as a cheat and banned you that is. The other program was a Winamp plugin called HLamp. It let you control Winamp from inside the game and even tell others what song you were listening to. My favorite feature: automatically turning the volume up/down when you died/respawned. Of course the VAC eventually detected HLamp as a cheat too.

Anyway, sorry if I got your WON/Steam account banned!

Good memories :)

<comment><USER19> Oh man, HLSS was crazy back then. I can't believe you created that. I just remember every one playing Bannaphone or Jim Carrey yelling at the top of his lungs. Those were the days.

</comment></comment></comment><comment><USER20> I think I'm also very close to those 10.000 hours in cs 1.6. I can really relate to this guy story. I don't think many people will ever experience that adrenaline you get when you're in high level competition. That is sport or esport. It's like a first girl friend, I will never experience that feeling again and that kind of makes me sad.

I know I've wasted a big part of my life playing this game, but I don't regret because of that competition feeling, that stress, that happiness when you win a tournament, that solidarity between players of the same team, the nights spend training and practicing...

<comment><USER21> If you enjoyed the time, did you really waste it?

</comment></comment><comment><USER22> Gaming taught me a lot and made my life better. I was depressed and with few positive catalysts. Warcraft 3 made me play with other people, meet people who I am friends with today and also taught me to be excellent.

I got to compete, set up a clan which trained other people, and held tournaments, and taught me how to take responsibility for my team. Like someone else mentioned, I learnt how to maintain morale, how to take on the jobs no one liked and to excel at them. Having people have faith in your strategy, making people follow your plan, knowing how important it is to even have one, no matter how bad, I learnt that from gaming.

But above all, like the OP, i learnt what it means to be the best at something. I look back at that time and am glad I did it. It helped me start building myself back up and taught me the basics of team work which I use everyday.

</comment><comment><USER23> League of Legends has become my modern-day Counter-Strike. The buzz the author mentions is exactly the buzz I get playing the game over hundreds of hours. The rules of the game are fairly simple -- and inside of that simplicity a desire for perfection emerges. It's fun and challenging -- likely why I'm a programmer, too.

<comment><USER24> LOL is many more times more complex than CS. If you are weird, try running game-theory and stochastic simulation models. Try to optimize things like item builds, team-movement/formation, engagement sequence, allocation of champions to lanes at various times, allocation of gold/farm to champions. And then to apply it.

</comment></comment><comment><USER25> Based on the title, I expected Jon to explain the things he missed about Counter-Strike, the game, with respect to Counter-Strike: Source (CSS), the sequel. That's not what this is about. It's a retrospective on his career as a professional CS player.

I then wondered why he didn't pick up another game or hobby. Turns out, he did. "Earlier this year I stumbled my way in to the world of tech startups."

</comment><comment><USER26> I played with and against him for years. His old teammate n0it was chatting with me on facebook for a while about my start-up-turned-company as he uses our software on his campus. I had not talked to either of them for a few years at minimum.

Jon's a great guy. Good read. Very surprised I saw something like this on HN. Small world, eh?

</comment><comment><USER27> Having read this, there are so many skills you can pick up from the gaming culture that helps you integrate with working as a programmer.

He probably knows how to do scripting from IRC... maybe he's written a bot or knows how a bot works from IRC. I remember lots of bots that work in different way and what you can learn from watching it run.

At 16 I remember seeing my very first bot and being amazed by it. The problem was that I was on a Windows box and everyone around me was on Linux. Then the problem was which language did I pick. Then the problem was that the most popular language was a bitch to install... then there was the problem I had no idea what the error was and if it was something I had done.

Oh the list goes on.

What I'm trying to say is, not everything is a waste. Knowing when something is valuable enough to spend time of is a skill in its self.

+1 procrastination proclaimer

<comment><USER28> [http://www.youtube.com/watch?v=BAx7Npsrin4&t=4m30s](http://www.youtube.com/watch?v=BAx7Npsrin4&t=4m30s)

same for designers as well lol

</comment></comment><comment><USER29> Interesting. I thought this would be a critique of modern day first person shooters.

<comment><USER26> Modern day first person shooters provide an immersive, story-driven single player experience, but have gameplay that cannot make for a decent competitive platform.

<comment><USER30> Surely you are aware that Halo 3 with variants and COD:MW with variants are the most successful online FPSes of all time? Both were also criticized for shallow single player stories, not on par with previous versions.

<comment><USER31> Well, to be fair, COD is an RPG. If you have to farm and craft for 20 hours to get a decent weapon, you're not playing an FPS. Halo on the other hand is a different story :D

</comment></comment></comment></comment><comment><USER32> Wow.

It's a great feeling, being the 'best' or better than the majority. I've also experienced the void created after deciding to move on. I still feel as though I'm on an endless search to find something that I can be as passionate about.

Thanks for the great read!

</comment><comment><USER33> Looking back to a few years ago, I would actually say that I was addicted to CS. Playing matches in a clan is a sure fire way to drive the addiction because it becomes hard to leave without letting your teammates down.

Luckily, due to Steam's awful user account tools via the client and the website, I am unable to recover my Steam password. The only way to recover it is to deface the CD box by writing the support ticket number on it, taking a photograph of that defacement and the product key and then sending that photo to their support email address. Then they will reset your password.

You know what, I'm really not that bothered!

</comment><comment><USER34> "all of a sudden I'm in a de_dust pub server and I just picked up my first mp5"

Ahh the memories..

</comment><comment><USER35> Few news articles (even on HN) 'move' me, but this one did. To all those whom were among the best at a popular game, you understand.

Some interesting comments: like whether playing CS, or any other game, is "worth it." I agree with kejadlen, "does it make you happy?" Though heroin, at some point in time, makes addicts "happy." One thing is for certain though, the feeling of mastery gets harder and harder to find later in life, at least with regards to professions or wealth.

</comment><comment><USER36> Wow. Nicely said. I help out with Ninja Girl's party in D2 which is a Counter Strike Source server and I never hear anything about Counter Strike outside of the server anymore. I am curious to see what Counter Strike Global Offensive will be like. Our server is the most popular in the US and I am pretty sure we can keep that status in CS:GO. I am kinda hoping it brings the spotlight back to CS.

</comment><comment><USER37> _"When you pursue something difficult, eventually you have to make a choice between being balanced, normal, and conventional, and being different, weird, and exceptional. I chose the latter."_

Wow. You are _not_ a normal writer. More writing needs to come from the heart like this. I don't even care about video games and loved this article.

</comment><comment><USER38> tl;dr: You can do anything you want to do, but you can't do _everything_ you want to do.

</comment><comment><USER39> Love the shoutout to Aaron Rodgers! lol

But seriously, as a former Cal-I vet myself, I know exactly what he's talking about. And I can relate to how it feels like that in the world of start-ups.

In my opinion, a lot of it has to do with the book "FLOW". We should all go read it.

Good stuff!

</comment><comment><USER40> What is a stratcaller?

<comment><USER41> The equivalent of a team captain or quarterback. As the situation of a match unfolds the stratcaller will do just that, call out different strategies and make decisions about what the other members should do.

</comment></comment><comment><USER42> Cliff notes: being great at something requires spending a lot of time on it.

Not exactly groundbreaking insight, and I disagree entirely with the assertion that such dedication makes one "weird". Any sane person would be jealous of someone who's so passionate about their career that they gladly dedicate signifant effort to mastering it. The fact that he chose to spend 10,000+ hours mastering Counter Strike is the "weird" part, although I'd personally love to see gaming become more accepted here as a professional sport.

<comment><USER43> I think you're missing the point. It's not about becoming great at something. It's about being exceptional at _one_ thing. It's about spending every moment of your life either practicing or thinking about that thing, to the detriment of everything and everyone else. It's about being possessed with the desire to be the best. And that _is_ weird, by definition - only a small fraction of people have such dedication to one pursuit. It's not just passion - it's obsession.

And, in the end, it's the feeling you get when you've attained that level of mastery, and the hollowness you feel when you give it up to focus on a more balanced life.

Many people would be jealous of someone with such skill, but few would envy the work and the exclusionary lifestyle required to get there.

</comment></comment><comment><USER44> Oh Janine, you so funny.

<comment><AUTHOR> Not trying to be funny. I posted this because this is the best thing I've read of Jon's - and I felt there was something universally resonant about the sweet pain of aspiring to greatness. What I didn't expect were the multiple comments from those who play or used to play CS and draw lessons that apply to programming and teamwork. If CS produces colleagues like Jon, then more please.</comment></comment>


Speed Test: Go vs Node.js (vs PHP) - <AUTHOR> http://jaxbot.me/articles/benchmarks_nodejs_vs_go_vs_php_3_14_2013

<comment><AUTHOR> OK, the PHP test was written wrong, with count() being called in every iteration. So this person didn't know the internals of the functions they were testing.

Nevertheless, PHP is about 3x slower than v8 for the optimized tests</comment>


Security Lessons for IoT from Japanese Castles - <AUTHOR> https://www.securitynow.com/author.asp?section_id=613&doc_id=738689 <comment><USER2> > However, the Himeji Castle, which was built in Japan 700 years ago and still > stands, employs a different strategy. It is not very hard to enter the > structure. However, the castle is a maze. It is difficult for attackers to > get to where they want to go, and it is not easy for them to get out. > Moreover, the castle is full of traps and places where defenders can hide > and attack.

Most western castles were built with similar design concepts, they just don't feature in our hollywoodized depictions of them.</comment>


Why you shouldn't jump on the SPF bandwagon (2005) - <AUTHOR> http://david.woodhou.se/why-not-spf.html <comment><USER2> I've been managing my own mail server since forwever (when nanae was still a thing: news.admin.net-abuse.email).

SPF is not too bad as far as forging countermeasures work. It's relatively simple both to implement and to check. I'm not against it.

What I don't like is every single other standard they pushed later. I personally think DMARC is borderline useless. DKIM is plainly horrid and breaks just about everything you'd expect from email such as mailing lists, while not solving anything both from a legitimacy perspective and from a spam perspective.

Like everybody says, the "recommended" solution is to pour each and every of these half-assed solutions into a score system. Which sucks, because when a legitimate email is rejected, the fix is never trivial: it could be just a perfectly legitimate host which decided that all these solutions are crap (and they're right).

You know my current 90+% spam and scamming source by volume? It's gmail.com. It's passing all these checks, of course. It's the reason I consider DKIM virtually useless even from a legitimacy perspective: a valid DKIM signature from any large/free email provider bears no significance to the point that even if I had a decent UI for validation in my email client, I would basically have to avoid it: "oh, right, another _legit_ scam from gmail.com".

<comment><USER3> It is SPF that completely breaks mailing lists, DKIM is necessary to fix it.

DMARC just specifies reporting and policy, DKIM is almost useless (except as SPF fail override) without it (because you don't know if it should have signature or not)

<comment><USER4> DKIM without DMARC is the issue. Mail servers have no way of knowing that an email with no DKIM signature was supposed to have one unless you've set a DMARC policy to make it clear.

</comment></comment></comment><comment><USER5> I helped develop SPF, and created what may still be the "largest" SPF record (eBay.com and PayPal.com). That being said, the author is mostly right. You shouldn't reject email that fails SPF.

BUT, there is a use for SPF. You add it as a factor in your spam filter. Deduct points for an SPF failure, or make it an aspect among many in your filters. It's still a useful way for one org to tell another org, "here are the IPs you should expect mail to come from".

<comment><USER6> I mean that's what we developed DMARC for though.

<comment><USER5> DMARC is a better solution for sure, but it's harder to implement and not as many receivers support it.

</comment></comment></comment><comment><USER7> Weirdly enough, I've had this problem with DMARC, not SPF. It occurs on a very small fraction of emails from more "sensitive" domains, like a fraction of emails from one or two banks.

In particular, Gmail _completely silently_ drops emails forwarded by hosts that aren't explicitly authorized by the sender's DMARC policy, which sucks because it means I can't forward such emails from my _own_ addresses on other domains to my _own_ Gmail account. I understand this is because the sender's DMARC policy says that the receiver should hard-reject any mail delivered by unauthorized middlemen, which seems naively short-sighted given that anyone can deliver email, and DKIM already lets the receiver verify the authenticity. (Is this even compliant behavior?)

Does anyone have a reasonable workaround for forwarding to Gmail in such cases?

<comment><USER8> I'm afraid I don't. This was in fact why I stopped hosting a mail server for friends, way back when. I realised that if most of them put their gmail address in ~/.forward, any spam they received on their account on my domain, gmail would count towards my domain / ip instead of the original sender. This is a fundamental flaw with current email implementations; there is no equivalent to something like the "trusted downstream proxies" list.[1]

I always wondered why gmail wouldn't have a (per account) setting to say: "I am forwarding mail from this host / domain / address", with corresponding trust of Received: headers chain. If I could then add a header in forwarded mails requiring that to be set, somehow, then we could avoid this SPF / DMARC problem entirely. The fundamentals are there (received: headers and DKIM). All we need is some last mile config :(

But it would promote decentralisation, so I'm not holding my breath.

[1] random search result of such an implementation: [https://github.com/tornadoweb/tornado/pull/1864/files](https://github.com/tornadoweb/tornado/pull/1864/files)

<comment><USER9> But why doing email forwarding. If it is a custom domain, why not simply use gmail as your MX entries?

<comment><USER7> Confused, how does that work? How would Gmail know which mailbox to put an email it gets for an address in a different domain?

<comment><USER9> Gmail like pretty much every other providers offers to manage custom domains. You point your mx entries to them, you setup the mailbox and aliases on the google side, and you have a emails in yourdomain.com running using gmail behind the scene. Just google "gmail custom domain".

<comment><USER7> Oh, so you mean GSuite, not Gmail. That severely restricts your freedom with the mailboxes and addresses you can have on your own domain.

<comment><USER10> The e-mail routing in Gsuite is very customizable, the only downside to using Gsuite (basic) is that it'll put you down $5 a month and if you use email aliases you can only send from those aliases via gmail.com (or a mail client that supports them).

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I've been using SPF in my SpamAssassin rules for over 10 years now and it has only ever been a good thing.

      score SPF_FAIL 0 0.919 0 0.919

<comment><USER12> That is not exactly how SPF was meant to use. If it fails email should be rejected not scored. Disclaimer: I do the same as you.

<comment><USER13> So the developer of SPF (see jedberg above) says it should be used as a ranking factor, but SPF itself says it should be rejected?

Maybe the issue with SPF is in the messaging around it?

<comment><USER14> I think that would depend on whether the SPF record indicated soft-fail or hard-fail, no?

</comment></comment></comment></comment><comment><USER15> Without SPF records, automated email notices from my sites to any system like Gmail, Hotmail, Office, Yahoo, etc... were rejected.

I don't care if it doesn't work, if 90% of every day emails are getting rejected without SPF, then I setup SPF.

Edit: For serious email delivery these days DKIM is required...

</comment><comment><USER16> I manage some pretty big spam filters for national regions and hospitals and we need SPF to ward off potential phishing attacks claiming to be from our own domain.

At the same time I do agree with the author that SPF might be harmful for the rest of the internet by vouching for e-mail from a certain sender but if you're relying solely on SPF then you've misconfigured.

</comment><comment><USER17> The Problems the article lists are correct still today. SPF should not be used to single-handedly decide whether to reject mail.

The Alternatives the article lists reflect the date (2005). Domain Keys and Cisco's alternative merged to become DKIM. DMARC came later.

Today I would suggest for most people to still use SPF but with ? or ~ (tilde), (Neutral or Softfail), and never - (Fail). So it becomes part of the spam scoring and not decider as there are too many false positives with SPF, as highlighted in the article.

Combine it with DKIM and at least initially a reporting only DMARC and you are on your way to a good set up.

SRS turned out to be a disaster. Idea good, implementation with spam bad.

<comment><USER18> I would suggest using the "-" ("reject")

Life is too short to waste it on spam.

If you can't set up proper SPF/DMARC/DKIM then I don't email me at all.

<comment><USER17> No, that is the point, and mentioned in the article.

"-"(Reject/Hard Fail) for SPF is broken and should be avoided. SPF only considers the sender and not the transport and recipient. It does not consider recipients' forwarding alias rules, backup MXs, multi relay domain setups, etc. I.e. normal email infrastructure and usage patterns.

I have subset of users that uses Gmail as their client, SPF with "-" from a random valid sender would not allow me to redirect those emails to Google's servers.

Also many aliases on my domains forwards to other addresses not on hosted by my servers (subsidiaries, personal accounts, mailing lists, etc), Spf with "-" will force the end SMTP server to block those emails as doubtful your SPF listing has listed my SMTP servers.

And if a recipient domain has a more complex SMTP setup with mutiple SMTP servers acting as incomming, outgoing, bastions, backups, webmail, sharded storage, etc then any redirecting between them would again break with a strict SPF.

As said before use: DKIM, DMARC but make sure SPF is set to not Fail as it is broken. Use Greylisting, Spamassassin etc to score spam to avoid false positives that are not obvious rubbish enough to reject on envelope details alone.

Fastmail has a very good default recommendations: [https://www.fastmail.com/help/technical/senderauthentication...](https://www.fastmail.com/help/technical/senderauthentication.html)

My own Postfix doc's DKIM section: [http://flurdy.com/docs/postfix/#ext_dkim](http://flurdy.com/docs/postfix/#ext_dkim)

</comment></comment></comment><comment><USER19> Just to be clear, if we don't implement SPF on our domain names, our mails will be rejected by gmail, right?

If that's so, this is purely a theoretical discussion (which has its own merits, of course).

<comment><USER20> I don't believe Gmail rejects automatically for missing SPF records. It may be a significant hit to the spam score, but it's still technically optional.

<comment><USER21> My experience is anything less than SPF, DKIM and DMARC results in Gmail silently dropping messages. Also, HTML mail with inline images similarly causes Gmail to drop.

And forget about sending from a DO Droplet due to poor IP reputation. A friend of mine at an ISP confirmed their third party SPAM scoring provider (like Symantec/ Brightworks) gives them a list of IPs to block at the edge, which includes large swaths of DO's IP blocks. Not sure what the story is for other low-end VPS providers like Linode, etc.

Testing deliverability has become completely absurd. Every ISP and ESP has a completely different method for mail rejection. And thanks to outsourcing options for SPAM scoring, is subject to change at a moment's notice.

This is a glaring omission in all Net Neutrality discussions I've seen, the ability to simply communicate an order acknowledgement to a customer. Even outsourcing to Mailgun, SendGrid or the like is no silver bullet for this issue, you'll still have interruptions in delivery because every day some spammer gets through their checks and trashes that shared IP you're sending from. And probably you're having unnoticed delivery failures because someone else reported it / got it fixed. Renting a dedicated IP isn't really a solution because you have to send from IPv4 to reach the guy who is still doing email @hisdomain.com and doesn't even know IPv6 is a thing. And IPv4 addresses are in short supply.

</comment></comment></comment><comment><USER22> This is a ridiculous article. First off,most orgs have an outbound mail provider that supports spf. Second, Spf can be setup to softfail (mail gets delivered anyways).

I have used spf many times to distinguish forged phishing email vs phishing email originating from a compromised account.

SPF is like most security solutions,its purpose is to reduce risk not eliminate it. If you really want to go down the rabbit hole of eliminating risk,your first step should be to not use email at all.

</comment><comment><USER23> It's SRS that is broken, not SPF.</comment>


Forgetting a Child in a Car Is a Horrifying Mistake. Is It a Crime? (2009) - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2009/02/27/AR2009022701549_pf.html <comment><USER2> Gene Weingarten won a Pulitzer for that article and his Pearls Before Breakfast one - [http://www.washingtonpost.com/wp- dyn/content/article/2007/04...](http://www.washingtonpost.com/wp- dyn/content/article/2007/04/04/AR2007040401721_pf.html) [https://www.washingtonpost.com/people/gene- weingarten](https://www.washingtonpost.com/people/gene-weingarten)</comment>


Technique - Watch 3D on your computer without glasses or any special hardware - <AUTHOR> http://www.youtube.com/watch?v=zBa-bCxsZDk&feature=feedrec_grec_index

<comment><USER2> This is totally the wrong technique.. Focusing in front of the monitor will only blur out everything. You have to focus your eyes behind the screen for that to work, like with hidden stereoscopy pictures</comment>