DARPA Cyber Grand Challenge - bra-ket http://cybergrandchallenge.com/ <comment><AUTHOR> Jesus. This site hurts to use. What's with the UI pigeonholing?

<comment><USER2> Plus it was using about 30% CPU for the one page.

</comment></comment><comment><USER3> Please let's all agree that scroll-jacking must die.

</comment><comment><USER4> I'm on a team that will be participating in the upcoming qualifier for the finals. I'd be happy to answer any questions about the challenge (that I know the answers to), though not any about our specific techniques ;)

<comment><USER5> For the love of god give us all the TL;DR, the site is awful.

</comment></comment><comment><USER6> This is a neat idea, nicely presented. The proposal appeals to a wide audience by explaining the defensive significance of the tools it asks participants to develop. Is there any reason to think that people who were directly or indirectly involved in proposing this challenging are also interested in offensive applications, and chose not to talk about them?

<comment><USER7> > nicely presented

I couldn't disagree more.

<comment><USER6> Sorry, I didn't actually go through the entire scrolling graphics thing, I just read the explanation of the idea. I'll agree that that part didn't add to my understanding and I didn't intend to praise it.

</comment></comment></comment><comment><USER8> TL;DR: It's about the "Internet of Things"

It's a buzzword with an vision that can have a positive but also a negative outcome for our society.

For example: The nest thermostat learns your behavior and selects your favorite temperature depending the day of time, the ambient light, ... it learns with you - and actually helps to save you energy. The opposite is a "smart meter" forced on you by new regulations that isn't smart at all and doesn't help you to save energy but sends your power usage data (your private life data) in regular intervals over the net to the usual data collectors.

Another example: All Ford automobiles that come with the Sync board computer (2008-2015, Windows CE based) can be optionally set to do the following in the event of a crash (at the time when the airbags go off): use your phone connected via Bluetooth, set a call to the international emergency hotline, speak via the Nuance Text-To-Speech software an emergency text including your current position (car have an inbuilt GPS antenna) and open the microphone so that you can talk with the emergency hotline or at least they can hear the audio if you are unable to speak. On the otherside, some lobbies try to propose in the US/EU a new law where every car has to share its location and some other "metadata" in a short interval (as soon as you turn on your motor) to a central data collector - so that in the event of an accident they know where you are, as they say.

Decide yourself which version of the "Internet of Things" vision you want to have in your everyday life.

<comment><USER9> The nest thermostat is a completely different device from an utility smart meter.

For example, I can see smart meters helping provide real time data _to the utility_ about power usage. Utilities are engaged in an enormous task of forescating power demand, which is probably much harder than weather forecasting even (as that is a subtask of demand forecasting!) -- and can net huge savings for the companies; or allowing more fair pricing schemes that discourage usage in times of high demand; etc. That's a real benefit for society.

I don't think there's a need to put a tin foil hat and demand that all personally identifiable information collection be ceased. We instead just have to make sure this info is getting used properly (within the designated scope) with according security for each problem. In other words: scrutiny, not celibacy.

<comment><USER8> > completely different device

You can twist it how you like but it doesn't make a difference - it's a device that the PR suggests that it helps you save energy and costs. One device (Nest) lives up the dream and is great, the other (smart meters) is the opposite - but it could be a great device too if it would live up the original PR vision.

> enormous task of forescating power demand

Not really, the electrical power transformer stations that are physically located near your home already communicate about the power demand habits to the central power grid network. There is no technical reason to track every single house hold every 15min or every hour.

> provide real time data to the utility

Do you believe it's great that a washing machine is running during the night to save costs for the power company (and maybe you) but keeps you and your neighbors awake and you have to deal with wrinkled laundry in the morning?

One can save energy at home, but the biggest power consumers at home are devices that are used at specific times - and that time cannot be deferred to the night - except one wants to be the slave of his own devices. On the other side a lot of energy could be saved in industrial production by optimizing processes.

Next time one buys a device check the energy rating - but be smart and cautious as some very energy efficient rated devices like new electric kettles and vacuum cleaners consume less power by using less Watt which means physically it takes longer to boil the water or the vacuum cleaner is less efficient as the engine is less powerful and it takes longer to clean your home.

Far better for the environment is to install photovoltaic panels near your home yourself. Especially then an electric car makes a lot of sense.

<comment><USER10> > it's a device that the PR suggests that it helps you save energy and costs.

I think being able to see your usage broken down to more than one reading per quarter can definitely help. You can then change your behaviour and see the improvements very quickly. One product many of the companies hand out with smart meters is something that sits there and tells you how much you're using _right now_. I can easily see that making people realise just how much they're using while not realising it, and turning some things off.

> but be smart and cautious as some very energy efficient rated devices like > new electric kettles and vacuum cleaners consume less power by using less > Watt which means physically it takes longer to boil the water or the vacuum > cleaner is less efficient as the engine is less powerful and it takes longer > to clean your home.

While you do need to check, you can definitely get lower powered kettles and vacuums (particularly the latter) that are as good or better. The EU has come around to regulating vacuums because many were just putting uselessly big motors in that did nothing really helpful for actually cleaning, but used loads of energy since people see a higher power and think it's automatically a better vacuum.

</comment></comment></comment></comment><comment><USER11> Will be interesting but a distraction from real INFOSEC work. DARPA and NSF have been leading the way with programs investing in real security. All kinds of results from SAFE processor to CHERI capability architecture to self- diversifying systems to inherently secure programming have come from this. Their HACMS work, for example, was even integrated into a UAV software.

It's that sort of work that's really delivering and needs more support. Smart people at institutions with good grant writers should stay watching all the DARPA and NSF security funding announcements. Plenty of money going around to solve fundamental problems. Great results so far that just need more development and adoption. And more bright men and women in the trenches fighting the rest of the hard problems.

<comment><USER12> I wonder , are those technologies scalable to micro-controllers ? because there the problem of backward compatibility is significantly reduces - as long as you supply a tcp/ip stack and an efficient compiler, the rest of the code is relatively easy , in many cases.

<comment><USER11> Yes, actually. Heck, the very limited PDP-1 was a capability machine of sorts. Most microcontrollers run circles around it. The simplest of the new schemes check small tags with hardware that runs in parallel to the processor. Essentially, the processor executes the instruction and the result is not written unless parallel unit says "All good." This should have little performance, latency, and chip area overhead. I'm not saying every microcontroller of every cost and such can be done this way: probably just mid- to high-end microcontrollers will be secure by design.

Also, there's long been chips design to run languages that are type- or memory-safe by design. Sandia Labs recently made a high assurance processor for a Java subset: the Sandia Secure Processor (SSP) or "Score" processor. It doesn't allow new code in production mode, resists all kinds of errors, has assured tool sets, has a converter from legacy Java to its, speaks JVM natively with associated benefits, uses asynchronous interrupts for determinism, and is fabbed in a rad-hard process. They aimed at safety & assurance over throughput so the specs are 25Mhz from 35,000 logic gates (110K with memory). Their ASSET framework and its high assurance design also led to amazing feet of 3 weeks from synthesis to working ASIC with no timing errors. They said similar projects normally take 6 to 18 months (!!!).

In closing, the above is evidence embedded can benefit. Yet, two in embedded just popped into my mind: CodeSEAL and smartcards. CodeSEAL combines custom hardware with a processor to (a) encrypt and hash memory pages to stop leaks or attacks outside SOC; (b) control flow whitelist produced by compiler to block all attempts to hijack it. MicroSEMI sells this commercially. Other one is smartcards: microcontrollers with strongly assured hardware, firmware, VM's, and so on for small prices. I should've thought of them first because they kind of answer the whole question, don't they?

Guess it doesn't hurt to spread more info on high assurance security tech. ;)

<comment><USER12> Thanks! Very interesting, especially the sandia rapid development tool.Could be really useful in creating low-cost mcu's.

I've looked through a few of the examples, and they are useful, but they require a different toolset from what real-time engineers use(JVM/CodeSEAL), and you probably need to certify your code in order to get eal6+ for your system. All those are big barriers for penetration, which probably creates less incentive for mcu companies to develop eal6+ mcu's with rich peripherials which will appeal to the market.

Do you see a way out of this ? maybe using rust(or some other language), an eal6+ certified RTOS and an eal6+ mcu , would enable people creating secure real-time systems without need of certification?

<comment><USER11> The toolset differences are a _huge_ barrier to market penetration. It's why technically superior, but architecturally different, products of the past were ignored to our loss. Itanium, with its advanced security, is a recent example. Not all are like that, though. There are a number that just protect pointers, do segments, do address space protection (see INTEGRITY-178B), or vary the granularity of the protection for legacy compatibility. These tend to support a modified UNIX/Linux kernel and/or GCC modifications. Things are otherwise the same. So, there's potential in those.

I found the following looking into embedded use and what works with similar tools. This tagging scheme [1] integrates with RTEMS and C albeit with more complexity than some. The guarded pointers [2] from mid-90's probably would work well with microcontrollers given embedded code is often fairly static, esp safety-critical schemes. The critiques shouldn't apply as much except cost of extra bits. The SAFE architecture's PUMP [3] does arbitrary policies with costs that _might_ put it outside of microcontroller range (high end? mid- range?). One can even use the old Burrough's model where 2 tags bits per word are used to ID pointers and code. Writes to either generate an interrupt for security system to approve based on context. Again, embedded is static enough that there should be no such interrupts in normal operation if pointer- arithmetic is avoided, right?

Feel free to give your thoughts on these in terms of microcontrollers or low- cost microprocessors.

[1] [http://www.uidaho.edu/~/media/Files/orgs/ENGR/Research/CSDS/...](http://www.uidaho.edu/~/media/Files/orgs/ENGR/Research/CSDS/2014/A%20New%20Operating%20System%20for%20Security%20Tagged%20Architecture%20Hardware%20in%20Support%20of%20Multiple%20Independent%20Levels%20of%20Security%202014.ashx)

[2] [https://www.cs.utexas.edu/users/skeckler/pubs/asplos94.pdf](https://www.cs.utexas.edu/users/skeckler/pubs/asplos94.pdf)

[3] [http://www.crash-safe.org/assets/PUMP-ASPLOS-2015.pdf](http://www.crash- safe.org/assets/PUMP-ASPLOS-2015.pdf)

<comment><USER12> Thanks.

The guarded pointers look great , and both them and the Burrough model could work well for micro-controllers, and suffer a relatively small penatly. The SAFE-PUMP would probably need a relatively new manufacturing process to make economical sense for medium-end microcontroller or would be fitting for a high-end microcontroller.

>> Again, embedded is static enough that there should be no such interrupts in normal operation if pointer-arithmetic is avoided, right?

I think when calling a function and pushing stuff into the stack ,you'll need such interrupts, and maybe in other situations.I'm no sure though, i'm just an hobbyist in embedded, but pretty interested in the industry - and the tension between the fact that everybody says internet-of-things-security is a big issue with no solution and on the other hand ,the availability highly secure research and working systems.

Anyway, thanks again for your help!

</comment></comment></comment></comment></comment></comment><comment><USER13> I suppose the challenge is to read through the site and successfully extract it's meaning?

<comment><USER11> Lmao. My initial reaction exactly. DARPA's writers are usually better than this if it's something open to the public. Other times, they do it on purpose. Maybe they got mixed up on which style to use.

</comment></comment><comment><AUTHOR> Or, less formally, the "Build An Internet That Pwns Itself For The Government" contest.

<comment><USER14> Where would silicon valley, and the world in general, be without DARPA? Not that I am trying to support any big brother agenda, but it's hard to deny that your smartphone and computer owe at least some part of their existence to efforts on the part of the US defense budget. Again, I am not trying to take sides, I just find it shortsighted to cast a disapproving eye on government projects....or at least funding.

<comment><USER11> Just agreeing here on the part about DARPA. It's possible, though, that you have no idea just how much DARPA was involved. Despite my research, I just now stumbled onto the Strategic Computing Initiative which shows most of the coolest stuff I studied was all tied to DARPA. Most people haven't heard of it despite it being much more useful than the other Strategic Initiative they know about. Link below for your enjoyment.

[http://monoskop.org/images/d/d4/Roland_Alex_Shiman_Philip_St...](http://monoskop.org/images/d/d4/Roland_Alex_Shiman_Philip_Strategic_Computing_DARPA_and_the_Quest_for_Machine_Intelligence_1983-1993.pdf)

</comment></comment></comment><comment><USER15> > The Skynet Funding Bill is passed. The system goes on-line August 4th, 1997. > Human decisions are removed from strategic defense. Skynet begins to learn > at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time, August > 29th. In a panic, they try to pull the plug.</comment>


Zulip 2.0: Open source team chat - <AUTHOR> https://blog.zulip.org/2019/03/01/zulip-2-0-released/ <comment><USER2> We use Zulip for xi-editor and related projects, and I am very happy with it. I find it helps us have real discussions, as compared to other types of forum (and I've tried a bunch).

Two features in particular make me feel it's helping me rather than just trying to soak up my time and attention. One is the "topic" organization, which is especially useful for conversations that span a length of time. A serious downside to HN and Reddit is that discussions flare up for a day and then become dead. Topics solve that, and have the added advantage (compared to, say, IRC) of being linkable, so I can point people to an existing discussion.

The second is the unified chronological display. This lets me catch up quickly with lots of discussions at once, as opposed to digging through a page for each conversation and then sifting through timestamps to find the new comments.

Disclosure: none. I'm just a happy user, and it's generously available for free to all open-source projects. I have no connection to Zulip or Tim, other than being fellow Recursers (which is probably how a lot of Zulip users get hooked).

<comment><USER3> > I find it helps us have real discussions, as compared to other types of > forum (and I've tried a bunch).

Have you tried a modern forum, like Discourse? I'm trying to understand why many open source projects opt for chat platforms instead of a forum. Why are you resignating public and search engine accessible discussions?

<comment><USER2> I have used Discourse quite a bit, and it was a top consider when we were looking for a new platform.

Public web archives are a goal, and either we'll deploy a bot to publish them, or I've heard rumors this feature may be added to Zulip itself.

In the meantime, it's kind of nice not having everything immediately publicized. We've had (knock on wood) exactly zero problems with spam users, even though it's open to everybody with a Github account. I'm also (if temporarily) enjoying the freedom to talk a bit more intimately, for example I'm discussing a major project I'm considering taking on.

<comment><AUTHOR> Public archives is definitely on the Zulip roadmap; much of the preparatory backend work for supporting was merged last year.

One thing I'd be interested in feedback on is how folks would feel about an ugly/janky version? There's a few different versions we've talked about:

* Being able to use the main Zulip user experience, with "public user" data (no unreads, can't send messages, etc.). This would be best as an actual browsing experience.

* Having a totally new webpage that's mostly just HTML+CSS (better for search engines) similar to our digest emails.

Possibly we'll eventually do both, but I'd love feedback on which of these open source projects care about the most.

(In any case, it'd be configurable at the stream level, so you could have some but not other streams that are public in the organization be publicly archived; we already have the data model for doing that).

<comment><USER4> I think (2) sounds more useful too. You may also wish to consider a 3rd option: a machine readable export format (XML?), which would allow users to make their own human-readable archive formats.

<comment><AUTHOR> That's already easy to do with the Zulip API.

</comment></comment></comment></comment></comment></comment><comment><USER5> Congrats on finishing this.

A suggestion for the Zulip team: email is the hardest part of setting up any self-hosted solution, and Zulip is no different. You covered a lot of bases in your email section: [https://zulip.readthedocs.io/en/stable/production/email.html](https://zulip.readthedocs.io/en/stable/production/email.html)

However it's still too difficult for many people to setup an account with an ESP, get the SMTP creds, and configure Zulip to use it correctly. It's a big step for people newer to self-hosting. I would suggest meeting somewhere in the middle for those people, by offering a paid self-hosted tier that handles some of the "harder" stuff for them. You can see how the popular 3CX phone system does this for inspiration: [https://www.3cx.com/docs/fqdn-management- allocation/](https://www.3cx.com/docs/fqdn-management-allocation/)

All 3CX accounts receive a FQDN and confirmation emails are routed through this managed service, no configs needed. You could charge perhaps $80/yr for this tier, so customers wanting to host their own data can do so, but have SMTP and DNS managed for them by providing them with a Zulip subdomain, like Slack does.

<comment><AUTHOR> Interesting idea; it's not something I'd thought about. I definitely figuring out what SMTP server to use is the hardest part of Zulip server setup, and I had believed there was nothing we could really do to make it easier. I guess the concerns I'd have are:

* Do people running on-premises actually want us to be an intermediary for all the emails their Zulip server is sending? I would imagine if they were happy with that, they'd be happy to just use Zulip Cloud.

* How does 3CX avoid this service requiring them to do a bunch of anti-spam work?

<comment><USER6> For 1-click deploys, have you considered packaging for cloudron? It has other chat apps and it has automated email send/receive as well.

<comment><AUTHOR> It looks like they are based on Docker; I imagine they could use [https://github.com/zulip/docker-zulip](https://github.com/zulip/docker- zulip). It seems like Cloudrun packages other apps, not the other way around?

</comment></comment></comment></comment><comment><USER7> So much better than Slack. It's crazy to me that a never-ending stream of chatty one-liners is what people think as "productive"

Experiment for slack lovers: Start talking about something in a channel with ~20 people. Have another use try to start _another_ conversation in the same channel.

What happens? Garbage. Chat is not how work gets done. Or how knowledge is transferred and, most importantly, retained.

<comment><USER8> We make heavy use of threads in slack for anything serious at my work. #general and #random are a mess of course, but that's kinda their point.

<comment><USER7> If they worked better we would too. But you can't have threads without also stopping people from throwing one-liners into an ongoing channel. You need both.

</comment></comment></comment><comment><USER9> I have been using Zulip for a long time now. One of the complains I get too often is that design is not very appealing compared to slack or discord. Though it's very fast most people just don't care, and hence it's hard to convince a team. Are there any plans for UI changes? I wish you guys did.

<comment><AUTHOR> Yes, there are several major things planned (in addition to the fact that every release touches dozens of smaller UI things; you should see what the Zulip 1.3 settings UI was like!). A few notes:

* There's active work on replacing the top-navbar/search area with something nice and clean that displays the stream description, number of subscribers, and other details.

* Our current visual density is really good for power users, but . zooming to 110% makes some people a lot happier and makes Zulip look more modern. We're working on changing the default visual density to look more like that, while leaving the current styling as an option for power users.

* You should try the night theme (in "display settings") -- a lot of folks who are picky about design prefer that one.

<comment><USER10> Thanks for planning on leaving a dense option in. I much prefer UIs with less whitespace and am saddened by the current trends in this area. I really like Zulip and its UI, thank you and everyone else for creating it!

</comment></comment></comment><comment><USER11> I have used Zulip in the context of a well-tooled coding/debugging workflow and I can't think of anything it didn't do that would have been useful. Nice integrations with JIRA and other coding oriented tools. I didn't like the Android UI, but that was a minor point at the time since I'd have to get out my laptop to address an issue anyway.

I use Slack for some projects currently, and it's pretty good most of the time, and brilliant some of the time. The UI is slick AF but it stumbles some places, such as spreading UI verbs around the menu bar, a pop-up menu, and a button bar without having the menu bar replicate things like accessing the pinned items pane, which is only a tiny monochrome button in the tiny button bar. IOW it's slick until it isn't.

Overall I'd say if you add Zulip to your task list for setting up a coding workflow you won't regret it. Slack is a little easier to get non-technical people on board, especially if they are more smartphone UI oriented, but Slack is no bed of roses, either, when it comes time to explain to users when channels, threads, topics, stars, and pinning are useful.

</comment><comment><USER12> We're thinking about un-slacking our team. We're utilizing Airtable and Atlassian for more contextual discussion but want to keep a chat system around - especially as a 100% remote team. Rocket.chat has been our planned destination for some time now, but we have looked at Zulip in the past as well. Can anybody compare and contrast Zulip vs Rocketchat, or link to something that does? I'm especially interested in if this new release changes that equation in any significant ways.

<comment><USER13> I was part of the un-slacking task force at my previous job. We gave Rocketchat a test run, but ultimately decided it was just a less-polished Slack. We also took Twist for a spin, which I really enjoyed. However, our support department relied too much on real time chat to abandon it completely. Zulip was a really nice compromise that I highly recommend.

If every Slack post had to be either the start of a thread or a reply to a thread, you'd basically have Zulip. The hardest part is conditioning everyone to use good thread names and not establish topics that are overly broad or narrow.

</comment></comment><comment><USER14> We use Zulip for Code Shelter ([https://www.codeshelter.co/](https://www.codeshelter.co/), an OSS maintainers collective) and I love it. It's so easy to keep track of everything, and I love how it encourages you to write long-form replies rather than the Slack-like one-offs. It feels like a cross between chat and email, with the best of both worlds.

</comment><comment><USER15> Neat! But no e2e encryption, so I'm going to have to stick with Matrix. Interested to see how this project progresses, though. Looks great, and active.

<comment><AUTHOR> So, philosophically, as a former MIT cryptography grad student who spent a lot of time in Ron Rivest's office, I'm unwilling to offer a cryptographic guarantee like "E2E encryption" if it doesn't actually provide the security guarantees that any reasonable user would expect when they heard that phrase.

Zulip encrypts all content in transit using HTTPS, which protects against a pretty wide of potential attacks to the privacy of one's messages. We put a lot of effort into ensuring messages aren't sent to the wrong users (one surface-level detail here is that our backend codebase has ~97% test coverage; which becomes 100% for views, validation, and other security-sensitive code).

The big thing that these techniques don't protect against which E2E encryption is supposed to solve is a malicious/compromised server accessing message content. But I'm also not convinced there is a viable solution supporting desktop+web+mobile+terminal apps that can prevent a malicious/compromised server from getting access to message content.

Just to highlight one of the issues, if you're using a webapp, the server itself is what tells your browser what code to run. So, if the webapp can display decrypted message content in a browser, a hacked server can just deliver JS code that causes the browser to fetch every single message of history your browser client has access to and send them back to the server unencrypted. I've thought at times about whether a trusted browser extension could help, but I don't think it can. I imagine the various "E2E encrypted" apps address this issue by just not offering a webapp.

Even if one were willing to abandon having a webapp for this feature, the really hard problem with doing E2E encryption is key storage and distribution. What process do you need to use to move your secret key between different devices safely (or do you just lose access to your history when your phone dies)? How do new users who get added to a stream get the secret key for that stream? Maybe there's a Keybase integration that would solve this (I actually have exchanged a few emails with the Keybase team about this concept).

<comment><USER16> _> Just to highlight one of the issues, if you're using a webapp, the server itself is what tells your browser what code to run. So, if the webapp can display decrypted message content in a browser, a hacked server can just deliver JS code that causes the browser to fetch every single message of history your browser client has access to and send them back to the server unencrypted._

If a native app is compromised, you are screwed all the same. I don't see how the delivery channel makes a difference -- the server serving the web client doesn't necessarily have to be the same one that's relaying the messages...

<comment><AUTHOR> Well, theoretically, you could use a signed version of a native app from a distributor you trust (or build it yourself after inspecting the code, or whatever).

</comment></comment></comment></comment><comment><USER17> It's sad that electron app is now only way to get a desktop client this days.

<comment><USER18> Zulip also has a terminal client.

</comment></comment><comment><USER19> Does it have read receipts now? They were one of the reasons why we picked Matrix over Zulip for our war room chat at work.

<comment><USER20> Oh god, that's terrifying. Then I'll see "Why haven't you read my message? Why are you ignoring me?" all the time :(.

<comment><USER21> Still not quite as bad as the "I _know_ you read my message and are deliberately ignoring me."

</comment></comment></comment><comment><USER22> How hard is it, currently, for an ordinary technical but non sysadmin person to host Zulip on a VPS? say, for 30 users. is the process very complex? is it a lot of work?

<comment><AUTHOR> Probably one of our users can better to attest to this than I can, but it's really easy for someone with that background to maintain. For installation, we've put a ton of effort over the years into making all the commands Just Work if you copy-paste them, adding custom error messages if you run something as root you shouldn't, etc.

And we put a ton of effort into making the upgrades, even for major releases like this, be a single command that Just Works for almost everyone.

I know this because I personally respond to every single report of issues installing/upgrading Zulip and have been making changes (even if the issue is basically user error) after most of them to help ensure they don't happen again for a few years now.

That said, if you don't want to deal with doing that work, Zulip Cloud is very reasonably priced for situations where all the users are employees (compared to payroll, it's effectively free) and for other use cases, we have steep discounts (e.g. free for open source, a huge discount for education, etc.).

<comment><USER23> I set our juniormost sysadmin to install Zulip. He took a couple of days to read through the docs, then did it in an afternoon.

Adding custom keywords -- Zulip calls them linkifiers -- took a fair amount of time, but we have about 25 of them and few of them resembled each other much.

Since install day, it really hasn't required much maintenance.

</comment></comment></comment><comment><USER24> I wonder how the IRC bridge works with regards to threading.

Does it merge multiple consecutive messages from a single user into a single Zulip message?

Are all replies from a channel just a never ending thread that goes on and on forever?

I might have to try it to find out.

<comment><USER25> I believe it's the second :). (All replies from a channel go into a never ending thread that goes on forever.)

</comment></comment><comment><USER26> Tangent about threads and Slack culture.

I have noticed that there are people who either purposefully, or unconsciously, do not use threads. They litter the stream by making sentences instead of paragraphs. What I don't understand is how could Slack not see this as an issue?

From my individual's perspective, I don't get the idea of chats as a one liner when topics should be contextualized via threads.

<comment><USER27> I've heard Zulip is much better about threads, but in Slack there are some annoying things about them. Everything is crammed into the sidebar, so reading log snippets suck. Also, I noticed people will often post their initial message, then a @here with slightly more info in the same channel. I'm not sure where to begin the thread from. I haven't been able to intuit the rules for alerting people or uploading things like images into a thread.

<comment><USER28> FYI for slack I see a button for "All Threads" or "New Threads" at the top of the left sidebar. Here you can see all your threads in full width glory (instead of crammed into the sidebar which I agree is annoying).

<comment><USER27> You're right. I don't know if this is a bad habit on my part, but I generally avoid "All Unreads" and "All Threads" because I'm focused on one thing at a time and want to leave unaddressed things unread until I can focus attention on them.

</comment></comment></comment></comment><comment><USER29> Is the Linux client native? Discord and slack have > 1gb footprints bc they're just web browsers and its awful.

</comment><comment> rooam-dev We really like Zulip, but one major complaint is the delay/slowness of notifications on mobile apps. We are not self hosting it, but using the official zulipchat domain.

Is this a known issue?

It is a problem, because we want to use Zulip for alerts too and delayed notifications means slower reactions.

<comment><USER30> We did recently improve how notifications are delivered on Android, about 1-2 weeks ago. Keep an eye on if you are still having issues, I hope the delay is resolved.

<comment> rooam-dev Thank you! I will pass it on.

</comment></comment></comment><comment><USER31> I've been looking at solutions like Slack/Zulip/Rocket.chat for a real-time customer-support/chat system where the user would chat with my team via a chat interface on the web-app while members of my team would reply via the chat solution on our end. This way we'd keep all these customer convos in the same place where work-chats happen.

Does anyone know whether Zulip has an integration or some trick to achieve that? I'd rather not have yet-another-system in place just to accommodate chats with customers.

</comment><comment><USER32> Zulip is definitely the best of the open source Slack alternatives. But having to think of a subject for every single message is just ... well, it's a newsgroup, not IRC.

<comment><AUTHOR> This is a common confusion from folks who haven't really used Zulip. You don't need to think about the subject for every message, because 95% of messages you send are replying to an existing message/conversation, and you don't need to think about topics to do that.

For those messages where you are effectively changing the topic of conversation, in Zulip, rather than starting your message with "On another note," or a similar phrase to communicate that you're about to say something unrelated words, you instead just send your message to another topic.

And if there are multiple conversations happening at overlapping times, Zulip's model often ends up saving you from having to say "@fred yes" in your reply to indicate which question you're answering "yes" to, because it's obvious from the structure.

You can argue it's slightly more work for the person sending a message to type a topic when you bring up something unrelated, but it's certainly not much, and it's only relevant to a small fraction of messages that one sends. Whereas what Zulip's model saves your organization is every one of the N users who can have to read the conversation needing to spend much more time and mental effort in order to understand what conversation(s) happened while they weren't looking at chat and whether there was something that needs their attention.

</comment></comment><comment><USER33> I knew Zulip already, and while reading the blog post I was thinking, Zulip needs a way to publish topics in a web format (web archive) I was surprised to see many comments about this in this HN discussion and getting to know it is already in Zulip roadmap.

I will definitely try to help develop such feature as it might be the killer feature for me to use it as a daily driver.

</comment><comment><USER34> What I hate about all the team chats altogether is lack of threading (discussion trees). IMHO threaded discussion model like we do here on HN is by order of magnitude more constructive and I can see no benefit in real-time chatting as compared to the way it works here.

<comment><USER35> You haven't used team chat for work? Then, things tend to happen chronologically, like, step by step problem solving, or doing something together. In such situations, it can be more important to find the most recent comments, than to find any "best" comments.

It's about what matters most: Knowing what's happening right now, what everyone is doing, what one is supposed to do next. Then, chronological team chat. Versus finding the best comments, e.g. when discussing a news article, or pro and cons about an idea.

We were using Slack at my last job, and it was great (now I don't like Slack any longer though, not after they added their weird threading. I like Zulip instead). Slack & Zulip = good sometimes, HN = good for other things.

<comment><USER34> We had been using Slack at a job and that was plain horrible. Say something, it drowns quickly pushed away by newly arriving messages and nobody ever remembers the problem you've mentioned unless you repeat times and times again. I've quit the job because of this. If there was a tree everybody would see an outline of problems and comments that have not been answered would be hard to ignore. IMHO chats are handy for casual personal communication and absolutely unsuitable for a meaningful conversation involving more than 2 people.

<comment><USER35> Hmm I recognize that. I mean, important information / answers / questions, in a chat-only community, that scroll up, away and are gone.

Aha you have in mind a chronological "chat" / discussion, with threads? Rather than a best-comment-first HN discussion page?

If you use something else than Slack now, it'd be interesting to hear what that could be?

</comment></comment></comment></comment><comment><USER36> Are there any apps with better threads support than slack but still allow un- threaded messages within channels? I find zulip's model too restrictive for when you want to have simple real-time chat about a certain topic.

</comment><comment><USER37> Is there a one-click installer for this yet? i.e. a pre-built image for Digital Ocean or similar.

I'm moderately curious but so far I've not gathered enough motivation to mess around with an install.

<comment><AUTHOR> We actually are working on a one-click Digital Ocean installer right now!

See [https://github.com/zulip/zulip/pull/11622](https://github.com/zulip/zulip/pull/11622) for the code; it should be in their marketplace in a few weeks.

That said, if you make just a Digital Ocean VM and run our install script, it'll Just Work and you'll get the same experience after like 10 minutes of non-interactive installation.

<comment><USER37> Good stuff. I seem to remember the installation around the time Zulip was first open-sourced was pretty fiddly. I'm glad you've made progress.

</comment></comment></comment><comment><USER38> any way for an admin / moderator to see other user ip addys / hostnames?

Any way for moderators to ban a user and an ip subnet, or cidr or hostname associated?

Any way to unban / see list of bans and reasons?

Isit possible for someone to see the ip addys of others in the chat? (some systems change ip at the server level, some send info like p2p and each chat user can find all the other users ips in various ways )

Interested, but without serious modding tools can't test it for our use cases.

<comment><USER25> [https://zulipchat.com/help/moderating-open- organizations](https://zulipchat.com/help/moderating-open-organizations) has some of that info. Zulip doesn't have IP-level banning or moderation tools (at least not at the organization admin level; maybe you could hack something together if you were self-hosting).

</comment></comment><comment><USER39> >Zulip is the world's most productive team chat software

What does this mean?

</comment><comment><USER40> It literally has 950 GitHub issues. How is that possible?

<comment><USER41> Lots of feature/change requests.

</comment></comment><comment><USER42> We are using [https://github.com/Canop/miaou](https://github.com/Canop/miaou) to stay productive, loads fast, markdown support, replies, channels</comment>


Show HN: 3,600 editable crowdsourced academic profiles of CS Profs - <AUTHOR> http://drafty.cs.brown.edu/professors/#hackernews <comment><AUTHOR> Wanted to share a computer science resource a couple of us in the HCI group at Brown have put together. It's a crowd-editable spreadsheet of data of ~3,600 computer science professors. For example, where they got their degrees, subfield of expertise, their join year and rank, etc...

It might be useful if you're applying to Ph.D. programs or faculty positions, seeking external collaborators, or just to better understand hiring trends in CS departments.

</comment><comment><USER2> I only get popups with errors like this and can't see any data.

[http://pastebin.com/mjymEFh7](http://pastebin.com/mjymEFh7)

<comment><AUTHOR> Thanks! It has been fixed. :)</comment></comment>


Carnegie Mellon Reels After Uber Lures Away Researchers - <AUTHOR> http://on.wsj.com/1AH8LnY <comment><USER2> Wtf: Jeff Legault, the head of business development for NREC. "I would have preferred [Uber] just come to us" to develop the vehicle rather than hire away scientists, he said. Yeah, that would have worked out just great for the scientists forgoing 6 figure bonuses and doubling of salaries. Sounds like Jeff didn't want to compete for talent. Good on Uber! I dislike the sleazy biz tactics, but poaching is not sleazy. It's recognition of worth.

<comment><USER3> That seems oversimplified to me. Uber could have funded the research and given grants big enough that the professors and researchers could match their uber salary, while still receiving the perk of contributing and sharing their knowledge.

<comment><USER4> Uber could have built some new buildings for the university and paid for new student scholarships too. But they didn't because they are a business, not a philanthropic foundation.

<comment><USER5> Google is a business as well, but seems to operate with a much lower "tool" factor than Uber somehow.

EDIT: Being innovative doesn't mean "at all costs".

<comment><USER6> Hiring smart people is now considered a 'tool' move?

<comment><USER5> No, I'm referring to the other issues in the wikipedia page posted by ceejayoz.

Two examples:

When I see news about Tesla, I have a positive reaction. They constantly release new technologies, open sourced their patents, and so on.

When I see a news piece about Uber, I think, "What'd they fuck up this time?".

News pieces about how Uber was attempting to encrypt/destroy data remotely in their Canadian office while a law enforcement raid was in progress......does not help their case.

<comment><USER6> Luckily in this case all of that has nothing to do with hiring smart people to try and improve their product.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Related story: Academia pays peanuts, and I'd love to see the postdoc/grad school racket get ravaged by "poaching".

Also, probably the most important contributor in CMU SCS becoming what it is now was an act of "poaching" (of the Blums, from Cal).

<comment><USER8> Businesses have been poaching from grad schools for quite a while depending on the field. My father-in-law regularly has his doctoral students poached by Wall Street because they have extensive training in developing mathematical models and using partial diff eq's. Apparently the same mathematical thinking is highly valuable in financial markets.

While it upsets him that he invests both time and grant money toward students who don't finish the program, he understands the lure of a 7-figure salary for people who are living on a low 5-figure income.

<comment><USER9> So basically, the principles of economics upset him, but he understands them.

Maybe, just maybe, instead of using grad students and post-docs as slave labor so he can slap his name on their hard work, he could instead advocate for better pay and working conditions for them using his privileged position of PI?

<comment><USER10> As a grad student, let me explain why I don't think I'm getting ripped off.

1) I have (at least) weekly meetings with advisors who can charge >$250/hr as a consultant. They are brilliant, and our conversations are enlightening, and they actually care about the outcomes of their students. This might be out of the ordinary, but I've never felt exploited by my advisors. In CS, advisors are very aware that their students are giving up significant salaries to do a PhD.

2) I get paid enough to live, not incredibly well, but I make a median salary in the area, and at this point in my life I'm more than willing to share a 2br 2ba apt.

3) I'm encouraged to do internships which do pay extremely well, and on top of my living wage at school, mean I live really well.

4) I want a job that requires a PhD. Sure I could drop out, take my masters in AI, brand myself as a data-scientist and get a job doing some ML programming at a hedge fund making 300k base with 1MM bonus, but working at a research lab, or at a tier 2 institute as a faculty member seems like a much better life in the long run.

</comment></comment></comment></comment><comment><USER11> 40 new, very-well-paying tech jobs within city limits has to be good for Pittsburgh's tech ecosystem. And, troublesome as Uber is, I'm glad to see these scientists directing their work to civilian concerns rather than military purposes.

The Lawrenceville neighborhood, where both NREC & this new Uber office are located, has recently become one of Pittsburgh's trendiest, and has seen skyrocketing real estate values— which means houses that used to cost $30,000 or less are now valued at over $100,000.

<comment><USER12> > I'm glad to see these scientists directing their work to civilian concerns > rather than military purposes

Is that what they were doing? Because I initially thought "what a waste... a lot of public research will now be locked up in one business's competitive advantage" \- but if they were just building stuff for the military that would get locked up for decades anyway, this is better.

<comment><USER13> NREC definitely does some military work, but it also does quite a bit of civilian work (things like pattern recognition to improve industrial farming systems by discerning types or quality of produce).

But that research is generally privately-funded and privately-owned, too. NREC is not---in general---a hotbed of publicly-published common-use research.

</comment></comment></comment><comment><USER14> I see a lot of articles complaining about the lack of job opportunities for Phd scientists. It seems like Uber just created 40 jobs that were as appealing as tenure track positions. Or alternatively, freed up 40 tenure track positions for adjuncts. CMU will survive.

<comment><USER15> These are not tenure track or even academic positions. NREC is owned by CMU but it is not part of any academic program at CMU. There are no students working at NREC. NREC does technology commercialization not fundamental research. NREC's primary product is big robots not research papers (although they do publish a bit). NREC is a lot like SRI before it separated from Stanford.

<comment><USER16> Then it seems like this story is more "corporation raids corporation" than "corporation raids academic seed corn".

<comment><USER13> Basically. But that headline doesn't play nearly as well to the heartstrings of a readership already primed to assume Uber is the antagonist in any story with its name in the title. ;)

</comment></comment></comment></comment><comment><USER17> Initially I was pissed of at Uber but then I realized that the way universities run, half of anything Uber gave the universities for research would go to fund their management costs. I remember in my college days I got an $800 academic performance award and 25% was taken of for management costs. When I was a grader, they had me sign a form that any inventions I discovered as a grader would be theirs. Bunch of leaches in my opinion.

<comment><USER18> > then I realized that the way universities run, half of anything Uber gave > the universities for research would go to fund their management costs.

I think half is a bit of an overstatement in the typical case, but this same criticism can be levied at pretty much any research- or cause-oriented work, like charities and foundations.

Usually this cut is intended in part to fund the process that actually procures this funding and these grants in the first place, so under that assumption, it more than pays for itself.

You can't run an organization with literally zero overhead; it's not possible.

<comment><USER19> > I think half is a bit of an overstatement

Nope, it's pretty typical. Most grants have a negotiated ~50% overhead in "indirects". I was surprised, though, to find a Nature report[1] that found the actual overhead was typically ~20% below the negotiated rate. Which is pretty wonderful.

1\. [http://www.nature.com/news/indirect-costs-keeping-the- lights...](http://www.nature.com/news/indirect-costs-keeping-the-lights- on-1.16376)

</comment></comment></comment><comment><USER20> What were they getting paid before, and what are they getting paid now?

A "doubling of salary" sounds nice, but it's still important to know the base. "Loyalty" to an institution is almost certainly an old-fashioned concept and probably a sucker's bet, but my sense of sympathy for CMU will still be somewhat dependent on the "pre-uber" numbers.

For instance, if you lose a post-doc earning 55k and uber now pays them 110k, well, it's time to stop complaining. This is a person who managed to get high grades in an very tough undergrad major with high attrition rates, gain admission to a top PhD program (almost certainly requiring high standardized test scores), and made it thorough a doctoral program with a 35-50% attrition rate (elite med schools, by contrast, typically have attrition rates below 0.5%).

Now, if these salaries were going from $250K with tenure to $500k, I'm a little more sympathetic to CMU (though even then, I don't begrudge these researchers their new and good salaries).

</comment><comment><USER4> Note that Google did a very similar thing last year by hiring the entire Martinis lab (quantum computing) from UC Santa Barbara.

[http://techcrunch.com/2014/09/02/google-partners-with- ucsb-t...](http://techcrunch.com/2014/09/02/google-partners-with-ucsb-to- build-quantum-processors-for-artificial-intelligence/)

<comment><USER21> Is it a "very similar" thing? The people hired by Google will continue to work with UCSB graduate students and use UCSB facilities in addition to Google facilities, and Google is maintaining a partnership with UCSB.

The Uber thing sounds like it is more of a complete transfer from CMU to Uber.

<comment><USER4> They are paying USCB to use the clean room because it would be too expensive/slow to build and outfit a whole new clean room. (The UCSB clean room is one of the best of it's kind in the world; no analogous piece of capital exists for the Uber/CMU deal.) The _current_ graduate students are going to finish out their dissertation work with Martinis (to do otherwise would be terrible) but I'm told Martinis isn't taking any new graduate students.

So yes, this is very similar.

</comment></comment></comment><comment><USER22> Does anyone else think it's slightly shady to be advising drivers take on loans for vehicles in one hand, while working on making those vehicle loans a bad investment by investing in competing technology in the other?

<comment><USER23> Not if the expected (discounted) payback date of the investment is near and the expected date of obsolescence of the vehicle is far away (mind not only technical aspects, but regulation, acceptance/penetration and financial viability). I wouldn't advise a young professional to drive uber as a full time job though. He might be making enough now, but when/if obsolescence comes, he'd be out of a job and lacking the skills he should be acquiring now.

</comment></comment><comment> rm_-rf_slash Uber does not seem to care much about its reputation in its rush to own autonomous transport. When self-driving cars are ubiquitous in a decade or two, I wonder, will decent folks still opt for the biggest bully in a crowded room?

<comment><USER24> Looking at other industries: probably yes.

That said, I think Uber will fuck themselves hard, and that Uber's robotics efforts will be viewed as a massive mistake within the next ten years. This is a situation where they should buy or borrow, but they're trying to build out of greed.

Autonomous driving technology is not going to be a differentiator. It's going to be a commodity. Everybody will have it. Investing heavily in a commodity product is a waste of money.

But it's exactly the sort of mistake that one could expect an egotistical asshole like Travis to make.

Uber won't be dead in ten years; they'll be the myspace of transportation. I guarantee it.

<comment><USER25> Uber has put NREC's previous employee's on a tight deadline, in an attempt to almost literally throw money at the problem to be one of firsts to market. Assuming it works, they'll be one step ahead of the competition. If they continue to invest and innovate they won't be the myspace of transportation.

</comment></comment></comment><comment><USER26> There's got to be a difference between poaching people from another tech firm and getting them en masse from a non-profit.

Sure, they are within their rights to get these employees, but it's worth considering whether they should think about the consequences for CMU. There's a lot of organization memory that makes a lab special, especially this particular lab.

If I start a medical startup, I'm more than within my rights to hire some doctors. But would I go and hire half the staff of my local teaching hospital? I think I'd think twice.

<comment><USER4> Those researchers aren't getting paid what they are worth, i.e., society would be forgoing value by keeping them at the university.

If your point is that society misses out on the positive externality of the knowledge they publish (which they mostly won't do at Uber), then the university or a nonprofit should work out an agreement with Uber to buy that info from them, e.g., by covering a portion of the scientists' salaries.

<comment><USER26> >Those researchers aren't getting paid what they are worth, i.e., society would be forgoing value by keeping them at the university.

Of course. This is the economically naive explanation of why people are paid whatever they're paid (marginal product). It works fine for things like soccer players, where it's quite measurable whether some guy is contributing, how many shirts he sells, how much he'd add to a given team, etc. In this situation, it's not that clear. Uber have money, but that doesn't mean those people are suddenly worth more. They may make something useful, they may not. Having more chips doesn't make you right, it just wins you the hand.

>If your point is that society misses out on the positive externality of the knowledge they publish (which they mostly won't do at Uber), then the university or a nonprofit should work out an agreement with Uber to buy that info from them, e.g., by covering a portion of the scientist's salaries.

Right, and did they do that? It sounds like they just said "meh, let's not bother and just use this pile of cash to get what we want". Maybe it's more complex than that, but it doesn't sound like they care too much.

<comment><USER4> The for-profit business will strike any kind of deals the university (or other non-profit) wants for the appropriate amount of cash. The business is self- interested, so its behavior is (more or less) predictable.

The question is: do the _non-profits_ actually care about societal benefit, or are they really just managed by people interested in building prestige? CMU robotics wouldn't get nearly as much prestige from paying Uber scientists to publish papers.

</comment></comment></comment></comment><comment><USER27> Uber certainly isn't doing themselves any favors when it comes to shedding their reputation as the most brazen assholes in tech.

<comment><USER28> Because paying people a lot more money and saving taxpayers millions of dollars (since we no longer have to pay for those scientists) is being assholish?

<comment><USER29> CMU is a private university, so there won't be much in the way of taxpayer savings.

<comment><USER30> Private research universities get a LOT of taxpayer money (e.g. DARPA grants, NSF grants)

<comment><USER29> Right, but hiring 40 scientists away isn't going to reduce that money. Even if CMU doesn't get it, it's not like they're going to save it or give it to some other department or program. At best, it goes to another institution.

<comment><USER28> Yes, but that is a moral indictment of the NSF et al, who will give away their entire budget even if there is no longer anybody qualified to receive the same amount those CMU guys did.

And then ask for an even bigger budget the next year.

In contrast, it is not a moral indictment of Uber.

</comment></comment></comment></comment></comment></comment><comment><USER31> I hate the word "poaching". We are not rare and mysterious beasts owned by our employers. We are laborers who work wherever we think we can get the best deal. ("Lures" is fine.)

</comment><comment><USER30> CMU should pay its profs and researchers more than it pays its administrators.

<comment><USER32> This is the real barometer to watch-- as long as university presidents are pulling down a million a year you won't convince me that Uber was displaying their "Asshole" nature by "poaching" these guys.

</comment></comment><comment><USER33> Previous discussions:

[https://news.ycombinator.com/item?id=9602655](https://news.ycombinator.com/item?id=9602655)

[https://news.ycombinator.com/item?id=9635554](https://news.ycombinator.com/item?id=9635554)

</comment><comment><USER34> The most interesting thing about the comments here (in my opinion) is how differently the industry seems to view professionals in academic/research environments and those in for profit/private sector jobs.

If this were Uber hiring engineers from Google or Facebook and paying them a huge premium, it would be considered the market at work and I expect there would be little debate on whether Uber was acting ethically or not (even when considering the tactic of opening an office nearby).

<comment><USER35> @bedhead hit the spot with his comment "Circumstances matter. I suppose if Uber hadn't entered into a partnership first, the whole thing would be more palatable. But by going this route, Uber is sending a clear signal to all potential future partners - watch out. I just find it distasteful, and sadly predictable given Uber's history."

</comment></comment><comment><USER36> Maybe this is a bit offtopic but I'm curious what are the thoughts with Google driving car.

Right now it feels Google, Uber and Lyft will compete for the same space. Uber looks to be winning, but can it really win the race against Google.

Although to its own merit one thing comes to mind was that -- at least from PR it looks like it -- Uber is moving faster. Google which is always hiring(?) lost the chance to grab that CMU talent.

<comment><USER13> Uber is moving faster because it has more catching up to do.

But overall, this will be good for the ecosystem both in terms of raw research project (more people working on a hard problem, though they aren't working _together_ so we're not getting theoretically maximum benefit) and economics (more competition in the space as these projects do flourish into commercial projects).

In the end, this sort of thing should get the product to market faster than Google working on it alone, which will be saving lives sooner. Strict positive.

</comment></comment><comment><USER13> Good news for the researchers (and academics in general, as the knock-on effect of this event should increase their overall market value. An alternative to a life of academia is clearly out there).

Honestly, the only thing I'd be concerned about is working for Uber itself. They're a company that has made it clear on multiple occasions that the moment someone is no longer valuable to them, they'll do everything in their power to zero out their responsibilities to that individual. Even if the triple-up- front signing bonus is a good deal now, I hope the researchers they hired aren't thinking Uber is going to be a career for them...

</comment><comment><USER37> It might also be a patent play. Create some new patents related to autonomous driving and Uber's bargaining position with other patent holders would be improved... maybe enough for a free/lowcost cross-licensing deal.

</comment><comment><USER38> I am unaware of the politics, but it should be pointed out that this did begin as a 'strategic partnership' back in Jan/Feb

[http://newsroom.uber.com/2015/02/uber-and-cmu-announce- strat...](http://newsroom.uber.com/2015/02/uber-and-cmu-announce-strategic- partnership-and-advanced-technologies-center/)

<comment><USER13> I'm an alum of CMU, and make no mistake that that institution (and NREC by extension) is willing to play hard-ball to meet its own needs.

My (uninformed on the particulars of this situation) guess is that if the strategic partnership has 'devolved' into a poaching situation, CMU shares its own bit of the blame. There's a lot that went on behind closed doors that we will likely never know.

<comment><USER38> The new administration at CMU (President Suresh et al.) are very eager to open the kimono. You can check out his background with fundraising etc. They are all about strategic partnerships; frankly in this case they were too eager to please someone with very deep pockets and I am guessing weren't aware of how aggressive Uber is or they were blinded by the prospect of money.

disclosure: CMU alum as well.

</comment></comment></comment><comment><USER39> Well i'm glad the scientists are finally getting paid their worth. Good on them and their families.

</comment><comment><USER40> It seems unclear if Uber is hiring them as engineers or building an industrial research lab. The latter case could mean they'd still publish their work and contribute to the community (reviewing, conferences, advising, etc). It'd be a shame to lose that though...

</comment><comment><USER41> Nice.

I'm looking around the NREC web site. At the top, it is "research professors," with similar abusive quasi-academic positions. Maybe this will give some incentive to move from short-term grant-funded or teaching-funded positions to workable long-term faculty positions.

The pattern of decades of post docs is not workable. People want families. There is a biological clock (women, but also men if they marry similar age).

The NERC response is a little bit arrogant. Jeff's quote on Uber coming to them -- well, Uber hired short-term university employees into long-term positions. They did with those positions exactly what universities claim those positions are for (training ground for stable work). Jeff should be applauding them.

<comment><USER13> I'm not convinced Uber hires anyone into a long-term position. This project can be expected to stick around for awhile, but only in the sense that it's complicated enough to justify long time investment; once the machines are reliable enough (or Uber loses interest or funding in this avenue of R&D), expect these researchers to be out on the pavement.

It'd be wise for them to consider this, if anything, a side-move (but a side- move with a 3x salary bonus, so definitely take that money and bank it!).

<comment><USER41> I agree with the sentiment about Uber, but there is a substantial difference. Uber will close them down when it stops to make business sense. A research professor is expected to be out on the street once grant funding runs out. Most postdocs are expressly 2-year appointments. Grad students get paid dirt, and have a ~7 year limit (depending on school) with random students kicked out at random points (qualifying exams, etc.).

Neither is stable, but of the two, almost any industry, even including Uber, is much, much more stable.

</comment></comment></comment><comment><USER42> Employees being considered property. Disgusting. US universities have become the most prevalent predatory institutions in existence. Earning trillions per year and burdening millions with increasingly crippling debt, while only a minuscule fraction of that money actually goes to the professors and researchers.

Say what you want about Uber, but universities are clearly 1000x morally worse.

<comment><USER28> But.... but... but universities are sacred cows paved with good intentions....</comment></comment>


Taking GNOME 3 to the next level (GNOME 3.6 features and screenshots) - <AUTHOR> https://afaikblog.wordpress.com/2012/08/31/taking-gnome-3-to-the-next-level/

<comment><USER2> "This is a big one, and it is something that has been on the drawing board for a while. The lock screen has a single primary aim: to provide useful functionality when the screen is locked."

Sorry, what? The primary aim of a lock screen is to prevent unauthorised access. They're proposing to allow unauthorised people to change/pause songs and view perhaps personal information (they say it's configurable, but Gnome's "configurability" leaves a lot to be desired).

Also, you have to hit ESC to actually unlock, whereas now you can just start typing your password. I unlock my screen 100s of times a day!</comment>


Show HN: Speak to users of your mobile app, from inside your inbox - <AUTHOR> http://supportkit.io

<comment><AUTHOR> After months of customer dev, my team is ready to kick things into second gear with an almost complete rewrite.

Offering this to all app developers, for free and looking forward to bringing it to some great places in the next few months. Would love your feedback!

Thanks so much, @gozmike</comment>


The Housing Market Still Isn't Rational - <AUTHOR> http://www.nytimes.com/2015/07/26/upshot/the-housing-market-still-isnt-rational.html?rref=collection%2Fcolumn%2Feconomic-view&contentCollection=upshot&action=click&module=NextInCollection&region=Footer&pgtype=article&abt=0002&abg=0

<comment><USER2> but SF supply is relatively inelastic as a result of NIMBY etc. the supply of engineers maybe not so much</comment>


Preparing for a Technical Interview: Algorithms and Data Structures - <AUTHOR> http://www.primaryobjects.com/2017/03/28/preparing-for-a-technical-interview-algorithms-data-structures-and-computer-science/ <comment><USER2> Some constructive criticism... I would review your explanations to see if any imprecise sentences can be replaced with more accurate definitions. I get that you're going for a friendly tone but many times, the more accurate definition is just as easy to read.

For example this text:

 _> In the case accessing an element within an array or hash, it takes 1 operation to perform. Thus, we can describe the complexity as O(1) for this code example. This is about as good as it gets for algorithm complexity. Of course, while O(1) runtime code is quite fast, it may often come at the expense of storage._

It's clearer to say that O(1) means _constant time_ access in relation to input size. The "1" doesn't mean one operation. The alternative explanations you wrote are actually misleading.

</comment><comment><USER3> This is a great guide, thanks for sharing.

Out of curiosity, how do other employed developers allocate time to study this stuff? Immediately after graduating from college I could spend 4-8 hours a day most days of the week reviewing algorithms and solving problems without issues. Now, after a full day of coding at work, going to the gym, coming home to prepare dinner and run other errands, I'm physically and mentally drained. I might spend an hour or two before bedtime trying to study this stuff (since I completely forgot it since I last did technical interviews 1+ years ago) but progress is slow. Of course there are weekends, but that's usually the only time I get to relax and go outside to see the sun. I now understand why it takes 6+ months for working professionals to find new jobs.

<comment><USER4> Honestly, don't bother practicing "this stuff". Instead, spend your time doing what is important to you (family, friends, side projects, side business, whatever).

If you need a job, then practice. While doing your job, do it well. Don't waste your personal time on this "stuff". That's really a waste of time and effort.

</comment></comment><comment><USER5> The text does not differentiate between worst-case and average-case analysis. Quicksort is worst-case O(n^2), but average-case O(n logn). Yes, I know the text says "on average" in parenthesis, but that's not going to help a reader understand what that means. For an article that is meant to prepare people for a technical interview, I think it's important to make this kind of distinction.

The article also says that merge sort is average-case O(n logn), which is true, but is likely to confuse readers, as merge sort is also worst-case O(n logn).

</comment><comment><USER6> The BFS tree traversal algorithm is also O(N^2). Very sloppy, I'd take off points.

<comment><USER7> "Points"?

That kind of oversight is simply unacceptable in a modern, agile engineering environment. Especially not in the august company of hand-picked, top-shelf developers such as you've been able to compose your build your team out of, thus far. So I'd fire them (or that is, shift ever-so-glibly to "Do you have any questions for me?" mode) on the spot. And instruct my internal recruiter to make a point of not bothering with any kind of follow-up after the interview -- dense as they are, sooner or later they'll get the hint.†

† Again, I'm being blatantly facetious. But this is exactly how the "modern" (Google-inspired) interview process seems to work much of the time, in practice.

<comment><USER6> Is there something wrong with not wanting someone to write an n^2 function that should only take O(n)? And the person who wrote this is supposedly giving advice on how to pass such interviews for "top-shelf" programmers. So I don't see how complaining about the existence of the process is relevant.

<comment><USER7> _Is there something wrong with not wanting someone to write an n^2 function that should only take O(n)?_

But that's not what the typical whiteboard session actually assesses -- that is, whether you'd _never_ catch yourself, in _the normal course of development_ , from implementing a grossly inefficient algorithm before catching yourself, and long before significant damage has been done. BTW the operative phrase here is "normal"; as in, the normal unhurried pace at which we work, with time to reflect on these things during coffee and bathroom breaks. And of course without being surrounded by tag teams of 20-something dudes you've never met, comfortably assessing your every move -- secure in the knowledge that they'll still be in a reasonably tolerable job, no matter what, at the end of the afternoon; but as to whether you'll get out of your current situation -- that's a total crapshoot, of course.†

What they test, rather, is whether your _immediate_ , muscle-memory recall of the complexity class for _each and every use case_ is 100% correct -- subject to the above-mentioned adverse conditions. Because no matter what they say about "just wanting to see how you think through a problem" \-- in reality these quickly devolve into zombie-like grading sessions (and, depending on your state of nourishment and general composure, sometimes outright death marches). Where -- very much unlike under real working conditions -- at the slightest misstep, however temporary -- you start losing "points", and very significantly risk the prospect of failing the process altogether.

 _So I don 't see how complaining about the existence of the process is relevant._

It's an observation about a process that has been widely observed to be deeply flawed, on multiple fronts. There's no need to label it as a complaint.

† Like as not, without adequate breaks for nourishment or bathroom needs -- or a significant portion of the time, without a break of _any_ kind -- during the whole multi-hour ordeal.</comment></comment></comment></comment>


Ask HN: Is saying "I don't know during an interview" something negative?  - <AUTHOR>

Hello,
I just interviewed for a position doing PHP/codeigniter. One of the technical questions I was asked had me working with multi-dimensional arrays. This is an area where I have not had much need to work with in the past. I could not complete the whole exercise. I was honest and did not cheat by asking for a solution at some web forum. I did not get the job due to not being able to do this.
Did I make a mistake by being honest and should have just googled for the answer?
Please give me your insight because I'm just confused by the whole thing. <comment><USER2> 1\. It's always best to be honest.

2\. If you don't know how to work with multidimensional arrays, you really need to learn. It's something I would consider a core skill for a programmer.

3\. If you're competent at all, it would have only taken a few minutes of googling to figure out the right solution. Multidimensional arrays are very easy to work with in PHP.

</comment><comment><USER3> It's not a bad thing to say "I don't know" to some things. In this case though (and please don't take any offense) any intermediate PHP developer should know how to work with multi-dimensional arrays. That should be part of any PHP developers immediate skill set (the set of skills you can reach into your brain and pull out at any time).

It's such a common element of PHP development. This probably came off to your interviewer as "he hasn't worked with PHP much" because of how common they are.

<comment><USER4> Agreed, when I read that you didn't have much experience with multi- dimensional arrays, the first thing that came to my mind was "He is pretty new to PHP".

I don't see how you could have built any substantial project in CI/PHP without coming across them.

That being said, I think saying I don't know is fine, but be aware of how you say it. If it is a shrugging "I don't know", that would be bad. A positive "I don't know yet", would show you are being honest and willing to educate yourself.

<comment><AUTHOR> I said I don't lnow but I kept hacking at it. Its not like I quit. Maybe it wasn't the right job for me. I see the whole experience as positive.

<comment><USER4> Same as landing a plane. Any experience you can learn from is a good one!

</comment></comment></comment></comment><comment><USER5> You should absolutely spend a day or two working with multi-dimensional arrays. It really is a core skill, like debacle said.

A few simple things you can try:

\- Design a database for a forum. Use PHP to pull a list of Users. For each User, pull the top 5 Posts, and for each Post, pull the Topic they posted in, and for each topic, pull the most recent Post and User who replied. That's 3 levels deep.

\- Create a list of 10 major Cities in your country, and for each City, list the Average, High, and Low temperatures for two different Dates. That's 2 levels deep.

\- Create a database for a store. For each Product, pull a list of the 10 most recent Purchases. For each Purchase, pull the User, and for each User, pull a list of their 10 most recent Purchases, and for each of these Purchases, pull the Products that were Purchased. That's 4 levels deep.

These are all very real-world scenarios, and if you can design and code them all, you'll have no problems working with any other multi-dimensional arrays.

I would also highly recommend writing the code to display the data from each array in a hierarchical table, and make sure you know how to access a single value directly, such as the Lowest temperature for a given Date in a City.

<comment><AUTHOR> I can do that with no problem. That is why it is frustrating. Nerves got the best of me. That is why I said I don't know. I was nervous. And under the circumstances I did not know the answer. But later on I went and did the exercise by myself with not much hassle.

<comment><USER5> So the moral of the story is: keep interviewing until you start feeling confident :)

<comment><AUTHOR> Well, you have opened up my eyes. Thank you.

</comment></comment></comment></comment><comment><USER6> FWIW, when I interview technical candidates, I ask technical questions until I get to the point where the candidate says "I'm not sure" or "I don't know". That helps me understand where the are in their career. If a candidate knows everything then they're not being honest with me :-)

<comment><USER7> That's what I do and then pay close attention what they do when we hit that point. Ideally, the candidate will explain what they would do. If we have enough time then I want them to ask me to explain the answer to them, that tells me they are actually curious enough to fill in their gaps.

</comment></comment><comment><USER8> Whilst interviewing SysAdmin candidates, I prefer an answer along the lines of: "I don't know, but I'd do x,y and z to find out"

Instead of guessing and potentially being very wrong and breaking things.

Be honest, but prove you're smart by showing how you'd get to the answer.

<comment><USER9> This is exactly what I look for when interviewing sysadmin candidates as well. I'm not sure how well this transfers over to programming though. The actual question was't posted, but in general working with multi-dimensional arrays is a standard part of PHP programming in my opinion.

Therefore the interviewer could have decided that the applicant didn't have enough base experience for the position they were applying for because of that.

Translating this to a sysadmin candidate. If I were interviewing someone for a Systems Administrator III position focusing on Linux and they couldn't answer basic DNS questions, such as A vs CNAME record I'd be inclined to believe they haven't done enough server and application builds to qualify for a III. IF they were applying for a devops position and couldn't cover the basics of named based virtualhosts in apache, that might be another indicator.

I don't know is the right answer always. It's a lot worse for a company to hire you because you are able to fluff the answers in an interview and then not be able to perform once you have the job. It creates stress on you and on the team you join. It's especially more negative when you have to once again go looking for a job and explain why your most recent position experience was so short.

To the original poster, as others have said, you got a leg up here. You know specifically what you missed during the interview so now you have an opportunity to go focus on an are you've identified yourself as weak on so you can pass the next interview honestly.

</comment></comment><comment><USER10> No, you did not make a mistake by being honest. If you'd have fluffed it or lied you would have either made yourself look stupid or found yourself in a position that doesn't suit you at present.

Be honest and in the long term it will be the right decision. And learn about multi-dimensional arrays - they're super useful.

<comment><USER11> Sometimes a good candidate has surprising gaps in their knowledge that can be filled in with some quick remediation. Ethics of lying aside, a sink-or-swim type may be able to succeed in the job in this case.

</comment></comment><comment><USER12> When I interviewed for junior dev roles I answered "I don't know" to questions during multiple job interviews and still got offers after those interviews. Usually after answering that I don't know something I would ask the interviewer how he would handle the proposed problem. My best advice would be if you don't know don't be afraid but have poise and show that you're eager to learn and willing to ask questions.

</comment><comment><USER13> Most of the interviews I've given are broken down into two sections: does the candidate have an effective baseline understanding of the technologies involved in the proposed job, and can they apply that understanding to complex problems?

If a candidate says "I don't know" during the first part, it's a sign that they will flounder during the second part. However, I usually guide the questions to try and actively FIND the "I don't know" point for the second part, as it helps me establish the boundary of their abilities.

</comment><comment><USER14> Part of your job as a developer is to find the right answer. It's not cheating if you can do it on the job. Just because you don't have the knowledge on hand doesn't mean you can't wade through and disseminate the correct solution via Google quickly.

Now if this was a phone interview and not some take home style assignment, I would've done the same as you and said, "I don't know that right now", and then give your best educated guess. Best of luck next time.

</comment><comment><USER15> I'm an engineer, not a programmer so take this with a grain of salt. Flat out saying "I don't know might" be seen as a negative, but saying "I don't know, but here is what I'm thinking..." or "I don't know, but I would try this, this and that" to find out would be something I wouldn't necessarily penalize, and would more likely be happy to hear.

In most technical jobs (the good ones anyways), you aren't expected to know everything off the top of your head. You are however, being paid to solve problems, and that means knowing how to talk about them with others, and how to go about looking for answers. Like many others have said, keep honest, but also show that you can talk with others, and reason about problems, even if you don't know an answer offhand.

All that being said, from what I gather, it sounds like multidimensional arrays in PHP may be something you want to look into. It sounds like this might be one of the easier things to work with in PHP. (I hope you don't take offense. I'm not a PHP dev., but it's just the impression I get from the other comments)

</comment><comment><USER16> Lots of good advice below. I'll add something that you might find useful for your interview process. If you really really want to work at company A, get some practice interviewing at 2 or so other companies, for similar positions, first. It will help you hone your technical and social interviewing skills and by the time you get to the desired interview, should fare better than if you went in cold.

</comment><comment><USER17> My only suggestion would be to not say I don't know. It would be "I'm not so familiar with XYZ, but here's how I'd solve that." Of course, if you can follow that up with an example of a similar situation mitigates some of the risk. This would assume that it's not considered to be a core skill set. If it 's fringe skill you should still be in the running.

</comment><comment><USER18> If the technical question was in a "take-home exam", as it were, or you otherwise had access to the internet, I'd figure you could look things up at will; to be on the safe side, perhaps ask "mind if I use php.net?". It's only reasonable -- you'd have access to the documentation when working in the field, after all.

Being a good programmer isn't about knowing absolutely everything about the tools you're using, that'd be impossible -- being able to look up things you don't know is a very important skill.

If, in a face-to-face interview, I were faced with something I didn't know, I'd say something like "I can't remember quite how this bit works, but I'd look it up on php.net/developer.mozilla.org/api.jquery.com/[appropriate reference]. Do you mind if I use pseudocode for the sake of getting on with the rest of the problem?" -- thus showing honesty, humility, the ability to use the resources available to you, _and_ expedience.

<comment><AUTHOR> I did do the process you described. It has been a great learning experience, and has made me a better person overall.

</comment></comment><comment><USER19> I recently posted a job opening. When I reached out to one of the applicants, he said he was worried that his knowledge wasn't as deep in some of the areas I wanted.

That honesty got him an on-site interview.

That interview, reference checks, etc., got him the job. He starts on Monday.

</comment><comment><USER20> If I were interviewing you and you said "I don't know" I would say "try to work it out". Jumping ahead and saying "I don't know but I think I can probably..." will earn you a few extra points.

I recall one interview where I asked what sort of responses an HTTP GET might result in. The candidate knew 200 and 404 but that was about it. Then I asked, "If you were writing the HTTP standard, what other responses might you include" and he told me about HTTP 304 Not Modified and the related cache-* headers, which he was clearly re-inventing on the spot. I scored him very highly for that.

</comment><comment><USER21> I've interviewed a few times for "data scientist" positions lately and I found the two answers that get you out of most trouble are:

#1 look it up in a hashtable, and #2 look it up in the literature

"look it up in the literature" is the answer you're really going to use on the job, so be proudof it.

</comment><comment><USER22> An educated man is not one who knows a lot of things, but one who knows how to find out what he needs to know.

I think Henry Ford said that.

</comment><comment><USER23> Answer with pseudocode if you have to, it will show your mastery of the concepts.

</comment><comment><USER24> if they give you a connection during the test...maybe they want to check also if you can search and find a solution when you don't know how to do something. is it possible?

</comment><comment><USER25> Best to say you don't know, than trying to BS your way through.

</comment><comment><USER26> When I interview technical candidates I follow the following process:

1) Ask them to rate their own skills based on the areas of focus found in their resume

2) Completely skip the areas they have self-identified themselves as beginners in

3) Drill them on the areas they self-identified as experts/advanced to validate the claims

4) Spend the bulk of the technical interview discussing the areas they identified themselves as "intermediate" in to identify where they want to go with their career and training as well as to assess their potential for getting there.

After all that I compare their perceived strength, weaknesses, and interests against the needs of the position and make a determination based on that.

The formula I use to assess skills can be expressed as: S = (SA * 5) + (SI * 2) - (FA * 10) - (FI * 4)

SA represents skills validated as advanced, SI represents skills validated as intermediate, FA represents skills claimed as advanced, but not proven to be valid, FA represents skills claimed as intermediate, but not proven to be valid.</comment>


Survival of the fittest; Can hacks strengthen the Crypto Industry? - <AUTHOR> https://zycrypto.com/survival-of-the-fittest-can-hacks-strengthen-the-crypto-industry/ <comment><USER2> I think this is an important point which directly impacts the expansion of the blockchain industry. Consumer and Enterprise touchpoints are mostly through exchanges and wallets.

Now while the blockchain itself is secure by default, the exchanges and wallets have routinely displayed vulnerabilities. Even though this should not malign blockchain as a technology, it does it anyway because these wallets and exchanges are the main customer touchpoints.

For example, if an Uber driver is rude and mean and a terrible driver, you are more likely to have negative feelings about Uber because the driver is one of your main touchpoints with the company.

Tldr; Wallets and exchanges need to drastically improve security because they are the main consumer touchpoint, for the crypto industry to improve credibility and adoption.</comment>