Powa: The startup that fell to earth - <AUTHOR> http://www.bbc.co.uk/news/technology-35860814 <comment><USER2> That article reveals a story that's one _facepalm_ after another. An example of the worst "rockstar founder" attitude backed by apparently clueless investors.

> Powa occupied two floors of the prestigious Heron Tower at the heart of the > city of London, and had equally lavish accommodation in Hong Kong, New York > and across Europe.

Before having established proper cash flow?! When all their "sales" were just "letters of intent". How were investors even remotely convinced it was a good deal?

> One of the more printable comments is this: "You don't employ intelligent, > highly experienced people to treat them like something unpleasant under your > shoe by telling them to forget everything they know, as your way isn't > working"

I wonder what the staff turnover was like? The only time I worked for a CEO who treated his employees with that little respect, they had a 90%/2 years turnover. No one was prepared to stick around and support someone who would send motivational emails saying "Ask not what your company can do for you, ask what you can do for the company" as the CEO was screwing up sales deals. I always wondered if he'd ever figure it out. Even burned my bridge there trying to help him understand what was going on during the exit interview.

> According to several former employees, at one Christmas bash in Mayfair, > strippers were hired to perform, to the discomfort of many present.

Grew up idolising the worst aspects of Yuppie culture?

> "While the company was going under, he's fooling around in a photography > studio pretending to be Ziggy Stardust. The guy is a narcissistic idiot."

Certainly sounds like it...

<comment> rm_-rf_slash Just curious, how did things end up at the company you worked at?

I had a similar experience with a startup out of college. On reflection, I should have noticed that among all the photos on the "mentioned in the news" billboard, the only familiar faces were the founders...

<comment><USER2> Still trundling along in a dead end race-to-the-bottom market. New CEO now, not sure what happened to the old one given he was also the founder, presumably he's in more of a board role or something. Unsurprisingly given the high turnover rate, I soon had no contacts left in the company and stopped paying attention. Without exception, everyone I knew has moved on to better things.

<comment> rm_-rf_slash Sounds eeriely similar to my own situation, without the CEO turnover. Godspeed.

</comment></comment></comment></comment><comment><USER3> There are some gems at the glassdoor site referred to in the article.

 _It is true, CTO did make whole team of people redundant on New Years Eve via voicemail - maybe 'how to' book on leadership taught him redundancy procedure._

 _Led by a truly odious individual, this attitude is prevalent throughout the company. Senior management are relics of the 80 's living off their success in the last dotcom boom (and bust), who believe the film 'Wall Street' is a training manual for management, business practices and team leadership._

These were via [https://www.glassdoor.com/Reviews/Employee-Review-Powa- Techn...](https://www.glassdoor.com/Reviews/Employee-Review-Powa-Technologies- RVW3877050.htm) \- looks like a signup would be necessary to get the full reviews.

I noticed, though, that clicking through to the full reviews page, the most recent are glowing ones from Powa's head of development and head of sales ;)

</comment><comment><USER4> I had a meeting with their sales people back in 2013 or so, a few year anyway, and I remember thinking after the hour long pitch that the claims where entirely delusional and pumped up. It was "just" a QR code with an app behind it and ultimately nothing at all fancy but they spoke about it like it was a total paradigm shift in buying. I never got how they lasted so long, reading the glassdoor reviews over the past year it was clearly a sinking ship years ago.

I honestly can't understand how they got nearly $100m in funding.

<comment><USER5> Yup - same here. The whole product was just... meh. If it had been backed by a market leader or (shudder) a consortium, it might have had a chance of success.

But a new entrant trying to sign up merchants individually?

<comment><USER6> They weren't interested in working with platforms either - they were actually actively offensive when we contacted them. Probably something to do with Wagner's background at Venda, a platform provider he founded.

Their users group call themselves "the prisoners of Venda"!

<comment><USER7> Might as well go for the pun.

[https://en.wikipedia.org/wiki/The_Prisoner_of_Zenda](https://en.wikipedia.org/wiki/The_Prisoner_of_Zenda)

</comment></comment></comment></comment><comment><USER8> One reminder I say to myself when reading stories like this:

It can happen to you.

Dramatic failure, maybe not: but there are plenty of startups out there in that gray zone of "we don't really know what we're doing but we have several redeeming qualities!"

That zone, the upper 10% of "hyped" startups shall we say, are far more deceptive, and therefore dangerous, than the "obvious" bad companies, the bottom 90%. It's easy to laugh at all those investors who got hornswoggled by an out-and-out narcissist. It's less easy when the team is super- smart, the founders super-motivated and the only factors missing just happen to be what separates the 10% from the 1% who are truly successful. It could be product- market fit, work-life balance, or whatever the team needs at the moment. The only way to know is to be super-paranoid[1]

Much like the stuff on /r/subredditdrama or /r/cringe, spectacles of human foibles convey "I'm better than the worst, so I am good." which, for me, translates into a false sense of confidence.

[1] [http://www.goodreads.com/book/show/66863.Only_the_Paranoid_S...](http://www.goodreads.com/book/show/66863.Only_the_Paranoid_Survive)

<comment><USER9> Startup business backed by VC is kind of unsound.

The traditional way maybe longer : minimal investment and constant self sustainability, but it seems also better at helping founder adapt to changes in costing and technologies.

When you have 50 customers it is easier to recognize you made a mistake in architecture and change it. While aggressive market spreading with freemium lock you in faster and makes you less agile.

Also you get very soon aware of your real costs.

But, the problem is VC+startup tends to aggressively compete with sound business in a way that has nothing to do with pure merit but often just the capacity to access capital (which according to most studies relate to birth).

I am an hardcore historical liberal, I don't really think that birth is a merit that is leading to a competitive market. Else, most of the leading economical nations would have remained monarchies. I also accept people have the right to live in dignity from their work and do not have to be all entrepreneurs.

I kind of think people misunderstand what liberalism is.

It is the right for people to choose a dignified existence through work with a clear contract of one hour worked has to be paid, and the right if people wishes to be entrepreneurs that have the possibility to access to a truly competitive market based on their merit without distortion.

And like any liberal I think it contributes to prosperity wealth and happiness of the Nations in an efficient way.

<comment><USER10> > The traditional way maybe longer : minimal investment and constant self > sustainability, but it seems also better at helping founder adapt to changes > in costing and technologies.

True and that's the approach I'd take but there is a benefit to the other way if you have a product that is a first or is the first to do something well, first mover advantage to grow big fast required a lot of capital (the costs to do that have dropped hugely but are still not trivial).

Some businesses grow best organically and some require a shot in the arm.

<comment><USER9> If they require a shot in the arm backed by massive investment, I don't think privately owned interest favouring statistically birth over competence is the right way.

It is basically both ploutocratie and major life changing decision who are escaping the control of the people. Hence not driven neither by the interests of Nations nor of the environment.

We are supposed to live in democracy where the people are free to decide to not trigger a massive extinction of species or fuel wars based on biasing the access to oil or cheap enslaved workforce.

I think we have the right to decide our own destiny. But, it is because I am an idealist still believing in the rights of the people, freedom and fair competition.

</comment></comment></comment></comment><comment><USER11> I've worked with Venda (for two separate companies) and met Dan Wagner and their platform is truly an awful piece of software, and the man himself isn't much better, my job was basically to find methods of subverting the software in order to do what our marketing team wanted. It's roughly £6k per month, and account management is slow to respond and it's very difficult to do anything meaningful with the technology. One of the companies is still with Venda with the intention of moving away, and one moved to DemandWare after roughly a year.

Powa is Venda's answer to Shopify, trying to capture the smaller market, the software, and the management, was never good enough to compete.

<comment><USER12> I worked /for/ Venda in their platform operations team in London, and everything in the original article is as true for Venda as it is for Powa.

We had herman miller aeron chairs and a prime piece of real estate in central london (by the Noel Coward theatre) but had never turned a profit, the Venda application was 2million lines of perl that could "sustain" 1 hit every 30 seconds, so most of my job was maintaining expansive arrays of caching systems.

The upper executives and thick layer of middle management were smarmy and entitled, and the operations staff took it as a challenge and a matter of personal pride to make it work "Smooth seas do not make skilled sailors" was a common motto.

I was once publicly berated for helping a customer on the phone because the management wanted to bill time for what was literally a 30 second change (I did it WHILE on the phone with them).

They do a good job of soaking up all the perl developers in London though.

also, FWIW: they sold the company to someone shortly after I left, it may be better managed now, but I can't be sure.

<comment><USER11> I visited the office a few times between maybe 2008 and 2012, if you were working there then, we likely were in the same room at some point.

I can't remember the exact syntax, but I used to find it hilarious that each Venda tag had to have a unique label, and since the code was notoriously difficult to navigate, everyone just ended up using random numbers and hoping that it wasn't used elsewhere.

        <venda_something label=5318008>
            ...
        </venda_something>

</comment></comment></comment><comment><USER13> I worked with them through 2014 and saw the NYE firing. Pretty brutal.

But at that point the 'agile' team hadn't delivered in over a year. Badly mismanaged...

<comment><USER14> What exactly happened on NYE?

<comment><USER13> About 20/30 developers were fired via SMS on NYE 2013/14

<comment><USER15> Support.com (NASDAQ and soon to be OTCBB[sauce]: SPRT) let go of over 20% of their call center by email/robocall that same day. That was a 'fun' year.

[sauce]: [https://biz.yahoo.com/e/160223/sprt8-k.html](https://biz.yahoo.com/e/160223/sprt8-k.html)

</comment></comment></comment></comment><comment><USER16> Getting money from VCs is usually difficult, how do idiots like this guy scam $200M from people? Makes the VCs look equally stupid.

<comment><USER17> I think people generally assume that confidence is backed up by reality. I've found that one of the most useful sales techniques is to be friendly and polite but also very confident. People find it reassuring.

Sounds like this guy took it to the extreme though, and lost all perspective on reality along the way.

<comment><USER18> Hmmm...yes maybe that picture of him in the Bowie getup was the giveaway for that conclusion?

</comment></comment></comment><comment><USER19> The opening paragraph on the CEO's wikipedia page is a gem: [https://en.wikipedia.org/wiki/Dan_Wagner](https://en.wikipedia.org/wiki/Dan_Wagner)

<comment><USER20> Another gem from wikipedia "His choice of attire (a Donald Duck waistcoat) to a media photocall ahead of the MAID IPO was considered responsible for reducing the value of shares by 10p."

<comment><USER21> Unfortunately a quick google image search for "Dan Wagner donald duck waistcoat" yields no results, but that would be quite something so see.

</comment></comment></comment><comment><USER22> You need basically every merchant to sign up for your payment app to work.

Otherwise people would just use credit cards, who have been here since forever.

<comment><USER23> I'm not sure you need every merchant - I think you only need a significant proportion of the merchants that a specific population use.

I probably make most of my purchases with a very small group of retailers - for example, in terms of number (not value) of transactions, the sandwich shop by my work and the corner shop by my house probably account for 80% of my offline transactions. (I go to the supermarket about once a week, and although I tend to buy more, that's all in a single transaction.)

If you could sign up those merchants, and give me a compelling reason (convenience, discounts, rewards) to use your payment app, it might not matter that I couldn't use your payment app on those rare occasions that I go shopping somewhere else.

Just a thought. (I'm not in the payment industry.)

<comment><USER24> Local shops all accept contactless payment though, which is faster than anything involving a smart phone could ever be. You literally just hover your debit card near the terminal and you're done, no pin, no signing[* ], it's quicker than unlocking a phone.

[* ] I've only once in my life ever had to sign for a transaction, it's not a common method, I just mention it here because I know some countries still use it.

<comment><USER25> Yes - I wonder about that every time I see an ad for Apple Pay or some other payment app. Contactless is rapidly becoming the default, so how do you compete with it?

<comment><USER26> Most people have their phone more easily to hand than a card, which needs to be extracted from a wallet or purse. So in practice Apple Pay is often faster and more convenient.

It's also more secure because you're authenticated by the fingerprint scanner, and it's anonymous.

<comment> m-i-l _Apple Pay is often faster and more convenient_

There have been several times I've got stuck behind someone using their Apple phone to get through the gates on the London Underground and have noticed two or three people get through the gates on either side in the same time as the one with the Apple phone. And it isn't just me - according to [http://www.theguardian.com/technology/2015/jul/16/tfl- cautio...](http://www.theguardian.com/technology/2015/jul/16/tfl-cautions- pitfalls-apple-pay) the iPhone "has led to irate commuters and queues at the gates".

<comment><USER27> People on the Tube using Apple Pay need to realise that you can do the Touch ID authorisation _before_ reaching the ticket gates.

The transaction will stay authorised for a couple of minutes, at least, and then the gates will open nearly instantly when you put your phone near the sensor.

This isn't an issue for using Apple Pay via the Apple Watch, since that device skips the Touch ID requirement (instead, it will de-authorise if you take it off your wrist).

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> For those interested in seeing Dan Wagner in action, this is a video Christmas message (4.44 mins) sent to all staff in December 2015. Powa went into administration in February.

[http://youtu.be/sWhI5YK-_No](http://youtu.be/sWhI5YK-_No)

</comment><comment><USER29> Wow, the letter of intent thing is kind of depressing. I mean, say what you like about Dragon's Den/Shark Tank esque 'business' TV shows, but that point comes up in almost every episode; a letter of intent is not a deal or contract. But no, a '2 billion dollar' business was rewarding staff for getting these.

And yeah, all the expensive office space, fraternity esque atmosphere, manager posing for photoshoots stuff... it's like the company was set up and run by people who wanted the glamour of running a large company rather than those who wanted to actually make a viable business out of it. The whole thing feels like something you'd read about a dotcom business in the 90s, right before the crash.

</comment><comment><USER30> Story sounds quite close to what happened to boo.com [https://en.wikipedia.org/wiki/Boo.com](https://en.wikipedia.org/wiki/Boo.com)

<comment><USER31> The CEO's wikipedia page [https://en.wikipedia.org/wiki/Dan_Wagner](https://en.wikipedia.org/wiki/Dan_Wagner) says:

"Wagner remained on the board of MAID until 2001 and founded Venda Inc later that year.[6] Venda Inc is provider of e-commerce software originally built using technology from the defunct company Boo.com.[1][4] Wagner had acquired Boo.com for £250,000 in 2000 following the dot-com crash.[12]

...

In 2007 he also founded Powa Technologies, an e-commerce business based on Venda Inc's small business solution, but with additional services for in-store and mobile point of sale and software for mobile payments called PowaTag and PowaPOS, formerly known as mPowa. Wagner introduced PowaTag in 2014, after receiving more than $100 million in funding.[15] Users of the service can make purchases using QR codes, audio watermarks and iBeacons.[6][16]"

So Boo.com -> Venda Inc -> Powa Tech :)

<comment><USER32> Later in the wiki article: "Wagner operates his various business interests from a holding company called Bright Station. Bright Station has revenues of $50 million and employs 450 staff." Am I the only one who thinks $111,111 in annual revenue per staff member is really low for a supposed tech holding company? The multiplier should be much higher than that (or they're paying slave wages plus stock options to make those numbers work).

</comment></comment></comment><comment><USER33> Good riddance. Dan Wagner was basically Gordon Gecko via David Brent.

<comment><USER34> I'll just leave this here: [https://www.youtube.com/watch?v=eHzKQdX- _KA](https://www.youtube.com/watch?v=eHzKQdX-_KA)

<comment><USER35> Link not working in the UK due to copyright. This one does though [https://youtu.be/L3pXnzBPT98?t=27s](https://youtu.be/L3pXnzBPT98?t=27s)

It's from a comedy pilot called 'Golden Years' which is very clearly a development step towards 'The Office'.

</comment></comment></comment><comment><USER24> " The start-up said that adding its PowaTag button to sites would reduce the risk of customers changing their mind before completing a purchase "

Instead they'll change their mind after it has been dispatched, costing the vendor more.

In the UK at least distance selling rules mean that anything[1] bought on the internet can be returned up to 14 days later without requiring a reason.

[1] There are of course some exceptions for certain product types.

</comment><comment><USER28> interesting insight here into how Powa's management tried to manipulate the reviews on the Glassdoor site, written by an ex-CFO of Powa.

[https://www.linkedin.com/pulse/powa-glassdoor-reviews- were-m...](https://www.linkedin.com/pulse/powa-glassdoor-reviews-were- manipulated-steven-prowse)

<comment><USER36> (bit off-topic): it seems human nature to manipulate reviews (Yelp, Glassdoor, Google) especially when "anonymous". Seems like what is needed is a third party to verify identity and certify to the review site that the reviewer is real and from a real person. This hopefully will maintain anonymity unless a sub-poena is involved.

</comment></comment><comment><USER37> Sounds like some people were miffed that they missed out on Clinkle and overcorrected a bit too much.

</comment><comment><USER38> Dan Wagner talking about an employers' responsibilities to its employees [https://youtu.be/Udc46TNfOtY?t=3m42s](https://youtu.be/Udc46TNfOtY?t=3m42s)

</comment><comment><USER21> Sounds like the startup was run by Russ Hanneman. It's eerie that the characters in Silicon Valley (the TV show) can be pointed to real life people so easily.

</comment><comment><USER39> > the deal". Mr Wagner, who claims to have a stellar record as a serial > entrepreneur, was still telling everyone who would listen that his was a > company that would be bigger than Google or Facebook one day. As recently as > last October, he told Evan Davis on Radio 4's Bottom Line that the business > had been valued at $2.7bn by its backers Wellington. Evan suggested that was > a meaningless figure because Powa hadn't made any money yet. "We're a growth > tech business," Mr Wagner replied, maintaining it was other people who had > set that value.

holy crap this reads just like the interview with Pets.com in a 1999 edition of some PC magazine</comment>


Discovery of Czech tiger farm exposes illegal trade in heart of Europe - <AUTHOR> https://www.theguardian.com/environment/2018/nov/19/gruesome-discovery-of-czech-tiger-farm-exposes-illegal-trade-in-heart-of-europe <comment><USER2> This is a great article. Really, really cyberpunk - "he large Czech-Vietnamese community". "illegal tiger farms ... are also operating in the middle of the EU". "processed products such as tiger wine and broth".

William Gibson would be a good person to write this novel. Hollis Henry could once again be on the trail of something so mysterious, so avante guard, that we proles can't possible understand it.</comment>


What's broken with Unix? A clearer alternative to text processing.  - <AUTHOR> http://www.venturecake.com/whats-broken-with-unix-how-would-you-fix-it-part-i/

<comment><USER2> Didn't the old Lisp Machines have everything this guy is asking for?

</comment><comment><USER3> Windows Power Shell addresses some of these issues.</comment>


Uber Wants to Patent Its Controversial Surge-Pricing Plan - <AUTHOR> http://www.huffingtonpost.com/2014/12/19/uber-patents_n_6354166.html

<comment><USER2> It's completely understandable why Uber would want to patent its surge pricing algorithm. However, the mere existence of surge pricing (especially prices that are 2-3x+ the normal rates) will allow for further innovation in the ride-sharing space. Expect to see more emphasis on 'ride-share pooling' and even on scheduled rides. Consumers will also become smarter as they are given tools and data (like whatsthefare) that help them better plan out their trips to avoid the price gouging. Extreme surge-pricing will be less prevalent as consumers get smarter and as competitors better forecast and communicate demand spikes more rapidly to their drivers.</comment>


Video game can detect early stages of Alzheimer's better than medical tests - <AUTHOR> https://www.cnn.com/2019/04/27/health/video-game-alzheimers-scn-trnd/index.html <comment><USER2> link to the article: [https://www.pnas.org/content/116/19/9285](https://www.pnas.org/content/116/19/9285)</comment>


An Ancient, Brutal Massacre May Be the Earliest Evidence of War - <AUTHOR> http://www.smithsonianmag.com/science-nature/ancient-brutal-massacre-may-be-earliest-evidence-war-180957884/?no-ist <comment><USER2> Reminds me of the Cormac McCarthy quote:

"War was always here. Before man was, war waited for him. The ultimate trade awaiting its ultimate practitioner"

<comment><USER3> That seems a bit pretentious. Surely there can be a species better suited for war?

<comment><USER4> From the videos I've seen ants and wasps are pretty good at it.

</comment></comment></comment><comment><USER5> > Even nomadic hunter-gatherers engaged in deliberate mass killings 10,000 > years ago

This may be our earliest evidence of it, but I would bet that even pre-sapien hominids engaged in deliberate mass killings for tens of thousands of years. 10kYBP is still very recent in the history of our species.

<comment><USER6> _" I would bet that even pre-sapien hominids engaged in deliberate mass killings for tens of thousands of years..."_

I think that's very likely. The article notes that chimpanzees "deliberately stalk and kill members of other groups". So humans may have inherited these nasty traits from our primate ancestors ages ago.

<comment><USER7> The Gombe Chimpanzee War: [https://en.wikipedia.org/wiki/Gombe_Chimpanzee_War](https://en.wikipedia.org/wiki/Gombe_Chimpanzee_War)

<comment><USER7> This article has been edited since I first looked at it around 2013. At that time, there were other explicit descriptions of the violence - chimps killing and eating infants from the other group, and beatings and rape of females. This New Scientist article has more details: [https://www.newscientist.com/article/mg22229682.600-only- kno...](https://www.newscientist.com/article/mg22229682.600-only-known-chimp- war-reveals-how-societies-splinter)

<comment><USER8> The newscientific's article has more information. But I think the documented case of eating chimps children is from another place.

And this is the revision that did that remove the rape part: [https://en.wikipedia.org/w/index.php?title=Gombe_Chimpanzee_...](https://en.wikipedia.org/w/index.php?title=Gombe_Chimpanzee_War&type=revision&diff=649596805&oldid=633464265)

The comment is:

> _The war: Second paragraph. Chimps were not raped. No where does this > reference occur in Goodall 's articles or any other Gombe researcher. The > source seems to be the Morris reference. I don't know where they got that._

</comment></comment></comment></comment></comment><comment><USER9> The article is hilarious.

Not only they seem reluctant to coming to terms with our nature, but they had to clarify that, in a great exercise of our anthropocentrism, that we and only us humans are also capable of showing acts of altruism. Just in case somebody gets upset at the idea that violence and warfare might not be social constructs.

</comment><comment><USER10> I wonder how accurate the millennium approximations are, it would put this event about 2000 years before the 1 in 17 males reproducing for every female at the dawn of agriculture.

[https://www.reddit.com/r/history/comments/2zkgq5/8000_years_...](https://www.reddit.com/r/history/comments/2zkgq5/8000_years_ago_17_women_reproduced_for_every_one/)

</comment><comment><USER11> I find it strange the author of the article seems to imply this is a surprising find. Humans have been slaughtering each other for all sorts of reasons since the beginning of known history. This merely is another confirmation.</comment>


Is There Any Benefit to Multivitamins? - <AUTHOR> https://www.hopkinsmedicine.org/health/wellness-and-prevention/is-there-really-any-benefit-to-multivitamins <comment><USER2> From what I've come to believe, still so after reading the article, is that most of the vitamins you intake are passed through urine. For whatever reason. I do think some have more uptake than others, but the most and only true fire way to ensure you're getting all the essential vitamins is through your diet. I won't preach what constitutes a healthy and balanced diet, but from my understanding the vitamin absorption through digestable foods is far superior to taking a multivitamin, especially when using them to cover some supposed deficient one likely has</comment>


Ask HN: How much CO2 we emit when sharing attachments on messaging apps? - <AUTHOR> <comment><USER2> I was literally thinking simultaneously about environmental impact of using internet.</comment>


Creatine supplementation improves brain performance in vegetarians [pdf] - <AUTHOR> http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1691485/pdf/14561278.pdf <comment><USER2> Edit : it should be noted that this is from 2003. I'm sure newer research has been done. (Re-Edit. Not much by the looks of it)

One question this raises is why isn't there a know correlation between high red meat diets and higher brain performance? All things being equal the the study suggests a significant advantage for higher intake.

Here are my best guesses in order of likelyhood

\- The benefit is temporary and relates more to the raising of levels rather the absolute level.

\- The amounts of creatine involved (equivalent of 2 pounds red meat per day) are too much for anyone to ingest naturally for long, but this level is required to see significant benefits.

\- The benefits of creatine are being counteracted by some other substances in red meat therefore masking it's effect on heavy meat eaters.

\- The reported high average IQ of those who chose to become vegetarians masks the fact that the lack of creatine in their diet does actually make them dumber.

Anyway it looks interesting especially for those without much natural creatine intake.

</comment><comment><USER3> Relevant link: [http://groups.google.com/group/brain- training/browse_thread/...](http://groups.google.com/group/brain- training/browse_thread/thread/fe4ee2f0c994e40e/d24bcf30c083ec3e)

tl;dr: Rawson 2008 is a broad null result for healthy young omnivores who aren't idiots. Vegetarians, idiots, the sleep-deprived, and old people may benefit.

<comment><USER4> So what the study is saying is that eating a diet we are evolutionary adapted to, then sleeping well makes us smart?

<comment><USER3> I think I'd put it in negative terms; not that sleeping makes you smarter (because that makes it sound like sleeping is a sufficient condition), but that not sleeping prevents you from being smarter (which says sleeping is necessary but not sufficient - as it is).

Ditto for vegetarian diet - not that eating meat makes you smart, but that not eating meat and not replacing the meat appropriately will prevent you from being (a little) smarter.

(There are other examples, like the B vitamins that vegetarians need to watch out for, I've heard.)

</comment></comment></comment><comment><USER5> The graphs seem to show ~50% increase on Raven's Progressive Matrices tests, and ~30% on backwards digit span tests.

<http://i.imgur.com/7jZT4.png>

Those are pretty large gains, I'm tempted to try supplementing this.

</comment><comment><USER6> A very interesting topic for a study would be similarly testing groups of omnivores, vegetarians and vegans, to see if there are any detectable mental capacity differences. It should be less controversial than comparing the same between races and genders.

The 'we developed bigger and better brains from eating meat' is an often used rationale for the omnivore diet.

<comment><USER7> Actually, I think that would be a terrible study. It's too hard to control for other factors that may differ between the groups. For instance, vegetarians and vegans in the U.S. are on average more educated. You can add that into a model, but this kind of study- where you test people before, during, and after creatine addition- is really much better science.

</comment></comment><comment><AUTHOR> From the abstract:

" .. In this work, we tested the hypothesis that oral creatine supplementation (5 g/day for six weeks) would enhance intelligence test scores and working memory performance in 45 young adult, vegetarian subjects in a double-blind, placebo-controlled, cross-over design. Creatine supplementation had a significant positive effect (p , 0.0001) on both working memory (backward digit span) and intelligence (Raven's Advanced Progressive Matrices), both tasks that require speed of processing. These findings underline a dynamic and significant role of brain energy capacity in influencing brain performance."

<comment><USER8> _Statistically_ significant (subject to the usual caveats of being careful about the results from a single study). Little is said about how worthwhile the change is.

<comment><USER9> See figure 1. From what I gather in the paper, this RAPM is a speed measure. If I'm interpreting this stuff correctly at all (never read anything in this field before) performing 40% more tasks per unit time is quite worthwhile!

<comment><USER3> Actually, Raven's isn't supposed to be speeded if you care about measuring IQ rather than, say, processing speed or WM control. This is one reason why the Jaeggi 2008 study (showing that Dual N-back boosts IQ) is somewhat untrustworthy.

</comment></comment></comment></comment><comment><USER10> Why do the graphs change the name of the line between point 2 and point 4?

<comment><AUTHOR> Because they switch the placebo and creatine groups :)

        Week (-∞)-0: Noone has taken any supplements
        Test 1.
        Week 0-6   : Group 1 gets creatine, group 2 gets placebo
        Test 2.
        Week 6-12  : Noone takes any supplements
        Test 3.
        Week 12-18 : Group 1 gets placebo, group 2 gets creatine
        Test 4.

<comment><USER10> Thanks. I guess I have a problem reading closely.

</comment></comment></comment><comment><USER11> It's time to link to Peter Norvig's article about reading research studies again:

<http://norvig.com/experiment-design.html>

</comment><comment><USER12> This study is from 2003 and makes extravagant claims. Have there been any followup studies that corroborate it or qualify it? Were these vegetarians seriously deficient?

</comment><comment><USER13> Just thought I'd add this...

Creatine is naturally produced in the human body by amino acids. Just because you're a vegetarian, it doesn't mean you suffer a shortage of the particular amino acids required for producing creatine. Most vegetarians fall under the "ovo-lacto" umbrella, meaning they will eat egg and milk, and pretty much anything else made by animals, just not the animals themselves - being a vegetarian myself, I often say: "I'll eat food made by animals, just not food made OF animals" - and many vegetarians also use various "fullworthy" protein supplements containing all the essential amino acids, guaranteeing them all the components needed to produce creatine while being a vegetarian.

I myself use protein supplements to ensure, together with food, that I get a bit more than 1 gram of fullworthy protein per kilo body weight a day, and that is an amount that actually even meat-eaters, without supplements, can have a hard time reaching on a daily basis.

Addendum:

Digging a little bit on Wikipedia, I found the three amino acids (of which only one is essential) that Creatine is produced from in the body:

Arginine (non-essential) - vegetabilic sources: "wheat germ and flour, buckwheat, granola, oatmeal, peanuts, nuts (coconut, pecans, cashews, walnuts, almonds, Brazil nuts, hazelnuts, pinenuts), seeds (pumpkin, sesame, sunflower), chick peas, cooked soybeans."

Glycine (non-essential) - synthesized in the human body from Serine, also a non-essential amino acid.

Methionine (essential) - vegetabilic (and animalic) sources: "High levels of methionine can be found in sesame seeds, Brazil nuts, fish, meats and some other plant seeds; methionine is also found in cereal grains."

Judging from this, it seems that a vegetarian has to maintain a really lousy and unhealthy diet in order to suffer a Creatine shortage. Maybe the test subjects were university students on a Ramen diet.

<comment><USER7> Just because your body CAN produce creatine doesn't mean that all it needs to produce enough is its building blocks.

People here seem to be acting like our bodies have perfect feedback loops for every nutrient, but if in our recent evolutionary history we always got enough, that might not be the case. You have to remember that were one of only three mammals species that has completely lost the ability to synthesize vitamin C. If we lost synthesis of one necessary nutrient, don't you think it might be possible that we also lost some mechanisms for regulating the amount of another?

<comment><USER13> I just don't see where you are going with that text in the context of Creatine production. Vegetarians HAVE Creatine in their system, fully produced by the body. They just don't have the same amount as the meat-eaters, __because red meat contains Creatine itself, as a form of Creatine supplement__. Ergo, vegetarians are fully capable of producing the necessary amount of Creatine they need, by the ingestion of the required components. (otherwise there'd be no Creatine in their bodies.)

<comment><USER3> > Vegetarians HAVE Creatine in their system, fully produced by the body. They > just don't have the same amount as the meat-eaters, __because red meat > contains Creatine itself, as a form of Creatine supplement__. Ergo, > vegetarians are fully capable of producing the necessary amount of Creatine > they need, by the ingestion of the required components.

That's quite a logical leap there. I 'HAVE Money in my wallet', so ergo, I am 'fully capable of producing the necessary amount of Money I need'? (You should know I dream of living like a billionaire.)

Humans can produce vitamin D or omega-N oils on their own, yet, it's established fact that many humans are persistently deficient.

<comment><USER13> I consider it just a small leap in logic compared to your knee-jerk parallel regarding money in the wallet.

We know that increased oxygen in the blood speeds up healing of damaged tissue - this is why you get a tube up your nose blowing extra oxygen into your respiratory system when you come out of surgery. Does this by your logic mean that we're persistently oxygen deficient in our natural state, just because ADDING oxygen gives a higher effect?

What IS the nominal level of creatine in the body? Do you know? I don't. Pure creatine supplement from meat ingestion can so far only be proven to be an _added aid_, rather than going by the logic that vegetarians turn dumb when they stop eating red meat.

<comment><USER14> I don't understand how you can argue against the research that shows that vegetarians who supplement with creatine perform better than vegetarians who don't. Vegetarians do not produce "enough" creatine on their own. If you want to disprove that, find research that shows otherwise.

The wallet analogy wasn't that great. Allow me to try. I have all the exercise equipment needed to stay in great shape in my house, but that doesn't mean I'm in great shape.

<comment><USER13> But, I never argued that they benefit better with Creatine. You haven't read my posts. And just as vegetarians get a boost from it, so do meat-eaters, who also perform better when supplementing Creatine - ask 10 athletes (body builders in particular) and you will find at least 5 who uses it and can vouch for increased stamina from it. Does this, too, mean that they don't get enough? Surely it should, by the logic you've been using, and at this point you are contradicting yourself. From this we can simply draw the conclusion that everyone benefits from more of this in their systems, but it doesn't point to a deficiency of any kind, just as with my example of how artificially increased oxygen levels in the blood doesn't mean we don't get "enough" naturally.

The point I trying to make just flies by you; You don't KNOW what is enough, you don't KNOW what is too little. You can't say any of this based solely on the proof that _anyone_ performs BETTER when you ADD MORE. This is _not_ synonymous with a deficiency. And the research pointed to doesn't even bring up the specific vegetabilic diets held by the vegetarian subjects of the research, which is a very important detail missing for solidifying the "facts" the research is trying to bring forth. It's a very clear case of "correlation is not causation".

<comment><USER14> The definitions you're using for "deficiency", "enough" and "too little" are useless. If your body performs better with more of a substance that can be obtained through food or produced by your body, I'd call that a deficiency. If your body isn't performing as well as you'd like, and that can be improved by consuming more of a substance without harming your health, then you don't have enough of it.

This really shouldn't be controversial. I think vegetarianism is a good thing and it's something I'm attempting, but ignoring science because you don't like the negative connotation of "deficiency" doesn't make any sense.

<comment><USER15> If we define a "deficiency" as "expected level" of something, then we don't know if they had a deficiency. Regarding your definition, I don't have a testosterone deficiency, but I'd certainly perform better as an athlete if I took anabolic steroids.

Regarding creatine levels, all we know from the study is that after the supplementation, they had significantly more in their body. Maybe the results would be the same for omnivores - we don't know until someone runs the experiment. Even within this data, I'd like to see the vegans and vegetarians graphed separately.

<comment><USER14> My definition of "deficiency" was intended to consider only levels that can be obtained through food or created by your body from food. The definition still isn't completely right since given the same inputs, different people will produce a range of values. You get the idea, though.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> After I switched to vegetarian diet I have not noticed _any_ difference in brain/personality/iq, I ve just lost extra weight. And have less allergies. Aside from that - nothing.

<comment><USER17> It is hard to add anything to corruption's comment, but a practical tip:

I've seen claims that it is hard to notice how/when your intelligence changes over time. A friend who had some health issues for a while (sorry, I'm not giving more details) played (simple) computer games quite a lot, because the results showed functionality trends.

ymmv, of course, but if I were you I'd play a few games like that over time while trying creatine supplements. If they help, I'd continue.

<comment><USER18> Games like what? Tetris? Bejeweled? Text Twist?

<comment><USER17> I think there were simple games like that; not reaction stuff, though. I'll ask and hopefully get back to you in less than 24 hours.

<comment><USER18> Awesome! Thanks!

<comment><USER17> Not so awesome.

There were mostly FB-games. Things like " _Who Has the Biggest Brain"_ , word games (speed reactions), like Word Drop and Word Challenge in FB.

(I don't know anything about these games; I just have their names and a datapoint that they were good to verify daily shape and trace mind effects for medicines, etc. For some specific problems I'm not going to discuss.)</comment></comment></comment></comment></comment></comment>


Ten Things a Serious JavaScript Developer Should Learn - <AUTHOR> https://benmccormick.org/2017/07/19/ten-things-javascript/ <comment><USER2> This is a decent list. Absolutely agree that you should know the core language and how asynchronous/callback style code works (and promises/async-await for newer code), and agree that knowing newer ES6 and beyond is also very useful. However, there's a lot of legacy code that was designed to work with older browsers and companies that aren't willing to invest in new tooling so you have to be careful and really understand the basics without relying on the tools like Babel.

One thing I will disagree with is that you don't need to learn/know Node.js anything to be a professional or serious JS developer. There are a lot of very proficient front end developers that never have and never will touch Node.js, even if it is Javascript.</comment>


Twilio Flex: the programmable contact center platform - <AUTHOR> https://www.twilio.com/flex <comment><USER2> Note to product marketers: If you don't put prices in an easy to see and understand manner on your website, I won't even bother to investigate the features.

What use are the features if the price doesn't work for me? This saves my time in only investigating products that make their pricing structure clear.

<comment><USER3> Access is not open yet.

However, either way, if you're really the market for the product then not seeing pricing won't keep you from inquiring.

<comment><USER2> And I'm unequivocally stating that I will not.</comment></comment></comment>


Password Cracking AES-256 DMGs and Epic Self-Pwnage - <AUTHOR> http://blog.whitehatsec.com/cracking-aes-256-dmgs-and-epic-self-pwnage <comment><USER2> I am not a cryptographer but:

"We're talking even 6 characters or longer, some upper and lower case, and maybe toss in a digit and special character."

6 characters? for 256-bit AES? That seems woefully inadequate. Imagine, say, 72 possible characters (52 a-Z, 10 digits, 10 special characters). This gives a password length for "full" 256-bit security as at least 128*log(2)/log(72) = 42 characters. If I'm wrong about this, please someone correct me! Either way, "6 or longer" seems far too short. Have I missed something here?

As for this particular person's predicament:

I, too, have been in this situation. I couldn't recite my password to someone; I can only touch-type it. It's a bizarre situation to be in and I've very nearly forgotten it myself in the past. I find it's easier to stop trying in case you accidentally "overwrite" your muscle memory and just go back to it later. Most recently, it happened due to my keyboard being detected incorrectly on boot and it almost drove me mad until I realised it wasn't my own error but the keyboard. I suspect if I hadn't have realised I might've been in the same situation as the OP.

In any case, Apple's implementation of FileVault is closed-source (to my knowledge) so it should always be assumed that someone who wants access to your data badly enough can get at it. I don't think it's worth being this paranoid about (e.g. the OP storing passwords as flat-files in a 256-bit AES encrypted disk image instead of just using the system keychain which manages all that for you).

Edit: I did find this interesting:

"The reason it's so slow is because your AES256-encrypted DMG uses 250,000 rounds of PBKDF2-HMAC-SHA-1 to generate the encryption key. The ludicrous round count makes it extremely computationally expensive, slowing down the HMAC-SHA1 process by a factor of 250,000."

It doesn't seem so ludicrous if it works. Does anyone know if this is standard behaviour for encrypted DMGs?

<comment><USER3> > I, too, have been in this situation. I couldn't recite my password to > someone; I can only touch-type it.

Reminded me of this; making password type authentication using a game. The person can authenticate, but don't have explicit memory of the password that they can vocalise or write down.

<http://bojinov.org/professional/usenixsec2012-rubberhose.pdf>

<comment><USER2> It's a great system. And easier than you'd think. It really takes only two days of logging-in to learn a random password; even a long one. After all, how often do you think about your password when you type it in? I imagine you only consciously think about it the first dozen times you type it, and after that it becomes muscle memory, regardless of whether it's a random password or a memorable one. If that's the case, why not just use a random password to start with?

Still, it's never good to encrypt everything with the same password otherwise you end up in the same mess as the OP. What's the point of a backup if it shares a common point of failure?

<comment><USER3> I wasn't able to find a proof of concept of the password system, is there one available publicly?

<comment><USER4> Keepass

</comment></comment></comment></comment></comment><comment><USER5> This is exactly why I always keep paper backup of the master passkey. But, the paper backup is encrypted with light encryption. Why not to use strong one? It really doesn't matter, the master password is random string and 16 chars long. Then it's encrypted with simple phrase, using substitution, partitioning and transposition. After those steps, I'm confident that the password on paper is also utterly useless to anyone without knowledge how it is encrypted and what the simple pass phrase is. The backup key is also hidden outside any reasonable search area.

You could also utilize very simple methods like reversing case of random password, or swapping parts, adding or removing something you know. Like prefix to strengthen the password, you just always write passwordpassword (or something similar) and then add your real password. Without knowledge to the attackers now your 6 chars long f8Snb3 random password is 22 chars long. Don't use any of the schemes mentioned here, make up your own.

The password container software is configured to run about ~10 million streghtening iterations on the password before it's being used. This means that it will take about two seconds to verify one password. (Yeah of course depending from many factors.) - Password strengthening can be done using memory hard problems, like scrypt, which is way better than options which only consume pure processing power. (Read about memory hard problems)

You should also be aware of corruption risk of encrypted data. Therefore it's better to always have a off-site backup set with different encryption key(s). I usually do not renew both keys simultaneously, so I can reasonably recover from the backup even if I would lose the master key.

Of course you can also use indirect method, where you map to numbers and letters, pages, rows, char poses and therefore the password on the paper has absolutely nothing to do directly with your password. Do mapping so, that distribution is even and it's not clear that it's offset references. Then you just know, that when you pick (pdf/book/file,source code) X and start applying your code, you'll get your password.

Generally I have absolute minimum length for passwords 12 random chars and for master keys I prefer 20. For keys that I don't remember, I use 32 random. If you're using AES256 and prefer to have 256 bits of entrypy in your password, use fully random password of 40 characters (including large set of special characters) or more.

Giving password to lawyer is good idea if you want someone to have your password, in case something bad happens to you. Otherwise it's totally pointless. If I'm gone, my (private) data is gone, and that's it.

</comment><comment> thomas-st Are DMG passwords really going through 250,000 rounds of PBKDF2-HMAC-SHA1?

I've been using the Python PBKDF2 module with fewer iterations as it takes over 18 seconds to hash a password with 250,000 iterations on my 2.7 GHz Core i5:

In [1]: import pbkdf2

In [2]: %time pbkdf2.PBKDF2('mypassword', open('/dev/urandom').read(16), 250000).read(32) CPU times: user 18.36 s, sys: 0.07 s, total: 18.43 s Wall time: 18.45 s Out[2]: '<>\x17\x03q+\x1d\x1c+\x94^\xa2\xc9&\xa9\xa56\xc2\xfa\x97A\xd7\xfb\xc8\x93r\x9d\xa0\xd67|\x1e'

Also, everyone else seems to be using way fewer iterations, e.g. 5000 for LastPass ([http://helpdesk.lastpass.com/security-options/password- itera...](http://helpdesk.lastpass.com/security-options/password-iterations- pbkdf2/))

I wonder if the C implementation is much faster, or if Apple uses some special hardware acceleration (GPU or special CPU instructions), as I'd love to increase the number of iterations in my Python application.

<comment><USER6> > I wonder if the C implementation is much faster

Very likely -- Run this on your machine and see if it improves things <http://stackoverflow.com/a/9781943>. I got about 18.6s for your python code while this one with a 16 byte salt and 250k iterations runs in 0.6s.

OWASP recommends over 100k iterations too: [https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet...](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Rule_3:_Iterate_the_hash)

<comment> thomas-st True, looks like it's important to use a C module if available:

In [13]: from M2Crypto.EVP import pbkdf2

In [14]: %time pbkdf2('mypassword', open('/dev/urandom').read(16), 250000, 32) CPU times: user 1.16 s, sys: 0.02 s, total: 1.18 s Wall time: 1.18 s

<comment><USER6> I may not understand the whole context, but if you're using PBKDF2 for key derivation, you don't want to use something that works "fast". You want whatever algorithm/iteration combination that is as slow as possible [1], but not too slow that it annoys the user.

[1] on modern hardware, that is.

<comment><USER7> Using a slow implementation of PBKDF2 is not going to slow down attackers who use a fast implementation.

<comment><USER6> Correct. I didn't mean slow implementation, I meant slow enough on modern hardware using the fastest implementaiton.

</comment></comment></comment></comment></comment></comment><comment><USER8> Another way to back up your master password is with 'ssss'.

<http://point-at-infinity.org/ssss/>

You can split a secret into N pieces, where any M of them are enough to reconstruct it. Even if you have M-1 pieces, you're no better off than a random guess. You can then distribute the N pieces in safe places and among trusted parties.

I just implemented this scheme thinking towards what would happen to all my digital data if I were to die or become incapacitated. I store much of my local data and account passwords with strong encryption, with full-strength keys (not six chars like the OP) that no one would be able to guess or brute- force.

The hardest part is really thinking through what the reconstruction threshold should be and who your trusted parties are. You want the threshold high enough that you would not be easily compromised if you misplaced your trust, but not so high to preclude recovery if any of your trusted parties lost their piece, or... both of you were taken out in the same accident.

You can also use a service like deadmansswitch.net to distribute additional pieces to people automatically if you don't check in for a certain amount of time. Another moving part, but it does increase the 'james bond' factor.

</comment><comment><USER6> I've been thinking about this very problem---recovering a forgotten encryption password without trusting a third party. The state of the art seems to be

1\. Print it out on paper and put it in a safe. This is somewhat annoying and inconvenient for the vast majority of users, and if you lose or don't have access to the paper, you're screwed.

2\. Encrypt the password using answers to some security questions and store it with an online provider you marginally trust. This has the problem of reducing the security to the strength of your answers (which may be known to any number of people close to you), and people might even forget the spelling of their answers which puts them in the same pickle.

I feel what would be ideal is some sort of a question/challenge that evokes a consistent, unique, high-entropy response from the user but the response is not based on a fact... sort of like a Rorschach test, perhaps, but one where each user would have a unique response. Is anyone aware of some system/research like this?

<comment><USER3> You're better off just remembering the key to begin with. I can remember the ones I used in high school, and there's lots of simple methods of increasing your retention of them. Simplest of all is using them regularly.

</comment></comment><comment><USER4> KeepassX. You can use the same file on OS X, Windows, and Linux. Keep the file in Dropbox (it has its own encryption, independent of Dropbox) and you can access it everywhere, including iOS and Android, which also have Keepass implementations.

<comment><USER9> Keepass (and LastPass, etc) is vulnerable to the same problem -- if you forget the master password, you can get locked out of everything. While it is useful, it is not the only answer. If the encrypted information is mission critical, then you _must_ have a paper backup of the password stored somewhere safe.

Then again, if you don't, there is also a keepass2john [1].

[1] [https://github.com/magnumripper/JohnTheRipper/blob/unstable-...](https://github.com/magnumripper/JohnTheRipper/blob/unstable- jumbo/src/keepass2john.c)

<comment><USER10> Is it just me, or is john very very slow? I remember trying MD5 once, but the tries per second were in the thousands (whereas GPU-accelerated crackers do billions).

Maybe I'm misunderstanding and it was a few thousand rounds of MD5, though.

<comment><USER9> John isn't always the fastest anymore, but it's definitely not very, very slow. It also provides the widest support by far. (And most of the formats _are_ GPU accelerated, OpenMP threaded, or SSE parallelized. John itself also supports MPI. Make sure you've configured the makefile right.) If there's a format you're trying to crack, chances are john provides a convenient and reasonably fast way to crack it.

<comment><USER10> Interesting, maybe I was doing something wrong. I was just using the package provided by Ubuntu.

<comment><USER9> Not sure which one is in the Ubuntu repository. Although John the Ripper is Solar Designer's baby, most of the current development (under Solar's guidance) occurs in the "jumbo" version led by another developer named magnum.

You can download that version here: <https://github.com/magnumripper/JohnTheRipper>

Then you can build it with CUDA or OpenCL, SSE, OpenMP, MPI, etc., support using the Makefile.

<comment><USER10> That's fantastic, thank you for the link.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> If you want to maintain _a better_ security setup than mentioned in the article above (and for Windows), you can use TrueCrypt[1], which has some nice schemes to protect your data, even if someone forces you to leak out your password. You can even maintain virtual drives that are completely encrypted and can be mounted when needed. Do check it out!

[1]<http://www.truecrypt.org>

<comment><USER12> I am wary of truecrypt. It is open source, but the development is not open. It's also "exceedingly difficult to generate binaries from source that match the binaries provided by Truecrypt (due to compiler options, etc.)"[1]

[1]: [http://www.privacylover.com/encryption/analysis-is-there- a-b...](http://www.privacylover.com/encryption/analysis-is-there-a-backdoor- in-truecrypt-is-truecrypt-a-cia-honeypot/)

</comment></comment><comment><USER13> I created <http://passguardian.com> for this sort of situation. You can use it to split a password into a certain number cryptographic shares, setting a threshold on the number of shares that should be necessary to reconstruct the password. Store the shares in different locations/with different people, and use only if needed to reconstruct the original password.

</comment><comment><USER14> I love how those BJJ guys manage to work it into every conversation.</comment>


Show HN: Abtesting.ai – Optimize your landing page for conversions using AI - <AUTHOR> https://abtesting.ai/ <comment><AUTHOR> Hi HN!

I'm Rodrigo from ABtesting.ai and I wanted to show you our product. It's still in a very early stage, we have been building it up as a side project over the last year or so. The main idea is to lower the barrier of entry to do A/B testing on landing pages.

The product works as follow: 1 - You enter your URL and create a few variations of your title, copy and call to action. The possible combinations of these variations can be very big. 2 - We create a first experiment with some of the variations and run it using a multi-armed bandit approach. 3 - Once the experiment reaches statistical significance, we take the variations that worked best and use an evolutionary algorithm to mix them up and mutate them to run the next batch. 4 - Run a new experiment and repeat this process until finding the combination that maximizes conversions.

Since we use a multi-armed bandit algorithm, it's unlikely that you will get a worse performance than if you just left your landing as is.

I know our product is oriented towards a marketing audience but I would love to have some feedback on the technical side :)</comment>


LetsLunch.com: network with the VIPs of Silicon Valley - <AUTHOR> http://techcrunch.com/2011/01/31/letslunch-launches-and-weve-got-100-invites/

<comment><USER2> Lunch is a great idea. It's long enough to start building a relationship, but not so long that a bad match will ruin your day. I should sign up and see how well the matching algorithm works.

</comment><comment><USER3> Hi, Alain here, one of the co-founders. If you have high karma on Hacker News, you should know that you don't need an invitation code from TechCrunch, you are automatically welcome :-)

<comment><USER4> I'm trying to sign up, but it is rejecting my twitter username.

[http://dl.dropbox.com/u/3666801/Screenshots/Screen%20shot%20...](http://dl.dropbox.com/u/3666801/Screenshots/Screen%20shot%202011-01-31%20at%203.30.09%20PM.png)

<comment><USER3> Weird. Just sign up for now with an invite code. We can update your twitter and reputation manually if need be. Welcome on board!</comment></comment></comment>


Spectre chip security vulnerability strikes again; patches incoming - <AUTHOR> https://www.zdnet.com/article/spectre-chip-security-vulnerability-strikes-again-patches-incoming/ <comment><USER2> previous discussion: [https://news.ycombinator.com/item?id=17121811](https://news.ycombinator.com/item?id=17121811) (172 points by brandon 19 hours ago | 20 comments)

<comment><AUTHOR> It's not a dupe. This article gathers up info from multiple and later sources --Intel, Red Hat, etc. and how to deal with it--not simply the first mention of the problem.

</comment></comment><comment><USER3> These performance regressions are getting a bit depressing.

Is there some other way we could architect chips or operating systems that would allow these branch predictors to go full bore instead of having to hamstring them? When this story first broke I know we talked a bit about the impetus to move code out of the kernel into user land.

<comment><USER4> Switching (or indexing) predictor state on task and privilege level.

<comment><USER5> It's even more complex. It's not only the predictor state that would need switching/indexing, it's the result of any prediction.

A speculative load in cache is global today, and that leads to a possible side channel attack. One may think about marking a speculatively cached entry by its security context, the only context allowed to "see" it until the speculation is resolved. But that is not enough: the entry may have evicted another, and that's globally visible. Or one may not use the regular caches, but add another lookup structure (CAM) for in-fly speculative loads (and same for store), indexed by context.

Another source of complexity is: what is a security context? An OS could use existing structures like processes, and it makes sense, but it's not enough. For a sandboxed application a given process or thread could run untrusted sandboxed code (Javascript) and also trusted runtime. In this case, the application need to help and manage security contexts. It's possible, but not backward compatible.

I expect progress will be made, but considering the complexity/costs it may take some time...

<comment><USER6> > It's even more complex.

Oh, this one goes elbows, armpits, neck, ten thousand fathoms deep. Now just imagine that every memory access that the processor does actually consumes another type of resource, which is memory bandwidth. There are a limited number of cache-fill lines and those can be occupied or not; after tracking down all of the state of things at rest, you now have to think about the information leakage from the occupancy of the various networks of the CPU-- data in flight. Tougher to analyze, but also tougher to secure.

It's gonna be separate CPUs, memory busses, and disks if we really want to get rid of side-channels.

And that's actually simple. Simple is better for security!

<comment><USER3> Wouldn't this mean that kernel calls are interprocess communication?

<comment><USER6> In general, yes. But one could, e.g. have a second kernel, or some microkernel subsystems, running on the other system for the most common calls. In fact, that'd be even safer.

It'd be safest to have a whole machine per process :)

</comment></comment></comment></comment></comment></comment><comment><USER7> I hope there's a way for users to disable these patches. I for one would rather have a fast processor that does speculative execution than one that takes a significant N% performance hit but is armored against speculative attacks.

Security compliance is becoming more and more like a ball and chain shackled to our legs. I expect security to slowly eat up a bigger and bigger share of processing power which translates to more sluggish chips, more sluggish software, etc.

<comment><USER8> Hi, could you please explain this further? I always assumed that if a program or chip is vulnerable then it is not operating as intended and must be patched quickly. You're suggesting that if a security vulnerability is patched and it removes a feature (in this case, processor performance) we should forgo it. Am I understanding correctly?

<comment><USER9> I think the point is that "security" isn't absolute, its always relative to some threat model. But if untrusted code isn't a part of your threat model then you might prefer the performance benefits.</comment></comment></comment>


Slow Deployment Causes Meetings - <AUTHOR> https://www.facebook.com/notes/kent-beck/slow-deployment-causes-meetings/1055427371156793 <comment><USER2> I see what he's getting at, but I don't think it's right.

Meetings are caused by policies and the need for coordination. Even companies with continuous deployment still have meetings.

You can eliminate policies, which will reduce meetings, but you'll still need coordination. You can move coordination to your issue tracker or agile board, but then you've just replaced meeting time with the time you spend interacting with the tickets and the agile board.

There really is just no way around it. The bigger you get, the more coordination you need.

Running small teams responsible for small services is one way to reduce that need somewhat, which is part of why microservices are getting more popular, but at the end of the day I'd say coordination time, in whatever form it takes, is linearly (or maybe even exponentially) correlated with org size.

<comment><USER3> But then you just end up with a bunch of microservices you have to coordinate changes between. Microservices are more of an implicit recognition that the job your software does is complex enough that you need the overhead of managing them.

I do think there's an element of truth to what he's saying: organizations develop processes that can handle a certain amount of throughput, and trying to increase throughput means making changes to those processes, which means meetings about reducing the number of meetings. The amount of overhead is largely driven by executive visibility requirements (and past times that executive has been "burned" by a bad deployment) so it can't really be changed.

I actually kind of agree with the mantra: "If you want to deploy more, deploy more often." We become accustomed to testing changes of a certain size, and if we try to cram more into a release, then release testing and certification takes longer. Big releases are the enemy of most Agile processes.

<comment><USER2> > But then you just end up with a bunch of microservices you have to > coordinate changes between.

Not if you do it right. As long as the API doesn't change and you adhere to every service having its own data store (which is key and many people forget), you can make as many changes to your service as you want without any coordination.

<comment><USER4> >you can make as many changes to your service as you want without any coordination.

I'm really not sure that's true. If I change my classifier endpoint, even with the same API it's important people know that they might get different results for the same input. It might be really quite important for peoples analysis.

Their system might not fall over, but that doesn't mean I don't need to coordinate with them.

Perhaps I'm missing something in what you're describing though.

<comment><USER2> I would say changing the resulting data in a meaningful way is still changing the API. The API contract is not only the verbs that they can use but the nouns that you send back.

<comment><USER4> Well, if all you were saying is that given the exact same requests, the exact same responses come back then you don't have to co-ordinate changes, then I'd agree. I'm not sure that's a particularly controversial point.

Although that does involve _knowing_ your responses are identical.

If my results are different _at all_ I would need to notify people downstream.

<comment><USER2> > If my results are different at all I would need to notify people downstream.

Presumably your API says what _types_ of data the caller should expect. As long as you don't change that, they should be able to deal with the response changing.

But really it's more about the fact that if you have a single monolith, if you want to make a change, you have to coordinate with _everyone_ at the company, whereas if you have microservices, you only have to coordinate with those who are _affected_ by the change.

<comment><USER4> > Presumably your API says what types of data the caller should expect. As > long as you don't change that, they should be able to deal with the response > changing.

The point I wanted to get across was that although a client won't _break_ , I'd still want to talk to those pulling data from the system. I was disagreeing with the statement "you can make as many changes to your service as you want without any coordination."

> But really it's more about the fact that if you have a single monolith, if > you want to make a change, you have to coordinate with everyone at the > company, whereas if you have microservices, you only have to coordinate with > those who are affected by the change.

Yes, it does lower the hurdles to getting something out.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Many developers and companies look at Facebook as a model for good software practices and principles, so it's interesting to see them struggle with the same issues:

 _" Increasing overhead initiates a positive feedback loop: less getting done -> more pressure -> more mistakes -> even fewer changes per deployment -> more overhead -> less getting done."_

<comment><USER6> I think the jury is still way out on whether Facebook's model is something to emulate or avoid. In the end, it's going to depend on the company, the product, the customers' expectations, and the engineering talent/engagement. "Move fast and break things" just isn't going to work everywhere.

I've seen places where waterfall was totally appropriate and worked well. There's a lot of variety out there.

</comment></comment><comment><USER7> Facebook deploy changes to production three times a day? Did I read that right?

<comment><USER8> It seems almost every time i use the website something is new/different/broken, so i'd believe that they're deploying that rapidly.

The mobile app seems a bit slower, with broken features staying broken for a while. (matching the stated 2 week cycle).</comment></comment>


We (ironically) recommend: - <AUTHOR> http://www.mkrecny.com/entry/16/

<comment><USER2> How about training a neural network for each user? You could provide lots of inputs that wouldn't be useful for all users (time of day, pervious likes, week of month, moon cycle, volume on twitter, DJIA movement) but may be very useful for a given user...

So many web apps (due to their nature, I'm sure) are based on a one-size-fits- all approach recommendation engine (i.e. Netflix, Pandora). How about an "everybody is different" approach that takes advantage of cloud processing/storage and scale? Sounds like a fun experiment, at least.

<comment><USER3> with an input like "pervious likes," you could really know what someone likes

;)</comment></comment>


Paul Graham and Walt Disney - <AUTHOR> http://community.livejournal.com/penguicon/40139.html Here's more of an opinion piece than a convention report. Needless to say, everything here is my own opinion alone and I'm not speaking for anybody else running Penguicon. I like to think that Penguicon is an incubator of Imagineers. This is a combination of artistic and literary imagination with engineering know-how, a word coined by one of my lifelong inspirations, Walt Disney: <comment><USER2> Well, Paul's coming at it from an artist's perspective. Don't get in business to do art - beautiful algorithms, a movie that has a message for modern America, a meditation on the color blue. Forget about doing that to make money. L'art pour l'art. That's what I get out of it, anyway.

Walt Disney, whom I never thought much about until I read a biography a few years back and I now consider a unique American genius, certainly wouldn't disagree with that. But his alternative wasn't "get money," it was to give people a certain kind of experience. But, in a sense, that's a great business plan too. So it works out.

</comment><comment><USER3> Walt is probably the most successful businessman ever to follow the mantra "Make Something People Want".

He wasn't a big fan of budgets, business models, and the like. He built things he wanted, and believed other people wanted too. He was a workaholic and a visionary, and never settled for just good enough. It shows in his work and it shows in the work that happened at Disney after his death.

</comment><comment><USER4> This inspired me to write a bit about creativity vs usefulness, which I subbed to hacker news as this link: <http://news.ycombinator.com/item?id=46850></comment>


Ask HN: How much domain expertise do you need to start a startup? - <AUTHOR>

A good startup idea solves a problem that people have. But a lot of the times you need some sort of domain expertise to solve this problem.
For example, from what I understand there isn't an easy way to "comparison shop" for mutual funds. To see the useful measures of past performance. However, I have no clue how to go about getting this data, and don't really know what are the best measures and what's important etc.
A lot of startups seem to require a good amount of domain expertise. Do all of these founders start off with this domain expertise, or do they learn it along the way? If so, how?
I don't see domain expertise talked about much, but I think that it's important. <comment><USER2> You basically learn along the way. Consider 'domaining' just one piece of a generally large pie. Startups have many pieces to tackle to be successful. You can learn about it or just learn generalities of it, but it's always best to focus on the bigger picture (all of the pieces of your startup). At the end of the day, you have to know how to be a good manager. Because the best solution is to 'hire your weakness'.

These are good strategies to follow: 10 Strategies Quick Learners Use To Pick Up Anything

[http://www.businessinsider.com/strategies-quick-learners- use...](http://www.businessinsider.com/strategies-quick-learners-use-to-pick- up-anything-2014-4)

</comment><comment><USER3> If you don't have domain expertise, how would you know whether the product you want to create solves anyone's problem? How would you know who your competitors will be? How would you know the potential size of the market?

As for comparison shopping for mutual funds, my brokerage (TD Ameritrade) has a mutual fund screening tool that lets you compare mutual funds based on a huge number of different criteria, such as fund composition, return, risk, fees, etc. While there may not be a public web site that provides this information, every brokerage provides similar information to their customers for free, so it's easy for investors to get.

<comment><USER4> "If you don't have domain expertise, how would you know whether the product you want to create solves anyone's problem? How would you know who your competitors will be?"

Most successful founders/ startups solve problems that they themselves have as opposed to having tons of domain experience. The key is to identify your early adopters and understand their needs and provide a unique solution so they'll stick.

<comment><USER3> Even if you're solving a problem that you have yourself, you need to learn enough about the domain to know whether the problem you have is:

(1) shared by enough other people so that the solution could be sold enough times to be profitable (which also requires knowing whether these people would actually be willing to spend money on your solution). Identifying a small group of early adopters is no guarantee that your product will gain traction beyond that initial group.

(2) not just due to ignorance of an already existing solution (e.g., the original poster may not have known that every online brokerage already provides tools to compare mutual funds, and that his problem has already been solved).

The more you know about your domain, the less of a chance you have of spending a huge amount of effort to develop a product that nobody wants to use. You could argue that even if there's no market for your solution, you've still built something to solve your own problem. But the amount of effort needed to build a tool that solves your specific problem is much less than the effort needed to build and support a tool that others can use easily (how useful to you is the average undocumented project on Github?).

<comment><USER4> "Even if you're solving a problem that you have yourself, you need to learn enough about the domain to know whether the problem you have is"

Yes! you need to know enough to be able to solve it but not necessarily a PhD. Additionally the question was how much domain knowledge you need.Id still say enough to start , the rest can be learnt on the fly.

identifying the early adopters doesn't guarantee that you will have enough traction however it will tell you more about the different problems/needs that could be fulfilled and could help you in identifying revenue sources , possible partnerships etc. Also most of these successful people talk about building something a few people love and focussing on that as opposed to creating a product that everyone will use sparsely

</comment></comment></comment></comment><comment><USER5> I am sure you could find many stories of successful startups where the founders had no domain experience. The reality is they are the exception not the rule. If you don't understand an industries problems you can't solve them.

To address your example there are literally dozens of mutual fund comparison tools. Mutual fund companies are required to publish their fund data in a standard format specifically to make comparison between funds possible.

</comment><comment><USER6> I've heard of many successful startups where the founders had very little domain knowledge when they started out. I think it's not a problem to learn on the way unless you're tackling a "research level" problem in which case it's difficult to do anything useful without deep domain expertise. I think you'll be fine but it would probably help to read "Mutual Funds For Dummies".

</comment><comment><USER7> This is going to sound like a non-answer but honestly it really depends. It can depend on a number of factors but mostly the idea and industry the idea is in. For many ideas, you can probably learn a solid amount along the way, particularly consumer facing ideas. For others, it will generally help significantly if you have domain knowledge coming in.</comment>


Ask HN: Do you have spare domain names? - <AUTHOR>

A recent post [1] reminded me that I have a couple of domains that I don't use and which would be perfect for somebody else.
If you'd like to have either of the following two domains, and are willing to initiate a transfer process I'm happy to lose them for free:
* redirected.email
* transient.email
If there are other people with spare domains feel free to list them here.
[1] - https://news.ycombinator.com/item?id=8414597 <comment><USER2> rankedchoices.com Started making a ranked choice voting application(instant runoff voting) but then got excited about another project and switched to focusing on that. Might get back to it sometime, otherwise thought about putting up basic page explaining the benefits of ranked choice voting, etc...

</comment><comment><USER3> dblyzer.com

I thought of some ideas on creating front end reporting/query editor for databases but never got time. Feel free to ask me for this one.

<comment><USER4> How would I acquire this from you?

<comment><USER3> sorry jut saw this msg. check out my profile for contact details.

</comment></comment></comment><comment><USER5> supernetizen.com ,

perfpirates.com

</comment><comment><USER6> ioshub.net

</comment><comment><USER7> dogemmo.com</comment>


How Does Israel Regulate Encryption? - <AUTHOR> https://www.lawfareblog.com/how-does-israel-regulate-encryption <comment><USER2> > The term "encryption" includes all forms of scrambling or unscrambling of > any form of data or of its modes of transfer, regardless of whether an > encryption key is used… In practical operation, companies submit license > applications for engagement in encryption to the MOD's specialized > Encryption Control Department.

I wonder if non-encrypting data compression is exempt from these laws, as it is arguably a form of scrambling data without an encryption key.</comment>


SQL: Select only rows with Max Value on a Column - <AUTHOR> http://stackoverflow.com/a/7745635/570191

<comment><USER2> Or those who happen to be using a dialect of sql with window functions, selecting the rows where:

ROW_NUMBER() OVER(PARTITION BY Id ORDER BY Rev DESC) AS "Row Number"

Returns 1 is clearer to my mind, with some caveats around dialects which use separate forms of row-number that assign identical/differing numbers to two consecutive identical rows.

</comment><comment><USER3> I prefer SELECT table.* FROM table WHERE rev = (SELECT MAX(rev) FROM table WHERE id=table.id)

I hate joins. Subselects are so much clearer imo - and you don't end up with extra fields.</comment>


Html5 webrtc platform - <AUTHOR> http://www.projectpeach.co.uk <comment><AUTHOR> we're quite proud of what we have made but would like some honest feedback as we try to roll out our html5 platform to capitalise in the business world mainly ecommerce at present. We believe it is one of a kind and as a result its difficult to sell but the tech is strong. Anyone in ecommerce that would like a free trial talk to us on the link</comment>