Ask HN: Which Monitor should I buy for long hours coding? - <AUTHOR>

Recently, I've been coding a lot on my 14" Dell Vostro Notebook, and I find it straining on my eyes.
I am planning on purchasing at least 23" Monitor, and I am having hard time deciding which one should I buy.
So please recommend which monitor should I buy, primarily for long hours coding. <comment><USER3> I don't name a specific model, because if you buy a monitor which is not the cheapest of the cheap it doesn't make that much of a difference, just a couple of tips:

First make sure you have a monitor with a quality panel - no TN. If its IPS or some S-PVA/P-MVA doesn't matter. Maybe take a look at different panels in a shop. I am personally very happy with my MVA-Panel monitor because of the good black levels. Try to avoid glare panels AND glare frames around the panel.

Next, make sure the monitor can be adjusted, not only in height but also tilt. I found that really useful adjusting the monitor to my seating position.

Regarding eye strain, the most common cause of this is setting the monitor backlight too high. Especially with LED backlights. Even in a normal lit room I only have set the backlight to around 10%. You may need to get adjusted to this first if you are used to normal settings (e.g. the default settings of the monitor which are always way too high), but for me it helped great deal with eye strain and headaches.

</comment><comment><USER4> Assuming your monitor is inside the range your eyes can focus on, if it's straining your eyes, you can try turning the brightness down, as well as using f.lux or redshift to reduce the color temperature from ~7500K to ~3500K. You might appreciate the low color temperature even during the day, as it's less blue light for your eyes to deal with.

</comment><comment><USER5> I'm not sure you are asking the right question. If you goal is to reduce eye strain which can lead to terrible headaches simply getting a monitor is not the total solution. I went through a few doctors and even an MRI only to discover accidentally that my new vision prescription and new phone/computer habits fixed it right up. You are getting older every day. This is what works for me, try it and see if it helps:

1) keep ALL screens at arms length from your face 2) code at night with a lamp on 3) 2x 27 inch displays (new toys!) 4) Look off into space here and there

I tried f.lux but I don't think it did anything for my sleep or eyes.

</comment><comment><USER6> For eyestrain, don't forget enough sleep, hydration, breaks, maybe reading glasses, f.lux, proper low glare ambient lighting, and astigmatism (get your eyes checked at Costco - cheap & no membership required).

Craigslist is your friend for trying out monitors before you buy, then buying one, of course. So, too, is taking your laptop to the local computer store and testing (if they'll let you) several sizes and shapes. I'm comfortable (sitting) with a Dell 24" appearing above my laptop screen. Standing, I haven't made up my mind yet.

Given buying another monitor now, I'd go with IPS as others have advocated here.

</comment><comment><USER7> Honestly, I am fine with any IPS display.

I also have taken the somewhat crazy looking step of getting some "prescription" (I have 20/20 vision normally.) glasses made with some light magnification +0.5 to +1.0 and are tinted 40% yellow. That way you don't have to mess with your monitor's color calibration, and it will filter the blues from any outside lighting as well. Also, it's pretty cheap, as you can order them for <$40 from most online eyewear places.

<comment><USER8> I recently got a pair of glasses with a slight tint and it does seem to make a big different. I went with slight grey tint since they are my everyday glasses, but I think any tint will probably help. I would also recommend an anti-reflective coating.

I also agree about the IPS monitor, they are much easier to look at.

</comment></comment><comment><USER9> This little app called f.lux ([http://justgetflux.com/](http://justgetflux.com/)) really helps with the eye strain problem. Use redshift ([http://jonls.dk/redshift/](http://jonls.dk/redshift/)) if you're on linux. Allows you to set the daytime color & can read from a config file.

</comment><comment><USER10> I tried the Dell Ultrasharp and sent it back - it wasn't crisp enough and I found that my eyes hurt after long hours of coding. I moved to the Samsung higher end model (which was $300ish at the time) and that was it - <USER2> great. I'm on an Acer G235H now and it's great - no eye trouble at all and I have very sensitive eyes.

</comment><comment><USER11> Move the screen farther away from your face.

Also, get a pair of very low-power reading glasses (+0.75 or +1). I use reading glasses while I work all day, despite not having any real "need" for them...they just make things easier on your ciliary muscles.

FWIW that was recommended by a retired optometrist friend of mine.

</comment><comment><USER12> I've had good success with the dell ultrasharp 27.

You can dock a retina to it and get full resolution.

</comment><comment><USER13> I don't know but don't buy DELL U2312HM, it was too bright even on low settings so it hurts eyes. Buy something that have a sensor that auto adjusts brightness.

</comment><comment><USER14> Light your work area with full spectrum light bulbs. Simulating outdoor light helps with eye strain. I can't code without them.

</comment><comment><USER15> Caveat: I'm an Apple Fanboi - but the 27" Cinema Display is like warm butter for your eyes.

<comment><USER16> I used the Cinema Display day in and day out for a long time, but then I got a retina MBP and found that it was hard switching back to the Cinema.

<comment><USER15> I'm in the same boat. I had fingers crossed at the last Apple event for a 4K Cinema Display.

</comment></comment></comment><comment><USER17> Dell Ultrasharp.</comment>


The Cognitive Dissonance Cluster Bomb - <AUTHOR> http://blog.dilbert.com/post/153080448451/the-cognitive-dissonance-cluster-bomb <comment><USER2> Well, both sides clearly can't be right.

If you look at Trump's actual policies, you'll see he wants to ban Muslim immigration, based on the results of an opt-in internet poll:

[https://www.donaldjtrump.com/press- releases/donald-j.-trump-...](https://www.donaldjtrump.com/press- releases/donald-j.-trump-statement-on-preventing-muslim-immigration)

So, his policies seem to be unconstitutional, racist, and based on dubious science.

I think must people voted for Trump because he had a great campaign, and as Scott Adams says he is a great persuader.

I infer from Adams' post that he thinks the anti-trump protesters are protesting based on beliefs rather than facts. However that's simply not true. The facts have been presented by Trump himself in the campaign promises on his website. I'm thinking that Adams himself might be engaging in some cognitive dissonance. What would be the reason for that? He's clearly highly intelligent, and understands that Trump is a great persuader. Could he himself have fallen for the persuasion? Or does he have some beef with Hillary which allows him to ignore Trump's nasty policies? (Again, more cognitive dissonance).

<comment><USER3> Playing devils' advocate, should we not reserve the right to screen immigration based on the ideology of those entering? Would it be ok to, say, deny entry to a Neo-Nazi supremacist wanting to immigrate from Norway?

<comment><USER4> Screening would be fine. Banning outright would not be.

And the screening must be universal. Not just based on whatever ideology used by violent extremist currently is.

<comment><USER3> I agree. The real question then is do we have enough information about individuals in order to screen on a case by case basis, and what rubric should we use to determine who should be screened out.

<comment><USER4> I've heard good things about Israel's security in this aspect. Has to be decent with all their enemies right next door instead of half a world away.

Unfortunately I'm not familiar with it or know if it would be viable.

Review publicly posted social media accounts for red flags, trained experts interviewing and talking to people.

Or just admit casualties from foreign terrorists are such a low risk and stop freaking out over it would be good too.

Cost spent on security should be proportional to lives saved in relation to spending on prevention of other causes of death to be honest.

How much do we spend on national highway safety (locally + federal) / lives lost in traffic fatalities * lives lost in terrorist attacks.

Don't spend more than that.

<comment><USER2> Even Israel aren't banning Muslims outright, as Trump says he wants to do.

For sure, some of his policies on immigration make sense. The problem is that he is at the extreme end of the scale, similar to UKIP, National Front, Wilders, etc.

People have legitimate concerns about immigration. Whether those fears are real or imagined, the government needs to do something to address them. When they don't bother, that's when the people get fed up and then elect someone who will shake things up. That seems to be what is happening in the UK and Europe at the moment.

</comment></comment></comment></comment></comment></comment><comment><USER5> A well reasoned and cogent argument. Yes, there's a lot of cognitive dissonance in the anti_trump world right now. But I think there's just as much on the pro-Trump side. he's already started furiously backtracking on many of his key policies which he swore he would implement, such as scrapping Obamacare, building a wall (now fence!) across the Mexican Border, and I'm sure many more to come. Who knows what his approach to Cuba will be, he's both told opponents of rapprochement to get over it because it's been 50 years after all, and also committed to burning down the agreement and pulling out US staff. So part of the cognitive dissonance for anti-Trumpers is we don't actually have any idea what the pro-Trumpers voted for, as against what they think they voted for. Other than 'Not Hillary'.

<comment><USER6> One working hypothesis is that he doesn't seem to really know what he believes - he's just in it for the sheer ego rush (as were probably many who pulled the lever for him), and will let his advisors and appointees take up the matter of implementing actual working policy.

The scary part is that most of these people (Thiel, Pence, Gingrich, Bolton, etc) know perfectly well what _they_ believe, and have been licking their chops at an opportunity gram the reigns of power, and execute on these beliefs at scale.

 _That 's_ where the damage is going to come from.

<comment><USER7> I'm sure he believes in giving himself and his kids 100s o f millions of dollars in tax cuts.

<comment><USER6> Right, there's always that part.

I just mean this, you know, abstract and political, "how to actually run the country" business.

</comment></comment></comment></comment><comment><USER6> _Those "facts" can't be reconciled in the minds of the anti-Trumpers. Mentally, something has to give. That's where cognitive dissonance comes in._

His operating premise seems to be: "If a bare plurality† of voters threw their lot for candidate/party/plebiscite X, then, _ipso facto_ , X cannot be considered dangerous or extremist." History instructs that this is a very dangerous axiom to hold.

† Leaving aside the popular vote / electoral college rift, for the purpose of discussion.</comment>


Dietary Fat Restriction Results in More Body Fat Loss Than Carb Restriction - <AUTHOR> http://www.cell.com/cell-metabolism/abstract/S1550-4131(15)00350-2 <comment><USER2> just another study on ketosis</comment>


Flipkart, Amazon of India, has sales of $100M in one day - <AUTHOR> http://www.livemint.com/Industry/TM8tDvrv3OfeYjeXkEPXZI/Flipkart-hits-100-million-sales-target-in-10-hours.html <comment><USER2> Most of the offers were sold out within seconds of the sale start, the servers kept crashing intermittently, items mysteriously disappeared from the cart just before payment, prices shown on the product page were silently increased when added to the cart, and to top it all off people managed to get screenshots of prices being raised to near 200% before a discount was applied and the items were sold for higher than normal prices. Reports are now coming in that most people who managed to actually buy something at bargain prices had their orders cancelled by Flipkart.

#Flopkart was trending on twitter through the entire day. Flipkart called this sale the Big Billion Day, and somebody registered bigbillionday.com and redirected it to amazon.in. Also for most items that were on 'sale' on Flipkart, the non-sale prices on Amazon and Snapdeal were lower than Flipkart's 'discounted' prices. All in all, a terrible PR nightmare for Flipkart.

Some coverage in Indian media and blogs:

[http://tech.firstpost.com/news-analysis/flopkart-twitter- moc...](http://tech.firstpost.com/news-analysis/flopkart-twitter-mocks- flipkarts-big-billion-day-festive-sale-236751.html)

[http://firstbiz.firstpost.com/corporate/from-flopkart- to-100...](http://firstbiz.firstpost.com/corporate/from-flopkart-to-100-mn- sales-how-flipkarts-big-billion-day-developed-103291.html)

[http://www.moneylife.in/article/from-flipkart-to-flopkart- in...](http://www.moneylife.in/article/from-flipkart-to-flopkart-in-one- bigbillionday/39017.html)

<comment><USER3> I am sure they weren't deliberately tricking the customers, instead it is their incompetence and immaturity showing up. They couldn't handle the commotion and steps taken to handle the load backfired (A completely made up example can be that they started the crashed servers but in panic forgot to apply the discount configuration). Disclosure: I worked at Flipkart. I felt that employees are immature.

<comment><USER2> I do agree that server crashes and products disappearing from the cart might be technical issues, they weren't able to handle (either from incompetence or other reasons).

But, if you go through my links, you will see that they were indeed deliberately tricking customers. Price tracking websites show that most Flipkart on-sale products' prices were hiked to double their original pricing and then discounts were applied. In one case, a printer was hiked from Rs. 10000 to Rs. 50000 and then sold at a 'discounted' Rs. 11000. Apart from this, they silently increased sale price when adding products to cart, and cancelled orders which people had gotten for bargain prices.

In addition, they also had numerous examples where their claimed discount percentage was not the one that was applied to the product. A discount of 3% was advertised as discount of 10%, 40 Rs off was advertised as 500 Rs off, etc.

All this has managed to completely put me off Flipkart. Prior to this I was a very happy Flipkart customer, and would preferentially order stuff from Flipkart even if it was available on Amazon for marginally lower prices. Even though I did not personally experience any of the Big Billion Day issues, the way Flipkart has handled this 'sale', has left me totally disgusted with them. I think, I'll stick to Amazon/Snapdeal from now on.

<comment><USER4> All the negative stories and tweets in the world won't make a difference. Their prices(that only they can offer at the scale they operate at) and marketing budget will nullify it as Walmart and Amazon have already proven in the past.

<comment><USER2> This would be true _if_ Flipkart did not have viable competitors. This is most definitely _not_ the case. Snapdeal is another Indian e-tailer and the global e-commerce juggernaut Amazon also has an Indian site, both of which offer cheaper prices than Flipkart on a vast majority of items.

When I can get the same product for nearly the same price from Amazon, Snapdeal and Flipkart, why should I go with Flipkart (in light of the negative stories)?

</comment></comment></comment></comment></comment><comment><USER5> For readers who aren't from India and wondering about the "festive season", the Indian festive season is different from US. The festive season is generally considered the period between two festivals Dussehra (triumph of good over evil) [0] and Diwali (festival of lights) [1]. In 2014, the Dussehra and Diwali fall on 4th October and 23rd October, respectively.

[0] [http://en.wikipedia.org/wiki/Vijayadashami](http://en.wikipedia.org/wiki/Vijayadashami)

[1] [http://en.wikipedia.org/wiki/Diwali](http://en.wikipedia.org/wiki/Diwali)

</comment><comment><USER6> I just received a well-crafted apology email "from the founders" (I'm guessing it's "on behalf of" instead of "from", but I might be wrong about that). It's interesting because it's quite long and aims to cover all of the problems that led to their failures yesterday.

The email to me communicates that they were just completely ill-prepared, which doesn't bode well for a company with growth aspirations. In a highly competitive environment, I can appreciate their frankness about the problems that they faced, but in truth, each one of them should have been tackled BEFORE planning such an event. None of the problems can be considered a surprise, and I think that they will have to do a lot more damage limitation to get consumers to trust their operations.

For those that don't have access to the email itself, I've dumped it in a Gist [1].

[1] [https://gist.github.com/kartikkumar/486208fa7aa3913b8932](https://gist.github.com/kartikkumar/486208fa7aa3913b8932)

</comment><comment><USER7> Yesterday was _flopkart_ not _flipkart_. Even I wanted to buy some offers in flipkart deliberately. But eventually, i ended up buying the same thing in Amazon.in. Since, the price of the thing is lower in _amazon_ than the _flipkart_ 's big billion day.

</comment><comment><USER8> [http://firstbiz.firstpost.com/corporate/full-text- flipkarts-...](http://firstbiz.firstpost.com/corporate/full-text-flipkarts- bansals-say-were-sorry-after-outrage-over-big-billion-day-103586.html) \- Apology from Flipkart

</comment><comment><USER9> To put that in perspective, if Flipkart has sales of $100M _every_ day of the year, at $36.5 billion, it would be half of Amazon's e-commerce revenue of $67.9 billion [0].

[0] [http://mashable.com/2014/05/08/amazon-sales- chart/](http://mashable.com/2014/05/08/amazon-sales-chart/)

<comment><USER10> I think you are looking at it from the economy perspective at current time. But in the long term, Indian market is going to grow and others are not going to grow at similar pace. The magic is in compound interest.

</comment></comment><comment><USER11> Isn't Amazon.in the Amazon of India?

<comment><USER12> To some extent, Flipkart.com:India::Amazon.com:USA is more accurate than Amazon.in:India::Amazon.com:USA.

Amazon.in is following a purely marketplace model i.e. only 3rd party sellers (which is unlike the Amazon we know in US). Whereas Flipkart has a large percentage of stuff offered by 'WS Retail', which is essentially Flikart itself.

<comment><USER13> Technically Flipkart isn't a Indian company as Flipkart is registered in SG. But since all its operations are in India you could say it serves India. Just like amazon.in which serves India.

WS Retail is now a separate entity not run by Flipkart anymore. It was sold last year.

This was mainly to bypass the FDI laws. So WS Retail is like a wholesaler.

So WS Retail is a seller technically. Also you cannot say they run on different models, Flipkart does have more than a one seller so the model is still the same as amazon. Flipkart just eats other sellers at times with the WS Retailer's discounts and stuff. Just like amazon?

If every legal aspect is off the table then Flipkart is running WS Retail and other sellers are at mercy of Flipkart's(WS Retail) listing price.

Also Amazon.in sellers are all Indian (brick and mortar stores)sellers, so theres that.

<comment><USER14> You know the founder of Amazon India is not an Indian but Flipkart's founders are Indians (born and living in India).

<comment><USER13> And do you know they worked for Amazon.com for few years to bring that model back to Indian market?

</comment></comment></comment></comment></comment><comment><USER15> I am a little bit proud that they use a framework I was involved in for a while: Padrino

[https://twitter.com/YogiKulkarni/status/183576477953036288](https://twitter.com/YogiKulkarni/status/183576477953036288)

</comment><comment><USER16> Flipkart heavily advertised for the campaign, spent lots of money. Also steep discounts for the products helped them to increase the top line. Amazon India got good mileage even though they havent planned much.

</comment><comment><USER17> This article has a few details on why this week was important for e-commerce sites in India: [http://qz.com/274278/the-real-reason-why-indias-shopping- web...](http://qz.com/274278/the-real-reason-why-indias-shopping-websites-are- at-each-others-throats-this-week/)

The incumbents from Silicon Valley may not have the Cultural understanding of the Indian market and the barriers to utilizing Large scale distributed technology platforms have never been lower.

I boldly (and somewhat foolishly) predict that as more and more Indians get online, get comfortable with spending online, there will be a huge wave of India focused sites that will become the next Billion dollar companies.

<comment><USER18> I've been a 11 year customer of Amazon US and a 2 year customer at Amazon.in. They certainly do get Indian culture. Amazon India isn't a bunch of white people from Seattle arriving en masse and setting up shop. They hired locally (including from Indian incumbents) and localized their operations to include stuff like COD, local language support etc. Amazon is well on its way to becoming as 'local' as McDonalds or Honda have already. Their capability to deliver in Tier II and III cities is already ahead of Flipkart for example. GMV is currently about 35% of Flipkart and I wouldn't be surprised if they overtook them in two years.

<comment><USER19> Last time I tried (guess it was last year), Amazon.in didn't have enough products I could buy. It was really looking like a family-run home business just went online (whereas flipkart was massive). Don't know if that's still the case.

</comment></comment></comment><comment><USER20> Alibaba sales $5.78 billion in 2013/11/11.

<comment><USER21> The scale of China can't be matched by any other single country. But considering India's past and present, this is the largest ever e-commerce sale pulled off by it's own local company which is a giant leap in it's struggling economy.

</comment></comment><comment><USER22> As we more westernised in our outlook, bigbillionday is something similar to "Black Friday" and deep discount on single day ....might do more for overall internet penetration....currently only 25% of Indians have access to Internet, which stands at 243 million , if this crosses to 340 million, That's a huge market growth of Internet users ...this will in the long term benefit everybody.....perhaps remove poverty of more than 500 million Indians.

<comment><USER4> Indeed, getting Indians to move from buying gold for no good reason to buying garbage for no good reason = progress to first world status.

<comment><USER22> I am just making point of "explosive growth of internet" might be the beneficiary ....in the process we might become more westernised...I don't mind that as long as it can remove poverty of 500 million Indians.....more than 200 million people live in abject poverty( poorest of the poor)...Internet penetration is known to uplift most people out of abject poverty...wish more Indians are online ...and the world will come and invest big billions...imagine both Europe+Usa = india market size..it's possible...but it takes effort and discipline..

</comment></comment></comment><comment><USER23> Apart from all the complaints about how the whole thing was managed,this marks as one big day for the e-com industry in the country. A lot of people had their first online purchange experience.A big step to target the next billion users maybe.

</comment><comment><USER24> How many orders got cancelled by Flipkart out of these $100M?

</comment><comment><USER25> Is that $100m USD or the Indian Rupee?

<comment><USER26> It's USD. A big deal I would say.

</comment></comment><comment><USER27> They had this huge campaign in news about the Billion sale. They really had good offers. I myself bought shoes and apparel.</comment>


Product Surge: A New Take on Agile Development - <AUTHOR> http://blog.highfive.com/product-surge

<comment><AUTHOR> As always, we'd love to hear thoughts and comments from other teams. Has anyone else done something like this?

<comment><USER2> Yep! We call it a Design Sprint, influenced by GV's approach: [http://techcrunch.com/2013/10/23/inside-a-google-ventures- de...](http://techcrunch.com/2013/10/23/inside-a-google-ventures-design- sprint/)

<comment><AUTHOR> Awesome, thanks for sharing that! Do you guys include the engineering team as well?

<comment><USER2> We don't really have an "engineering team" \- just a continuum from those who tend to focus on visual design to those who focus more on code. But yes, those who code are definitely involved.

<comment><AUTHOR> Nice! Well best of luck with what you're building :)</comment></comment></comment></comment></comment>


Researchers find weird magic ingredient for quantum computing - <AUTHOR> https://uwaterloo.ca/institute-for-quantum-computing/news/researchers-find-weird-magic-ingredient-quantum-computing

<comment><USER2> The following is a related paper by some of the same authors:

"The resource theory of stabilizer quantum computation"

[http://m.iopscience.iop.org/1367-2630/16/1/013009/pdf/1367-2...](http://m.iopscience.iop.org/1367-2630/16/1/013009/pdf/1367-2630_16_1_013009.pdf)</comment>


Design Principles Behind Smalltalk (1981) - <AUTHOR> http://www.cs.virginia.edu/~evans/cs655/readings/smalltalk.html <comment><USER2> > Natural Selection: Languages and systems that are of sound design will > persist, to be supplanted only by better ones.

I loved coding in Smalltalk years ago. Guess "better" turned out to be rather subjective...

<comment><USER3> No, it's just that this principle isn't true. There are a lot of factors that influence which languages and systems persist. Being of sound design is _a_ factor, but not the biggest one.

Take Javascript, for example. It's the top language on Github. Its not there because its everyone's favorite language, or because it's an ideal language for writing reliable software. Its there because its baked into web browsers. We're now starting to get full-featured reliable compilers into JS with sourcemaps and whatnot, plus things like webassembly. So it's becoming quite reasonable these days to write code for the web in a language that isn't JS and not feel like a second-tier citizen. But that hasn't always been the case, so people wrote a lot of JS out of necessity. And _that 's_ why it's at the top.

(I don't mean to riff on JS in this post. There are plenty of other opportunities for that. The language has improved over the years, and this is surely _part_ of the reason it's remained at #1, and _part_ of the reason why browser vendors didn't throw up their hands and try a different language instead. But the _main_ reason its at the top is because it's the language of the web.)

If SmallTalk were built into browsers instead of JS, then we'd all be writing SmallTalk. And it'd be blazing fast. And that has nothing to do with how sound its design is.

<comment><USER4> One turning point that saddens me as an ex-Smalltalker - at one point there were negotiations underway to have Smalltalk installed by default on all new Sun Workstations (this was back when Sun was a very significant player), but it fell through for financial reasons. Had this been the case, I'm sure Smalltalk would be significantly better known and more commonly used.

And as justinpombrio says above, that has nothing to do with how good or bad the language is.

<comment><USER5> Had not heard that, but this is truely heartbreaking. I still think that Smalltalk is the better language than most of the modern object oriented languages, and be it only that is is a bit more pure and its "successors" are too much a mix with other paradigms. Just thinking of Python - it is in a wide range of features equivalent to Smalltalk withtout being as consequent in the object orientation.

One could only dream of how nice the programming world would be, if Sun had pushed Smalltalk instead of Java. Ironically, Hotspot started its life as a Smalltalk VM and only when Sun took over the development was turned into a Java VM.

<comment><USER6> Actually, Sun tried to license Smalltalk from Parcplace to use in embedded devices. At that time Parcplace was quite happy to charge $3000 per seat and didn't make a reasonable offer to Sun, so the Oak (now Java) project was started instead.

To make things even worse, Parcplace merged with their main rival, Digitalk, which offered Smalltalks for PCs and Macs for $100 to $500. They promptly replaced those with "enterprise" products costing way more making it impossible for new people to learn the language except with toy implementations like Little Smalltalk and GNU Smalltalk (which later evolved into a very decent implementation). For some reason the nice Smalltalk/X (commercial, but free for educational use) only had a small niche in Europe.

Note that Sun already had a Smalltalk in the form of Self, but Java was created anyway and Sun decided to use it exclusively killing Self and Tcl (which spun off instead of dieing). Part of the Self group merged with a group researching Smalltalk with optional type declarations (Dart is the latest version of that) to create the company Animorphics to develop StrongTalk.

Meanwhile, the Pep project at Sun demonstrated that you could run Java on the Self VM and greatly outperform all existing Java implementations (which were simple bytecode interpreters). The Animorphics team did the same and showed off Java on their VM, which caused Sun to buy them to make this demo into the HotSpot VM.

</comment></comment></comment></comment></comment><comment><USER7> Everything in this article sounds very fine and agreeable to me. But can anyone actually point me to _use cases_ or _examples_ of the brilliance of Smalltalk? As it stands, it always leaves me feeling this is all very abstract/idealised...

</comment><comment><USER8> There is a lot that I like about Smalltalk. I think one of the most interesting ideas is that everything in the environment is written in the same language; that it's easy to use code from an installed package when you write your own code. I also like the idea that it provides its own GUI environment and IDE, making it easy to interact with and change the way things work.

I don't see myself spending more time working with Smalltalk, as it stands today. It's single threaded, which is fine for a lot of tasks but is (in my opinion) a poor fit for a GUI environment. Having looked around at projects like Pharo, it looks like the Smalltalk community may be moving away from the idea of Smalltalk presenting the whole environment for the end-user, instead providing one application (often one that presents no UI, i.e. a web application).

From a personal standpoint, I would be very interested in a Smalltalk-like environment that I could use to develop my own software and, hopefully, use to replace a lot of the smaller bits and pieces I use to get my work done. Perhaps it could provide an IDE that I could also use to replace Emacs (which I also use for mail) and an IRC/chat client I could use to replace Weechat (which I also use for Slack, Google Talk and Facebook Messenger).

I don't feel a great affinity for many of the tools I use daily (email, chat, calendar, etc.), in part because they are not easy for me to alter or improve. It's funny: Emacs is clunky and weird, but I stick with it because it's easy for me to add or change the way it works.

I wonder if a Smalltalk implementation that revolved around objects implemented as actors passing messages (as opposed to the direct calling of methods that we have today) would be more amenable to multi-threading, yet still retain the simplicity that Smalltalk enjoys today.

</comment><comment><USER9> A pity that Scratch is no longer written in Smalltalk. It was a natural move for a child to discover shift-click-R and progress from Scratch to Smalltalk hacking.

</comment><comment><USER10> Smalltalk is still a thing of beauty.</comment>


What if we reduced account creation to just an email address? - <AUTHOR> http://sefsar.com/post/66743902956/forget-about-social-logins-for-a-moment-what-if

<comment><USER2> What if? Then you have zero security.

<comment><AUTHOR> A confirmation email would be sent to the user, when they click on the link contained within they'd be directed to a page that would ask them to define a password.

It's about simplifying the on-boarding. The password doesn't need to be defined during the first session. Plus the email encourages re-engagement later that day.</comment></comment>


A Correction; Welcome to 51,254 (2000) - <AUTHOR> https://www.nytimes.com/2000/01/01/us/c-a-correction-welcome-to-51254-000005.html <comment><USER2> I don't think this should have been corrected. Now any reference to an issue number has to be corrected by 500, depending on whether it references an issue before or after the correction.

Other than correcting a number sequence error, this doesn't fix anything important.

<comment><USER3> That said, it doesn't break anything important, either, and it does bring the numbering in line with a major newspaper's understandable insistence on accurate representation of the facts wherever possible. The numbers could quite reasonably be construed as arbitrary identifiers, as you have. But to the Times, they are a statement of fact — i.e., a statement of how many issues have been published. You're right that it was silly to correct the numbering, but it was corrected as part of adherence to a journalistic culture that exists for un-silly reasons. So I appreciate the correction and find it pretty amusing.

<comment> another-one-off > That said, it doesn't break anything important

No, they clearly damaged something important - the uniqueness of each issue number.

If the issue number identifying a specific issue is not important, why have an issue number? They may as well label all their editions '1', and save ink. They already have thousands of editions that bear the wrong number; they can't fix that.

Indeed, I am suspicious that someone surely noticed the misprint in the weeks or months following when it was first made, then chose not to fix it for that exact reason.

<comment><USER4> I take issue with issue number being "important". Each NYT still has a much more useful unique identifier, which is the day it was published.

The issue number is probably entirely useless, but the reason to keep it around are historical. It's a neat thing that they've labeled all their issues like this, right from the start, and that they've kept up the tradition. Like quote from the linked article:

> ''There is something that appeals to me about the way the issue number marks > the passage of time across decades and centuries,'' said a memo from Mr. > Donovan, who is 24. ''It has been steadily climbing for longer than anyone > who has ever glanced at it has been alive. The 19th-century newsboy hawking > papers in a snowy Union Square is in some minute way bound by the issue > number to the Seattle advertising executive reading the paper with her feet > propped up on the desk.''

He's not wrong!

Not everything has to have absolute utility. Not everything has to be perfectly calibrated for storing in a database. Some things we keep around because of tradition, or because we're romantic creatures who sometimes appreciate things which have little practical use.

</comment></comment></comment></comment><comment><USER5> The importance of just giving each issue a UUID.

<comment><USER6> The date itself is already a universally unique identifier (provided there is never more than 1 issue per day).

<comment><USER7> Also naturally sortable if represented as YYYYMMDD, unlike default guids (unless specifically using sequential guid generator)</comment></comment></comment>


On the State of Pony - <AUTHOR> https://pony.groups.io/g/user/message/618?p=Created,0,,20,2,0,6182872&offset=0 <comment><USER2> For a bit of context on what is Pony: [http://www.ponylang.org](http://www.ponylang.org) . Are there any users of the language that would care to comment on using the language?

<comment><USER3> I've used it in a few personal projects. I've written some thing about it here: [https://bluishcoder.co.nz/tags/pony/](https://bluishcoder.co.nz/tags/pony/)

The two major things that I stumbled on when I first started using Pony was that there is no blocking constructs in the language and dealing with capabilities.

I've had exposure to memory safe languages using types before (ATS, Rust) so the Pony system of capabilities wasn't too difficult to understand once I was able to map them to things I was familiar with. Before that I struggled to understand why things weren't compiling. Now that things have somewhat clicked I'm pretty productive with the language.

Dealing with writing non-blocking code was a matter of thinking in terms of callbacks and promises - something familiar to a lot of Node programmers I suspect.

Once I got past those two things I find the language very nice to write in and easy to reason about the code. Sometimes I hit walls of struggling to work out why things aren't compiling and they eventually end up being the compiler showing me what I was trying to do would be unsafe due to data races, etc.

The language is still young though so definitely something to approach with a bit of understanding that things may break.

<comment><USER4> Interesting website.

</comment></comment></comment><comment><USER5> Does anyone have a short, paragraph or two summary of why you might choose Pony over Erlang/Elixir or Akka with Java or C#?

<comment><AUTHOR> Prerequisite:

You have the stomach for a relatively immature language

Re Erlang/Elixir the number 1 selling point would be if you need performance that you can't get from Erlang/Elixir.

Re Akka on the JVM, the number 1 selling point would be you want predictable latencies from your GC that you can't get from the JVM.

Along with those, you get a type system that enforces data-race safety which now that I am using Pony daily, is the #1 selling point for me.

<comment><USER6> Where does Pony's performance vis-a-vis Erlang/BEAM come from? The absence of dynamic typing? Better scheduler?

<comment><AUTHOR> There are a number of areas:

Most message passing on BEAM is done via copying. Pony can share the memory directly because the compiler enforces safe sharing via deny capabilities. You can only send 3 basic types to another actor:

iso -> mutable memory that you have the sole reference to val -> immutable reference. you can read but you can't write tag -> an opaque reference. good for sending messages to actors or doing identity comparisons

The type system certainly helps as well. It allows us to give LLVM hints on optimizations it can make. The type system also helps because we can do "dangerous but fast" things safely because we can prove they are safe in this instance.

Compiling to native code via LLVM is another area for performance wins.

That said, Erlang has over 20 years of rock solid production usage behind it and that unto itself is a quite a selling point. At this point in time, I'd suggest Pony to Erlang/Elixir users if they need more performance, otherwise, I'd stick with Erlang for now.

<comment><USER7>
      >  The type system also helps because we can do "dangerous but fast"
      > things safely because we can prove they are safe in this instance.

This is an area of some static type systems that I'm really interested in; it feels counter-intuitive at first. You'd imagine that flexibility is what lets you do the things you need to do to go fast, but in many cases, restrictions actually are. Cool stuff.

<comment><USER8> > _You 'd imagine that flexibility is what lets you do the things you need to > do to go fast, but in many cases, restrictions actually are._

Aren't you mixing up flexibility for the programmer with flexibility for the compiler?

The more restrictions the programmer has, the more flexibility the compiler has to change instructions and still produce the same results.

<comment><USER9> I think people tend to think that C lets you go fast because of the tricks it lets you get away with and how "close to the metal" you are. Which is partially correct, but C is also an obnoxiously hard language to optimize _because_ of the flexibility.

<comment><USER7> Exactly.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> > One of the first things we did was to introduce a Code of Conduct to put in > place rules for the community we sought to grow. A welcoming, thriving, > civil community is what will make Pony a success. The more welcoming that > community, the more people we will have driving Pony forward.

I honestly find a Code of Conduct _unwelcoming_ , as it indicates that it's very likely that what I write will be attacked due to my identity, and that I may at any time be written out of the community in a modern version of _damnatio memoriæ_ , even if I maintain a strict wall between my personal and professional lives (witness the people who attempted to shut down LambaConf because they disagree with Curtis Yarvin).

A Code of Conduct longer than 'be professional' is a signal that the community which professes it is hostile. They are, of course, free to be hostile; I am free to choose not to join them.

<comment><USER11> I think it is important to note that LambdaConf 2016 was successful. In organizers' own words, "It just means there is a space in this world for an indie conference that rigorously ensures professional conduct at the event, but leaves other matters at the door."

People who protested against LambdaConf 2016 organized alternative confrence MoonConf at the same place at the same time. Two conferences had cordial relationship. Nothing people worried about actually happened.

[http://degoes.net/articles/post- lambdaconf-2016](http://degoes.net/articles/post-lambdaconf-2016)

</comment></comment><comment><USER12> I am really interested in Pony. There are some exciting things about it. I'm hoping that bit syntax support from Erlang is implemented, possibly with support for recurring structures. Although, I wouldn't say that is strictly necessary if you can do some nice recursion on binaries.

</comment><comment><USER13> Thought it was about the Pony ORM (python)[1].

Perhaps the title should say "Pony Language".

[1] [https://ponyorm.com](https://ponyorm.com)</comment>


Ask and Show HN: Startups, do you have your integration tests? - <AUTHOR>

We (two of us) have been working on a solution to have some kind of integration tests coverage for everyone who is busy enough to be not able to focus on writing integration tests.
I know writing tests is good practice but many times due to time crunch we aren't able to get to it. For those of us, we have built www.pingsure.com.
We are also validating the market so we would love to know how many startups/established companies have their integration tests already in place? If not, then would you want them or you don't care.
The idea is simple. We write integration tests for you. We run them every hour on your production server and report in case broken.
One query could be, is it really needed to run against production? We think unless you have integration tests testing production site, you can never be sure whether a customer interaction is really working. Correct us if we are wrong.
We would love feedback and suggestions. We are looking for beta customers. <comment><USER2> No feedback on the product (I don't personally do any testing on the things you list since, well, they've never broken and if they did, customers would start emailing within a few minutes).

But I do feel obligated to ask that you kill that rapid scrolling carousel right now. I'm sure it looks right to you, since you know what it says. But to people reading, you can just barely find your context from the last time it scrolled out from under you and get one word further into the first sentence before it whips back out from under you.

Drop the timeout to 30 seconds so that people have a hope of reading it (I only know what those panels say because of Chrome's Developer Tools). Or better still, tear it out entirely.

Best of luck with the product!

<comment><AUTHOR> Thanks for the feedback. Will fix the scroller thing.

</comment></comment><comment><USER3> The difference between "X Testcases" and "Y Free Writes" per month is a bit confusing, but I think I understand what you mean.

My main concern would be that managing test failures (is it a real bug, or is the test just fragile to minor app changes) would be just as much work as having the tests in-house. Probably _more_ work, since I can't just look at the code. Your reporting/logs would have to be excellent and very detailed.

<comment><AUTHOR> Mostly, there are screenshots for each test case steps. Test cases aren't fragile. In some extreme cases we can tests only certain part which are more stable.

</comment></comment><comment><USER4> I'm not sure I like how you explicitly market it as integration tests. I'd just explain what it really does. It took me a bit to figure out that it targets testing website/webapp user-level interactions.

<comment><AUTHOR> I agree. Still learning the marketing part. I will definitely make it more direct.

</comment></comment><comment><AUTHOR> Clickable: [http://www.pingsure.com](http://www.pingsure.com)</comment>


XEmacs is Dead! Long Live XEmacs! - <AUTHOR> http://steve-yegge.blogspot.com/2008/04/xemacs-is-dead-long-live-xemacs.html

<comment><USER2> Also I don't quite get his desire to "live in" some giant all-in-one software package. I think it should be obvious now that Unix philosophy of many little specialized tools proved to be more flexible than uber-environments.

I am not sure if anybody here remembers, but back in the early 90 people believed that _"future belongs to integrated environments"_ , that's right - to IDEs and not just for programming. And now he's talking same thing again.

For those working for a web-services company (or living in SV these days) it may be natural to think that _"everything is in the browser"_.

But is it? I still can hear PG's voice from Startup School in my ears: _"Stop using the Internet please, my presentation won't open!"_

<comment><USER3> I've found that the specialized tools philosophy to be effective when building a, well a toolkit. Toolkits, if done well, are extensible and interoperable in ways that no 'integrated' system can be. However, There is a certain class of problem that doesn't really lend itself to the toolkit approach. This is the interface problem.

Vim is an awesome text editor, it is streamlined in a way most editors could only dream of. It's a very good text editor. Python is a very good language. One of it's nice features is that it comes with a REPL, so I can program in it interactively. Using a third program Screen, I run both side-by-side and pipe content between them. This is the toolkit at work, and it works very well.

However, there is a slight problem here. Each of these programs has a different interface design. Each has a separate key-binding scheme and different schemes collide. You have to learn three different interfaces and learn them well, to do this effectively. It would be nice if there was a program, similar to screen, that would stand between you and the editor and interpretor and allow you rebind and customize your keys and view ports so that they don't collide and are consistent. This program is emacs. It is the universal interface, a more flexible bash than bash, and people stay in it all day, not because they don't use toolkits, but because they prefer to use it to interface with toolkits rather than bash or some ill-conceived X monstrosity.

Emacs doesn't replace cvs/git, ls, grep, awk, gdb, gcc, python, rbi, cron... It mostly just provides a very powerful scriptable interface to all of them.

</comment></comment><comment><USER4> I was most intrigued by the thought of code editing as a serious part of Firefox. I don't know much about XUL, so I will need to read up, but I thought it would be quite sexy if I built an editor which binds to Heroku using the API. A local code editor extensible via javascript that works directly against the remote in-cloud data would be a pretty swift alternative to the Git approach.

</comment><comment><USER5> Honestly I'm a fan of good old gedit... but this makes a good case for trying emacs one more time.

I haven't really understood the appeal of the single, monolithic, do- everything editor up until this point, but looking at it from a self-modifying point of view does make it somewhat more appealing (and I need time to ingrain the key chords into muscle memory and learn some elisp).

I think the exciting idea was that of a the browser-as-editor. Where is the browser that acts as an editor and has all it's plugins written in javascript (as opposed to elisp)? Of course, once we had that, the next goal would be to replace bash with it... browser as terminal ftw.

<comment><USER6> FWIW, Elisp is _much nicer_ than JavaScript. It could stand to gain some features like static scoping and threading, but the "library" is so useful it's easy to ignore the linguistic flaws.

I'm sure an emacs-in-JavaScript would also have a good library, but let's face it... Lisp is very enjoyable to use. There may be more JavaScript programmers than Lisp programmers... but the same could be said for PHP, and I don't think anyone wants a PHPmacs :)

<comment><USER5> But you said in another comment here that you are an elisp developer... of course you are going to think it's nicer.

I'm not married to the javascript idea, I just suggested that because it's already used for a ton of other things in the browser, so it'd make sense to make the browser-as-editor extensible in javascript.

If we really want to make it from the ground up, it'd be nice if we could replace javascript with something like Scheme[1] (or Arc ;) as the de-facto client-side scripting-language in the browser.

My issue with doing it in elisp is that it's yet another special purpose language to use, and the web already requires three or four of them to get anything done as it is. I'm not scared of learning it, but if I am going to dream of pie-in-the-sky, I might as well dream of a world where one language gets things done on the web.

[1] I would suggest Lisp here, but honestly I got started with Scheme, and for some reason (purely aesthetic), CL just seems so ugly to me.

</comment></comment></comment><comment><USER6> As an elisp developer, I would like people to stop using XEmacs also. But the thing is, it seems like most of the more experienced extension developers are using XEmacs. I'm not really sure why, since I'm only active in the GNU emacs community... but there must be some reason. (I bet not having to sign copyright papers for every 10 line patch is one.)

</comment><comment><USER2> I just found myself, an avid vim fan, reading that whole thing to the end for some reason. Stevey got me again! :)

</comment><comment><USER7> I'm 1/4th of the way through this article and confused already... Steve writes:

 _I never managed to use XEmacs for very long, because it crashed a lot_

but then

 _XEmacs doesn't crash any more often than Firefox_

and

 _XEmacs may crash even less than Eclipse and IntelliJ_

For me Firefox and Eclipse are rock solid. So what is it? Does "a lot" mean every 6 months? Or every day?

<comment><USER3> Once or twice a week. Did you catch the part where he said he likes to maintain perpetual sessions? When you leave apps open indefinitely, they are more prone to crash I think.

</comment></comment><comment><USER8> You know wxPython has a widget that can render html. It's not full featured, but I was pretty amazed by it. There's definitely a lot of potential there...

</comment><comment><USER9> I have two major gripes with GNU emacs right now. THe mandatory signing over of papers and the lack of dynamic C library loading.</comment>


BlindBox: Deep Packet Inspection Over Encrypted Traffic [pdf] - <AUTHOR> http://iot.stanford.edu/pubs/sherry-blindbox-sigcomm15.pdf <comment><USER2> The fantastic thing about misguided research ideas is that they go nowhere, bearing endless publications over the years as terminology changes.

The _Internet_ is essentially the manifestation of the End to End principle. DPI is directly at odds with the Internet - if the functionality provided by DPI were actually beneficial to users, it would just be implemented as end- node software.

<comment><USER3> I'm not sure you're right about that. There are legitimate reasons to criticize this paper (its unclear, confusing security claims, for one) but the basic functionality they build can be used for an IDS, which seems beneficial to users to me.

<comment><USER2> A skim should clarify the security claims as much as needed - it's a complexifying of encryption schemes in order to accommodate third-party communications escrow.

Any communications-auditing regime relies on detecting and preventing steganography. This can be immediate successful, but is an endless escalation that should cause honest people (ie those who aren't trying to restrict communication) to focus on node security.

While an IDS can indeed benefit end users, its same functionality can be implemented as edge software - either on the nodes, or if worried about nodes being already compromised, then a separate "network processor" domain. The only point of needing a centralized IDS is the centralization - top-down control.

<comment><USER4> In line with the principle of charity I'd like to point out that your declaration here that network IDS provides only "minor cost savings" is controversial to the point of almost being aggressive towards folks working in information security. In the same vein, I'm simply disregarding the politically charged motive you assign to the technology.

If that was your intent (to start a political argument), then so be it, but if instead of picking a fight you would like to understand the problem space better there are plenty of smart folks on HN and elsewhere who can provide use cases and data ... to say nothing of vendors who will argue from either side depending on what they are selling.

hth, adric

<comment><USER2> Well, I removed "minor cost savings", because even that is being too charitable. Silicon is cheap, and it wouldn't take much of it to create a separate network processing domain on each node, which would perform all the functions of an IDS on _cleartext_ , but working for the node's owner rather than whomever supplies them network transit. It's also better security with regards to heterogeneous nodes, telecommuting, unenumerable Internet links etc.

Information architectures can't help but being simultaneously technical and political. The original "End to End principle" came out of utterly technical concerns. But codified into a principle, it becomes "political". This is inevitable, because the drawbacks of poor engineering aren't felt _immediately_ , and in fact can be quite beneficial in the _short term_.

There are of course plenty of vendors selling top-down "security". Right in this paper, they say "the market for such DPI devices is expected to grow to over $2B by 2018". Power tends to centralize until it _collapses_ , which is why we as individuals must work to rebuke such trends.

</comment></comment></comment></comment></comment><comment><USER5> What if the attacker can inject a string that causes a rule match and enables "probable cause" decryption?

Also, MITM attacks against vanilla TLS can be detected by endpoints. That doesn't seem be to the case here, so it makes the trusted third party problem even worse.

I'd reject anything based on this concept.

<comment><USER6> Also, lets say it detects a 'malicious string' what happens then? Can you force a new handshake with your root CA now as the signer in the middle of a request? I'm not positive but I don't think you can without having the root certificate to begin with. Then what do you do? Just allow the connection to timeout? Sounds pretty bad from a usability perspective.

> Some existing systems mount a man-in-the-middle attack on SSL by installing > fake certificates at the middle- box. This enables the middlebox to break > the security of SSL and decrypt the traffic so it can run DPI. This breaks > the end-to-end security of SSL, and results in a host of issues, as surveyed > by Jarmoc.[0]

That slidedeck they cite also notes a number of issues with middleboxes that are unrelated to decrypting the traffic. If the middlebox does not have a fully updated cypher suite then it can essentially do a downgrade attack on all of it's clients. Many of these middle boxes in the past have been found to do boneheaded things like accept self signed certificates as well. A mess all around. I say sandbox the browser and be done with it.

[0][https://media.blackhat.com/bh-eu-12/Jarmoc/bh- eu-12-Jarmoc-S...](https://media.blackhat.com/bh-eu-12/Jarmoc/bh-eu-12-Jarmoc- SSL_TLS_Interception-Slides.pdf)

</comment></comment><comment><USER7> This work is well known in the crypto research circles. Raluca Popa, now a professor at Berkeley was the lead for cryptDb, an encrypted SQL database that can still execute queries.</comment>


At Theranos, Many Strategies and Snags - <AUTHOR> http://www.wsj.com/articles/at-theranos-many-strategies-and-snags-1451259629 <comment><USER2> > _In April 2014, she got a long email from another employee. The employee > alleged that Theranos had cherry-picked data when comparing Edison machines > to traditional lab machines to make the Edison look more accurate, according > to a copy of the email._

> _For one test, the device's accuracy rate increased sharply after some > information was deleted and manipulated, the employee wrote. Edison machines > also allegedly failed daily quality-control checks often._

> _Ms. Holmes forwarded the email to Mr. Balwani. He replied to the employee, > who no longer works at Theranos, denied all the claims and questioned the > employee's understanding of statistics and lab science._

Oh man. If you read through Theranos' reviews on Glassdoor [1] this anecdote seems totally legitimate. Multiple reviews talk about the toxic culture and how management does anything to cover their behinds. Quite a few of these were written before the scandal broke so I think they're quite honest about what's going on.

[1] [https://www.glassdoor.com/Reviews/Theranos- Reviews-E248889_P...](https://www.glassdoor.com/Reviews/Theranos- Reviews-E248889_P6.htm?sort.sortType=OR&sort.ascending=false)

<comment><USER3> Glassdoor actually removed a few of the more scathing negative reviews about working there. I think Theranos advertised on Glassdoor so they removed some of the even worse reviews... there used to be some even more negative ones.

<comment><USER4> So I was on Glassdoor just yesterday and saw a little note "Your trust is our top concern, so companies can't alter or remove reviews."

Is that just a flat out lie?

<comment><USER5> It's not a lie but it's not necessarily the whole truth. Companies can't alter reviews, but Glassdoor definitely can and does. We just don't know what criteria they use.

<comment><USER3> Glassdoor seems like it has the same business model as yelp- "Buy our advertising and we will make your good rankings rank higher and your worse reviews be filtered or lower."

Maybe not outright extortion but certainly not what they claim of being a truly independent forum.

<comment><USER6> That allegation against yelp has never been proven. I'd be surprised if either yelp or glass door is outright deleting reviews for money.

<comment><USER7> What would you consider a proof? does a a sales rep asking her friends to post fake negative reviews count?

[https://www.youtube.com/watch?v=C67Lh4LE5LY](https://www.youtube.com/watch?v=C67Lh4LE5LY)

<comment><USER6> The fact that they need to have friends post fake reviews suggests to me that this is not sanctioned activity or a systematic fraud.

An environment where salespeople feel they can do stuff like that is a problem, but no, it is not proof that "yelp deleted bad reviews for money"

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I wrote a parody of Theranos as a TV pilot that is increasingly becoming true: [http://www.pricks.com/](http://www.pricks.com/)

(I'm sharing this here because the Hacker News community seemed to enjoy my Season 3 premiere of Silicon Valley [[https://news.ycombinator.com/item?id=10179894](https://news.ycombinator.com/item?id=10179894)], but apologies if others feel it detracts from the discussion.)

<comment><USER3> I was just thinking that someone needs to write a novelization of this Theranos nonsense & turn it into a screenplay and voilà:- Silicon Valley's "Wolf of Wall Street" or the next "The Social Network" ... I'm sure someone is already writing it up.

<comment><USER9> I thought Arrested Development has been parodying the tech scene well.

Seasons 1-3, which aired during the Bush era, showed the lives of incompetent and corrupt property developers + military contractors.

Now the main running gag is a BS non-existent app.

<comment><USER10> Don't forget what Parks and Rec did in it's last season. We've seen a lot of great comedy about tech recently.

</comment></comment></comment></comment><comment><USER11> No matter how this story ends (whether they eventually ends up with having a fully functioning product or not) this should be a cautionary tale to anyone wanting to actually change the world in healthcare.

Science speaks for itself and does not care how much you raised at what valuation. It requires a rigorous approach to testings and facts and data or it will be merciless if you aren't living up to your own claims.

So hopefully next time someone has a great disruptive idea in healthcare, they will spend a little more time getting the science and tech right before they start worrying about becoming a unicorn.

<comment><USER12> It is a common, romantic view of how science works - but it is only compatible with reality on a 30-50 year timescale, and probably only because of survivor bias.

The science of Dan Shchetman, J. Robin Warren, Barbara McClintock and many others spoke for itself, and for a long time "science" essentially didn't listen. I put "science" in quotes because "science" doesn't speak or listen - scientists do - and the scientists shunned those luminaries (eventually to recognize them with one of the highest honours - the Nobel Prize).

Warren had to use himself as a test subject for others to notice. Shechtman was a cast out for years (and then it turned out that he wasn't the first to notice 5-fold symmetry - he was just the only one for a long time to insist it's real; the other "scientists" who noticed it cared too much about their status, rather than the science). McClintock was shunned by her peers and essentially lost her job -- though evidence for how badly she was treated by "science" for her radical ideas (now mainstream and assumed true) is being whitewashed.

I keep wondering how much progress we have lost because "scientists" (unlike "science") does care how much you've raised, how much you've published, and who your friends are.

> anyone wanting to actually change the world in healthcare ... Science speaks > for itself

The belief that modern healthcare is nothing but the application of science is also romantic and misguided. In the US, healthcare is a business and not even a free-market one. It is informed by science, most definitely. But e.g. no doctor will recommend the single most effective treatment for type 2 diabetes early in the disease[0] (calorie restriction whether directly, by direct fasting or intermittent fasting). In fact, it turns out that the American Diabetic Association recommendations are the everything _but_ science, and possibly the worst you could do.

[0] - [http://www.theguardian.com/lifeandstyle/2013/may/12/type-2-d...](http://www.theguardian.com/lifeandstyle/2013/may/12/type-2-diabetes- diet-cure), see [http://www.ncl.ac.uk/magres/research/diabetes/reversal.htm](http://www.ncl.ac.uk/magres/research/diabetes/reversal.htm) for references

<comment><USER13> I agree that good science often doesn't get recognized because it happens to rub some established scientists the wrong way.

However, the issue with Theranos is the opposite: it _is_ getting recognized, even though we don't know whether it's good science or not, because there isn't any visibility into what they do and how they do it. The scientists you mention all published their work for the world to see; they didn't hide behind "trade secrets".

 _> The belief that modern healthcare is nothing but the application of science is also romantic and misguided._

I agree with this too; but again I don't see how it applies to Theranos, because they are explicitly claming that what they are doing _is_ science. So they should be judged by scientific standards, even if the rest of the health care industry can't live up to those standards.

<comment><USER12> I was not remarking about Theranos, but rather to ThomPete's statement.

Rigorous science is not sufficient (e.g. the Shechtmans/Warrens that we don't know about -- it is pure hubris to believe that all those were eventually vindicated), nor is it required (e.g. Vioxx, Thalidomide, ADA recommendations, baby peanut allergy recommendation, dietary cholesterol recommendation, dietary sodium recommendation).

If Theranos is a lesson to entrepreneurial scientists it is probably: "Don't waste your time failing quietly and cheaply, when you can fail extravagantly and retire rich"

<comment><USER11> Not sure what you mean.

Their product is scientific. It's not just a health app or some nutriment recommendation which can be claimed successful without any scientific claims to back it.

Theranos has a very a scientific product with a binary output and so it's claims will stand up to that (i.e. being approved by passing a number of tests)

My lesson was for those who wanted to change the world via healthcare, not those who wanted to get rich.

<comment><USER12> > Their product is scientific. It's not just a health app or some nutriment > recommendation which can be claimed successful without any scientific claims > to back it.

So was VioXX[0]. Read the Withdrawal section, especially the last paragraph. As someone who was following the case closely while it was happening, I can tell you that everyone involved looked guilty as hell, even though the court found only the marketing people "overzealous".

You see, "science" doesn't lie. But scientists do. Some liars are better than others, though.

Also, the standard US medical advice about things like nuts that might cause allergy are "delay introduction as much as possible" (e.g., do not introduce peanuts before age 3 or so, for fear of allergic reaction). You will hear this from doctors and find this in official manuals, although there is no science to support this (never was), and in fact, there's data indicating that early exposure to nuts reduces allergy.

> Theranos has a very a scientific product with a binary output and so it's > claims will stand up to that (i.e. being approved by passing a number of > tests)

Output is not binary. Most (often all) data used to evaluate medical products is provided exclusively by manufacturer, who is able to massage data to yield specific desired results, see e.g. VioXX.

> My lesson was for those who wanted to change the world via healthcare, not > those who wanted to get rich.

Well then, they shouldn't look to Theranos - those guys obviously care more about getting rich than about changing the world (well, changing the world for the global good, anyway).

[0] [https://en.wikipedia.org/wiki/Rofecoxib](https://en.wikipedia.org/wiki/Rofecoxib)

</comment></comment></comment></comment></comment></comment><comment><USER14> Does the composition of Theranos' board strike anyone else as very weird? It seems much more like the board of a foreign policy think thank than a biotech start up. There are three former cabinet secretaries (state and defense), two former very senior military officers, two former senators (one regarded as a foreign policy expert), a bigshot DC lawyer, and the former CEOs of Bechtel and Wells Fargo. The only physicians are former Senator Frist and a very credentialed epidemiologist, but it's not clear to me that either would have much knowledge about laboratory testing.

I'm really curious what the rationale for this board composition is. [Edit: I'm curious if this is connected to Holmes' father's experience in the foreign policy establishment]

<comment><USER3> I think they wanted a bunch of Washington power players because their real money grab was pushing regulation changes so that patients could go and do their blood tests themselves, without a doctor's order. Surprisingly, they were actually successful in getting this passed in 1 state already- Arizona. If they were able to push that through it would be a HUGE gamechanging cash cow, because people could either self pay or even try to get Medicare to pay for it if they wanted to run their own bloodwork without seeing a PCP and getting an order.

Physicians groups, insurance companies and biomedical ethics groups aren't really hip to this idea because patient self-testing bloodwork may open pandoras box to a lot of unnecessary expenses, especially if the patient is trying to bill this through their insurance. False positives can and do happen, and they lead to unwarranted appointments, specialist visits, exploratory surgeries, etc. Other reasons physician groups are opposed to it is because they view it as profiting off people who are hypochondriacs, and a huge amount of the customers would probably be drug abusers and steroid users. Most likely, people who would go and do their own blood work are the system's "super ultilizers" and they are the ones who are already costing the insurance companies and the states $3-4 million per patient per year in healthcare expenses. It's not uncommon to have a fibro/rheumatoid arthritis/hypochondriac patient who bills $10 million per year. If these people go to the ER and cost 3k per visit every time they can't fall asleep and have anxiety (~12x per month), imagine how often they might want to go and run their own bloodwork.

Not being able to order our own labs as patients is the reason there are moral objections to for-profit hospitals selling "full body scans" and dermatologists doing unwarranted full body mole checks. Generally the proper guidelines is to only administer testing when you suspect that something is wrong.

<comment><USER15> Will you please link to a source for the $3-4 million per patient per year figure or the $10 million per year figure for certain diseases?

<comment><USER3> It's just from what I see at work, we're consultants who do strategic case management for high acuity cases- patients who spend more than $3million per quarter (or whatever levels that specific client establishes with us) get kicked over to us.

I'm working with a guy right now who has a blood clotting disease and his meds alone are $800k yr before all the inpatient stays and procedures.

Generally once the patient starts spending and hits certain level of cost they get assigned a case manager through their insurance to 1. see if they're getting proper treatment 2. try to streamline them to the correct care first (rule out needless and repeat visits) 3. make sure all procedures and drugs are medically necessary. The people that go beyond these case managers sometimes go to a different organization for medical management.

Some states are getting even more strict, in Alaska right now if you have Medicaid and go to the doctor too much for what they view as needless visits you actually get cut off from ALL providers and then can only see certain approved providers for certain approved types of visits, can only get prescribed specific drugs and you have to "graduate" from that program after a year in order to get out of it by keeping ER visits to less than 1 every 6 months. I'll try and find you a link with more info about that program but they're trying to keep it on the dl because obviously all the patients who get put on that program are pretty outraged & they don't want the bad press about it, the perception of denying care etc.

Also everyone in the AK medicaid who is on opiates has to abide by a "pain contract" including random drug testing and med count checks and if they screw up too many times they will get banned from certain doctors/facilities, put on a stricter program (like the above) and can get kicked off Medicaid. Unfortunately this just leads to more homeless heroin addicts, so I can't really say that program has been a success.

Edit: link [http://www.adn.com/article/20140703/state-aims-curb- overuse-...](http://www.adn.com/article/20140703/state-aims-curb-overuse- emergency-rooms-some-medicaid-patients-0)

<comment><USER15> Thanks for the expanded answer! I found it hard to believe because I was remembering when most insurance had a lifetime payout between 1 and 5 million, but of course that was pre-ACA and never relevant to Medicaid.

</comment></comment></comment></comment></comment><comment><USER16> I like how Holmes' recollection of meetings is always different than the other attendees. Only one machine had an error message, not all three. She didn't abruptly walk out of the meeting. She didn't refuse to answer a question due to "trade secrets". And so on.

<comment><USER17> Every article I read about this company sounds like a recap of Rashomon. No two participants ever describe the same events.

</comment></comment><comment><USER18> Interesting, Theranos' funder's behavior is what you would expect from someone who knows nothing about Science:

\- make bold claims

\- avoid going into details ("trade secrets", sheesh)

\- make investors believe in your "vision"

\- give talks about successful entrepreneurship to polish one's image

And still nothing reliably demonstrated.

What amazes me the most is how clueless investors are. If they don't care about Science, what do they care about when it comes to providing new Healthcare solutions? What's next, a new take on homeopathy ?

<comment><USER19> > What's next, a new take on homeopathy ?

Not too far off, actually:

[http://blogs.sciencemag.org/pipeline/archives/2015/12/04/and...](http://blogs.sciencemag.org/pipeline/archives/2015/12/04/andreessen- horowitzs-first-move-in-biopharma)

<comment><USER18> Hehe, I really like Derek's sense of humor:

> A few billion years of blind evolutionary tinkering gives you a mass of > insane, irrational, tangled interwoven systems with no documentation in > sight. Crazy new things keep getting uncovered all the time (siRNA! Who > knew!), and the number and scope of the crucial things we have no clue about > is just another one of the things that we have no clue about. If your > worldview has been formed by using human tools to make human-designed > applications for humans, you are in for quite a shock.

</comment></comment></comment><comment><USER20> Many in SV find it hard to grapple with traditional startups not penetrating health care to a greater degree; in Rise of the Robots (one of the Financial Times and The Economist books of the year) it's lamented for an entire chapter.

Traditionally the level of fundamental research and development displayed by Theranos - in areas of health or national defence - are done for years behind closed doors and then slowly rolled out to the public to mitigate any questioning of the underlying tech since the standards are understandably higher (i.e - it has to work from the start). This stands in contrast to the "move fast, break things" attitude pervasive in start-up culture.

I don't think there's anything necessarily fraudulent about Theranos, from what I've read, which seems to be the not-so-subtle undercurrent in much of the commentary. Rather they flipped the model startups should use in health, which is establish a business model that works and then work on preparatory tech in the background until it's ready to be rolled out. This seems to be largely what Theranos has done, but not what it's purposely chosen to articulate to the public and investors as it surely would have garnered less attention/funding. At this point Theranos seems to be playing the waiting game; waiting for their technology to reach a point where they can make a more transparent case for their business model and change the narrative once they've reached a point that's more aligned with the aspirations that have been articulated by Holmes for the past decade.

Once again, Peter Thiel's approach with Palantir looks to be extremely well executed and one that perhaps Theranos should have emulated.

<comment><USER21> Thing is, the approach your describing is fundamental dishonest... Leading investors to believe that you have technology that will be ready in 2011 when in reality you expect it to be ready in 2016 is not flipping a start up business model... It's just lying to get investor money

<comment><USER20> The latter half of that paragraph is articulating what I think Theranos is currently doing, not what I think they should have done.

What I said they should have done is described to their investors the business model that would act as a stop gap measure (gain market share and revenues by using existing technology) while allowing them to develop their proprietary technology to a point where it can get regulatory approval and can replace the already existing tech they're currently using.

> Leading investors to believe that you have technology that will be ready in > 2011 when in reality you expect it to be ready in 2016 is not flipping a > start up business model... It's just lying to get investor money

I've not seen any indication that rounds were predicated on certain delivery dates of the tech (what tech? what is the "success" percent? can the tech be augmented with more traditional tools?). If terms did get that specific, then there would be grounds for potential fraud.

</comment></comment></comment><comment><USER18> > Sunny Balwani is an entrepreneur and a computer scientist. Sunny joined > Theranos after dropping out of the Computer Science program at Stanford > University. He received his MBA at UC Berkeley and undergraduate degree from > UT Austin.

Honest question, can you claim to be a Computer Scientist if you drop out from a computer Science program ? To me it sounds like calling yourself a Doctor after dropping out following the first year of Medicine Studies.

Needless to say, this smells of arrogance more than anything else.

<comment><USER22> Sounds like he dropped out of a graduate degree from Stanford. If his undergrad degree from UT Austin he might have a plausible fig leaf to go around calling himself "a computer scientist". Though I certainly wouldn't call somebody who with just an undergraduate degree a "scientist" in any field unless they've proven themselves by practicing such science in a credible manner for a reasonable period of time.

<comment><USER23> I prefer an operational definition: a scientist is somebody who does research using the scientific method. But then again, this eliminates a bunch of CS people, since they're mostly doing math and engineering.

<comment><USER22> Me too. Hence the "practicing such science" part in my comment. University degrees such as Master of Science/Doctor of Philosophy etc. are meant to provide validation from universities that the holder of such degrees has had some training in the discipline but it's by no means a requirement to be a scientist (Leonardo da Vinci certainly didn't have a PhD).

<comment><USER18> In theory, yes. But when it comes to highly specialized topics, there are a number of things that are very hard to learn on your own (at least for now) without going through an academic path. Chemistry, Biology, pretty much require hands-on experience as part of your education - and you can't do that kind of things from home or simply by reading books.

<comment><USER23> You can teach an 8-year kid the scientific method so they can "do science" with household chemicals. Probably they won't discover anything novel, but assuming they don't look at the internet it will be new to them and that's the important bit: reasoning about truth on the basis of experimental observation.

</comment></comment></comment></comment></comment></comment><comment><USER18> > He replied to the employee, who no longer works at Theranos, denied all the > claims and questioned the employee's understanding of statistics and lab > science.

> Quality-control failures were due to the "newness of some of our processes, > which we are improving every day," Mr. Balwani wrote.

> He added: "This is product development, this is how startups are built." The > reply ended with an edict that the "only email on this topic I want to see > from you going forward is an apology that I'll pass on to other people."

I would rather question Balwani's understanding of Lab Science and Statistics as someone who has never had a remote experience of lab science in the first place. And about his understanding of Statistics, I have no idea where he thinks he has any authority either. MBAs are not particularly known to be very good at grasping probabilities.

</comment><comment><USER24> I'm honestly getting kind of annoyed with seeing stuff about Theranos, since everyone writing about them is beating about the bush, and only ends up describing how Theranos communicates with a startling lack of earnestness.

Example from the video, paraphrased:

Mod: "What prick tests are you _able_ to do, using no commercially available lab equipment?"

Holmes: "[lots of waffling] We're currently only doing the Herpes test. [proceeds to not answer the question]"

Mod: [accepts the non-answer and moves on]

This kind of reporting is entirely useless, unless it's some kind of attempt to subtly out Theranos for being dishonest.

<comment><USER25> A media interview is not a police room interrogation, nor a courtroom cross- examination. The interviewer (most probably) realises the question has not been properly answered but understands that they have to keep the interview moving. Also, if they go in too hard, it can have a backfiring effect of causing the audience to start sympathising with the person being interviewed (even though that person is clearly waffling and dissembling).

The interview is still effective in that hard-headed people watching the interview who need concrete answers and actual information will still draw their own (likely negative) conclusions.

<comment><USER24> Yeah, i understand that interviewing follows specific rules, since it's a realtime setting. However, what i failed to make clear in my original post: The mentioned exchange is not addressed seriously in the article either.

</comment></comment></comment><comment><USER26> For awhile, I kept seeing job posts at Theranos, which is how I know the name. I didn't know whether they were expanding or just had high employee turnover. The WSJ articles and the strange Glassdoor reviews (either totally love the company and CEO or extremely negative about the company and its ethics) leads me to believe that the WSJ is correct. The latest article with the video interview of the CEO, makes me think that she is incredibly smooth at spouting the BS, to the point of being a pathological liar. This company will be VERY interesting to watch during the coming year.

<comment><USER27> I'd be interested to be the results from a bot monitoring/archiving the Glassdoor page. I'm sure Glassdoor has some ability to audit or approve the review statements before they posted publicly which would provide some degree of damage control, but given the negative reviews it seems some would get through.

</comment></comment><comment><USER28> Theranos = Pets.com of this decade's bubble, which will once again be defined by founders, often young ones, having no clue what they are doing.

Investors can you please get better at realizing that sometimes experience and know-how can help?

<comment><USER29> Should they get better at that? I mean, I'd like them to. But they're after return, not virtue or value.

I can certainly say I don't like what they're doing, but I'm not sure I can say that they won't make money on this.

</comment></comment><comment><USER30> As the article says, "blood tests sometimes provide life-or-death answers." If these allegations of fraudulent testing are true, then the executives belong in jail.

</comment><comment><USER31> The key questions that needs to be addressed, is how homogenous or heterogenous are blood markers at the level they want to measure at? The machines may be reporting results accurately, but a pin-prick-sized droplet may simply not be a large enough sample size for the tests they want to run.

<comment><USER32> >prick-sized droplet may simply not be a large enough sample size for the tests they want to run

This was always the main criticism of Theranos. Finger-stick blood tests have never been considered reliable for clinical diagnostic tests because you don't get enough blood and the blood you do get can be contaminated.

<comment><USER33> How does the blood become contaminated?

<comment><USER17> For one thing, it's almost impossible to get your skin perfectly clean. Any test that uses a single drop of blood will be very sensitive to even the slightest amount of soil or contamination on the fingertip where the drop is extracted.

<comment><USER33> Couldn't this be alleviated with a finger prick method that prevents the droplet from sitting on the surface of the skin before it is collected? (i.e. a tiny needle that reaches below the epidermis to extract a drop of blood)

<comment><USER34> The needle breaks the skin and moves through any contaminants that were on the skin's surface--potentially mixing the contaminants with the sample regardless of whether the blood sits on the surface of the skin or not.

<comment><USER35> Isn't it common practice to wipe the skin with a disenfectant to prevent this very thing? A 60-70% alcohol-based solution will kill the vast majority of germs on the skin.

<comment><USER34> Contaminants don't have to be alive to confuse results. Also many contaminants we're talking about were never alive in the first place.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER36> Holmes' backstory is getting so redundantly covered. It's like how every Superman movie has to walk us through how he was sent to Earth when Krypton was destroyed.

I suppose if the author didn't talk about Holmes' history, though, they wouldn't have half the damn article. Certainly nothing interesting to talk about with that company by itself, were it not for the headline grabbing founder.

That said if I read about how this "inspiring" person dropped out of Stanford when she were only 19 one more time I might lose my mind.

</comment><comment><USER37> How can I short Theranos?

<comment><USER38> I suppose you could go long LH and DGX. They might outperform if a potential major competitor fails to make an impact.

</comment></comment><comment><USER39> It's a long shot gamble funded by some people who maybe should and maybe shouldn't know better - I don't pretend to be in a position to judge the science in this case. So, who cares? I don't mean that in a derogatory sense, I mean it in the sense that you might set yourself a limit of a few hundred pounds for a game of poker one night. If it pays off, great. If it doesn't, no biggy. If they're committing fraud, then there are regulatory mechanisms in place around that - how far you trust those is an issue, but it's a much larger issue than one company.

The big sin that you mustn't commit, and that many do anyway, is to trust a private company's data where a potential conflict of interest like this exists. Run your own trials.

</comment><comment><USER40> though not yet proven, I believe we may have found the Enron of our decade

</comment><comment><USER41> The company's name sounds vaguely like "tear anus". What did they expect?

</comment><comment><USER42> Is it just me or WSJ increasingly is behaving like apologist for big business?

They probably always were, just now I am noticing.</comment>


Ask HN: Google Cloud Services Down? - <AUTHOR> https://status.cloud.google.com/summary<p>Seems like there are multiple problems happening on Google Cloud today. Is this common? <comment><USER2> I wouldn't say it's common, but I've seen GCP outages more often than AWS and Azure outages.

<comment><AUTHOR> I moved over to GCP from AWS for what I think might be better MLOps. I agree with you though AWS outages seem to occur less often than GCP outages.

</comment></comment><comment><USER3> This is not the first time that it happens.</comment>


The Update Framework - <AUTHOR> https://theupdateframework.github.io/ <comment><USER2> Everyone: Read this. At least the threat models.

Do not assume all software you currently use gets these things right.

</comment><comment><USER3> From the spec:

> Delegated trust can be revoked at any time by the delegating role signing > new metadata that indicates the delegated role is no longer trusted.

This is a mistake, as it means that a client must receive the new metadata in order to be made aware of the revocation. The correct approach is either to delegate trust for a particular time period (determining how long is a risk- based decision), or to specify an online trust check (this fails safe).

<comment><USER4> Every metadata file, including those that specify delegations, have an expiration. There are also higher-level expirations in the snapshot and timestamp files (a delegation won't be trusted if it's referenced by an out- of-date snapshot or timestamp)

I.e. there are multiple time-based controls in place

</comment></comment><comment><USER5> So obviously we have to wonder why TUF hasn't been applied to NodeJS's npm. All I can find is a suggestion that maybe someone from TUF posted to a node mailing list in 2014 [1]. Any more recent info?

[1]: [https://groups.google.com/forum/m/?fromgroups#!topic/theupda...](https://groups.google.com/forum/m/?fromgroups#!topic/theupdateframework/GbWtUbnO8_I)

<comment><USER6> AFAIK several language package managers have looked at implementing TUF for their repositories, but the only live implementation that I know of is Docker Content Trust.

I kind of think it's an important part of secure management of libraries. As the Fosshub breach last week showed, software repo's are tempting targets for attackers...

<comment><USER7> Hackage/Cabal also has at least a partial implementation of TUF.

<comment><USER8> And opam (OCaml) is working on it too.

</comment></comment></comment></comment><comment><USER9> The Github PR for merging this into Rubygems is ~3 years old: [https://github.com/rubygems/rubygems/pull/719](https://github.com/rubygems/rubygems/pull/719)

</comment><comment><USER10> Shouldn't this be part of the OS?

<comment><USER11> _sigh_. I know there are those in the Python/Pypy community that thing everything should be done via pip; not the system manager. Others say we should have system packages (and they make elaborate systems that check for new python packages they use and build them with fpm).

I really prefer the system managers, but what if things don't get new packages in a timely manager. When I was on openstack security, we used the Cannonical repos since they updated faster than the Debian repos, but some major exploits would be left out there for half a month (which lead down the path of; do we want to run our own CI-builds so we can deploy CVE patches immediately).

This isn't even getting into the issues with Java/Scala/Groovy projects that could have jars with exploits embedded within the project (most OS packages let projects keep their own jars, instead of using a set of system jars. Gentoo tries to use system jars, but oh boy is that it's own crazy mess). There are lots of programs that embedded C/C++ libraries for stability/error reporting (I'm looking at you Firefox/Libreoffice) and hence there are scanning tools for finding these embedded libraries with security issues (some guy did a talk on this at Ruxcon 2012 I believe).

TL;DR It's turtles all the way down.

</comment></comment><comment><USER12> Quite obligatory XKCD: [https://xkcd.com/927/](https://xkcd.com/927/)

<comment><USER13> While this link is the expected joke, it is not joke at all.

I'm writing software updater right now. Security is one of major concerns. Target platform, both client and server side is Linux. I write most of the code in Python. Looks like great opportunity to use TUF. But it is not. My updater has so many specific requirements that TUF is not nearly what I need. More than this, TUF is not subset of what I need and cannot be foundation for what I need, even from security perspective.

<comment><USER7> Can you share what your different requirements that are not supported by TUF are?

<comment><USER13> Software is split into a few overlays. Each overlay is filesystem slice, some overlays may have intersection. They are merged in specific order to get the final filesystem. Some overlays may be version-related (v1, v2), some environment-related (test, live), some may contain specific device configuration. Ordered overlay set forms an update stream. (That's just terminology we use, I do not want to teach somebody how to call things right)

Initially client knows only own hardware ID (which is just sha256 of part serials, MAC, etc.), and registers itself on server, which is allowed only from trusted networks. During registration client receives unique HTTP client certificate. Later administrator approves registration and assigns client specific stream. Stream may include sensitive information, like unique credentials to access some other services. Some overlays, which are not secret, like executables, 3rd party libraries, OSS stuff, are just rsynced to save time and bandwidth, but others like configuration and credentials, are downloaded over HTTP with client certificate authentication. Overlays are merged on client side in memory and applied in semi-atomic way (series of file moves within partition, not writes or other I/O in between).

There are a few other requirements, like log if devices tries to register second time, log if device tries to register from non-trusted network, log every update attempt, successful or failed, etc. And this is of course just brief overview. For instance, administrator approving registration is not a single person, but group of administrators, each with different permissions on streams. Client cannot download stream of some other client, and cannot get any information on overlays used by other clients, etc.

I do not see any way generic updater [framework] (not only TUF) to fulfill my requirements not causing more problem, than solved.

<comment><USER4> Most of what you describe is external to TUF (authenticating, logging, the specifics of the data you're protecting and how you transfer it once it's validated).

A couple things you pointed out are definitely hard with TUF right now:

> For instance, administrator approving registration is not a single person, > but group of administrators, each with different permissions on streams

TUF is being actively developed and this type of approval pattern is planned: [https://github.com/theupdateframework/tuf/issues/346](https://github.com/theupdateframework/tuf/issues/346)

> Client cannot download stream of some other client, and cannot get any > information on overlays used by other clients, etc.

This is currently a limitation of TUF, but it is known and there are some tentative plans to address it. If you have specific use cases you'd like to contribute to the discussion, there are GitHub issues and the mailing list.

I think it's worth pointing out that even if you don't use TUF, you need to be thinking about the vulnerabilities it's designed to protect against. Once you start doing that you'll probably end up with something similar modulo formats and transport.

</comment></comment></comment></comment></comment><comment><USER14> We've got a great update framework already, if only everyone would use it: git.

Seriously. I can't think why this wouldn't "just work".

<comment><USER15> When your only tool is a hammer everything starts to look like a nail.

<comment><USER16> When your only proverb is a hammer everything starts to look like a hammer.</comment></comment></comment>