A New Look and Feel for Uber - <AUTHOR> https://newsroom.uber.com/celebrating-cities-a-new-look-and-feel-for-uber/ <comment><USER2> Wow, this is painful. Definitely an early contender for worst rebrand of 2016. The video, oy-vey, pretentious does not begin to describe it. Their logo represents bits and atoms? What?.. but, why?

<comment><USER3> This might be one of the worst rebrands I've ever seen. They totally conceded something prominent for something that looks like a freelance logo-designer's general 'hey I design logos' generic portfolio item.

</comment></comment><comment><USER4> This somehow reminded me of the leaked Pepsi logo redesign presentation.

</comment><comment><USER5> on iOS, at a glance, the new app icon looks like an app when its updating. When i look at my home screen really quick, i see it out of the corner of my eye and think its updating.

</comment><comment><USER6> [https://www.youtube.com/watch?v=Ia8OKMlqxLs](https://www.youtube.com/watch?v=Ia8OKMlqxLs)

</comment><comment><USER7> So many broken SVGs!

</comment><comment><USER8> WTF. 50B down the drain.

<comment><USER9> Mind explaining what's so terrible about their design?

<comment><USER8> Too abstract.</comment></comment></comment>


Machine learning is teaching us the secret to teaching - <AUTHOR> http://nautil.us/issue/6/secret-codes/teaching-me-softly

<comment><USER2> Although the article makes no mention of them, George Lakoff and Mark Johnson's research on conceptual metaphor[0] seems to be intricately tied to this, somehow. I recently read two books by them: _Metaphors We Live By_ (see Peter Norvig's description here[1]), and _Philosophy In The Flesh_ [2] and found the ideas in them on how humans use metaphors to make sese of things very interesting and intuitive. It actually left me wondering when and how AI would use these insights.

[0] [http://en.wikipedia.org/wiki/Conceptual_metaphor](http://en.wikipedia.org/wiki/Conceptual_metaphor)

[1] [http://norvig.com/mwlb.html](http://norvig.com/mwlb.html) \- because it stays focused on language it manages to make a clear and convincing case

[2] [http://www.nytimes.com/books/first/l/lakoff- philosophy.html](http://www.nytimes.com/books/first/l/lakoff-philosophy.html) \- by comparison a flawed but nonetheless good read. I agree with the critiques laid out this review: [http://lesswrong.com/lw/871/review_of_lakoff_johnson_philoso...](http://lesswrong.com/lw/871/review_of_lakoff_johnson_philosophy_in_the_flesh/)

<comment><USER3> I started reading "Louder Than Words: The New Science of Meaning" which is based on embodiment. Instead of making up these grand hypotheses like Lakoff tends to do (not necessarily a bad thing) Bergen ties embodiment and more specifically simulation to new empirical research. I think that we could probably benefit from cross-pollination between cognitive linguistics/psychology and more technical AI.

<comment><USER2> Yeah, that's a valid criticism of Lakoff especially. This blog sums up the problems with his writins quite nicely, without losing sight of the good bits and the contributions of his work:

[http://blog.apperceptual.com/criticisms-of-lakoff-s- theory-o...](http://blog.apperceptual.com/criticisms-of-lakoff-s-theory-of- metaphor)

Thanks for the tip, I'll check out "Louder Than Words"

</comment></comment></comment><comment><USER4> I found some slides [1] explaining how this works.

A less poetic example of privileged information: if you're training on time- series information, you can include events from the future in the training examples, even though they won't be available while making predictions in production.

Apparently this helps the machine learning algorithm find the outlying data points when the data isn't linearly separable.

[1] [http://web.mit.edu/zoya/www/SVM+.pdf](http://web.mit.edu/zoya/www/SVM+.pdf)

<comment><USER5> Unfortunately, I don't find that reference very helpful - it's just pages of annotated equations.

What's an example of pseudocode that would actually implement this? Surely you don't load a natural language module in order to parse the pathologist's notes (in the example given in the reference about biopsies)?

(I should also note that the original article is devoid of _any_ technical examples, making it completely opaque to me what it actually entails.)

<comment><USER4> Yes, I mostly don't understand the math either. But apparently with the poetry, they converted it into a vector somehow based on the appearance of keywords. Perhaps someone will find a friendlier example.

<comment><USER6> I think an example is this: for a concrete set of data, see the distributions on page 28 of this document (page 40 of the PDF) [http://mi.eng.cam.ac.uk/reports/svr-ftp/auto- pdf/harpur_thes...](http://mi.eng.cam.ac.uk/reports/svr-ftp/auto- pdf/harpur_thesis.pdf)

These different distributions are difficult to distinguish with statistics. However, if you can see the shape snd therefore know the "rule" or the structure of the distribution, it's easy to design/train a network to recognise them.

(note that the content of that PDF is not about this problem per se)

</comment></comment></comment></comment><comment><USER7>
        "In many cases, humans use their own knowledge about
        actions to recognize those actions in others," he told
        me. "If a robot knows how to grasp, it has better chance
        of recognizing grasping actions of a person," he said.
        Metta is going one step further, by teaching iCub to
        follow social cues, like directing its attention to
        an object when someone looks at it. These cues become
        another channel through which to collect privileged
        information about a complex world.

This article kept getting better and better. I thought this was particularly interesting because it leads to a world where the AI software is available to all, but what's of value is the rules or metaphors you've developed for your robots. That would give garage hobbyists a chance of coming up with their own special formulas and possibly be the ones to figure out something novel or world-altering in AI.

<comment><USER8> This could potentially provide insight into Autism cases? Training an AI to be attentive to social cues, and then training another one to be not as attentive - and see what kind of results come out of each. This could also point us in a direction of what type of cues are the most important to pay attention to.

</comment></comment><comment><USER9> As I see it, the natural extension of identifying this "secret to teaching," is to try and extrapolate it to "unlearning," or memory loss, dementia and Alzheimer's.

If we can mimic and model the neuronal pathways and firings within humans, using AI, then we should also be able to study the relationship between the failure and degradation of pathways. AI pathways are subject to break and fail as well, though the causes are of course different. However, it would be imagined that there must be some shared structural stresses that result in the "unlearning" and failure to fire or function.

The potential for AI is immeasurable. If we can teach a robot, surely we can stress its system enough to "unteach" it. Despite being unable to force-feed it junk-food and/or vitamins/minerals, we can replicate environmental stressors, and once having generated the "unlearning" process, examine how to halt the degradation and perhaps reverse the trajectory.

</comment><comment><USER10> > His advice gave no specific information on what angle the bow should > describe, or how to move the fingers across the frets to create vibrato

And it's a good thing he didn't - violins don't have frets /nitpick

<comment><USER11> I wouldn't fret too much about it.

I'll get my coat...

<comment><USER12> Yes, perhaps you should bow out.

<comment><USER13> Aaaand the Reddit ~ HN equivalence is complete.

<comment><USER14> Actually it wasn't technically complete until your comment- the self-aware reference to the progression is the final step :)

</comment></comment></comment></comment></comment><comment><USER15> I stopped reading where it says that SVM is used for big data. SVM can only process about 10000 examples.

<comment><USER16> Then you ignored all the inaccuracies before that sentence, and all of the insights after it.</comment></comment>


Evaluating the effectiveness of Google's "Testing on the Toilet" program [pdf] - <AUTHOR> https://storage.googleapis.com/pub-tools-public-publication-data/pdf/00e67690ad147ab03479b9ddbc7f242ed85b5133.pdf <comment><USER2> Scientific papers are gradually partaking from the stash of clickbait title tricks. We've edited the one above to make it less activating.

If you post in this thread, can you please check that it's about the interesting aspects of the article? Poop jokes get old pretty quickly.

</comment><comment><USER3> For those that don't want to read the article, it is about the program Google has to post little newsletters about programming tools in their bathrooms. They hang them over the urinals too.

I was at Google for an event recently and found it interesting to read as I used the urinal. It was about an internal tool though so it didn't mean much to me.

<comment><USER4> Facebook seems to do this also.

<comment><USER5> Facebook's similar program was started by an ex-Googler

</comment></comment></comment><comment><USER6> Most of my best thinking at work happens on the toilet.

Don't know exactly what I should take from that. Except that probably something is wrong about open plan offices.

<comment><USER7> That and the shower.

<comment><USER8> It's weird. Going for a walk doesn't make ideas pop up in my mind. Nor does sitting still on a couch bring up ideas. But sitting in the static toilet environment does.

<comment><USER9> Because it's an enclosed space devoid of distractions?

</comment></comment></comment></comment><comment><USER10> I saw these during my 18 months at Google. They were never relevant to my work.

Working at Google you are bombarded with "nudges." The garbage cans have stop smoking signs. The plentiful candy is famously placed into jars to reduce consumption. There's signs telling you not to sit on the loo for too long. You'll get emails comparing your travel and server expenses to the average. All of this stuff is well-intentioned, but there's clearly part of the company seeking ways to manipulate its workforce.

<comment><USER11> During my ~60 months inside Google, these nuggets sometimes proved to be useful, telling about a newly available tools (e.g screenshot diffing in UI tests), common pitfalls (like mixing up dates from different systems with and without timezone), common best practices (don't use `now()` in test, instead, imitate the flow of time using...). These are just off the top of my head after several years outside Google.

Nothing mind-blowing or earth-shattering. A number of useful things to learn at these 30-60 seconds when you can't read anything more interesting, though.

<comment><USER12> Could you expand more on not using now()

<comment><USER13> Using the real-time clock makes your test impossible to reproduce. Using a mock clock leads to reproducible tests. Same with calls to PRNGs: these should be injected so your test failures can be reproduced.

</comment></comment></comment></comment><comment><USER14> I was at Google for 2 years and liked "Testing on the Toilet" plus it's spinoffs "Programming on the Potty" and "Localization on the Loo" pretty useful. Especially for someone like me who came from much smaller companies where a lot of best practices or tools they wrote don't exist.

</comment><comment><USER15> This is the closest we're going to get on HN to a shitpost. Speaking personally: I know one developer who discovers lots of new tools on the toilet: me.

</comment><comment><USER16> I used to work in the head-office of a well-known car dealership firm in the UK. In the bathrooms they had a quote along the lines of 'the best ideas come when we least expect them'.

I found that I ended up thinking more about that quote than coming up with ideas. Kind of counter-intuitive.

</comment><comment><USER17> I understand we're all different, but I prefer to clear my mind on the toilet.

</comment><comment><USER18> All I'm imagining right now is some posters promoting some tool/library beside those mental health awareness posters you usually see in the stall...

</comment><comment><USER19> I miss bathroom humor scribbled on the wall, such as:

What are you laughing at? The joke is in your hand.

</comment><comment><USER20> You misspelled Stools

</comment><comment><USER21> The title is "Do Developers Discover New Tools On The Toilet?" but an overbearing mod changed it because he thinks he's Etiquette Secretary of the Internet, and probably also so he can plausibly pretend this isn't a website dedicated to Alphabet's PR.</comment>


Dropbox Lack of Security - <AUTHOR> http://tirania.org/blog/archive/2011/Apr-19.html

<comment><USER2> This is the first time I've heard someone on HN actually ask for _more_ security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True or false: it is permissible to download these and take them home with you.", etc etc.

And they'd be exactly where we are today:

1) Yes, we could look at your data any time we want to. This is an inevitable consequence of letting _you_ look at your data any time you want to.

2) We promise not to abuse our power #1.

3) If you don't trust us on #2, you should not do business with us.

Except they'd be out seven figures.

<comment><USER3> That's a severe oversimplification, IMO. Just recently there was news that duplicating the host_id from the Dropbox config onto another system will immediately gain access to all of the Dropbox files associated with that host_id, without further authentication.

It's not security theatre to acknowledge that the security in such a system could be improved, especially as an option for those that require it.

#3 could easily be paralyzing for many businesses. There are already services (like Tarsnap) which are engineered to not require you to trust them; why should we ignore such services and limit ourselves to doing business only with those companies that we can trust implicitly?

As a specific example, I've had a client for a few years which is government funded and quite paranoid about security. However, they also need to communicate with outside contractors. I don't advise them to "trust" their ISP, the outside contractors' network, and all the other businesses in- between. I tell them that nothing sensitive leaves the building unless it's been encrypted, and that once someone else opens that file, it can no longer be considered secure in any sense.

"Trust us" is not a compelling requirement for doing business, nor can businesses limit themselves only to relying on service providers that they trust. Fortunately, the technology exists now to eliminate that requirement.

Dropbox is currently off-limits to all employees at my client.

<comment><USER4> Great points. Trust and hope are not IT Security Controls.

Take the matter into your own hands and GPG encrypt everything that you place into the cloud. That way, only you hold the decryption key. I'm sure this may violate their ToS and it is inconvenient for end-users, but in order to have a firm technical control, you have to remove "trust and hope" from the equation.

<comment><USER5> It's hardly against their TOS - they _recommend_ using FreeOTFE or TrueCrypt to do just this: [http://wiki.dropbox.com/TipsAndTricks/IncreasePrivacyAndSafe...](http://wiki.dropbox.com/TipsAndTricks/IncreasePrivacyAndSafety)

</comment></comment></comment></comment><comment><USER6> hi there, arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend.

all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud.

re. employee access to files - there are controls to prevent this. for example, even drew (founder/CEO), doesn't have physical access to our storage servers anymore.

for very sensitive data, there's always the option to use truecrypt (we even offer this as a recommendation in our security documentation: <https://www.dropbox.com/terms#security>)

<comment><USER7> Technically speaking, whats the point of encrypting data on the backend if you can decrypt it? This strikes me as a waste of computations for no real gain.

<comment><USER8> Someone in an Amazon datacenter that gets ahold of a random backup tape/hard drive can't read it. I'm not sure if Dropbox is hosted on EC2, but if not, it means that Amazon couldn't read the data at all. (If it's hosted on EC2, Amazon could probably get ahold of the key if they really wanted to)

<comment><USER7> Going off of that assumption, what if the decryption keys were also stored in an Amazon data center? It is then possible for Amazon read the contents of these files.

I'd like to hear from Dropbox how this works instead of speculation.

</comment></comment></comment></comment><comment><USER9> It always seemed obvious to me that Dropbox has access to your unencrypted files because _they make them available to you through the web interface_.

<comment><USER10> > because they make them available to you through the web interface.

You could have client side javascript that decrypts the files. <http://crypto.stanford.edu/sjcl/>

<comment><USER3> You're getting (maybe unfairly) downvoted because the popular opinion in security is that client-side JavaScript anything is worthless in terms of security. Since it's not authenticated in any way by the browser, any successful MITM attack on a connection can feed malicious JavaScript which would request the user's key. Or, a malicious add-on in the browser could do the same. Or, possibly, an XSRF.

I'm somewhat skeptical of this because I think that such attacks can be successfully mounted against most other web-related activities. DNS poisoning and self-signed SSL would be enough to phish many people's bank login credentials, and a lot of attacks don't even go to that much trouble.

But, anyway, client-side JavaScript for security purposes is supposed to be verboten.

<comment><USER11> The number of people who will find an attack in the middle of a ton of Javascript is _much_ smaller than the number of people who properly handle a certificate warning.

</comment></comment></comment></comment><comment><USER12> I don't care. I use Dropbox because of the unparalleled feature set and ease of integration. I have my taxes stored on Dropbox, along with a lot of other sensitive information. They're in an encrypted RAR file with a line-noise passphrase, just like they would be if I were storing them _anywhere_ (including locally -- after all, what if Mallory steals your hard drive? Or, to parrot the most common movie plot threat, what if the NSA secretly breaks into your house when you're out at the movies and images all your disks then slips them back in without your knowledge?)

The features DB offers for sharing, web access, etc. are well worth the tradeoff, and I am ashamed to see the security pedants constantly pillorying Dropbox because it's not some imaginary "verified secure" system. They don't advertise to be that. A claim of "we encrypt your files with RSA" should be utterly meaningless to you without knowledge of how the key is controlled, and a few seconds' thought and examination of the feature set should inform you that yes, Dropbox has to have the key to decrypt the files. That doesn't make the claim of "your files are encrypted" any less true.

<comment><USER13> >

paying Dropbox customer here, I wouldn't call the features "unparalleled". SugarSync offers more, and for slightly less: <https://www.sugarsync.com/sync_comparison.html>

...or so I'm assuming. I never tried it because last time I checked they require a credit card for a free trial.

<comment><USER14> Seems like you can get a free 5g account without CC here:

<https://www.sugarsync.com/signup?startsub=5>

</comment></comment></comment><comment><USER15> Do a lot of people think that Dropbox is some sort of super-private service?

I'm no security expert, but do I hope it's obvious to most people that Dropbox wouldn't be able to do stuff like reset your password if they didn't have access to the contents of your files at some level. A truly secure and private service would look a lot different, and be much more complicated to set up. That's the tradeoff.

<comment><USER16> >I hope it's obvious to most people that Dropbox wouldn't be able to do stuff like reset your password if they didn't have access to the contents of your files at some level

Those are pretty damn high hopes even for the average user from the generation that grew up with computers.

</comment></comment><comment><USER17> Three points:

1\. Sensationalism aside, Dropbox should review questionable security claims to reduce false sense of security if any. With millions of users, careless words formed out of marketing needs are no longer needed. What Dropbox users need now is more clear picture of what they are giving up to gain Dropbox's services.

2\. The weakest security link is the user and their computer, not Dropbox which has enough financial incentives at stake to be diligent security wise. In the end, no computer open to external data or code is safe. What protect most users today is actually not security technologies but cost/benefit ratio to potential attackers, tempered by goal and scale. 99.9999% of Dropbox user data is useless to attackers and cost of mining questionable nuggets out continually expanding sea of data from 20 million users is not a trivial task.

3\. While it's true that user must trust Dropbox in the end, some of its security measures could use strengthening even if it's just intended to raise the level of sophistication necessary to steal Dropbox data.

<comment><USER18> Agreed. Except a lot of companies have _a lot_ of " financial incentives at stake to be diligent security wise" but aren't.

Something I very recently heard: "World of Warcraft has had RSA-style two- factor token authentication for years, and my bank still doesn't"

<comment><USER17> Some thoughts re WoW vs banks:

WoW Authenticator is optional, costs $30~40, and intended for serious WoW players in a community with very strong peer support. Banks can do first two but don't have a community of tech savvy users to reduce cost of support manageable.

So Blizzard could but banks couldn't. Will this change? I think so but it'll have to be opt-in and paid for by customers, likely through third-party services first.

<comment><USER19> $6.50, not 30-40: <http://us.blizzard.com/store/search.xml?q=authenticator> \- this omits the free apps for most smartphones.

As far as peer support, honestly, there's almost no peer support. There is a strong first-line of FAQs and automated systems (regularly ensuring secondary contact information is accurate, well-defined systems for lost authentication devices,etc) and well-trained second-tier tech support.

There are enough third-party auth providers now that would be well able to provide the entire support chain for the banks. In fact, Gemalto has built for this: <http://www.gemalto.com/financial/ebanking/>

</comment></comment></comment></comment><comment><USER20> Regardless of how you want to parse a company's public statements and written policies, it's the height of naivete to think that a data host (ANY host) wouldn't share your data with law enforcement or has encrypted data in such a way that they guarantee that no one can access it.

If you have sensitive data, encrypt it yourself. Encrypt it on your local drive, back up encrypted data, encrypt it before uploading it to Dropbox. Doing otherwise is akin to not having a proper backup process: it's either because of laziness or ignorance.

</comment><comment><USER21> Dropbox didn't lie. This is simply a misinterpretation (or misunderstanding) of what's meant by the phrase "Dropbox employees aren't able to access user files". It's not the same as saying "It's impossible." The fact is, if you send a company your unencrypted data, it's obviously _possible_ for them to view it at some point. Otherwise they could never encrypt it in the first place. So when they say that employees aren't able to access it, they mean that they, as a company, _choose_ not to access it.

A good analogy is the post office. Anyone who works there and handles your mail could, if they so desired, tear open your package and steal the cookies your mother sent you. We trust them anyway, because we know they take precautions to ensure it doesn't happen. Dropbox is the same, but even tougher (I doubt the average Dropbox employee has access to their decryption mechanisms, but plenty of people at the post office can unseal your envelopes).

That said, to not acknowledge it as even _possible_ for the company you send your data to you be able to access that data seems, to me, a bit naive. That's not the promise they made, and so the claim that they lied is false.

<comment><USER22> The plain English meaning of the words "aren't able to access user files" is not the same as "choose not to access user files".

Dropbox could just keep keys in a store where only automated user accounts can get to them -- ones where only the founders have passwords, or they are in escrow. I think there are ways to restrict the access to founders and a fail- safe, without opening them up to anyone who works at Dropbox.

<comment><USER23> If you run their client you've already made the decision to trust them to behave responsibly. The rest of this discussion is simply about obfuscation.

</comment></comment></comment><comment><USER24> All this press about Dropbox is getting ridiculous. I'm almost suspecting it's a hit job, but I'm wondering why people like De Caza are getting involved.

Pay attention to the two following rules. They are, and always have been true. Write them down if need be:

1.) The government can demand files from any US (and many non-US) companies. The company is then legally-obligated to turn them over.

In the past, the government has even successfully demanded data without the proper warrants (read about the VZW/AT&T/Qwest/NSA fiascos).

2.) Your cloud data is always subject to security breaches and provider employee abuse. Encrypt accordingly (I prefer DMG and TrueCrypt).

Why is this news? Did people not understand this?

</comment><comment><USER25> It is possible to design a Dropbox-like system with the following properties:

1\. Files are stored encrypted.

2\. The service provider does not have the ability to arbitrarily decrypt the files. By "arbitrarily decrypt" I mean decrypt at any time they wish. They will be able to decrypt if the owner's client is actively connected.

3\. When someone uploads a file that is identical to an existing file, it initially is stored separately, but in most cases can be eventually de- duplicated, without compromising #1 or #2.

I'll leave the details as a fun exercise.

<comment><USER25> Scratch that. I've got an even better design than what I was thinking of above. It makes it so the service provider never has access to the unencrypted data, and they can fully de-dup immediately, and it supports all Dropbox features.

       Let F be an arbitrary file.
       Let N(F) be the name your client knows the file by.
       Let H(F) be a hash of the file that produces a 256 bit hash.
       Let AES(X,K) be X encrypted using AES with key K.

When you upload to the cloud, you upload AES(F,H(F)). In a local database, you store (N(F), H(F)). When you later retrieve the file from the cloud, you receive the encrypted data, and you can lookup the key, H(F), in your local database.

Note that if two different upload files with the same content, they pick the same encryption key (since the key comes from a hash of the content), and so the same data gets uploaded. The service can thus do de-duplication, even though it has no access to unencrypted data.

So far, all this provides is secure storage. What makes Dropbox useful is that a file uploaded on one computer can be downloaded on another, and that only works if the downloader knows H(F).

This is solved by also uploading a copy of that local database I mentioned, the one that stores the (N(F), H(F)) pairs. This can be encrypted with the account password.

Syncing between different devices on the same account is then a two step process. First, the name/key database is synced, and then both devices have access to the keys and then the files can be synced.

I believe web access can be handled via this system. Dropbox's web interface requires Javascript, so it could have the browser retrieve the name/key database and decrypt it using the account password, which gives it the access to the key to decrypt a given file.

For shared folders, you can use a public key system, where the keys for the shared files are encrypted with the public keys of each person you are sharing the folder with, and the encrypted key files are stored in the cloud. Anyone accessing the shared folder grabs the key file for the folder and uses their private key (which is protected by the account password) to get K(F) for the file.

I believe this covers everything Dropbox does, with the properties that:

1\. They can't decrypt your files.

2\. They can de-duplicate completely.

3\. Your account password is the key for everything for you.

4\. It satisfies all of their advertising claims for security.

<comment><USER26> There's still a big problem with de-duplication: Dropbox can still figure out which users have the same file, thus leaking information. That, combined with the fact that they'll know the size of the file already gives them a lot of info.

For example, if the FBI seizes a computer and finds some illegal files, they can still request Dropbox to give a list of users that have the same file.

<comment><USER27> As has been mentioned elsewhere in the thread -- de-dupe isn't responsible. If Dropbox is storing your files -- then the TLA can always request Dropbox to give a list of users that have the same file. (Unless you have some form of independant crypto/hashing)

<comment><USER26> yes, thank you for rewording my comment.

</comment></comment></comment></comment></comment><comment><AUTHOR> Couple this with the unencrypted metadata on mobile problem: [https://grepular.com/Dropbox_Mobile_Less_Secure_Than_Dropbox...](https://grepular.com/Dropbox_Mobile_Less_Secure_Than_Dropbox_Desktop)

And how their "encryption" on the server side is basically a lie, as they do dedupe on data: [http://paranoia.dubfire.net/2011/04/how-dropbox- sacrifices-u...](http://paranoia.dubfire.net/2011/04/how-dropbox-sacrifices- user-privacy-for.html)

I'm stunned that anyone would use them for anything for ephemeral data you wouldn't mind posting in public.

<comment><USER6> hi there, arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend. I'm not sure why you're concluding that de-duplication implies lack of encryption. the de- duplication occurs prior to encryption.

all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud.

re. employee access to files - there are controls to prevent this. for example, even drew (founder/CEO), doesn't have physical access to our storage servers anymore.

for very sensitive data, there's always the option to use truecrypt (we even offer this as a recommendation in our security documentation: <https://www.dropbox.com/terms#security>)

<comment><AUTHOR> Dedupe and cleartext metadata as stated in the article I referenced, would allow for the following possibilities:

If an attacker could figure out the hash method used by dropbox on the files and intercept a few hashes from a victim, it's plausible that an attacker could trick the service into thinking that he had uploaded the files on his own account, allowing access to the victim's files.

Could you explain what would need to be done to protect against this attack method?

Security is hard - I hope yours improves.

<comment><USER6> cryptographic signatures of files are never transmitted over plaintext. yes, the current incarnation of the mobile apps don't encrypt the _names_ of the files but we are working on a fix for this as soon as we can adequately improve the SSL performance of our mobile apps.

</comment></comment></comment></comment><comment><USER28> Relying on others to safeguard/encrypt your personal data just doesn't make sense to me, in the same way that closed-source cryptography doesn't make sense.

If dropbox is claiming a false sense of security then that is an issue, but users that truly care about their data should resort to truecrypt or something where they are the _only_ ones who control access. You can sync your files with dropbox and keep them safe with a truecrypt volume. Or if that is to much of a pain, only do so for sensitive files. Have your cake and eat it too!

</comment><comment><USER29> Wouldn't they have to keep the keys on their servers? Otherwise when my computer dies, I wouldn't be able to access my files from a different computer.

</comment><comment><USER30> This is the second completely unreasonable press attack on Dropbox. They are so unreasonable that I have trouble believing a reasonable person would think they are valid complaints unless they were trying to sell me a competing product.

Everyone with any security sense knows: 1\. If someone gains access to your computer, and they can read your hard drive, and your computer can automatically log in to some service, then they can log in to that service. 2\. If you can access the data without decrypting it locally, then your service provider can too. In a fantastically secure system, they will have decide to do and then wait for you to log in, but that's pretty unusual.

I predict next week we will get an article pointing out that I can get your files by breaking into your email account and then using the reset password feature.

</comment><comment><USER31> There was a really good thread in /r/netsec a few days ago about encrypting your dropbox:

[http://www.reddit.com/r/netsec/comments/gowvu/doityourself_e...](http://www.reddit.com/r/netsec/comments/gowvu/doityourself_encrypted_dropbox_any_ideas/)

</comment><comment><USER32> Dropbox is a good service, and I am sure file access is limited to a few employees, but I wouldn't use it for sensitive data or for a business. Any service where you do not control the encryption keys, e.g. Box.net, and myriad others will have the same issue. It's all about tradeoffs. Ultimately they can access your data. The truecrypt option may solve it for some but that means the whole archive has to be shared.

AltDrive unlimited online backup versions your files and allows you to control your encryption key. It runs on *nix, OSX, Windows, and other OSs. <http://altdrive.com>

</comment><comment><USER33> I don't know if that's how dropbox does it, but I could imagine that they have a master key to which normal employees don't have access, you need the founder and a trusted second person to retrieve it.

Thus their statement "Dropbox employees aren't able to access user files, and when troubleshooting an account" wouldn't be too far off the mark, and they can still make the data available to the government, on request and with higher effort.

</comment><comment><USER34> forgive me if I'm naive, but can file hashes be spoofed in any way? I'm thinking upload a bunch of files that hash to random numbers, then download the de-duplicated original files.

could someone more knowledgable in this area tell me if this is a credible threat?

<comment><USER34> and is the hashing done by the client, or server-side? because client-side would make spoofing even easier.

<comment><USER35> Client side. If you upload a very popular 500+mb file, maybe try a popular linux distribution iso, it will sync instantly.

<comment><USER36> so has someone written a client where you just enter hashes of popular files you are interested in and get them snyced to your dropbox?

<comment><USER37> As far as I know, not yet. It's not even publicly known how exactly the deduplication API works.

For example: is the hash enough to "prove" you have a file? Or do you need the file size (and potentially other properties, such as the first block) as well?

The only way to find this out would be to look at the protocol that the proprietary client uses.

</comment></comment></comment></comment></comment><comment><USER38> All US companies will comply with government requests for data, even Google, when a warrant is presented.

If you don't want anyone looking at your data, use your own strong encryption layer and hope that there's not a back door.

</comment><comment><USER39> I don't use Dropbox because their app on my computer have access to my computer. The data I could send to Dropbox are as secure as the data i send to a host or email server. ... or may I wrong. :)

<comment><USER40> You can sandbox it.

</comment></comment><comment><USER41> If I steal your ssh private key, I can do anything I want

</comment><comment><USER42> truecrypt ftw

If you're uncomfortable with dropbox, put a truecrypt partition right inside your dropbox folder.

<comment><USER10> In theory, if multiple snapshots of truecrypt are maintained, I believe it must be secure, but did the designers of truecrypt keep that in mind? Does dropbox maintain periodic snapshots of uploaded files?

<comment><USER43> Unlimited versions within last 30 days for all free and paid users (including changesets where files are deleted), paid users can also pay extra to keep every version since file creation.

So if you were suspected of getting a secret file and placing it in a dropbox hosted truecrypt volume, there would be a record of the time/date of altering the truecrypt volume and the possibility to compare the differences between two versions.</comment></comment></comment>


C++ Just My Code Stepping in Visual Studio - <AUTHOR> https://blogs.msdn.microsoft.com/vcblog/2018/06/29/announcing-jmc-stepping-in-visual-studio/ <comment><USER2> Great. Now if they can actually fix the debugger to lock onto a single thread when stepping thru multithreaded code. Currently when you set a breakpoint and step, you'll be jarringly switched back to the breakpoint when another thread hits it. The solutions now are tedious : [https://visualstudio.uservoice.com/forums/121579-visual- stud...](https://visualstudio.uservoice.com/forums/121579-visual-studio- ide/suggestions/8543248-make-the-debugger-stick-to-the-current-thread-inst)

<comment><USER3> The problem is that the normal implementation of a breakpoint/step is replace a single byte with a 0xCC opcode (INT 3), which will be hit by every thread. Making it lock onto a single thread would require a conditional breakpoint, checking the thread ID every time that code path is executed, which might potentially use a lot of CPU. I'm not sure that kind of conditional breakpoint has hardware support.

It's definitely possible to implement, but not as easy as using a regular INT 3 instruction.

<comment><USER4> Should be doable with help from the operating system to have thread-local storage for the code segment when debugging.

<comment><USER3> That sounds like a pretty good idea, would be nice to see gdb implement something like that.

</comment></comment></comment></comment><comment><USER5> Someone had a useful gdb trick in a previous post:

[https://news.ycombinator.com/item?id=17427001](https://news.ycombinator.com/item?id=17427001)

""" with gdb 7.12 or later, you can exclude files matching a glob with "skip -gfile", e.g. "skip -gfile /usr/*" """

</comment><comment><USER6> Using libClang and gdb: [http://jefftrull.github.io/c++/gdb/python/libclang/llvm/2018...](http://jefftrull.github.io/c++/gdb/python/libclang/llvm/2018/04/30/stepping- with-libclang.html)

</comment><comment> a-dub It would be pretty funny if they extended it to "just my uncommitted changes." ie: I want to step through every line I have written, but skip everything else...

</comment><comment><USER7> It is funny how long this has been an issue and how I and so many people have given up stepping in and instead jump to the actual user function, set break point, and then step over at the source location, then unset the breakpoint and continue. A bunch of crazy steps which you end up doing again and again.

Needless to say, this improvement is much welcomed!

<comment><USER8> Visual Studio even created the "Jump to here" option to do just this, but I agree this is how we all did it for a long time.

</comment></comment><comment><USER8> As a developer spending hours a day in Visual Studio with C++ as primary language this is a major improvement in terms of development time. Debugging is a a time consuming task in any language, but library headers from STD and Boost slow down the process tremendously.

<comment><USER9> Although it does help, I would say its only a bit faster than actually just setting a breakpoint of where you want the code to stop, and running till then, unlike Microsoft's example which shows 85 step intos, as if people actually do that.

<comment><USER10> It depends on the purpose of your debugging. If you know exactly where you want to go then, as you say, this has diminished value. but debugging can often be exploratory, in which case this feature could be a real timesaver.

</comment></comment></comment><comment><USER11> I love this idea. I wonder if something similar could be ported/achieved for JavaScript!

<comment><USER12> Not exactly the same, but you can use blackboxing [1] in the Chrome DevTools to isolate code you've written from library/framework code in the debugger.

[1]: [https://developer.chrome.com/devtools/docs/blackboxing](https://developer.chrome.com/devtools/docs/blackboxing)

<comment><USER11> Thanks for this! I didn't realise this feature existed.

</comment></comment></comment><comment><USER13> I would love to know the best Linux/OS X GUI debugger... and can it do this?

<comment><USER14> I don't know if there are any good Linux GUI debuggers, but gdb is a comprehensive debugger and can do something similar with the skip command.

Any gui debugger for Linux is probably a frontend to gdb, so as long as it lets you passthrough commands to gdb it can do this.

</comment></comment><comment><USER15> Why does this require a special compiler switch? Can't the IDE just auto-step until it gets back to your own file of code?

</comment><comment><USER16> Why has it taken this long for something so obvious to be implemented?

<comment><USER17> So that people with VS2015 would have to buy new version...

<comment><USER18> I know you're sarcastic, but this was common practice at my previous shop.

</comment></comment></comment><comment><USER19> Just a clarifying note : this is the closed Visual Studio, and not free software - VS Code - which usually does the rounds on HN.

I'm far more excited about the LSP protocol for C++ which would bring like this to all IDEs.

<comment><USER20> I don't think the LSP includes any debugging support?

<comment><USER19> I meant the sister/offshoot of LSP:

[https://github.com/Microsoft/vscode-debugadapter- node/tree/m...](https://github.com/Microsoft/vscode-debugadapter- node/tree/master/protocol)

[https://code.visualstudio.com/docs/extensionAPI/api- debuggin...](https://code.visualstudio.com/docs/extensionAPI/api-debugging)</comment></comment></comment>


Lobster, a game programming language - <AUTHOR> http://strlen.com/lobster <comment><USER2> Do you want lobster.io? I'm using it for something super important (as you can see), but this seems more ... deserving.

<comment><USER3> I agree that is indeed very generous! I am not sure I need it though, as I am fine having the main lobster page be a subpage of my personal wiki for the moment. That said, if it gets popular, it might be useful. Wanna hang on to it for the moment? Or email me about it - my username at gmail

<comment><USER2> No problem. Let me know if/when you're interested!

<comment><USER3> shoot me an email if you can, can't seem to find yours online.

</comment></comment></comment></comment><comment><USER4> Wouter van Oortmerssen is someone anyone interested in programming languages should be aware of - he's developed a ridiculous number of languages ranging from the very useful to bizarre and novel experimental.

I've been a fan ever since I was programming AmigaE, and it was the first and only development tool I've spent money on.

<comment><USER5> Wouter is has done amazing stuff, especially considering he is one person. Wish I was that productive.

</comment></comment><comment><USER6> I especially like his screenshot: A little minecraft clone with its code in a single image.

[http://i.imgur.com/ZZWFkXn.jpg](http://i.imgur.com/ZZWFkXn.jpg)

<comment><USER7> Yeah ... although there's some serious inflation about what is a "Minecraft clone", it's still pretty impressive.

I loved the highlevel-ness of the call to:

        camera_FPS_view("w", "a", "s", "d", 10, 4);

<comment><USER8> _Dude_ , it took me like 2 stackoverflow questions to get that working in pygame! (sadly not for a game, just a 3D visualiser for helping me debug my PhD code.)

This language is even more awesome than I thought :)

</comment></comment></comment><comment><USER9> At first glance it seems like an amazing language. Very few basic building blocks, and yet it manages to capture a good deal of the advanced features of modern languages. Nice, parsimonious syntax too. I especially like the Rubyesque way blocks are passed to functions.

Couple of things I imagine might bother me:

* Lack of upwards funargs. The reason stated is performance. I realise that it's complicated to implement, but it might be possible to start out with cheap blocks and promote them later to full closures if necessary.

* Reference cycles as an error. It's pretty easy to create these in legit circumstances. Maybe something like Python's auxiliary GC could be useful here.

<comment><USER3> Thanks! \- considering adding "full" closures at some point, so far haven't felt the need. We'll see how unbearable this gets eventually :) \- it does have a GC, which needs to be manually invoked. In games, that means you can decide to run it only on level start/end, etc

</comment></comment><comment><USER10> It's been out for 2 hours and there's still no SublimeText syntax package?

</comment><comment><USER11> The sound system appears extremely primitive. I also don't seen anything that makes game programming particularly "easy" over just using regular, ol' graphics and sound APIs in a general purpose language.

<comment><USER12> it makes it simpler to write small opengl games as it does a lot of setup for you.

<comment><USER11> That is such an incredibly miniscule bit of code that it seems ludicrous to pigeonhole yourself into a DSL just for that, especially considering that SDL does that for you, too.

</comment></comment></comment><comment><USER13> Is it a thought experiment or something that author suggests people use for real-world commercial projects? It would be nice to see some sort of feature comparison table (vs Lua, vs JS etc.).

<comment><USER14> There is [http://strlen.com/files/lang/lobster/C_style%20language%20Ch...](http://strlen.com/files/lang/lobster/C_style%20language%20Cheat%20Sheet%20for%20Lobster.html)

<comment><USER11> >> Lobster: v := [ 1, 0, 0 ]:xyz >> C#: var v = new xyz(1, 0, 0); you'd actually have to define the constructor in C# to be able to do this

well, not exactly. You could do: >> var v = new xyz{x:1, y:0, z:0};

<comment><USER15> Also in C#: | var a = 1; | vs | dynamic a = 1; | I think there should be a version number next to language name to avoid false impression.

<comment><USER3> You are both right. My use of C# is deliberately basic to give users of other languages a good chance to follow it too.

</comment></comment></comment></comment></comment><comment><USER16> Interesting syntax, it's the first sane-looking block-based Python-like syntax I've seen.

</comment><comment><USER17> I tried to find a way to store a function in an object to call later, and after fighting the syntax I hit a bus error. I guess that is only possible with full closures.

I was trying to have a vector of behaviors for my sprites, which would hold arbitrary functions to call when updating the sprite. I don't need to capture any variables, so I don't actually need a closure. But the scope in which the anonymous function was initially created is long gone, so that's probably the issue.

I'll see if co-routines can solve this for me ...

</comment><comment><USER17> At first glance I love this syntax. I'll have to pull out some of my hypothetical syntax notes to see if any holes I came up with for my language attempts apply here, but I very much like it.

Using high-level function constructs for main language flow control features seems to be in vogue. Rust does it too. I liked it when I learned Scheme and have been wanting it to be more main stream since then. That's probably why I like Ruby, since Ruby's blocks are close for many uses.

I'll play with this more when I get home tonight.

<comment><USER17> I did a little playing with it last night.

I find that one can do object-oriented things, but constructors are a bit of a catch.

        struct A : [a, defaulted]
        struct B : A [b]

        //You can do it this way,
        //but each subclass has to init every field (brittle)
        function MakeA(a): [a, 99] : A
        function MakeB(a,b): [a, 99, b] : B

        //Or use the super constructor syntax
        //but this uses a copy and is less efficient
        function MakeA(a): [a, 99] : A
        function MakeB(a,b): [super MakeA(a), b] : B

        //Or something in between
        function InitA(me::A, theA): a = theA; defaulted = 99; me
        function MakeA(a): new := [0,0]; new.InitA(a)
        function InitB(me::B, theA, theB): me.InitA(theA); b = theB; me
        function MakeB(a,b): new := [0,0,0]; new.InitB(a,b)

I'll keep playing with it and see what else I discover. I haven't gotten far enough to use coroutines, multi-method, or to make my own control structures yet.

<comment><USER3> the second option is the intended one, yes. I'd only switch that out to first one if you ever found that allocating objects is the bottleneck in your code, which it shouldn't be.

</comment></comment></comment><comment><USER18> At first sight I thought "meh" but then I saw multimethods and coroutines. I will definitely spend some time with this new toy.

</comment><comment><USER19> +1 for the link to the Java AbstractSingletonProxyFactoryBean class doc.

<comment><USER20> It was like inception going through the superclasses trying to get at some explanation of what a bean is. I decided I don't want to know bad enough when I was 5 levels deep.</comment></comment>


Facebook will study whether its algorithms are racially biased - <AUTHOR> https://www.theverge.com/2020/7/21/21333405/facebook-instagram-racial-bias-equity-team-formed-ai-algorithms <comment><USER2> Hmm... looks like the boycotts are having an impact. It's always surprising (but shouldn't be) that lip service often turns into action only and if the bottom line is impacted.</comment>


Set Theory: Should You Believe? - <AUTHOR> http://web.maths.unsw.edu.au/~norman/views2.htm <comment><AUTHOR> Question for the people reading this:

I thought this was interesting, and the upvotes show that others here on HN agree. But this item is now ranked below 850 and falling - clearly it's being flagged.

I don't much like StackOverflow, MathOverflow and similar - I much prefer the style of HN. If I provided an alternative to HN that overcomes this problem, would you be interested?

<comment><USER2> I certainly would be. I've noticed similar problems in the foundations of mathematics and I'd be very interested in an alternate system (and a strong defense of how this new system overcomes the problems found in other systems).

</comment></comment><comment><USER3> [update: better use the wayback link]

cache: [http://webcache.googleusercontent.com/search?q=cache:oyOudsA...](http://webcache.googleusercontent.com/search?q=cache:oyOudsA59NwJ:web.maths.unsw.edu.au/~norman/views2.htm+set+theory+should+you+believe&hl=en&gl=cl&strip=1)

(there's quite a few annoying typos with the text "MATH" - is that a problem with the cache, or was the article converted from some other format, poorly? ah, thanks to the wayback link - those are cache errors)

summary: it's a rant (i'm not being critical here - it's quite interesting, but that seems the best description) against standard set theory as the basis for mathematics (more generally, a rant against an axiomatic approach at all). but it doesn't really offer much in the way of alternatives. no mention of constructivism or intuitionism.

<comment><USER4> What about the following sentence?

"At no point do we or should we say, `Now that we have defined an abstract group, let's assume they exist'. Either we can demonstrate they exist by constructing some, or the theory becomes vacuous."

Doesn't that imply constructivism?

<comment><USER3> well, yes, i think the article as a whole is heading in that direction. all i meant was that it doesn't get into any details - it wasn't meant as criticism, i was just trying to explain that it stopped before that point.

</comment></comment></comment><comment><USER5> So Mr. Wildberger has rediscovered mathematical constructivism. This article would have been more newsworthy around, say, 1920.

</comment><comment><USER6> I don't buy this rant. I found his last argument a bit weak. Just because you can't write a number because it is so big, it doesn't mean it can't be simbolized by a handful of characters, or abstracted successfully.

Also it is more powerful to abstract than it is to enumerate.

<comment><AUTHOR> Here's the thing.

Let's suppose you write down all the syntactically valid 1 byte programs (in some language, say, Python). there aren't many of them, and you can certainly write them all down.

Now write down all the syntactically valid 2 byte programs, then 3, then 4, and so on. Now you have a list of all valid programs.

Some won't terminate, and some won't print anything, but any number that can ever be computed by any program will be printed by (at least) one of these.

But there are only countably many of them. That means that most of the numbers between 0 and 1 will not be printed by _any_ program. Ever.

Are you now still happy talking about the collection of all the reals? Most of them (by which I mean uncountably many compared with countably many) can never be printed or calculated.

<comment><USER6> Well, I'd say then, that's what abstractions are for!

Seriously, I think that's part of the role of abstractions, and that's why we _currently_ can talk about and use reals.

Even though we can't write the entire Pi number, and the program used to calculate all its digits might never finish, we do have a symbol for it, and put it to good use. What do you think?

<comment><AUTHOR> But we _do_ have a symbol for _pi_ and we _can_ write a program which, for any required N, can print the first N digits.

But there are only countably many numbers for which that is true. Uncountably many numbers _cannot_ have symbols and _cannot_ have programs to represent them. If we can never name them, not even in principle, does it make sense even to say that they exist?

(Note: Don't think you can extrapolate my own personal view from the above, I am merely pointing out that there are non-trivial questions here, questions that most people don't seem to notice or understand.)

</comment></comment></comment></comment><comment><USER7> archive.org's wayback machine has it ... [http://web.archive.org/web/20110616020815/http://web.maths.u...](http://web.archive.org/web/20110616020815/http://web.maths.unsw.edu.au/~norman/views2.htm)</comment>


Placeholder – Offline Coarse Geocoder Backed by SQLite - <AUTHOR> https://github.com/pelias/placeholder <comment><USER2> Awesome. I've been doing a bunch of geocoding recently and looked into self- hosting to get around the Nominatim (Open Street Map API) rate limit. In the past I used the datascience toolkit for this, which was awesome, but is no longer maintained. [http://www.datasciencetoolkit.org](http://www.datasciencetoolkit.org). Nominatim also has self-host instructions [https://nominatim.org/release- docs/latest/admin/Installation...](https://nominatim.org/release- docs/latest/admin/Installation/)

I decided not to self-host after seeing the spec requirements for Nominatim (64gb ram!). Much more than the old DSTK.

Looks like the specs to install this are much less, aboutt 8gb ram and tens of gb storage. Maybe i'll give it a try.

<comment><USER3> You can get 64GB this with Hetzner for less than $100 a month I think if you need the higher level of precision.

<comment><USER4> For around $45 [https://www.hetzner.com/sb?ram_from=9&ram_to=13](https://www.hetzner.com/sb?ram_from=9&ram_to=13)

</comment></comment></comment><comment><USER5> Neat. I was going to moan that the boundary for Lewisham was far too wide but I double checked with Wikipedia and nope, it covers the extremities of Lewisham correctly.

</comment><comment><USER6> Does not work for my address in Germany.

</comment><comment><USER7> More like super-coarse, I'm not sure how is this useful.</comment>


It May Be a Sputnik Moment, but Science Fairs Are Lagging - <AUTHOR> https://www.nytimes.com/2011/02/05/us/05science.html?hpw <comment><USER2> > In middle school, science fair projects are typically still required — and, > teachers lament, all too often completed by parents. And some high schools > funnel their best students into elite science competitions that require > years of work and lengthy research papers: a few thousand students enter > such contests each year.

Making them required makes them dull; the types of projects available to students without the "elite" (in my opinion, potentially worthy) status are also pretty dull. For my forced science project I tried to get away with doing something with potatoes and electricity, but the teacher said I should do something in programming instead so I did something or another about various benchmarks and controlling for caching... useless, but got me a grade and didn't consume my time.

Do parents still really do projects? I thought the "chili volcano done by Dad" has been consigned to sitcoms.

> But what has been lost, proponents of local science fairs say, is the > potential to expose a much broader swath of American teenagers to the > scientific process: to test an idea, evaluate evidence, ask a question about > how the world works — and perhaps discover how difficult it can be to find > an answer.

There's another set of classes that can do this far more effectively than a science project where most entries are BS and uninteresting (I have nothing against the interesting ones, a guy at my high school did some work with MEMS which was pretty cool, he had the best project of the whole district at least). That set of classes is programming. Every time you run the program, you're testing your hypothesis that it works. Errors give you evidence of what is causing the problem, which leads you to question how the computer works and how to get your program to work. More focus on everyone having a "Basic Programming Literacy" seems a lot more useful than funding the multitudes of BS science fair projects.

A quick comment on why I think so many science fair projects are BS... If it's not worth trying to independently replicate results later, it's not useful science. And in the same vein, if it's been replicated a hundred times, it's probably better to look at something else. (No more potatoes-generate- electricity or chili-volcano projects!)

The solar powered car they showed Obama examining looked pretty cool, I'm all for more projects of that sort (unless it's just a reimplementation of a solved engineering class project). Instead of trying to prop up the current faulty system of science fairs, we should create a new system dedicated to producing useful science (where a three-panel poster board isn't required).</comment>


Ask HN: Is a junior software engineer looked down upon for starting a business? - <AUTHOR>

Hi HN, I am a graduating software engineer that will be launching my own startup soon. What started out as a side project has turned into something I believe other people would use. I have now decided to make it into a business!
As a software engineer I want to work for a startup but I am worried that my ambition may be a turn off for companies. Is a junior software engineer that has started a company unattractive to employers or is it a plus? This question can be abstracted to include all engineers/professions.
P.S. I wouldn't mind advice on company organization types (LLC, S Corp, C Corp) or anything else relating to starting your own business. <comment><USER2> Echoing the other 2 commentators, especially kls, if this damages your changes at a particular startup "you do not want to work there", just as long as you can convince them you'll be happy to also work for others (in a startup environment) as well as being the top dog. Heck, it's likely to be a mutual learning experience: you and the company you're joining will have things to teach each other. One weird thing I helped a number of startups I worked for was real estate (in their case leasing office space), based on what I had learned while growing up from my father and grandmother.

</comment><comment><USER3> Quite the contrary. Having an education and relevant technical experience are all good, but what separates the merely good candidates from the excellent is that the latter have proven that they can get stuff done by their own initiative, that they've actually used their skills for something real.

Contributing to an open source project? Excellent. Writing your own research papers and contributing to a standards organization? Wonderful. Running your own business? Perfect.

</comment><comment><USER4> Off the cuff, catch all answer, You want to file an S Corp there are tax benefits to doing so. The better answer is talk to a tax professional.

As for damaging your ability to find a job, initiative will never hurt you and if it does you do not want to work there.</comment>


Why can't humans believe contradictions? - <AUTHOR> https://philosophy.stackexchange.com/questions/14323/why-cant-humans-believe-contradictions

<comment><USER2> If you haven't already done so, nothing will further clarify your understanding of politics, literature, religion, and in short human beings, than to free yourself from the unsupportable notion that the human mind has _any problem_ sustaining contradictions.

 _EDIT_ : If you happen to live in the US, I especially recommend considering this experiment, 2014 being an "election year".

 _EDIT_ : To downvoter, I understand that this sounds pretentious, and maybe is also OT. But I am in earnest. On HN we spend a lot of time pointing out logical fallacies, and I love that. But in the world at large, I believe it is largely a wasted effort. The sooner we accept that we ourselves would not escape the notice of our own wtf-dar, the sooner we can get to the heart of the arguments worth having.</comment>


Integer Square Roots - <AUTHOR> http://www.embedded.com/98/9802fe2.htm <comment><AUTHOR> If you feel bored at the start of the article, Scroll down to "The friden algorithm".

Flashback: I found the Friden algo part of this article printed and abandoned (wasted) in a common room in uni. Took home one copy (There were few for some reason) and loved it. Today I found embedded.com article on HN & looked for this article. And thought HNers would love.

<comment><USER2> Thanks for the tip. I skipped down to the friden algorithm and it was an interesting story.

</comment></comment><comment><USER3> > "When I'm starting on a new algorithm, I sometimes find it's both fun and > instructional to begin by trying to see just how simple-minded an algorithm > I can write. I think I do this just to prove to myself that the problem can > at least be solved. From there, anything else is mere refinement."

This is excellent advice.

</comment><comment><USER4> Yeah. Solved it 16 years ago as an intellectual game. comp.lang.c was my Hacker News at the time ;)

See [http://groups.google.fr/group/comp.lang.c/browse_thread/thre...](http://groups.google.fr/group/comp.lang.c/browse_thread/thread/229c0a6f0d0c031c/5aacf5997b615c37)

The method is very simple. We know how to compute the square of a value. So start by finding the biggest integer value with a single bit set whose square is smaller than the input value. Then set the bit just below to one, compute the square of the value and compare it with the input value. If it is bigger, the bit should be 0 otherwise it should be left to 1. And so on.

The thing is to avoid the multiplication to compute the square. So if you have a value n and you want to set a bit to one. We compute in fact the square of (N+B) where B is an integer with the bit to set to one, set to one. We then have (N+B)² = N² + 2NB + B² The last term is easy to compute from the previous B with the previous bit set. We simply divide by 4. 2NB is computed by a simple shift and N² is the result of the previous computation.

For fixed point, we benefit from the fact that while we progress in computing the square root, we have an increasing number of bits set to 0 in the most significant bits of the values. I then simply shift up to get usable bits in the less significant bits.

The only limitation is that we need the sign bit of the fixed point. So the computation won't work with big unsigned fixed points. This is solved by unwinding the first iteration.

It took me some time to understand all this. All I had was a short code to compute integer square root and I had no idea how it worked.

</comment><comment><USER5> I believe after the first formula in the text:

 _In the vicinity of the correct root, the method converges exponentially, meaning that it gives twice as many digits of accuracy at each step_

should instead be _converges quadratically_

<comment><USER6> No, it is exponential in the number of digits of accuracy as a function of the number of iterations performed.

<comment><USER5> Yes, but I think this is what is called quadratic convergence if the exponent is 2, as it is here. See for ex. [http://sepwww.stanford.edu/public/docs/sep97/paul1/paper_htm...](http://sepwww.stanford.edu/public/docs/sep97/paul1/paper_html/node5.html)

<comment><USER7> Don't cross purpose each other.

In fact it's somewhat interesting, that quadratic error decay equals exponential precision growth:

      0.1^2 = 0.01
      0.01^2 = 0.0001
      0.0001^2 = 0.00000001
      ...

Value equals error; number of zeros equals precision _measured as number of digits_.

</comment></comment></comment></comment><comment><USER8> I wont lie, I went straight for the Taylor approximation. According to wikipedia:

"As an iterative method, the order of convergence is equal to the number of terms used. With 2 terms, it is identical to the Babylonian method; With 3 terms, each iteration takes almost as many operations as the Bakhshali approximation, but converges more slowly. Therefore, this is not a particularly efficient way of calculation."

Heh, woops. My second inkling was the way slide rules do it: exponentials and logarithms ( sqrt(n)=exp(.5*ln(n)) ) Turns out that's more on target:

"Pocket calculators typically implement good routines to compute the exponential function and the natural logarithm, and then compute the square root of S"

<comment><USER7> _Pocket calculators typically implement good routines_

Yeah, they are accurate, but don't need to be fast. The blink of an eye is a long time.</comment></comment>


Face Masks Considerably Reduce Covid-19 Cases in Germany - <AUTHOR> https://www.iza.org/publications/dp/13319/face-masks-considerably-reduce-covid-19-cases-in-germany-a-synthetic-control-method-approach <comment><USER2> It looks like this is the equivalent of a preprint. So, while an interesting finding, a general reminder to take it with a grain of salt and recognize that there might be issues in the statistics (maybe confounding variables that weren't controlled for) that would lead to revised results if fixed, and we've also seen peer reviewed publications like the Lancet paper that were also hit with data integrity issues. It's a good data point to keep in mind, and you should probably be wearing a mask, but we'll need a meta-analysis of a lot of these studies over the next year or so to know to any level of certainty how much they actually helped. That's not useful for our behavior right now of course, but in terms of drawing conclusions, always keep in mind that initial analyses lime this are just that, initial. From the paper:

"IZA Discussion Papers often represent preliminary work and are circulated to encourage discussion. Citation of such a paper should account for its provisional character. A revised version may be available directly from the author."

<comment><USER3> This is a completely vapid and entirely generic attack that could be posted, verbatim, in any discussion of any research paper.

I'm barely exaggerating with "verbatim": remove the parenthetical ", and you should probably be wearing a mask" as well as the quote at the end, and read it again. It could be concern-trolling any statistics paper, ever!

And what's the point, exactly? Sometimes, results from research later turn out to be wrong, and therefore it is best to completely ignore them? At some point you'll deign enough time to have passed to allow some research to be useful. But until then, you also recommend masks, because..? How is your hunch a better barometer of truth than actual research using real-world data?

<comment><USER4> Indeed. The first response to anything challenging someone's (imprinted?) worldview is to nit pick on some detail, in order to invalidate the uncomfortable thesis with which they are presented.

<comment><USER2> This paper isn't challenging my worldview. It's supporting it. I posted the disclaimer because the paper is a preprint and it's easy to not get that fact when you just look at the title of this post and scroll through the comments.

</comment></comment></comment></comment><comment><USER5> I can only speak to Frankfurt (am Main) and Munich, but particularly in the last week as weather has improved the general public's concern towards the virus seems to be very low. Shopping areas are swamped with people, walking around in groups, queueing outside stores with very little regard for keeping even a polite distance from other people (even without a pandemic). Anecdotally, in a train Station on Friday I was waiting outside a bubble tea shop for around 10 minutes, and perhaps 5-10% of people were wearing masks properly (if at all) and even attempting to keep more than a metre distance from other people.

Bars and clubs have for some reason re-opened contrary to rules set by the local governments, I have seen 0 proactive or reactive enforcement of any rules by police or other authorities.

Some places are enforcing mask use, in supermarkets for example every customer is required to wear a mask and take a trolley to try and keep distance between customers, but the number of people wearing masks only over their mouths and leaving their noses exposed, or simply abandoning their trolley once inside and moving very close to other people is very high.

<comment><USER6> Indeed, the confused and fragmented situation caused by each county inside Germany having its own super-detailed and ridiculous rules is making compliance plummet.

The 1.5-2m idea is anyway a failure:

* first of all, it only allows one to dodge larger droplets.

* second of all, it's humanly impossible to respect this rule. When meeting acquaintances or friends there's a constant unconscious pull to get closer - in practice the distance is 70cm and often less. Crowded areas and narrow corridors or pathways make a mockery of it likewise.

The obsessive focus on hard to implement personal distancing and aversion to masks is embarrassing.

</comment></comment><comment><USER7> It is indeed very surprising to see the sharp drop in Covid-19 cases in Germany. If I understand correctly, this is also not a randomized trial. I am not sure how they constructed the "control" group here to which they are comparing. It is a synthetic group where they extrapolate cases from n-7 days where n is the day of introduction of mandatory use of masks?

It is hard to not be tempted to think about several confounding variables that could have played a role in the drop that is seen, like people being more vigilant, following distance guidelines, working from home more often, the list goes on. Nevertheless, it was an interesting read.

<comment><USER8> > like people being more vigilant, following distance guidelines, working from > home more often

Germany was in "lockdown" mode (in quotes because their lockdown never actually needed to be that strict due to proactive reaction) way before requiring masks, that's why they're such a good case study

All the things you've listed as potential confounding variables are much more likely to have gone in the opposite direction due to lockdown fatigue. It's extremely unlikely that everyone suddenly got much more vigilant two months into the pandemic

<comment><USER7> The opposite of "lockdown fatigue" could also happen where people get used to and better at carrying out the necessary restrictions and precautionary measures in their day to day life. There's just not enough hard evidence to be sure what factors would cause what effect in any un-controlled experimental setting.

Nevertheless, masks don't hurt so one should go with the Pascal's wager argument.

<comment><USER6> No, people just don't care any more, at least in my area. I think masks are only worn now in in supermarkets and doctor's practices because it's mandatory and people are not keeping distance any more, meeting friends, going out in groups, etc.

If one didn't know better, it all looks like business as usual.

<comment><USER9> It's probably both. Half of my close family is vulnerable and so we are still taking it very seriously. Some of my neighbours have been casual about it all the way through.

</comment></comment></comment></comment></comment><comment><USER4> There are clearly potential upsides (in terms of saving lives) of mandatory public mask wearing. What are the potential downsides (in those same terms)?

<comment><USER10> That's your opinion. I haven't seen anything proven yet.

And "saving lives" has become the new "think of the children" excuse for irrational public policy and laws. All public policy requires a cost-benefit analysis.

For example, banning cars would reduce automobile fatalities by 30,000/year in the US. But we aren't banning cars.

<comment><USER7> We aren't banning cars because we understand the cause of automobile fatalities. There are well defined laws and regulations implemented to curtail those fatalities. But people still choose to drive irrationally, they choose to disobey those regulations, violate the speed limits, so on and so forth putting their and other's lives in danger.

Going by this analogy, implementing mandatory masks is one such regulation to prevent covid infections and deaths as is implementing traffic rules to prevent automobile fatalities.

Since we have not had enough time to deeply understand the spread of this virus and its affect on all of us (unlike automobile fatalities), the state has no choice but to follow the safest policy that seems to work. But, of course, you are right to question whether this policy is the best we can do or not which remains to be seen as we witness the coming months.

<comment><USER10> > implementing mandatory masks is one such regulation to prevent covid > infections

Again, we don't know that.

"Doing something, anything" is not better than doing nothing.

</comment></comment></comment></comment><comment><USER11> Surprising considering hardly anyone wore them. <edit video link was from last year></comment>


Blank Keyboards (Das) - <AUTHOR> http://maximharper.co.uk/post/23924579501/daskeyboardultimate <comment><USER2> Mechanical keyboards are amazing. Typing on one is actually a pleasurable experience. I could go on about the benefits but other people have written guides that are much better than what I could post here. Here is one great guide. <http://www.overclock.net/t/491752/mechanical-keyboard-guide>

What I will say is that for anyone that has a job that involves massive amounts of typing I really recommend you invest in one.

I personally do not like Das because of the glossy finish which makes smudges and fingerprints very noticeable. I currently own a leopold tenkeyless with cherry brown switches, which I find to be great. The guide I posted goes into great detail over the different types of switches and the value of keyboards so you should read over it if you are interested.

<comment><USER3> How noisy is it? Can you type at midnight with someone sleeping near you?

<comment><USER4> > Can you type at midnight with someone sleeping near you?

No, you can't. Not even with the "silent" model.

</comment></comment></comment><comment><USER5> I have been using the Das ultimate for a couple of years now. Typing IS much faster, although using the windows version on a Mac can be frustrating at times, especially if you've used it on Windows first.

I also noticed some wrist fatigue at first, although I put this down to the lack of wrist support (I'd been used to working with a high support integral to my keyboard before this, and laptops where the keys are the same height as the wrist rest). A £7 wrist gel thingy has served me fine from a week after the Das arrived, although it does now look a bit dirty.

I've used it in two offices, for years, noone has complained about the noise ever.

And finally, I really like the number pad, especially when the numbers across the top have no markings - I still mash the wrong symbol keys at the top fairly frequently.

</comment><comment><USER6> My blank apple keyboard: [http://www.flickr.com/photos/deadsunrise/4338226640/in/photo...](http://www.flickr.com/photos/deadsunrise/4338226640/in/photostream)

It took me about 3 hours to sand all the keys.

<comment><AUTHOR> That's amazing!

</comment></comment><comment><USER7> QUOTE : >"In 2005, in a personal quest to improve his own typing speed and accuracy, Metadot Corporation founder and self-proclaimed "Uber Geek" Daniel Guermeur asked to have a totally blank keyboard created. To his surprise, his typing speed doubled after just a few weeks of use."

When reading the history of _Das Keyboard_ I get the feeling that the founder (Daniel Guermeur) felt an increase in typing speed due to the "blank" keys?

As hackers tend not to look at the keyboard when typing, is there any reason to have blank keys other then the badass feeling of it?

<comment><USER8> The only reason I can think of is to confuse your coworkers. Maybe it's to force people to learn to touchtype by going cold turkey on the visual aid?

As far I as I can tell it's just an overpriced gimmick.

<comment><USER9> I think the price is fairly standard for a mechanical keyboard... not that it is cheap.

</comment></comment></comment><comment><USER10> Can anyone speak to the difference in key feel between using one of these and using one of the more traditional modern-day Model M clones (e.g. Unicomp/<http://pckeyboard.com>)? I love the idea of getting a mechanical keyboard, but can't shake the feeling that the blank keys is just something of a gimmick.

<comment><USER11> Cherry MX Blue switches are similar in feel to the Model M style buckling spring switches but have I think a slightly shorter travel and require a little less force. Cherry MX Brown switches have a lighter touch and less of a click when the switch activates.

Probably you need to try them out for a while to decide which keys work best for you.

I used a Unicomp keyboard happily for a few years but am most comfortable with an MX Blue keyboard now.

</comment></comment><comment><USER11> I am a big fan of mechanical key switches; blank keys are partially a gimmick but also can be a useful tool to force you to touch type. I use a Filco tenkeyless board with cherry blue switches and blank key caps today and am very happy with it.

I have a Das Ultimate in the closet but overall I didn't like it. The usb controller was flakey and occasionally froze or doubled key strokes, hopefully they have fixed this issue but it was just too much. Other than that, it has a glossy finish that shows dirt and smudges too much and the size is overwhelming; I like to keep my trackpad close to the right side of the keyboard and having the number pad on that side meant a long movement.

</comment><comment><USER12> A tip for typing one handed, shift your hand from it's correct position to its mirror opposite i.e. from jkl; to asdf or vice versa it's easier than you would think to translate key memory if you do it like that, though it's still not exactly ergonomic.

I believe you can get footswitches and/or software that flips the keyboard for you so you don't have to move the hand back and forth if it's a more permanant situation.

</comment><comment><USER13> If you want to try this you can go the cheap way and just stick black stickers on your existing keyboard.

<comment><USER14> Or just stop looking at it. I've never understood this. Why does it need to be blank?

<comment><USER15> Because you may _think_ you're not looking, but -- unless you're a trained touch-typist -- you actually are looking. Even if only occasionally noticing something in your peripheral field of vision. 'Looking' is not necessarily a conscious act.

<comment><USER14> I thought we were all trained touch-typists?

How on Earth would we work if we didn't? That'd be like having a workstation with 256MB of ram.

Again - I don't get it. If you look at the keyboard ever, you're Doing It Wrong.

If you don't look at the keyboard, then it doesn't matter if there are letters on it or not.

Buying hardware is not the solution to "I don't know how to touch type".

<comment><USER9> Well it is _a_ solution. Because you won't be able to look at the keyboard, you will learn much faster and get rid of the last looks at your keyboard. Another (cheaper) solution is to put a cloth on your hands when typing so you don't see the keyboard.

</comment></comment></comment></comment></comment><comment><USER16> Its a beautiful keyboard... perfect for us dvorak users. I unfortunately had to leave my das in rochester with my main desktop because it couldn't be fitted in to the car.

I am typing this on a scissor switch keyboard...

</comment><comment><USER3> I wish they made tenkeyless. I'm trying to buy a Leopold but stuck in that "Paypal can't ship to a country that isn't the one you live" problem (I want to use a forwarding service).

<comment><USER17> Check out Geekhack.org or Deskthority.net. You may be able to find a keyboard from a member that's in your country or someone willing to act as a forwarding service.

<comment><USER3> I was able to buy, the seller generated a custom invoice for me. Thanks for the tip anyway. (There are some Model M's in Brazil, but it takes too much desk space IMO).

</comment></comment></comment><comment><USER18> I have a blank Das keyboard and after a lot of typing I find the extra pressure very noticeable and even fatiguing. I eventually switched back to my mac keyboard because of this.

</comment><comment><USER19> I have two, one for home and one for the office. If you balk at the price thing about how much RSI surgery will cost. Best Keyboard Available!

</comment><comment><USER20> I type by muscle memory, but I wouldn't use a blank keyboard. Brainfarts happen.</comment>


7 Startups That Seem To Be Doing Everything Right - <AUTHOR> http://williamgriggs.com/news/7-nashville-startups-that-seem-to-be-doing-everything-right/

<comment><USER2> Except for being in Nashville that is...

</comment><comment><USER3> balsamiq looks like a cool mock up creator (used by RentStuff.com), anyone care to share some other good ones?

</comment><comment><USER4> 7 _Nashville_ startups. Flagged, William.</comment>


Ask HN: What is so fascinating or interesting about the app Sketch? - <AUTHOR> So far there have been ten submissions of the announcement of the "Versioning, Licensing, and Sketch 4.0".  Why is this getting so much attention?  How many HNers use it?  Is it important?

    https://news.ycombinator.com/item?id=11861188
    https://news.ycombinator.com/item?id=11861255
    https://news.ycombinator.com/item?id=11861273
    https://news.ycombinator.com/item?id=11861329
    https://news.ycombinator.com/item?id=11861473
    https://news.ycombinator.com/item?id=11861553
    https://news.ycombinator.com/item?id=11861656
    https://news.ycombinator.com/item?id=11862255
    https://news.ycombinator.com/item?id=11862687
    https://news.ycombinator.com/item?id=11863487
 <comment><USER2> While a lot of people are switching to Sketch from other prototyping and design tools, I think it's getting attention for a couple of other reasons:

* Sketch are a darling of the Mac software scene who turned their back on the Mac App Store [1]. They were one of the top grossing apps, won an Apple Design Award from Apple itself, and yet they still found the Mac App Store situation so abysmal that they decided to go it alone. There's been a string of hardcore Apple-faithful who have quit selling via the App Store recently.

* They're now updating their pricing to a semi-subscription plan, which has been controversial when other companies have tried it (see JetBrains [2] and Smile Software [3]). It's a topic that may be concern to Sketch users, and also of interest to Mac developers who are still searching for viable pricing models.

[1] [http://mjtsai.com/blog/2015/12/01/sketch-leaving-the-mac- app...](http://mjtsai.com/blog/2015/12/01/sketch-leaving-the-mac-app-store/)

[2] [https://blog.jetbrains.com/blog/2015/09/04/we-are- listening/](https://blog.jetbrains.com/blog/2015/09/04/we-are-listening/)

[3] [http://www.imore.com/regarding-textexpander-and- subscription...](http://www.imore.com/regarding-textexpander-and-subscription- pricing)

</comment><comment><USER3> I think Sketch has become the default UI prototype tool for many people. Our designers use it created mock ups of web and mobile pages.</comment>


[Slides] Improve Your Life by Commoditising the Supply-Chain - <AUTHOR> https://thecodeartist.blogspot.com/2019/02/improve-your-life-by-commoditising-the-supply-chain.html <comment><AUTHOR> TL;DR: Model your challenge / problem-scenario as a supply chain.

      1. Identify the actors/entities involved.
      2. Identify the "item" in short supply.
      3. Commoditise the "item".

      Congratulations,
      you have found an "out of the box" solution
      to your problem.

\----

Recently presented this talk at BarCamp Bangalore Spring 2019.

During the session, we applied this technique to brainstorm how one could solve the problem of bad public infrastructure (eg. Good Roads) due to corrupt/inefficient public officials n developing regions.

\- There is already lot of public and private money (Corporate Social Responsibility) poured into solving infrastructure issues.

\- Workforce / Time is also NOT a constraint as there is no lack of expertise in developing basic infrastructure like roads.

Applying the "Commoditise the Supply-Chain" method, 2 potential approaches to this problem that we came up with were:

 _1\. Solve other basic problems first._

As long as people in the region have more pressing concerns that affect them directly, they will not unite behind the cause to improve roadworks to the level of first-world nations.

 _2\. Commoditise decision making._

Currently the people of a region do NOT get to directly decide which individual road they would like improved first. Having an app that detects rough-rides / potholes as you one rides daily, can help people to identify and upvote the worse stretches of roads that need to be fixed first.</comment>