Interview with Nick Chamandy, statistician at Google - <AUTHOR> http://simplystatistics.org/2013/02/15/interview-with-nick-chamandy-statistician-at-google/ <comment><USER2> Very interesting interview, but I couldn't help be saddened by this:

"...my PhD research was on Gaussian random fields, with particular application to brain imaging data. The bulk of my work at Google is in other areas, since I work for the Ads Quality Team..."

I wonder how much innovation in health and other important areas are hampered by the draw of bright people like Nick to the quest for ads and likes. Follow the money I guess.

<comment><USER3> This probably won't make you any less sad. Apologies in advance.

It's not simply a matter of throwing money and brains at healthcare. I used to work on data analysis at a healthcare startup. There is no shortage of driven, talented, intelligent people making businesses in that space. There are giant firehoses of money in healthcare as well, both effective uses and of the boondoggle variety.

So it's not solely the lure of money that draws bright people out of healthcare. It could also be the realization that nothing you ever did would be more effective than getting doctors to wash their hands, and doctors _still_ don't do that.

Many people are brilliant enough to make wonderful tools, but it seems that nobody is brilliant enough to overcome a system that doesn't want to use them. Whereas if you make a tool that helps businesses sell advertisements, or whatever the source of revenue, there is a higher chance people will actually use it.

<comment><USER4> > It could also be the realization that nothing you ever did would be more > effective than getting doctors to wash their hands, and doctors still don't > do that.

If you could invent some sort of mechanism that told doctors to wash hands, I think they would be more likely to. Here's a few ways to do that:

1\. Google Glasses with OpenCV - touching blood, bodily fluids etc. sets an alarm that doctors must either snooze till later or walk up to a sink to silence.

2\. Special gloves that instantly turn green when coming in contact with the most common bacteria.

3\. Wrist watch / mobile device that beeps loudly every time a doctor goes from one patient to the next without stopping by a sink.

I agree that hospitals and doctors don't want to change because that takes time. However, there is no point in giving up today because your work isn't going to be popular for two more decades.

</comment></comment></comment><comment><USER5> I agree that knowing how to pull your own data is important. While you are doing the tedious work of pulling data your brain will often spot a good idea for a new experiment or see a new relationship in the data structure.

</comment><comment><USER6> This reads less like an interview, and more like a carefully edited set of answers to carefully chosen questions. Nothing wrong with that, I just was surprised to see such well-connected piece to come out of a normally chaotic process.

<comment><USER7> Well, they definitely had to have it checked by someone senior at Google. Usually they are very careful about disclosing what they do and employees have strict NDAs.

</comment></comment><comment><USER8> A few things in this pierce struck a cord with me. I am a computer science Ph.D. doing a postdoc in statistics department, working on biostatistics, and as I am recently looking for a job and did a few interviews, some observations may be helpful to job candidates.

First, people are pigeonholed into certain roles. Statisticians analyze data and design experiments. They are expected to know classical statistical fields, theorems, and their standard usage and caveats. Programmers should be able to answer standard programming questions, such as dynamic programming, balanced tree, etc., and of course write programs. In large company where specialization is the mantra, expertise in both fields is not an assert in interviews.

Second, multidisciplinary experience can be a liability. Since my experience in statistics is nonstandard, more of signal processing than classical statistical inference, I am not as conversant in classical statistical theory as a statistical Ph.D. does, especially because genomic research often prefers most basic methods, as in industry. Interviewers rightly ask about things they know, and are not impressed if one cannot answer questions they learned in graduate class. It is similar with computer engineering interviewers. They will ask me to implement an interval tree or dynamic programming algorithm in 30 minutes. Most of my heavy programming is in numerical analysis and optimization, where dynamic programming is very different from what a programmer thinks it is.

Third, depth is not required in industry, and certainly not in interview. Interviews now-days feel very much like college entrance exam in China or one of those East Asian countries, where people are expected to regurgitate set answers and the most important trick is to meet expectation. It is not important to master materials but to have right answers. And the right answer depends on the person asking question. One may considers SVM to be mainly a kernel trick that molds nonlinear relation into linear function, while another considers SVM as finite approximation of dynamic optimization with a breakthrough in quadratic programming that efficiently solves the two-points boundary problem coming out of dynamic optimization. This gets back to pigeonholing roles. A professional statistician will prefer one while a control/dynamic system expert will like the other. The killer is that some interviewers ask questions with their preferred answer in mind, and the questions can baffling to people with different background.

Forth, different companies demand different capabilities for supposedly same roles. Data scientists can be as mundane as denormalization or as sophisticated as inventing a way of causal inference. It is not always easy to tell from ads. It is even less so when the company wants jack of all trades and experts in all possible tasks. Ask very pointed questions.

Fifth, there is no advantage in being both good programmers and good statisticians, at least in interviews. I have already noted several disadvantages. People much prefer build inter-disciplinary teams each member of which is tasked with one special area and let them talk. It works well. I cannot think of anything that requires expertise in both programming and statistics in one head. It may be a little slower, but not noticeable.

I am having doubts about a position in a large company because of too much specialization. I like to derive an algorithm and implement it efficiently. Even if I could get a position, and I could if I cram for interviews, I would be at a disadvantage when others can concentrate on one area. Sadly, academia is becoming very much like industry, except they count papers or grants instead of make money. I am still looking for my niche.

I guess the gist of my rant is that today's job market demands specialization and people better conform.

<comment><USER7> Many of your points are spot on in that many of us had similar experiences. However, I would disagree that being able to program can be a disadvantage in any of good jobs you might be looking for. There is necessary communication between members of the team and there are times when writing/reading code results in much clearer and faster communication, even if you are discussing some statistical approach.

In general you are right about pigeonholing/specialization in large companies. But it usually happens after you are hired, not before. Right now, without industry experience your skillset is very broad and it is hard to pigeonhole you.

As for the interviews, if they are like an exam where you know questions in advance you certainly should prepare. Sadly, this is usually not the case. As you mentioned in your point (4), sometimes you have no idea what the role is about. And there is no way to know because your recruiter doesn't want to get specific or maybe has no idea herself.

Which brings me to an important point which you might be missing. If you are applying for jobs through websites or by any other well-publicized way, you will inevitably subjected to a vetting process. The interviewers do not know anything about you and are basically looking for reasons not to hire you. If you are very good technically, it increases your chances but it is no guarantee of passing. Good communication skills are just as valuable.

It is different when you know someone inside the company, say your friend recommends you. You will have more meaningful interviews from the start. Most startup/small company hiring is done this way.

That said, with your background you should have little problems finding a job, if current Big Data hype is to believe. But of course it depends on your school, where you are looking etc.</comment></comment>


Ask HN: How do you notify someone famous about a security issue with a domain? - <AUTHOR> Does anyone know how one would you notify someone of a security issue with one their domains when the person's contact streams are so flooded they can't possibly see your alert? The person is pretty well known. <comment><USER2> If they have a bug bounty programm, look at it.

Also try to contact the $company's domain Admin (who.is e.x. give it to you) or, if availabel, the Network Abuse Team for further help to get in contact.

</comment><comment><USER3> You don't.</comment>


The Haskell String Situation - <AUTHOR> http://www.stephendiehl.com/posts/strings.html <comment><USER2> Regarding the following quote about type String = [Char]:

" _This is not only a bad representation, it's quite possibly the least efficient (non-contrived) representation of text data possible and has horrible performance in both time and space._ "

It is true: This is slow if String is _internally_ implemented so _naively_ that it is "really" a list of characters. However, better internal representations are possible, i.e., internal handling of strings _as if_ they were lists of characters, so that a String appears _to Haskell code_ as a perfectly "normal" list, while _internally_ being represented much more efficiently as _a sequence of raw bytes_.

In other words, the fact that String has this specific type (i.e., [Char]) _does not_ mean that it needs to be implemented in the most naive way possible by the Haskell compiler or interpreter.

Prolog is in a very similar situation:

For convenience to Prolog programmers, strings in double quotes (such as "abc") ought to be interpreted as _lists of characters_ (such as [a,b,c]). So, _to Prolog code_ , strings should appear as if they were "normal" lists. This makes them amenable to Prolog's built-in parsing mechanisms and many predicates over lists that are already available.

At the same time, strings should be _internally_ represented more efficiently, as sequences of bytes in memory.

Recently, Mark Thom has expressed his interest in implementing such a solution in Scryer Prolog:

[https://github.com/mthom/scryer- prolog/issues/95](https://github.com/mthom/scryer-prolog/issues/95)

The same idea may be applicable to Haskell, to combine convenience with efficiency when handling strings.</comment>


What the Airbnb Saga Tells Us About the (False?) Power of TechCrunch - <AUTHOR> http://danlewis.tumblr.com/post/8256395516/what-the-airbnb-saga-tells-us-about-the-false-power

<comment><USER2> I voted it up, although I disagree. I believe the power of TechCrunch lies not in the amount of RSS subscribers, or Twitter followers, rather it is the most connected player.

What I mean by this is they are arguably the biggest influencers of influencers. Here is a related Ted Video: [http://www.ted.com/talks/nicholas_christakis_how_social_netw...](http://www.ted.com/talks/nicholas_christakis_how_social_networks_predict_epidemics.html)

If I understand the autor's argument correctly, TechCrunch is an "epicenter of the saga", but this does not mean they are influential to the outcome.

Following the insights derived from "Network Theory" you only need a hand full of highly connected nodes broadcasting the same information and an idea can be spread to in the entire network. Interesting article how only >10% of the population with an unshakable believe can "convert" the entire population. [http://www.freakonomics.com/2011/07/28/minority-rules- why-10...](http://www.freakonomics.com/2011/07/28/minority-rules- why-10-percent-is-all-you-need/)

I asume this understanding led Mr. Chesky & Mr. Graham to mainly correspond & respond to articles posted by "the epicenter of the sag".

</comment><comment><USER3> Power is held by people who are believed to hold power. If people -think- TechCrunch is powerful, it is. That's all it takes.</comment>


Ask HN: Where is the safest place for Muslims devs to work? - <AUTHOR> I'm in the unfortunate situation where 1) I have a Muslim sounding name, and 2) I've lived in the US my whole life.
With these recent developments, I don't feel safe here. Although I'm grateful for everyone's support, at the end of the day, the government has had a lot of leeway in getting "us" arrested/harassed. At least, they certainly did post 9/11.
I've thought a lot about moving elsewhere, but I don't know where. Can other Muslim devs chime in? Is the climate better/worse in other countries? I feel stuck. No matter where I look, it doesn't seem any better. <comment><USER2> Canada is open for business. If you're looking to start a business, immigration is pretty easy and if you hold a US passport, it's easy to come to somewhere like Toronto and have a look round and see if you like the atmosphere. There's a few tech meetings you can drop in on too.

Oh, and we have free healthcare. Sounds good, eh?

<comment><AUTHOR> I guess this incident that happened yesterday doesn't inspire confidence:

[https://www.nytimes.com/2017/01/29/world/americas/quebec- cit...](https://www.nytimes.com/2017/01/29/world/americas/quebec-city-mosque- shooting-canada.html)</comment></comment>


How to deal with Recruiters - <AUTHOR> http://hackerjobs.co.uk/blog/2013/5/21/how-to-deal-with-recruiters

<comment><USER2> I know I'm in the minority here, but I love getting contacted by recruiters.

If they've looked at my CV/Profile it's validation that my skillet is in demand, and that's always moderately good to know.

If I'm looking, or even considering looking, then it's awesome - I've got a lead into a job before it's advertised.

If I'm not actively looking (or considering looking) then I get some information about the market that may well be useful for when I -am- looking.

If I'm not actively looking, I tell recruiters what sort of position would turn my head. Now, my current role is pretty damned awesome, but if they can offer something better, then I want to hear about it.

It may well be different in other parts of the world (I'm in Australia, and most of my experience has been here or in New Zealand), but I generally find that recruiters offer a service that (as a candidate) I value.

Ironically, as the person doing the hiring, I've generally found them to be a waste of time and effort.

<comment><AUTHOR> I've spent time in both Aus & NZ and I promise you, the recruitment industry on your side of the world is vastly different to the UK & US.

That being siad, your point is completely valid. There is an upside to getting recruiter calls however I didn't bother addressing it simply because most folk complain about the intrusion rather than praise the benefit.

</comment></comment><comment><USER3> It makes me sick to my stomach to read the tactics of those in my industry and it is a real shame to see an industry which should be there to help, in fact becoming a hindrance.

I wish all the terrible recruiters could just be weeded out and removed...

Since this is nigh on impossible I agree with the article's point about keeping a record. Some of us are passionate about what we do, some of us love startups, or tech, or people, or all of it and will give you a service worthy of a fee.

I do not work withing the UK industry, as I became disheartened by the hate (if you need help in Germany however...), but I can highly recommend companies like The Up group - to whom I have no affiliation - as I understand their service is brilliant.

Those that are less worthy of praise are pretty obvious - just search out Milo Yiannopoulos' Kernel mag articles....

</comment><comment><USER4> I've got on the mailing list of a London recruiter who have been spamming me for over two years. They run under at least two company names, and haven't stopped e-mailing me though they've told me they would do so twice.

They have a REC (UK trade body for recruiters) logo on their website but when I complained to REC, I was told they weren't a member, so there was nothing they can do (other than ask them to take the logo down).

I've taken to replying "Hello [name]" to each message but I only got one reply before that stopped getting results.

Still nothing I can do. What do you do when you are on the mailing list of a cowboy?

<comment><AUTHOR> Name and shame. I'm intrigued. If they are London based then there's a very strong chance I'll know them.

As I recommend in my post, contact the company, ask to speak to someone in a position of authority and instruct them to remove all your details from their database or you will lodge a formal complaint for harassment.

<comment><USER4> It feels a feeble threat - I would want to know who I can formally complain to in order to be able to do anything. I went to the people I believed I could complain to and they said there was nothing they could do.

</comment></comment></comment><comment><USER5> Most hiring managers delegate dealing with recruiters cold calls to their personal assistants. Anyone who's not in the preferred supplier list does not get through.

<comment><AUTHOR> That may work with larger companies but most CTO's and the like don't have that luxury.

<comment><USER5> Virtual personal assistants are quite affordable these days, it's not really a luxury.

</comment></comment></comment><comment><USER6> A very good article, and that's coming from a recruiter!</comment>


Coaching Kids to Focus on Focus - <AUTHOR> http://online.wsj.com/article/SB10001424053111904716604576542593019231326.html

<comment><USER2> "Focus on focus" -- that's exactly the phrase I had my niece and her friend verbally repeat as one of the things they were going to _focus_ on before each tennis drill, but I didn't realize that was a "thing" :)</comment>


Ask HN: Why Has SDK Become a Four-Letter Word for Developers? - <AUTHOR>

At a developer conference last week, several app and game developers said, "SDK has become a four letter word." That goes the same for API.<p>I have a general sense as to why this is, but I am curious to hear it from the community. Why are SDKs and APIs a dreaded aspect of the development cycle? <comment><USER2> Lots of reasons:

\- Software bloat leads to slow download times and slow launch times and more RAM usage

\- Abstraction layers often get out of control and sacrifice lots of performance and lead to software bloat

\- Often you start with and SDK thinking it will solve your problem, but it turns out it doesn't solve your exact casem which means you end up spending lots of time fighting the SDK which leads to a mess+abstrction+bloat. Many times you might have been better off writing it from scratch.

\- Dependency hell which brings in the bloat+abstraction problems. Plus now you now have extra environment and deployment headaches to make sure everybody involved has the correct dependency chain and correct versions of everything.

\- Build system hell: Once you have dependency hell, you often bring in build system hell to manage everything

\- SDKs (Frameworks) take control of everything: Often frameworks impose lots of rules and conventions that leak into everything else you do. This means following their design patterns, subclassing from their classes, etc. Their stuff may not fit well with your own stuff. Also, this often deeply entangles your stuff with their stuff so it is hard to remove later.

\- Fighting between SDKs: Lots of SDKs try take over the world. If you use multiple SDKs, they may fight.

\- Lack of understanding: People too eager to use SDKs often lack the understanding of how it works. To fix bugs, to fix performance problems, to extend features, means you must ultimately understand it, but often this comes too late in the process. And you discover that for all these things will require massive changes to the framework or a complete rewrite. You would have been better off writing it yourself in the first place or picking some other SDK that you understood better.

<comment><USER2> Check out the Handmade Manifesto for a better feeling of where people like these are coming from. [https://news.ycombinator.com/item?id=10095104](https://news.ycombinator.com/item?id=10095104)

</comment></comment><comment><USER3> I love SDKs and APIs. "SDK" means to me that someone else has done a bunch of work for me. A good example of the AWS SDK, which lets me very quickly integrate S3 uploads into anything I'm working on.

"API" means that I can use someone else's data and mash it up with my own (or even another person's data), and that's really exciting!

In summary: no idea why those people said that.

<comment><AUTHOR> To elaborate on my general sense of why the developers said that: there are now dozens of pertinent SDKs that developers need to stitch in to their apps. Same with APIs.

They take time to implement, can effect the performance of an app and sometimes don't really work all that well. An app developer could reasonably have dozens of third-party SDKs in an app. Say, Flurry, Applause Analytics, Google Analytics, Maps, Facebook, Twitter and so forth. Same with various APIs.

I remember one developer I was talking to on Twitter last year was so fed up with third-party SDKs that he basically swore them off except for the most essential ones. He was having a hard time stitching someone else's code into his app and the implementation was just wonky.

</comment></comment><comment><USER4> Lots of work, may require invasive permissions, may run afoul of app store rules etc, may be a pain in the ass integrating with whatever non-native approach you're building an app with, and potentially weeks to get any change live.

The people at FGL.com are working on a promising solution to this - [http://enhance.fgl.com](http://enhance.fgl.com) -

</comment><comment><USER5> I believe myself this development in APIs is just tip of the iceberg. If the software development goes like this, everything will become huge, and hard to scale, and will need lots of engineering resources.</comment>


Semantic video analysis | Finding the right picture - <AUTHOR> http://www.economist.com/research/articlesBySubject/displayStory.cfm?story_id=11079611&subjectID=348909&fsrc=nwl <comment><USER2> Can academic researchers get "press hits"?

I work in computer vision, and the approach described in this article is nowhere near a standard or agreed upon approach for this problem (there isn't one so far). The article focuses exclusively on the research of one team of researchers (not really the "leaders" in this field either), ignoring many landmark and prototype systems released over the past several years...</comment>


Chrome bug reveals your passwords - <AUTHOR> http://articles.timesofindia.indiatimes.com/2013-08-09/computing/41236732_1_passwords-browser-security-bug

<comment><USER2> Yikes. Seems like importing is not the best idea. I've always been skeptical of "save password" features.</comment>


Ask HN: Applying for jobs in unrelated specialisation? - <AUTHOR> I'm currently 5 years into an enterprise web services role, and have been looking for the chance to move over into iOS application development.
I work mostly with SOAP/HTTP & XML/JMS services, with some recent REST/JSON experience and a background in C# SQL-backed development.
A position has come up in a related agency looking for an 'experienced iOS developer'. I don't have any formal training, or finished personal projects to show, but have been learning Swift/iOS Development for the past couple of years through books and online courses, and am confident in my ability to pick up the rest on the job, if I were to get the position.
My question is: Have you been successful switching specialisations into a related field without meeting all the stated requirements of the job listing?
What are the best ways to communicate your eagerness for the new role while also showing you've got practical skills that will translate? <comment><USER2> In such a situation, job interviewers won't be placing a premium on a candidate's educational qualifications. Instead, they'll be taking a closer look at the candidate's non-academic attributes, such as drive and ambition, initiative and the ability to be a team player, to name but a few.</comment>


Snapchat's New Update Triggers Revolt by Millions of Teens - <AUTHOR> https://www.thedailybeast.com/snapchats-new-update-triggers-revolt-by-millions-of-teens <comment><USER2> > _One of Snapchat's biggest criticisms has been that the app is too > complicated to use._

> _While the majority of Snapchat's young userbase could navigate the product > just fine, older users struggled to comprehend the layout._

Ok, so younger users are better at adapting to new and unusual interfaces.

> _Hundreds if not thousands of teens lost their streaks, some of which had > been maintained for hundreds of days, because they were confused at how to > send snaps using the new interface._

Hmm...

</comment><comment><USER3> As someone who uses the app daily: the update blows.

If you don't use the app I'll probably lose you here, but:

1) The main page is so much more cluttered. I don't need to see someone's bitmoji or a tiny preview of their story.

2) There was something satisfying about being able to clear all the stories on the story page. With stories on the main page now, this satisfaction is basically gone. A major misstep by SC imo. They should have latched on to me being addicted to looking at all my friends' stories. I'm using the app more.

3) Finally, and this is what makes the least sense to me, is that now I never have a reason to go to the second page and see all those stupid "trending stories". My click % on those is all but 0 now, where as before, when I had to look at them to see my friends' stories, I would sometimes find one of them interesting and click to read.

That last one isn't really a complaint, as I don't have to see those stories now, but just doesn't make sense.

</comment><comment><USER4> I'd like to see a discussion of this by people who understands social networks better than me. Facebook updates have been meet with similar backlash and usually result in more user acceptance long term. Is that because they are tweaked to meet expectations or the users get used to them?

It sounds like they choose to deemphasize streaks and a lot of users really love that feature.

Is there a better way to handle this sort of rollout?

<comment><USER5> Any UI change large enough to be an overhaul is likely to get the same kind of reaction as people go through whatever learning curve there is to using the new interface. Overtime people just get used to it and the new interface becomes the interface. Admittedly I wasn't scrutinizing the whole rollout of the several bemoaned Facebook overhauls but I don't really remember them really changing much of the design once it was pushed out.

</comment></comment><comment><USER6> I think we're seeing a more intense backlash because the core Snapchat product doesn't exist in a vacuum anymore. Instagram has crafted a superior UX for the same use case(s).

My gut says that the redesign is primarily a reaction to Instagram's product, not to meet the "needs" of it's users.

</comment><comment><USER7> It's too bad they didn't roll out the UI as a feature. Allowing users to opt- in or opt-out. That way users could tinker with it and not lose their streaks, and learn the new UI before the _real_ rollout.

The mismanagement of Snap is so absurd. This company is going to end in a fiery scorched earth death.</comment>


Everything, find files and folders instantly on Windows - <AUTHOR> https://www.voidtools.com/support/everything/ <comment><USER2> Funny, I've seen Nirsoft windows utilities on the front page and I thought that it might be a good idea to post a link to "Everything" too. I wanted to check if someone already posted it to hackernews and I found this submission made "2 hours ago" :)</comment>


Ask HN: If you prove that P=NP, dare you announce it? - <AUTHOR> If you solve the P=NP? problem that find that P=NP. Dare you announce it publicly? <comment><USER2> Purported proofs of P=NP are published multiple times a year. They just always turn out to have a flaw, just like the P≠NP proofs. [http://www.win.tue.nl/~gwoegi/P-versus- NP.htm](http://www.win.tue.nl/~gwoegi/P-versus-NP.htm) collects them, though it hasn't been updated since 2 May 2015, probably when the refutation of the most recent purported P=NP proof was added.

</comment><comment><USER3> Not unless you were very certainly sure it was true. The probability that you got it right and didn't mess up some detail is so vanishingly small that it might as well be 0.

If you go around shouting about yet another half-baked "solution", people will think you're a crank (and they might even be right). Exercise some restraint, check it and wait.

One thing about a positive P=NP proof is that it would necessarily be constructive, so you could try to actually implement it and maybe do some SAT solving competition. If you start stomping the competition, you would get noticed and be in a much stronger position to announce something like this.

<comment><USER4> _" One thing about a positive P=NP proof is that it would necessarily be constructive"_

I don't see why that would necessarily be true. For example, let's say that I show that, if P != NP, the set of all NP-complete problems can be split into N equivalence classes and then produce N+1 NP-complete problems that are pairwise in different equivalence classes.

Alternatively (and, I'm guessing, slightly more realistic), one might define a Turing-equivalent machine and show that, if there is any room between P and NP, for that machine, any program that solves a NP-complete problem can be reduced to run for one less time step.

Can you explain?

</comment></comment><comment><USER5> A proof that P=NP would go against our everyday experience and it seems so unlikely that it would take you to the Gödelian level of fame and prestige. Would guys in black suits trying to kill you? No. Would you get 100s of job offers? Yes. Go for it, it would be a huge advancement for humanity.

Personally, I have a strong feeling that no one will ever prove that P=NP. There's that story that out of 100 math professors 10 or so say that P equals NP, but many of them admitted that they just wanted to be controversial. My suspicion is that the existence of P and NP as different complexity groups is a direct consequence of the way Boolean algebra is built up and the way operations are defined, but I far from being an expert on this.

</comment><comment><USER6> If I thought I had such a proof (and I expect the proof would be complex, relying on many leading-edge pieces of wildly different branches of mathematics, and therefore comprehensible in the short to medium term to but a few), I would first see if I could develop a practical implementation of the proof for a well-known NP problem, test that out, and see if it worked.

If so, I would have that reviewed by trusted colleagues. ("Hey, buddy, I have a P space solution to travelling salesman!" "Get outta town!", "No seriously..."). That would at least demonstrate that the proof works.

Next step? Well, there's a bit of the responsible disclosure argument at play: If P=NP and you have a practical implementation of a P-time algorithm for an NP-complete problem, translating that to another will be less work, I should think, than the original proof or the original implementation...

...meaning much crypto would break soon after publication. Give the proof and the implementation to 100 well-known and trustworthy mathematicians from around the world, have them agree to your disclosure strategy, then announce what you've got, with their backing, and tell the world that you won't publish for 6 months. Or 12. Whatever.

The Fields Medal will wait.

That will give the world time to adjust to its new reality.

</comment><comment><USER7> Knuth suspects that P=NP. However, theoretical feasibility doesn't necessarily mean that you'll know how to solve NP problems in P time, he says.

<comment><USER8> The citation: [http://www.informit.com/articles/article.aspx?p=2213858](http://www.informit.com/articles/article.aspx?p=2213858)

 _I 've come to believe that P = NP, namely that there does exist an integer M and an algorithm that will solve every n-bit problem belonging to the class NP in nM elementary steps._

 _Some of my reasoning is admittedly naïve: It 's hard to believe that P ≠ N P and that so many brilliant people have failed to discover why. On the other hand if you imagine a number M that's finite but incredibly large—like say the number_ [really big number] _discussed in my paper on "coping with finiteness"—then there's a humongous number of possible algorithms that do nM bitwise or addition or shift operations on n given bits, and it's really hard to believe that all of those algorithms fail._

 _My main point, however, is that I don 't believe that the equality P = NP will turn out to be helpful even if it is proved, because such a proof will almost surely be nonconstructive. Although I think M probably exists, I also think human beings will never know such a value. I even suspect that nobody will even know an upper bound on M._

 _Mathematics is full of examples where something is proved to exist, yet the proof tells us nothing about how to find it. Knowledge of the mere existence of an algorithm is completely different from the knowledge of an actual algorithm._

 _For example, RSA cryptography relies on the fact that one party knows the factors of a number, but the other party knows only that factors exist. Another example is that the game of N × N Hex has a winning strategy for the first player, for all N. John Nash found a beautiful and extremely simple proof of this theorem in 1952. But Wikipedia tells me that such a strategy is still unknown when N = 9, despite many attempts. I can 't believe anyone will ever know it when N is 100._

 _More to the point, Robertson and Seymour have proved a famous theorem in graph theory: Any class of graphs that is closed under taking minors has a finite number of minor-minimal graphs. (A minor of a graph is any graph obtainable by deleting vertices, deleting edges, or shrinking edges to a point. A minor-minimal graph H for is a graph whose smaller minors all belong to although H itself doesn 't.) Therefore there exists a polynomial-time algorithm to decide whether or not a given graph belongs to : The algorithm checks that G doesn't contain any of 's minor-minimal graphs as a minor._

 _But we don 't know what that algorithm is, except for a few special classes , because the set of minor-minimal graphs is often unknown. The algorithm exists, but it's not known to be discoverable in finite time._

 _This consequence of Robertson and Seymour 's theorem definitely surprised me, when I learned about it while reading a paper by Lovász. And it tipped the balance, in my mind, toward the hypothesis that P = NP._

 _The moral is that people should distinguish between known (or knowable) polynomial-time algorithms and arbitrary polynomial-time algorithms. People might never be able to implement a polynomial-time-worst-case algorithm for satisfiability, even though P happens to equal NP._

</comment></comment><comment><USER9> Yes.

Either you have a solution, and that's a great thing, or you are close to a solution and one will be found more quickly and that too is a great thing, or you don't have a solution. That's not such a great thing, but it's a contribution to the set of cases not known to be solutions, potentially hinting at where the solution may lie.

This assumes you have done the thought work and want to know. Don't you?

<comment><AUTHOR> It's definitely a huge contribution. But P=NP potentially means that RSA is solvable in Polynomial time. Then countless servers will be attackable. Not sure whether it's good to announce "publicly".

<comment><USER10> Polynomial time does not necessarily make it easy, the degree of the polynomial could be plenty high making large problems still sufficiently expensive.

<comment><USER4> It need not even be of high degree. With a large enough constant, even a constant-time algorithm could be way out of reach.

Suppose that somebody shows that, once you are past a googol^googol (not a big number, as numbers in mathematics go), factoring doesn't get harder at all, that would be merely a curiosity in practice (It also would be a hugely surprising result that would inspire mathematicians to start looking for ways to bring that limit down)

</comment></comment></comment></comment><comment><USER11> If just knowing P=NP were enough, for applications people could go ahead and just make the assumption now. The problem is finding an algorithm.

</comment><comment><USER12> No. [http://www.antipope.org/charlie/blog- static/fiction/toast/to...](http://www.antipope.org/charlie/blog- static/fiction/toast/toast.html#antibodies)

</comment><comment><USER13> if N=1, yes

Can someone explain better the problem for people like me? What is P and what is N here?

<comment><USER14> [https://en.wikipedia.org/wiki/P_versus_NP_problem](https://en.wikipedia.org/wiki/P_versus_NP_problem)</comment></comment>


People Hacks for Technical Leads - <AUTHOR> https://medium.com/@bellmar/people-hacks-for-technical-leads-6eef1576d046 <comment><USER2> I agree with a lot of this, disagree with "multichannel" bit. The idea of "learning styles" is dead in the field of psychology and the advice isn't actionable in the context of a presentation or meeting anyway (how does your average powerpoint aid these supposed "kinesthetic" learners?").

I'd never heard of back-briefing but see that as something my company could benefit from, however. So thanks for that!

<comment><USER3> it may not be _fashionable_ in the field of psychology currently to acknowledge "learning styles" but.. "is dead" seems to say "we can prove this does not exist" .. the strongest possible statement about it, in the field of _psychology_... psychology is accepted as a science, I guess, but really.. the mind is a massive thing.. which mind ? the one that responds when you drop a weight on your foot ? the one that responds after talking to a dear friend ? really.. this is so closed minded..

<comment><USER4> Well, a study kicked off the area of inquiry, and after years of work, the base studies failed to replicate.

Once you throw away rigor, you're no longer a scientist.

</comment></comment></comment><comment><USER5> I'm glad there are articles like this and people out there trying to figure out what it really takes to build a great dev team. Still, after all this time trying to find the equation for getting into that magical state I call "the groove" is insanely difficult. It could be compared to a band that put out a really great first album but needs that same energy for another one. I've spent a lot of time around professional musicians and their struggles mirror development ironically. Once I saw 1/2 of a band audition two studio musicians and hit a groove then mint two contracts for a tour in about the span of 30 minutes. That was magical and that was rare- dev teams sort of operate the same way and sometimes when no one is looking that groove happens.

</comment><comment><USER6> Are learning styles for various individuals still a thing? I thought that was a well debunked claim a while ago

<comment><USER7> I've wrongly assumed it to be real for a long time. Thanks for mentioning this! I just skimmed [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5366351/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5366351/)

As it stands, I believe evidence suggests that people may report to prefer a style, but it has no measurable impact on their learning.

<comment><USER8> Which continually surprises me and I wonder what content they test the learning on.

Is it on primary education topics or advanced topics?

I certainly can't imagine learning mathematics or coding from a lecture without _seeing_ the symbols. How else would I keep it all in my head[1]?

I don't know what the other 'learning styles' are so I can't really comment on them.

[1] - Surely some with physical impairments, i.e., the blind are capable of doing this as there _are_ blind programmers who make amazing things. But that belies a lifetime of practice of _not_ relying on one's sight.

<comment><USER9> There is some evidence that different styles work better for learning different topics but not that different individuals learn better with different styles. So e.g. learners might do better on average learning math when visual learning is emphasized and English when auditory learning is emphasized but a given individual will not learn both subjects better if both emphasize their "preferred" style. (Just examples here, not making any particular claims about learning math vs English)

<comment><USER10> Ah, thanks for the clarification!

The claim that the learning styles were debunked didn't jive with me because I had a very bad experience being taught German in school using only talking/speaking. And I feel like I need to have things written down to remember them. (For example, I cannot reproduce sounds - like foreign names - very easily, and I have hard time sorting them out. But if you write it down, I can relate it to other sounds and remember it.)

</comment></comment></comment></comment></comment><comment><USER11> One comment regarding the "embedding". This is similar to the Toyota concept of the _gemba_ , or being where the value is produced. For automobiles, that's the factory floor. For software shops, that's with the developers, testers and BAs.

You want to be able to understand the work flow of your staff in order to catch opportunities for continuous improvement, and the best way to do this is to observe the work being done, but in a respectful way, that is, respecting the staff space and making them comfortable that you are not there to observe __them __, but the work.

I really don't understand why a manager would want to have an office in the 21st century.

<comment><USER12> As a dev I would really appreciate an office though, but those jobs don't exist anymore.

</comment></comment><comment><USER13> No one has mentioned groups chats from the article. It's kind of scary to think there's a manager out there that is mindfully siloing conversations instead of letting smart people figure it out.

</comment><comment><USER14> Back briefing, very important point. It is one I still slip up on when I'm busy and there are a lot of moving pieces in play.

</comment><comment><USER15> Great article. Threading in a chat tool is an absolute necessity for me. Regarding embedding, I like to wave and smile without talking to makers while they are working. I say hello and maybe chat with managers. Waving and smiling is friendly without interrupting a maker. It still gives them an opportunity to start conversation.</comment>


France introduces 0.20% financial transaction tax - <AUTHOR> http://news.sky.com/story/967285/france-introduces-financial-transaction-tax

<comment><USER2> The markets interpret taxes as damage and will route capital flows around them. For example, if it is impossible to sell French securities more liquidly than a government imposed floor, sucks to own them, but with a team of engineers and billions on the line you can trivially create some instrument which proxies actually owning French stock, then trade that. For example, American Depository Receipts will move in virtual lockstep with the underlying stock but since they don't move he shares when they change hands they'd avoid the tax.

This involves more profit for middlemen than the more straightforward way. London and Wall Street thank you for your support.

</comment><comment><USER3> Just who the h*ll do those politicians think will pay those taxes? Certainly not the banks. They'll just push the costs to their costumers, they have no choice anyway as all the banks will have to pay the taxes. France? The next domino to fall...

</comment><comment><USER4> I was more or less convinced by Paul Willmott´s arguments on this one.</comment>


Experimental rejection of observer-independence in the quantum world - <AUTHOR> https://arxiv.org/abs/1902.05080 <comment> a0-prw "This result lends considerable strength to interpretations of quantum theory already set in an observer-dependent framework and demands for revision of those which are not."

Oh, the irony</comment>


Law Enforcement needs a UI designer - <AUTHOR> http://www.knowgangs.com/

<comment><USER2> Hard to believe it's even used by real law enforcement: a lot of the information isn't even accurate.

</comment><comment><AUTHOR> Because the one they have needs to be water-boarded.</comment>


Ask HN: How to find part-time local/remote tech jobs (Montreal) - <AUTHOR> I'm just starting in the job market but already have a few years of experience in tech (Go, PHP, Java, Python, etc).
How would I go to finding part-time (20h/week) jobs in Montreal, or remotely?
You can shoot me an email to Gmail at "cretezy", thank you! <comment><USER2> Maybe this helps: [https://medium.com/rmotr-com/top-3-places-to-find-remote- pro...](https://medium.com/rmotr-com/top-3-places-to-find-remote-programming- jobs-1f7b72c676ba)</comment>


Data Compression – LZFSE - <AUTHOR> https://developer.apple.com/library/prerelease/ios/documentation/Performance/Reference/Compression/index.html <comment><USER2> I think this algorihm is a variant of ZSTD.

</comment><comment><USER3> HTTP Error 403/Forbidden for me. Could anyone who managed to look at this page tell what it's about?

<comment><USER4> This is a new iOS (and possibly Mac?) library provided by Apple.

 _" "" The libcompression library provides an API for two styles of data compression:

Block compression, where all of the input data is compressed or decompressed by one call to the compression or decompression function.

Streaming compression, where the compression or decompression function is called repeatedly to compress or decompress data from a source buffer to a destination buffer. Between calls, processed data is moved out of the destination buffer and new data is loaded into the source buffer.

Choosing a Compression Algorithm Apple provides four algorithms, each of which is believed to be the best choice in some set of circumstances.

Three commonly-known encoders are implemented: LZ4, ZLIB level 5, and LZMA level 6. In addition, we provide an encoder for Apple's proprietary algorithm, LZFSE.

Choose an encoder according to the following guidelines:

Use LZ4 if speed is critical, and you are willing to sacrifice compression ratio to achieve it.

Use LZMA if compression ratio is critical, and you are willing to sacrifice speed to achieve it. Note that LZMA is an order of magnitude slower for both compression and decompression than other choices.

Otherwise, if speed and compression are more or less equally important, use either ZLIB or LZFSE. The choice depends on whether you require interoperability with non-Apple devices.

If you do require interoperability with non-Apple devices, use ZLIB. If you do not, use LZFSE.

LZFSE is an Apple-developed algorithm that is faster than ZLIB, and generally achieves a better compression ratio. However, it is slower than LZ4 and does not compress as well as LZMA, so you will still want to use LZ4 if speed is critical or LZMA if compression ratio is critical. """_

</comment></comment><comment><USER4> Are there any technical details anywhere? Papers? Patent applications? ...

<comment><USER5> "LZFSE" most likely refers to a Lempel-Ziv modeling phase that converts the input bytes into a series of either literal or copy instructions, followed by a Finite-State-Entropy encoding scheme which "provides the same level of performance as [an] Arithmetic coder, but only requires additions, masks, and shifts".

Here's some explanation of FSE: [http://fastcompression.blogspot.com.au/2013/12/finite- state-...](http://fastcompression.blogspot.com.au/2013/12/finite-state- entropy-new-breed-of.html)</comment></comment>


Ask HN: How do I acheive the best battery life/performance on my iPhone? - <AUTHOR> I read all the "7 tricks" bs articles but am wondering if there's more that most people don't know about. <comment><USER2> An Apple battery expert told how he thinks it should be done. Use the battery down to about 20%. Charge it back to about 80%. Once every few months (I think he said around three months), charge it to 100%, drain it completely to where the phone shuts down, and charge it back to 100%. He said this "informs" the system with the battery's performance limits. Then, go back to the 20% to 80% pattern.

</comment><comment><USER3> Turning off LTE voice calling can save a decent amount of battery if you don't experience poor call quality.

Settings->Cellular->Cellular Data Options->Enable LTE->Data Only</comment>


Researchers find Megaupload shutdown hurt box office revenues - <AUTHOR> http://thenextweb.com/insider/2012/11/24/researchers-find-megaupload-shutdown-had-a-negative-effect-on-box-office-revenues/

<comment><USER2> Direct link to paper: [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID2176246_code...](http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID2176246_code1545989.pdf?abstractid=2176246&mirid=1)

Someone more statistical than I can correct me on this, but by using on average 21 observations per movie (presumably for different weeks), aren't they creating dependence between observations which will artificially increase the p-values and r-squared?

<comment><USER3> Am I understanding this right, that this papers hasn't even been peer-reviewed and are just 3 pages uploaded by the authors to ssrn?

</comment></comment><comment><USER4> Haven't read the paper, but just based on the article I'd be curious to see the affect on blockbusters compared to say, their rotten tomatoes scores (or whatever). It'd be interesting to see whether the opposite of the reasoning applied for the smaller movies people may not have heard of ("I saw xxxxx, it was great you should see it") applies to the blockbusters with a lot of publicity and promotion behind them ("Yeah, I downloaded xxxxx, it was dreadful..").

</comment><comment><USER5> If this was true (and I'm dubious of the "find"), it should be something for movie makers to consider when it comes to distributing their movies.

What this shouldn't be used for, though, is the default excuse by pirates when stealing intellectual property. "My theft actually helps, see?!?!?" Even if there is some financial gain, more is lost when the fundamental IP rights are stolen.

<comment><USER6> I refuse to acknowledge the word "steal" as appropriate here. "Intellectual property" stealing was known for ages and described the process of depriving someone of attribution of his work. I can steal a poem if I recite it as my own. This is stealing, theft, and was recognized as such since really long ago.

OTOH, if I print, or make a handwritten copy of this same poem, preserving the name of the author, I'm not stealing. It may be debatable what I actually did, but I did not steal.

Every time I see well defined concept being reused to mean something different than it meant for hundreds of years I'm cautious. I think everyone should be.

<comment><USER7> If one prints copy of "this same poem" and sells it or distribute if for free (and there is no free lunch) then one stole the printing rights that the author granted (for a sum of money or a regular paycheck) to the official printer (the one who has a contract with the author). Regarding books, ideas are more or less free, the materialization of that work of thought into our physical realm (be it dead pieces of cellulose or bits on magnetic support), however, is not.

Kant wrote a bit about it.

</comment></comment></comment><comment><USER8> I really wish HN had a rule against blogspam like this. How about the original post: [http://torrentfreak.com/megaupload-shutdown-hurt-box- office-...](http://torrentfreak.com/megaupload-shutdown-hurt-box-office- revenues-121124/)

Or maybe the paper itself? <http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2176246>

</comment><comment><USER9> I am too lazy ... ummm busy to read the paper right now, but well, is it really causation, or some very, very weak correlation?

<comment><USER10> For massive blockbusters they do find a negative effect, the positive impact is mainly for lesser-publicized movies without the massive advertising budget funneled into them.

It's always hard to tell with statistics, but I don't think it's a stretch to suggest that the extra publicity from file sharing outweighs the negative effects for those smaller movies.

<comment><USER11> I imagine that most of the people who would want to see a blockbuster will know about it due to the overwhelming marketing. At the other end of the marketing budget spectrum the movies probably rely on word of mouth which would probably get a boost from file-sharing.

</comment></comment></comment><comment><USER12> Why don't film makers put the first 10 minutes of a film on Bittorrent a week or month before release? This could offer many of the advantages and still allows them to earn direct revenue. I know some have tried similar models and other studies have shown leaks help the success of a film.

<comment><USER9> Well, they already make trailers and put them to every videosharing site possible.

If you add all footage from the trailers, it can be about 10 minutes, maybe more.

<comment><USER13> Movie trailers are awful now. They generally show you all the important points of the movie and all the best SFX. Sometimes the movie is worse than the trailer. First 10 minutes sounds great - you'd know if you want to see more or not from that but it wouldn't [in most cases] give the whole plot away.

<comment><USER14> Agree. I assume some of the trailers of the movies are automatically generated. There are these groups in my university conducting research of generating trailers / sound effects / background music. Choosing the best scenes in the movie automatically and combined them in a good way.

<comment><USER13> What inputs are they using to chose the best scenes. Is it based only on the movie? Audience reactions at screenings? Sounds interesting.

You could presumably then tailor trailers to particular groups to emphasise desired attributes.

Downside to that is that if you sit through a few trailers you could literally have seen a-third of the movie before you go to watch it.

</comment></comment></comment></comment></comment><comment><USER15> The story's title is different, but I guess it doesn't fit on HN?</comment>


Solving the Tech Worker 'Shortage' Is Easy: Just Pay Them More - <AUTHOR> http://www.huffingtonpost.com/2014/11/25/tech-worker-shortage-low-pay_n_6218444.html

<comment><USER2> ... or accept having your fancy schmanzy startup outside the San Francisco Bay Area. VCs insistance of 'you HAVE to be here' and often moving companies/founders across the globe for it is silly to no end. Prices go up like crazy, investment money (especially Seed) doesn't last as long, you spend an enormous amount of time hiring/trying to find people etc

</comment><comment><AUTHOR> Really, not enough applicants?

That's a choice. Pay more, and will might give up our contracts. Maybe..

</comment><comment><USER3> ... or just hire remote workers. It will be healthier for your processes anyways.

</comment><comment><USER4> Having been on both sides of the table, where I have been rejected from consideration for no good reason, and also watched my organization turn down awesome candidates for no good reason, I have come to the conclusion that pay is only part of the story. Most places suck at hiring, and some of them even know this, but most don't suck the way they think they suck. If you have a hiring process that can start with 100 applicants, and whittle that number down to one, that doesn't mean you're getting the best candidate out of those 100 - few companies seem to recognize this. Most places will be lucky if they can say they got a candidate in the top 25, in spite of having such a process.

As an example, if I can finish a two-hour coding quiz with time to spare and nail it, impress the hell out of two subsequent interviewers, only to fail on the third with a poorly-prepared interviewer who has already canceled twice at the last minute, via a teleconference at 11PM my time, then something has definitely gone wrong and it isn't on my end. And this is a well-known company that has itself convinced that it has _wonderful_ , data-driven hiring practices. It does not.

Talk to hiring managers about this and they will say 'oh well we have a lot of applicants'. Well then, we don't exactly have a shortage then, do we?

It seems in the mid-to-late 00s there was a meme going around, probably in reaction to the hiring practices during the dot-com era (which were, admittedly, oftentimes pretty terrible in the opposite way), that you should take extra-special care to hire only good candidates. A lot of tech companies have taken this advice to heart, which is great, but they have also mistaken processes that merely weed people out due to mostly random or hard-to-control factors, for ones that select for good candidates. (Chiefly, many hours of interviews with any single interviewer having absolute veto power is a huge red flag.) They are not the same thing.

I mean, read what this idiot company recruiter does in this article:

[https://news.ycombinator.com/item?id=8660819](https://news.ycombinator.com/item?id=8660819)

and then tell me we have a talent shortage.</comment>


What is wrong with Elon Musk? - <AUTHOR> https://www.inputmag.com/culture/what-the-hell-is-wrong-with-elon-musk <comment><USER2> In terms of psychopathology, Musk is more dysfunctional than Trump. Both Trump and Musk are habitual liars (or to use a more polite term, hucksters). The difference between them is that Trump knows when he is lying and doesn't care, whereas Musk actually believes his lies are true. Worst case, Trump is likely to end up in jail and Musk may become delusional and incompetent to lead.

<comment><USER3> Where's the reason for thinking Trump knows when he is lying, but not Elon?</comment></comment>


Sony says it can fix private key crack - <AUTHOR> http://www.thinq.co.uk/2011/1/7/sony-says-it-can-fix-private-key-hack/ <comment><USER2> My guess? The suits at Sony, being as incompetent now as they always have been, still haven't realized the seriousness of their situation.

I'd love to be privy to the email exchanges that must be going on there between their engineers and management...

Alternatively they do have a solution, and it's something to the effect of "nuke it from orbit"/"if we can't have it, _nobody_ can". They already tried to take that approach with OtherOS, so this should get entertaining if that's the case.

<comment><USER3> My sentiment exactly, wonder if the solution includes something akin to the rootkit they deployed once before.

</comment></comment><comment><USER4> Here's the problem (picture supplied by first result after googling for ps3 nand motherboard):

[http://s200.photobucket.com/albums/aa138/ejsid/infectus%20ps...](http://s200.photobucket.com/albums/aa138/ejsid/infectus%20ps3/?action=view&current=DSC01329.jpg)

The keys are _hard-coded_ in hardware and the content in question lives on a TSOP NAND device on the motherboard. No matter what Sony does, they can't prevent you from flashing your own code, signed with the old keys, to that onboard NAND. Whether you de-solder it and socket it, or use some other sort of hardware device, Sony is screwed for old hardware.

<comment><USER5> If you jailbreak your PS3 before they push out the security update then you've won. But that probably isn't very many people at this point. If the security update is non-downgradable and invulnerable to the currently-known exploits then Sony will be back in control of most PS3s.

</comment></comment><comment><USER6> If I can resurrect my PS3 and run *nix natively on it with graphics and full blown access to the co-processors I'd buy a second one for gaming.

The main problem is the memory limitations of 256MB+256MB but with careful configuration it can be just OK.

I wouldn't be surprised if this ends up making the PS3 ubiquitous leaving all the other consoles behind. Even in spite of the poor higher management coming from old media (the ones pissing off traditional developers, forcing Blu-Ray and that insane rootkit.)

<http://en.wikipedia.org/wiki/Howard_Stringer>

[http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki...](http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal)

<comment><USER7> What makes you think it would make the PS3 ubiquitous? What evidence is there that more than a tiny set of people want to run non-built-in services on their PS3s? What would they _do_ with them? I'm a geek and _I_ certainly don't need another box running 24/7...

<comment><USER6> Different paragraph, different concept. A cracked and affordable PS3 with HD (Blu-ray) media player and trivially changeable HDD can be very attractive. And running a *nix home server on it could be a definite plus for many people, anyway.

</comment></comment></comment><comment><USER8> Let's say they update the hardware to include a new public key. They now have the issue that existing signatures don't verify properly. You can mitigate this by having a list of existing valid signatures which can use the old key, but that can't be the best way. Can anyone come up with another?

<comment><USER9> We'd still be able to decrypt the updates and look for holes, or if you have the hardware, just flash your hacked update on the PS3. (We have metldr keys, so we can sign our own loaders)

<comment><USER8> You'd be able to decrypt updates signed for old hardware, yes. You wouldn't be able to directly reflash new PS3s, though, which is a huge improvement for them.

</comment></comment></comment><comment><USER10> _"We will fix the issues through network updates, but because this is a security issue, we are not able to provide you with any more details," [Sony] said._

Wrong on two counts. First, Sony can't really "fix" the problem, merely patch over the current situation until their "fix" is compromised. At best they can hold freedom off for a little while longer.

Second, there is no security through obscurity, and failing to explain exactly how they will "fix" the compromised hardware is vainglorious. If a fix does exist, it will be so resistant to exploit that an explanation won't change anything.

It's conceivable for them to have an impervious fix (without conceiving of the fix itself), however experience has shown that the strongest schemes are the ones that have been exposed to the most eyeballs.

<comment><USER11> I think it's conceivable for a fix to exist such that 1\. knowledge of its inner workings could be used to prevent it from being applied. 2\. it will take weeks to reverse, by which point most systems will be upgraded. 3\. once applied, the trick used to prevent it from being applied cannot be used to remove it.

trivial example: the fix creates a new file "supersecurity" only if the file doesn't exist. by creating an empty with that name, you can upgrade but dodge the fix. but once you've got the supersecurity, you can't delete that file.

<comment><USER10> I agree with your first paragraph: It is possible for there to be a "fix" where knowledge of its inner workings would expose an easy way to prevent the fix from being applied.

Of course, what I said would still apply: I am less confident that such a thing would be resistant to compromise using other methods. So, if they have this supersecurity patch to put out, after it has been installed they should be eager to tell the world how the systems are now secured.

</comment></comment></comment><comment><USER12> Maybe the hardware has a second key hidden that wasn't used until now?

</comment><comment><USER13> They can simply check the date it was signed: if (dateSigned() < 1293775200) { // Verify with old PubKey } else { // Use new PubKey } What is the big deal here?

<comment><USER14> That doesn't close the hole because I can sign my homebrew or resign my pirated material with an older date. They would have to whitelist _all_ previous content and issue a new key in hardware somehow.</comment></comment>


Show HN: Jelly – A search engine for busy people - <AUTHOR> http://askjelly.com/ <comment><USER2> Sooooo, it's Quora/StackOverflow with anonymous mode by default and the wording "search" instead of "ask" and no gamification system?

I like it anyway, any idea how it's supposed to scale? I mean we've all seen a bunch of knowledge bases that are pretty much useless as they reach thousands of almost-similar questions.

UI is buggy: can't edit an item in the "additional list", the cursor gets moved to the end after each stroke.

</comment><comment><USER3> HTTPS support considering you're dealing with user accounts?

</comment><comment><USER4> oO

Q: "how to travel the amazon?"

A: "We got it! Sit back and relax, you'll get answers soon."

So, because I'm a "busy" person I'm told to sit back and relax? Aawwww. thanks :)

Seriously: Is it a search engine or a frontend for mechanical turk? What exactly is the benefit of it?

</comment><comment><USER5> Maybe this just happens in a mobile browser, but it seems very laggy as it misses many keystrokes.

</comment><comment><USER6> Was this not launched a while back by biz stone ex twitter? My memory is hazy

<comment><USER7> Yes, Jelly is Biz Stone's company, and this App is a "Re-pivot" back to the earlier release. I really like Biz Stone's thinking around altruism (apparently we get the same good feeling from helping people as we do from winning money). Using technology to promote altruism is potentially revolutionary, so I follow Biz and Jelly closely.</comment></comment>