What would you suggest to this start up? - <AUTHOR>

I started working on my idea 6 months before. I hired a Tech team to work on it. (because i am not a technical person). I strongly believe in my idea. do you think i should launch it without any kind of fund raising or should i try for fundraising and launch it on big scale? i am confused. <comment><USER2> This depends on the size of your vision and the speed with which you intend to achieve it.

Some people want to create a business worth 100s of millions, and they want to do that fast - they need funding (not necessarily external, but I'm assuming from your question that you've depleted much of your own capital).

Some people are happy to wait years to get to that sort of valuation; others may only want to develop a much smaller business. They may or may not need funding. So there's no right or wrong answer - only what is best for what you want to create.

Once you have an idea of what size company you want to create and any timeframes you are arbitrarily placing on yourself, then ask what you will do with funding to achieve that? Do you need $100,000 to achieve that? Or $1,000,000? Or $10,000? There's little sense in raising more money than you intend to invest (with the possible exception of a buffer for unforseen blow outs) - that's just selling part of your company at a lower valuation than it will achieve in the future.

Good luck!

</comment><comment><USER3> Answering this question properly requires access to a crystal ball.

A partial answer: If you go and do a fundraising round now you might burn up very valuable time being distracted when you could simply launch instead. In your shoes, I would launch, and use the response I got from the launch to open the doors to the capital world. Of course, if you don't need money right away you could grow the business a bit further to maximize your negotiation position.</comment>


Search Benchmarking: RediSearch vs. Elasticsearch - <AUTHOR> https://redislabs.com/blog/search-benchmarking-redisearch-vs-elasticsearch/ <comment><USER2> I've seen a lot of ES competitor posts pop up on HN lately, and I think they're missing the point of Elastic.

If you only need very basic word search, ES is probably not worth the complexity in your stack, especially if you're already running a SQL database with decent plaintext search.

Where elasticsearch shines is in complex queries: "Show me every match where this field contains 'extinction' within 10 words of 'impact crater' but NOT containing 'oceanic' and the publish date is > last month and one of the subjects is anthropology"

<comment><USER3> > Where elasticsearch shines is in complex queries ...

If the "Multi-tenant indexing benchmark" is accurate it seems like it might be a robustness concern for ES. "Elasticsearch crashed after 921 indices and just couldn't cope with this load." \-- does that mean memory exhaustion or some other crash? If it's the latter, it seems like a quality problem more than a performance one.

<comment><USER4> Very very few customers actually have 921 indices in production. That is an insane amount.. by a large factor.

<comment><USER5> Judging from what I see on irc and when I get called for "our ES cluster is on fire, can you put it out?", 921 indices is not much. I sometimes joke that I could replace myself with a bot that answers "less indices, less shards" to each and every question about performance and that bot could solve 90% of the problems at a fraction of my cost. But alas, nobody wants to pay for a visit from my bot.

</comment></comment></comment></comment><comment><USER6> I love plain old Redis, but I'm not thrilled with the extension modules from Redis Labs.

I experimented with RediSearch using 20 GB of Reddit posts and I was very underwhelmed.

First, 20 GB of raw data explodes into 75 GB once it's in RediSearch with zero fault tolerance. While I'd expect some expansion with inverted indexes and word frequencies by document, a 3.75 multiple seems high.

And since this is Redis, it's all in RAM, including indexes and raw documents, all uncompressed. That's not cheap. Add replicas for fault tolerance and the RAM needed for a decent sized cluster could be 10x the size of the raw data.

Then the tooling and documentation is very limited. Redis Labs provides a Python client, but it doesn't support basic features like returning the score with each document, even though RediSearch provides this capability if you query it directly.

Finally, I found stability issues with Redis when the RediSearch module is installed. Using the Python client provided by RedisLabs, certain queries would predictably crash every node in the cluster.

Redis itself is rock solid, but Redis with the RediSearch module feels fragile.

Overall, interesting concept but not ready for production use by any means.

</comment><comment><USER7> In order for me to trust a benchmark, it needs to be a lot more transparent than this

\- Show the code that runs the bench mark

\- Give opportunities for everyone to recreate the benchmark

\- Give opportunities for every technology to 'respond' and point out where the benchmark/tech configuration is wrong (ie "PRs welcome")

Otherwise, this just looks like cherry-picked data points, and even those I won't trust. Nor would I show this to any of my clients (whom I help select search engine technology). I dearly hope nobody makes real decisions based on this blog post until the code, and everything is opened up.

</comment><comment><USER8> >Component: Search Engine

>RediSearch: Dedicated engine based on modern and optimized data-structures

>ElasticSearch: 20 years old Lucene engine

The implications made here make me actually angry.

<comment><USER7> Lucene: over 20 years has been battle tested, optimized, and improved to the point where it's running search almost everywhere

RedisSearch: new shiny thing built on top of Redis that is used in a couple of niche places.

I'll take Lucene please

</comment></comment><comment><USER9> If 2-word queries is all you need, why would you even consider elasticsearch? This benchmark is pure marketing IMHO.

<comment><USER10> RedisLabs seems to really be abusing Redis's popularity on HN.

I've seen a lot of posts like this easily make it to the front page only because a lot of HN-ers are Redis fanboys (rightfully so: Redis is great). But then you read the post and it _appears_ to be marketing garbage.

<comment><USER11> From the license fiasco to this. RedisLabs tries hard to be the new Microsoft.

</comment></comment></comment><comment><USER12> The article is a mess of misspellings and misquotes. Also why two distributed search engine were tested on a single node? That's a a meaningless test.

</comment><comment><USER13> "Elasticsearch crashed after 921 indices" ... Shards: "20 for the multi-tenant benchmark".. 921 * 20 = 18420. Shards have state; they have overhead. Why wouldn't they pick one shard for that benchmark? It's either intentional misconfiguration, or poor understanding of sharding.

</comment><comment><USER14> From the article: "Here, we simulated a multi-tenant e-commerce application where each tenant represented a product category and maintained its own index. For this benchmark, we built 50K indices (or products), which each stored up to 500 documents (or items), for a total of 25 million indices. RediSearch built the indices in just 201 seconds, while running an average of 125K indices/sec. However, Elasticsearch crashed after 921 indices and clearly was not designed to cope with this load."

No sane elasticsearch engineer would make a new index for each product. They would just have a single index with a product_id field for each sub-item. If you needed product level information, you would create a second index for that. You'd use two indexes not O(#Product) indexes.

They just created a botched benchmark by using ES incorrectly. It's like driving a car backwards and then complaining it has poor max speed. ES could easily handle this type of problem if done correctly.

</comment><comment><AUTHOR> "The more advanced multi-tenant use case – where RediSearch was able to complete 25 million indices in just 201 seconds or ~125K indices/sec, while Elasticsearch crashed after it indexed 921 documents, showing that it was not designed to cope with this level of load." previously stated that "Elasticsearch crashed after 921 indices and just couldn't cope with this load."

It's hard to mistake documents for indices. Both original and the currently edited statement sound strongly suspect and make me question the benchmarking methodology used. What caused the ES to crash after indexing 921 documents? Why is comparing indexing speeds on a 1-node setup even a legit benchmarking test?

</comment><comment><USER15> I fail to see how the creation of 50K indices on elasticsearch is a meaningful benchmark, that's just not how it's supposed to be used. Also as others said, testing a distributed system on a single node makes little sense... as it is a benchmark which is not reproducible as we don't know how the data was queried and indexed

</comment><comment><USER16> This benchmark is pretty misleading. And not the mention that elasticsearch is free for multi node deployments while redis search is not.

</comment><comment><USER17> The intent is nice, but the weird clippy-style avatar in the bottom right is kinda annoying. I'm just trying to read the article not engage in a conversation.

</comment><comment><USER18> > Dataset source: wikidump Date: Feb 7, 2019 docs: 5.6M size: 5.3 GB

"wikidump" links to [https://dumps.wikimedia.org/enwiki/latest/](https://dumps.wikimedia.org/enwiki/latest/) , which has thousands of files, none of which are 5GB and make sense. That's a _very_ poor corpus link!

It says "Feb 7, 2019", so it probably means [https://dumps.wikimedia.org/enwiki/20190120/](https://dumps.wikimedia.org/enwiki/20190120/) or [https://dumps.wikimedia.org/enwiki/20190201/](https://dumps.wikimedia.org/enwiki/20190201/) ... maybe. They don't have any obvious 5.3GB files.

</comment><comment><USER19> If anyone is looking for real benchmarks of ES, check out this page and leave the BS benchmarks aside :-) [https://elasticsearch- benchmarks.elastic.co/](https://elasticsearch-benchmarks.elastic.co/)

</comment><comment><USER20> Someone needs to edit this article. There are misspellings and typos all over the place.

<comment> rooam-dev It's Friday, the task was to deliver the aritcle by the weekend :)

</comment></comment><comment><USER21> I'm curious if this scales down well. The test was done on "One AWS c4.8xlarge with 36vCPU and 60GiB Memory". But could I run this on a tiny vps to index, search, catalog my million-odd documents?

<comment><USER2> I'd guess redis performs _better_ in that case since there minimum overhead for redis is much lower than elasticsearch.

<comment><USER22> Wouldn't Redis need to keep the whole dataset in memory?

<comment><USER2> In my experience to get decent "show off in benchmarks" performance with ES you want your index to fit in RAM as well, but I haven't done much work with ES outside of high RAM boxes.

</comment></comment></comment></comment><comment><USER23> A problem with RediSearch, at least for me is:

Note: clustering is only available in RediSearch's Enterprise version

[https://redislabs.com/redis-enterprise/technology/redis- sear...](https://redislabs.com/redis-enterprise/technology/redis-search/)

At least with ES i can build and play with the clustering of the nodes. This is probably why they only made a 1 node ES, because they would have to push their Enterprise software to do make a cluster of RediSearch. Maybe i am wrong.

</comment><comment><USER24> RedisLabs has done great work in developing Redis but these extensions to retrofit Redis into a multi-model database have issues.

Raw latency is usually not the primary concern most of the time and having everything in RAM can be a major cost problem, further compounded by the lack of compression available as with other persistent stores. The RESP protocol is also overloaded and hard to work with when dealing with json and search queries.

</comment><comment><USER25> Does not tell us the settings for text analysis done by two engines. Secondly on query side - again, scoring settings of RediSearch vs Elastic are not discussed.

With that it's just 2 points in space which gives us little information to deduce 58% faster at X or whatever.

</comment><comment><USER26> In the fine print: number of shards for the multi-tenant benchmark for Redisearch was increased from 5 to 20; but kept the same (5) for Elastisearch.

This is why the only reliable benchmark is the one _you_ do on _your_ data.

</comment><comment><USER27> Anyone can make a search engine fast. It's much harder to make it good.

</comment><comment><USER28> So according to HN, they've proved RediSearch is actually inferior

<comment><USER24> No, they just haven't proven anything.

</comment></comment><comment> rooam-dev Is the RediSearch's aggregation comparable with ES's? Speed has lower priority when there are missing features.

PS: Crashes are never good though...

</comment><comment><USER29> WOW. Hahahaha.

This is a massive misconfiguration of an elastic search cluster. 50k indices? 500 documents per index?

500 records per index at 5shards/index is 100 records per shard.

Yeah, let's shard our data so much that we introduce tremendous amounts of disk i/o overhead!!!

Author should learn how to properly configure an ES cluster before posting ridiculous benchmarks like this.

What an utter pile of garbage benchmark this is.

<comment><USER30> Isn't that exactly what they're trying to demonstrate though? That all this arcana you have to invoke to get a stable ES cluster barely breaks a sweat on Redisearch?

The specific test deployment was multitenant anyway-- you can't account or optimize for what tenants are going to index.

<comment><USER29> I'm not familiar with RediSearch, but I'm just trying to point out that you can't misconfigure ES and then benchmark against a misconfigured cluster. This is comparing apples to oranges. Not to mention I'm not sure of the feature difference between the 2 search engines, but I'd bet ES is much more feature rich, thus its use cases are vastly different. If you are just comparing text search, sure, maybe redis is faster. But at that point, so is a simple sql database, when compared to a misconfigured ES cluster.

<comment><USER30> I'm not familiar with Redisearch either but I agree, there's definitely a bent to this in that they made something that isn't ES, then compare it to ES via a a benchmark that shows how poorly ES performs at...being something other than ES.

The impression I got was that they were trying to demonstrate for two specific workloads, how much more a single node of RS can do than a single node of ES, and that we should extrapolate the savings and performance if scaled out from there.

A properly deployed ES cluster versus a single RS node isn't a fair comparison either. It's a strained comparison in any case.

</comment></comment></comment></comment><comment><USER31> How silly to emphasize things like "built as a C extension" and "uses modern data-structures" as if these were useful criteria for choosing a search engine.

It's about minimizing the effort needed to find what you're looking for. Speed of index construction time, unless we're talking orders of magnitude, isn't really meaningful. I don't know if this is just a really clumsy attempt at "marketing" or what, but I can't imagine this is going to convince anyone to drop es for this thing.

<comment><USER7> Also complaining that "Lucene is 20 years old" is about the same as saying "Linux is ~30 years old"

Lucene is a pretty rock-solid open source project that has been battle tested over those 20 years and had some of the best engineers in the world improve over a long time frame. That's an asset for Lucene!

<comment><USER32> That's a testament to how hard search engines are. Armies of engineers spent years getting to this point. This project just started as a POC for Redis modules, but this is really forced and futile. Trying to do this is like attaching wings to a motorcycle - it's not how search works. This falls apart beyond a primitive word lookup, which you can do with any SQL database. And it has been done, MANY times.</comment></comment></comment>


Invisibility cloaks could take sting out of tsunamis - <AUTHOR> http://technology.newscientist.com/article/dn14829-invisibility-cloaks-could-take-sting-out-of-tsunamis.html <comment><USER2> Previous, limited, discussion: <http://news.ycombinator.com/item?id=319323></comment>


Can You Really Anticipate What Profit's You'll Make? - <AUTHOR> http://www.thefreedomtrader.com/can-you-really-anticipate-what-profits-youll-make/

<comment><USER2> Profit's :D cringe at the Grammar's</comment>


Law Firm Announces Investigation on Behalf of Uber Technologies Inc Investors - <AUTHOR> What do you suppose this is about?<p>https://www.businesswire.com/news/home/20190813005793/en/INVESTOR-ALERT-Law-Offices-Howard-G.-Smith <comment><USER2> Apparently Pivotal, Pluralsight and Zuora are also being sued by the same law firm ([http://www.howardsmithlaw.com/index.html](http://www.howardsmithlaw.com/index.html))

</comment><comment><AUTHOR> What the heck could this be about? They just IPO'd and the investors are mad the stock is down? Why would that be a reason to sue... Or I assume sue... Why would this require an investigation? Might be a dumb question

<comment><USER3> During the investor pitches there are projections and historical numbers that are provided of they are misleading this where a lawsuit is needed to uncover that.

That's what happened to Snapchat after they ipo. Turns out they had more warning internally that their numbers were slowing that weren't shared.

<comment><AUTHOR> Oh I didn't hear about a snap lawsuit, I knew their stock tanked but I don't know about the lawsuit. I'll Google it. I figured after they put out the ipo perspective it was "buyer be ware".</comment></comment></comment>


Researchers recover typed text using audio recording of keystrokes (2005) - <AUTHOR> http://berkeley.edu/news/media/releases/2005/09/14_key.shtml <comment><USER2> My uncle was a career NSA man. In the 1970s, his job (I learned decades later) was to modify and maintain all the typewriters in the White House so their keystrokes couldn't be used to identify what was being typed on them. Presumably the concern was that something like a Buran eavesdropping system could be used to detect vibrations in windows, and the sound of the typewriter keys then extracted and analyzed to recover the text.

My grandfather (also career NSA) used to tell me that it would seem like fiction if people knew some of the things that technology and a good cryptanalyst could do. I think he was right.

<comment><USER3> _" his job (I learned decades later) was to modify and maintain all the typewriters in the White House so their keystrokes couldn't be used to identify what was being typed on them."_

How would you do that? Soundproofing? Delay on the mechanical action? What is the fingerprint that allows transcription of a sound sample?

[https://www.freesound.org/people/keithpeter/sounds/123344/](https://www.freesound.org/people/keithpeter/sounds/123344/)

have at it...

<comment><USER4> If I was given this job, not knowing anything about typewriters or spying, my first plan would be to modify all typewriters regularly by switching parts around according to a random draw, and also by rejigging any calibration settings (individual letter height, etc). This would modify both the sound of the typewriters and the fingerprints of the actual typed output [1].

This way, there would never be a per-typewriter profile, because all machines are randomised every week. Obviously, I'd also have a white-room analysis team checking whether the scheme works.

Maybe someone who knows more about typewriters could tell me whether this would work at all, or there is a fatal flaw.

[1] [http://scholar.google.com.au/scholar?q=%22typewriter+identif...](http://scholar.google.com.au/scholar?q=%22typewriter+identification%22&btnG=&hl=en&as_sdt=0%2C5)

</comment></comment></comment><comment><USER5> Link to the paper: [http://www.cs.berkeley.edu/~tygar/papers/Keyboard_Acoustic_E...](http://www.cs.berkeley.edu/~tygar/papers/Keyboard_Acoustic_Emanations_Revisited/tiss.preprint.pdf)

It's pretty interesting. It's an algorithm which, given a recording of you typing out several HN comments, can generate an acoustic profile of how you type on your particular keyboard. By assuming that you're typing English, it can infer what words you're typing based on its rough guess, and then it can train itself to recognize keystroke sounds that it previously got wrong. After a few times of doing this, it claims to be accurate enough to recover your passwords from a recording of you typing them in.

</comment><comment><USER6> Related: (sp)iPhone: Decoding Vibrations From Nearby Keyboards Using Mobile Phone Accelerometers

[http://www.cc.gatech.edu/~traynor/papers/traynor- ccs11.pdf](http://www.cc.gatech.edu/~traynor/papers/traynor-ccs11.pdf) (Not working for me right now.)

[http://dl.packetstormsecurity.net/papers/general/traynor- ccs...](http://dl.packetstormsecurity.net/papers/general/traynor-ccs11.pdf)

</comment><comment><USER7> Some of the previous work on this involving timing attacks against SSH [1] is particularly interesting because it's so obvious in retrospect, but no one saw it when SSH was being designed.

[1][http://www.cs.berkeley.edu/~daw/papers/ssh- use01.pdf](http://www.cs.berkeley.edu/~daw/papers/ssh-use01.pdf)

<comment><USER8> About the nested ssh attack - I don't get it, how come the ssh client on B waits until return is hit to send the password but the client on A doesnt?

</comment></comment><comment><USER9> fwiw, when i used to work in finance, the team i was in used to handle very sensitive market-moving data. one day, without warning, all of the offices keyboards and mouse where changed to "more secure hardware/peripherals" by orders of the cio and its staff. this was in 06/07, at the time i thought they were paranoid - now i think otherwise.

<comment><USER10> Do you know what was different about them?

<comment><USER9> i remember all wireless devices were made wired, all keyboards where non- mechanical, very simple/traditional layout (no multimedia keys, etc) and no usb interface. i'm sure there was more to it, but that is all i saw/remember.

</comment></comment></comment><comment><USER11> This is a very old idea. I recall that in the 1987 book "Spycatcher" Peter Wright wrote about listening to typewriter keystrokes through a microphone bug in some embessy. He was the head scientist in British intelligence and the book caused a bit of a stir at the time, being the subject of censorship attempts. I think this audio bugging of keystroakes may go back to the 1960's.

</comment><comment><USER12> I wonder how well this would work for really fast (150WPM+) typists, since at that speed the keys are often being hit simultaneously by many fingers and it becomes much harder to distinguish the individual sounds. The spacebar still remains distinct-sounding, however.

<comment><USER13> fast typists are more regular. This should create patterns easier to recognise.

</comment></comment><comment><USER14> Doubt they will make it very far with me since I do most of my keystrokes in vim. I'll stick to being paranoid about van eck phreaking.

</comment><comment><USER15> Now smartphones will need protection against listening to keystrokes from the environment around them.</comment>


An Ad Hoc Affair: Jane Jacobs's Clear-Eyed Vision of Humanity - <AUTHOR> https://www.thenation.com/article/jane-jacobss-radical-vision-of-humanity/ <comment><USER2> Death and Life of Great American Cities is a book that everyone should relocate to the top of their reading lists, of they've not already tackled it. It's still perfectly applicable to every US town or city I've ever visited or lived in. The mistakes she laments are still being made. She mentions that what she writes about cities may not be applicable to smaller towns, but it mostly is (I believe she was just pointing out the limits of her own experiences.)

There are many, many social issues worth reading about right now. This book is important not because its issue is more pressing, per se, but because its issues are so foundational to many others we struggle with in our cities and in the whole country.

<comment><USER3> I'm in the middle of Death and Life right now. I'm enjoying it for sure, and I find myself nodding my head at a lot of what she says, particularly stuff about border vacuums and mixed-usage areas, both of which have figured into my own past decisions about where to live.

One thing I do find lacking is a discussion of assessing tradeoffs, particularly when her design principles bump up against natural pressures (i.e. driven by the market, not by fiat city planners). For example, she advocates a mix of new and old city buildings. Enforcing this may generate housing and office shortages, if a neighborhood becomes attractive at a rate exceeding that which we can maintain the desired old-new mix. How do we trade that off; at what price do we value incremental old-new mix?

She does cover some of this in her chapter on self-destruction of diversity, but her solution of zoning for diversity was a little tautological for me, just stating that diversity should be enforced. What I'm interested in is how we weigh that against the lost utility of individuals and businesses who would prefer to move to the neighborhood in question.

It's definitely a tough question! While I'd prefer some more head-on discussion of tradeoffs, I think (unfortunately, decades later) that there's still plenty of room for the ideas she advocates to be recognized at all.

<comment><USER2> Yeah, making her ideas systematic are definitely a sticking point. In so much as she suggests anything, the more prominent idea to me was the influential neighborhood association. That wasn't so much a policy as a recommendation to have a standing public opinion "army", if you will.

I'm not sure that there is a way to put a system in place to save us from ourselves if we fail to be well informed, but the book definitely points out a lot of ways you can notice things going wrong. Jacobs also does a great job of explaining the mechanism of the many traps that we plan ourselves into.

My favorite non-profit, Strong Towns, also frequently mentions how difficult it is to give a formulaic solution to these problems. Furthermore, as the founder likes to put it, what we're often asking for are "ways other people can change what they do so I don't have to change what I'm doing." Until I can figure out a better way to make change, I'm at least determined to be informed and well-versed enough in the lingo so that urban planners can't make their dumb ideas look good in conversation with me just by dressing the ideas up in jargon.

</comment></comment></comment><comment><USER4> In this article, the opening paragraph actually tells us why Jane Jacobs is culturally relevant. without all the irrelevant digressions. I mean what the heck does her boss being unable to attend a conference got to do with urban architectural planning.

[https://www.pps.org/reference/jjacobs-2/](https://www.pps.org/reference/jjacobs-2/)

<comment><USER2> It's long form writing, in this case taking the form of a narrative. It gives texture and context, which some people certainly appreciate. Having said that, it's also nice to have a summary version like the one you've offered, though I tend to go straight to Wikipedia if that's the mood I'm in.

<comment><USER4> I do appreciate long form writing, but not when it's done badly, as in all the salient details are scattered about the page. That article would be good as part of a biography. Having never heard of Jane Jacob, I too had to consult wikipedia. They should do what Time Magazine does and have a separate info-box with a brief synopsis of the salient details.

<comment><USER5> "They should do what Time Magazine does..."

Sorry, but you have really made a blunder here. The magazine you're critiquing is the foremost American journal of left political thought. It has been publishing weekly since the Civil War. Its editors, writers, and readers expect to read difficult, complex pieces there. It wants nothing to do with _Time_ , which, being an upstart Luce rag, is the opposite of it in so many ways.

Anyway. Doubtless, Jacobs excites some contradictory impulses in the _Nation_ readership. As a small article in another leftist journal ([http://inthesetimes.com/article/2743/jane_jacobs_reconsidere...](http://inthesetimes.com/article/2743/jane_jacobs_reconsidered)) put it:

"Jacobs' iconoclastic ideas raised questions about her political beliefs. Her opposition to the Vietnam War and her role in organizing movements for urban social justice seem to mark her as a woman of the left. And yet, conservatives also embraced Jacobs' wars with City Hall, joining her on the barricades to stop federal urban renewal policy. They found comfort in her cantankerous individualism and her attack on planners and government bureaucracy. Her economic ideas–which locate the roots of productivity in ingenuity rather than class struggle–attract libertarians."

This is the reason a short article on Jacobs in this magazine, especially, makes no sense.

<comment><USER6> That's a pretty good summary based on what I know of Jacobs. She has a lot of fans in the circles of city living advocates who are particularly opposed to car-centric cultures. On the other hand, I suspect that based on her record in NYC she'd be equally critical of those who would like nothing better than for the city (e.g. SF) to just bulldoze blocks of low rises and build, build, build.

<comment><USER7> That's the trouble with a lot of people who think of themselves as Jacobs fans. They like the sorts of outcomes that she liked, but then they ignore almost the whole of her analysis and basically come up with ideas for Master- Planning the Jane Jacobs City.

<comment><USER6> That's a good way to put it. I think it's also the case that Jane Jacobs wanted outcomes for cities that make them attractive and vibrant living places in the eyes of many. However, she was far less interested in then making, say, NYC easy and affordable for more people to live in--especially if doing so ran counter to goal #1.</comment></comment></comment></comment></comment></comment></comment>


Ask HN: How can an individual get into machine learning? - <AUTHOR>

HN, I'm a web developer who's good at front-end programming and okayish at back-end programming.
Reading articles on large companies making breakthroughs in machine learning and neural networking makes a part of me quite excited.
So I wanted to ask if it's useful for an individual to get into this sort of stuff? Is this a viable career path right now? What beginner books or sites can you recommend? <comment><USER2> This probably could almost be a FAQ.

Have a look here:

[https://news.ycombinator.com/item?id=7783550](https://news.ycombinator.com/item?id=7783550)

[https://news.ycombinator.com/item?id=2645671](https://news.ycombinator.com/item?id=2645671)

<comment><AUTHOR> Thank you for the links, sorry for posting an oft-repeated question.

<comment><USER2> Np. Way to avoid this is to do this:

google site:news.ycombinator.com subject of your question

More often than not a bunch of links will pop up.

good luck with studying!

j

</comment></comment></comment><comment><USER3> Do this Coursera course, targeted towards beginners and its taught by Andrew Ng (Co-founder of Coursera) - [https://www.coursera.org/course/ml](https://www.coursera.org/course/ml)

<comment><USER4> The videos are available here: [https://class.coursera.org/ml-005/lecture](https://class.coursera.org/ml-005/lecture)

I think it is worth mentioning that "beginners" should be understood as beginners in machine learning and not beginners in computer science. Ng's course more or less assumes students have the equivalent of an upper division undergraduate or graduate background in computer science.

While it may be a valuable learning experience for a person who isn't comfortable knocking out algorithms, academic success will be rather difficult to achieve.</comment></comment>


Amazon Shareholders Rejected Employees' Call to Respond to Climate Change - <AUTHOR> https://www.buzzfeednews.com/leticiamiranda/amazon-shareholders-reject-employee-call-to-respond-to <comment><USER2> This headline is misleading.

The vast majority of shareholder resolutions fail to achieve a majority (>50%) support. In fact, most shareholder resolutions are considered a 'success' anytime they garner any substantial amount of vote (>10%), and the company will usually take preemptive actions to address the issue when resolutions reach that level[0].

One thing most people don't realize is these votes are all non-binding. Companies have no legal obligation to do anything based on shareholder resolutions. Essentially they're a big survey.

Companies want to serve their shareholders -- that's the whole point. If the past is any indication, this effort will drive Amazon to substantially improve its sustainability practices.

_____

[0] From one of my working papers:

Proposals that do not achieve majority vote can still have impact by opening up a dialogue. Glac (2010) presents an example of a proposal asking Amoco to adopt the Valdez environmental principles which only got 8.6% approval, but Amoco began to shift environmental policies. A similar proposal the next year was withdrawn because of Amoco's policy shift. Sometimes, the media impact of a failed vote can lead to future progress. For example, Guay et al. (2004) argue that the media impact of a resolution filed with Talisman on operations in Sudan led the company to withdraw a year later.

<comment><USER2> If you own amazon stock and want to build support for when they re-file next year, you can add your shares to support of this online petition: [https://www.yourstake.org/ask/amazoncom-inc-amazon-reduce- fo...](https://www.yourstake.org/ask/amazoncom-inc-amazon-reduce-fossil-fuel- dependence/)

</comment></comment><comment><USER3> > In an emailed statement, Amazon outlined its sustainability initiatives and > said, "Amazon's sustainability team is using a science-based approach to > develop data and strategies to ensure a rigorous approach to our > sustainability work." The company also said, "We have a long term commitment > to powering our global infrastructure using 100% renewable energy."

In my experience, "using a science-based approach" translates to "maximizing shareholder value" with plausible deniability.

<comment><USER4> Is that supposed to be a problem?

Large data centers are strong candidates for renewable energy conversions because they need backup power regardless. If the "backup power" is supplied by renewables then that becomes the primary generation source and the power grid becomes the backup. Doing it that way is sustainable _and_ profitable.

<comment><USER5> I would be very leery of a datacenter that didn't have their own on-site generation plants that can be guaranteed to supply power in the event of a grid failure. If a substation goes down on a cloudy day, I would hope that they have a big diesel generator or gas plant on standby regardless.

<comment><USER4> The solution to that is to have enough solar to generate the power you need even on cloudy days, then sell the excess to the power company on normal days.

</comment></comment></comment></comment><comment><USER6> A call which was made by bcc spamming all the internal amazon mailing lists asking people to sign the petition.

Source: I know a guy who got spammed.

</comment><comment><USER7> I've been surprised by Amazon's commitment to and progress in this area. I only recently learned that half of AWS was powered by renewable energy in 2018. That might not be good enough for these people, but I was pleasantly surprised.

</comment><comment><USER8> Most shareholder resolutions are total jokes that get rubber-stamped by the large fund managers/executives and large individual shareholders who actually vote their shares. Despite increased access, due to ubiquitous internet access, only 27% of retail investors even bother to vote.[0] Plus, with an increasing concentration of assets managed by a small group of giant fund companies, this continues to become a bigger problem where the retail investors have little to no say.

Check out the AFL-CIO Executive Paywatch [1], can you imagine retail investors approving executive compensation to the rate of 200x or even 5900x (in the case of Weight Watchers) median employee pay? Those executive compensation votes usually pass without much more than a squeak from a couple of small investors or activist fund managers who typically get trounced when it comes time to vote.

Even if it's seemingly pointless, I always read the proposals and vote. It's also a great way to learn and get a sense of what's going on at the companies you are invested in.

[0] [http://buzz.money.cnn.com/2014/06/12/shareholders-dont- vote/](http://buzz.money.cnn.com/2014/06/12/shareholders-dont-vote/)

[1] [https://aflcio.org/paywatch](https://aflcio.org/paywatch)

</comment><comment><USER9> Time to change the shareholders

</comment><comment><USER10> Majority Shareholders are practically our Modern Feudal Lords. The only difference is that there is a government which was paid in blood as result from past revolutions and uprisings. A government that is also being taken over by Modern Aristocrats.

<comment><USER4> Amazon doesn't have a majority shareholder. Most of these huge companies don't. Gates doesn't own a majority of Microsoft, Page and Brin even together don't own a majority of Google, etc. These companies are owned by everybody's retirement fund.

It's actually becoming rather a problem because you have these gigantic containers of wealth but there is no one captaining the ship who can do anything bold with it, because that requires shareholder approval but the underlying shareholders don't even know what companies they own much less have any idea what comes up for a vote. Meanwhile the fund managers are the most conservative people imaginable and are far more interested in stable returns than making the world a better place, so the entities that have the resources for moonshots don't have the stones to actually attempt them.

<comment><USER11> Your comment is incorrect. There are numerous types of stock. The biggest division being preferred and common. Common entails voting rights, preferred does not. There are also share classes. For instance Google has class A, B, C shares. Class A are what people buy and do entail minimal voting rights. Class B are voting shares owned primarily by the founders and carry 10x the voting rights per share of class A. And class C are voteless shares generally distributed to employees for compensation. Sergey Brin and Larry Page own a minority of all outstanding Google shares (about 13%) but have majority control of the voting power in the company. The same is true of companies such as Facebook and Zuckerberg.

This leads to the rather interesting insight that the current direction and actions of of Alpha/Google/YouTube etc have been ultimately under the exclusive control of Brin and Page; similarly for Zuckerberg/Facebook. These companies' actions give the most honest insight possible into their owners' worldviews. Not the most comforting thought.

<comment><USER12> Is there a price difference? Can shares be converted between classes or between preferred and common?

<comment><USER13> I'm not much of a stock person, but I think in such cases, the voting shares tend to be tightly controlled. Especially for companies like Alphabet & Facebook, they are essentially trying to get the funding of a public company, while still maintaining the function of a private one.</comment></comment></comment></comment></comment>


We Don't Really Understand Randomness - <AUTHOR> https://adolos.substack.com/p/we-dont-really-understand-randomness <comment><USER2> > How do we break out of this feeling of certainty and discover the truth? > When looking for cause, try to disprove rather than prove the correlation. > Ask what could go against the pattern of the event you seek — where you have > randomness.

The more general approach is called Abduction: [https://en.wikipedia.org/wiki/Abductive_reasoning](https://en.wikipedia.org/wiki/Abductive_reasoning)

Abduction is the process used in a legal trial--the crime or claim is a consequence, the prosecution proffers the hypothesis that the defendant is the causative agent and presents their evidence, while the defense attempts to disprove the hypothesis while also proffering their own alternative hypotheses. The entire trial and its procedural rules play out as an abductive process. (The book "Analysis of Evidence" describes this more formally, including exploring the relationships to Bayesian reasoning and other systems of logic.)

A doctor uses abduction during a diagnosis--take all the symptoms and patient context (prior illness, family history, etc), generate a set of potential hypotheses about the cause, and compare-and-contrast them to see which is the more likely. This is very often a more iterative, interactive process as you can intervene (ask questions, run tests, etc) to bolster or filter various hypotheses.

In science an informal abductive process is how you generate a hypothesis for rigorous experimentation. Abduction is how you pinpoint a potential cause from a consequence. The scientific method then starts from a cause (the hypothesized starting condition) and attempts to empirically reproduce the consequence, although formally you're attempting to disprove the consequence.

Abduction is a process of _generating_ , _comparing_ , and _winnowing_ hypotheses, not making a single guess and looking for proof. And at the end, your chosen hypothesis, if you have one, is always contingent and probabilistic.

Abduction is often conflated with induction, but it's not really the same thing. For one, it's better characterized as an indefinitely iterative process rather than a discrete mechanism. (You can't string together a set of discretely abduced conclusions to infer something new; the new inference should begin anew by holistically assessing as many of the previous inputs as possible, as the broader context might reveal something new.) Recognizing the distinction permits far more rigorous and consistently analytical thinking, both professionally and in day-to-day life.

</comment><comment><USER3> "For example, Sam L. Savage was convinced he could use statistics to accurately predict fruit prices, which was undoubtedly unwise. He hired a commodities trading company, but lost $300 million in a matter of weeks."

I'm not familiar with that story. Is it the same person who wrote this book?

[https://www.amazon.com/dp/B0096CT4VY/ref=dp-kindle- redirect?...](https://www.amazon.com/dp/B0096CT4VY/ref=dp-kindle- redirect?_encoding=UTF8&btkr=1)</comment>


Ask HN: My team lead is incompetent - <AUTHOR> I've been working with my team lead for 3 years now, and I genuinely think they're dead weight. I'm the defacto team lead because I'm the most technically competent on the team and also because I: mentor the less experienced devs on the team, created the design and roadmap for our software, and help the team lead with practically every decision.
The team lead has difficulty completing simple tasks. They aren't learning the technologies we're using (Git, React, etc.) even though they're allowed to spend all the time they want to learn them. They don't seem competent in our core language (C#), and when given a task to write something new, they wrote it in Basic even though no one else on the team knows it. The team lead doesn't mentor. They don't have a solid grasp on the current state of our software. They rubber-stamp pull requests. When I asked for mentoring regarding interviewing a potential new hire, we didn't really evaluate the candidate in the interview at all (and I received no mentoring on the topic).
I've come to a point where working under the team lead is starting to seriously bother me, and I'm not sure what to do. Any advice? <comment><USER3> Observe your team lead, he/she might be dead weight... or maybe not. It's true that a tech lead should be pro-efficient in the language and technology, but there are tons of things that a tech lead is supposed to do.

Bringing people together, keeping the motivation of the team going, solving conflicts as soon as they happen. Also communicating with management (maybe you haven't realized that you are free to focus on the tech side because someone else is absorbing the drama?)

A tech lead is also expected to be able to distribute work and keep everyone engaged, working through the process and making sure the team has the resources including QA, hardware, other teams, coordinating release schedules, aligning stakeholders, controlling scope creep and product managers. And sometimes the manager relies on him to even do admin work.

Sometimes people are in a position for a reason. The ironic thing that could happen to you would be that someday you get that job and suddenly realize that it requires a completely different set of skills.

<comment><USER4> I agree with OP that writing a task in a non-core language is concerning, and also agree with you that there might be more going on.

I've worked with both types of team leads -- those that are there because they are technically proficient, as well as those that are good at handling the politics so the team doesn't and relies upon Sr. engineers to guide the project technically.

It's completely situational as to what is appropriate. Are you a 6+ person team in a large org (or in a small dysfunctional org)? Then you want some one who can handle the politics. Are you a 4 person team that owns your company's entire tech stack? Then you want someone who is really technically proficient.

Since OP mentioned the manager of this person, I suspect it's a larger org where politics is king, otherwise they would report to a VP or higher directly.

</comment></comment><comment><USER5> You have projected things you think are important onto the responsibilities of the team lead. Those things might not be what they or their boss feel are important.

If it bothers you that much, quit.

<comment><AUTHOR> Good point

</comment></comment><comment><USER6> I have had a similar team lead. Mine spent all his time on the phone talking to his buddies - not work related. I often ended up picking up the pieces of his mess. I quit. Best day of my life! Went on a 3 month bicycle trip - <USER2> IT. Found a better job.

</comment><comment><USER7> Just to add to all that has been said already : If he is in that position for 3 years and he stays there; there is something in him that fits the organisation he is in. He might be doing _some_ things right that you value less than others or can't see. Even if you end up leaving, you can get value from searching what that can be.

It might also be worth checking how he feels himself int he role (without confronting him of course). Does he think he is doing well? Maybe he is afraid of being judged so he sticks to what he knows.

In any case, good luck with it :)

</comment><comment><USER8> Simply stop doing their job. He is a team lead because of you.

</comment><comment><USER9> I think it would be good to learn what else your team lead is doing? Often team leads have more responsibilities than just technically leading a team. Such as

1) Working on budget and forecast

2) Developing project plans

3) Tracking milestones and project status

Of course it is more beneficial for the team lead to know what the team is doing, but it depends on how large your org is. I find that the larger the company, the less technical the lead usually is.

</comment><comment><USER10> It appears that the team lead's incompetence is not your problem. Then you should mind your own business.

<comment><USER11> 100%.

</comment></comment><comment><USER12> Where do you work where something like this can go on that long?

I suspect somewhere with over 2000 employees. No way a slouch like that could hide otherwise.</comment>


Warren Says Wells Fargo's Stumpf Should Resign, Face Criminal Investigation - <AUTHOR> http://www.bloomberg.com/news/articles/2016-09-20/wells-fargo-expands-account-review-to-2009-and-2010-stumpf-says <comment><USER2> Lifecycle of a banking executive:

1\. Commit fraud on a massive scale

2\. Say "I accept responsibility" but fire subordinates

3\. Ride off into the sunset with obscene personal wealth

<comment><USER3> Well, he said he will accept what the board says. If the board doesn't tell him to return his bonus, they should get sued by the shareholders.

<comment><USER4> He's the chairman of the board most likely stuffed with hand-picked cronies for exactly this situation.

</comment></comment></comment><comment><USER5> This activity was quite costly to the bank and Stumpf didn't benefit from it. Banks aren't popular, but I don't want a world where you can go to jail for making a mistake or being bad at your job.

<comment><USER6> Matt Levine gives a great rundown of this [https://www.bloomberg.com/view/articles/2016-09-09/wells- far...](https://www.bloomberg.com/view/articles/2016-09-09/wells-fargo-opened- a-couple-million-fake-accounts) ; you're exactly right, this wasn't Wells Fargo cheating customers. It was Wells Fargo putting some pressure on their employees who turned around and gamed the system in a way that earned the bank almost no money and mostly didn't cost their customers anything. Yes, some of the customers got some fees charged to them, but they were mostly small and most of the customers with accounts opened didn't lose anything.

That this should cause the CEO, who was several layers up the org chart from the person who came up with a bad retail bank employee performance metric, to go to jail is madness.

<comment><USER7> The CEO was the one pushing the metric. This wasn't just a localized problem.

<comment><USER8> He also stated that he never considered firing the head of the unit responsible for the problem. I mean, come on.

<comment><USER9> The previous Wells CEO gave a talk at stanford GSB in 2009 in which he explained the company's core strategy in consumer financial services: distributing decentralized products and services through cross-selling. [1]

Since cross-selling has been core to the Wells Fargo business model for many years, and proven an effective growth mechanism over that time, it wouldn't make much sense to just go round firing people over pursuing that mechanism responsibly. What does make sense is adjusting course sternly when that pursuit starts to look irresponsible, and it appears the current leadership is doing that.

If Elizabeth Warren had the brains to understand the financial services industry, she wouldn't have time to fling baseless legal allegations at dinosaur incumbents like Wells Fargo. She would be too busy disrupting them.

With an institution as old and large as Wells Fargo, the problem isn't that their strategy is bad. "How can it be bad when it's been good all these years?" It's actually much deeper than that: their strategy is yesterday's strategy, and that can be a big problem when you have the kind of organizational inertia Wells does.

1\. [https://youtu.be/XTh4ELp2VDc?t=2678](https://youtu.be/XTh4ELp2VDc?t=2678)

</comment></comment></comment></comment></comment><comment><USER10> I'm confused. My impression is that Wells Fargo made de minimus profit on these practices and there's no evidence at all that Stumpf himself did anything illegal (creating shitty incentive programs is just stupid, not criminal). Maybe there should be a criminal investigation into Stumpf, but to call for resignations and bonuses to be returned is premature, no?

<comment><USER11> Of course. It's simply too early to say. However, Warren is known for her political grandstanding. It's kinda her thing.

<comment><USER10> I guess I knew that when I wrote my comment. It would be nice if we all collectively remember when politicians spout nonsense like that the next time they grandstand or run for re-election.

</comment></comment></comment><comment><USER12> I'm not familiar with the US legal system, but what senators have to do with this? shouldn't it be the role of a prosecutor to deal with this case?

I also find the politicians quite hypocritical. Aren't they to blame if the laws they voted for (or didn't vote for) are such that guys like Stumpf get unpunished for their wrongdoings?

<comment><USER13> Congress can hold hearings, they can issue subpoenas, and they can hold someone in contempt of Congress.

There is currently no case. Congress is simply holding a hearing to roast the guy for making some stupid decisions. If information comes to light that would indicate criminal wrongdoing of a private citizen or a non-elected member of the government during a Congressional hearing the justice department takes over. For elected officials Congress (specifically the Senate) has the option of initiating an impeachment trial.

<comment><USER14> They can also change the laws.

<comment><USER13> True, but that takes a heck of a lot more effort than berating a CEO for 30 minutes straight.

<comment><USER14> Then it's a good thing they did more than that.

Even that meeting, titled "An Examination of Wells Fargo's Unauthorized Accounts and the Regulatory Response", was more than three hours long, and with three other witnesses.

Why, it's as if it were part of a larger effort to change the laws.

</comment></comment></comment></comment></comment><comment><USER15> Ahhhh. The headline refers to Elizabeth Warren. I was really confused as to why Warren Buffet (a big Wells Fargo shareholder) would be making a public statement like this.

</comment><comment><USER16> That congressional hearing was by far the most toothless circus I've ever seen on CSPAN. They're all in the tank with the banking industry.

<comment><USER3> Link please? From reading, it sounded like Elizabeth Warren spanked him.

And how can you not love Elizabeth Warren? <3

<comment><USER17> Embedded here: [http://www.nakedcapitalism.com/2016/09/wells-fargo-ceos- tefl...](http://www.nakedcapitalism.com/2016/09/wells-fargo-ceos-teflon-don- act-backfires-at-senate-hearing-i-take-full-responsibility-means-anything- but.html)

</comment></comment></comment><comment><USER18> This is quite insane. Is it too early to toss around the idea that the US government is slowly trying to take over the banking system?

<comment><USER9> From a political perspective, attacking the Wall St label is an effective "enemy of my enemy is my friend" strategy for gaining democratic power with the lower classes -- the people who comprise a democratic majority. Nevermind that the allegations won't stick, not necessarily because of government conspiracy, but because they aren't smart allegations that attack real problems.

Real problems are big and hairy. It's much easier to witch-hunt than it is to solve real problems. The real problem might be that the products Wells Fargo is cross-selling are outdated. It might be that cross-selling is an outdated strategy. These are much harder problems to solve than locking up or fining a CEO who made mistakes in leadership. That's much easier. Because every CEO makes errors in leadership.

</comment></comment><comment><USER19> Maybe... maaaaaaybe.. the former will happen. The latter? Never.</comment>


Who is a good beta test target? - <AUTHOR>

So I have a site i2drive.com and I am adding a new major feature which will become an add-on product. I want to release it as beta and get some feedbacks before it's done. I don't know who I should test this on?
1. Some users that have free accounts
2. Some of the paying customers
3. Some business customers
4. None of the above and test it with friends etc and release the final product to the customers? <comment><USER2> There are a couple of things to consider:

Paying and business customers might not want a beta service that is likely to be buggy. They may want a solid system that is as reliable as possible. On the other hand, they may like the idea of getting new features "first" even if it is going to be a beta. It depends on who your typical customers are: Techies, business types, college students...

Don't give it to the free accounts unless it's already been tested and proven reliable. If someone signs up with a free account to test the waters and then has to deal with a potentially buggy product they might be turned off from your service.

If you have friends who are representative of typical customers (both free, payed, and business) then it would be a good idea to release it to them first. If they are not representative of your typical users you will probably find that you encounter other problems that you weren't aware of during the beta.

If it were my decision, I would alpha test it amongst friends and family until the functional bugs are worked out, then offer it as an option to select (randomized between free, paid, and business) customers to see if they want to sign up for the beta for free (Limited time only!). Make sure they know that the beta is from for x months only. Then when it's time to move it into an add-on product, make it publicly available and offer those who alpha and beta tested it a discount on the service if they want to continue with it.

<comment><AUTHOR> Very good suggestions. I think that's what I'll do; the sampling, limiting the time and giving discounts are all good points.

By the way I looked at your startup and it looks very good. I'm also In Los Angeles. If you ever needed any type of help or just wanted to get together let me know.

<comment><USER2> Thanks! That's great that you're in LA. It would be cool to meet up with someone from news.YC. My email is dkokelley at gmail dot com, or you could go with email@example.com. What part of Los Angeles are you in? I'm up at the northern end, in Santa Clarita (at the 5 and 14 freeway).

<comment><AUTHOR> yea it would be nice to talk code and stuff. I'll email you my contact info. I'm in Santa Monica</comment></comment></comment></comment>


Ask HN: Where did you hang out while HN was down? - <AUTHOR> I'm (and probably others, hopefully) will be interested in knowing where you spent your online surfing time in place of HN. As a person learning programming for the first time, I spent most of the time on r/learnprogramming, r/learnpython, r/ python and Google Groups for the Python mailing list.<p>What of you? <comment><USER2> It was tough, but in the end I got by with a combination of work and spending time with friends & family

<comment><USER3> Likewise. With a 3 month old baby, I didn't even realise it was down until just before I went to bed and checked it on my phone.

<comment><USER4> I was hoping your comment was going to end with "I didn't even realize I had a baby until it was down"

</comment></comment></comment><comment><USER5> I spent the whole time on HN pressing F5

<comment><USER6> Me too, until a day later I realised I should probably try Ctrl+F5, worked like a charm.

<comment><USER7> Me too, followed the HNStatus on twitter too

</comment></comment></comment><comment><USER8> There's a list of other communities at a spoof site I made a while back: [http://hn4hn4x.herokuapp.com](http://hn4hn4x.herokuapp.com)

</comment><comment><USER9> I ended up being productive - Started a new book ([https://leanpub.com/jsoddities](https://leanpub.com/jsoddities)) and wrote some 20% of it while HN was down. Far more effective than my noprocrast

<comment><USER10> 20% in a day - sounds more like a pamphlet to me :)

<comment><USER9> 5000+ words a day isn't too difficult, really. Plus JS Oddities isn't going to be a very big book - about 20+ examples of rather crazy JS code and explanations

<comment><USER11> JS The Good Parts is a little pamphlet. But JS oddities sounds like a huge bible.

</comment></comment></comment></comment><comment><USER12> The latest really disastrous LessWrong thread:

[http://lesswrong.com/lw/jfr/link_why_im_not_on_the_rationali...](http://lesswrong.com/lw/jfr/link_why_im_not_on_the_rationalist_masterlist/)

It turns out that if you provide a safe space for "Human Biodiversity" advocates, this can put some people off your site entirely.

</comment><comment><USER13> I ended up spending most of my time productively, writing code. However, I did spend a significant amount of time in IRC channels, Lobste.rs, /r/netsec, /r/python, /r/crypto, and /r/malware.

<comment><USER14> Isn't IRC dead yet? What are some of the IRC channels you would recommend to HN users?

<comment><USER15> IRC is just a protocol, like HTTP.

<comment><USER16> ... and protocols never truly die? Like Gopher?

<comment><USER17> What? Gopher isn't dead, buddy. There are over 160 servers.

<comment><USER16> Forgive me if I don't hold my breath waiting for Gopher to come back in-style though. ;-)

</comment></comment></comment></comment></comment></comment><comment><USER18> I tinkered around with a project and started Google's python course: [http://www.youtube.com/watch?v=tKTZoB2Vjuk](http://www.youtube.com/watch?v=tKTZoB2Vjuk)

</comment><comment><USER19> I released [http://twittersearch.algolia.io/](http://twittersearch.algolia.io/) :)

<comment><USER20> Looks cool, and I added my handle, but doesn't twitter already have this feature?

<comment><USER19> Thanks. Sure it has, I explain what (and how) I improved here: [http://blog.algolia.com/improving-ranking-twitter-handles- se...](http://blog.algolia.com/improving-ranking-twitter-handles-search/)

</comment></comment></comment><comment><USER21> I spent more time hanging out in cesspools of villainy, like /b and the PhantasyTour Phish forum ([http://phantasytour.com//phish/boards.cgi](http://phantasytour.com//phish/boards.cgi)). But yeah, I'm really happy HN is back.

<comment><USER22> Nice, didn't expect to see any PTers on here

</comment></comment><comment><USER23> As most of it was Sunday for me, I spent some time working on my IOCCC 2014 entry after reading carefully through the 2013 entries for inspiration.

That and r/wtf which is slightly addictive if not completely _wrong_.

</comment><comment><USER24> I honestly didn't realize how much time I spend on here until yesterday. It was more than a little disconcerting.

I spent a lot of my time reading up on Julia, and a little time working on a website.

</comment><comment><USER25> /r/learnprogramming and /r/programming

</comment><comment><USER26> I was looking at news.ycombinator.com instead of news.ycombinator.com/news (which yields "Sorry for the downtime. We hope to be back soon.") so I thought it was still down until I saw hckrnews.com had new entries and I started thinking "New entries? I thought it was down." Backtracked and figured out what URL I should have bookmarked for HN.

<comment><USER26> And then I saw below - Ctrl-F5... ugh.

</comment></comment><comment><USER27> ISRO scientists were doing an AMA on r/india

</comment><comment><USER14> I spent most of the time finishing my backlog on the multireddits I have made. To list down some of the sub-reddits, /r/dailyprogrammer, /r/cscareerquestions, /r/algorithms etc. This, in the time I would have been surfing HN instead, obviously. I also had a bookmarks folder of links from HN that I hadn't gone through.

</comment><comment><USER28> Seriously? Can we stay a day without constantly checking hackernews and the internet? And then posting about it to show how much YC fanboi they are?

Maybe be productive instead and actually code your startup instead of posting on hackernews.

Seriously.

Sry, I saw this discussion was all humane, so I thought it was time for token snarky comment guy. :P

</comment><comment><USER29> Did you see that? Developer productivity in North America just increased for one day. Its back down now.

Honestly, while HN was down, I didn't feel the need to hunt down other news. In fact, I got a good start on the Coursera crypto course, as well as got some real work done.

</comment><comment><USER30> Took a peek back at [http://www.reddit.com/r/startups](http://www.reddit.com/r/startups) and [http://growthhackers.com](http://growthhackers.com)

</comment><comment><USER31> I searched google for "hacker news similar sites" and ended up on "[http://www.reddit.com/r/programming/"](http://www.reddit.com/r/programming/")

</comment><comment><USER32> I rediscovered lobste.rs - which seems to be picking up a little since I last looked. Quite a few duplicates from HN but some alternative stuff too...

(Shameless, but I'm still looking for an invite if anyone's got one....)

</comment><comment><USER33> beside working, I spent time lurking on reddit, lobste.rs and /g/

</comment><comment><USER34> Reddit /Jailbreak :D

</comment><comment><USER35> Reading a book (the origin of species, to be precise).

</comment><comment><USER36> On the phone to my lawyer discussing whom to sue for emotional distress and whether the $Million figure should be in double or triple digits.

</comment><comment><USER37> I was hanging out at Reddit and [https://devcharm.com/](https://devcharm.com/).

</comment><comment><USER38> I was using techmeme to get the latest tech news. To be honest, my work breaks got a lot more boring.

</comment><comment><USER39> Saw it was down, tried the next day. I have too much work and family stuff to spend all day on HN.

</comment><comment><USER40> /g/ & StackExchange. Still waiting for my account to be accepted at lobste.rs

(˘、˘)

</comment><comment><USER41> re-reading nodeweekly, jsweekly and pycoders weekly. oh and statuscode

</comment><comment><USER42> Reading TechCrunch, BBC News, and flipping through Flipboard.

</comment><comment><USER43> I couldnt hang out anywhere, I wall polling HN with F5

</comment><comment><USER44> In the datacentre, troubleshooting.

I hardly noticed.

</comment><comment><USER45> Fark, mostly.

</comment><comment><USER46> Went back to Slashdot for a day.

</comment><comment><USER47> I actually got some work done...

</comment><comment><USER48> i was... working. such a shame.

</comment><comment><USER49> I spent time reading Medium.

</comment><comment><USER50> I did my work.

</comment><comment><USER51> twitter. lots and lots of twitter.

</comment><comment><USER52> Slashdot.org</comment>


Most men in the US and Europe could be infertile by 2060 - <AUTHOR> https://www.weforum.org/agenda/2017/08/most-men-in-the-us-and-europe-could-be-infertile-by-2060?utm_content=buffer2e258&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer <comment><USER2> If you take any trend in any direction and extrapolate it linearly, you will always wind up with an absurd number. I lost two pounds this week. At this rate I'll be dead in a year or two and weigh negative 50 pounds on the third.

<comment><USER3> I wish I could say I lost two pounds this week. I probably gained. I will be the size of the known universe eventually.

<comment><USER4> I assure that this is not your fate. Eventually you'd become so large that you collapse into a black hole, and then you'd slowly evaporate due to Hawking Radiation. Nature has a feedback mechanism for everything.

<comment><USER5> Provided that your density is low enough you don't necessary become a black hole by just gaining weight.

</comment></comment></comment></comment><comment><USER6> This is a load of crap.

>if the data on sperm counts is extrapolated to its logical conclusion, men will have little or no reproductive capacity from 2060 onwards.

No, that's not extrapolating to its logical conclusion. That's extrapolating a trend as if it will continue without changing. In reality, even at these lower levels, sperm counts are considered in the normal range.

</comment><comment><USER7> Taking a trend with an unknown cause and extrapolating seems unlikely to yield accurate predictions. The actual news here is that in USA and Europe, male sperm counts have fallen 50-60% between 1973 and 2011. That's alarming enough on its own without sensational headlines like this.

</comment><comment><USER8> "Even in adults, exposure to chemicals, such as bisphenol A, which are thought to affect fertility, can have a negative effect"

BPA is very common in paper receipts you get when buying stuff from the store. A study in JAMA showed that for people who handle receipts often, it is detectable in urine:

[http://www.newsweek.com/youre-absorbing-bpa-your-receipts- st...](http://www.newsweek.com/youre-absorbing-bpa-your-receipts-study- shows-230178)

</comment><comment><USER9> Sperm count is correlated with testosterone levels, and testosterone levels have also been dropping.

[http://thechart.blogs.cnn.com/2011/08/18/modern-life- rough-o...](http://thechart.blogs.cnn.com/2011/08/18/modern-life-rough-on-men)

</comment><comment><USER10> I never thought The Handmaid's Tale was a documentary about the actual, real future ahead of us...

</comment><comment><USER11> Is there justification to continue the extrapolation?

</comment><comment><USER12> > found no decline in sperm counts in men from Asia, Africa and South America > ... US/European men will have little or no reproductive capacity ...

Still, this is alarming that we don't know why this happens.

<comment><USER13> More low-level radiation access? (smartphones/computers/smartwatches)

More refined sugar?

Less physical activity?

I really wonder what it could be, though.

<comment><USER14> Computers and phones don't provide any radiation of the variety you are thinking of. It's not merely a matter of degree it's a difference in category.

For more info look up ionizing radiation.

<comment><USER15> Are you suggesting that microwave oven doesn't work because it doesn't use ionizing radiation? Nonionizing radiation CAN have effects on humans, and current regulations are only based on temperature effects i.e a proxy like a SAR value. But there can be many effects of nonionizing radiation even before it raises tissue temperature level.

<comment><USER16> I believe michaelmrose is suggesting that while microwaves are indeed a form of (electromagnetic) radiation, "low-level radiation" usually refers to low- levels of ionizing radiation, not low-power EM sources. While fwdslash might indeed be talking about low-level microwaves, there are many in my experience who think that "radiation" only means "ionizing radiation" or "atomic radiation". (Hence, "nuke it in the microwave".)

Again, in my experience, people who are aware of the distinction tend to write "More low-power microwaves" than "More low-level radiation".

For a semblance of hard numbers, "low-level radiation" gives 735 hits in PubMed Central ([https://www.ncbi.nlm.nih.gov/pmc/?term=%22low- level+radiatio...](https://www.ncbi.nlm.nih.gov/pmc/?term=%22low- level+radiation%22) ) and 338 in PubMed ([https://www.ncbi.nlm.nih.gov/pubmed/?term=%22low- level+radia...](https://www.ncbi.nlm.nih.gov/pubmed/?term=%22low- level+radiation%22) ).

'"low-level radiation" microwave" gives 32 ([https://www.ncbi.nlm.nih.gov/pmc/?term=%22low- level+radiatio...](https://www.ncbi.nlm.nih.gov/pmc/?term=%22low- level+radiation%22+microwave) ) and 2 ([https://www.ncbi.nlm.nih.gov/pubmed/?term=%22low- level+radia...](https://www.ncbi.nlm.nih.gov/pubmed/?term=%22low- level+radiation%22+microwave) ), respectively.

One of the latter is [https://www.ncbi.nlm.nih.gov/pubmed/17886009](https://www.ncbi.nlm.nih.gov/pubmed/17886009) where you can see "low-level radiation" _is_ used to describe microwaves: "On the radar station area, blue tits nested in high exposed nest-boxes (67,0%) and great tit occupied mainly these boxes, which were exposed to low-level radiation", where that radiation is "pulse-modulated microwave radiation of 1,200-3,000 MHz."

It's just not common.

The topic, by the way, concerns sperm counts. You write "there can be many effects". Is a change in sperm count one of them? Many people have done experiments on the effect of microwaves from mobile phones on organisms. I was at a biology conference about 25 years ago where one of the speakers talked about their research, so surely this has been tested already.

Also, radio and TV techs have been working with high-power EM for decades. There's so much power in the air around some towers that florescent tubes can glow. If low-power microwaves have an effect on fertility then we should have seen an effect on those workers long ago, yes?

<comment><USER15> Not necessarily, what if it is long term effect? What if it is some kind of resonance involved, i.e. it only shows it face when there is certain geometry and frequency present? Plus there were some courts rulings about phones causing cancer ... [1]

[1] [https://www.theguardian.com/technology/2017/apr/21/italian-c...](https://www.theguardian.com/technology/2017/apr/21/italian- court-rules-mobile-phone-use-caused-brain-tumour)

<comment><USER16> Courts never make mistakes in science?

As I kid I visited a broadcast transmitter up on the mountains with its own hydropower generator. There was staff on-site who had worked there for years. How long do you think is needed to compare working 8 hours a day at a 500kW radio transmitter broadcasting all the time vs. holding a smartphone or using wifi with only a few hundred milliwatts? (mW values at [https://en.wikipedia.org/wiki/DBm](https://en.wikipedia.org/wiki/DBm) .) Again, there's enough RF power from the transmitter to make a florescent bulb glow.

The biophysics would pretty incredible, even unbelievable, for a certain geometry and frequency to make a difference. Microwaves are a few centimeters long, and longer than sperm or even the testes. What mechanism could make them so specific to frequency?

But putting that aside, different countries use different frequencies ([https://en.wikipedia.org/wiki/Cellular_frequencies](https://en.wikipedia.org/wiki/Cellular_frequencies) says "Many GSM phones support three bands (900/1,800/1,900 MHz or 850/1,800/1,900 MHz) or four bands (850/900/1,800/1,900 MHz), and are usually referred to as tri-band and quad-band phones, or world phones; with such a phone one can travel internationally and use the same handset.")

If there were a significant problem with one specific frequency then it would appear in an epidemiology comparison.

Fundamentally though, your line of questioning can have no end. What if it only affects people with one of about 30 point mutations? What if it's only for those who have a diet with an excess of selenium? What if it's only at a certain power level? What if ... what if .. what if?

Each of these is hard to test, and given the difficulty of the biophysics it's hard to justify spending a lot of money when other options, including "More refined sugar?" and "Less physical activity?", seem more likely.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Just like the movie Children of Men

[https://en.wikipedia.org/wiki/Children_of_Men](https://en.wikipedia.org/wiki/Children_of_Men)

</comment><comment><USER18> Glysophate causes sperm count drop and cancer

[http://news.harvard.edu/gazette/story/2015/03/pesticides- res...](http://news.harvard.edu/gazette/story/2015/03/pesticides-result-in- lower-sperm-counts/)

<comment><USER12> Might help to wash veggies with Natron (baking soda) before eating to remove at least the pesticides on the surface of the food? [https://happyherbivore.com/2012/12/how-to-wash-veggies- bakin...](https://happyherbivore.com/2012/12/how-to-wash-veggies-baking-soda- vinegar/)

</comment></comment><comment><USER19> If it is indeed due to our increasingly toxic environment, then we should perform studies based on different diets and the types of foods each group consumes. My hypothesis is that our food sources are huge culprits here.

</comment><comment><USER20> Quite a mix of propaganda & fear on that website. It's a trend I'm noticing more and more lately.

<comment><USER21> If the trends continue, the fear propagated by website will be so absolute everyone will kill themselves immediately.</comment></comment>


BeeWare project: A request for your help - <AUTHOR> http://pybee.org/news/buzz/a-request-for-your-help/ <comment><USER2> Although I haven't used any of them yet, the various beeware projects have always been interesting to me. I've especially been watching Batavia [1] because I think it could be a very interesting way to ship form/page validation code written in python to web clients. Lots of projects have tried this in the past but I think the approach it is taking is interesting in that the resulting code is relatively small (compared to other approaches) to serve.

[http://pybee.org/project/projects/bridges/batavia/](http://pybee.org/project/projects/bridges/batavia/)</comment>


Building An Alternative DVR - <AUTHOR> http://npjh.com/building-an-alternative-dvr.html

<comment><USER2> Cool project, looks like it's more geared towards remote sync and could be used for more than a DVR.

Just curious, why doesn't inotify work? (Because the directory is SSHFS- mounted, right?) Been experimenting with inotify lately which is why I ask.

<comment><AUTHOR> Yes. I was surprised I couldn't find any network file systems that could notify the client of changes.

</comment></comment><comment><USER3> I just run Plex Media Server and set it up to rescan whenever it detects changes to the folder. Then I can use any of their clients to stream the content on my network.

Mine is on the Mac but they do have a beta client for linux.

</comment><comment><AUTHOR> Nothing revolutionary, it was fun learning Go and scratching an itch.</comment>


Show HN: Run sweepstakes on Twitter with TweetStakes - <AUTHOR>

A friend of mine and I were talking a while back and we realized that it would be cool to run some sweepstakes on Twitter.
We put up a sign up page for a while to collect some emails and we got 200 sign ups.
Once we received some sign ups we got together about 2 weekends ago and we put together a web application that lets people create sweepstakes on Twitter by counting the mentions and picking winners etc.
I want to get your opinion on the site before we let those 200 people know that we are ready for beta. I would very much appreciate your feedback. Thanks in advance.
The url is: http://www.tweetstak.es <comment><USER2> Very nice! I been waiting for a steady service like this!!</comment>


Immortal cells of Henrietta Lacks - <AUTHOR> http://en.wikipedia.org/wiki/HeLa

<comment><USER2> Adam Curtis made a great documentary about Henrietta Lacks 10 years ago called "The Way of All Flesh."

I definitely recommend it: <http://video.google.com/videoplay?docid=8448974573505946013>

<comment><USER3> Just finished watching it. The story is truly fascinating. I started off thinking "we have been lucky to find a case like hers". Then I realized that if her cells could practically survive anything, the odds of us finding it are not as bad as they seem.

</comment></comment><comment><USER4> It is worth noting the real damage that cells such as these have caused in labs all over the world. Given the way they have contaminated lab testing materials, and the they have thrown off results, one has to realize that hardy cells are capable of undermining large categories of tests. Hela cells are now well documented, but how many other such cases are there?

</comment><comment><USER5> <http://www.qwantz.com/index.php?comic=677>

</comment><comment><USER6> Has anyone ever written a science fiction story based on this?

<comment><USER7> I don't know about a sci-fi story, but the non-fiction book, "The Immortal Life of Henrietta Lacks" by Rebecca Skloot is friggin amazing.

</comment></comment><comment><AUTHOR> One of the most interesting (for me) facts is that the scientists put this organism into separate family, and in fact, the cells themselves behave more like amoeba, but genetically way different from them,</comment>


Google Trends: Pokemon More Relevant Than Trump, Clinton - <AUTHOR> http://blog.plot.ly/post/147939406977/google-trends-pokemon-more-relevant-than-trump <comment><USER2> Well, one's going to affect your life significantly for the next 4 years, while the others are just politicians

/s

Despite the catchy headline, I think more interesting is their 8th graph showing searches for 'gun control' being a lot more frequent in per-capita higher gun ownership states like Wyoming, Idaho, and Montana, and their 10th graph showing searches for 'Brexit' being much, much more prevalent in states that have a large number of jobs in finance like New York, Connecticut, and Illinois. Those graphs actually offer meaningful insight.</comment>


American Identity and the Threats of Tomorrow - <AUTHOR> http://www.stratfor.com/analysis/20110825-geopolitics-united-states-part-2-american-identity-threats-tomorrow

<comment><USER2> This looks like Spam, or otherwise an attempt to get you to enter your email in exchange for a report from Stratfor.</comment>


Taiwan laptop maker warns of China labor shortages - <AUTHOR> http://www.mercurynews.com/news/ci_14426506

<comment><USER2> Worth noting that these labour shortages are localised to the coastal areas. There are no shortages when you consider all the people in interior regions (according to the article, anyway).</comment>


Raise the Titanic? It's Rapidly Dissolving - <AUTHOR> https://www.theguardian.com/uk-news/2019/aug/21/titanic-explorers-dive-reveals-shocking-state-of-wreck <comment><AUTHOR> > One expedition concluded that there would be nothing left of the ship by > 2030.</comment>


Anssi Vanjoki says using Android is like peeing in your pants for warmth - <AUTHOR> http://www.engadget.com/2010/09/21/ce-oh-no-he-didnt-anssi-vanjoki-says-using-android-is-like-pe/

<comment><USER2> And using a Nokia phone is like doing nothing at all for warmth?

Where does he really expect that comment to go? Android (and iPhone) have a TON of apps out there. Until I bought my Android, I didn't even realize Nokia -made- 'smart phones'. I thought they were all just phones that could run some really crappy apps. (I even owned a couple... And hated them.)

Nokia's going to have to do more than trash talk if they want in the smartphone market.

</comment><comment><USER3> This smells of desperation more than pee.</comment>


HTTPS in the real world - <AUTHOR> https://robertheaton.com/2018/11/28/https-in-the-real-world/ <comment><USER3> Maybe a stupid question, but what's the difference between OCSP Stapling and just rotating your TLS certificate more often?

It feels like at the end of the day, my server is essentially asking some authority to sign something that says "yes you are you for the next 24 hours".

I coukd keep the same keypair unless I want to "revoke it". It also doesn't seem more expensive because the authority, in both cases, is just signing something?

<comment><USER4> I guess that issuing new certificate requires some logging, for example certificate transparency log, also it requires domain verification, while stapling does not require anything, so it's a more lightweight operation.

<comment><USER5> Why can't the certificate issuer log a certificate, marking it as renewable for 6 months (or whatever), and not log the renews?

That would require changing the Google's standard, but it's a ridiculous small change.

<comment><USER4> Technically I don't see any difference. Whether you're signing a timestamp or certificate, it's the same.

<comment><USER5> Issuers are expected to log every certificate in a public block-chain (most don't). And clients are expected to consult that block-chain and report certificates that are not there (to whom?).

That creates a difference between issuing a certificate or just attesting it was not revoked.

</comment></comment></comment></comment></comment><comment><USER6> Technical communities like this have to accept their role in perpetuating false narratives and a naive perspective of the world where everyone acts in good faith.

Like the exploding complexity in browsers touched on recently that makes it now impossible for small teams to develop in effect rewarding billion dollar companies and guaranteeing centralization and vested interests. Once done these are nearly impossible to reverse making it all the more important for the scrutiny to happen while it is happening.

Similarly there is something completely disingenuous and false about those who have been pushing ssl on the pretext of 'concern' end user privacy and surveillance when the response by the tech community both in comment and action to Snowden and Assange's revelations and invasive surveillance by Google, Facebook and others remains embarrassing if not non existent and in case of the latter even supportive, again promoting centralization and a few interests.

<comment><USER7> Thank you, although I fear you may get downvoted to oblivion for your tone.

Something that people need to consider is that the tech folks behind things like CT and cert pinning (many of whom I know personally) have true technical motives, but their employer entertains them because it protects against ad injection.

We haven't seen robust development of alternatives like DNSSEC not because they are worse, but because it isn't in the commercial interest of the powers- that-be.

<comment><USER8> We haven't seen robust development of DNSSEC because it is worse.

</comment></comment></comment><comment><USER9> Hmm, went into this article skeptical, but came out agreeing with it more than I expected. Makes some excellent points, and highlights some real challenges of the ecosystem.

But actually, I'm optimistic about Web security in general. Especially with regards to HTTPS, things have improved a lot, and looks like they will continue to get better! We really have come a long way in a few years to baking privacy into the Internet. In general, nowadays attackers will have to be well-funded, have a lot of time on their hands, and/or focus on specific targets to break this encryption. (Aside from the usual side-channels, 0-days, etc., which exist, but which is also a different problem.)

1\. Private keys staying private: there was a catastrophic flaw in web servers a few years ago called Heartbleed that handed out the private keys like candy. These flaws are rare, and modern web servers written in memory-safe languages are much more immune to such vulnerabilities ( _cough_ Caddy). Of course, securing one's system to prevent break-ins is paramount.

2\. Revocation: It's still mostly broken, because it's generally not enforced, and when it is, that can take days. Recent research that I believe has yet to be published proposes a way to scale CRLs at the regional or organizational level with 99.99+% cache hit rate. Fun fact: with Let's Encrypt, you can revoke anyone's certificate... if you have their private key. Another fun fact: revocation is really, really, really not awesome when it's used as a censorship weapon.

3\. OCSP: Again, I agree with the article here. Vanilla OCSP is not awesome. OCSP stapling, however, is actually pretty awesome! But only if done right. Unfortunately, only one web server does it "right" out-of-the-box ( _cough_ Caddy). OCSP stapling is broken enough in most mainstream web servers that I would generally advice against using them with Must-Staple certificates. More details: [https://gist.github.com/sleevi/5efe9ef98961ecfb4da8#gistcomm...](https://gist.github.com/sleevi/5efe9ef98961ecfb4da8#gistcomment-2336055) and [https://caddyserver.com/blog/certificate-management- policies](https://caddyserver.com/blog/certificate-management-policies) \-- basically, OCSP stapling is great when web servers implement it robustly and conservatively, and when it doesn't require any configuration. Highly recommended in that case.

4\. Key rotation: Again, I know of only one web server that does this by default and automatically ( _cough_ Caddy).

5\. Certificate transparency: As of now, there is not enough useful consumption of CT logs. We have TBs of data but no one to read them. So, we're close to integrating a CT monitor into Caddy so that your web server can report if it finds a certificate issued for a name it is serving that it did not request: [https://github.com/mholt/caddy/pull/2274](https://github.com/mholt/caddy/pull/2274) (And even if a misissuance is identified, what is one to do about it?)

I want to emphasize that just because PKI is not a totally solved problem does not mean that every site should not be using HTTPS. Surely this will be controversial (even though, in my mind, it is not a question), but I'm going to sleep for the night so I won't be able to answer right now. (And I'll pre- empt the argument that HTTPS, or at least DV certs, are bad because it makes phishing sites look safe: that's not why PKI was invented. I'll go out on a limb and suggest that even phishing sites deserve HTTPS... not because of the merits of the site, but for the sake of the poor victim.)

(Note: I am the author of the Caddy web server.)

<comment><USER10> For 2. note that Let's Encrypt just automates a facility every CA provides (is required to provide). A compliant CA is required to have a means by which you can point out that a private key is revealed and they'll revoke certificates for the corresponding public key. It's just that for Let's Encrypt this is automated the same way as everything else.

You SHOULD NOT post private keys, if you find a key that you think shouldn't have been shown to you, you can prove you have it without posting it anywhere. That's what Let's Encrypt does in the revoke-with-key modality. A poor man's way to do this with tools a typical Linux system has is to construct a CSR using that private key, but requesting a Subject that makes it obvious this is a bogus request, e.g. CN="mholt should not have this private key" instead of any real subject. Bad guys don't learn the private key by seeing this CSR, but everyone (who understands cryptography) learns that you must have the private key or moral equivalent.

The requirement to revoke if a private key is revealed is why that craziness with the reseller happened earlier this year where they'd been keeping all their customer keys in escrow (if you allowed them to generate the key - <USER2> do this) and they said "Oh, these keys are leaked" and sent all the keys to the Certificate Authority. The CA went "Oh, these really are the private keys, huh" and revoked all the affected certificates. The Baseline Requirements don't have an option for "But, but, my reseller is an idiot, pretend you haven't seen the keys". So, don't trust your idiot reseller with your keys and then they can't do that to you.

<comment><USER11> One note regarding revocations.

Recently a bank in Brazil got leaked the private key for its main domain (and internet banking frontend). The leaker tried to ransom the bank but wasn't happy, so he went to the press with a detailed report of what he got, and included a message signed with the bank's key as a proof. The bank denied everything.

But the more interesting thing was that, when confronted about the key, they said it was indeed legit, but their site was already using a new certificate for a while, so everything is ok. And part of the press bought it, including sites targeted to technical audiences. That's how much a lot of people in real world don't know exactly how PKI works.

It took a few weeks until the leaked cert was finally revoked. And now I wonder if it was really the bank who did it.</comment></comment></comment>


The cost of selling Galaxies | asymco - <AUTHOR> http://www.asymco.com/2012/11/29/the-cost-of-selling-galaxies/ <comment><USER2> Summing up the last graph, Samsung will likely spend roughly $16B in promotions, marketing, and other payola in 2012.

Then again, Samsung is roughly 20% of South Korea's GDP:

[http://www.theverge.com/2012/11/30/3709688/samsung-25-years-...](http://www.theverge.com/2012/11/30/3709688/samsung-25-years- lee-kun-hee)</comment>


Ask HN: Other CA with API, similar to Lets Encrypt? - <AUTHOR> Hi, We started to use Lets Encrypt for automatic certificate generation. Unfortunately we start to get close to rate limits [1], so we requested an increase. Apparently our use case isn't eligible for increased limits, as it wasn't approved (no response, so not declined either). So we started to look for an alternative.
Do you know other CA that provide API for certificate requests? It can be paid. The API doesn't need to be compatible with Lets Encrypt, but it would be nice.
Thank you!
1. https://letsencrypt.org/docs/rate-limits/ <comment><USER2> ACME ([https://en.wikipedia.org/wiki/Automated_Certificate_Manageme...](https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment)) is still new, I don't believe any other certified CA implements it.

What is your use case? Maybe there's a better way.

<comment><AUTHOR> Well, ACME would be perfect, but actually any fully automated process would do.

We provide an on-prem software available via browser. And well, we want to be very nice for our customers, so upon installation we also setup a subdomain in a domain that we control and request a certificate for that. At the end of installation we provide user with HTTPS URL where the service is available and with a valid certificate :-) Of course they can later opt-out, use their domain or certificate, but we make it work without security warnings from the first moment.

<comment><USER2> Do you have to control the domain? That's the main source of your rate limiting issues.

If you can use different domains for different customers, then you can scale that better.

Look into Caddy for automatic ACME integration: [https://caddyserver.com/](https://caddyserver.com/) \- This + DNS or HTTP challenge, it sounds like this might work for you.

<comment><AUTHOR> Thanks for hints. The Caddy server looks nice.

The default and simplest scenarios is that our domain is used, so that the user is not forced to setup DNS, but they can if they wish. But of course having a set of domains is an option. The problem with that is, that there is still a limited set of domains that we could use and still easily matches with the product.

</comment></comment></comment></comment><comment><USER3> Can I suggest that perhaps you could just start using alternative domains to avoid the rate limit?

Edit: also, how long since you requested the increase? They say it takes a few weeks.

<comment><AUTHOR> It is about 1.5 month now.

Yes, using different domains is a potential option too, but the domain is directly connected with the product, so want to consider other options too.</comment></comment>