UNIX tips: Learn 10 good UNIX usage habits - <AUTHOR> http://www.ibm.com/developerworks/aix/library/au-badunixhabits.html <comment><USER2> Also handy for your .zshrc or .bashrc:

      mkcd () {
          mkdir -p $1
          cd $1
      }

Also, moving a tarball before unpacking it is indeed brain-damaged, but,

      cd /target/directory
      tar xzvf /source/dir/sourcefile.tar.gz

works for me. I don't know why you would need -C, though it saves five keystrokes ("cd -") if you didn't want to end up in the target directory for some reason.

Listing 6 looks like a bad idea; it either goes to or makes a directory, depending on whether it existed. I realize he's just illustrating the use of "||", but don't copy the command. Usually you would want pwd to be an invariant. It looks like he really wanted to write:

      [ -d tmp/a/b/c ] || mkdir -p tmp/a/b/c

GNU mkdir -p will not complain if the target directory already existed, so you could just run

      mkdir -p tmp/a/b/c

but then that doesn't illustrate the use of "||".

Overuse of 'cat' is a hard habit to break for some reason, especially since it's so harmless. I found it useful as an intermediate step that Z shell is more flexible than other shells about where to put redirection, so:

      < foo.txt | wc -l

works in zsh instead of cat foo.txt (to get line count without a filename, which is useful in shell scripts and long one-liners), and seeing that, I would see more obviously that the pipeline is unnecessary.

<comment><USER3> Your mkcd script breaks for directories with spaces in their names; you've got to put $1 in quotes. Also, never heard of a tar bomb? =)

<comment><USER2> It works in Z shell, and breaks in Bash -- thanks, I didn't realize that.

I don't see how -C protects against a tar bomb. Generally when I untar a tarball from a new source whose packaging habits I'm not familiar with, I tar tzvf it first.

<comment><USER3> -C protects if you create an empty directory and then use it as the argument to -C; saves you a command line cd and a cd back to where you were, though it doesn't save much if you use your mkcd command to make the directory. (I'm talking about GNU tar where any leading slash(es?) is stripped off of the path of any files in the tar (and .. is disabled))

</comment></comment></comment></comment><comment><USER4> "It is generally a good idea to enclose variable calls in double quotation marks". No, it's generally a good idea to learn what quotes do and use the appropriate kind when required. Else you're just adding noise to your code.

The backslashes aren't needed in listing 9 since the shell expects more input after `&&' or `||' and automatically switches to PS2.

Using xargs is more subtle than they suggest. If may kick off the given command multiple times. This would make a difference, e.g. `xargs wc' would give multiple totals.

</comment><comment><USER5> Maybe it would be better if people always used cat, always used wc, &c. Sure, performance is better the other way -- but multiplying the functionality of each command comes at a price, namely that only grognards can do things "the right way". If we instead emphasized the way of distinctly separate commands for distinctly separate things...

<comment><USER6> The way of Unix.

</comment></comment><comment><USER7> 11\. Don't ask for overtime ;-)

</comment><comment><USER8> I honestly knew most of this, but I did pick up a few tips that I didn't know; for example, I tend to use

grep <whatever> | wc -l

Not that it's really harmful or anything, but -c is certainly less keystrokes.

</comment><comment><USER9> Not that I ever plan to use it, but every time I see a list like this I wonder when we'll start seeing similar lists for Microsoft's PowerShell (aka monad).

<comment><USER3> Why would we ever need such a list; PowerShell is so tightly integrated with Clippy that you can always rely on him to give you the appropriate wizard for your task.

</comment></comment><comment><USER10> > Make directory trees in a single swipe.

Really? How often will I need to make a directory structure that is several levels deep, but only one directory at each level?

>Match certain fields in output, not just lines

For someone who was trying to save a few keystrokes, instead of trying waste time getting the right field for awk, just use grep. Its easy, you can't mess it up, and unless the formatting really matters its the best option.

<comment><USER4> > How often will I need to make a directory structure that is several levels > deep, but only one directory at each level?

When you want to put a file into a directory structure where theres several levels of directories to avoid one directory containing many files, e.g. com/ycombinator/news/foo.

> For someone who was trying to save a few keystrokes, instead of trying waste > time getting the right field for awk, just use grep. Its easy, you can't > mess it up, and unless the formatting really matters its the best option.

The FA shows grep fails because 'Dec' matches part of the filename instead of just on the date. awk's a worthy solution in that case and formatting of the output wasn't relevant to the point made.

<comment><USER10> By formatting I was referring to the fact that he had to match the 6th field. If grep would return 100k and only 10 in the desired field awk is obviously handy (the exception). In the general case where you are just trying to hunt things down who stops and counts which field their target string is in. I could have run grep and analyzed the results by the time you count to the right field. If you miscounted however... how do you know?

<comment><USER4> The example was using awk to pick "Dec" out in the month column whilst pointing out a grep for "Dec" would also match the filename "December _" which didn't have "Dec" in the month column. awk's clearly better than grep in this case.

It's not hard to count the column and you can always do a

        ... | awk '{print $6}' | sort | uniq -c

to see if you've got it right. In fact, a common way to develope the pipeline for a one-off task is to keep appending a pipe and another command to the previous pipeline command. That way, you can see a sample of what's being produced instead of imagining it.

You couldn't have analysed the results of grep, discarding the non-month matches of "Dec" in the time taken to count up to field 6 if the number of lines was at all significant. Don't be silly.

If I did miscount and no lines matched I may be suspicious and look more closely. If some lines matched but on a different column than intended I may notice. I can re-run the command after correction or try the {print $6} idea. How would you notice if your _manual* analysis failed to spot the extra result from grep here and there. Would you do your manual analysis twice? Ask someone else to do it too? Or just think "good enough" and use the data for the next stage?</comment></comment></comment></comment>


Ask HN: What are the best data warehouse and BI resources in print and online?   - <AUTHOR> I started formally practicing data analytics a little under a year ago. Since then, I've really ramped up my Ruby, C++ (w. boost), bash, and (especially) MySQL skills. I've always been a MS Excel geek, but I love the power, versatility, and reusability of MySQL charged Ruby scripts. Excel is now just the final step for most of my analytics and market intelligence reports. I use Excel to generate pretty graphs, and to calculate the occasional statistical distribution or linear optimization. I'm at the point where I will still need to do these types of things, but I would like to expand into other things that I think will help the stake holders at my company. Real time dashboards with our key business metrics, recurring automated reports, and (possibly) automatic neural networks. This is the type of stuff that a good Business Intelligence (BI) solution would provide painlessly.<p>After a bit of research around the internet, I discovered that I need a rock solid data warehouse if I'm going to effectively implement any of the BI products out there. My question is this: What are the best books and online hidden gems about building data warehouses? I need to fully understand not just why a certain method will work better for my circumstances, but also how to implement that method. Code examples are a must. I'm willing to spend a fair bit of time and money on learning this and I know no other place to turn for trustworthy advice. Thanks a ton, you guys and gals are the best! <comment><USER2> Have your read Kimball's Data Warehouse Toolkit? I'm partial to the first edition (1996). It's mostly conceptual stuff: design rationale, OLTP vs OLAP, fact vs dimension, type II SCDs (very important), surrogate keys, aggregate navigation etc.

Most code in a data warehouse is ETL code, and much of that is obscured behind the interface of big-name tools like Informatica. I don't think you are interested in that. People who roll their own have typically rolled with Perl. Try a search on Perl + ETL and you might find something.

Other items of interest:

* Pentaho, an open-source BI suite. Includes ETL, reporting and multidimensional cubes.

* Column-oriented data stores like Vertica, Sybase IQ, MonetDB, and Infobright. MonetDB and Infobright are both open source. Infobright integrates with MySQL, so that might be up your alley.

* SSDs may or may not turn data warehousing on its head. Yet to be determined.

* schema-driven ETL is very powerful: define an input view/function, a target table, a few naming conventions, and generate your ETL code directly off the system tables--ETL with opinions, as it were.

EDIT:

For online resources, I used read intelligententerprise.com. Can't vouch for its current quality. Back then it was hit or miss, and promotional items frequently overshadowed substantive material.

<comment><AUTHOR> Thanks a ton. I'll make sure I pick up Kimball's Data Warehouse Toolkit and check out intelligententerprise.com. The four that pop out most from your post are Pentaho, MonetDB, Infobright, and schema-driven ETL, so I'll start my search there. Thanks once again for the help!

<comment><USER2> How has it gone? Have you found any helpful sources?

I have since learned that LucidDB may be more appropriate for DW-style workloads than MonetDB. There was a LucidDB thread on HN recently that had more details.</comment></comment></comment>


Donate to the Lavabit Legal Defense Fund - <AUTHOR> https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=7BCR4A5W9PNN4

<comment><USER2> It is important to remind people that they _always_ have a choice, and that there will be support for those that make the right choice. So donate.

<comment><USER3> Donating to a Lavabit Legal Defence Fund through PayPal seems a bit of an oxymoron though, no?

</comment></comment><comment><USER4> No BitCoin? Well, here is the PRISM query to find out who contributed: SELECT FROM PayPalTransations WHERE hosted_button_id='7BCR4A5W9PNN4' AND referral_url like '%news.ycombinator.com%';

<comment><USER2> To quote myself from below because I find this issue so important to highlight:

So what if they can see that you donated to this pro-constitutional defense fund?

If you want to make a surveillance state less effective, you should generate _more_ noise, not less. When fascism is at risk of taking over, you don't just roll over and take it quietly because you fear they'll know you're against it.

As a person who has Nothing to Hide, I encrypt everything, and will gladly donate here. If we get everybody to use encryption, nobody will be suspect for using it. If you donate here, there's less risk that others will get hassled for donating.

</comment></comment><comment><USER5> Just donated $100. Never heard of them before today, but am very happy to support the fight they are undertaking on all our behalf.

</comment><comment><USER6> For those not trusting random PayPal links, you can click the donation link at the bottom of this page: [http://lavabit.com/](http://lavabit.com/)

<comment><USER7> Thanks. I was really surprised when I saw this on the front page as I wasn't aware of the fund and didn't see how to verify the recipient.

</comment></comment><comment><USER8> Google et al. should be donating to them. This would be a nice, indirect, low risk way to establish legal precedence, wouldn't it?

</comment><comment><USER9> $50 inbound. USA Agitator watch list here I come!

</comment><comment><USER10> 1\. The link doesn't work.

2\. As a non-Lavabit user, who are they and why should I give them money?

<comment><USER11> They are(were) a fully-encrypted email provider that had no ability to monitor your emails. Edward Snowden hosted his account there, and they had to shut down because of (probably) US government intervention.

<comment><USER12> it starts to sound like providing fully encrypted solution (where provider just isn't able to cooperate because of no access to plain text) makes the provider de-facto accessory to whatever crime may be committed by perpetrators who used the solution while committing the crime. Basically fully encrypted solution (incl. without government backdoor) moves into the same category as assault gun, ie. something that regular good citizens supposedly just don't have legitimate uses for.

<comment><USER13> I'm not sure I catch your drift. I don't see how being an accessory enters the equation at all (how can you be held responsible for providing information you simply do not have?), and there are no current laws concerning "assault guns".

<comment><USER14> I get the reasoning. If you provide the ability to communicate securely without a government backdoor, the government will treat you like you assist terrorists.

"Either you are with us, or you are with the terrorists." \- George W. Bush, Sept 20 2001

<comment><USER13> That ship has sailed though, unless they really feel like harassing Phil Zimmermann again...

</comment></comment></comment></comment></comment></comment><comment><USER15> Just asking, but how legit is this? Does anyone know who set this up and who is managing these donations? It is just a paypal page with nothing that obviously links it to lavabit.

</comment><comment><USER16> Bitcoin, please.

<comment><USER17> Seriously. First they colocate in Texas. Then use Paypal for donations. It's like they are trying to martyr themselves.

</comment></comment><comment><USER18> I Don't trust Paypal. I sent him something to email@example.com I'll update if it is rejected or something.

</comment><comment><USER19> What legal action are we actually supporting? Defending the rights of a mail provider to not be directly spied upon by the three letter agencies? Transparency in regards to NSA letters? I know they are limited in their speech regarding their legal issues, but is there any explanation on how the funds will be employed?

</comment><comment><USER20> Keep in mind all your actions are being observed and collated somewhere. If you don't want hassle with your next police run in, or worse, don't live in the US and don't want "special attention" next time at the border, think twice about donating...

<comment><USER21> I don't think anyone here ever takes any pleasure in using PayPal. Especially with the seizures - maybe that's the biggest concern with using their service.

But that doesn't create an alternative. People have wanted one way farther back than the NSA info dump.

<comment><USER22> Could mail him some gold.

</comment></comment></comment><comment><USER23> I wish I could give this a dozen upvotes!

</comment><comment><USER24> Poor choice for funding a good cause.

</comment><comment><USER25> The link from the lavabit homepage is [https://www.paypal.com/cgi- bin/webscr?cmd=_s-xclick&hosted_b...](https://www.paypal.com/cgi- bin/webscr?cmd=_s-xclick&hosted_button_id=7BCR4A5W9PNN4) which actually works.

</comment><comment><USER26> Why didn't you just link to their site which already has the link and explains why we should be donating to them?

[http://lavabit.com/](http://lavabit.com/)

<comment><USER27> It would probably have been caught by the duplicate checker.

</comment></comment><comment><USER17> What did Lavabit think would happen by physically locating servers in the US? It's almost irresponsible to sell customers on the illusion of privacy and to not mention the risk of the servers being confiscated.

edit: This whole Lavabit thing is so dumb that I'm inclined to think it was a honeytrap designed to waste supercomputing cycles on decrypting random data.</comment>


Lavabit's Dark Mail Initiative - <AUTHOR> http://www.kickstarter.com/projects/ladar/lavabits-dark-mail-initiative <comment><USER2> Video summary:

\- Lavabit + Silent Circle are starting a non-profit called the Dark Mail Alliance.

\- Planning to release an open source protocol for end-to-end encrypted email, along with some open source implementations. Expecting feedback from the community to drive the direction.

\- Sketch of the protocol: Mail body/details is saved encrypted on some server somewhere. Encrypted XMPP message containing URI describing where to retrieve the message is sent to the recipients. Recipient clients figure out how to fetch it and decrypt it.

\- The protocol is based heavily on Silent Circle's protocol. Functional proof of concept already exists.

\- There will be several modes of security, default being the most secure, but allowing the user to explicitly scale down on a case-by-case basis (e.g. to abide by regulations and corporate policies).

\- Sounds like it's backwards-compatible with SMTP, perhaps through gateways. It'll be explicitly marked as insecure.

\- Ladar's goal is to transition Lavabit from a services company into a software company, using the free/open source business model and offer support services around it.

\- The protocol will be using "new elliptic curve cryptography we [Silent Circle] developed." They're expecting the encryption methods will change over time.

<comment><USER3> Thank you for the summary!

>"new elliptic curve cryptography we [Silent Circle] developed."

???

is... this a good idea? I would of thought libraries for this technique abound.

<comment><USER4> Strange that they say "we", because in the previous interview, they said Dan Bernstein helped them to create some new 205-bit curve or something. Previously they were using the NIST curves in the SCIMP protocol. They should probably just use Curve25519, unless they think that's too overkill.

<comment><USER5> I don't know too much about cryptography, but for an asynchronous communication method like email, is there such a thing as encryption overkill? For example, does it matter whether the message takes two seconds or five seconds to decrypt/encrypt (particularly if that encryption/decryption happens in the background of your mail app)? Are there other issues as you increase the number of bits on the curve?

</comment></comment></comment></comment><comment><USER6> I think it's important that we separate our support for Ladar's legal problems from our support from his technical decisions.

I think we should support Ladar as a person for bravely deciding not to comply with the government's request, but that we should be extremely critical of the technical decisions that lead to his ability to have complied.

LavaBit was a service offering "secure" email using a mechanism known to be insecure, which unnecessarily put a lot of users at risk. It seems injudicious to fund its redeployment, and even a little bit strange to fund the same person to develop something new.

<comment><USER7> I dont understand. Lavabit's full process, including the last resort off switch, worked. Snowden was well served to rely on it, his emails were not read by the government.

<comment><USER6> Lavabit was vulnerable to three attackers:

1) The server operator could choose to obtain access to plaintext. 2) An attacker who compromised the server could get access to plaintext. 3) Anyone capable of intercepting the SSL communication could get access to plaintext.

Incidentally, those are the exact same points of vulnerability for a normal (unencrypted) mail service.

One interesting question is why the US government requested Lavabit's SSL key rather than just getting a CA to sign their own. My assumption is because they were interested in _past_ communication that might have already been deleted (perhaps by Snowden). We now know that the US government often logs and stores ciphertext, and we know that Lavabit was not selecting PFS SSL cipher suites.

So when Ladar did eventually provide the SSL key to the government, it's likely that the government was able to use that to decrypt all previously stored traffic and obtain the entire history of transmitted email.

So it's quite likely that Snowden (and all other Lavabit users) did have their email read by the government.

<comment><USER8> Are you sure, that Lavabit did not select PFS? Is this documented somewhere? That's quite a fumble for someboday advertising secure email services.

BTW: shouldn't we assume, that the US government operates at least an own intermediate CA for such purposes rather than getting single Certs signed.

<comment><USER9> Ladar says so in this interview, starting around 32:30:

[http://www.youtube.com/watch?v=7LzKjxj0u_s#t=32m30s](http://www.youtube.com/watch?v=7LzKjxj0u_s#t=32m30s)

</comment></comment></comment></comment></comment><comment><USER10> I'm disappointed with this Kickstarter campaign. One 23 minute video and almost no text explaining the project. The video isn't even made for Kickstarter, it's just the announcement video from Inbox Love. How do they expect to get almost $200,000 in donations with a campaign that looks like it was put together in 10 minutes?

I want Darkmail to succeed (and I don't mind the name like many here), but I have serious questions about the protocol and the community, no one which have been answered.

<comment><USER11> I couldn't believe that the Kickstarter video was the unedited conference recording. I don't think campaigns need to be exceedingly polished but I do expect a bit more effort than this.

</comment></comment><comment><USER12> This Kickstarter campaign reads like a What Not to Do If You Want Your Kickstarter Campaign to Get Funded.

23 minute video that isn't specifically created for the Kickstarter campaign? Check.

Very little explanatory text? Check.

Reward levels at different price points with identical rewards? Check.

Basic spelling errors (their != they're)? Check.

Campaign started by someone with a dog as their profile pic? Check.

I hope this project succeeds. I don't think this Kickstarter campaign will, though.

<comment><USER13> >Reward levels at different price points with identical rewards? Check.

Come on, that's not fair. This is a kickstarter that gives the normal contributor _no_ rewards. That is an entirely different discussion, and not inherently bad.

<comment><USER12> I'm not talking about what's fair/not fair or what's bad/not bad. I'm talking about attributes of successful (or not) Kickstarter campaigns. Do you know of a successful campaign with reward levels at different price points that have identical rewards/text? Do you think that increases the chances of success for this campaign?

<comment><USER13> I'm saying that your classification of multiple tiers as having the 'same' reward is misleading, because those tiers have _no_ reward.

I can't answer your question because I've only paid attention to a handful of kickstarters, and they were product-selling rather than goal-fundraising.

<comment><USER12> When I used the word _reward_ I used it in the context of Kickstarter. That's the terminology they use: [http://www.kickstarter.com/help/faq/backer%20questions](http://www.kickstarter.com/help/faq/backer%20questions)

Whether a project creator chooses to provide an actual reward in the sense that most people use the word is up to him or her. I'd wager that electing not to do so is strongly correlated with a project not reaching its funding goal.

<comment><USER13> I'm not complaining about terminology. Okay let me put this another way. Let's pretend they had a $20 tier where you get nothing, plus the $5000 and $10000 early access tiers. If someone donates $20, they get nothing. If someone donates $437, they get nothing. Does it actually hurt the project to create a $400 nothing-tier in addition to the $20 nothing-tier? I am skeptical of this. But that's what you called out as a negative in your original post, having multiple tiers that are the same.

<comment><USER12> I'm suggesting that if the $25 tier has nothing as a reward, the $100 tier should not also have nothing as a reward.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> It's been said before but the name seriously needs to change if the initiative wants to get any sort of support from the general public. It's only slightly better than say "pedomail".

<comment><USER15> Similar to authoritarian conservative political groups using names like "Freedom" and "Liberty"?

They can sugar-coat it however they want but I'm ok with "dark". That is the fact of life in a surveillance-state. In such an environment, one who wishes to communicate in private must do it in the dark.

<comment><USER16> As accurate as it may be, it's terrible from a PR standpoint. The grandmother next door will be less likely to adopt its use if she associates it with darkness/nefariousness. _You_ may be OK with it and understand its true meaning, but this isn't about just you.

<comment><USER15> They are creating a new protocol to be adopted and marketed by other email providers (including Lavabit).

Those companies can take care of Grandma.

<comment><USER14> But why create the friction in the first place? News are mostly about soundbites, do you think that if grandma hears on the news that a defendant is part of the 'dark mail' initiative that she will be sympathetic towards him?

<comment><USER17> Viewed slightly differently, given that news is mostly soundbites, which is going to be more memorable?

</comment></comment></comment></comment></comment></comment><comment><USER18> They point out that existing email leaks a lot of metadata, but I do not see any proposal to fix that in the new protocol. How would you hide/encrypt/otherwise protect the list of recipients? Someone somewhere has to know where to deliver the message, especially if you will continue to use human readable/memorable email addresses as we currently know them today.

You could have the server know the addresses to forward the message and then forget them. However, then the server knows this information at some point and it could be sniffed/recorded along the way.

Does anyone know any more details about the specifics of the protocol? How would you minimize metadata leakage if you were implementing such a protocol? I am not sure it is possible to guarantee the recipient list won't be leaked.

<comment><USER10> I've read over the SCIMP protocol. From their white paper, a sample message looks like this:

       <message type="chat"firstname.lastname@example.com' firstname.lastname@example.com'
       id="0FF6CF98-32FE-4EED-9DEF-D66A0E50EA8F"><body/><x xmlns="http://
       silentcircle.com">?
       SCIMP:ewogICAgImRhdGEiOiB7CiAgICAgICAgInNlcSI6IDE1MDcyLAogICAgICAgICJtYWMiOiAiZlp
       YYURlQ1ljVTA9IiwKICAgICAgICAibXNnIjogIkloT051Sm9kK0Fjb09KQ1prZ0xHQXliSmJjbC9WNzhl
       cmMrSFY4K1FHcUJ2cEdlb2RaSWZwNTRKVWluU2g0N0lZTjFORkJOaXBjTVdubWlsMXVtbi9pcG5rVk8rd
       VJZdUJuQjdpZXZEK1pZQzBYV0hHQWQ3WWJtOWRsYkpSd0oyIgogICAgfQp9Cg==.</x></message>

which worries me. Yes, the connection between the server and client will be encrypted, but my message still has metadata that isn't encrypted. I'd just like an answer from Silent Circle / Lavabit.

<comment><USER19> why dont they address the server and encrypt the user address at the server level, so a network eavesdropper would only see traffic too and from servers but not the particular addresses being addressed. The user puts in an address e.g. email@example.com the sender and receiver address (maName & yaName) are then stripped on sending the D-mail and encrypted with the D-mail servers private key the receiving server (maDomain) then goes through the public private key exchange with the sender (yaDomain) thus securely passing the user address between the two servers without the eavesdropper knowing from what user the D-mail originated and to what user the D-mail was addressed to. This system would become more secure the the greater the number of users on each domain.

To add extra security batch sending by the server would make it even more secure

e.g. every 3min || when unsent messages to domain x > 999 --> send D-mails.

this would add latency and create bandwidth spikes but would negate time based inference attacks.

edit: relevant xkcd; [http://xkcd.com/927/](http://xkcd.com/927/)

</comment></comment></comment><comment><USER20> : Whiney warning : I wish they'd put a bit more work into this kickstarter, rather than just dropping a terd on my doorstep. I'm really interested in this protocol, but I can't help but feel like there's a lot of entitlement evident in the lackadaisical approach. : end whine :

</comment><comment><USER21> Neat, but they really need to repeat what's said in the video in the text. Currently it's not amenable to obtaining a quick understanding.

</comment><comment><USER22> Wow, $196,000? That's a lot of cash for cleaning up source code and releasing it, isn't it? My understanding is that the code is merely being modified to work in other environments, right? Finding great talent costs money and time, but surely finding great developers who support Ladar and his quest to release an open source email service wouldn't be that hard? I don't know C that well, but I'd volunteer my time to make the project a success.

Something about that almost 200k figure they're asking for doesn't feel right. Am I missing something here?

<comment><USER23> > Am I missing something here?

Yes, watch the video. Or read the comments here with a summary.

Even the summary of the kickstarter says more than 'OSS the code.'

</comment></comment><comment><USER24> I can't find any information on the "newly developed dark mail protocol." Is this public anywhere? I need more information before I know if I want to donate to support it.

<comment><USER25> Seriously? It's the first result for "dark mail".

[http://www.darkmail.info/](http://www.darkmail.info/)

<comment><USER26> I don't see any information on that page.

</comment></comment></comment><comment><USER27> "Yet another communication system that offers better encryption" is not going to solve fundamental problem. Even if it is named "dark".

The communication system that conceals the very act of communication will.

The best way to conceal anything is to make others think that it never existed.

Pissing off enemies with stronger encryption will just get more people hurt and hunted for.

</comment><comment><USER28> I like this project:

[https://bitmessage.org/](https://bitmessage.org/)

<comment><USER29> Bitmessage is not very viable for mobile devices unless you offload hash cash to a server.

<comment><USER28> Then there's this, built on top of the protocol:

[https://bitmessage.ch/](https://bitmessage.ch/)

The source code is here:

[https://github.com/AyrA/BitMailServer](https://github.com/AyrA/BitMailServer)

It's written in C#, which I don't personally like. And there's no mention of which particular 'open source' license it is. But the source code should be informative for a port/rewrite, and maybe running it via Mono is viable.

edit:

If the DarkMail people happen to be reading this thread, please consider putting your full support behind BitMessage.

</comment></comment></comment><comment><USER30> Donated. Good luck to Ladar.

</comment><comment><USER31> Previous discussion: [https://news.ycombinator.com/item?id=6642106](https://news.ycombinator.com/item?id=6642106)

</comment><comment><USER32> "sell the sizzle not the steak"

</comment><comment><USER33> What is keeping this service from getting shut down as well?

<comment><USER34> It is a protocol, not a service.

<comment><USER35> Ha, that's a pretty bullet-proof way to not get shutdown.

To expand a little bit for the less technical readers. This is about developing a new protocol for email, and an open source software package that supports that protocol for people to use it with.

So in the end there will be a software package that you could install on a server yourself and use for emailing others using the protocol. Most likely some businesses will use the software and charge users for the service, just like what Lavabit was doing before it shutdown.

So you could shutdown one provider, but you'll likely just make several new ones popup. This is similar to the war against bittorrent. You can shut down the trackers and the sites where people find the torrents but new ones will just appear.

<comment><USER36> I think chances are, the readers of HN already know the difference between a protocol and a service.

And the benefit you listed is already one given to email — the reason that lavabit was shut down was because the guy behind it didn't want to provide a service he knew to be flawed, in that the US government could request details about users.

The question is, how does this protocol have it built into it in such a way that both allows anonymity and so that providers can pop up in their place, as you say?

</comment></comment></comment></comment><comment><USER37> pledged.

</comment><comment><USER38> I like the name didapper mail. A fun sounding duck inspired protocol.</comment>


☃ - <AUTHOR> http://unicodesnowmanforyou.com/

<comment><USER2> Not to pee in your Xmas punch, but this -

        @font-face {
            font-family: Arial Unicode MS;
            font-style:  normal;
            font-weight: normal;
            src: url(http://unicodesnowmanforyou.com/ARIALUN0.eot);
        }

most certainly violates Microsoft's font EULA.

</comment><comment><USER3> Unicode Consortium is such an odd organization. Why is a snowman in the symbol table when the universal On/Off symbol isn't? What about the USB symbol?

<comment><USER4> Snowman is in table because of weather (like ☂ and some other symbols). I would like to understand what cats and dogs are doing in unicode: 😾 😸 🐶 (I kind of like that Mac OS X is using images for these)

<comment><USER5> The Unicode Consortium added most of the commonly supported emoji (picture- characters: [http://wap2.jp/emoji/imode/?act=list](http://wap2.jp/emoji/imode/?act=list)) from Japanese cell phones to the list of glyphs Unicode supports. As a result, if something was socially important enough to make it into early generations of featurephones in Japan back in the day, it is now in Unicode.

Cats/dogs made the cut, along with a bunch of characters which are a bit more esoteric by Western standards, such as a pictograph representing hot springs or the silhouette of Mt. Fuji. Many American programmers of my acquaintance believe U+1F4A9 (pile of poo) got grandfathered in at the same time, but they are historically mistaken. Japanese phones didn't have the pile of poo until much later.

</comment></comment></comment><comment><USER6> [http://www.reddit.com/r/programming/comments/75vt6/unicode_s...](http://www.reddit.com/r/programming/comments/75vt6/unicode_snowman_for_you/)

</comment><comment><USER7> Can someone explain why this is interesting? I must be missing something.

<comment><USER8> Well one interesting thing to consider is that Unicode could be abused to glue together weird and obscure symbols into the shape of words in English so you'll have a link that looks sort of like YourBankName.com but is actually x --213idsauaaslkda.com or some such.

<comment><USER9> [https://www.schneier.com/blog/archives/2005/02/unicode_url_h...](https://www.schneier.com/blog/archives/2005/02/unicode_url_hac_1.html)

> _Here 's a demo: it's a Web page that appears to be www.paypal.com but is > not PayPal. Everything from the address bar to the hover-over status on the > link says www.paypal.com._

[http://stackoverflow.com/questions/2742852/unicode- character...](http://stackoverflow.com/questions/2742852/unicode-characters- in-urls)

</comment></comment></comment><comment><USER10> Interesting. Shows OK in Firefox on Linux. Shows as a rectangle in Chrome on my Samsung Android phone with Chrome, and completely blank in the built-in browser on the same phone. I wonder why they're handling fonts so differently when in theory the font should be downloading.

</comment><comment><USER11> I prefer [http://☃.net/](http://☃.net/)

</comment><comment><USER12> ...and even _that_ can be used as an operator in Scala.

<comment><USER13> ... and in Haskell too. The funny thing is, that i first read Snoyman instead of Snowman.

</comment></comment><comment><USER14> Yeah, if I were a snowman in Arabia I'd be pretty meh too.</comment>


Ask HN: Do You Want a Fastlane-centric CI Service? - <AUTHOR> CI services suck for mobile app workflows; would your team be interested in a CI service built from the ground-up for mobile workflows based on Fastlane? <comment><USER2> Yes.

I would assume that is why Twitter is integrating it into their Fabric platform. That's just a guess though.

</comment><comment><USER3> What is Fastlane?

<comment><AUTHOR> "fastlane lets you define and run your deployment pipelines for different environments. It helps you unify your app's release process and automate the whole process. fastlane connects all fastlane tools and third party tools, like CocoaPods and Gradle." directly from the horses mouth [https://fastlane.tools/](https://fastlane.tools/)

I'm obviously a fan.

It's a Ruby-based DSL that wraps a collection of small CLI tools to define the entire workflow. It can handle most aspects out-of-box like building, signing, taking a snapshot, pushing, etc. It appears to be extensible too, but I haven't tried that much yet.</comment></comment>


Catalan Separatists Defiant Before Independence Vote Deemed Illegal - <AUTHOR> https://www.wsj.com/articles/catalan-separatists-defiant-before-independence-vote-deemed-illegal-by-spanish-government-1506698055 <comment><AUTHOR> I'm interested to learn the reasoning of those who are against the independence of Catalonia. Apparently, there are many against the Catalonian separation movement. Why?

<comment><USER2> there's probably many different reasons, like for any political idea. For a start, unionists within catalonia tend to have a very different discourse than those that live in spain proper.</comment></comment>


Twitter CEO Admits Company Didn't Fully Grasp Abuse Problem - <AUTHOR> http://variety.com/2018/digital/news/twitter-ceo-abuse-1202714236/ <comment><USER2> I mean, what crap. There were people inside the company, including me, who could easily see what was going on since the early days of GamerGate. We were repeatedly asking executives at all hands meetings and other places why more progress wasn't being made on dealing with abuse. We were volunteering ourselves to help - the various "working groups" and abuse "task forces" that Jack spun up were comically under-resourced, but it's not because he couldn't see what was happening. We saw, and the executive team failed to hear and to act.

</comment><comment><USER3> Twitter seems to be the epicenter of echo chambers for every different combating ideology in the world. Probably best for the world for them to just shut down.

<comment> yoz-y And be replaced with what? I still think that Twitter is the best avenue to get in touch with companies and, otherwise unreachable people.</comment></comment>


Why VCs don't invest in early-stage consumer companies - <AUTHOR> http://billburnham.blogs.com/burnhamsbeat/2009/12/the-great-abdication-consumer-internet-venture-capital-and-angels.html

<comment><USER2> Dupe of <http://news.ycombinator.com/item?id=1000404>

URLs didn't match because of Google Analytics tracking cruft. Curious to know how bad the dupe-URL problem is on HN.

</comment><comment><USER3> Define "consumer internet startup". Is that any startup that isn't focused on B2B, or what? Isn't that most of them?

</comment><comment><USER4> this is why Y combinator is important, and the offspring it has spawned in the last 3 years.</comment>


The Next Web Is Just Around The Corner (The Conference, That Is) - <AUTHOR> http://www.techcrunch.com/2009/04/05/the-next-web-is-just-around-the-corner-the-conference-that-is/ <comment><USER2> There's a link in the TC article with a 20% discount to the full conference pass (€600 instead of €750). It doesn't apply to the single-day passes.

But even with the discount, I'm still on the fence. Maybe I might just go for the drinks.</comment>


Netflix Awards $1 Million Prize and Starts a New Contest - <AUTHOR> http://bits.blogs.nytimes.com/2009/09/21/netflix-awards-1-million-prize-and-starts-a-new-contest

<comment><USER2> Netflix has definitely got their ROI from free marketing alone. How many articles have you read about this from Wired, Washingtonpost, NYTimes, etc in the 2 years?

This could definitely be a good marketing strategy for a startup with low marketing costs. $100,000 programming prize might be one method for getting your name out in the press, and get you some free work.

</comment><comment><USER3> Crowdsourcing is customer development to the extreme. By placing R&D in control of the customers, only products which are useful are likely to emerge. More companies (especially those which high brand recognition) should be using this technique. It generates quality products for relatively low costs.

<comment><USER4> As long as they utilize the inherent synergies to be found in surfing the cloud.

</comment></comment><comment><USER5> I read this, curious when the new rating system would be in place, but the next contest info surprised me:

"The data set of more than 100 million entries will include information about renters' ages, gender, ZIP codes..."

Isn't that enough to identify many of the raters?

<comment><USER5> It's enough to identify 87% of the people, apparently: [http://www.freedom-to- tinker.com/blog/paul/netflixs-impendin...](http://www.freedom-to- tinker.com/blog/paul/netflixs-impending-still-avoidable-multi-million-dollar- privacy-blunder)

I hadn't realized that someone identified some of the raters in the previous contest with their imdb ratings: <http://www.cs.utexas.edu/~shmat/netflix- faq.html>

(I hope it's not bad form to reply to myself.)

edit: Also, why this matters, page 44 of a research paper (PDF): <http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006>

</comment></comment><comment><USER6> Another $1M prize fund? Why don't they spend a few thousand tidying up their awful website?

They claim "You can browse, search or see our recommendations for you. [..] Over 100,000 titles on DVD"

But when I try to browse their selection they show three pages of seven movies per section, with mystery-meat navigation (hover to get more details). That's 441 difficult to browse films.

<comment><USER7> Hopefully <http://feedfliks.com/search> is a little better?

<comment><USER6> Worse - error 500. ;)

<comment><USER7> Hmm - it works fine now. Sorry about that hiccup.</comment></comment></comment></comment>


Dark matter may be hiding in a hidden sector - <AUTHOR> http://phys.org/news/2016-11-dark-hidden-sector.html <comment><USER2> The article revolves around the concept of hidden or visible "sectors," and never seems to explain what kind of thing thee actually are. Does anyone have the expertise to clarify?

<comment><USER3> Disclaimer: not a string theorist.

In examining the behavior of superstrings, we are concerned with modes of oscillation. As with ordinary strings, the possible oscillations are determined by the boundary conditions on the string. E.g., both ends of the string can be fixed; both ends can be variable; one end can be fixed, one variable.

One dimensional strings in a three dimensional space really just have a couple of possible conditions.

Superstrings oscillate through as many as 10 dimensions. That means there are many more possible boundary conditions. They come in groups. As an analogy, if a dimension ranges from 0.0 to 1.0, the string behaves pretty much the same regardless of whether its end is fixed at 0.5 or 0.6. What matters is that it is fixed. We can group the "fixed endpoint" conditions together.

The collection of boundary conditions on a superstring defines a "sector".

The "hidden sectors" is the part I'm less clear on. I think that refers to the many combinations of boundary conditions that would produce a string theory that we simply can't observe. I.e., all the strings we see as bosons, fermions, charge carriers, etc. share some sector. But the underlying math allows other string theories to exist. They are internally consistent but would result in particles we could not observe.

And, of course, 100% of this is based on string theory which is, thus far, unproven.</comment></comment>


Ask HN: How did you learn programming? - <AUTHOR> What was your schedule, learning style, time dedication? <comment><USER2> At university in the Software Basics 101 module, spending about 2 hours a week in lectures and another 6 hours in my own time for 3 months. I've continued learning to code in the 20 years since, and I think I'm just about getting the hang of it now.</comment>


Tutorial on making a photo app using Parse - <AUTHOR> https://parse.com/tutorials/saving-images <comment><USER2> Thanks guys. These tutorials are going to help. Keep them coming more and faster.

Particularly for web app builders, like me, who would like to get a version of their apps onto the iPhone.

I really don't want to be an iPhone guru, I just want to make some of my content available on an iPhone. The content typically is a combination of text, images and a little bit of formatting.

Somewhat on the lines of research reports

</comment><comment><USER3> This is amusing, as I've been using Parse's Facebook API for my app which looks almost identical to what this tutorial is creating. However I'm uploading the image to a web form instead of storing it in Parse, so it's viewable in a web browser as well. I'm still very new to it all though, would you use the Parse REST API to view these images on a website? Any chance of the next tutorial showing that?

<comment><USER4> Couldn't you set up a simple web app to get one time usable (or reusable I guess if you want to allow sharing) of the images from Parse's API since Parse just stores them on S3?

<comment><USER3> Probably, but like I said I'm still learning all about this, I have no idea how to do that.</comment></comment></comment>


How Naive AB Testing Goes Wrong and How to Fix It - <AUTHOR> http://ewulczyn.github.io/How_Naive_AB_Testing_Goes_Wrong/ <comment><USER2> By the way, as part of a research project which will (hopefully) become public soon, I've been thoroughly investigating these issues. It's important to note that Bayesian and Sequential testing are orthogonal.

You can have a sequential frequentist test (typically the Sequential Probability Ratio Test), which is standard frequentist hypothesis testing that allows multiple looks.

Similarly, you can use a Bayesian test in a "deadbeat" (run the test out to N=10,000, stop and choose the best) manner - you simply use the posterior to determine which variant is superior (i.e. choose the one with the highest mean).

tl;dr; The core difference between deadbeat and sequential is whether or not you stop the test at a fixed time. The core difference between Bayesian and Frequentist (as described in this article) is whether you maximize a utility function (e.g. revenue) or attempt to determine "truth".

</comment><comment><AUTHOR> This post describes the shortcomings of hypothesis testing for web optimization and proposes a method of repeated Bayesian A/B testing to address them.

</comment><comment><USER3> I only understood one word in three here, and that worries me. I am envisaging a world of "software literacy" where the ability to write decent correct code is as common as writing human language was (sometime between now and the renaissance.)

I would say that for the next hundred years software is likely to be a 10x skill - economically, intellectually and culturally valuable.

But there will be other skills dragged up with this - one likely one is the statistical rigour to be able to make use of your new found software skills.

If "stats" is a necessary adjunct to software skills what other skills will be part of the curriculum for the next century?

<comment><USER4> Most A/B testing uses statistical tests which are readily understood by mathematically inclined high schoolers, and some of the most effective stats- based decisionmaking processes in the world are designed by arbitrarily smart people and executed by average high school graduates.

For example, "Here's a two-dimensional graph where the Y axis is a measured feature of the part that just rolled off the assembly line and the X axis is the trial number. Every five minutes, pull a part off the line and put a tick mark at the appropriate place. See this red line on the graph? Two rules: a) If you ever make three ticks above it, in succession, SHUT DOWN THE LINE. b) If you ever make eight ticks above it in a shift, SHUT DOWN THE LINE. We will never under any circumstances consequence an employee for hitting the Big Red Button as a result of these two rules, but we will be most upset if the Big Red Button is not pushed when these two rules indicate it should be pushed."

A particular company teaches this to, quite literally, even the people who sweep the floors in its factories.

</comment></comment><comment><USER5> Could someone please explain it in short and plain English for non- statisticians in here?

<comment><USER2> Key points:

1) The goal is not to figure out if Variation is better than Control (this is what classical hypothesis testing is about). The goal is to make the revenue maximizing decision. If Variation and Control are identical, there is no harm in a false positive.

2) The author finds it desirable to allow the test to run for a variable amount of time, and stop it when statistical significance is achieved. This is called _sequential testing_.

The rest is the details on how to actually accomplish these goals.</comment></comment>


Rousseau: Meditations of a Solitary Walker (2016) - <AUTHOR> https://www.theculturium.com/jean-jacques-rousseau-meditations-of-a-solitary-walker/ <comment><USER2> _Meditations of a Solitary Walker_ is an abridged version of _Reveries of the Solitary Walker_. Unlike _Meditations_ , _Reveries_ is available new in both paper and ebook formats: [https://www.amazon.com/dp/0140443630](https://www.amazon.com/dp/0140443630) .

The original French version is available freely in ePub, Mobi, and PDF formats: [https://www.goodreads.com/ebooks/download/722065.Reveries_of...](https://www.goodreads.com/ebooks/download/722065.Reveries_of_the_Solitary_Walker) and also as an audio book: [http://www.litteratureaudio.com/livre-audio- gratuit-mp3/rous...](http://www.litteratureaudio.com/livre-audio-gratuit- mp3/rousseau-jean-jacques-les-reveries-du-promeneur-solitaire.html)

</comment><comment><USER3> Wow, I'm struck by the similarities to Buddhism. Renunciation, solitude, reflection, nothing to fear or hope for, unmoved by worldly events, at peace. Some of this stuff is like what I would expect to hear from someone like Thich Nhat Hanh.

</comment><comment><USER4> The idea of the noble savage is problematic given that "society" is the product of individuals. To say society corrupts the individual means that that which is caused by individuals (society) corrupts the individual. It would follow that individuals are the source of their own corruption.

<comment><USER5> > The idea of the noble savage is problematic given that "society" is the > product of individuals.

I think that there are a lot of problems with the idea of the noble savage, but surely the idea that people (or any system) behave differently individually or _en masse_ is not one of them.</comment></comment>


960 Grid System is Getting Old - <AUTHOR> http://www.webdesignerwall.com/trends/960-grid-system-is-getting-old/

<comment><USER2> You may also take a look at <http://www.tinyfluidgrid.com/>

</comment><comment><USER3> I really like the new grid system YUI released with version 3.2. Much better than their old system, and is fluid.</comment>


Show HN: Bitcoin Smart Contracts – With Live Demo - <AUTHOR> https://medium.com/@hedgy/decoding-the-dna-of-derivatives-82dcdf052607 <comment><USER2> This is very interesting. Right now Hedgy is the only option for a trusted third party oracle though. I'm not sure if this is a "real" smart contract... They are just a legal notary service and oracle for prices right now. Could this off blockchain? I think that would only require publicly posting every contract that is agreed, maybe obfuscating the identities.

They will be hashing legal agreements and adding that meta data to the bitcoin transaction so there is a permanent record of it.

Does anyone know of a real world example of a blockchain holding up in court? I know that www.proofofexistance.com does something similar with hashes of documents to prove it hasn't been tampered with. Used for wills and other documents that are traditionally notarized by a person and not a blockchain.

</comment><comment><USER3> Go Hedgy!!</comment>


Eurisko, The Computer With A Mind Of Its Own - <AUTHOR> http://www.aliciapatterson.org/APF0704/Johnson/Johnson.html <comment><USER2> Dr. Lenat still refuses to disclose the source code of Eurisko. He is even on record as having claimed that it was "lost", which seems unlikely.

What is more probable is that the program's much-hyped accomplishments were done with substantial human hand-holding a la Deep Blue, and the author will not risk his decades of academic prestige by allowing us to see the code and judge how high it could have flown on its own.

</comment><comment><USER3> I used to play Traveller, and our group at college didn't play the ship-to- ship combat part, just the role playing game (think of it as D&D with only 6-sided dice, space ships and other planets instead of dungeons).

Thanks for bringing this story back up.

</comment><comment><USER4> _Unit of bogosity is the lenat, named after Douglas Lenat. Like the farad it is considered far too large a unit for practical use, so bogosity is usually expressed in microlenats._

<comment><USER5> But it wasn't always thus. In the dawn of time Lenat actually did stuff.

Funnily enough, I've been playing around with a port of AM for the past coupla weeks. I've had the code for years and never looked at it until now. What got you on Lenat, Peter?

I think the world's coolest AI programs are Eurisko, Copycat and AM.

<comment><USER6> > _In the dawn of time Lenat actually did stuff._

Harsh, but probably fair. Or as Eliezer Yudkowsky put it "EURISKO may still be the most sophisticated self-improving AI ever built [...] by Douglas Lenat before he started wasting his life on Cyc."

> _I've been playing around with a port of AM for the past coupla weeks._

From where is the code for AM available? I ask because some people on an AI list I subscribe to think the Eurisko code is unavailable (but would like to get hold of it). You wouldn't have the Eurisko code too, by any chance?

> _I think the world's coolest AI programs are Eurisko, Copycat and AM._

I would agree, in terms of modelling general cognition.

<comment><USER5> No, eurisko nobody has :) The version of AM I have was written by one of my professors at the University of Texas Austin, and is in an ancient dialect of prolog. I'm not sure if it was ok to redistribute. Let me check.

I got it working on gprolog last week, but it seems to cause stack overflows :(

<comment><USER6> > _No, eurisko nobody has :)_

So why is that? Does Lenat not want anyone to see it? Or was the code lost?

BTW am I right in presuming that the original AM was written in Lisp?

<comment><USER5> Yes, the original papers indicate it was in lisp. "Why AM appears to work" suggested that a lot of the reason math was a good domain for discovery was just that lisp is well-suited to the domain. And Eurisko could modify heuristics expressed as s-expressions.

People have asked him, but I'm not aware of Lenat ever commenting on the source code. Cycorp is substantially funded by DARPA, and I wouldn't be surprised if Eurisko is part of its IP now.

Feel free to email me to take this offline.

</comment></comment></comment></comment></comment></comment><comment><USER7> "We're building a machine that will be proud of us"

</comment><comment><USER8> Lenat's been working on this since the 80s: <http://en.wikipedia.org/wiki/Cyc>

</comment><comment><USER9> interesting read until i came to the part where douglas photo is displayed... is it just me or does he look like jake gyllenhaal?..</comment>


Ask HN: Dealing with security concerns for self driving cars? - <AUTHOR> Delegating activity that was once exclusively done by humans to "machines", exposes a surface of attack that did not exist before. Just off the top of my head:<p>- there is a long history of countermeasures targeting radar, lidar and other sensors.<p>- with AI/ML taking center stage, attacks may be tailored to "confuse" automated decision making.<p>- ?<p>What approaches are taken to mitigate security concerns regarding self driving cars? <comment><USER2> It's like people throwing bricks at cars on the highway. It's going to happen so we build fences to keep the cars safe but no one pours buckets of nails through the fences.

It's a cat and mouse game, but the cat isn't interested. The attackers are people trying to fool cars in YouTube videos.

Sophisticated methods of hacking a vehicle electronicly do exist, they are used today to steal cars.

<comment><AUTHOR> _The attackers are people trying to fool cars in YouTube videos._

That may change really quick once a critical mass of self driving vehicles is achieved.

 _Sophisticated methods of hacking a vehicle electronicly do exist, they are used today to steal cars._

The stakes for the owner / driver are quite different.</comment></comment>


Making a Simple Dribbble Alternative - <AUTHOR> http://stugreen.com/blog/2011/02/introducing-favwork

<comment><USER2> I really like the simplicity of you app. I have not been "blessed" with a dribbble account either, but I do have forrst and lovedsgn accounts. The problem is, I always end up posting pretty much the same stuff to both accounts, and I find that the people that frequent both sites are pretty much the same, and dribbble as well. I wonder if there is something you can do to differentiate it from "the big three". Perhaps a rating/feedback system that's different than "likes" to captivate useres?

I really like what you have going, I'm just offering my 2 cents :)

<comment><AUTHOR> Really appreciate the feedback!! Yeah totally open to ideas. I'm just soft launching it to see if it gets any traction.</comment></comment>


Ask HN: How do jump hosts improve security on AWS? - <AUTHOR> With proper security groups and IAM configured, I am having trouble seeing the value (in terms of additional security) using a Jump Box pattern (Bastion Host) - what I am missing? <comment><USER2> 1 host vs all hosts. I've been using jumphosts on all my dmz's for years. Never have ssh open to the Internet, or desktop networks. Then I only have 1 host with an ssh ACL, not all my servers.</comment>


Ask HN: Proper way to report an error in a paper - <AUTHOR>

I have found an error in a peer-reviewed paper by a well known author. At a certain point in his algorithm, the author gives a lower bound for allocating storage. He does not provide a proof for that bound and it turns out that the bound is too low.
I have found a correct bound and spent several hours proving it. I am mainly a programmer and not well versed in the ways of academia. My natural instinct is a) to send my proof to the author directly. Another option is b) to put a small paper on my website that corrects the flaw.
Option a) has the downside that you don't know if you'll get proper credit. Many people seem to use option b), but is that an accepted practice?
What would you do? <comment><USER2> Both of them. They could be done in the following combination: post a small paper on your website about the flaw, with all the details - but make sure it is purely objective. Then e-mail the author, and send him the link to your article.

Provided that he's (or she) a nice guy/gal, it shouldn't be much of a problem and you might even get some public credit by his/her part.

</comment><comment><USER3> Option b - and email the author too.

It's your "discovery" so you can do what you like with it :)

</comment><comment><AUTHOR> Thanks guys, I'll go for b) + a).</comment>


Fuzzwich (YC summer 07) launches a new look and previews Animator - <AUTHOR> http://www.fuzzwich.com This is Ryan from Fuzzwich.  Check out the screencast at http://www.fuzzwich.com/animator if you have not already.  The Fuzzwich Animator is the start and the foundation of our new online animation studio. We're very excited by the new focus and look forward to inviting everyone to animate in the near future.  We're also very curious to your feedback, so please sound off! <comment><AUTHOR> This is Ryan from Fuzzwich. Check out the screencast at <http://www.fuzzwich.com/animator> if you have not already. The Fuzzwich Animator is the start and the foundation of our new online animation studio. We're very excited by the new focus and look forward to inviting everyone to animate in the near future. We're also very curious to your feedback, so please sound off!

<comment><USER3> I really like the colour scheme of the new homepage/site, but have a few observations:

(1) It's not immediately obvious to me what Fuzzwich is and why I should use it - I really think you could benefit from a prominently positioned tagline on the page itself ("Animation for Everyone" is good, but why put it only in the title bar ?)

(2) If your new screencast is a big play you definitely need to sell it more on your homepage - bigger or bold font / more prominence would help

(3) What's with the (wasted ?) space to the left-middle of the page ? This could be put to good use with a big SIGNUP NOW ! style button or maybe a funky image to sell the screencast with.

Just my two pennyworth - Hope some of it helps. You have a cool product - <USER2> pg says "Don't give up" :-)

<comment><USER4> Excellent points. I'll take into consideration immediately. Textmate is go!

</comment></comment></comment><comment><USER5> Looks really good, like the new direction.

I've a quibble with your screencast though - I can't pause it. It kept stopping and starting to buffer. It'd be much better to be able to stop it like a youtube video and let it load before watching.

<comment><AUTHOR> Yeah, we agreed. Switched to a YouTube player.

</comment></comment><comment><USER6> I've always liked Fuzzwich, especially the goofy stuff that people come up with, just using the simple tools. I've used it to make birthday "cards" for people.

I can't wait to see a Geico Commerical done with Fuzzwich one day.

Ryan, make it happen!

</comment><comment><USER7> I'm uber proud to be a YC alum when I see this kind of talent in the portfolio companies. You guys are fantastic artists. I'm excited to see the animator take off.

After you IPO Fuzzwich, you guys should be making film.

</comment><comment><USER8> Great site; I always thought that user-generated animation has the possibility to become huge. And being able to create animations from withing the browser... wow!

Like with HTML, it would be great if there was some way of doing "View Source" and be able to build on somebody else's animation.

<comment><AUTHOR> As long as the animation creator allows it, you will be able to work and play around with any published animation you see made from Fuzzwich.

</comment></comment><comment><USER9> Congrats Fuzzwich guys!

One question: will Fuzzwich Animator still have the same try-before-you- register feature as the original Fuzzwich? As another comment mentioned, the value proposition isn't immediately obvious without playing with Fuzzwich, so some sort of no-risk-no-hassle trial could do a lot to let people decide if Fuzzwich works for what they want to do.

<comment><AUTHOR> Yes. You will be able to play around with the Animator before you register (except in the private beta). However, unlike Minivid, you will not be able to save or publish until you have registered.

</comment></comment><comment><USER10> Very cool! Glad to see someone trying to bring animation to the masses

</comment><comment><USER11> Couple of things I've observed

\- what is a "portfolio"? I think I know what you mean but it's a bit of a mouthful. Do you need a non shop-talk word to replace it?

\- no controls on the playback sample I can't FF or see where in the stream I am. Do your playback mechanisms have controls like say YouTube?

\- really like the "Pythonesque" animation in the demo (got a chuckle) can you show "even" more styles as you discover them?

\- can you caption? If you can caption you can make comics.

I'd say there is legs in this idea because it's making what "artists" want ~ <http://news.ycombinator.com/item?id=129616>

<comment><AUTHOR> We chose 'Portfolio' because we think the analogy carries well -- Fuzzwich allows you to create a portfolio of animations. We also just like the sound of 'Portfolio' better than 'Account' :).

You can do captions, and the comic world is one we are very much excited about trying to get into.

Glad you like the styles. We will try to put a few more unique animations up in the near future.

<comment><USER11> _"... We also just like the sound of 'Portfolio' better than 'Account' :) ..."_

Point taken. Flickr has _'sets'_ , _'groups'_ , smugmug _'galleries'_. Fuzzwich _'Portfolio'_. Are your users used to the terminology?

 _"... comic world is one we are very much excited about trying to get into ..."_

If you do go take the time to read "Scott McCleod"s _"Re-inventing Comics"_. [0] Scott is a great writer/illustrator (read the book) and covers so much what is wrong in the comics world. There is a gaping hole at the moment being left by technology starved newspapers. [1]

Plenty of room for improvement.

[0] Scott McCloud, ISBN 978006095308 ~ <http://www.scottmccloud.com/store/store.html>

[1] Marvell comes to Facebook ~ <http://www.comicbookresources.com/news/newsitem.cgi?id=13246>

<comment><USER12> I wouldn't expect _Portfolio" to be the same as_ Account*. I'd think I'd need an account first before creating a portfolio (which would be a special-purpose collection of videos I've made).

</comment></comment></comment></comment><comment><USER13> awesome new look guys, huge evolutionary step. Love the twisp and catsby annimation, too. :)

</comment><comment><USER14> This is really awesome. Best of luck guys!

</comment><comment><USER15> Holy crap is it easy to sink time with those animations/videos. I want to use it!

<comment><USER16> yessir. the timing is solid and friendly. as extras perks, you can record in slow motion, fast forward, or even backwards (backwards recording + parallax leads to very cool aesthetics). once you've got stuff recorded, you can shift it around on the timeline or stretch and condense it like in video editing apps.

</comment></comment><comment><USER17> Thank you fuzzies. You have made what I plan to do much, much easier.

</comment><comment><USER18> fyi, the favicon is still the old logo</comment>


How your startup should not respond to negative feedback - <AUTHOR> http://betabeat.com/2013/05/privco-responds-to-criticisms-of-its-tumblr-report-by-slinging-twitter-insults-at-fred-wilson-everyone-else/

<comment><USER2> Wow, those childish ad hominem tweets look really bad coming from a company account. I know nothing about PrivCo - is this a one-person shop?

<comment><AUTHOR> No. According to Glassdoor, it says 16-50 employees - [http://www.glassdoor.com/Overview/Working-at-PrivCo- EI_IE659...](http://www.glassdoor.com/Overview/Working-at-PrivCo- EI_IE659519.11,17.htm)

LinkedIn has them at 50 employees. Safe to say it's definitely not a one man shop.

</comment></comment><comment><AUTHOR> Inspired by this thread where Fred Wilson called Privco's data garbage, their response was a bit of a case study in how not to respond to criticism.

<https://news.ycombinator.com/item?id=5746763></comment>


Journalism is being eaten alive by opinion - <AUTHOR> https://unherd.com/2020/01/journalism-is-being-eaten-alive-by-opinion/ <comment><USER2> the title is true and worth discussing.

the article, less so.

The TLDR; = Am I to grok that journalism's decline is due to an anecdotal incident of social media (completely different field here) manipulation?

Hrmmm nice article title. I wish it were attached to a related article. Op-ed drek churned out in industrial quantities cheaply, as it's basically the verbal equivalent of comments on any net forum. Funding a global investigative journalism team? not so cheap, eh?</comment>


Octopart releases free API for developers - <AUTHOR> http://octopart.com/blog/archives/2009/10/octopart-api

<comment><AUTHOR> Some background - We think that hackers with hardware experience are the best people to build engineering design tools. Unfortunately, it's quite difficult to get startup capital for design tools so there hasn't been much innovation in the space. The end result is that only large well funded companies have had the resources to build design tools. We hope that by sharing revenue generated by the API, we can democratize design software by enabling hackers of all stripes to build new tools.

<comment><USER2> Do you have any specific ideas in mind that you guys just don't have time to tackle?

<comment><AUTHOR> We'd love to step aside to let developers build on top of the API. I'd even like to see someone revamp the Octopart UI! Here are some other ideas:

      - a really good project manager (with collaborative features and publishing tools)
      - browser plugins/toolbars
      - ajax circuit simulator
      - an AdSense-type widget to help engineering forums monetize their sites

Finally, I think that each node in our category map needs a specialized UI. Since we have 1000's of categories there's endless room for improvement there. Top of the list are:

      - power supply picker
      - capacitor picker
      - opamp picker

Any other ideas???

<comment><USER3> A power supply designer would be super-useful. I've designed at least a dozen onto PCBs in the last several years, all pretty similar to a few reference designs. It's a constant pain in the butt to keep up with obsoleted capacitors. I'd love to see a fully general-purpose power supply designer, where I enter a voltage & power and it spits out a working schematic complete with intelligently selected minimum-cost part numbers.

<comment><USER4> Several of the big voltage-regulator manufacturers (National, Linear, ST come to mind) have software along these lines already, some of which is fairly good. A unified and less cumbersome application would be great, especially if it could pick out passives (caps, as you suggest, but also inductors and freewheel diodes for switchers). National's Webench already does this, but its library of passives is very limited compared to Octopart and many of the parts it suggests are either expensive or hard to find in low quantities.

</comment></comment></comment></comment></comment><comment><USER3> This looks great! I'm already imagining some quick Python scripts I want to write to help automate component selection

</comment><comment><USER5> This looks fantastic. This could actually work well with a project I've had floating around in my head for a while.... I better get going on it!

</comment><comment><USER6> Is there any guarantee on the accuracy of this information? I've run into wrong technical info numerous times, even on datasheets themselves.

Is this info scraped from datasheets or is it just entered into the database by hand?

<comment><AUTHOR> We have 9M+ parts in our database so we use algorithmic methods to parse and normalize technical information. In general, the data comes from many different sources including increasingly from the manufacturers themselves. We're not parsing pdf datasheets though so datasheet errors won't affect the accuracy of our database.

As you can imagine, it's impossible to guarantee 100% accuracy on 9M+ parts since we can't verify each part by hand. If you spot an error, please send us an email and we'll fix it.

<comment><USER6> I wasn't really worried about datasheet errors making into the database. I was more worried about OCR problems and human error. It is nice to know that the manufacturers are starting to give you this stuff.

</comment></comment></comment><comment><USER7> your search engine is very quick and thinking that you're doing faceted search it's incredible. do you use sphinx, lucene or custom search engine implementation?

<comment><AUTHOR> haha! Thanks! We recently switched from a hacked-version of sphinx to solr. We're using some custom solr features (including some that we're contributing back) but most of the speed comes from solr faceting. It wasn't trivial to setup though - Harish did a lot of work performance tuning solr.</comment></comment>


StackMob Ratchets Up The Competition: Launches A Marketplace - <AUTHOR> http://techcrunch.com/2012/11/13/stackmob-ratchets-up-the-competition-makes-api-calls-free-launches-a-marketplace-for-third-party-mobile-services/

<comment><USER2> The pricing page makes me nervous now, when do the charges start kicking in on the Innovation plan? I was looking at the old one earlier today which was much clearer about exactly what was free.

<comment><USER3> Hi there and thanks for the feedback that the pricing page needs to be clearer for you. Here's what Free means, when we say free:

Unlimited API transactions (no limits, no hidden fees)

ACL Permissions

Collaboration (this means one team with up to three developers per app)

Analytics

S3 integration

Twitter and Facebook integration

Geo queries (unlimited)

Work flow basic (this means you get both a development AND a production environment - no need to create separate accounts or apps to manage dev to production)

The ability to mix-in any third party or StackMob modules in the Marketplace

@stackmobsteve

</comment></comment><comment><USER4> The new site looks great! We use StackMob and it works very well for enabling mobile web services apis.

\- Hamilton

<comment><USER5> I agree. Their designer is awesome.

<comment><USER6> The design is nice but I've found the font not so readable (Chrome 22 on Win7)

<comment><USER3> We made some changes. What do you think?

</comment></comment></comment></comment><comment><USER7> Awesome guys.. glad to be a part of this.</comment>


The First ARM CPUs - <AUTHOR> http://www.apdl.org.uk/riscworld/volumes/volume9/issue5/2ndproc/index.htm <comment><AUTHOR> Found on Azeem Azhar's Twitter feed, it is a journey from the 1980's.</comment>