Marissa Mayer says the secret of success is working 130 hours a week - <AUTHOR> http://www.cnet.com/news/marissa-mayer-says-the-secret-of-success-is-working-130-hours-a-week/ <comment><USER2> 130 hrs requires you only get 5.4 hours of sleep a night, never eat, and never sleep. And that is assuming you don't take breaks on weekends.

Assuming a 5 day work week that means you are only getting 2 hours of sleep a night.

tl;dr Title should read "Marissa Mayer is full of shit and/or expects everyone else to live up to expectations she cannot meet herself"

<comment><USER3> I went through a six-month period where I was working 80-120 hrs/week. All I did was eat quickly and sleep when not working.

This did permanent damage to my metabolism. Towards the end, my body temp was dropping close to 95 deg while sleeping, and a few times I had trouble waking up. Should've gone to the hospital; any lower and your body probably can't warm up on it's own. Ever since that time my normal temp is one degree lower than it was before, and I've struggled with slow and steady weight gain.

The _project_ was a success, but I wouldn't say that I've had success as a result of that effort.

</comment></comment><comment><USER4> Yes, if her definition of success is destroying the value of a company, then she is very successful.

</comment><comment><USER5> > If success had a formula, everyone would follow it. If, indeed, work could > be defined in some specific manner, everyone would know what it was.

No, they wouldn't follow it if the model for success is working 130 hours a week.

Most people, including myself, would just give out. Even if I knew there was some vast fortune and a windfall success in a year or two, I couldn't hack that kind of work load.

<comment><USER6> Yes, you could.

She's not a cobblestone paver working under the Sun. Her job is being a boss and do the bullshitting that comes with it while earning a couple millions every month.

Are you telling me you couldn't handle it for 1 year?

<comment><USER7> I'm pretty sure I couldn't. If you literally work for 130 hours/week, you have less than 5.5 hours for hygiene, food, and sleep. So maybe 4 hours of sleep per day if you're really efficient at everything else and never leave the office. I couldn't get by on that for long.

Either Marissa Mayer doesn't sleep or she's grossly exaggerating.

I met a bunch of folks at Yahoo who had this same pretend-to-work-long-hours philosophy. If asked, they'd claim to work 10+ hours/day but actually showed up at noon and left at 7pm and rarely seemed to do anything from home. My interpretation was that long hours were expected and the easiest thing was to just pretend to be doing them.

</comment></comment></comment><comment><USER8> Perhaps the secret of success she has is convincing the people around and under her that THEY need to work 130 hours a week.

In my personal opinion the code I've seen written by someone who worked 130 hours the previous week is complete crap. Working that much never gives you a moment to clear your mind and see the forest of your problem through the trees.

</comment><comment><USER9> If you look at the history of Google [1], it's pretty clear that Larry and Sergey didn't work themselves into the ground. On the contrary, they did things like spending an entire day driving around Palo Alto taking pictures with a handheld camera.

The reason Google was successful was because of the creativity of the founders, which was nurtured by their playful attitude to work. Marissa Mayer seems to have completely the wrong idea about success, and Yahoo provides proof of it.

[1] [http://www.slate.com/blogs/business_insider/2014/04/25/googl...](http://www.slate.com/blogs/business_insider/2014/04/25/google_s_larry_page_the_co_founder_s_untold_story.html)

<comment><USER7> > _Marissa Mayer seems to have completely the wrong idea about success, and > Yahoo provides proof of it._

That's unfair. Yahoo was sinking long before Mayer, and numerous CEOs were unable to do anything useful to fix the situation. I'm not sure Steve Jobs could have saved Yahoo.

</comment></comment><comment><USER10> This pretty well mirror's PG's assessment of startups:

"Economically, you can think of a startup as a way to compress your whole working life into a few years. Instead of working at a low intensity for forty years, you work as hard as you possibly can for four. This pays especially well in technology, where you earn a premium for working fast." (1)

I've started or been a member of, I dunno, 7 or 8 startups at this point in a 20 year career.

The biggest success had the absolute worst work culture, longest hours, was the most detrimental to personal time, personal health etc.

The one with the brightest potential, best team, and best work/life balance was an utter failure.

(1) [http://paulgraham.com/wealth.html](http://paulgraham.com/wealth.html)

<comment><USER11> I've worked at a startup with poor work culture, long, long hours, and super detrimental to my time and personal health, and it crashed hard.

It gave me a lot of experience but I'm not sure the resulting poor health and burnout afterwards made it worth it.

Success is not guaranteed by working hard. At best, it increases your chances of success, and probably not by a whole lot.

</comment></comment><comment><USER12> Yeah cuz that worked out really well at Yahoo.

<comment><USER13> It worked out well for her, considering her personal networth from Google and Yahoo is probably over $500m now.

<comment><USER14> Did it really? That leaves barely 38 hours a week for vital things like: sleep, health, family time, friends, etc. You know, real life stuff™. She can't get those hours back, and given her "work ethic" seems happy to keep spending her deficit.

<comment><USER13> The thing about life is you get to define your own life's meaning. So I don't know if she's actually happy, but I do know that judging her life choices is a largely fruitless endeavour.

</comment></comment></comment></comment><comment><USER15> Counting working hours is a bit like using LoC to measure success. More helps but it definitely isn't a good KPI.

</comment><comment><USER16> Working 130 hours a week will not make you successful, but if you are successful, you probably worked 130 hours a week. People are praising the wrong thing.

<comment><USER17> Probably? As in you know that more than half the people whom would be reasonably considered successful worked 130 weeks for a non trivial portion of their careers? I'm calling bullshit. I'd need to see a study. My belief is that work hours is one of the most common things to lie about these days. It's the adult version of how much you can bench

<comment><USER18> Sounds like the CEO at my work. I was working 75+ hours a week, no breaks (got a warning for taking them), using my own equipment just to keep up with the increased demands on me. Not paid for anything over 40 hours, minimum wage was almost double what I was paid.

When I complained about it, I was told that I could do the work or quit, because the CEO goes to bed at 2am and gets up at 6am, works all his other hours, and it's my problem if I can't keep up with the workload.

(It's worth noting that, in the end, he got his way and drove me to resign. Years later, I found out that what he does is illegal, but of course you don't mess with millionaires if you ever want to work again. Still have a couple of tricks up my sleeve, though.)

<comment><USER17> Yup, once you take the job you are at a tremendous disadvantage. You can quit but then you need to find a new job. If you quit the CEO just works the remaining people harder until you are replaced

</comment></comment></comment></comment><comment><USER19> I worked 106 hours a week for 2 years (three jobs) due to a lot of personal factors. It got so tiring I fell asleep standing up at a urinal, head resting on the water trap. I don't believe it is possible to do 130 a week for any continuous stretch of time. If that's how you "succeed", count me out.

</comment><comment><USER20> That's 5h20 NOT working, 7 days a week... bs ?

<comment><USER21> 5 mins to hurl something down your throat, and hired help for everything else. Everything. Else.

Also stimulants. Lots of stimulants -- and blood transfusions.

<comment><USER22> What are the blood transfusions for?

<comment><USER6> Tiger blood.

</comment></comment></comment></comment><comment><USER23> Of course the real secret is to be lucky enough to be one of the first employees at a company that is eventually worth more than $500 billion.

</comment><comment><USER24> I doubt she worked 130 every week

<comment><USER25> I've done 110 - 120 for 6-8 months straight. Its doable. I ended up quitting that job in very large part, because I felt like I could fall into a trap where I never stopped doing that.

At that point, you've cut off so much of the rest of life, and you've started gaining such large monetary rewards (or else why do it?), that you can get caught in it, I think.

<comment><USER26> I can see this possible in a company where things are going well and you make a lot of money and your work is successful. I have worked at a startup where I pulled around 100 hours per week for 6 months and it ended with the company laying off almost everybody and all hard work being scrapped. Never again.</comment></comment></comment>


YC applications (an improvement suggestion) - <AUTHOR>

I was just thinking it'd be nice to still have access to these even after winners/losers have been decide, for our own purposes, or maybe early work for the next round.<p>Anyone else think this would be a good idea? <comment><USER2> when you're done filling them out, click file > print then click print to pdf. i've kept all the ones i've sent in since it's not that hard to just copy and paste even.

don't think yc holds on to the applications; might be a liability issue.</comment>


What's Up With The Beep Driver In Windows 7 - <AUTHOR> http://blogs.msdn.com/larryosterman/archive/2010/01/04/what-s-up-with-the-beep-driver-in-windows-7.aspx

<comment><USER2> It's not directly relevant to this article, but you can stop the beeping of a Thinkpad keyboard by disabling this driver.

See:

<http://forum.notebookreview.com/showthread.php?t=155201>

</comment><comment><USER3> Quite a fun an informative article. I've not plugged in a pc-speaker component into my builds the last 6 or so years, I'd gotten used to peace and quiet without shrill (and very loud) beeping coming from inside my box.

</comment><comment><USER4> Anyone who still thinks PCs are in any way elegant machines, please raise your hand.

</comment><comment><USER5> So I can't play with my PC Speaker anymore in x64 Windows?

FFFFFFFUUUUUUUUU-</comment>


The best jokes are offensive. - <AUTHOR>

Think of a good joke you know, take the first one that comes into your head.
Analyze it.
Is it completely neutral? Probably not.
What about word plays, they are not offensive eg.
'Why did the chicken cross the road? To get to the other side'
The chicken wanted to die and reach the 'other side' (ie. heaven) - but this is offensive to people considering suicide, you are calling them chickens!
Hell even chickens, if they could understand humans, would take offense because we use their name as the word for 'coward'.
Ok what about other word plays:
Knock knock Whos there? Orange Orange who? Orange you glad I didn't say banana?
However, that's not a very funny joke.
Tell it to a person who's enunciation of the word "aren't" is close to "orange" or a person who has bananaphobia (yea, they exist), and it gets a little better.
Puns in themselves are hard to laugh at, but once you attach a certain context, they can become really funny. Usually that context can be found offensive.
'Supercollider?' - Not funny
'Supercollider? I just met her!' - Funny, offensive
Is this funny: Arn-Old
How about now: http://thechive.files.wordpress.com/2012/06/funny-captions-0.jpg?w=500&h=595
The best jokes are offensive, stand up comedians are notorious for it. However because of the nature of their work, no one complains, everyone knows they don't truly believe what they are joking about.
Or do they.
Remember Michael Richards (aka Kramer from Seinfeld) before the whole Racist Tirade[1] if he made a simple black joke, people would laugh at it. Not anymore.
Carlin said it best[2], context matters, at the same time though, if there is no hint of offensive in the joke, it loses the taboo aspect which makes it funny.
Sitcoms; Miscommunication between actors leading to funny situations, achieved by implying one party was stupid or situational stereotyping (eg. Fonzie), it all ends up giving a sense of superiority (from the audience) which ultimately creates the 'funny'.
What does that say about human sense in general, are we creatures that only find happiness in the misfortune or degrading of others?
Also, is there a truly neutral joke which is actually funny?
[1] http://www.youtube.com/watch?v=6Pksx_IAHDE
[2] http://www.tmz.com/2006/11/20/kramers-racist-tirade-caught-on-tape <comment><USER2> fail youtube videos are the most fun!

</comment><comment><USER3> People trying to excuse racism and sexism by claiming "they're funny" are the real jokes.</comment>


You'll See Two Figures for GDP Decline: Big, and Huge - <AUTHOR> https://www.nytimes.com/2020/07/29/business/economy/us-gdp-report.html <comment><USER2> Newer article on the same subject: [https://news.ycombinator.com/item?id=23997362](https://news.ycombinator.com/item?id=23997362)</comment>


Bitcoin creator Satoshi Nakamoto would never have qualified for a license - <AUTHOR> https://www.eff.org/deeplinks/2015/08/license-kill-innovation-why-ab-1326-californias-bitcoin-license-bad-business <comment><USER2> Licensing isn't designed to spur innovation, is it?</comment>


Do we need defined hours of work any more? - <AUTHOR> http://gigaom.com/2011/09/02/do-we-need-defined-hours-of-work-any-more/

<comment><USER2> It depends on who "we" are, but for a working group of people, there is a big advantage in being at work at the same time, being able to talk to each other.</comment>


What it's like to be listed on Product Hunt, twice - <AUTHOR> http://www.peteroome.com/2014/07/22/what-happened-when-my-startup-was-listed-on-product-hunt.html

<comment><USER2> Page hit count is a vanity metric.

We were featured on PH and while it does indeed drive a lot of traffic, the quality of it is about the same as from StumbleUpon's paid discovery, i.e. near zero. They come, they see, they bounce. No conversion _at all_.

<comment><USER3> Agreed re: page views.

As Peter pointed out, it really depends on the product. Founders have reported as little as 0.5% conversion to as high as 40% conversion from page view to purchase via PH.

<comment><USER4> I agree 100%. The author spells out explicitly that you should consider if the users of Product Hunt are in your demographic. Seems pretty smart, it would be like advertising a fast food app in a fitness magazine and then being upset that the conversion rate was low.

I also look at things like PH, HN and Reddit as tests of my product. I had a post about a new feature make the front page of Hacker News, the product is a Swift programming resource and I had 8500 views within 5-10 hours. After that, the shark fin died out and I'm back to nearly where I started. That tells me that I haven't quite figured it out.

An interesting difference (just observing my own behavior) is that every new feature I release, I submit to HN. But, I am waiting until a certain point to submit something to PH. I think it is because of Product Hunt's focus on Product that makes we want to only show things that are more "ready for primetime" .

I might be fooling myself, but I feel that the probability of meeting people interested in joining my cause in one way or another on PH is much higher than on HN. Obviously, that's just what my brain has decided on its own, no data to back that up.

</comment></comment></comment><comment><USER5> what did you mean by "after clearing it with the Product Hunt crew." isn't the process just submitting your link?

</comment><comment><USER6> I'd not even heard of product hunt, is it a UK only thing?

<comment><USER7> Its basically one of those scene pumping deals. Its seems more common in the art and music world than tech as far as I can tell. Get together with a group of people trying to do similar things and then make it look like you are more popular than you are by acting in concert with each other. For example liking each others posts, promoting each others projects on social media and in person. Essentially you give each other a fake buzz to get new things off the ground, like a head start. Then others from the outside looking in think that you have created that buzz organically and come to check out what all the excitement is about.

<comment><USER8> hah, that is a super-negative interpretation of it. It is also a really one- sided view (only looking at it from the perspective of people who submit links). The bulk of their users will never submit anything, they just enjoy reading the posts, trying out the products and giving feedback. I'm not sure what you see as "fake" about the "buzz"? It isn't like they are bots. They are actual human beings who might even purchase the service or product.

Another view (a far more accurate view) is that it is a spin-off from Hacker News with a more focused topic. I quite enjoy the site, and I've never posted anything on it. Non-technical people and product focused people can find a lot of the stuff on HN outside of their interests where product hunt hits much closer to the bullseye, more consistently.

<comment><USER7> I'm not saying it to be negative. Its the standard way to get any type of endevour that needs a network effect(hype) to get off the ground. When starting a band its really hard to get people to come to your shows and listen to your music. But if you get together with a group of other like minded bands and start pumping each other up, it looks like you are already popular and attracts attention. Standard scene building stuff.

I just wanted to clarify that Product Hunt does not appear to be an organically created phenomenon, but a very engineered process that from the looks of things was very well executed.

I could also be completely wrong.

</comment></comment></comment></comment><comment><USER9> At this point in time Product Hunt is only really known to a very small community of people

<comment><USER10> Yes, and it's a very niche demographic. I think Pete made a great point about bearing in mind where the feedback is from.

</comment></comment><comment><USER11> Thanks for the information. I've been interested in going to the site with LinkPlug > [http://www.linkplugapp.com](http://www.linkplugapp.com)

<comment><USER12> Looks similar to [http://snip.ly/](http://snip.ly/).

<comment><USER11> It's very similar. Of course I believe we do some key things differently.</comment></comment></comment>


Ask News.YC: What MTA? - <AUTHOR>

I'm reading the exim4 documentation trying to figure out how to pipe to a script any mail with a recipient matching publish-* or draft-*.  This is on Debian stable.  Was it a mistake to switch with my OS's default MTA?  Would Postfix or netqmail keep this conceptually simple task simple? <comment><USER2> I'd suggest reading up on <http://en.wikipedia.org/wiki/Procmail> to start.

<comment><AUTHOR> AFAICT procmail only gets invoked when you have a valid recipient. How do I make addresses that match a regular expression be valid from the MTA's point of view? The script (procmail or not) would decide which ones to bounce.

<comment><USER2> For that you'll probably need to hack the sendmail.cf file. I suspect it's probably easiest if you can use the "plussed user" feature - [http://www.cs.ait.ac.th/~on/O/oreilly/tcpip/sendmail/ch24_04...](http://www.cs.ait.ac.th/~on/O/oreilly/tcpip/sendmail/ch24_04.htm#SML2-CH-24-SECT-4-3)

</comment></comment></comment><comment><USER3> QMail.</comment>


Stripe-CTF 3 Writeup - <AUTHOR> http://muehe.org/posts/stripe-ctf-3-writeup/ <comment><USER5> I got stuck on Level 3, partially because Scala is a little wacky (but I learned to appreciate it!) and partially because their specs were super terrible. They didn't mention it required substring matching or was case- sensitive until I'd been working on it for 2-3 days and then was out of time. Given the bad debug output (the head of a diff which often didn't show anything and didn't include what term the failure was for) it was really frustrating to make any progress.

And he's right about the servers and scoring; that, too, was frustrating. I'd pass a test case locally then push and have it fail because it was slower for no apparent reason. Overall, it was awesome up until Level 3. I wish I'd made it to 4 because that strikes me as an actual distributed systems problem rather than a minor tweak to an existing example like the others.

It wasn't a bad experience and the system they have to manage it all is cool. I just wish a little more care had gone into making that level a bit smoother.

<comment> brown9-2 To be fair though, there was an update to the level 3 README published on 1/25 which made some of the requirements (substring matching) a bit clearer.

<comment><USER5> Yup, but that was kind of after I didn't have a lot of time to devote to it unfortunately. They did clarify but only after I whined. ;)

</comment></comment></comment><comment><USER6> I got stuck on level3 over the weekend and then had to put it down due to life stuff. But it was still a ton of fun, and I learned a lot.

If anyone from Stripe is here, do you plan to post the original problem statements and repos for the problems anywhere public now that it's done? I'd love to get a look at level 4... :)

<comment><USER7> [https://github.com/ctfs/write-ups/tree/master/stripe- ctf3/le...](https://github.com/ctfs/write-ups/tree/master/stripe-ctf3/level4)

<comment><USER6> Ha, I missed that this existed. Thank you!

<comment><USER7> Well it was published about half an hour ago ;)

</comment></comment></comment></comment><comment><USER8> Great article, I am really eager to see the solutions in github. I guess there won't be many with c++ solutions.

I only found the challenge two days before the end. My goal with the challenge was not to get the best solution, but rather use it as an exercise to practice the different languages and finding intuitive solutions.

Level 0 as you wrote was really just a two line change.

Level 1 was fun, because I tried to work with the existing bash structure as far as possible and just replaced the hot loop with inline python (something new learned). I found it interesting that this way I could directly inject the variables into the python program without having to load them as env variables (see [1]).

In Level 2 I did too much work, I did not think simple enough. I assumed that the different test cases would differ a lot and that a static divider would not help. My assumption was that the histogram of requests per second across the different IPs would have a bimodal distribution[2], thus I used the excellent "fast-stats" library to get a histogram and ban clients based on that. The library even offers approximate histograms, so even if there would be thousands of requests it would still scale.

To solve Level 3 with the given code required to changes:

-(i) Partitioning the data across the three server. I only loaded a subset of the files based on the server id (which was conveniently already available in the search servers) and

-(ii) Loading the files in memory so that they don't have to be read from disk for every search term. This was enough to pass this level. The code was too long for the gist but I can put it on github if someone wants to take a look at it. No fancy index structure required. I just scanned The files linearly on each request.

Mastering Level 4 was not possible for me, I tried working with the go-raft library and got the integration with unix sockets working, but somehow the system got unstable after a while. Fixing this was really frustrating and in the end I gave up because I could not find the problem and time was running out.

I congratulate all ~200 persons which also passed this last level. This was much more difficult than the other ones!

[1] [https://gist.github.com/mkaufmann/8716922](https://gist.github.com/mkaufmann/8716922) [2] [http://en.wikipedia.org/wiki/Bimodal_distribution](http://en.wikipedia.org/wiki/Bimodal_distribution)

<comment><USER9> Mind posting your code for level3? I got that partitioning was the main trick but I am too unfamiliar with scala to reassemble the responses properly.

<comment> brown9-2 Here is how I merged the responses: [https://gist.github.com/mattnworb/8717911](https://gist.github.com/mattnworb/8717911)

<comment><USER10> Or a bit cleaner using lift-json: [https://gist.github.com/mwylde/8724700](https://gist.github.com/mwylde/8724700).

</comment></comment></comment></comment><comment><USER11> I really enjoyed the parts of CTF I was able to work on. I didn't have enough time to finish, but I got through the first two levels and the second flag ( gitcoin ) was actually really fun to implement. I got a gitcoin hasher up to 2M hashes/second on a single machine, but even with that I was no where near fast enough to get any coins when competing against the rest of the field.

I limited myself to doing everything using only "C++11". I had to pull in boost_regex since no one has the c++11 regex support, but I am really liking the new standard and looking forwards to what we can get with c++14

</comment><comment><USER12> I think this particular bit says it all. To get blazingly fast results...

> _I can say with great confidence that we all cheated._

But I disagree with the word used.

Pre-computing the hash-table and embedding that into the final binary to eliminate relatively expensive calculations when it matters? That's not cheating, that's effing _brilliant_.

Hard-core software engineering, that's what it is. There's also a saying that the only people who play fair are those who don't know how to cheat well enough.

Well done.

(edit: typos)

<comment><AUTHOR> Op here, just wanted to say thanks. Of course it is not cheating in the sense that I tricked the system to give me a better score than warranted but my solution only works for this ONE dictionary so.. maybe it is not cheating but using tighter assumptions than those which were provided by the original task description :-)

<comment><USER13> The problem description did say:

        # Our test cases will always use the same dictionary file (with SHA1
        # 6b898d7c48630be05b72b3ae07c5be6617f90d8e).

<comment><USER14> The cheat is that he used a separate process to build hash table for real time look up, which is different from reading the data from the file at run time.

</comment></comment></comment></comment><comment><USER15> After many hours I failed to complete Level 4. How frustrating! But what a great experience. I think Stripe did a great job at building a programming challenge. By going through the challenge I learned something new in each of the following: Python, Ruby, Scala, Go, Node/Javascript, Git, Hashes, DDOS, Consensus Algorithms, raft, transactional logs, Inverted Indexes, BitCoin, IRC Chat, and more. Thanks Stripe you made me a better programmer.

<comment><USER16> You're very welcome. Glad you enjoyed :).

</comment></comment><comment><USER17> I gave up on the last level, as I didn't have the time to commit. I'd say this CTF was too difficult/too much work for me. Last time with smaller challenges was more fun. The challenges were interesting in their respective subjects, but maybe they should have been a little bit more condensed in scope, particularly the last 2 levels. Although learning Scala and Go beforehand would have helped a bit.

</comment><comment><USER18> I went up to level 3 and then work/life took over. Here's my approach to the problems:

(1) Python. Used a set() for the dictionary. Got ~200 points. I was planning to go back and implement this in Go to see the difference in performance but never got around to do it.

(2) Python. I wrote a single-threaded miner which could do around 300K hashes/s. My miner calculated 1M hashes (~3s), then fetched origin, then continued until it got a hit. I stopped after the first Gitcoin.

(3) Node. My solution was very simple and pretty much like the OP's. I kept a map between IP and count and always let through IPs with count <= 4. If the count was > 4, then I let them through with 0.3 probability to keep the backends working.

(4) I spend most of my time on this problem, largely trying to keep the memory within the constraints. I started with Node and created a simple inverted index of all words to their positions. Since we needed substring search I had to loop through the keys of the index which was too slow. My next attempt was to index all substrings but that used too much memory. My third, and best, Node attempt was using a prefix tree to index all suffixes, effectively building a suffix tree. This was quite fast, got ~2200 on local tests but was still over the memory limits.

I then gave up on Node and moved to Python. I used Flask for the server and built two solutions. A simple inverted index and a prefix tree (using datrie) with all suffixes. To keep the memory footprint low, I stored file/line locations as bit-shifted longs. Amazingly, the simple index and the prefix tree performed the same (!), so I submitted the inverted index solution and got a passing score.

Thanks for a great week Stripe. I learned tons! Looking forward to the next one.

</comment><comment><USER19> I bailed out on level 3 after about 10 total hours into the contest, as I see was pretty common.

I really enjoyed level1. I ended up doing an ugly little modification to git itself to mess around with the last few bits of the commit until I got the desired number of prefixed zeros on the sha1: [http://pastebin.com/RwTjjtTU](http://pastebin.com/RwTjjtTU)

</comment><comment><USER20> Looks great! Nice scores.

I focused on getting the minimal passing solutions (e.g. Level 3, the distributed grep problem, only took ~5 LoC changes to pass, Level 4 was 162 LoC additions, 69 LoC deletions).

I wrote up my solutions at [http://tullo.ch/articles/stripe-ctf- golfing/](http://tullo.ch/articles/stripe-ctf-golfing/) if anyone was interested.

</comment><comment><USER21> I really liked CTF-3 but I'm astonished at the amount of time people are able to find for it. Just reading this write-up I kept wondering, "does this guy have a day job!?"

I got to level 3 but then figured I had already spent my entire weekend plus a day and had responsibilities like grocery shopping, going to work, laundry, etc.

</comment><comment><USER22> Scored in the top 10 on level0 using a Bloom filter in C. Once you had an optimal solution, getting on the leaderboard came down to luck. 90% of the runtime of my program was operating system overhead that also happened on `int main() {}`. Today I realized I could've compiled with -nostdlib or -nostartfiles and halved that overhead - lesson for the future. If your binary needs to run faster than 1.5ms, libc is the next thing to cut :)

I held the top leaderboard spot of level1 for a day or so (my hashrate varied between 1-5GH/s) but was pushed out in the last few hours by pushrax and the Stripe server load. Used an OpenCL + Go solution. Was a close race there by all.

[http://bochs.info/~aegis/rounds.tar.gz](http://bochs.info/~aegis/rounds.tar.gz) \- tarball of all the Gitcoin round repos if anyone wants to play with the data.

</comment><comment><USER16> Very fair feedback on moving the deadline. We'd debated doing it or not, and ended up moving it in the spirit of distributed systems education. A lot of people in the chat appreciated it, but that's obviously a selected segment.

So we know for next time, how strong are other people's feelings on this?

<comment><USER13> I'm glad you did (but I wouldn't have finished if you hadn't).

More people learning & having fun is better. IMO people only complain about the extended deadline because of its effect on the rankings.

The scoring system was an interesting addition over CTF2, but it also created these complaints and silliness like people submitting the same code repeatedly to get the best score possible.

It may have been better to only tell players what broad percentile group they're in. There would still be an incentive to write faster code, without the frustration of being edged out of position #20 because someone else's submission was (arbitrarily) scored a few points higher.

<comment><AUTHOR> I actually think there is a middle ground; just bump the deadline, allow people to still solve it and get a T-shirt but freeze the scores and everybody's happy.

Btw, I agree that the scoring needs to be consistent or less coarse grained (percentiles) so that people don't submit thousands of attempts to get the max out of their solution...

</comment></comment></comment><comment><USER23> Added a link to your write-up and solutions to the collection here: [https://github.com/ctfs/write-ups/tree/master/stripe- ctf3](https://github.com/ctfs/write-ups/tree/master/stripe-ctf3)

</comment><comment><USER24> I love his hash table solution to level0!

I would never have spent much time optimizing such a trivial challenge as level0, but after seeing the leaderboards with such ridiculous scores, curiosity got the best of me, and I had to figure out how people were achieving such speedups.

I used a precomputed bloom filter to get 2641 points on level0, because I couldn't think of another way to avoid doing the expensive processing of the dictionary ahead of time. That solution simply read in the filter from a file at run-time. I thought of embedding the data in the source code to avoid the file I/O, but instead moved on to work on some of the later levels.

<comment><AUTHOR> Op here. I have done a lot of work involving hash tables in main-memory database research and therefore really like applying those optimizations. You are right though that it might be overkill :-)

</comment></comment><comment><USER25> I read through this and was amazed by the OP's approach to the problems even though I could barely understand 10% of the reading. How do I learn to think and code like this? I honestly have no idea where to begin.

<comment><AUTHOR> Thank you. What you have to keep in mind is that I do databases research for a living so many of the problems involved in each challenge are very familiar to me. My suggestion to you is to get a stronger systems programming background, I figure that's what helped me the most.

</comment></comment><comment><USER26> I'm glad I participated in this challenge. It was fun to micro-optimize stuff, and I'm really happy to have been introduced to Go. The last level was a challenge, mostly due to Unix sockets and Goraft bugs and lack of documentation, but I enjoyed the language enough that I went back and redid level3 in Go, taking a top-30 score right at the buzzer. (Or where the buzzer would have been had they ended on time, which they should have.)

My family doesn't appreciate my long hours at the computer, and I haven't caught up on sleep yet, but I'll definitely do this again.

</comment><comment><USER27> One recommendation I'd make, is to reveal all problems at the very beginning.

I logged in, saw that the first problem was nothing to do with distributed computing. Also realised it would take me longer to submit the code than it had taken to work out the answer... then I quit and didn't look back.

It's a shame, because levels 2 & 4 possibly look quite interesting, I might have persevered if I'd known. Sadly, limited time on my hands means I dismissed it too quickly!

</comment><comment><USER28> I've blogged my extremely lazy solutions for the first 3 rounds. TL;DR is level0 used a hash table, level1 found an existing utility, level2 used a hash table. Grand total of about 15 lines of new code.

[http://www.codesuck.com/2014/01/stripe-ctf-minimalist- soluti...](http://www.codesuck.com/2014/01/stripe-ctf-minimalist-solution- edition.html)

</comment><comment><USER29> Nice article. I got stuck on level3 and perhaps got close to finishing it, but there were a few unforeseen things that came up. I'm glad I did what I could for this CTF, though. This is the first CTF I've done, and pretty much all the languages were new to me. Definitely a great experience!

</comment><comment><USER30> I've got mixed feelings this time.

Disclaimer out of the way: No sense of entitlement here, every time I see a challenge like this I expect to fail. I'm really, really happy that people (Stripe, here) offer their time and resources to entertain us.

I'm a proud owner of the CTF2 shirt.

This time I couldn't finish level4. My takeaway is: I invested too much time and shouldn't have done it. I guess I'll pass next time when a challenge w/ a deadline starts.

Level0 was a nice warm-up.

Level1 was immensely satisfying and interesting, but the pvp challenge was .. well.. dead. By the time real life let me join others were throwing GPU based miners at the problem and traffic was constantly heavy anyway. So amazing level, the arena type thing was imho not a good idea.

Level2: Here the problems began. Local tests and remote tests diverged, plus this level was pushing you to use node.js. Will come back to this later. The actual challenge was interesting, so my issues here were infrastructure and .. language

Level3: This was absurd. Again, the challenge sounded interesting. The sample solution you're supposed to fix came in Scala and you had some constraints (time/memory). I had a couple of (locally) working solutions that never made it remotely. After hours and hours I gave up and solved this challenge - <USER2> executing grep for each request. Yes, I called grep and parsed the output, didn't index a thing. That felt .. bad.

Level4: Didn't solve it. Utterly frustrating. The consensus (hah.. hah.. get it?) seemed to be that raft (goraft) would be the way to go, but I invested again hours (8? Probably a lot more) and didn't make it. Problems with the deployment were mentioned on the channel again and again, goraft has even open pull requests and recent tickets from the stripe guys, as far as I can tell. Dependencies were a mess. Someone built the reference solution to this level and found bugs in goraft (see Github, goraft issues)? I .. don't think this was a good idea. Plus, forcing unix-sockets into the game (where everything around it doesn't support those and hey - if you want to have a 'curl for unix sockets' you end up finding another go project that just didn't work for me) was really messy.

So, putting aside the fact that I wasn't smart enough to clear level4 (it was obviously possible!): The templates came in nodejs/Scala/go. I knew a little about nodejs, nothing about the other two. Ripping the provided framework out was kinda possible, but a pain in the ass to debug (you could run a script that installed stuff remotely - I tried solving level3 in Clojure and it was a miserable experience). So challenging tasks plus new languages, plus deadline, plus 'servers are overloaded and cannot answer': This was just way too much for me. I still tried to solve level4 until the server fell over again and the CTF was finally closed.

My take away: All the ideas, the problems, were cool and interesting. But I guess even the Stripe guys were surprised to see the load/spikes/outages - probably a consequence of the 'distributed'/'load handling' type of problems, versus the 'try to break in' challenges last time. It hooked me with the leaderboard, nice website, good problems. But it was an exercise in frustration for me (and Scala/Go are _really_ not for me..).

That aside: Thanks a lot, Stripe. I cannot even begin to imagine how much work you guys invested in the preparation and administration/maintenance. I do consider the extension fair - and didn't gain a thing from that (was already at l4 at that point).

<comment><USER31> > Ripping the provided framework out was kinda possible, but a pain in the ass > to debug

This is very different from my experience. They give you a build.sh script that does anything you want and a container with open access to the internet. Anything you print to stderr is shown to you. I didn't use the provided code for any of the challenges, and thought it was awesome that they didn't force you into a particular implementation. It's just a reference to help you get started.

And hackers staying up all night to write openCL gitcoin miners? That's just awesome. I don't know how you concluded that pvp "wasn't a good idea". I thought that challenge was just fantastic.

<comment><USER30> To clarify:

\- Ripping out the framework caused lots of issues for me. Maybe my choice was wrong? I actually (in spite of my complaints) used two 'interesting' languages for myself. I polished my ocaml for the miner and switched to Clojure for level3. The latter was hard, because the infrastructure was down a lot and you already had a hard time getting past 'Kicking of your trial' messages - <USER3> to fail because leiningen complains about the inability to verify ssl certs for example. Try to fix it (doesn't happen locally...), push, fail to kick of the execution of the build script.. Loop.

\- The miner: As I said, I loved the idea of that challenge. The problem was highly interesting. My problem with pvp was mostly "There's no way to compete". When I joined it felt already like installing a bitcoin miner on my home machine. openCL based miners? That's changing the field of course and the only way to participate at that point is to follow - and I'm running a laptop here with an integrated Intel chipset for everything else. That totally ignores the fact that I don't know a thing about openCL or CUDA and would've started from scratch (as w/ Scala, as w/ go).

I certainly understand the fascination, but .. how many people _could_ compete against each other? The implementation (gpu based) and the network (git pull was sooo slow, same for push) made this inaccessible. At least for me.

</comment></comment></comment><comment><USER32> I definitely learned a lot. I was able to pass all levels but unfortunately didn't have enough time to optimize them, even though I would have loved to. Thank you Stripe for putting this on! Looking forward to the next one!

</comment><comment><USER33> I really had a blast doing level 1. I wrote my first real C program and it was as blazingly fast as I hoped. After that level 2 was easy but like many others I got stuck in level 3.

</comment><comment><USER34> Anyone else seeing links to empty repos?

<comment><USER35> "Note: I'll add the source once submissions are off."

<comment><USER34> Didn't catch that, thank you.

</comment></comment></comment><comment> grey-area Here are my thoughts: I managed to scrape through level 4 so saw them all - this CTF was fun and educational. Level 4 in particular felt like a real education (for me at least), and a great way to learn. Unlike many others I was fond of level 0 because it brought up questions that even beginner programmers should address - how to organise your data so that you can search through it easily, which was in some ways a preparation for the other levels. For the more expert than me it probably felt tedious or inconsequential, but it was quick to solve, and I thought inviting for beginners and open ended.

 _Lessons learned for me_

Distributed consensus was really interesting; I'd never heard of it and enjoyed reading about Paxos and Raft, even if I don't fully understand them yet. Distributed searches can actually be faster than searches in one process - I didn't believe this but as resources were limited on the server it was true in some cases (depends how fast you can make your search, mine wasn't as fast as Henrik's :).

Big scala projects take an aaage to compile - is it normally this bad in real projects? Anyone care to comment? The remote was pretty slow, so that might be why.

Golang needs package versioning! On level 4 there was a versioning bug with differing versions of the go-raft library being fetched locally and on the server which led to problems setting the heartbeat timeout of raft. That was confusing and annoying.

 _A few notes for the CTF authors_

The dramatic variation between resources on remote and locally was a problem in tests - I felt like that needed to be adjusted for as the local test results were meaningless compared to the server. This particularly made level 3 and 4 difficult.

Code examples are great to get you started, but it'd be nice if there was also a clearly specified API for each one which you were required to conform to, to make it easier to use another language, and if the build scripts simply launched one binary at all times - level 3 had two different styles of starting the servers for remote and local for example, that was frustrating.

The varying test cases were sometimes frustrating, and were too varied and randomly chosen. I completely agree with Henrik that you need small tests. Each run should have say 5 tests which can be run individually (for speed), or as a suite. The downloading of tests broke a few times for me and left me stranded and constantly re-downloading new test data/tests seemed a bit pointless. Proper logging output when tests fail is really important - <USER4> was particularly bad for this as the diffs were useless; I had to edit the test harness to get decent output.

The use of the JVM on level 3 was pretty painful for me - compile times on remote were in the minutes, and I couldn't even get it to compile locally even after installing another JVM, nor on remote without compiling all the sbt stuff - this one was probably my fault, and I just rewrote with golang in the end. Explicit language independence for all the problems would be great.

Unix sockets felt like an unnecessary distraction which caused pain on level 4, it would have been nice if it used IPs, but perhaps for reasons to do with Octopus that wasn't possible, and on a deeper level, being given broken code to fix just felt a bit wrong and distracting - having slow code you have to speed up is one thing, but having code which feels like it has been sabotaged is another.

Don't bother changing the deadline even if people whine - the contest isn't remotely fair anyway or an objective test, so it's better to have a deadline and stick to it.

Oh, and thanks again Stripe, it was a blast.

The original code and some more writups:

[https://github.com/ctfs/write-ups/tree/master/stripe- ctf3](https://github.com/ctfs/write-ups/tree/master/stripe-ctf3)

[http://blog.joneisen.me/post/75008410654](http://blog.joneisen.me/post/75008410654)

<comment><USER10> The reason the build times on level 3 were so bad was due to time spent downloading libraries. Stripe seems to have set things up to use a different ivy cache for each user, so every time you deployed code it had to redownload all of the dependencies. For me, this tended to take a couple of minutes. Actually compiling the Scala was pretty fast (< 10s for me).

So yes, Scala is generally slow to compile, but don't blame scalac for this one :).

Personally, I didn't quite manage to finish 4. I had a working solution locally, but didn't have the hours to debug why their remote environment differed so much from my local environment. My submissions also failed randomly about 4/5 times as the deadline got closer, presumably due to overload on their servers. And the unix domain sockets indeed felt unnecessary; I probably spent more than an hour just dealing with issues related to that.

The format (particularly on 3 and 4) of being given pretty broken code also sort of messed with my normal approach to code reading, which assumes that the code is more or less ok. This was particularly problematic for me on 4, since I had never before used Go and had a harder time figuring out what was wrong and what was just Go weirdness.

All around, though, I had a pretty fun time. Even if it did suck up way more time this week than I intended.

Note to Stripe: I would gladly pay $10 next time around if it could buy more/better ec2 instances.

<comment> grey-area _Stripe seems to have set things up to use a different ivy cache for each user, so every time you deployed code it had to redownload all of the dependencies._

Thank you. So normally you'd have the dependencies prebuilt, and it wouldn't take long at all to deploy? That sounds more sane. The build time for golang was < 1 second for comparison, and at first I couldn't get rid of the sbt build due to confusion over start_server/start_servers being used to launch, which was a bit annoying. I couldn't get their solution to build locally so I just gave up on Scala, which is a shame, perhaps I'll try again sometime.

l4 was pretty hard, even just integrating raft in the time available, I started adapting what they had, then switched to inserting raft - I was still left with some issues, and it was humbling and awesome to see people scoring so highly on it for me with things like in-memory dbs, but also great just to read about the problem space, which isn't one I'd normally touch at all. So an education even if you didn't pass, which was pretty chancy anyway in my experience.

 _Note to Stripe: I would gladly pay $10 next time around if it could buy more /better ec2 instances._

I wondered if that was part of the challenge, particularly on l3, it meant it was harder to solve with just one instance, but yes it did cause frustration, particularly because a working solution locally would then not work remotely and scores were all over the place, even for the same code, due to contention and the random tests loading remotely. It's probably really hard to set this stuff up, and I look forward to the infrastructure posts to see how they did it.</comment></comment></comment>


Yoda conditions - <AUTHOR> https://en.wikipedia.org/wiki/Yoda_conditions <comment><USER2> Not every language throws an exception if you forget to use a double-equals sign:

if (iCounter = 10) { ... }

In these cases you get an assignment and the value 10 is emitted, which in C, C++, JavaScript, and other languages is simplified in the if statement to "not 0" and, therefore, true. However, if you write:

if (10 = iCounter) { ... }

you get a compile error. In general, any practice which allows bugs to surface earlier than later will allow you to complete a project faster and yield a better result as well.</comment>


Ask HN: What is the most difficult part of your job? - <AUTHOR> Mine switches between the people and coding between different timezones, what's yours? <comment><USER2> People. Unfortunately, I have to say it is definitely people-but possibly less professionally of me I have to say specifically one person. Who, due to situations that had the outcome of our engineering organization no longer having a manager-has aggressively usurped a 'leadership' role-purely due to seniority-and has displayed a shocking unwillingness to entertain ideas that do not originate from him.

It hasn't been without it's own outcomes.

Like multiple engineers leaving and refusing to work with him any longer, and those who remain saying quite frankly in back channels how the feel about this individual.

More disastrously, though, his behavior has resulted in multiple client facing outage.

So yeah, people. Which is the shame because I love dearly everyone else I work with.

My resignation is already typed up.

</comment><comment><USER3> I'm also working in a distributed team and working from home and I fell fantastic about that.

Surprisingly the most difficult part of my job is to stop working at the end of the day. I'm so concentrated and into solving the problems that I need to setup an alarm to tell me I should stop working. I never felt so concentrated like this in ages.</comment>


Chaos Engineering: the history, principles, and practice - <AUTHOR> https://www.gremlin.com/community/tutorials/chaos-engineering-the-history-principles-and-practice/ <comment><USER2> awesome-chaos-engineering lists a bunch of chaos engineering resources and tools such as Gremlin: [https://github.com/dastergon/awesome-chaos- engineering](https://github.com/dastergon/awesome-chaos-engineering)</comment>


ShellHub enables teams to easily access any Linux device behind firewall and NAT - <AUTHOR> https://github.com/shellhub-io/shellhub <comment><USER2> This is interesting, but how does it work? By leveraging a STUN/TURN server? Can we connect on port 22?

Actually, there is this link in the subtitle (and in the readme, but only mentions "getting started", now "how does this work"): [https://shellhub- io.github.io/](https://shellhub-io.github.io/) this should probably be the story link.

So, short answer to my question (though I had to read [https://github.com/shellhub- io/shellhub/commit/fb0ebf10b1270...](https://github.com/shellhub- io/shellhub/commit/fb0ebf10b12700e56ab470634d3c150cd3f34036) to understand it, the website wasn't enough):

* You host a TURN-like server somewhere

* You locally host an ssh server (see the above commit: using docker)

* When you ssh to the local server, the TURN server is contacted, and performs the handshake; your local server proxies to the remote one on the right port

This is an interesting proof-of-concept, but:

* I wish people would deploy ipv6 without (or with minimal) firewalls instead

* As with all TURN, doesn't work with symmetrical NATs

* This is a bit overkill. If I could ssh into the TURN server and have it reply with the right ssh command, it would work as well (need to be quick)

Given the above, this could be built into ssh: specify a TURN server (or plain ssh host) to negociate a port and have the client & server perform the handover.

The way I do NAT traversal usually is to setup a reverse tunnel between the target sshd and another server (initiated by the target host), which I then proxy/jump on with `-p`. Obviously this uses some of the server's bandwidth, hence my proposed offer to add something like TURN negotiation on the server. The intermediate server doesn't even need to be aware of this, if you can execute arbitrary commands.

I wish more applications were compatible with something like this. The Internet really is broken if we have to jump trough these hoops to get any p2p going. There might be a way to do it in a way that's transparent to the application, but we might need a new TCP for this. I wonder if Yggdrasil or GNUnet offer to solve that kind of issues over the current TCP network (making a VPN of sorts between the computers, but not firewalled/NATed).

<comment><USER3> TURN is the solution for communicating around Symmetric NAT. STUN is used to determine the type of NAT a user has, which helps determines the connectivity method to use between endpoints. Connectivity can be direct to each other or must routed through a TURN server.

IPv6 still uses NAT and Firewalls, which is a pain, but it is a reliable method of defense.

Almost all Cellular Networks are on Symmetric NAT, so P2P games are always going to require a TURN server. However, almost all WiFi networks use Port Restricted NAT (a level below symmetric), or lower, which is still possible to make direct p2p connections.

(I am working on my own Networking/P2P library for Unity, which is a painful process.)

<comment><USER4> Does ipv6 use nat, though? Firewalls for certain, but nat? Have you got an example?

<comment><USER5> > Since at least Linux kernel version 3.9.0 and using ip6tables since 1.4.18 > also Network Address Translation (NAT) is usable.

[https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html](https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html)

</comment></comment></comment></comment><comment><USER6> For a number of years now — I think I got the idea from a HN comment — I've just been exposing ssh as a Tor hidden service. Really easy to set up, and I can donate a few kbps to the tor network.

</comment><comment><USER7> Is it just me or documentation is lacking? What is server, what is device? In both introduction and "getting started" it is mentioned that "The ShellHub SSH gateway is a modern SSH server built using the microservices design pattern" but does it really bring any information about what exactly am I doing by generating keys, creating users? How is it really an improvement over let's say VPN? Maybe a simple image/scheme would help to understand all the hierarchy and what exactly is happening where?

<comment><AUTHOR> > but does it really bring any information about what exactly am I doing by > generating keys, creating users?

The keys are used by ShellHub as "ssh host keys" that ensures you are connecting to the right server.

The users that are created by 'add-user' script are used to login in the Web UI running on port 80.

> How is it really an improvement over let's say VPN

The improvement is that you don't need to run your own VPN server and setup the client on every host :)

> Maybe a simple image/scheme would help to understand all the hierarchy and > what exactly is happening where?

I fully agree with you

<comment><AUTHOR> > Maybe a simple image/scheme would help to understand all the hierarchy and > what exactly is happening where?

Please see [https://shellhub-io.github.io/introduction/](https://shellhub- io.github.io/introduction/)

</comment></comment></comment><comment><USER8> A security critical daemon running in docker?

Given docker abysmal security track record?

</comment><comment><USER9> DigitalOcean doesn't charge for their floating ips, so it's a fairly economical way to traverse NAT. $5/month total assuming you keep the floating IP assigned. Fairly simple with wireguard and port forwarding via firewalld or iptables.

</comment><comment><USER10> Is this just another client that wraps SSH and provides a Web interface?...

Or am I missing something?

<comment><USER9> It seems to also include a gateway component you run on a public machine that brokers ssh access to machines behind nat.

So you could piece together your own with ssh tunnels, or a VPN, and a web terminal. I assume the appeal is that's done for you.

The docs are pretty light though, with a lot of typos. It doesn't inspire a lot of confidence that it's done in a secure way.

</comment></comment><comment><USER11> Not a bad idea, I have seen some simular but for the love of god why the docker dependancy ?

Any stripped down version ?

Let me rephrase that, I'd like to test this out, maybe even use it, but I don't want docker near my machine..

<comment><USER12> Why the hate for Docker? :-) As I wrote in another post, using a Docker in this case is a form of packaging, which is reasonable for a young project. Of course, ideally (and/or in the long-term), one would use something more specific, like distro-based packages or snaps/similar.

<comment><USER11> I don't have a hate for Docker, its really useful for certain things, but with a project like this I would preffer to run it myself without th docker scafolding and hand holding, I would like to go straight in here and play around.

It's just a preference I guess, but it's time consuming now to go and extract the docker fluff for me.

> which is reasonable for a young project

I would argue a more mature project would benefit more from stronger versioning management though.

</comment></comment></comment><comment><USER13> We need a way for software to declare its _runtime dependencies_. This product _must_ use some sort of running process on the public internet, and yet there's no mention of it in the readme!

<comment><USER12> Runtime dependencies are a matter of packaging. Does this differ from your requirement(s)?

In this case, packaging is in the form of a Docker image. It's definitely suboptimal, but for a young project, that's reasonable.

</comment></comment><comment><AUTHOR> Due to the amount of messages I've received about ShellHub I've created a channel on Gitter ([https://gitter.im/shellhub- io/community](https://gitter.im/shellhub-io/community))

</comment><comment><USER14> You could also use [https://ngrok.com/](https://ngrok.com/)

<comment><USER15> its worth noting this, as well as shellhub, cannot get around Bluecoats javascipt clickthrough transparent proxy, which imo would be a serious win.

</comment></comment><comment><USER16> Neat. This looks like a self hosted version of AWS SSM/Systems Manager + Session Manager Plugin</comment>


PSA: Don't Open Random PowerPoint Presentations from Strangers - <AUTHOR> http://techcrunch.com/2014/10/24/psa-dont-open-random-powerpoint-presentations-from-strangers-right-now/ <comment><USER2> More generally, "don't open files in random proprietary formats from strangers".

People are surprised and think it's strange when I request they send me files in .txt instead of .doc(x), .csv instead of .xls(x), .pdf instead of .ppt(x), reject HTML emails, etc. Some of these people are the same ones who manage to somehow get infected with tons of malware, even when they're running an AV.

The best alternative to a .ppt(x) is .pdf, and even that has had its share of exploits in the official implementation.

<comment><USER3> > More generally, "don't open files in random proprietary formats from > strangers".

Disclosure and licensing of the format doesn't actually prevent any of the security issues, so I'm not sure that "proprietary" is meaningful here.

"Don't use software whose security profile you aren't confident in to open files" might be a better rule -- but then you could drop the "to open files" part off without any loss of validity.

<comment><USER4> Remember when, years ago, there was an exploitable flaw in WinAmp's loading of .m3u playlists! That format is neither proprietary nor complicated.

The 1989 Morris Worm exploited the loading of a character string into a C buffer (by means of the gets function). The data format there is "line of text (which may only be yay long)".

I think the main point here is "don't forward me documents that can only be viewed with large, complicated, closed-source programs, if you did not write those documents". This is reasonable.

As consumers we basically trust these proprietary programs not to be malicious in and of themselves. Let's put it this way: if Microsoft wanted to do something bad to your Windows PC, they could do it in so many ways _not_ involving the loading of a specially crafted Office document.

We also trust documents created in these programs by people that we trust. If my friend created a PPT he wants me to view, it probably doesn't contain an exploitable hole. (Probably: because there could be some virus that spreads from malicious documents to good documents via exploit code running inside the document application.)

Taking random PPT's, DOC's and XLS's from some unknown sources on the Internet and circulating them to people in your address list: totally bad, unacceptable.

There is no reason that some circulating joke has to be a Word file! Even if the author thinks it requires colorful fonts: use HTML, damn it.

</comment></comment></comment><comment><USER5> >If you're on a build of Windows that has User Account Control as an option, enable it (it should be on by default, in most cases.) This won't fix the bug outright, but it'll throw up a big permissions prompt that'll remind you not to open mystery files.

Default UAC option in Windows 7 and later is "Notify me only when applications try to make changes to my computer". That option is problematic because of various ways to exploit built-in apps to bypass UAC. "Always notify" is slightly less convenient but much more secure option.

</comment><comment><USER6> It's a Microsoft Office OLE bug. If you're running OpenOffice or LibreOffice, you should be OK.

(The last Microsoft Office product I bought was Word 97. The free stuff has been good enough for years now.)

<comment><USER7> OpenOffice and LibreOffice aren't magically free of security holes.

[https://www.openoffice.org/security/bulletin.html](https://www.openoffice.org/security/bulletin.html)

<comment><USER8> Nobody never said they would be. However, their market share is notably smaller (and the operating systems they run on is vastly more diverse), and thus there's little sense in writing bulk malware targeting them. Targeted attacks definitely, though in that situation one would be screwed almost certainly anyway if the adversary is capable enough.

<comment><USER9> And pretty much most of these exploits are targeted attacks already.

</comment></comment></comment></comment><comment><USER10> I think, in general, it's prudent to not open any files from strangers unless you're expecting said files.

<comment><USER11> exactly. the lesson could even be "don't open * from anyone, especially strangers."

you can get code to execute in all sorts of presumably innocuous file types.

<comment><USER2> Plaintext is likely to be OK, however; that is, if you're using a "dumb and simple" true text editor and not one that tries to do fancy things like parse the text and perform syntax highlighting.

<comment><USER12> Would the UNIX utility `cat` fall into that category?

<comment><USER13> cat is probably safe. I would be concerned about the terminal you are running it in though.

<comment><USER14> `cat -A` works for terminal-safety

</comment></comment></comment></comment></comment></comment><comment><USER15> Unfortunately, opening and forwarding random PowerPoint presentations is all some of my relatives do on their computers.

<comment><USER2> This is even more problematic, as all it takes is for someone to be enticed into opening one which silently installs malware, and then they'll think it's "perfectly fine" and forward it to someone else who trusts them.

</comment></comment><comment><USER5> >4\. If you have Window's User Account Control feature enabled, it'll throw up a prompt asking if the file is okay to execute. If you aren't 100% sure that the file is legit, avoid doing so.

If opening PowerPoint file throws up UAC promt, that is so good evidence for that file to not be legit that your prior estimation for it to be legit realistically can not be close enough to 100% to override this evidence.

So, if opening PowerPoint file or other office document throws up UAC promt:

1\. Say No.

2\. Warn person who send you that file and other people who could receive it. If you created this file or if you opened it before and it did not throw UAC promt, that means that your system is probably infected and may be all your other documents are infected, warn other people about it.

3\. Send this file to VirusTotal.

4\. Run antimalware check on your machine with free tool from legitimate antivirus vendor (such as Dr.Web CureIt, Kaspersky Virus Removal Tool, Microsoft Windows Malicious Software Removal Tool). If VirusTotal said you that some vendors already detect that file as malicious, use tool from one of such vendors you trust more. Otherwise, prefer vendor which is not vendor of your currently installed antivirus, then wait until VirusTotal will detect malware in your file, and repeat this step.

<comment><USER16> I think I was a minority who loved UAC as it existed on Vista. I didn't mind the OS saying "hey, something is happening, pay attention."

<comment><USER17> You were a minority. 95% of users had no idea what they were being asked to confirm and just clicked OK to make the box go away.

</comment></comment></comment><comment><USER18> Important for anybody running powerpoint conversion servers to apply this patch (myself included, looking into it now).

[https://support.microsoft.com/kb/3010060](https://support.microsoft.com/kb/3010060)

</comment><comment><USER19> This is yet another argument for using HTML5 as much as possible instead of proprietary formats for public document interchange of formats fancier than plain text. Although you might have to give up some fancier features, you can get a near-equivalent of PowerPoint, Word, and Excel from HTML5 with a lot less risk and a lot more cross-platform availability for the people you send it to.

<comment><USER20> I give a lot of talks, and would move to HTML5 presentations in a second -- but the editing tools just aren't there yet. Sometimes I really just want to draw some shapes and show the relationships between them without having to go to a separate editor for that.

The best tool out there right now is [http://slid.es](http://slid.es) but it doesn't come close to letting you represent things visually.

<comment><USER21> There are tools that let you draw on the screen, no matter what other applications are running. At least there are such tools for Linux, but I'd guess there also would be one for Windows. Heck, I'd guess there is such a tool as a browser bockmarklet. If not, tell me and I write you one (would support Chrome and Firefox and maybe, just maybe, IE11 (canvas+pointer- events:none)).

</comment></comment></comment><comment><USER22> Embedding xls in ppt sounds like a good idea. At the moment, though, the only two use cases I can think of are: (1) Inadvertently generating Powerpoints that are far too large, or (2) Making it easier for attackers to take over your system.

<comment><USER23> OLE/COM allowed me to use some flash animations as part of a powerpoint about a decade ago... Also, being able to chart live graphs from excel isn't a bad thing. All of that said, I don't regularly use PowerPoint, and MS has at least been forthcoming with the issue (far better than in the past)

<comment><USER9> Interestingly, the use of Flash exploits eventually became common enough (it was used to hack RSA for example I think) that Adobe go out of the way to detect older versions of Office and throw up a warning message.

<comment><USER23> Yeah, I worked in a company that had a legitimate reason to be able to save state (the local file system) from flash before storage solutions inside of flash (around 4 to 6 iirc) a COM injection bug was used to access the filesystem... after I saw what could be done (COM injection), I promptly disabled flash on my own computers.

</comment></comment></comment></comment><comment><USER24> Would opening them in Google Drive sanitize them?

<comment><USER25> Their converter probably has its own share of vulnerabilities, but the most it could probably do is start executing JS.

<comment><USER21> But probably in the context of your Google account: can access and maybe manipulate all your Goole Drive files. Maybe access mails in your GMail account? Probably not (other domain).

</comment></comment></comment><comment><USER26> Random?

</comment><comment><USER27> Just wow.

</comment><comment><USER28> PSA: Don't use Microsoft products.

<comment><USER29> That's an unrealistic PSA at this point in time. Too many people are invested in Microsoft products to just walk away. Instead, a constructive and helpful PSA would be "Don't open attachments unless you both expect them and know who sent them, and even then, probably don't open them."

</comment></comment><comment><USER28> PSA: Don't use Microsoft products</comment>


Sketching a path for software for quantum computing - <AUTHOR> https://www.princeton.edu/news/2017/11/14/martonosi-sketches-path-new-type-computing <comment><USER2> I don't think we have any clue yet what the real use of quantum computers will be. They are so far out of what we can comprehend. Imagine Watson in the 1940's trying to predict the iPhone, i think this is where we are at with quantum computing.

</comment><comment><USER3> interesting.</comment>


The World's First Adult Entertainment Site Powered by Blockchain Technology - <AUTHOR> https://airporn.io/ <comment><AUTHOR> Hello everyone, Airporn Founders here. We're excited to help the adult entertainment industry with blockchain technology.

Let us know if you have any question, and we are happy to discuss with you!</comment>


FatBoy SoundFont - <AUTHOR> https://fatboy.site/ <comment><USER3> Love it!

I had to go back and listen to one of my favorite midi tracks - the Ultima online Buccaneer's Den theme.

Using this sound font there are some really major improvements. Not that the original instrumentation that shipped with machines of the day didn't have its charm.

I love the fact that we used to literally ship midi files around for game music - it's such a technically elegant approach and because it could be thought of as just 'musical markup' it was even trivial to add compositions to websites - when we had severe bandwidth limitations.

While there's no question that the addition of a mastering step and the ability to ship perfectly 'rasterized' music (to mix metaphors) has meant we have a perfect rendition of the composer's intent and is vital for a lot of musical expression, there was always something fun about the idea that music directors were practically composing symphonies to be played by individual orchestras on each user's machine.

<comment><USER4> > there was always something fun about the idea that music directors were > practically composing symphonies to be played by individual orchestras on > each user's machine

I like this way of looking at it. And with different sound fonts like the original vs the FatBoy sample posted on the site and ITT

[https://www.youtube.com/watch?v=veMlnxlgpZg](https://www.youtube.com/watch?v=veMlnxlgpZg)

[https://www.youtube.com/watch?v=b3uycgx8FiA](https://www.youtube.com/watch?v=b3uycgx8FiA)

it's kind of like we get to listen to new interpretations of the music, where the sheet music remains the same but the conductor has told the orchestra to perform it different in terms of instruments used. I think.

Someone who knows about orchestra music and performance correct me if you think what I said was off base. I don't know whether it is actually the role of the conductor to pick instruments. Wikipedia says:

> The primary duties of the conductor are to interpret the score in a way > which reflects the specific indications in that score, set the tempo, ensure > correct entries by ensemble members, and "shape" the phrasing where > appropriate.

[https://en.wikipedia.org/wiki/Conducting](https://en.wikipedia.org/wiki/Conducting)

So I don't know who actually picks the instruments that the orchestra will use.

<comment><USER5> A composer specifies which instruments play what, as a general rule.

We call it an 'arrangement' when a piece of music is reinterpreted with different instruments.

</comment></comment></comment><comment><USER6> Nice work! I am working to improve the MIDI playback quality on my MIDI archive website, BitMidi ([https://bitmidi.com](https://bitmidi.com)), and I think this might help.

The main difficulty with a web-based MIDI player like BitMidi is that it's not feasible to force the user to wait for a 300+ MB SoundFont to download before starting in-browser playback. The current format I use ("patch" files) has a separate file for each instrument, so I can lazily load only the necessary instruments needed to play a single song. You can see the approach I use here: [https://github.com/feross/timidity](https://github.com/feross/timidity)

Anyway, excellent work on this SoundFont!

<comment><USER7> Can't browsers just play midi files? I know we could in the 90s and 00s.

<comment><USER8> Not directly. This was usually done through a plug-in such as QuickTime.

<comment><USER9> ... QuickTime which itself can't play midi anymore.

</comment></comment></comment></comment><comment><USER10> Excellent work!

My only complaint would be the too low snare volume.

I almost stopped making any music after I switched to a laptop and lost daily access to an old SoundBlaster card which only supported some obscure sound font format. One of the fonts supplied with the driver CD was named "eapci8m.ecw" and had some of the best sounding instruments I ever heard - <USER2> all that squeezed into an 8MB file!

Regarding the snare: here's a piece I did for my friend's acting-school-entry- exam-dance-routine back in 2007:

With Fatboy:

[http://node.tade0.usermd.net/crook- fatboy.mp3](http://node.tade0.usermd.net/crook-fatboy.mp3)

Original(caution: much louder):

[http://node.tade0.usermd.net/crook.mp3](http://node.tade0.usermd.net/crook.mp3)

</comment><comment><USER11> Without commenting on the design, I just want to say that I appreciate how well the information on the home page is laid out.

You addressed all of my questions in order and in a compelling way. Very solid melding of marketing and education.

<comment><USER12> Maybe I missed something while reading the page but the whole time I my biggest question was what it actually sounds like. At the very bottom is a "hear demo" link, that leads to a Youtube channel with one song. But there isn't a link to the original version, so I can't compare how much it improved.

</comment></comment><comment> Birch-san Wonderful samples. None of the instruments are neglected; the standard is consistently high. And I'm happy to have clarity on the terms of use. So many (for example, Shan's Soundfont) have no stated license or provenance.

I'll be loading this into juicysfplugin[0] (my free, cross-platform soundfont synth) for a play.

[0] [https://github.com/Birch-san/juicysfplugin](https://github.com/Birch- san/juicysfplugin)

</comment><comment><AUTHOR> I realize it's somewhat ironic that I'm the one who posted the link but I myself am not a huge fan of the font itself. The site is cool, though. My main problem with the SoundFont is the same that many of them have: they, for some reason, mute the chirping sound in Duke3d's storm.mid. It totally changes the song and I just find myself getting frustrated when it's missing.

<comment><USER13> The changelog shows the font is still being tweaked based on real-life feedback:

[https://fatboy.site/changelog.html](https://fatboy.site/changelog.html)

And if you scroll down, there's an email address:

email@example.com

So you could try contacting the author about this issue

<comment><AUTHOR> Thanks. I've sent them a message and included the MIDI file.

</comment></comment></comment><comment><USER14> The soundtrack of Descent 1 was composed on a Roland SC-88 (or a sister model), which was the "gold standard" Midi hardware module of the era. (Its samples formed the basis of the wavetable synth shipped with Windows 95.) I rendered here the Descent 1 title theme using FatBoy via FluidSynth: [https://chris.pacejo.net/temp/descent/D1.ogg](https://chris.pacejo.net/temp/descent/D1.ogg)

It's good, but compare to a rendering from an actual SC-88: [https://www.youtube.com/watch?v=xqrvsy7AeGw](https://www.youtube.com/watch?v=xqrvsy7AeGw) (not my rendering, though I do own an SC-88)

There are definitely nuances missing; e.g. 40 s in, when there's just the bass vamp, the SC-88 rendering is far superior in my opinion. At 60 s in, the synth that enters is too loud in the FatBoy rendering.

It's possible – maybe even likely – that these differences are more due to FluidSynth not interpreting all controls and RPNs identically to the SC-88.

Same comparison, only for Descent 2: [https://chris.pacejo.net/temp/descent/D2-Title.ogg](https://chris.pacejo.net/temp/descent/D2-Title.ogg) (FatBoy/FluidSynth) vs. [https://www.youtube.com/watch?v=o9_uUCBCuUs](https://www.youtube.com/watch?v=o9_uUCBCuUs) (SC-55 II) I think the difference here is stark. Though clearly FluidSynth is partly to blame, as the beginning notes aren't even in tune with each other in that rendering.

<comment><USER13> > _controls and RPNs_

Out of curiosity: could you elaborate on what those are? My first guess would be it's something like font hinting but for MIDI

<comment><USER14> Sort of. They control things like volume, panning, reverb, pitch bend sensitivity, tuning, synthesizer parameters, etc. Most controls have a defined meaning, though some (named things like "General Purpose" and "Effect 1 Depth") do not, and control different things on different synthesizers. (For example, "Effect 1 Depth" is usually reverb, but not always.) But even those things with a defined meaning are "defined" in the loosest sense of the word. E.g. one synthesizer may implement "Modulation" as tremolo, while another may implement it as vibrato (two similar, but noticeably different, musical effects). So any MIDI recording which ventures even slightly outside of the most common and obvious controls or RPNs risks losing important nuances upon being played by a different synthesizer.

(The difference between controls and RPNs is that RPNs are – in theory – extensible, registered with a centralized authority, so that new ones may be developed. In practice, there are a small fixed number, fewer even than controls.)

Further there are NRPNs, which are like RPNs but are not registered with any authority. So these completely vary by manufacturer. The SC-88 has a bunch of these, things like "Vibrato Rate", which, if ignored by another synthesizer, sometimes make no difference, or sometimes are very noticeable, depending on the degree to which the composer is relying on that functionality.

Often the bigger difference which I neglected to mention is banks. There are 128 MIDI "patches" – sounds – but of course there are many more than 128 instruments in the world. So there is also a system of patch variations called "banks". Usually these variations are true variations (e.g. concert grand vs. baby grand piano), but sometimes they are completely different (Moog synthesizer vs. square wave). And like controls, they are variably ill-defined or not standardized, and thus not implemented identically on all synthesizers.

(The reason for this mess is because MIDI is really an evolved creature. The original MIDI standard specified very little, so General MIDI (GM) was born, which is what most people know as "MIDI", but that was insufficient, so manufacturers authored their own extensions: Roland created GS; Yamaha created XG; and of course they are incompatible with each other.)

<comment><USER13> That was very interesting and educational, thank you!

</comment></comment></comment></comment><comment><USER15> I remember my younger days. Games today depend on graphics card for quality, so you can brag to have better graphics with your friends if you have a better card.

In the old days, the card was important of course (it's more to whether it's software or hardware, essentially jagged vs "smooth" picture), but having a good MIDI sound card is like heaven and earth for the ear. I literally spent hours just justening to MIDI files downloaded from the internet when I got a Sound Blaster (forgot the model).

<comment><USER16> Me too. And of course the Sound Blaster was an _entry-level_ MIDI device; even while I was enjoying my SB card I was jealous of people who could afford a Roland MT-32!

</comment></comment><comment><USER17> Here's the Link to the sample:

[https://youtu.be/b3uycgx8FiA](https://youtu.be/b3uycgx8FiA)

Sounds pretty good!

<comment><USER18> Here's the original for comparison. It's quite an improvement!

[https://www.youtube.com/watch?v=veMlnxlgpZg](https://www.youtube.com/watch?v=veMlnxlgpZg)

<comment><USER19> Are you sure this was a Roland SC? This sounded pretty close to just plain old Adlib. Of course _any_ sound font would sound better than fm synth. What would be helpful is to have the track played on an MT32 or a Sound Canvas to do a proper comparison.

That's the thing about these old games: they were totally made for how the MT32 and later the Sound Canvas sounded to the point where they would even chose an instrument that would otherwise not be fitting, but which sounded good on the original device.

Unfortunately for me, all of this happened way before I had money on my own or could convince my parents to shell out the considerable sum these devices would have cost, so I really don't know how these games were intended to sound.

Which makes me really sad as a huge video game music fan/nerd.

<comment><USER20> [https://www.youtube.com/watch?v=_HjPqvCp_aQ](https://www.youtube.com/watch?v=_HjPqvCp_aQ) here is an actual mt32 recording, without voice over, that should make the comparison more clear

</comment></comment></comment></comment><comment><USER21> Make sure you get to the bottom of the page and hear the linked samples.

The "King's Quest V - Oasis Theme" was so immersive I couldn't help clicking on the static image to try and play it.

<comment><USER22> I recently replayed through KQ5 (and for the first time ever, finally completed it). The provided youtube recording of the oasis theme MIDI is way way WAAAAYYYY nicer quality than the original game. Is this deliberate? Is this what we're trying to showcase?

Side-note: It was really nice hearing the theme music when encountering the princess near the end of KQ5, as it was very clearly the progenitor of the "Girl in the Tower" song that was to be the main theme of KQ6, which is my favourite by a long way. It was an unexpected nostalgia hit, was quite well done and I'm glad they carried the tune between the games.

</comment></comment><comment><USER23> That's really cool to hear about. IMO you can't have enough SoundFonts... :-) Back when I used Reason a lot, I would load these into the sampler and see which sounds I liked better between the different collectoins. Spending more time in Linux these days, we are lucky to be able to open FOSS like LMMS(.io) and there's an SF2 Player instrument you can use for auditioning the various banks and patches within the SoundFont.

</comment><comment><USER24> Any chance someone with this already setup could share a sample of DOOM E1M1?? Man, I loved that song.

Thanks!

<comment><USER25> [https://clyp.it/zbkee0uy](https://clyp.it/zbkee0uy) (better quality)

<comment><USER24> thank you! sounds AWESOME!

</comment></comment></comment><comment><USER26> Fantastic.

Duke3D and Bermuda Syndrome nostalgia time.

I used to love listening to midis back in the day, I think the soundfonts that came with my Sound blaster vibra 128 were top notch at the time.

</comment><comment><USER8> For Timidity in Linux, though, I find myself relying on eawpats ( [https://www.doomworld.com/idgames/sounds/eawpats](https://www.doomworld.com/idgames/sounds/eawpats) ). It doesn't require that the simple Timidity support in things like SDL_mixer understand soundfonts, and I like the old GUS sound more.

</comment><comment><USER27> Well, this inspired me to install ScummVM, install this pack, and finally beat Kings Quest VII Chapter 1. It was the first game I ever had as a kid, and I never was able to get past one of the puzzles. The audio sounds great!

</comment><comment><USER28> This was very eye-opening, not being very familiar with the time I thought MIDI was just a designation we had for music in older games, I never thought it worked like that, sounds like it could have a lot of potential!

<comment><USER29> There's an extension for MIDI to control things like lighting and pyrotechnics:

[https://en.wikipedia.org/wiki/MIDI_Show_Control](https://en.wikipedia.org/wiki/MIDI_Show_Control)

</comment></comment><comment><USER30> Informative. Never had any idea that these MIDI things allowed people to use different music to reproduce it. I mean I always thought that MIDI was something about connecting real instruments to computers or something, never really saw a use for it. Reading from the comments it seems people used to share and play these on a previous era. Interesting. The video of the game sounds interesting I guess.

</comment><comment><USER31> I worked at Babbages in the early to mid 90's. It was very sad to watch the "Multimedia" revolution happen before my eyes... I wasn't impressed then and the multimedia titles didn't age well, imo. Midi in games had so much more potential that I don't believe was ever fully realized.

</comment><comment><USER32> Also relevant is GXSCC, a midi player that turns the music into chiptunes!

[http://www.geocities.co.jp/SiliconValley- SanJose/8700/P/Gsor...](http://www.geocities.co.jp/SiliconValley- SanJose/8700/P/GsorigE.htm)

</comment><comment><USER33> I was using Creative SoundBlaster's 8MBGMSFX with Terra Nova: Strike Force Centauri and I found some samples to be way too loud. Popped in FatBoy and the title music sounds fantastic.

</comment><comment><USER34> Oh boy,this thing will make me dig my DOS game archive and oldies trove when I get home.

</comment><comment><USER35> Is it hard to make the soundfont as wave tables instead? Samples are so large!

<comment> Birch-san At the very least, it would be good to release an sf3 version; sf3 uses ogg compression (as opposed to mp3). This can be 10x smaller for comparable quality.

Though I found that (fluidsynth, at least) is very slow at loading sf3. Takes a few seconds.

<comment><USER36> I wonder how hard it would be to write a non-compliant SoundFont that uses Opus - Ogg Vorbis is very old at this point and not as good as newer codecs.

Edit: _that_ was a fun rabbit hole

SF2.04, owned by Creative. [http://freepats.zenvoid.org/sf2/sfspec24.pdf](http://freepats.zenvoid.org/sf2/sfspec24.pdf)

SF3 is "just" Ogg compressed SF2, but there's no spec and it seems like it's only implemented in [http://www.fluidsynth.org/](http://www.fluidsynth.org/)

Edit edit: in the SF2.04 spec - "hydra - A. A nine-headed mythical beast. B. The nine "pdta" sub-chunks which make up the SoundFont articulation data."</comment></comment></comment>


Airbnb refuse a refund because "A fan legally constitutes an air conditioner" - <AUTHOR> https://www.reddit.com/r/digitalnomad/comments/d1i53n/its_100_degrees_in_mexico_and_airbnb_wont_offer_a/ <comment><USER2> See this comment from a roommate: [https://www.reddit.com/r/digitalnomad/comments/d1i53n/its_10...](https://www.reddit.com/r/digitalnomad/comments/d1i53n/its_100_degrees_in_mexico_and_airbnb_wont_offer_a/eznhz87/)

</comment><comment><USER3> Can Airbnb legally say this? What is air conditioning?</comment>


Marathon gaming for the children - <AUTHOR> http://desertbus.org/

<comment><USER2> In case you hadn't heard about Desert Bus before, here's what they're playing:

[http://en.wikipedia.org/wiki/Penn_&_Teller%27s_Smoke_and...](http://en.wikipedia.org/wiki/Penn_&_Teller%27s_Smoke_and_Mirrors#Desert_Bus)</comment>


Some advice on teaching FP - <AUTHOR> http://existentialtype.wordpress.com/2011/04/17/some-advice-on-teaching-fp/

<comment><USER2> Bob is an incredibly smart and accomplished guy, and I imagine the students will get a lot from the course.

That being said the tone of triumphalism and the suggestion that a whole bunch of tough problems in CS (parallelism, program verification of real systems) are about to be solved by the majesty of strongly-typed functional languages is awfully familiar from the way Bob was talking about 15-20 years ago.

We certainly have seen many interesting research papers, type systems and compilers since then, but I'm not sure whether much progress has been made on anything more visible to the much-maligned 'working programmer'.

<comment><USER3> The more worrying thing from a pedagogical point of view is his claim that a bunch of problems that programmers outside academia regularly deal with are non-problems and don't need to be taught, because they're cruft that is on the verge of obsolescence.

He had better be right, or he'll be helping to produce a cohort of students who don't know a lot of stuff they might find themselves needing to know! (Of course, I realize that Harper doesn't control the entire CMU curriculum, so it's quite possible that despite his views, CMU students will end up studying the "not worth studying" versions of parallelism/architecture/etc. problems and solutions in other courses.)

<comment><USER4> This is a first year course. I think the idea is to teach students a `right way' before sullying their minds with real world `wrong ways' and more practical concerns.

<comment><USER5> > sullying their minds with real world `wrong ways' and more practical > concerns

Why do computers exist, and why do people study them? Because they're very useful for "practical concerns". Practical concerns should be at the heart of any study of computers and computation; it's impractical for them not to be.

<comment><USER6> I'm not sure I agree -- it's my experience that too often `practical concerns' become an excuse to teach faddish details of what is being done in the `real world' now, instead of provide any sense of the parts of the field which _don't_ change with each new technology.

I'd rather teach a new hire who had worked through a curriculum built around SICP[1] or HtDP[2] the languages and technologies we actually use here -- even though we never write a line of scheme -- then teach a student who got a four year `Computer Science' education focused on the details of a particular programming language or technology stack how to use that very stack to accomplish lasting things...

[1] <http://mitpress.mit.edu/sicp/>

[2] <http://www.htdp.org/>

<comment><USER2> This is a false dichotomy. I would rather a student who had gotten a coherent CS education in some random Algol-descended language who had worked on a curriculum consisting of a great big chunk of algorithms, systems work (os, compilers, networks) and architecture.

I am finding many "high-church-of-X" approaches to CS increasingly unsatisfying, whether it's rabid OO, the rabid 'functional programming solves all problems', Stephanov's 'grind away for 6-12 months putting the basics on a RIGOROUS FOUNDATION without solving a single interesting problem' book, etc...

My feeling is that many of these religious attitudes will not survive the first contact with a truly serious enemy - in other words, a system with substantial complexity that can't be expressed in an elegant way. I don't think it's a mistake that strong FP guys spend so much time hacking around on compilers, type systems, regular expressions, etc. Maybe a foray into scientific computing - but if you're biting off problems that were previously tackled by a bunch of nested loops in HPF, maybe these aren't the world's most hairy algorithms either.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm a TA (one of four) for the course Harper is talking about in this post. As they say on reddit, ask me anything. I do not guarantee I'll answer. I'll check back in in the morning.

<comment><USER8> Has Harper actually done any real programming of significance? I am an "industry programmer" who has a pretty strong theoretical bent (have a math degree rather than CS, have read most of Harper's papers on the type theory and semantics of module systems), but when I read his blog posts I get the feeling that when it comes to programming he doesn't really know what's up.

<comment><USER7> I dunno, I just TA for the guy. I suspect it depends on what you mean by "real programming of significance". I can tell you that Harper is really damn smart. I'd be truly surprised if he was bad at programming. But his actual experience, I don't know. He hasn't written any code for the course itself, but that's not really his role.

</comment></comment></comment><comment><USER9> "One beautiful feature of the language-based approach is that we start with a very familiar model of computation, the evaluation of polynomials over the reals. It's very familiar for all students, and I think they find it very satisfying precisely because it has a direct computational flavor."

Don't know how true this is at other universities, but this doesn't sound like my experience at all. :)</comment>


Structure and Interpretation of Computer Programs (Lectures) (1986) - <AUTHOR> https://www.youtube.com/playlist?list=PL8FE88AA54363BC46 <comment><AUTHOR> """ These twenty video lectures by Hal Abelson and Gerald Jay Sussman are a complete presentation of the course, given in July 1986 for Hewlett-Packard employees, and professionally produced by Hewlett-Packard Television. These videos are also available here under a Creative Commons license compatible with commercial use.

Note: These lectures follow the first edition (1985) of Structure and Interpretation of Computer Programs. Many of the programs discussed were rewritten for the second edition (1996) of the book, and new material was added. These video lectures will still be useful for students using the second edition, since the overall themes of the course and order of presentation are unchanged.

These videos are courtesy of Hal Abelson and Gerald Jay Sussman, and are used with permission. """

[https://ocw.mit.edu/courses/electrical-engineering-and- compu...](https://ocw.mit.edu/courses/electrical-engineering-and-computer- science/6-001-structure-and-interpretation-of-computer-programs- spring-2005/video-lectures/)</comment>