Calling out Hacker News - <AUTHOR> http://blog.bitquabit.com/2009/07/01/one-which-i-call-out-hacker-news/

<comment><USER2> August, 2007:

      Hmmm, a ticket aggregator, huh? Yeah, I can throw that
      together in a month over the summer. Then we can find
      another idea so I can work on something *hard*!

July, 2009:

      Fuck, I'm *still* working on this thing?! When did it turn
      into a fully-fledged, funded company? And why can't I find
      an intern to help me with all this damn work?!

The original plan for TicketStumbler was a quick, stop-gap solution to the problem of not having jobs anymore. It was supposed to take a couple months, at most. Some day I might get into why it will soon have taken a year and 3 complete re-designs (working on #3 as I type!) and 3 re-writes of a high- performance site crawler / parser which is now largely obsolete thanks to proper APIs, just to get to a point where we _kinda_ know what the hell we're doing. Until then, I just laugh at Techcrunch commenters who think they can clone it in a weekend. But I can get you started:

      CREATE TABLE ticket_ticket
      (
        id serial NOT NULL,
        event_id integer NOT NULL,
        section character varying(150) NOT NULL,
        "row" character varying(150) NOT NULL,
        price numeric(9,2) NOT NULL,
        quantity smallint NOT NULL,
        url character varying(300) NOT NULL,
        extra text,
        broker_id integer NOT NULL,
        last_update timestamp with time zone NOT NULL,
        root_url character varying(300),
        CONSTRAINT ticket_ticket_pkey PRIMARY KEY (id),
        CONSTRAINT broker_id_refs_id_2b5e6c11effcebee FOREIGN KEY (broker_id)
            REFERENCES review_broker (id) MATCH SIMPLE
            ON UPDATE NO ACTION ON DELETE NO ACTION DEFERRABLE INITIALLY DEFERRED,
        CONSTRAINT ticket_ticket_quantity_check CHECK (quantity >= 0)
      )
      WITH (OIDS=FALSE);

Good luck! :D

<comment><USER2> That part under "July" is meant to be mildly sarcastic; hopefully it doesn't come off as disappointment that it didn't take two months. It has been a very fun and educational ride.

</comment></comment><comment><USER3> > ... what actually makes StackOverflow a continuing success ...

What _actually_ makes SO a success is network effects, dude:-)

Is it nicely done? Sure. It's way better than "expert sex change" for sure! But something that took 3 people 6 months (as per the other thread) to do is well within the reach of a lot of people here. "Spit and Polish" included.

Now, how many people could get significant linkage/coverage from two people who already have huge audiences of just the sort of people who use SO?

That's your 'moat', your competitive advantage. Not to belittle the good work behind the app itself of course, but that's just the base you need to stand on. Joel could link some piece of junk and, yeah, it might not become a hit, but the _community_ is really what makes sites like SO, or reddit, or even HN go. HN, for instance, doesn't seem to have a lot of 'spit and polish' and yet I prefer it to SO.

<comment><USER4> It has more spit and polish than you think - just not flashy. (Think 'Shibumi'.)

</comment></comment><comment><USER5> You're not really calling out HN, you're calling out the coders here who claim they can recreate StackOverflow. But it is an example of a provocative title that lured me into reading.

<comment><USER6> Yep, thats me and I'm still going to try do it this weekend =) I think some people takes things way too seriously like the fog creek employee who posted in the original thread whose post this blogpost references. EDIT: it actually appears to be the same guy who wrote this blog post.

To me its just a fun little thing I'll try to do over the weekend and hopefully it'll offer a bit of refreshing perspective into web-based app development again since I've been stuck in the flex world (what pays the bills for now) for so long.

But actually his post offers a pretty good to-do list for the list of things I need to do to get it working, so basically, there is:

1, Asking and Responding to question 2, can't downvote person too many times in certain amount of time 3, spam bot detection/prevention 4, user icons 5, sanitizing html lbrary 6, karma 7, full-text search with search-as-you-ask 8, user bios 9, important questions that bubbles down slowly 10, bounties 11, email notifications 12, javascript smart tags 13, user configurable badges 14, history of karma, upvotes and downvotes

and oh yes, I'm not going to attempt to implement the design, i'll prolly start off by using the stackoverflow css and html as a template like what cnprog did when they started off and perhaps let someone else ( or do it myself ) replace it later.

<comment><USER7> > I think some people takes things way too seriously like the fog creek > employee who posted in the original thread whose post this blogpost > references

Well if he is really an SO dev, or knows the SO devs, he knows how much work has been put into it. SO is definitely not a complicated site, architecturally speaking. But as he points out, it's a very polished site. This may not be important for a programmer, but it is for an user (it is for me as an user at least), as he also points out.

Regarding the amount of work wich probably has gone into it, your original statement :

>it looks like something that can be thrown together in a weekend.

surely sounds disrespectful to the labor of those guys.

I'm also quite amazed by the general reaction to this. I don't understand how some commenters on hn, wich is supposed to be oriented towards entrepreneurs, who are by definition people interrested by the end user experience, could so quickly discard in several largely upvoted comments the work that has been put by those individuals, by saying that their success is just due to 'owners reputation'.

This is amazingly rude, and seems to be going along just fine.

When you provoke an argumentated and well thought out reaction as this one, you should ask yourself, before saying some people takes things too seriously, maybe you're taking what is important to them too lightly. And that's your responsability, not theirs.

EDIT: This is not to say your challenge is not a nice one. I'll be interrested to see how it works out =)

<comment><USER3> > could so quickly discard in several largely upvoted comments the work that > has been put by those individuals, by saying that their success is just due > to 'owners reputation'.

> This is amazingly rude, and seems to be going along just fine.

No one is "discarding" their work (well, I certainly am not, in any case), just saying that you can be covered in all the spit and polish you want, but if you don't have a community, a site like SO isn't going anywhere. And having Joel and Jeff as backers contributed to that. A _lot_.

Also, if we're talking about being dismissive, any idea how much work has gone into make things like Gnome, KDE and Ubuntu better looking? On beating all the involved code into shape so that it has started to conform to some kind of uniform look and feel? And it "it sucks" according to this guy, whom I will quote from directly:

"open-source software is, incontrovertibly, a total usability clusterfuck."

The astute observer will note that he's wielding an _awfully_ broad brush that is very much discarding the work of a lot of people, who, while they may not have attained perfection, _are_ working on these kinds of issues:

<http://library.gnome.org/devel/hig-book/stable/>

<http://usability.kde.org/hig/>

<comment><USER8> Well, there's a subtle difference there, I think.

The quote isn't, "open-source software's usability could be perfected in a weekend". The quote doesn't suggest that it's easy, or not time-consuming, just that the end result right now isn't great.

Which I would agree with.

You're just saying that a lot of people are working hard to make it better.

Which I would also agree with.

<comment><USER3> "Isn't great" or "needs improvement" is quite different than "total clusterfuck". This last statement is extremely rude and dismissive of a lot of hard work that _has_ brought great progress to the Linux desktop, which, contrary to the hand waving, is quite usable these days.

</comment></comment></comment></comment></comment></comment><comment><USER9> You can build a prototype of pretty much anything in a weekend. We've all done it.

Most of us have also gone through the 6-24 month process of turning that prototype into a real functioning product that people would actually want to use. We know how much work goes into "polish", and how many little details crop up and eat into your time.

So yeah, I have no doubt that this kid will put out a working prototype of a StackOverflow clone over the weekend. And he'll think he's just a few days from putting it live. He'll be wrong, of course, but if he puts in the year or so it will take to finish it up, he'll learn a lot about the software business.

I wish him luck.

</comment><comment><USER10> I know its an oft-visited subject, But I liked his analysis of how many programmers ignore the spit-and-polish of a UI and focus solely on implementing the model.

<comment><USER11> Agreed. Despite its "provocative title", the "eternal optimism of programmers" rings true in my book!

<comment><USER12> Yes. Except I really have implemented caching in a half-day, using memcached. :) (Utterly fixed the speed issues with the site I was working on then, incredibly easy to use.)

That was a good day.

It almost never happens like that - in fact, the irony for me is the example he uses in the quote is just about the only time where it was _substantially_ easier to do something than I expected. :)

</comment></comment></comment><comment><USER13> The SO guys seem to really love to hate on FOSS. I'll admit that the user interfaces for some desktop FOSS stuff are crap, but let's not forget that the server architecture is top notch.

How many programmers would be out there asking the kind of questions that show up on SO if it weren't for the ubiquity of the LAMP stack? I shudder to imagine a world where hitting the start button on your neat weekend project involves buying licenses for Vista, IIS, Visual Studio, MSSSQL, etc., etc., etc. "Now that I've dropped $20k on dev tools, I'm ready to get to work!"

<comment><USER14> Everything you mentioned but Vista is available in a free version precisely for things like the aforementioned weekend projects. And I don't think that it's any more fair (for 99% of users) to include buying an OS in "prerequisites for fun weekend project" than to include buying a computer in the first place.

<comment><USER15> Counterpoint: They are available in a free version precisely because of the competitive pressures from the open source stack...

<comment><USER9> countercounterpoint: They are available in a free version because Microsoft really wants you to build things for Windows. If they could give you the full versions for free without cutting off the air to the 3rd party tool vendors, they absolutely would:

<http://www.joelonsoftware.com/articles/APIWar.html>

</comment></comment></comment></comment><comment><USER16> I can't really disagree with any of the specific claims here, but at the same time, the whole argument seems to be constructed on the basis of a hasty generalization. This situation is not reflective of OSS, developers, hacker news, hackers, whatever, it's reflective of a handful of people and their own biases. The author's statements about the lack of usability in OSS in the large are as dubious as the statements being made about how easy it is to implement a clone of product X, Y or Z.

I think there is definitely a discussion to be had in this general area, about the relative importance of usability and polish to applications depending on their target audience. Maybe next time.

</comment><comment><USER17> The guy makes a good point, but he is underestimating the redundancy and code duplication of web apps. I could have "something like" StackOverflow in a day, not because I will write it from scratch, but because I will be running global string search and replace on a bunch of stuff that I have in ~/hacks.

Having said that, I would probably estimate a 3 - 6month time frame just to cover my ass.

Be optimitistic all you want to yourself, but you must estimate projects very conservatively and assume the worst, Big "Murphy's" Omega of everything.

Arm-chair programmer != professional :-)

<comment><USER18> You could have "something like" StackOverflow in a day the way a 10-speed bike is "something like" a Honda, in the sense that they've both got wheels and they get you around.

<comment><USER17> Are we taking bets here? let's talk shop; get a check for $2k ready, list everything from SO you would like to see copied and have a stop-watch ready.

Sorry, didn't mean to put you in the spot like that, but yeah, sometimes it's just that easy, _specially_ when you have a check list and well specified requirements.

Sometimes it takes longer negotiating the deal than writing the actual software.

<comment><USER18> Maybe you should go back and re-read the article. The whole point of the article is that programmers see a few database queries and the major, obvious functional points and say "I could do that in ..." Whereas, to me, saying "something like" means recreating a comparable user experience.

I think any decent web programmer could hack together a bare bones, functional Q&A site in a few hours. I have no reason to doubt you couldn't implement a lot more features in 24 hours. But to claim you could provide a comparable user experience, I'm just not buying it, even if you have a lot of the generic building blocks already written.

</comment></comment></comment></comment><comment><USER19> He had a really good point with the last thread regarding Open Source and it's tendancy to be a little lacking on the "Polish"

But he's going a bit far now to suggest, as I read it, _all_ FOSS suffers this fate... plenty of well polished Open Source software exists. And plenty of paid software lacks polish.

And at the end of the day; maybe not a weekend but SO wasnt put together in TOO long a time. With a couple of good enough hackers and someone to do the UI a few weekends might be doable..... the polish doesnt make SO.... it helps, but it sure doesnt make it (IMO of course)

</comment><comment><USER20> Coming soon: Calling out posts with provocative titles

<comment><USER21> That's a fair point, and one I thought about for awhile. Both this post and the previous one were originally a single Yegge-length post entitled "The Eternal Optimism of Programmers." The problem was a) Yegge's columns are so long that even when they're great, people zone out, and b) I'm no Steve Yegge. So I split the column into its two general parts and started editing two essays: the one in which I said software sucked, and the one in which I seemed to be calling out Hacker News. I realized that no matter what I titled the first one, someone was going to end up posting it as me saying open-source software sucked, so I simply decided to one-up them and meet that title on its own terms: the usability side of the equation. At that point, turning the working titles into the actual titles made sense.

Are they provocative titles? Yes. Are they _fair_ titles? I think also yes. That means they're good titles. There's nothing wrong with being provocative, as long as you're not being provocative for the sake of being provocative. I don't think I'm doing that here, but I understand if you disagree.

<comment><USER22> Ben, off-topic: I really like the way you've done bitquabit, and I wanted to look at the Django code you used, but when I went to your bitbucket account, it doesn't seem like it's up there? Did I miss something?

<comment><USER21> I'm tentatively aiming to release it around the end of July. At the moment, there's a bit too much hard-coded to handle my site (e.g., there's an entire urls.py that does nothing but map my old MovableType and WordPress URLs to Django, which can be messy, and my DB passwords are in the source repository), and there are a few features I want to add before I release to the world (like putting StackOverflow's markdown editor into the post editor so you don't have to guess-and-check whether your Markdown looks right), but once I do that, she's all yours.

<comment><USER22> Cool. this reminds me of that Django blog we never got around to building in that house course. I look forward to seeing it when it's done.

</comment></comment></comment></comment></comment><comment><USER23> > StackOverflow's _.cs,_.sql, _.css,_.js, and *.aspx files come to 96.5kB

This simply can't be correct. The css file by itself is 26kb. Actually the js file is over 90kb...So it's not correct, unless I'm missing something?

I would expect the source code for a site such as SO to be will over 3 or 4 MB...

<comment><USER21> Crap. That's a superb example of me not actually processing whether what I'm typing makes sense. The actual size of those is 2.3MB. I'll update the post accordingly. (96.5kB is the size of all the file _names_ in StackOverflow.)

 _Edit_ : Post updated.

</comment></comment><comment><USER24> Well only yesterday I asked a question on StackOverflow and noticed that there does not seem a way to monitor a question without answering it. So even now it needs more polish.

Probably after one weekend a clone would not be as polished, but it might be usable enough. If it picks up, there is still enough time to add polish by and by (maybe taking another direction than SO in some respects).

Also if it is open source there is a chance that other people chime in and help adding features they miss.

<comment><USER25> Every question has an rss feed, for example: <http://stackoverflow.com/feeds/question/415260>

</comment></comment><comment><USER26> No offense to this guy, but the first argument that doesn't seem to make any sense is that you couldn't reproduce SO because it would take you 33 hours just to type the existing code back into an editor. It seems like a pretty arrogant assumption that the existing code is _the simplest possible_ code that could be used to provide this functionality.

Beyond that, he is ignoring the fact that...Stack Overflow is really not _that_ obscure of an idea. There is posting questions and responses (or stories and comments); basically a blog which, by this point, is kindof trivial to put together.

User icons and profiles? Seriously? Not to be a prick, but I implemented those on my own website in a matter of about an hour. From scratch...and I am _not_ a developer.

Okay, so...upvotes and downvotes and a frontpage that bubbles like reddit does? Mayyybe...how nice do we have to be to the database?

select (upvotes/(now() - time_submitted)) as heat from questions order by heat desc limit 50;

On a related note, he also mentions the scaling...so, what are our constraints here? What hardware are we using and how much do we get to use?

Okay, then search. Seriously? This is also something that most geeks have written at some point and would have no problem dusting off.

Granted, yeah, this guy is probably right. I don' think anybody is TOTALLY going to reproduce a verbatim copy of SO over the 4th of July weekend...but I don't think this guy (I am assuming he is the author of SO) should assume that he is th BEST, FASTEST dev in the world. Especially when he is talking about such a common problem; what is essentially a blog.

<comment><USER7> >but I don't think this guy (I am assuming he is the author of SO) should assume that he is th BEST, FASTEST dev in the world.

Where in the world did you see him say that ?

<comment><USER26> The first couple of paragraphs where he said that it would be impossible to recreate SO in a weekend because of how long the current code was.

This is making the assumption that the new code would be the same length.

</comment></comment></comment><comment><USER27> I suspect there is a high correlation between coders who think that cloning something like StackOverflow would be easy and those who have crappy interfaces to their own code, even if the core functionality is there.

</comment><comment><USER28> No one complained that C# is significantly more verbose than Python/Ruby/Arc/whatever?

</comment><comment><USER29> This seems like a list of stuff I tell clients when they sit down with only the ideas of how the visitor will access the site.

But 18 man months seems like an awfully long time, but I bet their framework has 10x more features than they use!

If the guy thinks it is just a feature of OSS he clearly hasn't bought much shrink wrapped software. Procomm anyone? try these proprietry programs <http://homepage.mac.com/bradster/iarchitect/shame.htm>

</comment><comment><USER30> One of the best blog posts I read in a while...

</comment><comment><USER31> "Build a skyscraper? Dude, I could build one taller than the Chrysler building in like a week."</comment>


The Gadget Apocalypse Is Upon Us - <AUTHOR> http://www.nytimes.com/2016/12/07/technology/personaltech/the-gadget-apocalypse-is-upon-us.html <comment><USER2> The author lacks perspective. GoPros for Mtn Dew drinkers? Might as well just start yelling "get off my lawn" now. What happened to NYT? Has old media literally just given up? /rant

<comment><USER3> Farhad Manjoo was bad before he moved to the Times.

A thing I don't like about this article is the mischaracterization of Kickstarter. There's been lots of high attention hardware projects, but the site was never just for gadgets.</comment></comment>


Microsoft Announces ARM-Powered Surface Pro X - <AUTHOR> https://www.theverge.com/2019/10/2/20885572/microsoft-surface-pro-x-2-in-1-sq1-processor-specs-price-release-date <comment><USER2> This would make for a beautiful Linux device

</comment><comment><USER3> So no one going to talk about the removable hard drive?

</comment><comment><USER4> Didn't Windows RT fail? I'm genuinely curious: what's different here?

<comment><USER5> Windows 10 now supports x86 emulation on ARM processors, so most programs will run on this device without a problem.

Unlike Windows RT, which could only run things from the windows app store.

[https://www.theverge.com/2018/2/19/17027026/microsoft- window...](https://www.theverge.com/2018/2/19/17027026/microsoft- windows-10-on-arm-apps-games-limitations-support)

<comment><USER6> Windows RT was especially hamstrung because without jailbreaking it couldn't run Win32 desktop software even if it was compiled for ARM.</comment></comment></comment>


Ask HN: Suggestions on a New Hacker News App for Android? - <AUTHOR>

There are dozens of apps for Hacker News available in Play Store already. Being a newbie to Android app development, I thought it would be better to develop a minimalistic app for Hacker News using their API on Firebase.
I had already completed the basic pages and looking forward to release the app in Play Store in a week. I thought it would be better to get some suggestions on the design from the HN Community before releasing the app.
The design can be found at  http://i.imgur.com/UVfxEEs.jpg <comment><USER2> Looking good. Does the search function work? Because Firebase API doesn't seem to have a search function. You can add pull to refresh and hide the action bar when scrolling if you haven't already.

<comment><AUTHOR> Thanks for the feedback. The Search API for HN is provided by Algolia. The action bar is of course hidden when scrolled. Noted down to add the pull to refresh function.</comment></comment>


Ask HN: What's the best technical book that came out in the last decase - <AUTHOR> I've enjoyed reading classic CS books like Unix Network Programming, but if you ask me to name a seminal book that came out in the last decade or so, I'd draw a blank.<p>What are some good CS books that are relatively new yet offers high quality technical content, the sort that can rival the classics but shed light on recent research and developments in Computer Science? <comment><USER2> I really liked the google Site Reliability Engineering book -

[https://landing.google.com/sre/book.html](https://landing.google.com/sre/book.html)

And think that the chapter on Simplicity is one of the most important chapters any developer can read -

[https://landing.google.com/sre/book/chapters/simplicity.html](https://landing.google.com/sre/book/chapters/simplicity.html)

</comment><comment><USER3> Art of Computer Programming, Volume 4A: Combinatorial Algorithms, Part 1.</comment>


Drupal benchmarking with NGINX and Apache - <AUTHOR> http://cloudarch.co.uk/2012/10/drupal-benchmarking-apache-nginx-varnish

<comment><USER2> Surely you are just benchmarking Varnish and Drupal is irrelevant in the equation? The other results are more useful. Interesting to see how little it takes to kill Apache for a stock Drupal install.

</comment><comment><AUTHOR> Check out my benchmarking tests with Drupal and NGINX vs Apache

Plus with Varnish thrown in for fun.</comment>


Ask HN: How do I work with a frustrated boss? - <AUTHOR>

Hi folks,
I'm a junior level programmer at my company. I was hired in less than a year ago.
Lately the company has been adding in more process in our work. Instead of spending 75% of my time coding, I'm now cutting to 30-50% due to the amount of documenting and overhead that is now required for each production change.
This adds up over time and the team is growing increasingly displeased with it.
I had a bi-weekly meeting with my boss today, and he just came from a meeting with HIS boss. He was quite frustrated and mentioned process issues that the team was not following. He also mentioned in our conversation (very briefly) that he was "this close to snapping". There wasn't anything I did here... he has said several times he was very pleased with my work. The source of his frustration was completely out of my control.
That's not to say he's a bad boss! He's normally a great guy. In fact, prior to management, he was a senior programmer for ~10 years. His style isn't "What do we need done" but rather "What obstacles can I remove for you?".
So my question to you folks: how do I deal with a frustrated boss (or coworker)? And how do I make the most of this situation? <comment><USER3> It wasn't appropriate for your boss to vent to you, but it sounds like that was what he was doing. Continue to do your work well, and cooperate with the extra process for now.

Give him a week or so to cool off. If you're feeling brave, ask him if there's anything you can do to help him support the team. Documenting how the new process affects your productivity? Taking the process to new heights of absurdity? The answer may be to just follow the damn process and let him deal with the politics.

Process isn't always a bad thing - it can help make sure that your coding time is spent on the right things and it can help stem a lot of value loss and productivity obstacles related to siloed information. Work that feels like a big time sink up front can pay big dividends in the long run (the process equivalent of building a test suite for an existing code base). And if it's really that bad, touch up your resume!

</comment><comment><USER4> It's an implicit invitation for you to take over the job of process compliance and get into management instead of coding. Presumably someone else (with, as another commenter points out, more power) actually needs that stuff - <USER2> let's face it, lots of programmers are really crap at documentation. Make your manager's problem evaporate and you'll be his golden boy or girl. Downside: you won't get around to writing any code if you devote yourself to this. Upside: if you go into management you get to have ideas and leave the implementation to your staffers while you deal with people problems. Also, you'll make more money.

</comment><comment><USER5> The issue isn't that your boss is frustrated per se, it's that he seems to have little to no leverage with his boss -- to the point that he vents to you.

Power is an inherited property, so if your boss has little leverage, then you have very little power or reason to hope that things will change. Take from that what you will.

</comment><comment><USER6> Sounds like a textbook case of a capability trap and a failure to recognize that an improvement programs may actually result in a reduction of productivity in the short term.

From 'Nobody Ever Gets Credit for Fixing Problems That Never Happened'[0] that was discussed a few days ago [1] :

 _In one firm we studied, the general manager laid out his goals for improving the product development process [...]. At the same time, they launched many new development projects in anticipation of the expected productivity gains. Viewed through the lens of management's mental model these decisions were entirely rational. However, that mental model [...] led them to the erroneous belief that the delay between improvement effort and results was short and that their engineers were under-utilized, undisciplined, unmotivated, and unwilling to adhere to the specified process._

 _The company spent millions and invested countless person-hours to create a new product development process. The new process [...] also increased monitoring, including a structured stage-gate review process and mandated use of project management software. While there were some pockets of success, in most cases the effort had little impact. The leaders of the change effort often attributed its failure to the engineers' lack of discipline:_

 _"A lot of the engineers felt that [the new process] was no value-add and that they should have spent all their time doing engineering and not filling out project worksheets. It's brushed off as bureaucratic."—Manager A_

 _Yet, when we asked engineers why the effort failed, we got a different story:_

 _"People had to do their normal work as well as [use the new project management system]. There just weren't enough hours in the day, and the work wasn't going to wait."—Engineer B_

 _"The new process is a good one. Someday I'd like to work on a project that actually uses it."—Engineer E_

 _While managers felt the engineers had little interest in following the process, engineers became increasingly frustrated with leaders they felt had no understanding of what was really required to develop new products. Faced with the double bind of hitting aggressive performance targets and equally aggressive improvement targets, they were forced to cut corners while still appearing to follow the process. As one engineer remarked,_

 _As management discovers the engineers' shortcuts and workarounds, their view that the engineers can't be trusted is confirmed, and they are forced to step up their monitoring._

[0] [http://web.mit.edu/nelsonr/www/Repenning=Sterman_CMR_su01_.p...](http://web.mit.edu/nelsonr/www/Repenning=Sterman_CMR_su01_.pdf)

[1] [https://news.ycombinator.com/item?id=8940820](https://news.ycombinator.com/item?id=8940820)</comment>


Show HN: Shell-Loop - <AUTHOR> https://git.sr.ht/~shakna/shell-loop <comment><AUTHOR> This is a hack, that exploits some design decisions in shell scripting, that allows us to generate an infinite loop in shell, thanks to self-modifying the running code.</comment>


MyVodafone passwords are not encrypted? - <AUTHOR> Yesterday I was at a local Vodafone store and want to have some information about my contract. For that purpose, the employee ask me for my identification password. After that he ask me a personal question belonging to my "myVodafone"-password. So my questions is, why can he/she see it? Is my password not encrypted?<p>Here the twitter feed: https://twitter.com/vodafone_de/status/688312287141036032 <comment><USER2> Knowing vodafone, it's probably not encrypted at all.</comment>


AT&T Sucks, and now it is ruining T-Mobile too. - <AUTHOR> http://www.experimentgarden.com/2011/07/at-sucks-and-now-it-is-ruining-t-mobile.html

<comment><USER2> Wait, what? I didn't think the buyout had actually occurred yet. A quick search on Google News doesn't turn anything up, just a bunch of (very recent) articles about concerns about the proposed merger...

</comment><comment><USER3> "5 gigabyte and 10 gigabyte unlimited plans" - how twisted our truth in advertising laws to allow items like this to be marketed?

<comment><AUTHOR> I guess technically it is unlimited because it never cuts off, it just drastically reduces bandwidth after the 5 gigabyte or 10 gigabyte mark. Still, you can't help but feel ripped off by the communication companies.</comment></comment>


Why Clinton's Private Email Server Was Such a Security Fail - <AUTHOR> http://www.wired.com/2015/03/clintons-email-server-vulnerable/ <comment><USER2> The reporting on this story has been pretty terrible. Wired just running with the AP story without spending the couple of minutes it takes to verify the details is shameful.

The clintonemail.com domain was registered by Justin Cooper [1] and the MX records point to mail servers run by mxlogics.net, now owned by McAfee, not some solo server in Clinton's home. The sole evidence from the AP report is:

> It was not immediately clear exactly where Clinton's computer server was > run, a business record for the Internet connection it used was registered > under the home address for her residence as early as August 2010. The > customer was listed as Eric Hoteham.

A business record for an Internet connection doesn't prove anything, let alone the location of an email server. A history of the MX records [2] is evidence of the location and management of the email server, which has always been set to a mxlogics domain. That it took me only 5 minutes to gather his information but unsourced reporting is being parroted is poor journalism.

[1] [http://who.is/dns/clintonemail.com](http://who.is/dns/clintonemail.com) [History & DNS Tabs] [2] [https://dnshistory.org/dns- records/clintonemail.com](https://dnshistory.org/dns-records/clintonemail.com)

<comment><USER3> Background: I was quoted in the Wired piece. I made sure to emphasize that us outsiders can't say, with any certainty, whether this server was more or less secure than the State Department infrastructure. Matt Blaze, faculty at Penn, made the same point. But, alas, non-expert sensational spin won the day.[1]

With that out of the way, I suspect some HN readers might have an interest in the attribution process.

1) Find the mail servers for clintonemail.com, using DNS MX records. These days, they're run through McAfee. Back in 2010, though, the records pointed to mail.clintonemail.com. (There are a handful of services that keep those historical records, e.g. dnshistory.org.)

2) Find the IP address for mail.clintonemail.com, using DNS A records. Today, it's 18.104.22.168.[2] Back in 2010, it was 126.96.36.199.

3) Run an ARIN WHOIS on the old IP address. It's a static IP range through Optimum Online, allocated to "Eric Hoteham" at the Clinton home in Chappaqua. The surrounding IP ranges map to small businesses in the area.[3]

So, there is some nontrivial technical evidence that the email server was at the Clinton residence. But it's hardly definitive. It's possible, for instance, that the registered address is merely for billing purposes.

[1] There's even a glaring a factual error in the story. It was a web hosting service offered by Network Solutions that was hacked in 2010, not their DNS service. That would've been a much bigger deal.

[2] There's still a live server at mail.clintonemail.com. It's running Windows Server 2008 R2 with a valid SSL certificate. And it appears to be colo'd at Internap. Between that and the MXLogic protection, hardly a slapdash setup.

[3] Quite a few of these records have odd contractions or typos, suggesting the misspelled name wasn't intentional.

<comment><USER4> Thank you. That's certainly more compelling than the AP story talking about how her "private email server was reconfigured". Given the language used, Occam's Razor was definitely leaning towards reporter misinterpreted what was said.

</comment></comment></comment><comment><USER5> I'm still waiting for the explanation of why this was OK. "Every secretary of state has done this." or, "appropriate and very common among high elected officials."

When i think about the email requirements of any corporation, every real job I've had, the use of personal email for company business is against policy and would be a fireable offense.

Also interesting to consider the FOIA is more fearful to a politician, than having this private email service hacked by a foreign intelligence service. state department is essentially an adjunct to the CIA at the highest levels, so this is a real risk.

<comment><USER6> "When i think about the email requirements of any corporation, every real job I've had, the use of personal email for company business is against policy and would be a fireable offense."

Rarely enforced. Executives in regulated industries do it all the time. Or (more commonly) when hordes of contractors use their own email systems to discuss client matters -- which is perfectly normal because they are covered by NDA. If someone is fired for using personal email, it's likely because a higher up was looking for an excuse.

Of course a contract doesn't cover classified or FOIA material which is where the questions regarding Clinton's setup will go.

<comment><USER7> This answer is too flip. In corporate america, you might be able to use a personal e-mail as a stop-gap measure but not as a primary communication. Not in any fortune 50 or whatevr company with compliance and security infrastructure. This is something that has changed drastically in the past 10 years.

Most corporate hardware should be presumed "insecure" from the perspective of personal communication, and similarly so shoud any account that is used to co- mingle work and personal communication.

In other words, it is with great risk[1] that you don't use company hardware. Unless you have duplicate systems, of course. And if you have a duplicate system that you pay for in lieu of the company, only to for the purpose of subverting company policy, you have an ethics problem.

If that makes sense.

In any event, the technical issues here about how this was setup are legitimately interesting. It might very well be that the NSA/secret service or whomever set up this system to very secure indeed. I think the jury is out on that, frankly, and I'm not sure I would jump to the conclusion that SOS would be so wreckless as to not have her system vetted. (Or that the secret service or NSA or whomever would be so wreckless to not do it for them). Obviously it was a very carefully considered and pre-meditated decision to set up this system.

But then again people do stupid stuff all the time.

[1] To your personal life and privacy, not to the corporations per-se.

<comment><USER6> "In corporate america, you might be able to use a personal e-mail as a stop- gap measure but not as a primary communication. Not in any fortune 50 or whatevr company with compliance and security infrastructure. This is something that has changed drastically in the past 10 years."

Yes ... towards things like Google Mail for Corporations. If you make your corporate email better than your personal email, people will use it. If not, they just won't, if they have enough political power within the organization.

I speak from close exposure to white glove CxO level IT service where we do everything from ensure the biometric reader on the CEO's laptop works, to helping wire the CFO's home theatre system, getting the board chairman's vacation photos printed, and setting up all their personal devices.

If these sorts of folks don't like a system, they won't use it. They chucked the Blackberry for an iPhone. One of the reasons I've seen biometrics on a laptop is that a particular leader refused to remember a password longer than 4 digits. That alone made them prefer the corporate Lenovo vs. their personal Macbook Air.

"Most corporate hardware should be presumed "insecure" from the perspective of personal communication, and similarly so shoud any account that is used to co- mingle work and personal communication."

Bring Your Own Device is becoming popular. Every company I've worked for in the past 8 years (2/3 in the Fortune 100) allows BYOD in some form for executives, where they mix their personal and corporate communication. And sometimes for all employees.

The latest thinking in corporate security is not to lock down devices but rather to assume that ALL devices are vulnerable, with no special status for corporate assets. The solution there is to isolate in depth at the service level, with appropriate policy and device management installed for enforcing minimum standards and for emergency remote wipe. Modern apps - email, HR, reporting, order management, etc. are on the Internet, not behind the firewall... unless there's a need for NAT. Legacy can be accessed through VDI.

I admit the future here is not evenly distributed yet. But this is the trend that I see.

"In other words, it is with great risk[1] that you don't use company hardware. Unless you have duplicate systems, of course. And if you have a duplicate system that you pay for in lieu of the company, only to for the purpose of subverting company policy, you have an ethics problem."

I would say corporate IT has a usability problem.

</comment></comment></comment></comment><comment><USER8> > Clintonemail.com currently uses an invalid TLS certificate, another method > that a man-in-the-middle might use to intercept or spoof emails from the > server; but Stanford researcher Jonathan Mayer points out to WIRED that the > State Department's own TLS certificate is currently invalid, too.

The invalid certificates are a red herring. These are certificates used by SMTP servers[1], and since SMTP encryption is currently opportunistic (i.e. completely optional and trivially defeated by an active attacker), it _does not matter_ whether the certificate is valid or not. Virtually no SMTP client validates the certificate presented by an SMTP server on port 25, let alone care if encryption is used. The only reason why SMTP servers present certificates at all, as opposed to using an anonymous TLS ciphersuite, is because some SMTP clients choke on anonymous ciphersuites.

[1] [https://twitter.com/jonathanmayer/status/572779239281332224](https://twitter.com/jonathanmayer/status/572779239281332224)

</comment><comment><USER9> This mess is an example of a much larger problem: We are being governed by a bunch of attorneys who do not hesitate to lie, cheat and steal and play all of us for the fools that we are. Recent examples include a President telling lies (keep your insurance and doctor, save $2,500 a year, etc.) without consequences. This is not limited to a single party. It travels equally well on both rails and spans from mayors and governors to senators and, yes, Presidents.

Not sure what the solution to this might be. This is the stuff of so-called third world countries. I have long held that we are not far from "them", we just do it differently and don't take to the streets en-masse when we are lied to and royally screwed.

Maybe one day we will and things will start to change. A lot of these people belong to jail for what they've done to this country. My guess is that if you are under, say, 30, you are going to have to suffer the consequences of what these people have been doing to the country for, say, 50 years. And your children. Well, there's a school of thought that is of the opinion that your children migt just get to experiencethe US as a near third world country in about 50 years.

Our politicians must be accountable for their actions and must have consequences for misleading and manipulating the people. Not sure how that happens. Not sure what laws would deal with this. If there aren't any, there ought to be.

</comment><comment><USER10> I seem to recall CIA director Deutch keeping highly classified information on his home computer. CIA Director Patraeus giving classified info to his mistress. National Security Director Berger taking national archive info? Snowden. Its alleged Leon Panetta revealed classified info in his biography. Its almost as if some of the intelligence community leadership could, possibly, lack humility and believe they are infallible. There have been one or two cases in history where a lot of power combined with secrecy has led to bad decision-making. Perhaps this is another example.

<comment><USER11> Patraeus is facing jail time as a result. (though his plea deal will probably prevent that)

 _led to bad decision-making_ I think you misspelled "law-breaking"

</comment></comment><comment><USER12> Also, the bit about self-signed certificates being insecure? Arguably they are the _most_ secure if you pin to them since you are trusting no third parties. Obviously if you keep them untrusted and ignore the validation error every time it's a different story.

<comment><USER13> How could it be the "most secure"? How do you as a client verify the self signed certificate is the right one? If someone MITM'ed the certificate and you've never used it before how would you know that the certificate was intercepted? Who do you go to verify you've got the right certificate? That doesn't sound secure at all. It's like asking potential a liar to swear to you they aren't lying and not asking someone else if that person is possibly being dishonest. Sure central certificate authorities have their problems as a concept, but at least that someone else verifying the cert is the real one.

<comment><USER14> Note the "if you pin them" part. Pin in this context means you have the identity of the specific certificate stored on your client, and so you are not depending on whether or not it is being declared by some CA to be be valid for the server in question. Instead you are expecting _that exact certificate_.

That it is a private cert does not make it any more secure, but pinning is more secure, and with a pinned cert, having the cert signed by a CA gives no _additional_ security.

<comment><USER13> And how do you know you're not pinning the MTIM cert?

<comment><USER12> Because it's _your_ cert that you just installed on _your_ server, so you know its thumbprint.

This is effectively what you are doing every time you connect to a server over SSH and say 'yes' to that message with the funny string asking, "Are you sure you want to connect?" It's analogous to pinning a self-signed certificate.

</comment></comment></comment></comment></comment><comment><USER15> Remember this: if you are a run-of-the-mill State Department staffer or a military servicemember and you put classified material on a non-classified network, you might go to prison. Even high-ranking government officials have gotten in serious crap over classified material mismanagement--GEN Petraeus did this and lost his job as a result.

<comment><USER16> And proceeded to get the biggest sweetheart deal in the world from the feds. It's a miracle they didn't offer him a sex act to go with his plea. Unless you believe some random asshole who shares TS/code word info with a mistress and repeatedly lies to the fbi normally gets the feds to give him a misdemeanor and suggest probation.

One law for you and me, one law for them.

[https://www.popehat.com/2015/03/03/a-few-comments-on-the- dav...](https://www.popehat.com/2015/03/03/a-few-comments-on-the-david- petraeus-plea-deal-what-money-and-connections-buy-you/)

</comment></comment><comment><USER17> I am surprised this is such a big issue considering something very similar happened while Bush was in the White House with outside email under gwb43.com and georgewbush.com and Bush didn't really use email: [http://en.wikipedia.org/wiki/Bush_White_House_email_controve...](http://en.wikipedia.org/wiki/Bush_White_House_email_controversy)

<comment><USER18> That would be like saying it's surprising torture by the Obama Administration is such a big issue, because the Bush Administration did it too (and I'm not implying there is or has been torture under Obama, that's not the point).

These things should always be a big deal.

</comment></comment><comment><USER4> I like that Wired takes the AP claim that the server was literally in her home (in a closet? the attic?) at face value.

<comment><USER19> Whether it was located in her home or not, that building is probably quite secure given who she is and is married to.

</comment></comment><comment><USER20> Interestingly, neither state.gov or clintonemail.com sets SPF records. (Nor does nsa.gov, army.mil, or af.mil, though cia.gov, navy.mil, and whitehouse.gov do.) From personal experience as of a few months ago, state.gov did not use DKIM for outgoing mail.

</comment><comment><USER21> Because it was Windows?)

</comment><comment><USER22> heh. they are probably safe. or should i recall the kind of people the gov gives out money for it security?</comment>


Anonymous picks up where Lulzsec leaves off with new hack - <AUTHOR> http://www.abc.net.au/technology/articles/2011/06/27/3254252.htm

<comment><USER2> I don't understand why #AntiSec has such a massive following. What does hacking companies and government agencies do for the average person?

This is referring to the fact that @AnonymousIRC has over 100,000 followers now</comment>


Amazon Makes Good on Business-To-Business Threat - <AUTHOR> https://www.bloomberg.com/view/articles/2018-09-11/amazon-amzn-makes-good-on-business-to-business-threat <comment><USER3> If there B2B quality control is anything like what they offer to consumers, I'm not worried. They cannot pull the blind eye to counterfeit garbage like they do to their consumers.

<comment><USER4> Am really intrigued by this line - I've never had any reason to suspect my Amazon items in the UK have been counterfeit, whereas it seems like a common refrain in the States. Greater reliance on the third-party market and intermingling stock? Or radically different product base?

<comment><USER5> Apparently, the problem is that for a given SKU they'll mix up (on purpose) all marketplace vendors items, for items sold by third party but delivered from Amazon.

Let's say you're selling Tickets to Ride on Marketplace (counterfeit products are common for board games). You send 100 copies to Amazon, now customers can buy those from you.

I also sell Ticket to Ride on Marketplace! But I'm a cheap bastard so I send 100 counterfeit copies from China, with lower quality (off-centered chips, cheap prints, etc.)

Instead of sending your copies to your customers, and my copies to my customers, they'll dump all of our copies all together and send a random copy to each customer.

That means that any customer can receive counterfeit copies. You can't even trust a given vendor, or Amazon, because all the copies are mixed up.

<comment> saiya-jin That sounds like properly dumb approach to save a penny on an item - understandable with some quick grab scam scheme, but not something to do when building/maintaining long term business.

I guess some manager got his yearly bonus for lowering expenses to next bottom, and who cares about the future because f*k 'ya all.

<comment><USER6> I imagine a lot of the reason they mix vendirs products together has to do with logistics. If seller A sends 100 units of product X to the East Coast and seller B 100 units of product X to the West Coast it has to be immeasurably easier to lump them together (not physically but electronically) then distribute this 200 units out to all their warehouses for faster shipping.

It makes a lot of sense if everyone's on the up and up. That way you ship 20 units from Vendor A to NJ to cover the NYC metropolitan region for both vendor A and B.

</comment></comment></comment></comment></comment><comment><USER7> Selling on amazon is like making a deal with the devil. You have to sell on amazon to get access to amazon's customer base but at the end of the day if you are selling a lucrative product with little moat then amazon will copy cat it and sell it for less.

<comment><USER8> Amazon can copycat products not sold on its platform. No barrier to entry businesses all share the same competitive vulnerability.

<comment><USER9> But it doesn't know the sales numbers of items sold on other platforms and the details of who is buying it and what else they bought, etc.

</comment></comment></comment><comment><USER10> Amazon didn't threaten anyone, in case you were wondering. They simple expanded their bushiness-to-business selling operation to roughly 10B$ after entering the market 3 years ago.

<comment><USER11> $10b here and $50b there and they'll own it all. Shipping is the sticking point but they're working on their own FedEx /UPS ...

At some point you trust Amazon and don't care that Walmart might have a certain item $3.70 cheaper...win some, lose some is the rationale but "Amazon is cool"

<comment><USER12> Amazon isnt cool though. They dont carry good brands, half the stuff is fake, the other half is ads. We all hate Amazon, but use it because it's so darn convenient.

<comment><USER13> Is the fake stuff a problem in the EU, or is it an artefact of poor consumer law?

<comment><USER14> Generally fakes are a no!no! within the EU. Obviously not all fakes are caught and if they are the minimum consequence is confiscation.

In countries with strong brand manufacturing interests, notably Italy and France, it can be very expensive if they catch you with that 50$ "Bolex" watch from Bangkok, or with fake LV gear. Fines can go into the 1000s of Euros.

<comment><USER15> Wearing one or selling one?

<comment><USER14> Ownership is enough.

<comment><USER16> That doesn't seem right, putting the burden on the consumer to know if something is fake or not. Also, what if the consumer doesn't care if something is fake? For example, if he needs a watch, just needs it to tick and tell the time, then a Bolex is as good a brand as any other, I would think.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Although it may not legally be one it feels like Amazon is Monopoly.

<comment><USER18> Amazon is nothing like a monopoly.

If you want to sell something online you can do it in any number of places, and you can do it yourself (and fairly painlessly). If you want to buy something online, you can go to any number of retailers. You can get an Echo from Best Buy if you want, and you can get towels delivered from Walmart etc etc.

Ditto cloud computing, of course -- it's an incredibly competitive market.

Amazon does have large market impact and can (in a practical sense) exert market pressure. That's obviously a dangerous position for everyone to be in, but it's far from monopoly and it's also (afaik) well within the bounds of (American) law. As I understand things, US antitrust laws are all about _abuse_ of market position, not just the existence of a dominant position.

</comment></comment><comment><USER19> Amazon keeps saying there's discounts on the b2b site but when I joined I don't see any difference.

<comment><USER20> I'm pretty sure the "millions" of customers number is artificially inflated with people that just want those discounts. I bought some tools on Amazon for regular household use, and then recently I got prompted to create an Amazon Business account simply because I bought tools. Promising vague discounts by signing up for a free account is a good way to get more "customers". I wonder if all purchases from then on count as "business sales"?

</comment></comment><comment><USER21> * "B2B" is a catch-all term. There's indirect/MRO procurement and there's direct procurement. It's very hard to break into direct procurement without also owning the product/manufacturing. So yes, that does mean Amazon is going to go after the bigger MRO market. (This is a space they excel in already.)

* Amazon is operating in the marketplace model, not just in the conventional e-commerce model. This means their inventory can be MUCH BIGGER than anyone else's with FAR LOWER operating risks. This is what is worrying Grainger and others.

* Also worth noting that Amazon has more or less given up on product quality and instead, chosen to focus on Fulfillment and Supply Chain quality. With a marketplace model, that could lead to major headaches (while still giving the B2B buyer perfect delivery and a great price!).

</comment><comment><USER22> This is just the latest push of their "AmazonSupply" and "Amazon Business" systems dating back to their 2005 "Smallparts.com" acquisition.

Like Grainger, they used to be well-curated sub-sites where you could do your parametric sorting and filtering to drill down to "the" O-ring or other part you needed. But also like Grainger, they've fallen behind on their curatorial efforts and now it's more difficult to locate the right part among all the noise.

To supply a B2B part like an O-ring, you need to categorize it. You need to ask every. single. distributor. the same set of questions - composition, diameter, thickness, firmness, temperature rating, oil resistance, etc. Then allow your users to parametrically search and sort to drill down to the part(s) they need.

Digikey has this internalized - If you're building a web store, go to Digikey and pretend you're an electrical engineer. Find, say, a 22k surface-mount resistor in an 0603 package, 0.1W or greater, cut tape form factor, in stock, 5% tolerance. Boom, done. Now find that on Amazon. Allow a customer to come to your site with a list of requirements who wants to find a product on your site and try to make it as easy as it is on Digikey.

Ebay does not have parametric search internalized, nor does Craigslist - <USER2> they're much more seller-focused than Amazon. Grainger does not, and they're loosing business because of it. McMaster Carr curates their offering down to one distributor, which makes it really easy for me, but is a rather hamfisted way to solve the problem. Still, I'll always start my search for McMaster- supplied stuff on McMaster. Alibaba does not. Newegg used to, but they're losing the curation battle as they follow Amazon's model of 3rd-party distributors listing whatever they want whereever they want. Amazon does not have this internalized.

Amazon has been trying to have their cake and eat it too: They want to provide a curated section of their site that's easy for customers, and want to make it easy for sellers to sign up and list products. If you require each part to go through an onboarding process and fit somewhere in the hierarchy, you increase the friction massively for sellers. As a customer, I really wish that they would do so everywhere. If they want to just do this for the subset of customers that aren't willing to sort through the mess, but still allow vendors to come in droves with poor-quality categorization, it will still be hard to use and people will choose specialized distributors that are willing to do the work.

[1] [https://www.digikey.com/products/en/resistors/chip- resistor-...](https://www.digikey.com/products/en/resistors/chip-resistor- surface- mount/52?FV=1c0002%2C400005%2Cii2%7C1127%2C1f140000%2Cmu2.2+kOhms%7C2085%2Cffe00034%2C80002%2C80003%2C80026%2C80004%2C8022c%2Cc0002&quantity=100&ColumnSort=1000011&page=1&stock=1&nstock=1&datasheet=1&photo=1&pageSize=25)</comment>


Show HN: Learn Pure React – An Interactive Deep Dive into the Basics of React.js - <AUTHOR> https://www.educative.io/collection/5661736652767232/5629499534213120 <comment><USER2> So if I take this course and want to deploy a React app, will I have to use create react app, or will I have to acquaint myself with webpack?

<comment><AUTHOR> The course relies on Create React App, and does not delve into deploying to production. CRA does have a "build" command (npm run build) so you can use it to generate files suitable for deployment.

<comment><USER2> That's great, this should be helpful for people to get up and running with React without getting bogged down by the tools/config. Just my honest feedback though: The lesson "Why Just React" should be a part of the preview. It would be hard for me to pay for the tutorial without that information.

Anyway, I've just completed the free React Fundamentals course on reacttraining.com by Tyler McGinnis. What resource would you recommend to dive deeper with React (learn best practices to make complex web applications)?

Thanks!

<comment><AUTHOR> Thanks for the feedback - I updated it to make that available for preview.

I would recommend checking out Egghead.io if you haven't. They've got a lot of courses covering a range of stuff. Specifically, if you want to get into Redux, Dan Abramov's courses [0] [1] are great. Dan is the creator of Redux and a great teacher too. They're meant to be taken in order and they're available for free.

[0] [https://egghead.io/courses/getting-started-with- redux](https://egghead.io/courses/getting-started-with-redux)

[1] [https://egghead.io/courses/building-react-applications- with-...](https://egghead.io/courses/building-react-applications-with- idiomatic-redux)

<comment><USER2> Thank you! I never noticed that these were free courses, I just assumed that they were paid with Egghead pro.

Edit: I tried previewing that lesson but still can't. It says this lesson is not part of preview; I even deleted my browser cache, didn't work.

<comment><AUTHOR> Sorry about that, and sorry for the delay - it should be available for preview, for real now :)

I had hit "Save" but I didn't hit "Publish". Oops.</comment></comment></comment></comment></comment></comment>


Neil Armstrong:  "It's True Beauty however was that it Worked" - <AUTHOR> http://www.lettersofnote.com/2010/11/its-true-beauty-however-was-that-it.html <comment><USER2> Two missing commas, and one misspelled word, render the title incomprehensible. The original:

"Its true beauty, however, was that it worked"

This reminds me of the classic missing-comma gag: "Eats shoots and leaves":

<http://en.wikipedia.org/wiki/Eats,_Shoots_%26_Leaves>

</comment><comment><USER3> This is an illustration of why it's usually best to select, copy, and paste the title of a submission directly from the original article. This is a very good article, and I am glad it was posted, but the misspelling in the title is not Neil Armstrong's misspelling, and we should honor his memory by making sure his words are quoted accurately here.</comment>


Is Yahoo down? - <AUTHOR> http://yahoo.com/ Was trying to get to Yahoo finance but neither are loading... anyone else? <comment><USER2> US and UK sites both accessible from UK now</comment>


Show HN: Multi-GPU Reinforcement Learning in Tensorflow for OpenAI Gym - <AUTHOR> https://github.com/viswanathgs/dist-dqn <comment><USER2> A bit off topic, but how many people here use rl in their day job, and, if you use it, what do you use it for?

<comment><USER3> I work on a few algorithms that could be classified as RL given an open mind. Most of them learn distributions from streaming data via some kind of online EM. I know that people in the ad-serving, porn-serving, and website optimization (A/B stuff) sectors use RL pretty extensively as well, but I'm not one of them at the moment.

<comment><USER4> > learn distributions from streaming data

That's unsupervised learning afaik - clustering, manifolds etc. Where is "reinforcement" part there (agent, environment, reward)?</comment></comment></comment>


2009 Open Source Top Ten - <AUTHOR> http://ozmm.org/posts/2009_open_source_top_ten.html <comment><USER2> I'm glad I looked at this list, hadn't seen a couple of these projects before.

It should be called 2009 Ruby Top Ten, but interesting all the same.

<comment><USER3> Only three of the ten relate directly to Ruby (Unicorn, Gemcutter and yajl- ruby) - Homebrew also happens to use Ruby but is useful outside the Ruby community.

As a non-rubyist, I think it's a pretty good list.

</comment></comment><comment><USER4> Whatever happened to the OSI's Open Source Awards?

</comment><comment><USER5> imho, the biggest problem being that there are only web apps or web related apps in there...</comment>


Proof of work - an unobtrusive alternative to captchas - <AUTHOR> http://bennolan.com/2011/04/28/proof-of-work-in-js.html

<comment><USER2> Proof-of-work systems are cool, but this doesn't work, economically.

A proof-of-work system requires a verifiable amount of computation time before you can do something. The idea is that "honest" computers are mostly idle, but that this should slow down spammers.

The problem is that it may not be possible to seriously inconvenience spammers without seriously inconveniencing honest clients, _even if both run native code_ (e.g. hashcash). The article limits the honest guy to some crappy smartphone's interpreted Javascript running an algorithm that is very much optimized for 32-bit machine words (instead of Javascript's floats). If the smartphone can do the work in 10sec (which is annoying enough), the spammer should be able to do it in at most .01sec: enough to send ~8.6 million messages per day.

<comment><USER3> I think your statement is too broad. I agree that it wouldn't work on the web, for the reasons that you state. But it _is_ a useful approach in a lot of other situations. For example, I've seen it used successfully in gaming to prevent DOS attacks.

Client Puzzles have a couple nice properties: the difficulty can be adjusted & they can be implemented in a completely stateless manner. The last point is the most important because it what protects against a [D]DOS attack.

</comment></comment><comment><USER4> I wouldn't necessarily suggest it, but imagine if this were implemented at the protocol level and handled with native code built into clients.

There could be a new HTTP request method called "SUBMIT" which works like a POST request except with an added step for proof of work. When making a SUBMIT request, the client opens a connection to the server, sends the initial request header with the SUBMIT method, and receives a proof of work challenge as an HTTP field in the server's response. The client then processes the challenge and sends its proof of work to the server which verifies it and sends an OK. Then the client sends its url-encoded data to the server, the server sends its response data, and the connection closes.

Then performance impact and behavior would be fairly uniform for all clients, especially if a standard library of problems and problem solving code were used by them, so you wouldn't have to worry about finding a problem that isn't too hard for poor Javascript implementations to solve while still being too easy for native code implementations in spamming tools to process. There could even be an added field for the server to inform the client what problem type is being used, allowing the addition of new problem types of different difficulty and performance requirements in the future without any more updates to the protocol.

Personally though, I don't like proof of work solutions. Sure, they add some computational cost to spamming, but the mass implementation and use of any proof of work solution would probably just create a new, lucrative market for botnet hackers to sell their services to. Besides that, it just feels like the wrong solution to me.

</comment><comment><USER5> Messing around with your clients performance doesnt seem like a nice alternative to a captcha for me...

There is plenty of people with bloated windows machines that even using a modern browser struggle to perform properly, I dont think overloading them with extra work would help making their experience easy and smooth.

Just my 2 cents.

</comment><comment><USER6> This strangely reminds me of how Bitcoin works under the hood -- basically, a proof of work. Anybody up to creating a Bitcoin plugin for browsers as an alternative to captchas? Either as .xpi or a Flash file to be included on the website?

<comment><USER2> That won't really work. See <http://news.ycombinator.com/item?id=2407149> (summary: generating bitcoins takes too long and both client and server would have to trust each other.)

<comment><USER7> It will work, but the scheme has to be simplified some. Coins can be generated ahead of time, and then the client just pays a 0.001 bitcoin (via browser plugin, automatically) to the server instead of jumping through the captcha hoops. No trust is required, it's just a usual bitcoin payment.

<comment><USER8> I thought a bitcoin transaction was only considered successful after a sizable number of other bitcoin participants have based their successful computations on it?

If that is correct, bitcoin validation isn't fast enough for instantaneous forum postings when the spammers can be assumed to be as dishonest as fits them.

<comment><USER7> IIRC, you can almost instantly verify that certain bitcoin wasn't spent someplace else before, which would be good enough. Now, the attacker can use the same bitcoin for several web forms simultaneously, but 1) the scope of this attack is limited by the time window, and 2) if the server discovers a fraudulent transaction in, say, a few minutes, the spammy comment can be automatically deleted then.

</comment></comment></comment></comment></comment><comment><USER9> This wouldn't work would it? If the server sends the client a number (n), surely, I (as a spammer), could simply pre-calculate the largest integer (p) where the hash starts with 0000. The server cannot verify this is the wrong answer, without calculating all the hashes between n and p.

So I can send back p as my answer for all values of n, without needing to do any client side calculation

<comment><USER10> You're right, the server needs to send additional unique information, as in <http://en.wikipedia.org/wiki/Hashcash>

        Server:

        uniq_id = long random string
        salt = long random string
        work_number = random integer

        storage[uniq_id] = salt
        send(uniq_id, salt, work_number)

        Client:

        new_number = work_number

        while hash[:4] != "0000"
          hash = hashfunc(salt | new_number++)

        send(uniq_id, new_number)

        Server:

        salt = storage[uniq_id]
        if no salt
             deny

        delete from storage[uniq_id]

        if hashfunc(salt | new_number)[:4] != "0000"
             deny
        else
             allow

May also add timestamps.

</comment></comment><comment><USER11> Proof of work surely is a very interesting concept, but I'm not sure it's preferable to other methods.

As far as I'm concerned using up 8 seconds of user computation time (during which you _cannot_ guarantee responsiveness) is just as bad as throwing a cryptic CAPTCHA field in her face.

Methods such as timestamping, honeypots and dynamically added fields yield very good results for bot recognition.

<comment><USER12> Can you expand on the timestamping method? I thought this could be easily circumvented by adding random delays to the bot requests.

<comment><USER13> See also:

<http://news.ycombinator.com/item?id=2368486>

(there are lots of comments, a couple of months ago, it would have been easy to see which ones are "interesting", now you must read them all).

</comment></comment></comment><comment><USER14> Isn't that also what "hashcash" is all about?

<http://www.hashcash.org/>

<http://drupal.org/project/hashcash>

<http://wordpress.org/extend/plugins/wp-hashcash/>

</comment><comment><USER15> Is it possible to use in javascript a memory-bound proof of work (<http://www.google.com/search?q=memory+bound+proof+of+work>), where the computation speed is bound by memory latency, not CPU speed?

</comment><comment><USER16> If we could make it work (and I recognise the problems other commenters have noted with this particular implementation) then this would be a big benefit for blind people, for whom CAPTCHAs aren't just inconvenient but impossible. I'm sure they would gladly accept 8 seconds of unresponsiveness while the computer did some verifiable work, if it meant they could pass the test and use the service.

<comment><USER10> Audio CAPTCHAs solve this problem.

<comment><USER16> Not entirely - what about deaf and blind people, or those with cognitive disabilities?

</comment></comment></comment><comment><USER17> This works well with big forms due to the time it takes to carry it out so it would complete by then. That is, if the user isn't put off by the size of the form. Small forms not so much and the user would be annoyed.

It also penalises users who don't use Javascript.

Edit: This fails against a botnet where computers can be told to wait(10) [seconds] after filling form out.

</comment><comment><USER18> If the idea is to create a bottleneck, then why not throttle login at the server? Eg. have mutex for logging in, only allow one request at a time and then slow that down with a slight wait (Say, 1 second). You'll have to balance the exact throttle with the number of legitimate users on the system, and you'd probably want a timeout-and-retry mechanism in place.

<comment><USER19> I love the idea for login systems that exponentially (or somewhat exponentially) prolong the waiting period. Eg 1 second, 2, 4, 8 and so on. There should be a reasonable maximum of course, say 5 minutes. That would leave 300 attempts per day which renders brute force useless yet is low enough to not annoy users too much if you explain the motive.

<comment><USER18> Yes, that's probably a better solution.

</comment></comment></comment><comment><USER20> I'm sure someone has thought about this before, but instead of having the client do work for a certain amount of time, could you just disable submit, set a javascript timeout for some set amount of time, then enable submit after that?

Why does the client need to be processing during the waiting time? Would spambots wait around for the submit button to work?

</comment><comment><USER21> Don't trust client input!

The random number would have to be sent from the server, else the same hash could be used every time.

Also MD5 can be easily done on an FPGA at hundreds of millions of tests a second. Other algorithms might be more effective, particularly those which attempt to use large amounts of memory.

Nice idea though.

<comment><USER22> Not necessarily. You store which random number you sent to the client in the session on the server. Once it's been solved you invalidate it.

<comment><USER23> How do you know that the response really is the smallest such integer, rather than a precomputed one (e.g. the largest int with a hash beginning "0000")?

<comment><USER2> You don't (have to) care about "the smallest", just "any integer with a hash beginning with 0000".

<comment><USER9> But once the spamming machine has worked that out once, they can submit the same integer every time.

It would be better if the server sent a request saying send me an integer which has a hash beginning with npqr where n, p q and r are all random characters.

</comment></comment></comment></comment></comment><comment><USER24> I wonder if there's any way to use this scheme as a distributed computing tool. Maybe give out 3 work-units, one or two of which you know the result for, and the 3rd is unknown. The two known answers could be used to do the check, and the third actually does the work (and provides more known answers for later).

</comment><comment><USER25> 8 seconds is not unobtrusive.

But maybe browsers could implement something natively.

</comment><comment><USER26> Isn't this what botnets are for?

I'm serious - spammers already use packs of porn-hungry humans to process CAPTCHAs; this will only make their lives easier as they already have the botnets available, and botnets don't need porn!

</comment><comment><USER27> Isnt't the idea of a captcha that only a human can solve it ?

This sounds like it could just (handwaving here) be given to a bottnet for solving.

<comment><USER28> Yeah, that's the _idea_ of CAPTCHAs. In reality they can be solved by bots, given enough computing power and several attempts.</comment></comment>


Why Does Time Fly By As You Get Older? - <AUTHOR> http://www.npr.org/templates/story/story.php?storyId=122322542&ps=cprs <comment><USER2> Because as you get older any unit of time is proportionally a smaller fraction compared to the part already behind you.</comment>


Sunspring, a short science fiction film written by algorithm - <AUTHOR> http://arstechnica.com/the-multiverse/2016/06/an-ai-wrote-this-movie-and-its-strangely-moving/ <comment><USER2> My prediction: At this level of AI-generated writing, keeping the works short will attract (allow?) small audiences ... but only to watch the human talent in the production struggle and improvise over truly awful writing.

If a human was responsible for that writing, they wouldn't have much of a career.

Actors: 1. AI: 0.

<comment><USER3> Agreed. Joeboy's description of this screenplay as "word salad" was perfect: [https://news.ycombinator.com/item?id=11876333](https://news.ycombinator.com/item?id=11876333)

I like your scoreboard too -- that pretty much sums it up.

Although I do wonder if actors/directors could use this as a practice tool. Challenge: turn word salad into a meaningful scene. It almost seems like it could be an exercise in a theatre class.

You wouldn't want to do this for the full 10 minute screenplay (it's a little painful even with these talented actors). Maybe generate a 2-3 minute scene or generate the whole screenplay and you get to pick a scene. An optional crutch -- the actors get to do their own 2-3 minute scene before and/or after to give it real context and meaning. That could be interesting.

I have a feeling that something like this kind of exercise is probably already done in training (any actors on HN?). Although I bet this algorithm is better than humans at coming up with difficult challenging incoherent word salad gibberish.

<comment><USER4> Doing scenes with "word salad" is something improv actors do as a practice tool, as well as scenes where each actor only has a single word or simple phrase they can use as dialog. The latter is often part of a performance for an improv troupe.

<comment><USER3> Good point. I have seen the single word / phrase prompt for improv. It would be a truly impressive improv group that could make this coherent with an on the spot improv performance (but that wouldn't really be improv). The screenplay seems more difficult than a single word prompt because with the single word there is so much that you get to make up on your own. I feel like the ability to take the word salad and convey emotion and meaning through body language and delivery/emphasis of each word is a whole different skill set for an actor. words from the generate scene only without any additional improv/screenwriting is definitely the most challenging (and that's what they did here for a full 10 minute screenplay!)

<comment><USER4> I don't mean a single word prompt, I mean you can only use the single word or phrase as dialog and have to perform a scene (also randomly provided) with other actors. Bob gets "roses," Jill gets "fire," and a third person has unrestricted dialog... now do a scene where Jill is a salesperson getting ready for pitch to a big client.

The word salad you're describing would be no more difficult than having a scene where actors have to speak gibberish (faux Klingon or something)... which coincidentally isn't unlike another improv exercise where one person has to convey a message given to them by the director to other actors but must talk gibberish or just use a single vowel sound.

</comment></comment></comment></comment></comment><comment><USER5> Apparently the "essence of sci-fi" is people saying "I don't know what you're talking about" to each other.

<comment><USER6> I notice one of the inputs was The Phantom Menace. This film's dialogue was better.

<comment><USER7> Me se don't know what you are talking about

</comment></comment></comment><comment><USER8> This is a weird thing about LSTM generated sequences. Any random 5 seconds of this sounds reasonable. Like it could come from an actual movie. But there is no coherency between these sections. It flows and ebbs randomly around the state space like a markov chain, with no direction.

I think this is because LSTMs have very little "memory". They have a learned procedural memory, but no episodic memory. So they have a very difficult time keeping track of information. E.g. if I say "the cat was in the box", a few sentences later I might say "the cat is in the __" and the LSTM has a hard time guessing "box".

Second, it works by predicting the next character in a sequence. This is _not how humans write_ , at all. If you ask a human to predict the next word in a sequence, and then the word after that, and then the word after that, etc, you would also get something like this.

<comment><USER5> The output is not far off what what a Markov chain or "Dissociated press" (1) technique would make. I did one of those 20 years ago for fun in a few hours; it wasn't AI then.

1)

[https://en.wikipedia.org/wiki/Dissociated_press](https://en.wikipedia.org/wiki/Dissociated_press)

[http://www.catb.org/jargon/html/D/Dissociated- Press.html](http://www.catb.org/jargon/html/D/Dissociated-Press.html)

</comment></comment><comment><USER9> AI is not here, as far as we know, so let's stop throwing it around with every other topic

<comment><USER10> > as far as we know

Or maybe AI is here, and it's throwing out all these articles to hide its emergence. :)

<comment><USER9> Ender's Game suggests such a genesis story for AI: born as a "spark" of self awareness in the world wide computer network where it developed silently for a while, before making itself known to humans

<comment><USER11> Oh wow, is that where that meme started? (All I know about Ender's Game is from [https://web.archive.org/web/20110319084212/http://plover.net...](https://web.archive.org/web/20110319084212/http://plover.net/~bonds/ender.html))

<comment><USER12> I don't know anything about the site you linked, but at face value, that article is absolutely awful. (Is it satire?)

For example, the point at the end saying the book celebrates a guilt-free genocide. Not the point at all! OSC wrote the entire rest of the series about his main character grappling with the guilt of what he did.

</comment></comment></comment></comment></comment><comment><USER13> A sort of Proxy Turing Test would be that a computer could write a character with a convincing inner dialogue.

If a machine author can produce a simulacrum of consciousness by good characterisation then that seems like a partial theory of mind.

</comment><comment><USER14> Ignoring for a moment that the script makes zero sense... I expected the writing to feel more sci-fi-esque: space, aliens, computers, physics, etc.

Maybe the conclusion to draw is that sci-fi writing is 99% like any other storytelling in terms of how characters think, behave, and talk.

<comment><USER15> Scripts of popular sci-fi movies, anyhow. Most films aren't going to be _A Clockwork Orange_. Instead, they'll just have the same sort of dialogue and tropes as other popular movies, with the science fiction aspect relegated to the sets, props and costumes.

</comment></comment><comment><USER16> to be fair, I felt pretty much the same as I did at the end of Primer

</comment><comment><USER7> A chinese room making party conversation and keeping to the filler lines that allow to connect to the most conversations?

</comment><comment><USER17> Can anyone explain the appeal of getting an AI to generate a movie or (chat with you)? I find that experience "plastic", not exactly the right word but I hope it conveys the feeling I get when something programmed pretends to be intelligent.

<comment><USER18> I'm very interested in this area, and for me it's a couple of different factors.

From the engineering side:

1\. There is a model that is built of what is a valid screenplay, and that can grow and be enhanced over a time. What gets generated is an 'acceptable' output.

2\. Lots of extraction of storytelling and adding all the features and constructs to the model (through algorithm or manually).

3\. Representing that knowledge in a form that makes sense, in English.

4\. You really get to play with the pieces of what makes language and the composition of language work rather than just consuming it, which is sort of the same as authoring under your own power.

5\. The act of carrying a tune. Lots of AI's right now are building a model with a look at the next step which is great- but combining that with building a structure with a beginning middle and an end is much harder.

From the output/end result side:

1\. Lack of culture preconceptions- an AI doesn't know what the last Marvel movie was, an AI never saw Back to the Future, an AI can't quote Star Trek or Gilmore Girls references off the top of their head (unless they were informed), an AI doesn't know about WWII, the Crusades, or other historical events, lots of things like that.

2\. Lack of social norms- developing a morality system for the end output is very difficult so the AI author doesn't know what is appropriate or isn't.

3\. The act of serendipity. Just like doing a materials science or engineering optimization through computers you can have a sequence of events that come together in an unexpected way. Instead of getting a interesting new material or alloy, you end up getting something that is a valid output of the model with all of the warts for and against.

4\. It fits the form of a 'single room/closed room' movie such as 12 Angry Men. The entire universe as it is known by an AI is considered when it constructs a script.

This ends up forming for me at least the same kind of intrigue as watching sports or a well written mystery. It is a story told within in a certain framework and there is always a chance for something truly special to come from it.

</comment></comment><comment><USER19> Interesting that the AI is able to produce a meaningful storyline without fully understanding characters; makes me wonder how it would do at producing stories without any characters; such stories exist, bit SciFi feeling too.

<comment><USER20> > Interesting that the AI is able to produce a meaningful storyline without > fully understanding characters

Does it? I think the actors and film makers did a pretty good job of creating a film with meaning and characters, despite not having much to work with. In fact a lot of the fun of this is watching the actors try to make something out of the word salad they've been given.

Edit: If you want to see the script unembellished by the cast and crew it's here [https://www.docdroid.net/lCZ2fPA/sunspring- final.pdf.html](https://www.docdroid.net/lCZ2fPA/sunspring-final.pdf.html)

It's a damn thing scared to say. Nothing is going to be a thing.

<comment><USER21> Also _we_ fill in tons of subtext I'm quite sure the AI has no idea about.

<comment><USER22> Also, this script appears to have been selected by a human actively looking to find apparently meaningful and original structure and sentiments from a long list of attempts by Benjamin, most of which clearly derived from the source texts

> For a while, Sharp said, Benjamin kept "spitting out conversations between > Mulder and Scully, [and you'd notice that] Scully spends more time asking > what's going on and Mulder spends more time explaining."

Can't help thinking that this reported response to questions about the film appears more meaningful - poignant almost - than anything in the actual script

> The world is still embarrassed. > The party is with your staff. > My name is > Benjamin.

<comment><USER23> It reads a lot like Racter (I think I read that _The Policeman 's Beard is Half-Constructed_ actually involved a lot of human selection of amusing and interesting utterances).

</comment></comment></comment></comment></comment><comment><USER24> AI?

If it were written by a man, we would call him stupid.

<comment><USER25> AI is basically divided into three "levels": ANI (Artificial Narrow Intelligence), AGI (Artificial General Intelligence) and ASI (Artificial Super Intelligence).

We already have a bunch of narrow AIs, as in, algorithms that do a specific thing in a way that no human would have ever been capable of doing it (think: Google searches). If such AIs (well, large amount of algorithms combined) were thrown into any other scenario other than the one they were created for, they would be useless and a human could perform better than them because humans adjust easier (we don't have to change a bunch of lines in our brain to be able to drive on the left side of the road, it just takes us some time to adjust).

This is a perfect example of this. We have an ANI that was intended for one purpose, we have a scenario for which it wasn't created (imagining SciFi scenarios) and it behaves poorer in that scenario than a human would.

However, we've now explored what can it do in this scenario. We laughed at how terribly bad it behaved and we can either move away from it, improve the AI so it can do this one specific task better than humans, or improve the AI so it can do it kind of okay, but not very brilliantly (like a random person would do if you stopped him and the middle of the street and asked him to write a SciFi scenario).

Once we have an AI that behaves kind of okay, but not brilliantly, in any situation we can possibly put him in and at the same time, if it can learn from his mistakes and improve itself not to make it anymore, we have a AGI (Artificial General Intelligence).

AGI behaves exactly as a human, _but_ , because it will be able to surpass the physical limits that we humans have (as in, brain capacity, dependence on food/water/oxygen etc.) and because it is able to improve itself by learning on his own mistakes, soon after he hits the AGI mark, he will surpass that and become ASI (Artificial Super Intelligence).

What happens then, nobody knows. It's hard to imagine how something with a higher intelligence than ours is going to behave. All we can do is to try to come up a number of certain plausible scenarios. If there are negative ones (and sure as hell there are), then we need to address them _before_ we even create something _close_ to being AGI, because by the time the AI hits the AGI mark, it's already too late for us to do anything about it.

There you go, AI philosophy 101.

<comment><USER3> > because it is able to improve itself by learning on his own mistakes, soon > after he hits the AGI mark, he will surpass that and become ASI (Artificial > Super Intelligence).

I was with you until this point. You have a great description of why ANI is not AGI, but this AGI => ASI is just hand waving.

An AGI will have some of the same issues to deal with:

1) opportunity cost. yes, it will have more time because it doesn't sleep. Although maybe it will find that spending 1/3 of its time/resources cleaning out the cobwebs is optimal. Regardless it will have to spend resources (including time) on some things rather than others. The leap from general adaptability to perfect selection of tasks is likely just as large if not larger than the leap from ANI to AGI.

2) Some problems are just plain hard. There are algorithms for learning optimal results -- even brute force. The problem is they are too complex for a realistic fast solution. Just because an algorithm becomes as adaptable as a human doesn't mean that computational complexity is reduced. Therefore, either the AGI will consume massive resources to get a single optimal answer or they will be fallible just like humans.

When we get AGI, that just means we will have adaptable general algorithms, they will still have to learn and they will still be susceptible to restricted resources. In other words AGI does not imply ASI.</comment></comment></comment>