Inside The Making Of The New "Dungeons and Dragons" - <AUTHOR> http://www.fastcodesign.com/3034062/designing-the-new-dungeons-dragons

<comment><USER2> "Let's assume since you're reading this, you are, or plan to be, a Dungeon Master. By now, you should be familiar with the rules in the _Player 's Handbook_. You've probably already noticed things you like or things you would have done differently. If you have, congratulations. You've got the spirit every Dungeon Master Needs. Curiosity and the desire to make changes, to do things differently because your idea is better than the other guy's -- these are the most important things a Dungeon Master needs. As you go through this rule book, I encourage you to continue to make these choices.

Choice is what the AD&D(r) 2nd Edition game is all about. We've tried to offer you what we think are the best choices for your AD&D campaign, but each of us has different likes and dislikes. The game that I enjoy may be quite different from your own campaign. But it is not for me to say what is right or wrong for your game.

(...)

Take the time to have fun with the AD&D rules. Add, create, expand and extrapolate. Don't just let the game sit there, and don't become a rules lawyer worrying about each piddly little detail. If you can't figure out the answer, MAKE IT UP! And whatever you do, don't fall into the trap of believing these rules are complete. They are not. You cannot sit back and let the rule book do everything for you. Take the time and effort to become not just a good DM , but a brilliant one."

\-- Foreword to AD&D 2nd edition's "Dungeon Masters's Guide", David "Zeb" Cook, 2/9/89

Sadly, very few people paid any attention to that foreword (players because the book was off limits, of course ;-).

It's a shame WotC/TSR didn't go forward with the idea of an open rule set, rather than going back to the more traditional model. It is nice to see them borrow some ideas from White Wolf though -- to this day, if I were to recommend a [edit: single] rule set for role playing, it would be something between the old and new World of Darkness rules (aka the Storytelling System).

</comment><comment><USER3> So I've been playing a Pathfinder game for the last year, but a lot of are pretty interested in the "5e" changes. Basically, they simplified a lot of the tedious bits of 3.5 and removed the weird role concepts. The Basic rules, which come as a PDF, are now available[1]. In general it looks closer to 3 than 4, but is still attempts to remove lots of the table calculation from the game.

What this article somewhat mentions and what seems really weird for people that like Pen and Paper and want to play this new edition is that they are releasing the CORE books over the span of a few months. It's kind of weird for players. Sure we get the Player's handbook this Tuesday, but without a DM book and a Monster Manual it makes things a little limited for a few months.

A decent portion of the core audience moved on to Pathfinder and feel pretty comfortable there. It'll be interesting to see if this push can sway us back.

The key part of course is you don't NEED to change. A lot of people still stick to old versions. I play once a month with a group of 5 others. It'll take us a couple years just to get through our current campaign in Pathfinder. Moving to 5E right now will just be a curiosity.

[http://dnd.wizards.com/sites/default/files/media/DnDBasicRul...](http://dnd.wizards.com/sites/default/files/media/DnDBasicRules%28No%20Background- PrinterFriendly%29_0.pdf)

<comment><USER4> > What this article somewhat mentions and what seems really weird for people > that like Pen and Paper and want to play this new edition is that they are > releasing the CORE books over the span of a few months. It's kind of weird > for players. Sure we get the Player's handbook this Tuesday, but without a > DM book and a Monster Manual it makes things a little limited for a few > months.

This is not new. It seems strange, but each and every edition of D&D so far has been released this way, one core book a month for three months.

It's a time-honoured tradition, but yes, a strange one. I just don't know the full details about _why_.

<comment><USER5> I think Mearls said somewhere that the staggered release was because their copy editing pipeline couldn't handle three releases at once.

</comment></comment></comment><comment><USER6> Pen and paper can never beat computer games at combat mechanics because the rules have to be human-friendly to compute. Pen and paper lives and dies with storytelling, which is why I prefer simple rules a la World of Darkness (apparently mages are really complicated, though).

<comment><USER7> This 1000 times this. You can condense the rules for a fun RPG game down to a single piece of paper. These companies only make money selling rule books so they want something more complex which does not necessarily mean fun.

<comment><USER6> Well, they could always sell monster manuals and pre-canned stories. City maps and politics. Those are the exciting parts, anyway.

<comment><USER7> Option A, monsters use the players class system. Option B, monsters use a separate system, need to be balanced externally and become part of a large rule system...

City maps and politics might work, but pre canned campaigns never seem to sell well because building that stuff is generally considered a fun part of being a DM.

That said, I actually found D&D/white wolf source books and monster manuals etc a fun read on their own.

<comment><USER6> I was more thinking pictures of the monsters - the concepts of what the monster is. Probably just with given stats of the "a thief is a thief is a thief" type.

</comment></comment></comment></comment></comment><comment><USER8> Somewhat off-topic, but every time I visit a FastCo page the only thing I see immediately is the slideshow at the top of the page. I often don't even bother scrolling down, because it doesn't seem that there's anything more to the link. This seems like a usability problem to me. I would imagine that it would result in a lot of articles that go unread. Depending how they count pageviews, though, it's probably quite effective at generating ad revenue.

<comment><USER9> Yes, that happened to me several times as well until I figured out there was content down there once.

</comment></comment><comment><USER10> I started playing D&D when 4e came out in high school. I switched over to Pathfinder after two years or so when I went off to college. Pathfinder was ditched for GURPS the last year in college and I've been using it ever since, and am now dropping that (and miniature grid-combat entirely) for the Fate system.

I bring this up because, in hindsight, if I had managed to come into 3.5e instead of 4e I feel I wouldn't have become so disgusted with roll-playing (especially in combat). Even Pathfinder's combat seemed to be dominant time- wise, even if combat is comparatively scarcer. I realize this depends entirely on the campaign and players involved and is just my anecdote, but I really do believe that my first experiences being with 4e shaped my perception of grid- combat negatively and is a constant bias. I'm curious if anyone else had their first experiences with tabletop RPGs using D&D 4e, and what kind of experiences they came out of it with?

<comment><USER11> You should try gridless 5e, it discards a lot of the Math and time suck.

</comment></comment><comment><USER12> Is it just me or does the title seem like it has an extra level of 'meta' to it?

<comment><USER13> Inside The Making Of The Documentary About How Movies About Film Studios Are Made

</comment></comment><comment><USER14> The most promising evolution of rpg i've seen was the microsoft surface table ( the big tables, not the tablet) prototype some guys did. It seemed to be built as a helper for combats and not much more. Obviously you don't want humans to compute bonuses or damages, because that's what computers are for, but you want to keep the freedom and imagination of paper rpgs.

I don't know what the whole thing has become though.

<comment><USER15> I have been playing the contrarian to this idea since... 1998 I believe? (that was on the Italian usenet RPG group).

My point: unless you want to play an RPG _exclusively_ as a miniatures tactical game, the GM has to be able to "cheat" sometimes in order to adjust things. If you accept this premise, "automated bookeeping systems" like Surface or any other kind of computer assisted combat processor risk becoming a burden: as soon as you decide that the killing blow from (or to) an NPC has to be changed in order not to spoil the fun of your players the system will go out of synch with the shared narrative, and you either have to manually realign it, or accept that yeah, the death really happened, no matter how detrimental to the rest of the adventure.

Also, it tends to negate any attempt at being creative in using spells or even just inventing novel tactics: if the computing model hasn't it hardcoded, there is literally no way to use a decorative mirror on the other side of the room to hit your enemy in the back with your beam weapon, for example.

So, Surface is great for wargames, a complicated and ultimately limiting system for RPGs.

<comment><USER14> That's just a matter of fine tuning. You may very well imagine an inteface which lets the gm adjusts computed bonus or even cheat the dices. But imagine having precise maps of every places your characters go into. How many times have you heard a player say "but he can't hit me, because i said was behind that wall ! But the wall isn't there, it can't cover you, etc.."

Or the GM drawing shite last minute maps...

With a table, you have unlimited possibilites for in-game accessories, drawings, sound effects, automation, etc. Then buying a scenario would actually mean something ! You would buy tons of assets, that you could later reuse, etc..

Your concerns ar valid, but seing the table as a helper rather than a simulator would avoid many pitfalls i suppose.

</comment></comment></comment><comment><USER16> I DM'ed 3rd edition and 4th edition campaigns. The author of this article said that 4th edition made combat much longer and that's not true. Once my players got up to speed with the new system, our combat encounters ran about twice as fast as 3.5 did. I also had the impression that 4.0 had been designed with writing computer games in mind (whereas 3.5 would have been a nightmare to code into a game).

<comment><USER17> Oddly, there are many more video games that use the 3.5 rules (D&D Online, Neverwinter Nights 2, etc.) and only one that uses the 4th Edition rules (Dungeons & Dragons: Daggerdale).

</comment></comment><comment><USER18> These rule problems can be a distraction from actual role playing. Might be a good time to try the White Box rules.</comment>


Show HN: ElementHistory – See what code created or updated a DOM element - <AUTHOR> https://github.com/mattzeunert/ElementHistory <comment><USER2> how much does it affect performance?

<comment><AUTHOR> Capturing the callstack with `Error().stack` is expensive and it's done for every DOM manipulation.

The idea is that you'll only enable the extension when you're mystified by a DOM change, so if the page loads half as fast it's not a big deal.</comment></comment>


Study sheds light on the evolution of the earliest dinosaurs - <AUTHOR> https://phys.org/news/2020-07-evolution-earliest-dinosaurs.html <comment><AUTHOR> >The Late Triassic Ischigualasto Formation at Cerro Las Lajas (La Rioja, Argentina): fossil tetrapods, high-resolution chronostratigraphy, and faunal correlations

[https://www.nature.com/articles/s41598-020-67854-1](https://www.nature.com/articles/s41598-020-67854-1)</comment>


Dubious framework decision process - <AUTHOR> http://www.google.com/trends/explore#q=django%2C%20ruby%20on%20rails&cmpt=q

<comment><AUTHOR> Just thought it was interesting to see the term Django take off (with the new movie out).

So much for using Google Trends to see what's more popular.</comment>


Can we learn from Post Secret's integrity? (largest non-ad blog in the world) - <AUTHOR> http://monkeymace.com/post/25205533364/postsecret-is-the-largest-advertisement-free-blog-in-the

<comment><AUTHOR> The integrity of the founder to stay true to his mission, and not just chase the highest dollar has led to a consistently high quality product, that has real value.

I don't think the key is not to have advertising, but to be committed to an authentic vision.

<comment><USER2> But in the case of post secret, what kind of ads would be appropriate?</comment></comment>


How to make Linux more trustworthy - <AUTHOR> http://arstechnica.co.uk/information-technology/2016/12/how-to-make-linux-more-trustworthy/ <comment><USER2> > Alarmed at the prospect of being unable to trust all 24,000-plus Debian > packages, most of which are built on package maintainers' laptops, the > Debian Project has pushed hard over the last three years to make as many > packages reproducibly buildable as possible. As of this writing, 91 percent > have achieved that goal, and the project hopes to hit 100 percent in 2017.

91% already? That's pretty impressive! I remember when they first started discussing this but haven't tracked the progress at all. Happy to see how far long it's come.

<comment><USER3> > most of which are built on package maintainers' laptops

Gracious, is that really true? My experience of interacting with Debian/Ubuntu is via launchpad.net, where you push the dsc (source tarball + patches + metadata), and the server takes care of producing binary archives for the supported architectures.

<comment><USER4> Ubuntu does source-only uploads. Binaries cannot be uploaded by anyone; everything is built on Launchpad's infrastructure (managed by Canonical).

Debian traditionally has done source-and-binary uploads for the maintainer's architecture (usually amd64), and builds for other architectures via the its buildd infrastructure (managed by contributors, AIUI). More recently it is possible to do source-only uploads to Debian now, but I'm told it doesn't work for new packages.

</comment></comment></comment><comment><USER5> Good summary, but disappointing reactions from other distros.

Just to add some info: In the past few days a couple of people gathered in Berlin to discuss reproducible builds. There were some people from the distributions quoted that they don't show much interest, so maybe there will be more movement than this article suggests.

My personal take is that I think there are a few more pieces that are needed for really trustworthy software distribution.

I tried to get a grip on that with the idea that we have a chain "upstream repo" \- "usptream tarball" \- "potentially insecure transport" \- "distribution compile" \- "package" \- "user download".

Reproducible builds basically fix the tarball to package way, but there's a lot more. E.g. how does a repo become a tarball? Who's checking that? And how does user a know he has the same software as user b? (This is mentioned at the end of the article with the comments of Joanna Rutkowska. Others have discussed basically the same ideas under the term "binary transparency".)

<comment><USER6> Have you taken a look at OBS (openSUSE)? Every package in openSUSE:Factory should have a link or _source script to fetch the archive which is then used for the build, so the source of the source should be transparent.

<comment><USER7> Ideally, you shouldn't even upload the sources to the OBS manually at all! Just provide a so called "service" file with an instruction hour to fetch the sources (tarball or git), and everything after that will be handled by BuildService.

<comment><USER6> I use disabled services. The _service auto-run magic always makes me feel iffy (it won't work on my local machine for some reason, for example).

</comment></comment></comment></comment><comment><USER8> I wonder if Canonical could use this to their advantage, now that they are 'taking a stand against unofficial Ubuntu images'.[0] _(looking at you, OVH...)_

It could also go a long way towards addressing concerns that they, as a UK corporation, may now be subject to the Investigatory Powers Act requiring encryption 'back doors' be inserted in communications software.[1] Even if you argue that Ubuntu isn't communication software, they do ship plenty of packages that are.

[0][http://insights.ubuntu.com/2016/12/01/taking-a-stand- against...](http://insights.ubuntu.com/2016/12/01/taking-a-stand-against- unstable-risky-unofficial-ubuntu-images/)

[1][http://www.theregister.co.uk/2016/11/30/investigatory_powers...](http://www.theregister.co.uk/2016/11/30/investigatory_powers_act_backdoors/)

</comment><comment><USER9> Reproducible builds is an excellent QA initiative, but let's not overestimate their security benefits.

They're maybe going to protect us from random ELF viruses on developers' machines, but not from a targeted attack.

Why bother pwning binaries when it's much easier to pwn the source?

I mean, it's so easy it's already been done:

[https://email@example.com....](https://firstname.lastname@example.com)

<comment><USER10> Lets also remember that its threat model is FBI, CIA, and do on. They mainly exploit vulnerabilities in software or bad configurations. They're quite successful. Repeoducible builds with normal Linux environments isnt going to stop them. Doing it with "hardened" OS's might but incurs the risk that such niche OS gets less security review.

So, this post and effort is ultimately misguided if it's about securing computers from nation states. Linux cant be trusted for this job. They need strong, endpoint security with verified source and compilation for that. Likely be console apps with a microkernel OS since labor involved will demand simple system.

<comment><USER11> I can't stand this "throw up our hands" reaction to nation-state adversaries. None of these APTs have unlimited budgets; sufficient hardening and defense- in-depth will encourage the planner to use different targets to satisfy the tasker's intent.

Every security improvement helps. We can't just say "run SELinux in a VM and use Tails with JavaScript disabled or accept the Mossad completely owning your life." There has to be a realistic middle ground.

<comment><USER10> It's not a throw up your hands reaction. The Linux stacks, from kernel to key apps, have had boatloads of vulnerabilities since they accept insecure code written in languages easy to screw up by people who arent security engineers. Such a stack has no business being used in anything designed to resist well- funded or determined attackers. Federal government's own criteria rates Linux at EAL4: "can protect against causual or inadvertant attempts to breach security." Whereas, even trying to stop nation-states requires very-rigorous developmenf plus review of vastly simpler systems. Systems done like that resisted NSA penetration during evaluation.

So, the trick for FOSS is to do their stacks like that. They refuse. Genode is at least architecturally doing it right. Muen and seL4 are separation kernels that might be turned into the foundation. The pieces are there and could be turned into a usable system with a tiny amount of effort compared to what's going into Linux right now. It can even run Linux apps user-mode. Commercial implementations already exist for these (eg Turaya Desktop, Dell SCC) while FOSS just ignores it like most high-security techniques.

Google Nizza Secure Systems architecture pdf for an example from CompSci. Genode evolved from it but basis could be done in other projects.

<comment><USER11> I am blown away at the amount of terms you mentioned that I never heard of, despite working in vulnerability research/development for years. I've got a lot of Googling to do. It sounds like you are an expert at secure operating systems.

I want to emphasize that computer network security is more than a secure operating system. It is defense in depth: the combination of well-designed networks that are hard to traverse, isolated endpoints for internet-facing products, management interfaces that are also properly isolated, monitoring that alerts with a low false positive and negative rate, sufficient logging and analysis that surfaces anomalies while keeping noise down, etc. These are hard and should be scaled to the appropriate threat level to prevent impact to usability.

It is possible to keep a computer network secure from APT _even with a vulnerable operating system_. The APT has to deal with everything mentioned above even if it has spent millions on vulnerability research on a vulnerability-ridden operating system.

<comment><USER10> "It is possible to keep a computer network secure from APT even with a vulnerable operating system. The APT has to deal with everything mentioned above even if it has spent millions on vulnerability research on a vulnerability-ridden operating system."

All the big companies seem to be failing at that given the TB of data exported. It's pretty hard. Whereas, systems immune to code injection or catching leaks by default might have reduced it considerably. That's why INFOSEC's inventors focused on designing those.

"I am blown away at the amount of terms you mentioned that I never heard of, despite working in vulnerability research/development for years. I've got a lot of Googling to do. It sounds like you are an expert at secure operating systems."

The reason is that INFOSEC the profession acts in almost a pop culture way where what's popular from certain parties goes. Very fad-driven. It was originally created by engineers and computer scientists that did things in a rigorous way with excellent results in pentesting. The strongest form we called high-assurance security or real security if you ask me. They solved tons of problems early on. Later people ignored them entirely starting around the 90's onward. Keep reinventing their lessons but most steadfastly refuse to read & follow their work.

In any case, send me an email if you want a curated list showing where it came from, what was achieved, with what methods, and so on. I'll send as much or at little as you can take. Meanwhile, here's my own framework I posted for free after high-assurance market went nowhere outside defense. It embeds some of what I learned from them.

[http://pastebin.com/y3PufJ0V](http://pastebin.com/y3PufJ0V)

For interim, I'll give you just a few on the main model that achieved real security: designing system around a limited, strong component where all trust is placed called a TCB. First is paper on first systems certified for security claims based on high-assurance methods invented in 1970's. Both are still available commercially. Second is example of secure VMM (for OpenVMS) done by legendary engineer & INFOSEC co-founder Paul Karger. Pay attention to "Layered Design" & "Assurance" sections then wonder why mainstream INFOSEC is barely securing VMM's today despite techniques (eg leak mitigation) being ancient. Third is architecture that evolved from them in academia that I link since the paper explains the concept really well. Fourth is the only FOSS implementation of that architecture using best-of-breed components like seL4 or Nitpicker. Fifth is Nitpicker just so you see how our sub-field of INFOSEC turns hard problems like trusting X/KDE/Gnome apps into simpler ones. Sixth is a secure, browsing architecture that shows both a way to do it better & how systematically people in high-assurance solve these problems.

[http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf](http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf)

[http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf](http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf)

[https://os.inf.tu-dresden.de/papers_ps/nizza.pdf](https://os.inf.tu- dresden.de/papers_ps/nizza.pdf)

[https://genode.org/](https://genode.org/)

[https://os.inf.tu-dresden.de/papers_ps/feske- nitpicker.pdf](https://os.inf.tu-dresden.de/papers_ps/feske-nitpicker.pdf)

[https://www.usenix.org/legacy/event/osdi10/tech/full_papers/...](https://www.usenix.org/legacy/event/osdi10/tech/full_papers/Tang.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER12> From [0] > Of course building everything yourself generally isn't practical.

I've been using gentoo for a decade and I'm sad to say that I still can't get to 100% built from source. There is always some useful program out there, or something that I don't want to maintain the build process for, that ends up being a binary that I know nothing about.

Getting to 90% is possible. 100% is extremely difficult requires making some hard choices about what software you are going to use.

0\. [http://sobersecurity.blogspot.co.uk/2016/05/trusting- trustin...](http://sobersecurity.blogspot.co.uk/2016/05/trusting-trusting- trust.html)

<comment><USER13> It's all kind of moot anyway if you are running hardware with blobs (Intel ME, for example). Getting truly to 100% is pretty far away, as frustrating as that is.

<comment><AUTHOR> With major effort, ME has been disabled on Lenovo X230 (Ivy Bridge).

<comment><USER14> Where do you get your information from? AFAIK, it's only has been stripped down to a bare minimum, putting it in some sort of recovery mode - but it can't be erased from the BIOS chip yet.

<comment><USER15> [https://www.coreboot.org/pipermail/coreboot/2016-September/0...](https://www.coreboot.org/pipermail/coreboot/2016-September/082049.html)

<comment><USER14> I was thinking of this project - [https://github.com/corna/me_cleaner](https://github.com/corna/me_cleaner) This is the one that strips most of the ME (which seems to be Java applets, if I remember correctly Igor Skochinsky's presentation), but there's still the core "OS" in PCH, which loads and executes the applets - we don't know what nefarious things that part of ME might be up to - and it has DMA, and access to the network controller - that's how they remotely wipe HDD's, even without an OS being installed, even without the computer being turned on - that shit is straight out of Orwell's 1984. Telescreen, that's what it is.

<comment><AUTHOR> Thanks for the info.

Is there security benefit in running on a desktop with non-Intel (e.g. Broadcom) add-on NICs and nothing connected to the integrated Intel NIC?

<comment><USER14> Yes. It seems this only works with Intel cards(wifi or ethernet); I don't know the reasons why, though - it might be some firmware support. Also, I find it odd that it can work with the wireless chip - shouldn't the laptop be associated with the AP? If somebody knows, I'd be happy to learn about it.

Source: [https://software.intel.com/en-us/blogs/2013/08/07/intel- vpro...](https://software.intel.com/en-us/blogs/2013/08/07/intel-vpro- technology-release-90-platform-requirements)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Once you go full tin-foil hat, you want silicon level validation. And when you find out that isn't really viable, you realize that an open source driver that uses high-level silicon functions isn't all that different from a binary blob.

<comment><USER17> There's a really interesting open hardware project that's developing a Raspberry Pi competitor, "LowRISC".

If they end up fully blob-less (no firmware blobs, open chip designs, open board layout) they're going to be the first group to achieve that ever AFAIK, so I'm on the edge of my seat for it.

<comment><USER14> Yes, it's a very interesting project. I'm already subscribed to their list, I got on their site accidentally. If they do not succeed, the next best thing is to wait until ARM gets powerful enough, and hope they don't go down the orwellian route, like Intel and AMD.

</comment></comment></comment><comment><USER18> This article focus a lot on security, but deterministic builds are also good property to have for other reasons (e.g. it can serve as strong evidence that a new build environment is sound; gives people more trust in the build process).

</comment><comment><USER19>
      Small details like differences in timestamps or build directories result in different binaries.

Why is this even a problem? Did people actually think it was a good idea to have a compiler's binary output depend on incidental crap like this, or did it sneak in somehow?

<comment><USER20> I think a lot of times it just sneaks in. For example, when one of my projects was in alpha state, I added the build timestamp to the `--version` output, so that I could reserve version number changes for actual releases. At that point in time I never thought it would become a debian package, much less that reproducible builds would be a thing someday.

</comment></comment><comment><USER21> Nix has been working on reproducibility: [http://nixos.org/nix/](http://nixos.org/nix/)

</comment><comment><USER22> Seems like package hashes could be stored in a block chain to prevent modification by certain three letter agencies and other non-benign actors.

<comment><USER5> That's basically the idea of binary transparency (which is a bit stalled right now, but people are aware that this would be a good move). BT is a complement to reproducible builds, not a replacement.

<comment><USER19> Well, yeah, obviously you need a deterministic build before you can have a meaningful hash to store on your blockchain.

<comment><USER23> Disagree :) We don't need repro to start logging what we build! We should start logging what we build so it's an incentive to get repro results :)

Reproducible builds are a pursuit. You can never "prove" yo have them: only keep checking and be vigilant. So it's best to start logging now, and then keep putting in the work to make sure it's "meaningful".

</comment></comment></comment></comment><comment><USER24> Reproducible builds are one of three components necessary to have a secure code delivery system: [https://defuse.ca/triangle-of-secure-code- delivery.htm](https://defuse.ca/triangle-of-secure-code-delivery.htm)

That Red Hat and Ubuntu aren't interested in delivering trustworthy software means you shouldn't trust them.

<comment><USER10> This isnt accurate. High-assurance established the requirements by mid-1980's in TCSEC. Wheeler, inventor of reproducible builds, also has the best page for SCM security which describes such methods. Here's what it takes:

1\. Build system that only developers can access, review of their submissions, a trusted compiler that turns them into binary, and then signs both binary and source.

2\. That source or binary is distributed with its signature over any medium. Add TLS for defense in depth if you want.

3\. User checks their against signature to determine if trustworthy. Source they compile themselves if worried about substitution.

Now, maybe that repo is compromised. Decentralized checking approach says let them pull source signatures from many other repos that are all building from same source on diverse platforms and such. Go with what (strongest) majority says while reporting inconsistencies. Compile source yourself for sure.

Now, the user might not trust the compiler. If repo is trustworthy, then compiler source should be too with bootstrapping done by experts in diverse ways. However, if one really wants compiler verification, they have to both understand the source and turn it to machine code themselved for at least first run. Ive shown here before how to do that increnentally.

Looking at above, it boils down to a secure, signed distribution of source code for compiler and app. That's all you need. Reproducible builds can have benefits but arent good enough to stop subversion that will mostly be 0-days in source or attacks on endpoint. They're not necessary to stop MITM attacks given signed distribution of source handles that. They're not necessary to bootstrap major compilers as distros come with scripting or executable tools by default that can be trusted to do initial source. If you cant trust them, your distro should already be considered subverted.

There you go. That's about all of it if we're not talking about eliminating code injection from or formal verification of these components. So, strongest repo security they could build should be FOSS's plan. Repo appliances on microkernels or stripped OpenBSD with append-only storage. Signatures (incl key storage) in HSM's or carefully-done embedded boards. Transport node for Internet connection on its own machine with mediation against device-level attacks on host.

Old shit. Would work if they just put work into it. Oh yeah: paper backups hidden in various places. As fail-safe. :)

</comment></comment><comment><USER25> Is Debian really built on private computers?

How is this any more secure than a random PPA/EXE download from the internet?

<comment><USER26> > Is Debian really built on private computers?

"Depends". Package maintainers usually build the binary package for their arch themselves (typically x86_64 nowadays). The ~dozen other archs are built by buildd, which also largely runs on hardware* controlled by private people / entities as far as I'm aware.

See eg. [https://db.debian.org/machines.cgi](https://db.debian.org/machines.cgi)

* you can really forget building software on emulators. Way too slow.

<comment><USER10> What about FPGA-based emulators for building older architectures? Anyone trying that?

<comment><USER26> While there are a bunch of older archs most are quite well and alive (hence supported by Debian). For example, there are a bunch of POWER8 machines in buildd, or some fairly recent SPARC machines.

Some of these machines are donated. FPGA emulation would be a _huge_ project, both time/involvement wise and also cost-wise (FPGAs are freakin' expensive).

Software emulation gets nowhere near usable performance, even with older archs (say PowerPC970) the real, >10 year old hardware is _much much_ faster than any emulation, which also tend to be rather limited. For example, PPC in QEMU is actually not the 970 (G5), but an G3ish thing. Conversely, the virtual machine is limited to 1.5 GB of RAM (iirc). Technically you can build stuff on that. It just takes ages. 2-10 minutes for compiling a C module. The real deal (a G5 in the cellar) on the other hand can be stuffed with RAM to 8-16 GB and will be about as fast as a slow laptop nowadays is. (Except it will make much more heat and will be louder. Well, the latter depends on the laptop, hellish noises they make...).

<comment><USER10> Makes sense. Thanks for the detailed response.

</comment></comment></comment></comment></comment><comment><USER27> The other notable thing about deterministic builds is that they are needed for the nix package manager.

</comment><comment><AUTHOR> OpenEmbedded BitBake supports file integrity verification for remote code sources, [http://www.yoctoproject.org/docs/2.3/bitbake-user- manual/bit...](http://www.yoctoproject.org/docs/2.3/bitbake-user- manual/bitbake-user-manual.html#the-download-fetch)

 _File integrity is of key importance for reproducing builds. For non-local archive downloads, the fetcher code can verify SHA-256 and MD5 checksums to ensure the archives have been downloaded correctly. You can specify these checksums by using the SRC_URI variable with the appropriate varflags as follows:_

         SRC_URI[md5sum] = "value"
         SRC_URI[sha256sum] = "value"

<comment><USER23> I love that tools like BitBake _support_ integrity, but I also feel it's not enough to merely support it. We must _incentivize_ it, if not outright _require_ it.

Integrity is a property of the whole ecosystem. Our toolchains are complex, and call other tools, and those call yet more tools. Optional "support" at any layer means even though the user might ask for integrity at one level, their security and integrity may be unverified by another layer of tool. If we want integrity from the whole ecosystem, we must demand it from every part.

Integrity should be a mandate, not an option.

<comment><AUTHOR> Most (all?) OpenEmbedded production recipes already use this mechanism to specify hashes during builds.

<comment><USER23> Most isn't enough. "All?" with a question mark isn't enough. Just like one zero-day is enough to totally compromise a system, one unverified source anywhere in a build dependency tree is a great way to land just one RCE, leaving your system _precisely_ as hosed as if you just got hit with a zero- day. :)

I saw another blog about the summit the top link reports on discuss this as well -- from [https://garbas.si/2016/reproducible-builds-summit-in- berlin....](https://garbas.si/2016/reproducible-builds-summit-in-berlin.html) :

        > As with zero vulnerability days, there should probably be zero reproducibility days.

</comment></comment></comment></comment><comment><USER20> It's also worth highlighting that diffoscope.org is an extremely cool tool. This project is worthwhile just for having encouraged its creation.

</comment><comment><USER28> I am just going to leave this here: [https://en.wikipedia.org/wiki/NSAKEY](https://en.wikipedia.org/wiki/NSAKEY)

Linux might not be the most trustworthy but it would be hard to sneak in something like that.

<comment> angry-hacker There is fairly good explanation for this, or no?

<comment><USER28> You won't find it in Linux. Especially by surprise.

</comment></comment></comment><comment><USER29> > "Red Hat has never intentionally inserted a back door in our products, and > we have never received a court order to do so,"

Sure. But that doesn't mean it doesn't contain any backdoors. RedHat (also Fedora, Ubuntu, and many others) kindly accepts non-free binary blobs (in Linux kernel), which may make the system vulnerable with backdoors.

Not much people care about software freedom. Most care about "open source." Though it does have some interest in freedom (ie, opening the source, but not freeing), that's not its vital aim. For most, it is money (though they say, quality), and for a few it is power.

As long as the majority of the world focuses on money or power, we will see some weakness in security, and freedom (That doesn't mean free software are more secure, but the user have the choice).</comment>


Ask HN: Stick with it or get out? - <AUTHOR>

I am sure most of you will understand my reason to remain anonymous in this post, with that said: I have been offered the following post, and am deliberating on its acceptance, your help would be very much appreciated.
Firstly, whoami: https://news.ycombinator.com/user?id=developer786
I am not a born coder, I know that, therefore for the second post, I will be working very very hard. Where I am currently, I am very comfortable.
Current Post
- Windows/Linux Administrator / DevOP
- Small Private Healthcare company with good financial backing / profitable.
- Job Security: Medium/High - Environment: Working with a team of 30 2nd and 3rd line support
- No Stock options
- Salary: $63K
- The role: Little development, lots of Linux Admin, training in any sysadmin courses provided once every a years, Ruby training course provided soon.
New Post
- Developer(bash/php/ruby/python) / Linux Administrator
- Telecommunications company with investor backing / breaking even.
- Job Security: Low/Medium - Environment: Working From Home
- No Stock options - Salary: $75K+8K bonus
- The role: Developing bespoke applications in the above languages for a range of customer requirements. Developing and extending Linux based applications.
Your help, If I don't get to thank you later, is very much appreciated. <comment><USER2> This is easy: Your salary and skills can use a bump. Take the risk, and save some of your raise in an emergency fund.

</comment><comment><USER3> Why coast when you can push? Yes, its a risk, but a lot of the time risk pays off. And, worst case scenario? You come out with more knowledge of yourself and your skillset, and a lot of businesses look at that fairly favorably.

Unless you're in Silicon Valley, age shouldn't be a factor. The only thing holding you back is yourself.

</comment><comment><AUTHOR> Should mention I have a mortgage ($200K) and a family (2 beautiful kids) to support. I am also 35 so feel it may be too late to take the risk like this?</comment>


Implore HN: Celebrate and encourage young developers who post here - <AUTHOR> Recently an ugly and short-sighted essay about teens posting on HN hit the frontpage and was later killed.
I'd like to take a moment to point out how important it is that we encourage young people who take the time and ego risk to share their work.
"I am [age] and I made [thing]"
actually means
"I am new at this. I know you guys aren't. I want you to check it out and give me encouragement and guidance."
Do they want attention? Of course! They believe, correctly, that the attention of more experienced people will lead to their growth. We should absolutely give it to them.
Getting young people into science and technology is the single greatest professional duty any technologist has. We need help. The problems are so many and the minds equipped for them so few.
We have an entire planet of dumb objects waiting to be woken up. We need software written and interfaces designed for classes of products we can't even imagine yet.
So we need kids to grow up and choose the very, very hard work of learning to bend technology to their will. We need them to believe they can make careers out of it.
And we certainly need them to believe that when they get there, they won't be surrounded by assholes.
When a kid shows up sharing their work, we ought to circle around them and hoist them on our shoulders. They're choosing the career that will make our lives better one day. They're choosing the career that will broaden our hiring pools one day. They're, blessedly, choosing tech over drugs, drink, violence and investment banking.
When a teenager comes shuffling along, awkwardly holding up his or her project for our scrutiny, take a moment and see if there's any experience of your own that you can offer to help them on their journey. If there isn't, move along quietly and let the mentors do their thing, eh?
Young folks: I don't know a lot, but if you want career advice or tech advice or just someone to talk to, I'm email@example.com. <comment><USER2> That blog article was one of the stupidest things I've ever read.

I never got the encouragement or support to pursue my hobbies at a young age, whether from parents or friends, and would've _killed_ to have a community like this that could've praised me and pushed me forward.

To accuse a kid mentioning the fact that he's 14 in his submission title as being manipulative really reflects on how out of touch you are with the way humans operate. A kid his age is looking to show off his work, proud that he's not wasting his time on Power Rangers and Nerf guns, putting his focus and attention to furthering his meaningful hobbies. You encourage that, not dismiss him.

Time and time again, it's just remarkable to me how socially inept the lot of you are. When your child comes up to you and exclaims "Daddy, Daddy! Look what I've done!", you sure as hell aren't going to say "Heh, yeah, I did that too, but I was _younger_."

<comment><USER3> We're not these children's daddies though, are we? Did you run up to every adult expecting praise? Did they give it to you?

This is a group of, by and large, professionals. They are going to look at it in a critical light. If you want critical feedback, this is the forum to show it to. If you want coddling and nothing but positive reinforcement, stick with your parents, teachers and friends.

<comment><USER4> Positive reinforcement and pleasant feedback are how people grow, not some type of angry neckbeard behavior. Everybody knows the professionals are superior, so we ought to kindly and gently nudge the newcomers to the same level of excellence.

<comment><USER3> First: Praise given always is meaningless.

Second: Criticism is not always 'angry'

Third: Consider dealing with the crass criticism as a life lesson.

Fourth: Mindless praise is not going to help you grow

Fifth: How you present something will often determine the type of response you get.

You are going to leave kindergarten some day, the world isn't all gold stars. You are going to have to deal with people giving a critical analysis of what you're doing. That is what will make you better, not endless back-patting.

<comment><USER5> There's a nasty illogic to this sequence, but I see it all the time.

A. "The world isn't all gold stars" (a.k.a. "it's a dog-eat-dog world out there", or "there are a lot of hardasses out there", etc.), THEREFORE

B. I'm _personally_ not going to pull any punches for this naive/hopeful/idealistic/etc. young person.

This isn't logic; it's a weak rationalization for being an asshole, because there's a certain pleasure to being an asshole and cutting others down to size.

Is there really just a black/white choice between "crass criticism" and "mindless praise"?

Of course not. What about this: filter whatever critique you have to offer down to what's useful to a 14 year old (or whatever they are), and present it with kindness.

<comment><USER6> I've seen the following happen way too often: from a young age, kids are told they are child prodigies and maintain top status in high school. Then they enter college and meet people who are more intelligent or proficient and can't seem to accept the reality of the situation.

As an example, there was one section of organic chemistry for freshmen, and to get into that class you had to have a 5 in AP chem and pass two exams. I saw many of my classmates (Columbia) who were genuinely taken aback that they weren't the top of the freshman class -- and many of these self-styled rock stars never heard of the IChO!

It is better for long term growth if kids are humbled at an earlier age than to be shocked much later in life. And holding back criticisms now really does a disservice later in life.

<comment><USER5> Here's the line that makes me really uneasy about what you're saying:

> It is better for long term growth if kids are humbled at an earlier age

You don't _humble_ a kid. That's not an action any person needs to take, ever. Instead, you _expose_ them to the wonderful things in the world, and they will learn humility and be inspired and motivated at the same time.

If you "humble" them instead, they may learn humility, at the same time as they learn how shitty some adults are, and you seriously fuck with their motivation and inspiration.

I'm aware this may not be quite what you meant; maybe I'm reading too much into your wording.

But while I agree that false praise is bad ("kids are told they are prodigies"), the solution isn't to cut them down; it's to show them more of what's possible (and of course, replace the false praise with simple recognition of how their hard work is paying off, noticing improvement, etc.).

You want to build a drive for self-improvement in them; not convince them they're already at the pinnacle (as if anyone ever is...), nor convince them that they're currently worthless compared to the best (because it's not a competition) -- just notice how they're getting better at climbing, show how it's making their skills/lives/etc. better, and help them along.

<comment><USER6> You are reading too much into my wording -- kids are humbled in multiple ways, and in my specific example humbling happens when they meet other exemplary people. It's not about cutting down people to size, but rather reframing their understanding of what is possible.

<comment><USER5> Thanks; I agree totally with that. The important thing is that this can be really misleading:

> And holding back criticisms now really does a disservice later in life.

Holding back criticism isn't the problem; their limited understanding of the world is. Once you name the problem, the best solutions look quite different; there's no need to tell them their work is low-to-mediocre; they'll be saying it themselves (but with a drive to improve).

There are also still people who will be nasty to kids with the idea of "toughening them up"; this is crap as well (kids can better deal with shitty behavior if they have a solid idea of what is _non_ shitty behavior, and if they haven't been traumatized into having intense emotional responses in conflict), but I don't have time to get into that in depth here....

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> As the author of the "ugly and short-sighted essay" in question, I want to just mention that I meant no hard feelings to anyone of any age, and tried hard to critique the behavior, not the person, Sorry if it came across as ugly. However, I stand by my opinion. I believe that there are plenty of other places these teens can go for blanket approval and yes-men, such as friends and family. HN is, to me, reserved for unbiased and fair commentary. As an aside, I think everyone's post should be considered carefully and encouraged; however, it shouldn't be based on age. Also, in response to those who raised comments about how Mozart's age was relevant to his accomplishments, I must say that in our day and age, teens making apps is hardly that noteworthy anymore. Yes, it is impressive, but not exceptionally so.

Lastly, why exactly was my original post killed? What happened to it? I may not understand HN fully, but I thought something that fostered a good discussion would be kept. I can't even find the post anymore! Would it have stayed up if I had said I was 16?

<comment><USER8> Would you post the link here? I would be interesting in reading your specific arguments.

The only issue I really take with the "I'm 14 and check out my first [x]," is that some of them feel a little suspect. Hell, I stumbled upon one of the "I'm 15 and.." guys astroturfing his thread. He neglected to change accounts, and so he gave a glowing review about how great the game was, and how awesome the it is that he's doing this at his age... all from the same account he used to post the link. When I pointed this out to him, everything was quickly deleted.

Maybe I'm letting one bad apple spoil everything, but I feel that some percentage of the "I'm young, check out this really mediocre, yet ad supported thing I made" are in fact, just some older guy's weekend passive income experiment.

<comment><USER9> It's [http://vishnumenon.com/2013/01/21/im-35-months-old-and-i- mad...](http://vishnumenon.com/2013/01/21/im-35-months-old-and-i-made-this- cool-app/)

<comment><USER8> Thanks for the link! After reading through it, I don't feel there was anything "ugly and short-sighted" about it. OP was being way over dramatic.

On a tech centered website such as Hacker News, it seems a perfectly reasonable position to ask someone not to rely on an emotional manipulation to get page views.

<comment><AUTHOR> You need to have a pathological lack of empathy to view these matters as "emotional manipulation."

<comment><USER8> Ah, thank you for your internet diagnosis. I suppose it is possible that I suffer from a "pathological lack of empathy," or, you may just be over reacting to the word "manipulate." So, let's sub in a different phrasing so you don't take it so harshly.

"On a tech centered website such as Hacker News, it seems a perfectly reasonable position to ask someone not to appeal to emotion in an attempt to garner page views and/or karma"

<comment><AUTHOR> > "On a tech centered website such as Hacker News, it seems a perfectly > reasonable position to ask someone not to appeal to emotion in an attempt to > garner page views and/or karma"

This is bordering on deliberate obtuseness. This is not a matter of appealing to emotion. This appealing to experience and asking for guidance during a fragile period of development.

In a "tech-centered" _community_ , we should do our best to nurture young people who want to follow in our footsteps. I simply have no respect for anyone who can't see the value in that. It's the worst kind of childish, self- centered worldview.

<comment><USER8> Oh, I just realized that your OP.. _That_ makes a little more sense...

>I simply have no respect for anyone who can't see the value in that. It's the worst kind of childish, self-centered worldview.

I stand by my original statement of your tendency toward hyperbole.

It's fine that you feel the need to be all high and mighty about this, and tout on about your various respect hierarchies and where others fall into them, but at the end of the day, you're really wetting your pants over nothing. Honestly, I think you just lack reading comprehension, or maybe you just want attention yourself? However, I will refrain from internet diagnosing you.

You know what the other guy's post said? You should really re-read it. It said they should come as equals and be judged accordingly. There you go; That's pretty much the summary. Whether or not you agree with it, is that position __really __as ugly as you make it, or are you simply overreacting? Did it really warrant calling him out in a public forum? I understand white- knighting, and "Won't someone think of the frail, helpless children!" mentality, but Jesus, man..

One guy says, "Don't coddle them."

You say, "That guy is childish and selfish! Coddle them"

There's the summary of this thread. Calm down, my man. Difference of opinion does not an asshole make.

<comment><AUTHOR> > Difference of opinion does not an asshole make.

On this we agree. That's not what makes the asshole.

> I think you just lack reading comprehension

> coddle them

If you think advocating mentorship over hostility is me wanting to "coddle" people, you've got a lot of nerve throwing around phrases like "reading comprehension."

<comment><USER8> Welp, I think I'm going to cut it off here. Clearly we're not getting through to each other, and I prefer to do my mindless arguing on other websites.

I urge you to read through his posting again (slowly). You're phrasing (or closer, shoehorning) his article and your response as a mentorship versus hostility debate, but it feels a bit straw-man-ish misrepresentation to me. Let's keep shifting the other author's position to the "evil" side.

Though, again, perhaps I'm wrong. Maybe it _was_ a "terrible," "ugly," and (now apparently) "hostile" article. However, you'd need to point out the directly hostile parts to me, in that case. Because I missed them.

>That's not what makes the asshole.

Oh, _you._ So cheeky.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I'm 19, and I can give credit to a couple forums (The Web Squeeze and Forrst) and Hacker News for making me successful. If it weren't for a handful of people out of the buckets of everyone, I wouldn't have had the encouragement or motivation to be where I am today. I skipped college, and am cofounding my second company now and leading a team of talented people. I would have never guessed I'd be doing that..even two years ago. If it weren't for you guys and other forums giving me critique, criticism, and encouragement, who knows where I'd be. I've learned soo much from HN, it's ridiculous, but it has helped me in more ways than I can acknowledge.

Anyone can be an encouragement to someone like a younger me, but a lot of people don't. The ones who do however can really make a difference in peoples lives.

<comment><USER11> Congrats on your success. One piece of advice: you can further reduce the chance that you have blind spots due to your skipping of college (which you almost certainly do) by slicing off some time to go through Coursera classes, particularly ones that are a bit far afield and seem like a waste of time. People your age are so damn lucky :)

The thing about college is it forces exposure to stuff you'd never see otherwise. A lot of it is irreplaceable but more and more of it _is_ thanks to sites like these.

<comment><USER12> Great advice. The most important thing to understand about life is that you don't know what you don't know!

Put negatively, if you're not interested in further educating yourself outside of your direct interest areas, understand that you will have certain limitations in life that you will not yourself perceive.

</comment></comment></comment><comment><USER13> How about we leave age/sex/race out of it all and accept them into the community as peers and equals?

I'm all about encouragement, but if we treat them differently because of age, we are just sheltering them from the real world (the Internet hardly counts there, I know). The Internet may not be the safest place to be taught how to accept criticism, but it is a lot easier to take (and more productive) when the attacks aren't personal and instead directed at an app.

<comment><AUTHOR> > How about we leave age/sex/race out of it all and accept them into the > community as peers and equals?

How about because it's not that simple? Being a teenager is fraught with insecurity, loneliness and the perception of being misunderstood. Lots of their maturity is still cooking.

The teen years are also very formative. So if we can take an extra moment to give them the right nudge early in their trajectory, the final outcome of that tiny investment of time could be huge.

If things about a shared project are crappy, that's worth mentioning, of course. That can and should be done in a way that's constructive and encouraging, though.

I don't like the idea of a community that's too self-important to indulge the ambitious fragility of youth.

<comment><USER14> I agree but have one nagging doubt that won't go away. Is it really ridiculous to want one "adults only" community of professional peers that isn't invite- only or purposefully hard to find?

I find it enormously fulfilling to mentor younger programmers and have luckily had many chances to do so. But my personal development always suffered at those places compared to the places where I was working mostly with those near my level or above it.

An online community can't serve two masters, it is either mainly for peer discussion (and elitist) or it is mainly beginner friendly. Beginner friendly often wins out because: "won't somebody please think of the children" is a discussion ender.

</comment></comment></comment><comment><USER15> Why not be supportive and friendly to everyone? I always find the "say it to their face" rule is a good one for formulating even negative comments. Rather than channeling your inner comic book guy, it helps you think of how to state something unpleasant in a constructive, polite way.

<comment><AUTHOR> Absolutely.

But it's worth making a special effort for the young. As I told a teen poster below:

Someone helping me with a project is nice. Someone helping you with a project is an investment in the future. My neuroplasticity wanes with every passing year. Your mind remains limber. I am encumbered by obligations and debts, limiting my flexibility. You have infinitely more options.

Helping you is just a better bet than helping me. You're still on the launchpad, fuel tank still full. If there's something simple, like an encouraging comment or a thoughtful correction, that can be done to help you meet a wonderful trajectory, we should absolutely do it.

</comment></comment><comment><USER16> I can't agree more.

I started my first project, Asturix, a Linux distribution, at age 12. I have found all kind of complications, most of them related with being young.

I live in Spain, where there are a lot of prejudices against youth. Also, the educational system here doesn't empower any "21 century" value such as creativity or inspiration. Fortunately, the situation is changing thanks to the media and other young entrepreneurs and I are starting to be famous in Spain.

On the other hand, working and studying in Spain at the same time is really, really, really hard. Oh, and we have a youth unemployment rate of 54%.

Right now I'm 17 and have founded a couple companies, what has been really hard due to legal issues - creating a company in Spain being underage is practically illegal. I have also started an incubator for hackers from 12 to 18 so they can create their projects in a easier way.

This is a beautiful age for discovering your passion, but if people screw you out it can be a difficult one.

The talent is there, but we have to let it grow.

</comment><comment><USER17> Memo to self:

Make mentoring site (hackernewsmentor.com) Where old and weary can openly agree certain SLAs With the young and enthusiastic

If more of us see it publically more of us will be encouraged to answer a months worth of questions on perl

As for me - I could have done with a mentor not for technical issues - but for the life and career choices I made badly twenty years ago - but I would only have take. Advice from someone whom I technically respected.

<comment><USER18> I'm in. Let me know when you get started with this, I'll help build it.

<comment><USER19> I'd definitely help as well if I could be of any use.

</comment></comment></comment><comment><USER20> Should age be included in a post's _title_? In most cases, the age can be disclosed in the comments without losing any information, and in the process removing any 'negative' connotations.

I posted something on the thread that started this whole dance a day or so ago, however it probably merits further expansion.

Most arguments that are 'pro' age disclosure boil down to "We should treat younger members of the community differently". This comes in many forms, like how we should be supportive, how we should mentor the next generation, and how teenagers are often insecure.

I agree with them, at least in general.

Arguments 'against' age disclosure have a few flavours; some say that we should treat posts based on merit, that we should not discriminate based on age, but mostly it comes down to "Posts with the age in the title are 'gaming' the system (purposefully or not)" and the meta-argument that such posts encourage talking about community instead of the post.

I agree with this side as well.

The thing is, placing your age in the _title_ of your post is link-baity. It may be unintentional or it may be coolly calculated, but in most cases if you remove that piece of information the post title is entirely uninteresting.

So we have two types of posts to consider. The first are those posts where the age of the person involved contributes to how _interesting the post is to HN_. A completely fabricated example: "12 year-old entrepreneur youngest funded by YC".

The second type of post are those where the age of the person involved contributes to how _the HN community responds to the post_. A young developer's first app would fall into this category.

In the first case, I believe this is useful information to have in the post title. In the second this is useful information, however I do not believe it is useful in the post _title_. For these posts, I would much rather see the age included as a comment on the post.

In any post that use of age in the title gets called out for being 'link- baity', 'manipulative' or 'gaming the system' the main counterargument is that knowing the age helps the community know how to respond to the post. The age can be removed from the post title, and placed in the comments, addressing both major concerns.

[edit] improved summary.

<comment><USER21> I'm pretty sure that you do not think the correct response to a title including an age is to rant at the poster, to be rude and aggressive.

It's possible to express dissatisfaction with a title and to encourage better posting habits without being a jerk. I agree with your summary.

The problem isn't with HN being jerks to young people. The problem is with HN being jerks to anyone.

<comment><USER20> I agree that the correct response is definitely not being rude and aggressive, and that is true in pretty much every situation anyone ever comes across.

The main problem I think we have is that posts will continue to be 'link- baity' and some of those will be related to age. Each time one of these hits the front page the community will need to respond to it, and for the near future that response seems likely to be a reignition of this debate.

How do we educate 'drive-by-posters' who create an account simply to post an article (potentially with a link-bait title)? Is it up to moderators to change the title? Users to flag it? Should we just keep arguing about age in post titles?

I don't know the answer, but I think reasonable application of the posting guidelines is appropriate, and for me that means keeping the post title as relevant as possible. Most of the time, the age of the poster/developer is not relevant enough to be in the post title.

</comment></comment></comment><comment><USER22> It's not just the blog article. It's also the attitude of people that will berate a youngster for being young and going out on a limb to show what they've made and making the mistake of telling us their age. That age thing is not a qualifier of pride, it's a guide to the mental state and the amount of experience the poster has. What amazes me most is that after seeing how one young developer gets treated that the next one still dares to post at all.

Danilocampos is exactly right. As far as career advice or tech advice, if you think I can contribute _regardless of age_ feel free to contact me as well, email@example.com . I can't promise to always be immediately available but I'll do my best.

</comment><comment><USER23> As a 17 year old, I disagree, regardless of age, if someone creates or does something that is considered impressive, they should receive credit based upon that - not because of an arbitrary number that supposedly relates to their ability.

<comment><AUTHOR> Then I shall congratulate you for being well-encouraged and thick skinned in your world already. For everyone else lacking such good fortune, though, it would be nice if we could err on the side of being welcoming, rather than hostile.

<comment><USER23> I agree with you on that, but I also think, why should that not be extended to everyone no matter what age?

<comment><AUTHOR> Because it is a grand human tradition to show extra kindness, attention and indulgence to the young, that they might be equipped to build a better world.

Someone helping me with a project is nice. Someone helping you with a project is an investment in the future. My neuroplasticity wanes with every passing year. Your mind remains limber. I am encumbered by obligations and debts, limiting my flexibility. You have infinitely more options.

Helping you is just a better bet than helping me. You're still on the launchpad, fuel tank still full. If there's something simple, like an encouraging comment or a thoughtful correction, that can be done to help you meet a wonderful trajectory, we should absolutely do it.

</comment></comment></comment></comment><comment><USER24> I think announcing your young age alongside your project is important because it opens up more opportunities for others to guide you and help fuel your passion and talent. Without the age, people will assume that the creator is old enough to know what they enjoy and what they want to pursue. But with the age, you'll have people with more experience saying "Since you obviously like X, you should look into Y and Z. Here are some great resources on those topics." Advice like that is invaluable and we should encourage scenarios that result in it.

<comment><USER25> The issue is that most posts that announce one's age don't result in guidance. They result in a chorus of "good jobs" that, although nice, don't offer any real constructive advice.

I've always postulated that one would get more actionable advice and sincere criticism if they did not include their age, and that age merely lowers the bar and dilutes the value of the discussion.

Including one's age might result in comments that make the poster feel better, but they won't make him code better.

<comment><USER24> That is very true. But that's on us for being disingenuous and watering ourselves down; not on the kids for revealing their age.

</comment></comment></comment><comment><USER26> If this is in relation to [http://vishnumenon.com/2013/01/21/im-35-months-old- and-i-mad...](http://vishnumenon.com/2013/01/21/im-35-months-old-and-i-made- this-cool-app/) then I think you miss the point. I agree with the author of that and it is the most common sense post I've read, so far, regarding this issue. The reality is people posting their age doesn't simply mean "I am new at this. I know you guys aren't. I want you to check it out and give me encouragement and guidance." Simultaneously the people throwing out the "age is irrelevant" argument simply miss the point, also. I'm 19 and I've been programming for as long as I can remember starting with my shitty commodore64 hand-me-down. Along the years I have received much criticism and help and am immensely grateful to the people who took the time out to answer every question I had, trivial and otherwise - and believe me, there were plenty of them. However the idea of constructive criticism on HN, and sadly, in the hacker community at large is ironically more political than logical. "Criticism" seems to be code for "I'm smarter than you and I'll be damned if I don't make sure you know it." The hostility towards, not just kids, but people's projects in general borders on the pathological and that's what needs to be addressed. I wholeheartedly agree that kids who are building fun projects do need that nudge and that encouragement to go deeper down the rabbit hole, however we should indeed distinguish between encouragement and patting on the back. The problem is the risk of creating a Hollywoood mentality (Hollywood may be the bastion of acting but really most people are more attracted to the prospects of fame than actual acting). We need to give them encouragement that lets them enjoy the process, not just massaging their egos, and moreover we need to get them to enjoy constructive criticism and see it not as "boo-hoo they didn't like my stuff" but as "hmm I never thought about that." The reality is, the poisonous, know-it-all, thinly veiled political nature of our culture doesn't provide this.

<comment><AUTHOR> That essay called mentioning age "manipulative," which is easily the most jackasstic thing I've seen on the subject. Whatever valid point might have been there was lost in the cold dismissiveness of the author's attitude.

<comment><USER26> So is your point that he was incorrect in stating that a lot of people post their age in order to get to the front page or that calling that action manipulative is wrong? The thesis of the post seemed to me to be if you make a product, focus on making the product better and everything else falls into place. Very fair bit of advice if you ask me. Furthermore, it states another related thing which is, how are you going to get any actual feedback when all the comments are either calling you an asshole or rallying around you, singing war cries. Now with regard to posting age, that's actually very variable why people do that, and from an objective standpoint I don't find anything wrong with that. However if what you're after is guidance then it's pretty obvious posting your age isn't going to get you much of that.

<comment><AUTHOR> Calling that action manipulative is inherently hostile. That's counterproductive.

</comment></comment></comment></comment><comment><USER27> I'm 16 and Things I've written have made the front page twice, both times without mentioning my age. As a teenager, it feels really good to make the front page or #1 with no "omg they're young" bonus points.

Granted, it is encouraging to get bonus up votes for being young and achieving something.

</comment><comment><USER28> There is a reason why there is an age of consent, why there is a youth criminal system, why there are age limits.

Some of you clearly lack empathy.

</comment><comment><USER29> Two cents: I worry that we run the risk of acquiring that awful trend of reddit's to append some personal relation to every post (e.g. "My Brother did this...", "My SO made me a cake", etc) which has become a terribly abused trope.

The user account of the 14 year old kid who posted the Show HN that prompted this was a brand new account. The App Author was listed under a different name than the user account seemed to suggest. It screamed 'manipulation' to me.

I'm all for encouraging younger developers, but at a certain point you have to step back and evaluate whether we're promoting things based on merit or a sense of communal nepotism.

</comment><comment><USER30> Agreed. I always make the time of day to talk to high school or college age kids aspiring to be in engineering or the sciences. Paying it forward if you will, because I got the same help when I was younger.

</comment><comment><USER31> I'm all for people shipping. Age isn't really a part of it. What I'm not all for is people creating an account, posting the thing they're looking to promote and only posting in that thread - otherwise completely disengaged with the HN community.

You can argue that lurkers form part of that community. My counterpoint would be that if you create a specific account and post the thing you're trying to promote in the first 10 minutes, you haven't lurked enough.

Yes I know you can lurk without an account, but to reach the stage where that's considered acceptable you have to travel through if they felt they couldn't register an account for more than 5 minutes, if they felt they couldn't comment and plenty of other ifs, yet somehow they can create an account and post what they're promoting in 10 minutes, then only interact with people in their thread?

Young people should be encouraged. Aaron Swartz was 14 when he worked on RSS. But being young doesn't give you a free pass at being a spammer, and that's what kicked this whole thing off.

</comment><comment><USER32> Other people shouldn't get encouragement and guidance and tolerance for their newness? Suggesting that you are an x years old child prodigy has become a cheap way of getting front page. If we are going to be nice to new projects we should be nice to them regardless of the claimed age of the author.

<comment><USER33> I didn't read this as exclusionary -- it's just a shorthand way of saying how much experience one has. Someone who is 35 could easily say "I have [X] number of years using [technique/technology]."

If someone doesn't indicate age or experience, the default would be to treat submissions or projects as the marketplace would.

</comment></comment><comment><USER34> _Getting young people into science and technology is the single greatest professional duty any technologist has._

What? I don't understand this at all. The "single greatest professional duty any technologist" has is unique to that "technologist". If, for example, I'm a 23yo kid who just graduated uni and in my first job, do you think for a second that I give a #$(* about "getting young people into science and technology"? Of course not. I'm so busy trying to figure basic life out that I don't have time for that sort of thing.

If I'm a 33yo dad who wants to start my own business, I don't care one whit about 'getting young people into science and technology' b/c, between working 60 hours a week and changing my kids' diapers, I'm sleeping.

Good for teens - glad for them - but this statement is just silly.

<comment><USER35> I'm a 19 year old and when I got into college I remember thinking that I would love to interview prospective students after I graduated.

Maybe you don't care about mentoring young people, but there are certainly many, many people who care a lot about that.

<comment><USER34> _Maybe you don't care about mentoring young people_

I carefully crafted my reply and for you to mistakenly read that into it made me go back and re-read my reply. I don't see where you get that I say that I "don't care about mentoring young people". Please take the time to point out where/what part I seem to imply that I don't care about mentoring young people. Actually, hell, I'll make it easier for you: point out where I state my opinion about what I prefer at all.

Please - before you misquote, misunderstand, and then slag someone, take the time to re-read what they've written. Maybe it's your reading comprehension that was the problem rather than their post.

And besides, "there are certainly many, many people who care a lot about" (insert anything ever here). There always has been and always will be. Stating the obvious doesn't really help here.

<comment><USER35> The part that got me to think that was when you said:

> I don't care one whit about 'getting young people into science and > technology

Sorry if I misunderstood, and maybe we're just arguing between "mentoring" and "getting young people into tech," but I was referring to your sentiment as opposed to some exact wording.

<comment><USER34> I think you need to check your ego and re-read what I wrote without an outside bias. Maybe English isn't your first language and that's causing some block for you - I don't know. But to yet again quote me out of context just highlights how poor your reading comprehension is for a second time.

Protip: I'm not a 33yo dad who wants to start a business.

</comment></comment></comment></comment></comment><comment><USER36> I read a couple of days ago a blog post written by a 17 years old in which he was stating a rather interesting fact. He was saying he prefers to omit mentioning his age on forums and discussion boards (such as HN) because he wants to be critiqued for his work regardless of his age.

I found that to be incredibly accurate. Most of the kids want to just show-off their projects, but there are still a lot of them who want genuine critique.

So, if you want to get real opinions about your project and you post on HN or reddit, you should put on your big boy pants.

</comment><comment><USER37> I agree. Kids post their age to get attention. They want experienced devs to take a look at their code/app/project. Lets help them! All you need to do is a upvote or comment.

</comment><comment><USER38> In a lot of communities, the "this is my first post" is often celebrated. On HN it definitely is not, which is kind of strange. Glad you put this out there danilo.

<comment><USER39> Maybe a question of size. In a small communities, everybody knows everybody. Here, it is not the case, we do not look the persons, just the result.

</comment></comment><comment><USER40> Age part should not be thrown away. There are lots of young people out there, myself included, that are in need of advice, tips and help( even saying that something I've done is wrong and bringing some arguments, suggestions and whatever you thing it is useful is better than nothing, at least I know where to start improving my skills and work)

</comment><comment><USER41> Let's treat all fellow human beings this way. We are all kids at heart.

We are all seeking approval.

Why admonish or dismiss anyone? What good does it do?

I don't mean to diminish from your point, because I think it is absolutely correct.

</comment><comment><USER42> It sounds like this was inspired by a single incident, so is this really as large a problem as described? Also, for a fun game, replace the word "attention" with "money."

<comment><AUTHOR> This is an ongoing bad attitude, actually. This was just the latest example. Kids who post their age often have their comments devolve into moronic arguments about whether their age should really matter.

</comment></comment><comment><USER43> s/young/any/

</comment><comment><USER44> Who killed the thread?

</comment><comment><USER45> My name is Kabir, and I am looking for young, motivated, and passionate individuals to help me with my great startup idea. If you are willing to talk, shoot me an e-mail at; email@example.com

Lets get to work!

<comment><USER37> Wrong place, wrong time. Better to learn the trade by yourself!</comment></comment>


Boston public schools map switch aims to amend 500 years of distortion - <AUTHOR> https://www.theguardian.com/education/2017/mar/19/boston-public-schools-world-map-mercator-peters-projection <comment><USER2> > " _The result goes a long way to rewriting the historical and socio- > political message of the Mercator map, which exaggerates the size of > imperialist powers._ "

> " _This is the start of a three-year effort to decolonize the curriculum in > our public schools..._ "

 _Decolonize_ is guilt-inducing newspeak for injecting propaganda into school curricula. Also, my peers and I learned about Mercator's pros/cons and other projections in elementary school.

> " _The Mercator projection had "fostered European imperialist attitudes for > centuries", creating an "ethical bias" for "western civilization" against > the developing world._ "

Baseless statement.

Everything is viewed through the lens of oppression and race war. The real reason of the ubiquitousness of Mercator is barely mentioned in the article. From the comments "Mercator was made for mariners who navigated by dead reckoning. Holding a compass steady course on a sphere will produce a curved path. On Mercator it is a straight line." Gerardus Mercator was aware of his map's shortcomings and merely followed the engineering rule _Form follows function_.</comment>


Ask HN: When should I worry about legal docs? - z-magic

Hey everyone,
Aspiring startup guy here.
I am in the early stages of developing a social app, but I am quickly heading to a point where I want to beta test with my larger College community.
That being said, when do I need to worry about Terms of Conditions, DMCA, Privacy Policy etc.
Should I incorporate and become an llc before any of this?
Also, would I be able to adopt legal documents from other similar apps eg Snapchat, Instagram and tailor it for my specific app?
Any insight would be appreciated. Thanks hackers! <comment><AUTHOR> Handle all the legal stuff up front were it is much easier and affordable. My advice to you: a few hundreds up front with an attorney and certified professional accountant will save you thousands or millions down the road.

I recommend starting your business up front as it is cheap to do so ( legalzoom.com ) and helps you run your business in a proper structure for growth from the beginning. In terms of what documents to use you, can only adopt what others have once you receive their official permission from an officer of the company authorized to allow you to do so. Also note that copying their terms may not be applicable to your business or give you the best benefit legally so getting legal advice from an attorney is advised.

If you want to enable more investor options you will have to convert your LLC to a Corporation so insure that you know the differences between the two and plan out what you want to do up front. When you have an LLC up front you can have the separate business accounts and separate your personal assets from the business assets which will help you keep your books straight along with with having the ability to show your cash flow to potential investors without having to include personal items in it that are irrelevant to the business.

You can build the product or other things once you have a product and do not need to start the business up front until your really ready to start marketing it, bringing in employees, investors, etc.

</comment><comment><USER2> Incorporation is not a straight-forward question. Depending on what kind of IP you have (if any), what kind of costs and when you anticipate revenues, can all affect your position (notably in respect of future tax issues). Also assuming in all this that we are talking about US jurisdictions of some kind. Generally speaking, you probably want to incorporate before you start incurring significant costs and liabilities or before you start accumulating significant assets (including IP). There are a ton of resources online about this kind of thing so I'd recommend doing a basic google search and going from there but ultimately it is worth speaking to a lawyer or accountant about this.

As for legal docs, this is often a catch 22 for start-ups and again, will depend a lot on your circumstances. What are your risks (i.e. what does your app actually do)? By looking at many different examples online, you can probably get a good idea of the kinds of things you need to cover, but a lot of it will be specific to your business. Many law firms offer start-ups deferred fee structures so even getting a lawyer to help doesn't necessarily have to cost you an arm and a leg....

</comment><comment><USER3> I formed an LLC early when I was doing my startup, and regretted it b/c it became a burden to maintain all the necessary records I might have not had to do if I had chosen to incorporate later- like when I had paying customers. I would wait as long as I can stay unincorporated if I were to do it again.

I would create a Sole Proprietorship first, before there are many assets belonging to the startup- it'd allow for the use of company accounts with vendors, without the cost associated with an incorporation. I think it was less than $50 to do that.

As for ToS, I believe that would be a good thing to get in place early on just to have some sort of protection/insulation from liability as far as that would provide. There are resources on HN if you search to help get that done at minimal cost. I hired an attorney to do mine, & it was way more expensive than it had to be, as I learned later.</comment>


Ex-Neuralink employees describe rushed timelines clashing with science's pace - <AUTHOR> https://www.dailymail.co.uk/sciencetech/article-8662975/Elon-Musks-brain-chip-Neuralink-plagued-turmoil-rushed-timelines-former-employees-claim.html <comment><USER2> The bit that caught my attention is that 6 of the 8 founding scientists are gone. I bet the former and current heads of AutoPilot are shaking their heads now. Sterling Anderson -> Chris Lattner -> Stuart Bowers -> Milan Kovac. Note how there was a progression from experienced highly respected scientists and engineers until Elon finally put in place someone who owes his career to Elon.

<comment><USER3> In the real world, the people who get stuff done get replaced with Yes Men who go "yes, no problem, we can hit that deadline" and end up delivering trash.

Tesla's self driving division will really have to include a beheading life insurance policy for me to buy their cars after the shit that came out on Twitter about how things are done in their "move fast, break things, kill people" organization.

<comment><USER4> There have been a total of six deaths related to Autopilot misuse over 3 billion Autopilot driven miles by the fleet. Humans are terrible at risk management.

<comment><USER5> > There have been a total of six deaths related to Autopilot misuse over 3 > billion Autopilot driven miles by the fleet. Humans are terrible at risk > management.

Or, humans rightly assessed that despite marketing to the contrary autopilot only really works on the _easiest_ part of driving (highway miles) and still managed to kill 6 people.

<comment><USER6> > despite marketing to the contrary autopilot only really works on the easiest > part of driving

Is that not what Autopilot is sold as? Does it not make you read and accept a disclaimer stating exactly this?

<comment><USER7> The things the ceo proclaims on stage and in the press are marketing -what it's sold as.

A click wrap legal disclaimer after you already purchased the thing is in no way what something is sold as. It literally can't be - because you have already bought it.

</comment></comment></comment></comment></comment></comment><comment><USER8> Seems like great thing. The fact is that science may be moving too slow and given proper motivations could move faster. If it can not move any faster then you quickly figure that out that you've gotten you answer, and you can circle back in a few year. But if so you've effectively moved the needle past what people thought was possible and you have a moat the size of the pacific ocean.

<comment><USER9> "...and that, ladies and gentlemen, is how I invented Thalidomide."

We're talking about a technology with the potential to cause accidental aneurisms and lobotomies. Maybe some conservatism really _is_ in order?

<comment><USER8> Seems like a better testing suite is in order. How many times since then has that happened, and have we gotten better at figuring out issues before they become this big of an issue.

I ask this because we've had everything from chernobyl to the Columbia rocket explosion. We didn't hamstring those things. We got better at anticipating them.

<comment><USER10> Remember, it doesn't matter if you've survived 100 Chernobyls, 50 Tsunamis or 20 Covids, all it takes is one bad one to wipe you out of the gene pool(kill). The worse is called worse precisely because it did not happen until then. Yes, testing helps but only when you know what to test, a hastily designed system where the workers are put under pressure and made to ssh into a fleet(See: [https://twitter.com/atomicthumbs/status/1032939617404645376](https://twitter.com/atomicthumbs/status/1032939617404645376)) to fix bugs, is not a mere matter of testing. It is a matter of culture, autonomy, prudence, care, and add other things that would help build a well- designed system from ground up.

</comment></comment></comment></comment><comment><USER11> The descriptions in the article sound like every early stage startup that has ever existed (except the monkeys part).

<comment><USER12> _"Meet the new boss, same as the old boss"._

Not just startups, any corporation too, or retail, hospital, etc. People have another thing coming if they think this is not standard life at most workplaces.

There will always be a tit for tat between labor and employers. It's a perpetual conflicted relationship that needs constant maintenance and compromise to achieve sane productivity.

</comment></comment><comment><AUTHOR> The original article is paywalled. Here is a detailed summary (by Daily Mail tho): [https://www.dailymail.co.uk/sciencetech/article-8662975/Elon...](https://www.dailymail.co.uk/sciencetech/article-8662975/Elon- Musks-brain-chip-Neuralink-plagued-turmoil-rushed-timelines-former-employees- claim.html)

<comment><USER13> Arghh such mixed emotions... I want to read, but not on Daily Mail. Maybe there is a browser extension/userscript/css that makes daily mail palatable.

<comment><AUTHOR> Exactly, this is why I had avoided posting the Daily Mail article.. Unfortunately their summary seems quite complete.

</comment></comment></comment><comment><USER14> This is typical of Musk companies:

Tesla:

[https://www.businessinsider.com/ex-tesla-employees-reveal- th...](https://www.businessinsider.com/ex-tesla-employees-reveal-the-worst- parts-of-working-there-2019-9#dealing-with-the-companys-growing-pains-2)

[https://www.ccn.com/tesla-elon-musk-circus/](https://www.ccn.com/tesla-elon- musk-circus/)

SpaceX:

[https://www.businessinsider.com/former-spacex-employee- worki...](https://www.businessinsider.com/former-spacex-employee-working-for- elon-musk-2017-11)

[https://qz.com/281619/what-it-took-for-elon-musks-spacex- to-...](https://qz.com/281619/what-it-took-for-elon-musks-spacex-to-disrupt- boeing-leapfrog-nasa-and-become-a-serious-space-company/)

Well, the cars look great, the rockets look great. Now we wait and see if it works for the mind-machine interface. I don't think HN is capable of generating good predictions on this.

<comment><USER15> Maybe in 50 years workers will be forced to impant this thing. Imagine your boss screaming at you literally in your brain because neuralink is telling him you feel lazy!

What can be abused will be abused!

<comment><USER16> Nah. I don't buy it. I don't think that future will ever come to pass in any democratic country, even a sham democracy like the US. The evil forces haven't even managed to get an encryption-backdoor law passed, and most policymakers don't even understand that issue.

What you're describing is so far beyond any social issue of today in terms of egregious and horrifying threats to society that it would just get voted out of existence so hard you'd barely know it was ever a risk.

Nobody will ever let thought intrusion come to pass.

<comment><USER17> On the flip side, everyone is now walking around with an internet connected camera, microphone, and location tracker in their pocket. Most of us are livestreaming their location to cloud services.

I don't think this will come to pass as a mandate from on high, but it might come to pass as a practical device that everyone needs to function in modern society.

</comment></comment></comment></comment><comment><USER18> Good?

Quality, cost, speed; I'd pick quality and speed.

<comment><USER19> There's diminishing returns along all those axes, suddenly throwing billions of dollars at a problem doesn't automatically yield a fast, high quality result.

<comment><USER18> But there is a sweet spot. Musk seems to be good at finding it.

<comment><USER20> There are many sweet spots, Musk is good at targeting the "deliver quickly, fix the glaring problems later if at all" sweet spot.

<comment><USER18> I still don't understand all the negging, Musk has done more for mankind than most people on here combined. Must be jealousy.

<comment><USER20> Part of the culture of "move fast and break things" is that sometimes the things you think are "broken" are going to end up not being included in the final product, or will be better optimised later, once you understand the process better.

It's like spending time developing a sprue-cutting process is going to be wasted when in the next iteration you refine the manufacturing process to no longer leave sprues connecting moulded parts.

</comment></comment></comment></comment></comment></comment><comment><USER21> Tesla, SpaceX and Neuralink are very different companies, different kinds of products, different markets with different dynamics. So it's hard to compare.

</comment><comment><USER22> I would not bet against Elon musk. He has the ability to recruit the best people in the world and has a near unlimited supply of funding.

</comment><comment><USER23> Elon Musk leaves a trail of destruction with the early employees of his companies but the results are tremendous and have huge implications for humanity. I'll give Musk the benefit of the doubt at this point.

<comment><USER24> I'm not sure that the high churn rate at the high end is really in Musk's interest, but it MIGHT be in society's interest. Instead of sucking up a bunch of highly skilled and driven people indefinitely, the few who are able to work well in that environment stay and are able to get stuff done while the others leave and spread the knowledge elsewhere, perhaps starting up competing efforts that either complement Musk's efforts or give Musk a run for his money. This is a strong argument against Non-Competes.

<comment><USER23> It probably is in Musk's interest too. Musk has earned the benefit of the doubt in trusting his decision as to "should Very Smart Person X be employed by Neuralink" or not. There's a lot more to making a company successful than being competent and as much as I find Musk personally distasteful there is nobody with his track record at building transformative private sector companies.

</comment></comment></comment><comment><USER25> I have personally come to a conclusion that people like Elon will always have disgruntled employees around him, and the bar for expressing dissent with Elon should be high and responsibility should be on them to express the dissent and not for us to read between the lines.

Unless every employee who has quit documents convincing literature they don't get any of my attention.

</comment><comment><USER3> This is very surprising as this an Elon Musk company and he has never in the history of his companies every tried to rush a timeline of a product.

<comment><USER26> Given Tesla's track record, I find that statement hard to agree with. I have no qualms necessarily with most nuts and bolts part of it, but the entire self driving division reeks of rushed compared to what the project actually requires.

<comment><USER27> What feels rushed about a custom ML chip an order of magnitude better than NVIDIA?

<comment><USER28> It's cool that Tesla made an ASIC, I guess.

I think more relevant though, would be Tesla's hype around "Autopilot" when they still can't reliably avoid parked cars.

<comment><USER29> Ok the freeway, my Model 3's autopilot is amazing. It's not 100% on surface streets, but it's impressive given all the edge cases and the scale of the problem.

<comment><USER30> They get around that by saying that autopilot is not meant to pilot the car automatically.

<comment><USER29> It's clearly marked as in development. What's impressive to me is just how good the 80% solution they have is, even without the additional FSD package.</comment></comment></comment></comment></comment></comment></comment>


Dart vs. Swift: A Comparison - <AUTHOR> https://medium.com/coding-with-flutter/dart-vs-swift-a-comparison-6491e945dc17 <comment><USER2> Nice overview. My eye caught one bug: the code for _"iterates over a list of items, using a closure to print the index and contents of each item"_ is buggy in both examples; it will print incorrect index values if the list contains duplicates.

It also is inefficient, searching the list for every value in the list, turning an _O(n)_ algorithm in _O(n²)_.

It's easy to prevent that by just keeping track of the index value, increasing it in the lambda. That"s ugly, but both faster and correct.

In Swift, you can do better by using _enumerated()_ ([https://developer.apple.com/documentation/swift/array/168783...](https://developer.apple.com/documentation/swift/array/1687832-enumerated)). Chances are Dart has a similar construct.

(Yes, I know that's not what is being discussed in that section, but people will copy-paste that code and learn incorrect patterns from it. To prevent introducing two concepts in one example, I would change the example to just print the items, and add an item on the use of _enumerated_ )</comment>