Show HN: NetLua – Completely managed .NET Lua - <AUTHOR> https://github.com/frabert/NetLua

<comment><USER2> There's also IronLua, which is written in F#: [https://ironlua.codeplex.com/](https://ironlua.codeplex.com/)

<comment><USER3> Would be cool to see performance comparison in future.

</comment></comment><comment><USER4> I'm a user of NLua[0]. Why would I switch to using this instead?

[0] [http://nlua.org/](http://nlua.org/)

<comment><USER5> As this post title says: "completely managed".

NLua still relies on native code.

</comment></comment><comment><USER3> Well done! Is it a specific version of Lua?

</comment><comment><USER6> Very interesting! I'm curious about the parser's error reporting for malformed input -- does it use Irony's default error reporting, or a custom solution? Are error reports good, bad, or lacking in any way?

<comment><AUTHOR> I've not had a chance to look too deep into it but if you find out let me know.

</comment></comment><comment><USER7> Very interesting. If you don't mind me asking, how difficult was it to parse the grammar of Lua? I see you mention "Irony", but I've never heard of it. Is it a parser generator?

<comment><USER8> [http://irony.codeplex.com/](http://irony.codeplex.com/)

</comment></comment><comment><USER9> I'll be "that kid"... what does "completely managed" mean?

<comment><USER8> Runs entirely on the Common Language Runtime: the .NET VM. So no native code is used.

<comment><USER10> So, being pedantic, really it means you rely entirely on the GC for memory management. You can run unmanaged code on the CLR.

<comment><USER11> That's not correct. Unmanaged code, by it's definition, is not run on the CLR. It's run natively by the OS, and is compiled to machine code, not IL.

Managed code, on the other hand, by MS' own definition: "All of these languages share a unified set of class libraries and can be encoded into an Intermediate Language (IL). A runtime-aware compiler compiles the IL into native executable code within a managed execution environment that ensures type safety, array bound and index checking, exception handling, and garbage collection." [0]

[0] [http://msdn.microsoft.com/en- us/library/windows/desktop/bb31...](http://msdn.microsoft.com/en- us/library/windows/desktop/bb318664%28v=vs.85%29.aspx)

EDIT: I should add, that while unmanaged code does not run on the CLR, the CLR does act as a bridge between managed and unmanaged code.

<comment><USER12> To expand on this... "So no native code is used." was probably somewhat misleading.

More specifically, no native code is _explicitly_ used. IL may be compiled down to e.g. x86-64, but you won't have a C DLL being PInvoked from your C# (or other .NET language), nor a C++/CLI DLL compiled against x86-64 specifically.

Among other advantages, this usually implies:

      - Less interop overhead (unmanaged <-> managed transitions are expensive)
      - Easier dependency management (just include the assembly instead of assembly + native DLLs via installer or whatever)
      - Portable (more likely to run on e.g. the Mono Runtime on a Linux box with an ARM processor without requiring a build specific to ARM and possibly to Linux)

</comment></comment></comment></comment></comment><comment><USER13> Is the Irony parser also managed .net?</comment>


Can "Cookie to header token" CSRF prevention be beaten with permissive CORS? - <AUTHOR> The CSRF Wikipedia article https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token describes Cookie-to-header_token as sending a CSRF token to users in a cookie, and then using JavaScript to read the cookie and set it as a custom header (I think a post param would work too) when making ajax calls. It also adds:
The protection provided by this technique can be thwarted if the target website disables its same-origin policy using one of the following techniques:
  Permissive Access-Control-Allow-Origin Cross-origin resource sharing header (with asterisk argument)
The article https://en.wikipedia.org/wiki/Same-origin_policy#Security_Applications also says:
The user visiting the malicious site would expect that the site he or she is visiting has no access to the banking session cookie. While it is true that the JavaScript has no direct access to the banking session cookie, it could still send and receive requests to the banking site with the banking site's session cookie. Because the script can essentially do the same as the user would do, even CSRF protections by the banking site would not be effective.
Is this still true if doing client side rendering and all server requests are ajax get/post calls with a required token in cookies plus custom header? I think the token can be stolen, if the server is rendering the CSRF token into forms, by sending a GET with the user's session cookie, and parsing the response HTML, but as far as I know a malicious site' JS can't read another site's cookies even with Access-Control-Allow-Origin set to the malicious site and Access-Control-Allow-Credentials set to true.
I know setting allow-origin to the request origin is stupid, but am just wondering if I'm missing something that makes it easy to exploit the above CSRF prevention. <comment><USER2> So from reading this over it sounds like you are enabling an endpoint on your site with both CSRF protection enabled that also sends CORS headers to allow for cross origin ajax calls. This could be a workable solution for cross domain calls on the same subdomain (like a.example.com and b.example.com but not malware.com). Since you can scope cookies to domain suffixes, you can have a csrf cookie that can be read from javascript from a number of subdomains and included in a header but can't be read from other domains. Same origin policy prevents domains from reading cookies not scoped to their domain so this should not have any security issues. Note that if you care about confidentiality, you would have to put your CSRF protection on the GET requests (which is a bit abnormal) with CORS since Access-Control-Allow-Origin allows for reading data cross origin (in addition to making requests).

On the other hand, it seems like [https://en.wikipedia.org/wiki/Same- origin_policy#Security_Ap...](https://en.wikipedia.org/wiki/Same- origin_policy#Security_Applications) is flawed and should be fixed. The section seems to be directly describing a CSRF attack and then saying CSRF protections are not effective which doesn't make sense.

<comment><AUTHOR> I think [https://en.wikipedia.org/wiki/Cross- site_request_forgery#Coo...](https://en.wikipedia.org/wiki/Cross- site_request_forgery#Cookie-to-header_token) is flawed too because "Access- Control-Allow-Origin: *" doesn't let browsers send cookies with the request, so any of the CSRF prevention methods shouldn't be broken by it. I was just using "Access-Control-Allow-Origin: malware.com" as an example of a worst case scenario where I still don't think the cookie-to-header method is exploitable, unless I'm missing something. The articles don't give examples or link to sources, so I'm guessing both are slightly wrong. I could try to edit them, but wanted to make sure I wasn't wrong first.

</comment></comment><comment><USER3> As far as I understood, to prevent CSRF, you do a double submit:

\- server sends an HTTP only cookie, which cannot be read from JavaScript \- server sends a new CSRF token via Header/Form for each request

On POST send back the CSRF token via FORM/Header and let browser send along the HTTP only cookie

The owasp cheat sheets are a good read

<comment><AUTHOR> Yea, but doing it that way requires same origin policy not to be weakened like from CORS being misconfigured. [http://blog.portswigger.net/2016/10/exploiting-cors- misconfi...](http://blog.portswigger.net/2016/10/exploiting-cors- misconfigurations-for.html) talks about exploits from this.

But what I am wondering is if using "Access-Control-Allow-Origin: evil- site.example.com or *" can be used to exploit the cookie-to-header technique with a token for every request (GETS included), no form GETS (so token doesn't appear in url query), https, and no browser bugs or XSS vulnerabilities. The wiki articles suggest it could be exploited, but I'm thinking they're just worded conservatively.</comment></comment>


Tesla's over-the-air brake upgrade was amazing–and also a bit worrying - <AUTHOR> https://arstechnica.com/cars/2018/05/how-a-software-brake-upgrade-won-tesla-a-consumer-reports-endorsement/ <comment><USER2> Well, that is patently horrifying.

The last thing I want to think about is having a computer second guessing about what my "pedal to floor" means.

The fact the software has enough leeway in function to make a 20 foot difference via software update is bad enough, that apparently everyone else is at least DOING the testing before vehicle release is reassuring though.

I'm honestly beginning to wonder whether modern society can afford trade secrets? Or does it work just fine, but the Silicon Valley "hit em' young" syndrome is limiting Tesla's exposure to fundamental practices that an older automotive industry have long since internalized and standardized. I'm less and less comfortable with how knowledge is seemingly silo'd so effectively between companies.

"Competitive advantage" shouldn't have body count as a viable metric.</comment>


Django 1.9 release candidate 1 released - <AUTHOR> https://www.djangoproject.com/weblog/2015/nov/16/django-19rc1-released/ <comment><USER2> In theory this will be the second Django version in a row to not have a big release-date slip, which is quite nice.</comment>


Trump's dangerous TikTok ban, abuse of power - <AUTHOR> https://searchcio.techtarget.com/opinion/Trumps-dangerous-US-TikTok-ban <comment><USER2> banning china is probably the only good thing hes done.

<comment><USER3> Though it pains me a little to acknowledge that the Sociopath in Chief could be capable of anything that could possibly be construed as 'good,' gonna have to agree. Seconded.</comment></comment>


Source code of the file with the Zune bug (starts on line 249) - <AUTHOR> http://pastie.org/349916

<comment><USER2> Took me a minute to figure out what was wrong. If IsLeapYear() returns true, and "days" equals 366, you get stuck in an infinite loop (you don't modify "days" at all).

This was the first leap year since Zune was released, and yesterday was the 366th day of the year, sooooo....

Also spotted in this code: several "goto"s.

<comment><USER3> Normally, gotos wouldn't _necessarily_ be bad, but at least one of these is really really bad.

Consider the function OALIoCtlHalInitRTC, lines 122 and 139-143. The last else block has no obvious terminator, but it looks like the else is empty because of the comment and the indentation. So the line after the label cleanUp is the body of the else. This means that if the if on line 131 is true, the cleanUp code never gets executed. Now this may be intentional (but I doubt it since the label is named cleanUp), but that should be documented in the code.

I consider this use of a goto to be legitimate, since it avoids duplication of the cleanup code (and the last thing you want is to have multiple similar blocks of code that need to be maintained/modified in tandem). This idiom often appears in the linux kernel IIRC. But this code is quite terrible since it doesn't use the idiom correctly, produces an unexpected execution path, is a problem to maintain, and is a problem to read. It seems that it ends up being a no-op since the line after the cleanUp label is a debugging line or something, but that doesn't make this a good practice.

But really, this isn't really a problem with the use of goto, it's a problem with the optional braces on single statement blocks in C. The goto and the label chosen just make it harder to spot. I've made it a habit to use braces around all blocks, even empty ones, to make the intent clearer and avoid this problem.

<comment><USER4> _...since it avoids duplication of the cleanup code (and the last thing you want is to have multiple similar blocks of code that need to be maintained/modified in tandem)._

Isn't that the definition of "when to extract code into its own function"?

<comment><USER3> That may be hard to do if it's cleanup code, as the scope changes. Plus, it divorces, visually, the cleanup code from the main body. And there may be additional function call overhead (which may be avoidable by having the compiler in-line it). One reason to use goto is the style that all functions should have one entry and one exit. Even if the cleanup code was put into its own function, you'd still have to ensure that the function was called in all the right places before returning. Without gotos, the logic can become harder to follow through a series of if-else blocks.

</comment></comment></comment></comment><comment><USER5> Last I checked, there haven't been any major overhauls to the Gregorian calendar since C was invented. So why aren't we all using the same, fully- debugged date library yet?

Edit: Actually, I'm cutting it close :-). The last time we changed the calendar was in 1972, when we settled on integer leap seconds -- the same year that C was invented.

<comment><USER6> Hear, hear. It's strange how often we have to get bitten by date and time bugs. I think people ignore the wisdom of Peter van der Linden in the excellent book "Expert C Programming":

"Anyone who thinks programming dates and times is easy probably hasn't done much of it."

</comment></comment><comment><USER7> > Line #263: if (days > 366)

This should work if that was a >= sign. And people at work don't believe me when I say how insanely careful I have to be when I write any code, especially code that deals with people's payroll and vacation time. One missing equals symbol and every Zune in the world froze. One missing equals symbol and every employee could lose 1/12 of their accumulated vacation time.

The ability to pay attention to "mundane details" is just as important as the ability to envision the whole software application from the project manager point-of-view, especially when working in smaller companies without additional oversight.

<comment><USER2> Making that ">=" would make that entire "if" check redundant, since we already know it's at least 365 (because of the "while" condition)

I _think_ the "while" condition should actually be

        while ((days > 365 && !IsLeapYear(year)) || (days > 366 && IsLeapYear(year)))

(or perhaps some simplification that I'm too lazy to figure out right now)

And then the inner "if" condition can be eliminated. Thus the final code could be:

        while ((days > 365 && !IsLeapYear(year)) || (days > 366 && IsLeapYear(year)))
        {
            if (IsLeapYear(year))
                days -= 366;
            else
                days -= 365;
            year += 1;
        }

This seems logical and easier to understand than the original too.

 _Edit: if you want to get ternary-operator fancy:_

        while (days > (IsLeapYear(year) ? 366 : 365))
        {
            days -= IsLeapYear(year) ? 366 : 365;
            year += 1;
        }

<comment><USER8> Let's be a little more DRYer:

        days_in_year = IsLeapYear(year) ? 366 : 365;
        while (days > days_in_year) {
            days -= days_in_year;
            year += 1;
        }

<comment><USER9> How about a little more CORRECTer?

#define diy(y) (IsLeapYear(y) ? 366 : 355)

while (days > diy(year)) { days -= diy(year); year += 1; }

<comment><USER10> For the confused: the year changes each time, so you need to recheck IsLeapYear each time.

But I wouldn't do it with a define but rather:

while (days > (days_in_year = IsLeapYear(year) ? 366 : 365)) { days -= days_in_year; year += 1; }

</comment></comment></comment></comment></comment><comment><USER11> Someone at QA it's going to be fired. Corner cases like 1st and last days of a year(leap and not), 29th of February and the like are the first candidates for proper blackbox testing.

I wouldn't put all the blame on the programmer (who probably is now scared to death).

</comment><comment><USER12> Source? (journalism, not code)

Do you have the rights to this code?

Some context would be nice...

<comment><USER2> It's allegedly from a Freescale clock driver (see the comments at the top). I'm trying to find the original on Freescale's site, unsuccessfully thus far.

If it is indeed a Freescale-supplied driver issue, it makes me wonder how many other devices failed yesterday...

</comment></comment><comment><USER13> I find myself wanting to see the version history for that function. Is that how it was originally written? Was the bug introduced by a previous bug-fix? By a refactoring? Something else?

</comment><comment><USER14> And another leapyear bug on line 170? The year 2000 was a leap year, but here they seem to have the 0 and the 1 mixed up:

Leap = (Year%400) ? 0 : 1;

</comment><comment><USER15> How did these guys (pastie.org) get hold of he Zune source code? I don't think Microsoft gives away any of their source to the public (except for some programs covered by MS's shared source license).

<comment><USER16> Freescale gives away this source for free. It's driver source for some of their hardware.</comment></comment>


Bitcoin: Would you want to get paid in cryptocurrency? - <AUTHOR> http://www.bbc.co.uk/news/business-42435838 <comment><USER2> > Mr Chester said he converts 15% of his own monthly salary and believes it is > "a way of accumulating Bitcoin or cryptocurrencies without worrying about > whether you're buying at the right time".

> That is because people can theoretically reduce the risks of volatility > because they "only buy little bits over time".

I'm skeptical of this statement. Does anyone know if it has validity?</comment>


Djb and Copyright (2004) - <AUTHOR> http://thedjbway.b0llix.net/license_free.html <comment><USER2> Is this accurate? Perhaps I am one of the "bamboozled" mentioned in [1], as I tend to assume that the default copyright of works, in accordance with the Berne convention[2], do not yield the right to make and distribute copies nor derivative works.

[1] [http://cr.yp.to/softwarelaw.html](http://cr.yp.to/softwarelaw.html)

[2] [http://en.wikipedia.org/wiki/Berne_Convention](http://en.wikipedia.org/wiki/Berne_Convention)

I'd love to think that djb is correct, and that I do not need to distribute LICENSE files along with software in order for the users to have these freedoms that I expect them to have.

I want copyright to be _abolished_. I do use CC0 [3] for many works. For software, however, I like to use GPLv3 specifically to prevent my labour from being used in a way that limits the freedoms of others. If we abolish copyright, then I would be all the happier that my works no longer require the GPL to protect these freedoms.

[3] [https://creativecommons.org/publicdomain/zero/1.0/](https://creativecommons.org/publicdomain/zero/1.0/)

<comment><USER3> > I want copyright to be abolished. I do use CC0 [3] for many works. For > software, however, I like to use GPLv3 specifically to prevent my labour > from being used in a way that limits the freedoms of others. If we abolish > copyright, then I would be all the happier that my works no longer require > the GPL to protect these freedoms

If we abolish copyright, you certainly no longer have to worry about protecting those freedoms, because those freedoms would no longer exist. Anyone could copy your software, modify it, build the modified binary, and distribute that modified binary without source, and locked down as tight as they want with DRM, and requiring updates be signed with a key only they have.

You could try to counter this, of course, by carefully only giving copies of your code to people who enter into a contractual relationship with you in which they agree to not do any of those things you do not like, and to keep your code secret from others who have not entered into such an agreement with you...but it only takes on person leaking the code to the public and then it is game over.

<comment><USER4> > If we abolish copyright, you certainly no longer have to worry about > protecting those freedoms, because those freedoms would no longer exist

I think you and the poster above you likely have very different definitions of freedom. Supporting copyright is taking the stance that a reduction of freedom (to reproduce info) is worth it, in exchange for an economic incentive to invent. The world ends up with better stuff, and the inventors are rewarded.

(That is the argument anyway.)

Those who wish to abolish copyright usually either (1) think the economic argument is flawed or (2) believe that the freedom is simply more important than the economic gains. Or some blend/combo of those 2 arguments.

So I'm curious what you mean that it actually leads to less freedom.

<comment><USER3> I'm not talking about economics at all. The poster above me is talking about "freedom" in the same sense the FSF does--the freedom of the users of a program to (1) run it as they wish, for any purpose, (2) to study how it works, and change it to work as they wish, (3) to redistribute it as they wish, and (4) to redistribute any modified versions they make.

The reason they use GPL for their license, instead of something much simpler such as a BSD style license or MIT style license, is that they want to ensure that anyone who obtains their software will be able to do all of the things listed above.

As the poster above me put it:

       For software, however, I like to use GPLv3 specifically
       to prevent my labour from being used in a way that limits
       the freedoms of others.

If I were to take a copy of his software, modify it, build a binary from the modified copy, and use that in my proprietary product without making the modified source available to the users of my product, he would believe that I have limited the freedom of the users of my product. If I were to use a code signing scheme in the firmware of my product to block software updates that are not signed by me, he would consider that as limiting the freedom of my users. If I make my users sign a legally binding agreement to not reverse engineer the code before I allow them to buy the product, he would consider that as limiting the freedom of my users.

He doesn't want me to be able to do any of that that, and so he uses GPLv3, which is only effective because of copyright. If copyright were eliminated, "Free Software" of the kind the FSF strives for is not possible.

<comment><USER5> It's true that the GPL currently uses copyright law to achieve its goals; but it's not true that copyright is the only possible way of achieving them.

If we're assuming legislative power (to abolish copyright), there's no reason we couldn't pass laws to achieve the same goals without copyright.

<comment><USER3> If the new law actually makes it illegal to provide software or use software in an embedded system without including source, and makes it illegal to use signing or other technical means to stop the user of a device that contains software from replacing that software, and makes any contract term that tries to place conditions on someone redistributing software they have received from others, then yes, we could achieve GPL goals without copyright.

Otherwise, its still a copyright law. It's just more limited than current copyright law in that it might only cover software, and provide drastically fewer options for the author.

The chances of anything like I described in the first paragraph happening are so low, I felt justified in ignoring the possibility

<comment><USER5> _The chances of anything like I described in the first paragraph happening are so low, I felt justified in ignoring the possibility_

Fair enough, but the discussion happens in the context of abolishing copyright, something that exists in (almost?) every single country in the world, and which is consecrated in many constitutions, include the US'.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I was part of a panel discussion with DJB in 2006, in which I maybe (!?) convinced him to make all his code until then much more open source. It was video'd here: [http://wstein.org/sagedays6/M2U00221-sd6-panel_discussion.MP...](http://wstein.org/sagedays6/M2U00221-sd6-panel_discussion.MPG) [2GB download!]

He also talks about his philosophy about what people care about in software.

This was before youtube. Somebody should upload it to youtube... (sorry, I can't right now, due to limited bandwidth).

(I know DJB, since we had the same thesis adviser in graduate school....)

<comment><USER7> [https://www.youtube.com/watch?v=COTy32aQ11E](https://www.youtube.com/watch?v=COTy32aQ11E)

</comment></comment><comment><USER5> So, he doesn't have licenses, except he does, in the way of a FAQ that is much harder to evaluate as for its legal grounds (unlike standard licenses, which have often been tested in court).

</comment><comment><USER8> It may be true that DJB is a great ideological champion of free software, but in practical terms, his refusal to license his software means that any organization with a legal department will be extremely hesitant use his software.

<comment><USER9> He put at least qmail in the public domain in 2007.

[https://lwn.net/Articles/260481/](https://lwn.net/Articles/260481/)

Further explained at [http://cr.yp.to/publicdomain.html](http://cr.yp.to/publicdomain.html) which IIRC has been linked many times here.

<comment><USER8> Yeah, that's nice but about 9 years too late while the rest of the FLOSS world had moved on from qmail to Exim or Postfix.</comment></comment></comment>


Linking and loading: what's incidental? - <AUTHOR> http://www.cl.cam.ac.uk/~srk31/blog/2014/06/13/#linking-and-loading-complexity

<comment><USER2> "Few people care about all things simultaneously, so linking seems overcomplicated to everyone. But all these concerns add to complexity individually, and the tension between them also increases complexity."

This is true of all software, actually.

</comment><comment><USER3> Personally?

I think that most compilers should not compile to machine code. They should compile to an intermediate bytecode (only doing relatively generic optimizations), something like LLVM but with precondition / postcondition annotations. Call this phase 1. The operating system then takes that bytecode and on first-run (or at any other time if a program explicitly asks for it) compiles it to machine code, doing whole-program optimization, for the specific machine. Call this phase 2.

The phase 1 compiler may split functions into a version with the original semantics, and maybe versions that require preconditions / post-conditions. Say, a hashmap constructor that requires the size to be a prime (that throws an error otherwise) may get split into a version that checks if the size is a prime that falls through into a function that just assumes the size is a prime, with a precondition that the size is a prime. This can then be used by the phase 2 compiler when appropriate.

For public functions, the phase 2 compiler _may_ decide to copy (a) functions from the shared library to the program itself if there is enough incentive to do so. Say, a function that does an expensive check that the compiler knows isn't necessary, but the pass 1 compiler didn't split it out. The phase 2 compiler saves information regarding what optimizations were done / useful, which can be passed back to the phase 1 compiler when appropriate.

(For cases where a compiler on the target device isn't really appropriate, and/or the hardware of the target is fixed, you can cross-compile. Again: "most".)

<comment><USER4> It might not be a good idea to push compile-time bugs to runtime.

EDIT: Whoops, I misread your comment. Sorry about that.

<comment><USER3> Can't you say the same about any interpreted / JITted language?

</comment></comment></comment><comment><USER5> This article is the first I've heard of `dlvsym`. The idea of shared libraries having more to their versions than just the name of the `.so`.

This was an informative post to read: [http://www.trevorpounds.com/blog/?p=33;](http://www.trevorpounds.com/blog/?p=33;) I just posted it to HN: [https://news.ycombinator.com/item?id=8216999](https://news.ycombinator.com/item?id=8216999)</comment>


Why I Did Not Go to Jail (2014) - <AUTHOR> http://www.bhorowitz.com/why_i_did_not_go_to_jail <comment><USER2> 'I obviously don't know what happened at the other company, but I do know that Michelle had no intention of breaking any laws and no idea that she'd broken any laws'

This. This is terrifying. We're already in the position, as a society, that everyone is guilty of something, and it's just whether someone feels like prosecuting you or not as to whether you'll be penalized.

<comment><USER3> It's cause for concern, but I don't see how this is different from any other society or historical period.

<comment><USER4> It's somewhat of a departure from say, 50 years ago in the United States of America. Options are a substitute for salary. Options were invented when executive salaries were deemed too high.

Now a detail in compensation practice will get you three-plus months in jail.

<comment><USER5> _Now a detail in compensation practice will get you three-plus months in jail_

How is it merely a "detail"?

If, on March 31 of a given year, you hand someone a stock option, you don't get to pick "today" as the lowest price the stock has had in the interval of March 1 thru March 31.

That's not a "detail". That's not just a small problem with the paperwork. That's nothing but obvious fraud.

IMO. IANAL. But I've had stock options given to me. And the price was set for that day, not for some date that was clearly a lie. And this all happened 20+ years ago, long before these sordid SV practices came to light.

Edit: One time my stock option grant was worse than "today". What happened is we were a small company, the BOD met a few days earlier and approved grants, my manager didn't give me my grant for a few days. So it was something like this:

manager: "Here's your stock grant for $20 a share". me: "but the stock closed today at $18 a share. So I'm already 10% underwater".

Such were the perils of working at a small company that wasn't trying to game the system.

Not that there weren't ways to change employee compensation. In 2009 (and I'm sure at various dates before that), many companies went to their stockholders to ask them to approve re-pricing because employee options were way under water.

I don't recall the converse ever happening. I'd like to hear of a company going to its stockholders and asking for approval to tear up grants in the other direction. Something like this: "we gave out employees stock options at $10, but the stock is now $30. We want to take back those grants and give them new ones at the current price". Nope, that doesn't happen.

I.e. there are already many ways companies can legally "cheat" without having to commit obvious fraud.

<comment><USER4> Back-dating options is pretty fishy. Not saying it isn't.

</comment></comment></comment></comment></comment><comment><USER6> > I told our employees that there was a difference between accounting fraud > and accounting mistakes and I believed that Michelle made mistakes at her > previous company, but did not commit fraud. [...]

> Michelle ultimately served 3½ months in jail for her part in the other > company's stock option practice—the same practice that we nearly implemented > at Opsware. Since we had the same head of finance, we almost certainly would > have been investigated. I obviously don't know what happened at the other > company, but I do know that Michelle had no intention of breaking any laws > and no idea that she'd broken any laws. The whole thing was a case of the > old saying: "When the paddy wagon pulls up to the house of ill repute, it > doesn't matter what you are doing. Everybody goes to jail." Once the SEC > decided that most technology company stock option procedures were not as > desired, the jail sentences were handed out arbitrarily.

In England it would be unusual to go to jail unless there was intent to deceive. People don't go to jail because they've made a mistake in their accounts.

Is that true for the US? Or is this story an example of the massive over- incarceration the US has?

<comment><USER7> The UK certainly does have strict liability offences:

[http://www.peterjepson.com/law/A2-2%20Jonathan%20Wight.htm](http://www.peterjepson.com/law/A2-2%20Jonathan%20Wight.htm)

[http://www.drukker.co.uk/publications/reference/strict- liabi...](http://www.drukker.co.uk/publications/reference/strict-liability/)

It's a little unusual to have strict liability result in jail time for directors, but this is tax enforcement. See the ongoing Rangers case.

<comment><USER6> So, I'm not trying to say they wouldn't be found guilty of an offence. I'm saying that they wouldn't go to jail unless there was recklessness or intent to deceive.

For a tax offence this would mean they'd have to repay the tax, with some penalty. Non-payment would then result in a prison sentence.

And I'm only talking about taxes.

</comment></comment></comment><comment><USER8> Wasn't it her job to at least know where the gray areas where? If you know you're in a gray area, I'd expect you know that you _might_ be breaking the law.

<comment><USER9> The point of the story is that social proof isn't enough when it comes to legal matters. The author contrasts his behavior with Michelle's to point out what can happen when you use social proof rather than direct legal advice.</comment></comment>


There is no such thing as good hiring, only good firing - <AUTHOR> http://www.fonality.com/blog/there-is-no-such-thing-as-good-hiring-only-good-firing <comment><USER2> This actually makes me want to work there. At past jobs I've often been frustrated by management's inability to let go of problem employees. If the team isn't gelling or someone just isn't contributing, changes need to happen.

Note: someone might say that _I_ was the problem, which may be true, but I wasn't let go either, so my point still stands ;)

<comment><USER3> what kind of problems did these "problem employees" introduce?

</comment></comment><comment><USER4> This works incredibly well. At my last company I fired about a third of the engineers I hired after 3 to 6 months and ended up with a great technical team. I never know how good an engineer is going to be during the interview process but after 6 months it is blindingly clear.

I am upfront about the winnowing process during the interview, it scares some candidates away but I often get a very positive reaction to this "meritocracy by proof" approach. Another advantage is you can take some flyers on people with nontraditional backgrounds and find the occasionally diamond in the rough.

<comment><USER5> > This works incredibly well. At my last company I fired about a third of the > engineers I hired after 3 to 6 months

Wow. I wonder, have you and this smug author ever considered that you are the problem?

Interviewing is a two-way process, it's the candidate's job to back up everything that's on their resume and make sure they present an honest view of their ability but it's also your job to decide if someone is a good fit for your team before making them quit their comfortable job and move to your start-up. By firing a THIRD of all people you convince to join your company, you are both incompetent and irresponsible. Precisely the kind of harmful deadwood people enjoy see getting fired.

<comment><USER6> I'm not sure it's possible to make the right choice every time when hiring - and even if he's firing a third of his hires it means that he's getting it right two thirds of the time.

Given how lousy interviewing is as a method for discerning quality employees, I'm not sure that's a bad result.

<comment><USER7> While I agree with the essay (will write on that next), firing a full 1/3 of those you've hired is going to be very debilitating for the organization. And not something I think most startups will be able to afford.

And if you report or have to answer to anyone, they're not likely to be impressed that you hired _that_ many duds/people who just didn't work out.

<comment><AUTHOR> _And if you report or have to answer to anyone, they're not likely to be impressed that you hired that many duds/people who just didn't work out._

I think it's important to note that the author is writing from the viewpoint of a serial entrepreneur, which means the context is small startup environments.

Presumably he still might answer to a board, but those may all be co-founders. Regardless, I don't think they would need to be impressed by his management style so much as his end results.

<comment><USER7> How many startups are funded entirely by real co-founders? Some, I'm sure, and a lot more now, but is that the exception rather than the rule?

So if you have "normal" investors, unless the board that includes them is _really_ hands off they'll notice and I can't imagine it will help his credibility. If it's that hands off you're in trouble in that they aren't likely to be very committed to the venture.

<comment><AUTHOR> I'm not suggesting funding entirely by co-founders but, rather, controlled by them.

It also seems a bit like speculation, unless you're a VC or angel who has seen this.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> As an employer you will find yourself with the quality of employees that you deserve. Treat your employees right and they'll be loyal and hopefully will treat you right in return. Treat them bad or whimsically and it will come back to you just the same.

Employer-employee relationships differ from country to country but the above is I think a universal truth. Be a 'bad boss', hire and fire at will and you'll find that your employees will continuously be on the look-out to see if they can do better before you have a bad (pointy) hair day.

Treat them well and they just might amaze you in what they can do for you.

Managing people always was the part of the job that I dreaded the most, as the ceo of a relatively small company. The biggest reason for that was that it took time away from my 'first love', computer programming. But I hope that I never treated the employees of my company as cold and heartless as the article suggests, I'd be interested to hear his employees side of the story.

Different strokes for different folks, it is very well possible that this strategy will work for a certain style of CEO, in a given job-market and location, but I'm fairly sure that it would not have worked for me.

I'd rather spend a bit more time on the hiring side of things and get the right people on board than to go for a 'trial-and-error' approach like this and to have to go through the painful (for all parties) process of getting rid of a third of the new hires every six months.

I have a particular problem with the sentence:

> Your team thinks you suck if you don't have the chutzpah to fire.

That speaks to me of a CEO that is at heart a very insecure person.

You don't fire people to show you've got balls.

<comment><USER9> He wasn't saying that you fire people to show you've got balls. He was saying that teams will think less of you as a manager if you don't fire bad people. And he's right about that.

<comment><USER10> Hiring and firing bad people manifests itself as additional chaos to the others who are trying to get their work done. For those in the trenches, those doing the firing will have already lost credibility for hiring the bad people in the first place.

<comment><USER9> I'm sure you're also right, but I'm not sure what your point is. You can't _keep_ bad people on the team.

<comment><USER8> But you might be able to find a way to make them an asset to your organization any way. There are many kinds of 'bad'.

There is 'incompetent', but that usually comes with a specific field of competence, maybe the employee has different skills and can be given a new role where they're more productive and happy.

There is 'anti-social', this is a real problem and should probably have been caught at the hiring time, a person like this is going to have a hard time being a part of any team.

Then there is 'not in this team', if you have only one team then that's easy, but if you have more of them you might try a different one.

There are the 'loners', people that can't work with others but have to do everything their way, these are usually better suited to become entrepreneurs themselves (I had one guy like that working for me and I helped set him up to start his own business and he actually succeeded in an amazing way).

And so on. So even if you can't keep a bad person on the team there are a few more steps before you bring out the shotgun.

I've literally fired exactly _one_ person, the reason was that he was starting up a competing service and at the same time approached our customers. That was reason enough for me for an on-the-spot termination when I found out.

Other than that we never had any issue that we couldn't resolve amicably or part on good terms without having to resort to firing someone outright.

</comment></comment></comment></comment></comment><comment><USER11> Is it just me or is ignoring the interview process in favour of the firing process as poor as the opposite? The best method is to weight them about equal.

Have a rigorous interview process where you try to hire only the best fit. If the new employee is a failure, have the ability to admit you made a mistake a correct it. Best of both worlds.

Firing a new hire is not a cheap process and it does affect your reputation/company morale.

<comment><USER8> Absolutely true. I'm really surprised at the attitude of the article, it almost seems as though firing is seen as a replacement for a good interview process, and to shore up a lack of authority by instilling fear or showing 'guts'.

</comment></comment><comment><USER12> This guy is brilliant. He's got a number of similar excellent posts on a variety of business and tech related subjects.

Straight, direct, clear and refreshing communication. I recommend you go through the other posts at <http://www.fonality.com/blog/>

<comment><USER13> He's wrong, tho'. The #1 reason that managers don't fire poor performers is that firing is a huge, huge pain at most companies. Everyone might "know" they're a chump, but HR will want proof in writing, over a period of time, and god help you if the person is any sort of minority.

Which is why in most companies poor performers get "promoted" to where hopefully they can't do too much damage. If you're lucky, they can be contained to writing reports that no-one reads. If you're not and someone forgets _why_ they were promoted, then they might actually end up in charge of something, and no-one wins. Except for the HR department. They always win.

<comment><USER14> The corporate job where I'm at right now has this exact problem. HR has made termination require a LONG process that starts with a 6 month "performance initiative plan" before enough data can be collected to fire someone. And even then it requires a tremendous amount of executive level approval.

We've had lots of incidents in the past where older employees would play the "I have a health issue" card to avoid being fired. Just to avoid getting sued, the company would capitulate and "promote or move" them away from the manager who didn't want them.

Part of the problem is that as companies get bigger and their pockets get deeper, an entirely new class of employee enters which is low skill, highly cunning, and completely untrustworthy. Unfortunately, in my experience, most of these individuals always fit a certain profile: Middle Aged Men (50+) Low level of education

Most of these people are hired for two reasons: 1) Need someone for grunt work (support/maintenance) 2) Need someone that will accept a very low salary

Once a few incidents happen, HR and legal issues take over and begin the stranglehold on operational efficiency that infects large organizations.

</comment></comment></comment><comment><USER15> This was great, however, it also rests on the premise that management and those above them has the knowledge and ability to recognize what constitutes a bad employee. Sometimes, through their own ignorance, what is "bad" really is good. It's so sad that that type of problem permeates the software industry. Firing "bad" people fast should be a good thing but only if you can judge bad from good.

</comment><comment><USER16> This is a refreshing alternative to the "better to turn away a superstar than to hire a dud" approach that seems so common. I've always felt that it was caused by risk aversion anyway.

<comment><USER17> What's missed here is that being fired, for a lot of people, has real consequences. I don't think I'd take a job where I thought there was a 1/3 chance I'd be fired in the next 6 months.

If you're a startup, you're hiring people who understand the lack of job security. If you're a large company, there's no excuse for firing 1/3 within 6 months: you can move people around until they fit. If you're getting rid of more than 10% in the first 6 months, you're doing something wrong.

My thought: we should have a real safety net (including universal healthcare and a basic income that _everyone_ gets, even the gainfully employed millionaires) and then allow companies to hire and fire whomever they want, because no one's life gets ruined by the loss of a job. But this would be a radical departure from the society we currently have.

<comment><USER7> Is there any hire at will (which as a term of art includes firing and leaving at will) European country with socialized medicine and the dole?

I told that plenty that make it so difficult to fire a person that they have high youth unemployment rates (e.g. France), but the above three _with_ a strong "Protestant work ethic" might work out well. Or the incentive structure, if a lifestyle on the dole is too good for too many people, might be disastrous in the long term.

I'm inclined to think the latter will be the outcome but wonder if we have any tests of the proposition.

<comment><USER17> _Or the incentive structure, if a lifestyle on the dole is too good for too many people, might be disastrous in the long term._

Within about 50 years, due to technological advancements, we'll have 20-40% paid employment (not unemployment) and there'll need to be some sort of dole.

Personally, I think it would be great to have a society where people don't need to work. The people who only work because they have to wouldn't be working, which means that the people who are working are those with ambition and talent, and only those.

<comment><USER7> The arch-conservative and historian part of me tells me in reply that "The Devil finds work for idle hands." For a pre-Christan example of this, look no further than Rome's initial "bread and circus" period.

The wealth gained from the Republic's Third Punic War had an ultimately disastrous result in all sorts of ways.

That said, you're absolutely right, we will _someday_ have a true post- scarcity society, although the near total suppression of real nanotech research in the last quarter century makes me leery of predicting any dates.

<comment><USER18> What do you mean by "the near total suppression of real nanotech research in the last quarter century"?

<comment><USER7> Spend some time on this site: <http://e-drexler.com/>

Start with this item at the end of the home page: Changing the narrative in the U.S.

In short, "the establishment", e.g. existing chemists appropriated the buzz Drexler created while not actually doing what he was promoting for the usual parochial reasons plus in many cases a genuine and legitimate fear of what his style nanotech will bring about.

<comment><USER18> Right, so the failure of significant progress towards Drexler's vision must be due to some kind of secret conspiracy of physicists and chemists rather than, say, the fact that atom-by-atom assembly is ridiculously hard?

I should probably vaguely mention that my PhD work was not entirely disconnected from the idea of fabricating devices by placing individual atoms in locations with sub-nm precision. I suppose I should be offended that nobody let me in on the fact that we're supposed to be suppressing that kind of work.

<comment><USER7> It wasn't secret! See e.g. the "debate" Nobel Chemist Smalley had with Drexler in _Scientific American_ and then I think the JACS. Smalley started out with a straw man ("fat fingers") in both, which is not a sign of honest intent.

The bottom line is "where are the grants and research centers for Drexler style nanotech"? Either he's lying about this---I'll admit most of my info about this is from him or people in his orbit---or he's mostly right.

Or let me put it this where: when you graduate, where are you going to be able to go to work on "Productive Nanosystems" in his style? Name names, this should be something you're looking for or at least aware of, or can ask about tomorrow when you go into "work".

ADDED: I _know_ it's "ridiculously hard", for if finances hadn't gotten in the way I would have most likely eventually gotten a Ph.D. in work "not entirely disconnected from the idea of fabricating devices by placing individual atoms in locations with" atomic precision in the '90s.

<comment><USER18> _where are the grants and research centers for Drexler style nanotech_

Same place as the grants and research centers into warp drives and unicorn husbandry?

<comment><USER7> Ah, it would have been easier if you'd started out saying "beyond the foreseeable state of the art" or "impossible". Then we could have discussed that issue.

However your appeal to authority (that authority being yourself) does not falsify what Drexler has said about this or his evidence.

<comment><USER18> And if you'd started out by saying "I think that full-on atomistic assembly nanotechnology isn't being taken sufficiently seriously by the scientific community" rather than "nanotechnology research has been suppressed for the past 25 years" then you'd have had a more sensible argument.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> A great book that espouses this principle is Fire Someone Today: <http://www.firesomeonetoday.com/> There's a lot of other practical entrepreneurial advice in there too!

</comment><comment><USER20> Just looked up this company on Glassdoor. As I suspected this jerk has created a company culture of suspicion and hate. He himself is not respected by his team as is proved by his abysmal rating. As a potential employee I'd take one look at this review and head for the hills. An example -

""Lord of The Flies Meet Corporate America."

Pros

Product works well and is fully supported by a highly skilled team. Some positions offer work from home.

Cons

Management plays favorites for their friends and plays immature games. Nothing you shouldn't expect from a company that had a fight club. Overall the upper management doesn't seem to care about their employees rather tech support or sales. Constant turn over in the sales department lead by myopic management team. You will love the atmosphere with your coworkers but despise the management for their lack of respect and unethical conduct.

Advice to Senior Management

Treat your employees with respect. You can not expect your customers and channel to respect you when you constantly cut good people from your team. I would advise the executive team to seriously look at their management who has regular turnover. Sometimes its the process not the person."

</comment><comment><USER21> I've had so many spineless bosses it's not even funny.

<comment><USER22> I remember reading that bosses are most likely to have a heart attack while firing people. It's not easy.

<comment><USER17> In a way, it's an admission of impotence. When you fire someone, you're saying that you don't have the resources or power to turn that person into a success at your company.

The "resources" angle is crucial. Large companies can afford to have a non- producer for 6 months and train him up to being able to contribute, and they generally should. Startups usually can't afford this.

Of course, this excludes the cases where a person is fired for doing something seriously wrong or unethical. But I imagine it's much easier to fire in those cases.

<comment><USER7> I don't think it's within my power or anyone else's to turn many people into a success if they can't grok pointers, recursion and/or abstraction and one or more of those is necessary for the job (I'm assuming a small enough startup they can't be put someplace "safe").

I'm pretty sure the abstraction bit is innate (I'm assuming they've passed high school math), and very sure I can't teach it nor is it my duty to. Pointers and recursion are not so bad (but again, in these sorts of situations I'm probably not in a position to get them up to speed on something so basic and so far reaching in effects (especially unsafe pointers)).

<comment><USER17> If you fire someone who can't understand basic programming concepts, the mistake you made was hiring that person.

<comment><USER7> Indeed, which is why I test for each of those necessary concepts, as detailed elsewhere.

</comment></comment></comment></comment></comment></comment><comment><USER23> Huh, whatever CMS he's using didn't enter in his HTML comment as, well, a comment. Up near the top of the article: "<!-- If what I write makes me look like the grim reaper of CEOs.-->"

</comment><comment><USER7> Very interesting. And it agrees with the one unique piece of advice I give people who are considering whether to go to work at a new firm, "Try to determine if they can fire people."

One quibble:

" _It takes time to glean an employee's pithy attributes: work ethic, intelligence, attention to detail, enthusiasm, even personal hygiene._ "

You should be able to judge at least initial enthusiasm in your interviewing process or you're not doing a good job of selling your company or it's an impossible sales proposition. Either of which you should do something about at a high priority.

But I'll admit that sustained enthusiasm is what really counts and of course only time will tell WRT to that. And I'm not sure what you'd do with people who take some time to warm up to a situation (ADDED: well, make sure they've been enthusiastic about at least one prior job; if they're too young to have any/many and are already cynical you'd probably best pass on them :-).

For programmers you should be able to get a reading of intelligence and attention to detail in the interview as long as you do minimal testing (perhaps Fizzbuzz, my preferred 3 tests of reverse a linked list (pointers), recursive factorial and find error in this block of code, etc.).

Having them work out loud with you a relevant design problem is also good, although recognize that only 1/5 of programmers "get" abstraction (according to the Antipatterns book and my personal experience); if you need/can afford having programmers who don't get it, you'll want to gauge their ability to follow orders and "do it this way" "just because" the architect says so.

(There are potentially lots of slots in an organization including a startup for all sorts of competent people, e.g. look at the 2nd _Coders at Work_ interview Brad Fitzpatrick, the Live Journal Founder. They had an older employee who produced _awful_ code, but they loved him since his forte was quickly figuring out difficult integration problems which no one else liked to do or was good at. He handed them messy solutions filled with duct tape and bailing wire and they mined the interfaces from them and made clean versions that fit with their system.)

Anyway, my advice is to pay close attention to what this author says, just don't let it cause you to significantly relax your hiring system since hiring, working with and then firing duds is _always_ debilitating for all concerned.

<comment><USER17> What if they reverse a linked list using a language like ML or Haskell where pointers aren't required?

<comment><USER16> Personally, I'd take a good understanding of functional programming as a substitute for a good understanding of pointers. I mean, the point of the exercise isn't to find out how well they know pointers (they'll rarely use them anyway). It's just a way to figure out how smart they are.

<comment><USER7> See below at <http://news.ycombinator.com/item?id=1331995>.

When I was doing this, groking pointers was required and functional programming unfortunately just wasn't an option. E.g. during this period LISP was anathema (even to the point where one project at the beginning of this decade died because it could only be done in something that productive but use of it was rejected for no good reason).

So my test _was_ for understanding pointers as well as figuring out how smart they are _at programming_.

Plus as noted when things get ugly (e.g. in some debugging situations) groking pointers is required and as long as Johnny von Neumann's initial hack architecture rules that will remain true.

Today, I would most certainly take someone with "a good understanding of functional programming as a substitute for a good understanding of pointers", I'd just make sure a few also grok pointers and other low level stuff.

(I am _so_ happy we have exited the Dark Age of Programming Languages.)</comment></comment></comment></comment>


Australia Plans $1 Billion Electric Vehicle Network - <AUTHOR> http://afp.google.com/article/ALeqM5il6f9UKjXLMrq0sQ-Ccd8vh5VANA

<comment><AUTHOR> While the car companies and the media is focused on the creation of better electric cars - "Better Place" is planning ahead and betting on building a fortune by servicing these electric cars. They've started creating electric networks which these cars will need to recharge.

<comment><USER2> Electric cars that don't exist yet. It's still a risky bet, but as you point out the payoff is huge.</comment></comment>


Presenting OpenBooth: Open Source Webcam PhotoBooth - <AUTHOR> http://obsesh.com/openbooth/openbooth.html

<comment><AUTHOR> So here's a quick overview on how OpenBooth came to life:

Our site is mainly based on user photo submissions, and so we decided that having a photobooth would help us by making it easier for users to submit their original content. Naturally, we searched the net for some cool open- source webcam projects, but with the exception of 1 product that would have cost us over $5,000, we found nothing that suit our needs.

So, we decided to create OpenBooth - a fully customizable Photobooth Flash application. Check it out, and feel free to use it in your own site!

GitHub Project URL: <http://github.com/obsesh/openbooth></comment>


Show HN: 300+ Best Twitter Threads - <AUTHOR> https://awesomethread.com <comment><USER2> Good idea to curate those threads!

For some reason, I can't see the actual threads on mobile. The browser (Safari) just shows a popup with only the first tweet visible. Below that, I just see loading skeletons where the other tweets are supposed to go.

<comment><AUTHOR> Let me check and fix it. It happens in some browsers because they block twitter script. If you can please send a screenshot that would be very helpful.

<comment><USER2> Never mind, I just figured out that disabling my adblocker fixes the issue.</comment></comment></comment>


Microsoft surpasses Exxon as second most valuable company - <AUTHOR> http://www.washingtonpost.com/business/technology/microsoft-passes-exxon-as-2nd-most-valuable-co/2014/11/14/302a53cc-6c29-11e4-bafd-6598192a448d_story.html

<comment><USER2> I used to follow stocks more in college and had a pretty good idea of market caps of the Dow components. I remember that MS was always near the top.

Then I tuned out for 12 years. (I came to believe the stock market was a rigged insider's game, but that's another story.) Given how badly they've been managed during that time and the explosion of mobile, I _assumed_ Microsoft had dropped not only out of the top spot but out of the top ten, probably worse.

Nope. Never dropped below 6th _worldwide_.

[http://en.wikipedia.org/wiki/List_of_public_corporations_by_...](http://en.wikipedia.org/wiki/List_of_public_corporations_by_market_capitalization)

That's just astounding to me. Google has done almost everything right since its founding, dominating the Internet wave (and a massive portion of online advertising), grabbing a huge chunk of the mobile revolution and getting its tentacles in almost every area of disruption... and yet for all of the success and raw brainpower, batting as close to 1000 as a company possibly can for 15 years, they _still_ haven't eclipsed Microsoft, which bumbled its way through the 2000s in embarrassing fashion. Very hard to comprehend.

<comment><USER3> From a business perspective, Microsoft also did almost everything right[1] for 15 - 20 years, and for as much bumbling they did during the 2000's, they still maintained a few strategic advantages:

1\. SQL Server

2\. Sharepoint

3\. XBox/Live

4\. Exchange (one of the earliest demands by corporate iPhone users was ActiveSync)

5\. Live/Bing

6\. Office (mostly Excel)

7\. Lots of cash

[1] Or their competitors screwed up.

<comment><USER2> I mostly agree with this with some additions/deletions:

0\. Windows. Everything else flows from the monopoly, including Office/Excel.

Remove #3, Xbox is not a big money maker for them, IIRC. Remove #5, Live/Bing are a joke, unless I'm misunderstanding what Live is.

Funny, neither one of us mentioned IE, which was dominant for a long time.

<comment><USER3> I elided Windows because it required too much exposition. As a platform, it also entails a bunch of strategic liabilities, and I'm not sure how everything cancels. At least Office/Excel, Exchange, Sharepoint, SQL Server, et. al. can be ported to other platforms.

XBox is not a big money maker, but neither was Amazon for a long time. Investors also care about potential.

Bing will probably turn out to be a strategic advantage: If Google creates or dominates new markets, it's going to have competitors who will not want to use its search engine and other online services, case in point: Apple.</comment></comment></comment></comment>


Moving from Rails to Vue Saved Me Headaches – and $84/Year - <AUTHOR> https://medium.com/@tygertec/moving-from-rails-to-vue-saved-me-headaches-and-84-year-96bf0b82faa9 <comment><AUTHOR> For those without a Medium sub: [https://www.tygertec.com/rails-to- vue/](https://www.tygertec.com/rails-to-vue/)</comment>


Dream Jobs: College Students Get Real - <AUTHOR> http://www.businessweek.com/managing/content/apr2010/ca20100428_482088.htm?chan=rss_topEmailedStories_ssi_5 <comment><USER2> Causality always gets overlooked in free markets.</comment>


Microsoft Sells 4 Million Windows 8 Upgrades in 4 Days - <AUTHOR> http://mashable.com/2012/10/30/4-million-windows-8-upgrades/

<comment><AUTHOR> Looks like the reduced pricing and simple, relaxed upgrade path was a smart strategy. By comparison, Apple sells about 5M new Macs a quarter.</comment>


Show HN: YouTransfer – Self-hosted file sharing - <AUTHOR> http://www.youtransfer.io <comment><AUTHOR> YouTransfer is a simple but elegant self-hosted file transfer & sharing solution. It is an alternative to paid services like Dropbox and WeTransfer by offering similar features but without limitations, price plans and a lengthy privacy policy. You remain in control of your files.

Created to be installed behind the firewall on private servers, YouTransfer aims to empower organisations and individuals that wish to combine ease-to-use file transfer tooling with security and control.

You can watch a live demo at [http://demo.youtransfer.io](http://demo.youtransfer.io)

If you want to see it in action on your own environment, you can use the Docker image ([https://hub.docker.com/r/remie/youtransfer/](https://hub.docker.com/r/remie/youtransfer/)) or NPM package ([https://www.npmjs.com/package/youtransfer](https://www.npmjs.com/package/youtransfer))

<comment><USER2> Sounds fairly similar to bradfitz's Camlistore ([https://camlistore.org/](https://camlistore.org/)).

If you're familiar with that project, could you comment on the main differences in YouTransfer?

<comment><AUTHOR> I'm not familiar with camlistore, but a first glance at the project website tells me that it has way more features and serves a different goal.

YouTransfer is basically a very simple hit & run file sharing application. The goal is to make uploading & sharing files a matter of 2-3 clicks. The files will be stored with a configurable retention time and will be deleted from the server after they expire.

YouTransfer it's not meant to help you organise your digital life, or have access to all your files remotely. It will only help you share files in a more convenient way compared to SFTP or email.

</comment></comment></comment><comment><USER3> If I read it correctly, this is how a file token is generated, which is supposed to be secure:

         file.id = md5(file.name + (Math.random() * 1000));

First of all please do not use MD5 for anything anymore, it has known collisions. But you shouldn't also use any hash functions here at all: just generate a long enough random token. Math.random is not a secure PRNG, use crypto.randomBytes in Node or window.crypto.getRandomValues in browsers.

PS And multiplication by 1000... is it just for fun?

<comment><AUTHOR> Thanks for scrutinising the codebase! You are absolutely right that there is no need for creating a hash. This was just plain laziness on my part. I've created an issue ([https://github.com/remie/YouTransfer/issues/101](https://github.com/remie/YouTransfer/issues/101)) to change the token generation.

<comment><USER4> Just to reiterate what dchest said, you should _never_ use MD5 anymore, even if you do intent to hash something. MD5 is is broken and should not be used for anything anymore.

<comment><USER5> What about Gravatar?

<comment><USER6> Please just stop using it? It's the feature no one asked for.

<comment><USER7> I am not a very important person but I certainly ask for it, and I'd like you to stop discarding me and my "kind" as "no one".

<comment><USER8> Do you ask for that with the awareness that gravatar then gets to track your presence around the internet for the cost of a tiny picture?

I would rather have less ad tracking pixels on someone elses websites if possible, but I am genuinely interested in the value that gravatar provides to people who like the service.

<comment><USER7> There's a lot of things that can track presence around the web and gravatar's not one of them. Iff you decide to implement gravatar without mirroring their images, avatars are indeed loaded on their first query (and not subsequent ones) and, _god knows what they 're doing with that information ohgod_. They certainly can't "track my presence around the web", though - no js means no fingerprinting, no tracking cookie, nothing. Juuuust a blind IP address.

But the recommended way is to prefetch the avatars directly from your server and offer them on your own cdn.

As for the value it provides, well for one thing I pretty much never have to upload my avatar to websites anymore - it's an avatar attached to my email addresses instead and that's very nice. _Of course_ I'd prefer a proper identity protocol but nobody's _working_ on one. If you want to, be my guest...

<comment><USER8> I think we disagree on one basic topic, I dont want an easily distinguishable identity to track across the internet.

I would rather external actors (say gravatar does nothing wrong) not be able to identify which email address I use on a site they do not own, and not be able to track my user signups by something that might be public information, which generally a site does not advertise.

It just feels wrong.

<comment><USER7> Unlike every actual tracker on the internet, Gravatar is opt-in. Things like google analytics, facebook like button/tweet button etc, they are all opt-out.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> It's a different use case, but I love magic wormhole for directly and securely sending files to people:

[https://github.com/warner/magic-wormhole](https://github.com/warner/magic- wormhole)

It's file sending from 1995.

</comment><comment><USER10> Might I suggest that you split the folders up in your uploads.

0b692a00635682fabc78b6a50655242c.binary gets stored, for example in "./uploads/0b/69/2a/0b692a00635682fabc78b6a50655242c.binary" etc. Too many files in one dir can have problems or be slow.

<comment><AUTHOR> Good suggestion! I've added an issue on GitHub ([https://github.com/remie/YouTransfer/issues/106](https://github.com/remie/YouTransfer/issues/106)).

BTW: normally the files will expire within a specific timeframe and will be removed by a scheduled cleanup process. This should limit the impact, but if the system is heavily used it might become a problem.

</comment></comment><comment><USER11> You might want to fix the XSS [1] on the page and prevent the path traversal (try typing ../config in download input)

[1] XSS Example: [http://demo.youtransfer.io/download/%3Cscript%3Ealert(%27xss...](http://demo.youtransfer.io/download/%3Cscript%3Ealert\(%27xss%27\)%3B%3C%2Fscript%3E)

<comment><AUTHOR> Good catch! The XSS error was introduced with the implementation of error handling, but is a really unwanted side effect :)

I've created two issues on GitHub ([https://github.com/remie/YouTransfer/issues/107](https://github.com/remie/YouTransfer/issues/107), [https://github.com/remie/YouTransfer/issues/108](https://github.com/remie/YouTransfer/issues/108)) which will be fixed in a new hotfix release asap.

</comment></comment><comment><USER12> I made this once pomf.se went down:

[https://github.com/SirCmpwn/sr.ht](https://github.com/SirCmpwn/sr.ht)

pomf.se was my replacement after my own hosting service, MediaCrush, went down.

<comment><USER13> I've been searching for a pomf.se replacement for some time now, so this is great! Can I request an account?

<comment><USER12> I would prefer if you ran it on your own infrastructure.

</comment></comment></comment><comment><USER14> Oh, thank goodness. I was looking for a solution like this less than a month ago and couldn't find ANYTHING usable.

Much appreciated, added to my list o' useful things.

<comment><AUTHOR> Thanks! I'm glad I could help :)

</comment></comment><comment><AUTHOR> Released version 1.0.3 which fixes the XSS and path traversal security issues (as well as 3 other issues, see [https://github.com/remie/YouTransfer/issues?q=milestone%3A1....](https://github.com/remie/YouTransfer/issues?q=milestone%3A1.0.3) for more info)

</comment><comment><USER15> These kind of projects are a lot of fun. I wrote a simple one, in Ruby, using Sinatra here:

[https://github.com/skx/web-file-publisher](https://github.com/skx/web-file- publisher)

But then as an experiment I wrote another which uses TOTP to authenticate uploads, so you can upload a file directly via CURL with a suitable TOTP device. This is written in golang:

[https://github.com/skx/go- experiments/tree/master/publishr](https://github.com/skx/go- experiments/tree/master/publishr)

Using TOTP limits compromise if your upload is sniffed, although I run it behind SSL so I'm protected against that regardless.

Interesting project though; and I like that you can deploy it via Docker.

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER16> I've just seen the demo. What about security? Can anybody just "dump" files on your server?

Also, when people run this at home on their home computers there is limited upload speed (typically 1/10th of the download speed).

<comment><AUTHOR> Basically... yeah, if you do not take any additional security measures, anybody can just "dump" files on your server.

You could opt for the S3 storage provider, which will dump the files to Amazon AWS instead.

The YouTransfer project does not implement access control or SSL, so it is highly recommended that you look at the hosting options on the Wiki ([https://github.com/remie/YouTransfer/wiki/hosting](https://github.com/remie/YouTransfer/wiki/hosting)).

I'm afraid there is not much the project can do concerning upload speeds of individual connections at home :)

<comment><USER17> This is very nice! Personally I'd really like some kind of login for the uploader so I can offer this service to friends and family (and myself ;)) without the risk of someone discovering the url and using it as a way to distribute illegal things... Perhaps it is easy to do with Apache/Nginx (when the upload site is on another subdomain for example), I don't know actually.

The speeds issue can be solved by running on a cheap DO droplet or scaleway arm server btw (my city luckily has fiber everywhere :)).

<comment><AUTHOR> The problem with ACL is that I'm worried it will make the project more complex. I've added an issue on GitHub for future reference ([https://github.com/remie/YouTransfer/issues/105](https://github.com/remie/YouTransfer/issues/105))

</comment></comment></comment></comment><comment><USER18> The software looks interesting, however the web page is hard to read due to low contrast and very thin fonts.

Join [http://contrastrebellion.com/](http://contrastrebellion.com/)

<comment><AUTHOR> Are you referring to the generated GitHub pages on [http://youtransfer.io](http://youtransfer.io) or to the demo instance ([http://demo.youtransfer.io](http://demo.youtransfer.io)) which is the actual application?

<comment><USER19> Probably [http://www.youtransfer.io/](http://www.youtransfer.io/)

I'm having a little trouble, too. Even making the type a little bit darker would help.

<comment><AUTHOR> I'm a bit hesitant to change this as I'm using the GitHub site generator for convenience. There is a limited set of templates available, most of which are either ugly or have readability issues. As the website basically only consists of the README file, you can also look at the GitHub project for more information ([https://github.com/remie/YouTransfer](https://github.com/remie/YouTransfer))

<comment><USER19> haha, fair enough. I just checked my github, and as you can probably guess, I've just used their template which is pretty low-contrast.

</comment></comment></comment></comment></comment><comment><USER20> Hoes does it compare to Seafile or Owncloud?

<comment><AUTHOR> It has less features :)

The success of services like WeTransfer or Dropbox is that it is dead simple to use. It does one thing (sharing files) and makes this as easy as possible.

Seafile seems to be easy enough, yet still has a multitude of features compared to YouTransfer. OwnCloud simply has a whole different goal. It's not about sharing files, it is about organising your entire cloud presence (with e-mail, calendar, foto's, etc).

With YouTransfer, you can have the same ease-of-use but on your own terms. It runs on your own servers, with your own (secure) storage. You are in full control.

Given that it is also published as an NPM package, YouTransfer can be modified to suit your specific needs. This makes it interesting for companies to rebrand it and use it as their file-sharing system.

</comment></comment><comment><USER21> Congrats on the project. Without loading and looking myself, how are the file accessible on the server? I asked because I'd like to have clients use this to send ME files only. Is that an option?

<comment><AUTHOR> Currently, the files are stored as a flat file list on the file system using their randomly generated token to create a [token].json and [token].binary file. The JSON file contains meta information, the .binary file is the actual file.

Using the default settings, you would get something like "./uploads/0b692a00635682fabc78b6a50655242c.binary" in the application directory.

I've already has plans on making it possible to change the interface, for instance not allowing direct download from the homepage. I could ament this with the feature to send email notifications to the system administrator upon successful file transfer. The combination of both would allow you to use YouTransfer.io as a public drop box for files. Does this sound about right to you?

<comment><USER21> Yes, it sounds as expected. Thank you again for your work.

</comment></comment></comment><comment><USER22> The amount of of infrastructure you have to deploy to use this seems excessive.[1] You need NGrok (a commercial service) to get through NAT. You need Docker to install. You need Heroku, Microsoft Azure, Amazon AWS or Google Cloud to host. Then you need a reverse proxy, HAProxy, Nginx or Apache Httpd, for some reason.

How many sysadmins does it take to screw this in?

[1] [https://github.com/remie/YouTransfer/wiki/hosting](https://github.com/remie/YouTransfer/wiki/hosting)

<comment><AUTHOR> Actually... you don't _need_ any of those. It's only a suggestion. You can also install NodeJS, download YouTransfer, set the port to 80 and run it.

However, it is highly recommended to either use Docker, a reverse proxy, any of the PaaS providers or a combination of the above.

EDIT: I've updated the wiki with additional information on running it locally.

</comment></comment><comment><USER23> How is this related to Dropzone? [http://www.dropzonejs.com/](http://www.dropzonejs.com/)

<comment><AUTHOR> It's not really related. YouTransfer.io uses DropzoneJS as the file transfer UI for javascript enabled browsers.

</comment></comment><comment><USER24> Any chance for a more readable font?

<comment><AUTHOR> Any suggestions?

<comment><USER25> Not San Francisco not San Francisco not San Francisco ;)

<comment><AUTHOR> :D

How about Proxima Nova? ([http://www.marksimonson.com/fonts/view/proxima- nova](http://www.marksimonson.com/fonts/view/proxima-nova))

</comment></comment></comment></comment><comment><USER26> See also transfer.sh</comment>


Stop the Presses: Essay Shows That Hard Work Can Be Unpleasant - <AUTHOR> http://diegobasch.com/stop-the-presses-essay-shows-that-hard-work-c

<comment><USER2> Here's the big thing that you missed in PG's analysis:

>The most dangerous thing about our dislike of schleps is that much of it is unconscious. Your unconscious won't even let you see ideas that involve painful schleps. That's schlep blindness.

Thus defined, schlep blindness isn't the _unwillingness_ to do hard work. Instead, it's the unconscious aversion to ideas that have unpleasant tasks associated with it. This idea is actually pretty profound and it's good to have an awareness of it.

<comment><AUTHOR> That concept is made up by him. I, as well as many other people, am absolutely aware of great ideas that involve painful schleps. I've discussed startup ideas with different people since the 90s. A reason to discard an idea was "that's a cool problem, only we'd be in for a world of pain."

I don't see any evidence to support his assertion that "your unconscious won't even let you see ideas that involve painful schleps." It's just psychobabble to me.

<comment><USER3> You should read Daniel Kahneman's _Thinking, Fast and Slow_ , which says basically the same thing in thorough detail. The fact that you know of some number of difficult things that you've seen and considered says very little about whether there's a cognitive bias against doing so in general - how can you even start to quantify all the things that you may have missed?

<comment><AUTHOR> I've read it. Daniel Kahneman says something very different than what Paul Graham says. Graham is making an unsubstantiated assertion about a very specific hypothesis for which he has no evidence: that people generally fail to see ideas that would require hard work. That's not one of the many very specific biases and cognitive illusions pointed out by Kahneman which he substantiates with studies and experiments.

<comment><USER3> The unifying characteristic of the many specific biases and cognitive illusions Kahneman discusses is that System 2 systematically defers to System 1 to avoid doing work. I appreciate your point that Graham's specific claim is not substantiated by direct experimental evidence, but I think it's likely that the task of picking a business idea is subject to the same biases as any other task. It's certainly not as ludicrous a suggestion as you're making it out to be.

</comment></comment></comment></comment></comment><comment><USER4> I think this analysis is a little unfair. It may be true that pg wasn't really saying anything new. That doesn't mean that it wasn't worth writing about, however, because it is one of those lessons that seems to continually go unlearned.

I don't believe his allusion to the inverse correlation between the age of founders and the likelihood of big successes is entirely unfair, either. Of course there are exceptions, but in general I've noticed that as my friends grow older, they have become more risk averse. They seems to be much more likely to talk themselves out of pursuing big ideas by enumerating all of the ways in which they might fail.

Having said that, I think there's a lot of value in older founders who can use their experience and judgement, but are still willing to adopt a "damn the torpedos, full speed ahead" attitude when they realize that a lot of hard, boring work lies between them and their goal.

<comment><AUTHOR> The obvious question is, how many of your older friends are founders? The fact that someone is an older founder means he/she is less risk averse than other people.

</comment></comment><comment><USER5> I think that this is only half of what PG was trying to say. It's not just that hard work can be unpleasant - it's that hard work can be unpleasant _and this blinds people to working on problems with large impact, simply because they will hard_. He's describing a very particular failure mode of potential startup founders that he sees.

If this weren't a real problem - why are so few people trying to tackle actual problems that make millions of people miserable? Like health & sanitation in the third world. Or fixing the political process in the U.S. (and everywhere) so that people with less than a million dollars actually have a voice? Or matching up the millions of job seekers with the millions of jobs that go unfilled because there's nobody suitably skilled for them? Or finding a sustainable energy source so that we can maintain our lifestyle when the oil dries up?

<comment><USER6> Lots of people are trying to tackle these "actual problems". There's just no money in it, so it doesn't get funded.

Or if there is money in it, people criticize things. Oprah has practically become a saint, for opening a school that graduates ~100 students a year. Foxconn provides hundreds of thousands of migrant workers with the money they need to send their kids to school, and they are practically the devil incarnate. It's complicated.

<comment><USER7> """Oprah has practically become a saint, for opening a school that graduates ~100 students a year. Foxconn provides hundreds of thousands of migrant workers with the money they need to send their kids to school, and they are practically the devil incarnate. It's complicated."""

How good of Foxconn. If only they didn't make ten times the money or more off of each migrant worker while forcing him to work in shitty conditions capitalizing on the fact that they are kind of the only game in town and/or have agreements with fellow factory owners to keep the wages down/conditions bad...

<comment><USER6> Foxconn - revenue $59.3 billion, profits $2.2 billion (2010). They can't really afford to raise their costs that much. OK, a large part of their revenue might be components, but even then, they aren't exactly rolling in cash.

</comment></comment></comment></comment><comment><USER8> Well, most first-time parents confess surprise at how difficult it being a parent turns out to be. Among them are parents who did their research, knew lots of other first-time parents, and didn't believe they would be surprised.

It turns out that believing you are prepared for something and actually being prepared are often not the same thing, hence the "blindness" pg refers to.

You say "Don't be fooled, what pg is doing here is thinking like the VC that he is." I say, don't be fooled by analyzing the source, "schlep blindness" really does exist.

He's also writing about fear and perfectionism. And I find his admonition to

"...ask 'what problem do I wish someone else would solve for me?' ... there's plenty still broken in the world, if you know how to see it."

to be useful.

It's fine to point out his (VC) bias, but I think you're doing a disservice in not pointing out that he's also giving useful advice.

<comment><AUTHOR> I'm not convinced. He says:

"There are great startup ideas lying around unexploited right under our noses. One reason we don't see them is a phenomenon I call schlep blindness. Schlep was originally a Yiddish word but has passed into general use in the US. It means a tedious, unpleasant task."

I wouldn't say we don't see them. The problem is we don't want to take on them. Founders know that the odds of getting rich are slim, so they (we) want to have fun during the journey. Investors on the other hand, want to make money. They don't care if founders have fun. They need to convince founders to do unpleasant things that have a chance of doing spectacularly well.

<comment><USER5> I think you're interpreting "don't see them" in a way different from how PG meant it. Of course we "see them", as in "are aware of them". There're pretty common threads on HN and Reddit where people lament "Oh, wouldn't be awesome if <big hairy audacious goal> were solved!"

I think he meant "see them" as "see them as something that could realistically be solved by my startup". And that's not really divorceable from being willing to take them on. After all, if you recognize that something is a problem and recognize that you can solve it - why wouldn't you? What's holding you back?

<comment><AUTHOR> I could solve problems that are extremely unrewarding to me. Some problems are very unsexy to most people. In order to tackle those problems you must be motivated by either extreme altruism, or a belief that your odds of success are high. The latter is probably unrealistic and irrational for most problems worth solving.

<comment><USER9> Some problems are also beyond most of our scope. Most people here think they're extremely smart. smarter than the average person. But all we really possess are superior technical skills. In reality, we just own a tool others don't. But solving those hairy problems requires special insight/research outside of technology. Having those technical skills(coding, design, user experience, etc) is just a pre-requisite and let's you into the arena.

</comment></comment></comment></comment></comment><comment><USER10> I disagree that the point of the article was to make the obvious point that hard work is unpleasant. Rather, I thought he was trying to illustrate that there are components of many tasks that are easy to discount the importance of. Instead of attending to certain details that seem pointless on the margin, or may have less obvious benefit, the focus may be placed on more mission- critical tasks. It's not that those other tasks don't require hard work; it's that it may be easier to place the focus on them because it's more apparent why they need to be done.

Perhaps, it would do everyone some good to focus on the things we suck at doing or can't see the obvious benefit to doing.

</comment><comment><USER11> One of the general failings of smart people is that they tend to breeze through school without ever trying very hard, and thus lack some of the necessary skills when faced with an arduous problem. This is probably what PG is getting at.

</comment><comment><USER12> "He makes it sound like he just invented faster-than-light travel, even though every person who ever ran a successful business can tell you this"

I don't think he wrote it for people who run successful businesses, but for other hackers. The thing is that as a hacker it does not seem unreasonable to possibly get away without doing unpleasant work. After all you enjoy programming, and most business tasks seem algorithmic. Your business is going to be making the computer work for you, hence no Schlep.

It really only makes sense if you consider the target audience.

</comment><comment><USER13> I respect PG very much. His past successes, YC, and his essays are great. He's not infallible though and I'm glad someone had the balls not just to put their disagreement in writing but to post it here on HN too. The author makes some good points and if the Schlep Blindness essay was written by anyone else there wouldn't be such a knee-jerk reaction to come to his defense like there is here. This community pays a lot of lip service to being the best, the brightest, critical and independent thinkers but then we all end up looking like hypocrites in situations just like this one. While there's no doubt that PG is am exceptional person I really think his celebrity and a ton of groupthink influences our interpretation of what PG says and how we react when someone doesn't fall in line to compliment him or do anything but disagree with what he says. I also shouldn't have to litter my opinion here with qualifications about how I think PG is great but without doing so I'll probably get bullied into submission via downvotes and various snarky comments. When the author of this article pointed out that the PG essay was basically telling us what we already knew while tricking us into thinking it were so profound the lightbulb went off in my head that inspired this. Anyway, we should all take what PG says like something any mere mortal would come up with. Some of its good, some not as good. Putting him on a pedestal impedes pour ability to think critically about the content of the writing and let it pass as high quality no matter what.

<comment><USER14> The two top-rated entries in the HN comments for PG's essay are disagreements, both stating that the essay is flawed. I'm not so sure the groupthink is really that bad here on HN.

</comment></comment><comment><USER15> And working at a start up isn't "dirty" work try working as as a sewer cleaner or a miner for example.</comment>


Contact Lens with embedded 1 pixel display - <AUTHOR> http://www.reuters.com/news/video?videoId=111810&videoChannel=6

<comment><USER2> As much as I would like a monitor display in my contact lenses, somehow I think the public will find other uses for it first. Prepare to meet people in clubs soon with really shiny (and animated) eyes.

</comment><comment><USER3> You can't focus your eyes when the display is so close, an "E" on the lens will look like a blur. So to get good resolution, you'll probably need a more focused light source, and you'll need voxels instead of pixels.

<comment><USER4> Another article mentioned that each pixel will have it's own microlens to provide proper focus

</comment></comment><comment><USER5> It looks like it's more than 1 pixel, since they talk about displaying an "E".

<comment> a-priori I think I can explain that. One thing that may be surprising about vision is that when you look at a scene, what you see comes from your memory of the scene (first iconic memory then visual short-term memory), not directly from your eyes. These memory buffers are refreshed from information received from the eyes, and most of that comes from the fovea in the middle of your field of view. That's where they placed the pixel.

(You do obviously get some information from your periphery, but not much. As an example, you are colour-blind in your periphery. The rods that detect light there cannot differentiate colours. If you see colour in your peripheral vision, that's because you remember the object being a certain colour from when you looked directly at it.)

The eye usually moves in jumps, called saccades. There are many other eye movements, but saccades are the most important for scanning a scene. While the eye is moving during a saccade, you receive no visual information. This is known as saccadic masking. That's important for making a device like this, because it gives the little chip a few milliseconds to do its business in peace.

Okay, so how do they make an "E" appear using only one pixel? My guess is that they have a small accelerometer on the chip that detects saccadic eye movements, then turns on and off the pixel depending on where the eye is pointed. As long as you can detect the start of a saccade, predict the target (acceleration is linear over short distances so at the midpoint it begins decelerating; at that time you've travelled half the distance and can predict the target), and refresh the pixel all in less than the duration of the saccade, you're set.

Because of saccadic masking, the person won't see any of this. In a series of these movements, the eye will scan the scene, detecting the edges of the "E", and from knowing where the edges are, the brain will reconstruct an image of the letter floating in space.

</comment></comment><comment><USER6> The Daemon is that much closer...</comment>