I stayed in a hotel with Android lightswitches and it was as bad as you'd think - <AUTHOR> http://mjg59.dreamwidth.org/40505.html <comment><USER2> So sad. I find the mechanics here really challenging to overcome. The hotel management no doubt wants "really cool tech" for their hotel to show they are up to date etc. And they send out an RFQ which someone bids on, really cheaply. Knowing that by only doing the things the hotel asks for, they can throw something together quickly and cheaply for a big payday.

This is _exactly_ the mechanism that gets people in trouble going to China for manufacturing. They say "I want you to build widgets" and they get a good price quote, and say "Wow, this is awesome!" because they have in their mind that "making things in China is cheap" but in reality its that if you cut a lot of corners you can make things really cheap, and since the contract doesn't say you _can 't_ cut corners, it is all "perfectly" legal. But the manufacturer knows what the buyer doesn't, and exploits that information asymmetry to make money at the buyer's expense without the buyer having any true recourse.

The hotel in question could have said in the RFQ, "System will be impervious to network traffic snooping and at no time will systems or a guest supplied computer be able to access the controls in another room."

Had they said that, the price quotes would have gone up and had the system the author speaks of been delivered, the Hotel could recover the costs of installing it from the vendor. But they hotel didn't even know they _needed to ask_ for that since they no doubt would assume, "nobody would make something that shoddy would they?"

I learned about this when I saw one of the rules in a NetApp hardware contract that said "Manufacturer will install all components shown on the schematic on the final units in their designated locations." That seemed really odd. I learned that before that clause had been part of the standard contract, there had been a manufacturer who decided unilaterally that half of the noise suppression capacitors in the schematic were "unneeded." Units from that manufacturer started failing in odd ways in the lab.

<comment> Jean-Philipe I agree with you on all your points, except:

> This is exactly the mechanism that gets people in trouble going to China for > manufacturing.

I keep hearing about the "cheap Chinese tech", even though nowadays a lot of high-quality gadgets are really Chinese. Even Apple's products are mostly from China. And it's not even for the cheap prices, it's because the entire production chain is there[1]

The mistake is not going to China, it's going to China just in order to save money - or anywhere, for that matter. I get that your point is not actually about China, but saving money on the wrong things.

I'd just appreciate if we could stop using "Chinese" as a synonym for "cheap".

[1] [http://www.heraldtribune.com/article/20120123/ARTICLE/301239...](http://www.heraldtribune.com/article/20120123/ARTICLE/301239999)

<comment><USER3> The practice of unethical corner cutting seems somewhat rampant in China, though. And isn't there a reason why cheap tools that easily break are said to be made of "chineesium"?

<comment><USER4> But it is rampant in whichever location has the whole supply chain.

It was rampant in the US when there was the manufacturing workshop of the world, and rampant in the UK when they were before them.

<comment><USER3> That's interesting. What causes the correlation?

<comment><USER4> The full history of commerce. :p I'd suggest looking at the history of food and drug regulation and testing, or weights and measures regulation if you want more. The early years of both UK and US food and pharmaceutical regulation is terrifying!

TL;DR Immature locations cut more corners. More regulation, experience and reputation helps. Consumers are naive. Manufacturers want you to buy the same things many times over your life.

In all markets, There's always going to be someone willing to cut corners to secure a place in a market, or make a fast buck in a mature market. Or maybe it's a new market that can't yet have matured. That's only part of the problem.

As markets mature regulation increases and companies tend to trade more on reputation (not always deserved of course. eg Beats headphones). Now there's an opportunity to trade on the good reputation of wherever (Proudly Made in America! / Britain! / Japan!), whilst selling you cheap crap. That's the other half of the problem. The meaningless label to tell the consumer it's made wherever they currrently believe is good.

In the early 80s most things Japanese were crap. Hifi sounded awful, but had lots of LEDs. Bolts, tools and vehicles were made of soft cheese. Their stainless steel rusted (I kid you not)! Honda made cam chains of special stretchy metal and probably accidentally invented cheese strings. Now Denon make very nice hifi, Teng make very nice tools and their cars are pretty reliable.

Why pay £50 for a Snap On or Britool[1] spanner when there's an almost identically packaged one, made in the same place, for £3 or £40? Only one will last longer than you in daily use. One risks breaking on first use.

So, it would be more accurate to say "isn't there a reason cheap tools break", "cheap materials break", "consumers naively expect $100 quality for $3.99" or "dishonest people are dishonest" than blame a specific locality.

The ONLY thing that has changed is all manufacturers adding built in obsolescence whenever possible. Now even the premium item is made to last "just long enough" (to get away with), but that doesn't make any one location especially good or bad at making stuff.

The only thing geography introduces is the further away it's made, the harder it is to audit your supply chain. Racism and nationalism has no relevance however.

[1] They're no longer British, or often made in Sheffield, they're just another meaningless brand of Stanley trading on 100 years of reputation. You're actually better served buying Teng these days.

</comment></comment></comment></comment></comment></comment><comment><USER5> When I stayed there, it was just as soul destroying to use these things as you might imagine.

The implementation felt like they'd asked a VB6 dabbler to implement it in Java. Then stuck it in the cheapest 600mhz tablet they could find.

The UI was purely a button grid with distorted graphics, and dodgy typography. Button presses took about 1/2 a second to respond, and every 5th press caused the app to crash (adding a good 30 s to the experience).

My room had 4 tablets* in, and all of them behaved exactly the same way.

* the idea of a tablet to control the room is neat if it could be moved around. Like a remote-control. But for security (and using Ethernet) they were all fixed down. Making them far more useless than plain switches

<comment><USER6> Light switches that can fucking crash!

Now I'm living in the future.

I keep waiting for this iot/we put a chip in it/etc to produce results _that are an improvement_...

<comment><USER7> [https://twitter.com/internetofshit](https://twitter.com/internetofshit)

Edit:

Here are the greatest hits. [http://favstar.fm/users/internetofshit](http://favstar.fm/users/internetofshit)

By the way, it seems like extreme product fail on Twitter's part that I have to go to a sketchy third party site to get the top tweets for an account.

<comment><USER8> > By the way, it seems like extreme product fail

Not necessarily. They just decided not to have this specific feature. It is a product design decision.

<comment><USER7> Of course they decided not to have it. It's not like they aren't capable of implementing simple features. I just think it's a dumb decision.

For _many_ Twitter accounts, the top tweets are a lot more interesting than the latest tweets, especially if you've just discovered the account for the first time.

</comment></comment></comment></comment></comment><comment><USER9> I'm amused by the use of Modbus. I worked on Modbus networking back in the 1980's at Modicon (a company that disappeared long ago that created the "standard"). Using a protocol invented before the internet to control devices on a semi-public network is insane.

The original Modbus was designed to communicate with factory devices controlled by logic controllers over serial and eventually over a custom token ring network. Modbus got moved to TCP at some point when I stopped paying attention. Modicon rejected TCP when I was there because the OSI model 7 layer network stack was going to be the next big thing.

<comment><USER10> I think if people actually knew the true extent of the _debacle_ that industrial control protocols are, they would pass out. If you ever want nightmares, check out EtherNet/IP CIP protocol...

Of course, there are no security provisions whatsoever. If you can get a device on the LAN, you're golden. Every device, fully open to monitoring and control of every attached piece of equipment.

In the new world of inexpensive, battery powered LoRaWan to Ethernet bridges with tens of kilometers range, I can't even begin to imagine the industrial carnage we're heading for. A sufficiently funded attacker could find ways to implant remote monitoring _and_ _control_ in virtually every facility, where they can get a minimum-wage cleaning staff member hired. That means -- pretty much every facility (short of military, perhaps).

Exciting times.

<comment><USER11> I recently went to a LoRaWan workshop funded by my megacorp (a utility company). It felt like paying someone to try and sell you their stuff.

Anyway, what the LoRa did emphasize is that both the network layer and application layer are encrypted with different keys using AES. This means someone would have to compromise both layers to actually control the devices.

Buuut, given that both encryption keys are stored on the device, I bet someone will just walk up with a chip clip and read the keys right out of EEPROM and then the pretty lights will start.

Or they'll just hack the application servers. I've seen some really god awful pieces of software in use.

A vendor once told me "it's so easy to admin our device over the internet. Just go to 192.168..." And of course due to corporate politics we still bought that piece of shit.

<comment><USER12> > read the keys right out of EEPROM

Usually keys are stored in a part that is not accessible directly, think of SIM and bank cards. Actually lots of LoRaWan use SIM cards.

</comment></comment></comment></comment><comment><USER13> Turning lights on at 3 a.m. is a nuisance. Knowing when lights go on and off can tell you when the people are not in their room - which could help if you wanted to break in and steal their stuff. Overall quite disconcerting how lax they are with security.

<comment><USER14> I think the implication was that some asshole can obtain photos of you sleeping by opening the curtains and switching on the lights in the middle of the night. A nuisance, sure, but also a massive violation of privacy.

<comment><USER15> > _the implication was that some asshole can obtain photos of you sleeping by > opening the curtains and switching on the lights in the middle of the > night._

So, somebody is going to set up shop across the way, in what is probably another commercial building, commit a couple of crimes, all to take a picture of some random, likely unidentifiable person sleeping in a hotel bed?

Personally, I'm not very worried about that.

I mean, it's not like there aren't easier attack vectors for creeping on people in hotel rooms if you were so inclined.

<comment><USER16> How about setting up shop next door to get pics of $random_politician getting a blowjob for blackmail material?

<comment><USER17> Or taking a shot at the clearly surprised and now well lit individual.

<comment><USER18> That would be hard to swallow

</comment></comment></comment></comment></comment></comment><comment><USER19> Maybe it's worse: If these are really off the shelf tablets, presumably the camera can be turned on remotely. Though I'm sure the hotel would have put a piece of black tape over it, right?

<comment><USER20> And the microphone

<comment><USER21> And the GPS

<comment><USER22> Except they a) know where the room is anyhow and b) GPS doesn't tend to work very well indoors

<comment><USER23> And the Joke Sensor

<comment><USER24> And my axe!

<comment><USER24> The downvotes were worth it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> "Jesus Molina talked about doing this kind of thing a couple of years ago, so it's not some kind of one-off - instead, hotels are happily deploying systems with no meaningful security, and the outcome of sending a constant stream of "Set room lights to full" and "Open curtain" commands at 3AM seems fairly predictable."

Which takes us to this: "Any sufficiently advanced technology controlled by a miscreant is indistinguishable from a possessed object in a Stephen King Novel."

[http://thefutureisastephenkingnovel.com/assets/player/Keynot...](http://thefutureisastephenkingnovel.com/assets/player/KeynoteDHTMLPlayer.html#2)

<comment><USER26> I can't wait until Random Q. Hacker can flood the lobby with blood from the elevators.

And if you wonder why the blood reservoir has to be connected to both the elevator shafts and to the Internet, I ask you this: who would want a _dumb_ blood reservoir in their hotel? I mean, _obviously_ you have to have one, but wouldn't you rather be able to query tank levels from your phone and automatically order refills online? Nobody wants to be the unlucky employee that has to go up there with a dipstick at midnight during a thunderstorm, right?

</comment></comment><comment><USER27> I feel like I'm missing out on a huge bulk of money simply because when I have ideas of "Internet of Things", I cant get over the security obstacles and cancel the ideas. If only I just didn't care (or didnt know) and just implemented whatever the heck brought in money from oblivious customers.

<comment><USER28> Under pressure in an interview, yesterday, I found myself saying "'The Internet of Things' is short for 'The Internet of Things you don't need, sending surveillance data you don't want, to people you don't know.'"

<comment><USER29> > to people you don't know

What is worse, your data being sent to people you _know_ or to people you _don 't know_?

<comment><USER30> I argue to people that I'd rather have my photos on Googles servers than on the friendly local Dropbox clone.

Why? Because I know Google has systems in place to detect sysadmins browsing in data unrelated to their job and I know they have fired people over it even if was tought to have been done with good intentions.

Edit: as for tracking I wish they would up their game and stop providing ads for <insert eastern country here>-dating.<tld-of-the-day>

I wish they would take into consideration that I am happily married with more than 3kids, belongs to a subset of the population that has way less than 10% divorce rate and I might even be in the market for a new car at some point.

In fact I would even tell them if they asked.

</comment></comment></comment></comment><comment><USER31> This is the unfortunate outcome of a bunch of factors.

OEMs moving to XXX over TCP protocols which have zero security by default and documenting this in the datasheets.

VAR installers switching to the newer products because CAT5 cable is cheaper and easier to pull than what they used to use.

The previous solution was just as insecure but harder to hack because you needed more specialised equipment.

I'm not sure how we are going to fix this without getting the OEM industry and the industry bodies behind xxx over TCP to understand that they need to bake a security model in.

<comment><USER31> Also, for the particular case of MODBUS over TCP, MODBUS itself doesn't have any security aspect (by design) it is a very simple byte read/write protocol really.

[http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b...](http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf)

<comment><USER9> Just read over their FAQ. They claim that Modbus over TCP is an internet protocol. No where do they even mention security. I wonder how many devices are sitting on IPv4 addresses that are completely controllable over the net without a shred of security. Lovely.

<comment><USER31> Previously: [https://blog.shodan.io/dont-be- clever/](https://blog.shodan.io/dont-be-clever/)

> For example, you might know that Shodan crawls the Internet for industrial > control systems (ICS). One of the most popular protocols in ICS is called > Modbus that runs on port 502. At the moment, there are about 17,000 devices > listening to Modbus on the default port. It turns out there are also 700 > devices listening on port 503, again a one-off sort of situation.

Probably over 20k by now

<comment><USER9> Thanks. Exactly as bad as I expected.

</comment></comment></comment></comment></comment><comment><USER32> Technology for technology's sake is a real shitshow and a big problem.

I was in my friend's Honda Pilot the other day, which has the new trendy big screen interface to replace the radio. I'm sure it is insecure junk, but more importantly it is a nightmare for humans.

I have a BS in CS, have developed some enterprise apps, run major complex tech programs successfully, and could program my dad's VCR in the early 80s. And... It took me nearly 10 minutes to figure out how to turn off the radio on the weird touchscreen.

To turn the radio on requires 4 clicks, and the key button is on the corner of the screen, where it is least responsive to touch. I would probably be safer driving with my knees and texting with two hands than controlling that radios.

</comment><comment><USER33> KNX, being one of the most sophisticated and proven building intelligent protocol, widely adopted in Europe.

If anyone interested, cross scan its default IP interface port 3671 and, say German telecom ISP IP range (and there is CSV available on www), with efficient penetration test tool like masscan, challenge it with 0x0205, look for 0x0206 on response.

Thousands of home and factories and commercial buildings welcome you with real time datagrams on all their switches/appliances/presences/sensors/cams/... Bonus point: writable!

</comment><comment><USER34> The title is implying that Android is the culprit here, and not just a horrible design and implementation.

<comment><USER35> yes i was also misled by the title. You read again, android in the text as well as in the title as if something to do with the android OS is responsible especially taking into account that the guy is a security developer at CoreOS.

* "I stayed in a hotel with Android lightswitches and it was as bad as you'd think "

Another title would be:

* "CoreOS security developer stays in a hotel, and hacks the light switches to.."

</comment></comment><comment><USER36> All that internet, and the android tablets are still just sitting on the wall where the light switches used to be. What's the cost in hardware and electricity to move from light switches to android tablets for an entire hotel?

<comment><USER37> Look, the sales guy gave the president a _really_ nice lunch.

</comment></comment><comment><USER38> I feel like the only thing that can fix this type of mentality is a line of products targeted towards annoying nerdy 13 year old boys-- the type of boy that a lot of us were. We need to make it easy for them to abuse security lapses in IoT products. When I was in middle school, I brought a universal remote to class and turned on the television set. Yeah, _I know,_ I was a badass. But these kids will do much more.

The problem is that when a software engineer goes to the front desk of a hotel and complains about the security of the brand new Android-Powered Hi-Tech system that they just put in, the person working the desk thinks, "Haha wow! That nerd was a real Sheldon Cooper, like on the television!" and they don't care at all. If you live in a bubble where programming and computer work is black magic, well then of course it is completely inevitable that someone so nerdy and so smart would be able to hack everything on the planet. So they don't really think there's anything to be done.

When it's a group of annoying little 15 year olds that sneak out in the middle of the night to wake up all of your guests, it's a lot bigger of a deal.

<comment><USER39> Not sure why this is getting downvoted. This is a big part of what happened with internet security over the years.

Back at the dawn of time, less than a billion seconds from epoch, it was considered rude to exploit obvious security holes. People would actually track down casual hackers and get them in trouble. But once script kiddies came on the scene, it became a lost cause. Once it could be any 14-year-old idiot on the planet scanning your ports and exploiting your old, unpatched software, it became clear that tacit agreements and social pressure weren't enough. The burden of security began to shift to people who created the software.

</comment></comment><comment><USER40> This whole IoT craze is turning into a nightmare. People are building all kinds of devices in complete ignorance of Security.

<comment><USER41> Just let them. The sooner people realize that buying a cheap $35 smart watch, or embedding the cheapest Android tablets into walls, or turning off your heating completely after the battery in your smart thermostat dies... the sooner we'll be in a place where the security of IoT is actually considered, not only as important, but as crucial. Then, we can have nice things.

<comment><USER42> Maybe we'll end up with a standard certification equivalent to UL or the green padlock next to the URL. Probably about 5 years in the future.

</comment></comment></comment><comment><USER43> I liked how the article gave the commands used to set up the correct networking config with the bridge.

Can anyone recommend a good reference / tutorial for learning basic network-fu in unix ?

</comment><comment><USER44> Yeah, wow. Twelve years ago, I worked for a firm that built DVOD (digital video on demand) systems for hotels across Australia and UAE.

Even then, and with the limited 'damage' that could be done, each and every single room got its own VLAN. That was certainly a little ugly to manage at times, especially in a 1200 room hotel, but yes.

VLANs.

Authentication.

Something.

Anything.

</comment><comment><USER45> Isn't this just a modern day equivalent of Phone Phreaking ?

There used to be party lines in villages where the whole village could listen in to anyone's phone call.

Never mind the operator could also have a sticky beak.

Now if they can change your sound system to play Kanye West... that truly is a problem worth worrying about.

</comment><comment><USER46> This is why I don't understand the "Internet of Things." A light switch is a pretty effective solution to the problem; there seems little advantage to networking it. Ditto for a toaster, refrigerator, et cetera, et cetera.

Now get off my lawn!

<comment><USER47> You want to have your lights come on at a certain time.

You want to add motion detection to lights turning on.

You want to attach light sensors to have variable intensity bulbs be brighter or dimmer depending on ambient lighting conditions.

You want your lights to turn on inside your garage when the garage door opens.

You want your front hallway light to come on when your door is opened.

You want to be able to check all the lights in your house at a glance to make sure you did not accidentally leave any on.

You want to have all your lights auto-off when your kids should be in bed.

And of course, most importantly:

You want to turn your house into a rave party, or an epileptic seizure inducing disaster, and I don't think there is actually a difference there.

Your networked toaster might have online profiles for how to optimally toast bread, bagels, rolls, etc based on the type of bread and they would be available on a per-toaster basis. Rather than just odd balling how you want your toast done, you could buy a toaster that has profiles with high ratings that will toast your bread to your exact desire with your given model of toaster.

For your fridge, it could have isolated temperature and humidity per compartment, give alerts when different foods are low in quantity / going bad, track the expiration dates of all your food, and have the same lighting features as your house lights.

There are plenty of applications of "smart" devices. The problem with the IoT is that once you put software in a device you need to be responsible for it, and I don't believe there is actually a single hardware manufacturer on Earth right now who is legitimately responsible for their hardware and respectful of their users (particularly their software freedoms in relation to that hardware).

<comment><USER46> None of these things sound like killer applications, and few of them require any kind of computational power let alone networking. There are much simpler ways of accomplishing the same things. That is my point; IoT proponents are adding unnecessary complexity for dubious gains. Some examples:

 _You want to have your lights come on at a certain time._

I can get a timer at a hardware store.

 _You want to add motion detection to lights turning on._

I can get a motion sensor switch at a hardware store.

 _You want your lights to turn on inside your garage when the garage door opens._

Yep. That happens with most existing garage door openers.

 _You want your front hallway light to come on when your door is opened._

I've never seen this implemented, but it could be done in a multitude of ways such as the motion sensor or a simple contact switch on the door itself.

<comment><USER48> I've long been interested in "home automation" stuff, so I'll give you a quick example of what I have at my house now that can't be done with timers/motion sensors from the hardware store.

There's keypad in the entrance to the kitchen, with buttons labelled "Bright" "Dim" and "All off". If you press Bright, all of the lights (sink, under- cabinet, range hood, and island) turn on 100%. Dim sets just the under-cabinet lights are on at 50% and island is 10%. Without this keypad, you have to walk to 3 different switches on opposite sides of the room.

There's also a keypad by the front door. It has an 'all off' button which is great when we're leaving, and as we also walk by it on the way upstairs, handy when we're going to bed.

The front door keypad also has a "Garage" button. It lights up red if the garage door is open (as we can't see the door from anywhere inside the house). Press it and it'll toggle the door to open/close.

That stuff is just simple scenes, but I also have some more complex things..

The outside lights go to 20% from dusk until midnight, then turn off after midnight. On top of that, at any time between sunset and sunrise, if the garage door is open, or if the outside motion detector sees motion they go to 100%, and once the door is shut or no motion is seen for a few minutes, they return to previous level.

At sunset, if none of the lights in the house are on, one of the lights in the kitchen and one of the lights in the living room turn on (to make it look like someone is home).

At ~midnight, if only the one kitchen light and living room light are on (and nothing else has been adjusted, indicating someone is home), turn the lights off.

At sunrise, turn off all lights. (This used to be 3am until we had a baby, then it was annoying because, well, crying baby + preparing bottle + 3am + lights suddenly turning off = ..not good).

At some point I will also set up a motion sensor in the front hall (or maybe a door open sensor), so if the outside motion is triggered followed by the inside motion (or door opening), the inside front hall light turns on. A bit tricky, since I don't want to happen if I'm just walking around the house (or leaving).

Is any of this game-changing? Not really. It's interesting to me, it's not overly expensive (especially as I have built this up over time), and it's a nice albeit minor quality-of-life thing.

Btw, I _can_ control this from a PC/phone, although I basically never do (the keypad/switch on the wall is always going to be faster). I could also set it up to work via internet, but I don't, because 1) there's an attack vector and extra security to worry about, 2) adjusting the lights while I'm not home is pointless, 3) I believe a key to home automation is the _automation_ part. If I have to control it manually, it's by definition not automated.

<comment><USER46> Thank you. Genuinely interesting, and in my opinion, one of the few examples of the technology done right.

I would point out that the three different switches on opposites sides of the kitchen sounds more like an issue of poor switch placement (admittedly, a common problem) than anything crying out for automation, but the ability to control sets of lights with one button is intriguing.

I think the take-away is this:

 _> Is any of this game-changing? Not really. It's interesting to me, it's not overly expensive (especially as I have built this up over time), and it's a nice albeit minor quality-of-life thing._

Which I contrast with: "Let's hook my toaster up to the internet because: Internet of Things!" which seems to be the prevailing attitude.

</comment></comment></comment></comment></comment><comment><USER49> prepare to be arrested for various violations as a punishment for pointing out these obvious and dangerous flaws.

<comment><USER50> I mean he did unplug network equipment and MiTM, if this isn't illegal it probably should be. I see ethernet cables all the time in things like hospitals and hotels, should anyone be able to simply unplug them and put their laptops in the middle?

<comment><USER51> Yes, anybody should be able to do that with no legal consequences. If you don't want to give people access to your network, don't provide them with a fucking port and cable explicitly designed for doing so.

<comment><USER50> Come on now, you really think people should be able to unplug cables anywhere they go? This could have major consequences at a hospital.

Edit: Completely agree Ska, no excuse for making it this easy. I'm just pointing out that just because it's easy to pick a lock or unplug some wires to MiTM doesn't mean it should be legal.

<comment><USER52> People shouldn't unplug equipment in a hospital without express permission, sure - they shouldn't do it in your home either.

If your security model relies on this, though, you have failed. Period.

It is maybe a little fuzzier in a hotel (should I be able to stream content to the TV from my device instead of paying you extra for a movie?) but similar applies.

</comment></comment></comment></comment></comment><comment><USER53> My favorite example of this is the evolution of volume controls in cars. These days you have all sorts of fancy and inferior alternatives that leave you wishing for a plain old-school volume knob. The worst are the purely virtual volume settings with up and down buttons on a touch screen. Or only a bit better, physical knobs that spin endlessly and just send up and down operations to a digital volume level. Reasons why the old school knob is better:

* It maintains its position across power cycles. It can even be adjusted when the car is off. So you can lower the volume knob before you turn the car on and blast loud rock into your grandmother's ears.

* It does not require you to look at a touch screen to find the volume buttons. Tactile feedback is enough. You can operate it while maintaining the other 99% of your attention on the road.

* It physically stops at the lowest and highest possible volumes. Again, no need to look at some display.

Even better would be a physical slider instead of a knob. That would let you feel out the exact position of the volume without looking. The downside would be the limited space on a car stereo dashboard. But please, a touch screen is the worst and most dangerous interface while driving.

The same goes for radio presets. In a car with physical buttons for the presets, I can switch between my favorite stations without having to look. Try doing that with a touchscreen. How is this progress?

Maybe it's just a symptom of an industry that's often more about selling status symbols than selling functional products.

</comment><comment><USER54> I don't see what this gains the hotel. You get an increase in complaints/request about not being able to turn on/off lights, etc. Standard light switches are dirt cheap and last years and everyone from age 2 up knows how to use them.

Is this solely to look "fancy"? If so, then at least get the tech right otherwise you look incompetent.

<comment><USER39> Hotels are under substantial competitive pressure to seem fancy. Fancy hotels can charge a lot more. Looking good is often more important than ease of use, as is demonstrated by every hotel alarm clock I've ever tried to set.

It's also partly our fault. Computer-y stuff has had poor usability for years. A standard tech response to bad user experience has been to tell people that they're doing it wrong, that they just need to learn a particular trick and it will all be great. So people often assume that when something is hard to use, it's probably their fault. Which means that a buyer of stuff like this can have a bad experience and wave it away thinking that the tech is just fine. After all, why would somebody sell a computer-controlled lighting system that is in practice worse in every way than regular switches?

</comment></comment><comment><USER55> Perhaps the hotel was getting ahead of UK gov requirements for network backdoors.

</comment><comment><USER56> Great, now make a drone or self-driving robot to randomly run around the country messing with peoples' insecure lights. It'll be one huge party.

</comment><comment><USER51> This is absolutely fucking preposterous.

The 'Internet of Things' or whatever you want to call it – controllable peripherals, ubiquitous connections, stuff like that – is a pretty cool concept. I want to be easily able to do things like ask 'when will my laundry be finished?', or have my central heating come on when I start heading home. Not because it's massively beneficial, but because it removes some minor annoyances.

The technology is there, and has been for a while. But the proliferation of mindless, unforgiveable security flaws, pervasive surveillance, proprietary cloud-based networks, shitty software and bad UX generally – it's really mad. It really makes it difficult to want to use any of these devices.

I'd love some kind of proper, non-half-baked-and-riddled-with-holes solution for home automation, but I reckon I'd probably have to build it myself.

<comment><USER57> Well, one major problem that I see is that, we aren't required to learn about any of this stuff before we buy it and most of the people who's job it is to set this up would gladly do it for less than someone who knows what they're doing even though they know nothing about it. The entire world is set up incorrectly for something like IoT. We try to get as cheap as we possibly can with everything and we try to skimp on any labor cost but set everything up fancy as hell. That's always going to leave you with security holes because security doesn't make money. Not unless someone starts getting punished for the bullshit security they are putting into these things.

</comment></comment><comment><USER58> Hotel name and address was not mentioned. As long as people complain but fail to name-and-shame, these practices will continue.

<comment><USER59> I'm generally unenthusiastic about naming and shaming hotels that I'm still staying in.

</comment></comment><comment><USER60> If you found that you could do the same thing on a classic installation people will be like. So what? and an electrician wouldn't even be excited to try it.

But since hacking is cool, we like this stuff.

Weird thing also is that using WiFi years ago was basically giving your data, when SSL websites where so rare. And we didn't even cared for it...

</comment><comment><USER61> Every once in a while invention is the mother of necessity.

But do we really need our lights to do all kinds of funky things and be controlled from around the globe?

Don't we really just need our lights when we're in the room? And don't we just need to them to be on/off or at most dimmable?

Help me here.

<comment> mark-r I could see a hotel system that turns off the lights at some predetermined time if the room is not rented, in case they were accidentally left on. That might save them some electricity, but it's hard to see it saving enough to pay for the system.

</comment></comment><comment> saint-loup I work in a flagship building in France, known for its environmental compliance and automation features. It's quite nice, but there's a web app to toggle the lights, the blinds and whatnot. And guess what, the logins to other floors are trivial to guess.

</comment><comment><USER62> This is a great example of more technology making things worse. I don't mean badly done technology, I mean that even if this were working and secure, a light switch would be cheaper, more durable, easier to repair, and easier to use.

</comment><comment><USER63> And here I thought the video game Gunpoint (where you rewire switches, lights and doors among other things) was unrealistic.

Although I'm a bit disappointed mjg59 didn't play Blinkenlights with the rooms on his floor.

<comment><USER64> I was thinking the same thing :)

For those unfamiliar: [http://blinkenlights.net/](http://blinkenlights.net/)

</comment></comment><comment><USER65> In a competition it's possible to wake up your competitor. I mean if you are going to play a tennis or football match the next day, you can bother your competitor to have an advantage.

</comment><comment><USER66> Last week's episode, Ask This Old House, had something similar. They swapped a normal front door lock/handle with a Bluetooth (or WiFi) controlled unit. The phone could be used with an optional WiFi extender. My head swirled with so many scenarios where things could be bad.

1) Leave the phone in the home, you'll never be able to get in! 2) Wireshark the WiFi 3) Hijack the signal

I'm sure the dark side is waiting for us all to adopt IoT in our homes. I prefer my mechanical locks, thank you.

</comment><comment><USER67> I think one part of the reason is "good" developers almost never apply for jobs to work on such projects. These projects are not cool or cutting edge, and you won't learn anything new. Also the reason why a lot of outsourcing, which is boring, and tedious 'business software' type work ends up being of average to below average quality.

It happens elsewhere too. Like how poor people get public defenders who are overworked, underpaid and not as good as private lawyers.

</comment><comment><USER68> I surprised no one's mentioned Brillo[0] or Weave[1] from Google. They're trying to solve this problem in an open, standardized way.

[0] Brillo - Embedded Android - [https://developers.google.com/brillo/](https://developers.google.com/brillo/)

[1] Weave - Communications - [https://developers.google.com/weave/](https://developers.google.com/weave/)

</comment><comment><USER69> Why on earth are they using Modbus? Is there already some sort of industry standard (on Modbus) for remotely controlling hotel peripherals?

<comment><USER70> Modbus has been installed in hotels for years and years. They are probably using it because many hotels already have infrastructure in place for it.

</comment></comment><comment><USER71> > My coworker asks whether you can control the channels. Can you set all of > your neighbours' TVs to pay-per-view while they're out?

Hahahahahahah! "Asking for a friend."

But really, folks are talking about the nuisance of waking people up in the middle of the night and that's true. However, controlling channels could be a more significant nuisance.

</comment><comment><USER72> Having stayed at a similar (same) hotel don't even get me started on the guest experience. It took longer to familiarise myself with all the controls in the room than a normal stay in the hotel. Also really appreciated the slight glow all the tablets gave off at night...well they did until they got covered with cushions and gaffer tape!

Jarrod

</comment><comment><USER73> In the hotel's defence, I'm sure he could also go toconventional hotels and chop a hole in the wall and start messing with the wiring to achieve approximately similar "security breaches". The broken implementation is more concerning to me than the security aspects.

</comment><comment><USER74> I wonder if a more fruitful attack target than the lights in other rooms might be the android switches themselves. Even cheap commodity android tablets contain cameras or at least microphones. There's almost certainly a remote update interface on them of some sort.

</comment><comment><USER75> Are physical light switches even a problem to be solved?

Seriously, I fail to see the ROI of such endeavor.

</comment><comment><USER76> Don't suppose those tablets had any kind of microphone or image sensor/webcam built into them? If they're using cheap generic android tablets, they probably do.

Should be fairly simple to setup remote blackmail-material-collection. :(

</comment><comment><USER77> What's up with all the hotel hacking today? First towels [1], now light switches??

[1] [https://news.ycombinator.com/item?id=11265849](https://news.ycombinator.com/item?id=11265849)

</comment><comment><USER78> There's nothing inherently wrong with a touchscreen, IoT light switch. But the main problem here, apart from using an insecure legacy protocol, is the use of a general-purpose OS like Android instead of an embedded OS.

It's not just this light switch – Android refrigerators, Android ovens, Android washing machines are all using a wildly inappropriate operating system for single-purpose devices. The problem is likely that it's a lot easier to develop for Android than it is for a proper embedded OS: It's faster, the commodity hardware is easy to procure, licensing fees are minimal to none, and it's easier to hire developers.

The first company to bring to market a more IoT-appropriate, yet accessible combination of operating system and SoC reference designs stands to become a massive player when IoT goes mass-market.

<comment><USER79> Yes, there is. Touchscreens lack tactile feedback, and for stuff that one must manipulate on the dark (like a light switch), that's a very important flaw.

</comment></comment><comment><USER80> Write a script to rhythmically open and close the curtains, as well as turn the lights on and off for the whole floor. Then call OK Go and tell them to bring a drone because you got their next clip idea.

</comment><comment><USER81> Does anyone have a mirror? It looks like it's been taken down for me.

<comment><USER82> [http://archive.is/vSFf9](http://archive.is/vSFf9)

</comment></comment><comment><USER83> I wonder if, with MITM devices set up on a few consecutive floors, you could make massive pixelart animations on the outside of the building by turning lights on and off...

</comment><comment><USER84> eh, It doesn't scare me because they have the name, credit card, and exclusive control over the lock on the attacker's door. You'd have to commit so many counts of fraud and hacking in order to attempt getting away with it, that the reward just doesn't seem there to me.

</comment><comment><USER85> why on earth are the 2 largest and highest valued technological companies in human history repurposing mainframe multi-user computer operating systems from the 1970's (extended even further with sandboxed app containers!) for mobile phones!?

It smacks of deliberate incompetence to sell hardware.

iOT on top of this just smacks, again, of deliberate incompetence, to either sell hardware or raise the attack vector profile (the NSA loves you!)

why on earth is there still no reasonable competition to either android or ios?

<comment><USER86> There's nothing in the article about Android, it's only in the title.

</comment></comment><comment><USER87> A lot of consumer IoT feels forced. It feels like I am supposed to want these things. What am I? A luddite? It's The Future(tm)! Of course I should want a less reliable, more expensive, shorter life span, more complex security/privacy nightmare in place of a completely reliable long-lived inexpensive device.

Complexity is costly in many, many ways. There is zero justification for adding it to anything unless the payoff is some multiple of the complexity cost being added. I just don't see it here.

For any new tech, I always ask "what super power will this give me?" For much of IoT I can't answer that question. There are a few nice-to-haves but nothing compelling, no must-haves or genuine wows. Then you add in all the unbelievably creepy security and privacy implications and any lukewarm interest goes away. I can't shake the obviously crazy idea that some of this stuff is being pushed because certain people (advertisers, intelligence agencies) want as many sensors out there watching us as possible. Imagine every light switch, thermostat, etc. with an Internet connection and then think about the meta-data correlation capabilities with mobile sensor and location data and other Internet traffic.

We're really talking about a total surveillance society where literally every single thing you do is stored in a database somewhere. Anyone able to correlate your phone's approximate location and/or your web browsing history with, say, light switch data really will know every single time you use the bathroom and for exactly how long.

Do you stop moving and kneel every day at the correct time? Then you're praying to Mecca-- you're a Muslim. Do you leave the lights on late? That might say something about your personality profile. Do you work with the lights off? That says something else. Is there ambient sound but no light and are a male and a female present? They might be having sex. Two men in the bedroom? Gay sex! And that's just the easy low-hanging fruit I can imagine. Throw some theory-agnostic deep learning at it and I can imagine unbelievably spooky stuff that makes this look tame:

[http://nypost.com/2013/10/29/facebook-knows-when-youre- going...](http://nypost.com/2013/10/29/facebook-knows-when-youre-going-to- break-up/)

Edit:

But mostly I think the driver is tech industry wishful thinking. Everyone is looking for the next catapult capable of tossing unicorns to billion dollar valuations in 1-2 years.

Mobile has IMHO been a bit of a disappointment. It's been big but not quite as big as everyone predicted. It's failed to displace desktop or achieve "convergence," and the limitations of the UI and the walled garden model have kept "serious" apps off mobile platforms for the most part. The collapse of app stores as a commercial software sales platform with prices spiraling down to $0 and clutter making new apps un-discoverable has further destroyed any incentive to push the boundaries of the platform beyond a "portable dumb terminal."

It's also been an architectural disappointment. It was supposed to be a clean slate where we could escape some of the cruft and bloat of desktop, but we're doing iOS and Android around here and the development experience on both is as bad or worse than Windows, Linux/Qt/GTK, and the web. It's not the promised land by any stretch. We took a lot of bad ideas with us from desktop and then added walled gardens and more resource constraints. Woohoo!

So now everyone's hoping IoT will be the next unicorn flinger. I'm skeptical so far. The Blackberry and the iPhone had immediate killer apps: maps, portable chat/email, portable books, music, and movies, etc. Those are real benefits that are worth the cost and the downsides. They're "super powers." Where's the super power in an internet connected light switch?

<comment><USER88> I work in the Hotel industry making Apps for reservations and in room entertainment and engagement. Some of your statements make sense but, form the hotels perspective, some of the reasoning for implementing this stuff has little to nothing to do with making the experience better for the guest. We use the data we get from things like the lights, temperature, and other information to find ways to save money and find how to better set up properties for profit. Its a numbers game. We hope that we can use the same tech to drive user engagement and keep them within the apps so they become lifetime guests and book with us for subsequent stays. It is a marketing and management effort. All about the ability to save money while driving engagement.

</comment></comment><comment><USER89> People forget how reliable and secure things like hard-wired physical light switches and other natural interfaces (like paper books, etc.) are. There seems to be a vast ignorance about topics like reliability, interfaces, usability and design. Just because it's digital, it doesn't mean it's better - I'd argue for the contrary in many cases. I don't want to upgrade the firmware of lightbulbs, I just don't. Despite my affinity for them, I have more than enough computers surrounding me in my everyday life.

<comment><USER90> Everything you said, and also that the old analog devices are future proof.

For a trendy metropolitan hotel, with a design refresh cycle of 10 years at the most, the future might not matter. But people are wanting to put these devices in homes with a refresh cycle that should be more like 30 to 50 years. Big difference.

</comment></comment><comment><USER91> What has this got to do with Android?

<comment><USER92> > What has this got to do with Android?

Not much. But Android _is_ pluggable, Linux based, and easy to put an OTG Ethernet adapter into to divert supposedly "secure" wifi traffic.

I really think "Android" and the "as bad as you think" meme is just used here to grab attention to something which is definitely worthy of it:

About IoT and what terrible things people are doing with it.

How long did it take for the web to mature? Do we have to wait that long for IoT to settle as well?

</comment></comment><comment><USER93> Sorry, fanboys, but anything Android is always "as bad as you'd think"

</comment><comment><USER94> Correction, he stayed in a SHITTY hotel. Not much else to report here.

</comment><comment><USER95> Or you could just kick the door in - and turn the lights on. Then write "HACKED" on the wall with a spray painter. (sarcasm)</comment>


Making fun of LinkedIn "quote of the month" meme computationally - <AUTHOR> http://community.wolfram.com/groups/-/m/t/749246 <comment><USER2> I'm using either "socialism", "inadequacy" or "rituals" next time this comes up.

</comment><comment><USER3> Bulliest- It's time to be like Teddy Roosevelt and bring back "Bully!" as an exclamation.</comment>


Reviving the US CDC - <AUTHOR> https://www.thelancet.com/journals/lancet/article/PIIS0140-6736(20)31140-5/fulltext <comment><USER2> After all the bungling they did on Corona they should rather be happy if they survive as a organization. You had one job ... and everything. Clearly some major reforms are needed.

</comment><comment><USER3> > Deborah Birx, the head of the US COVID-19 Task Force and a former director > of the CDC's Global HIV/AIDS Division, cast doubt on the CDC's COVID-19 > mortality and case data by reportedly saying: "There is nothing from the CDC > that I can trust". __This is an unhelpful statement, __

Why is pointing out abject incompetence an "unhelpful statement"? First step to solving any problem is acknowledging you have a problem.

Go to the CDC website yourself and try to understand the total mess they are publishing, full four months after the epidemic started in earnest. They should be the "gold standard" I agree. But they are not.

<comment><USER4> This is not an accident. It's the system working as designed. Steve Bannon famously described his agenda as the "deconstruction of the administrative state." It's pointless to argue about the chicken or the egg of how the CDC became crippled. The administration does not want it to succeed.

<comment><USER3> Does the _CDC itself_ want to succeed? People _without a budget_ have done a much better job collecting and publishing data on github. Why is this so insurmountable for the CDC? I'd ideally have a single source of information. I'd prefer that source to be the CDC. But they somehow, 4 months in (!), choose to publish a pile of steaming excrement instead of clean, curated, well explained data.

<comment><USER4> I'm not defending the CDC. I am astounded at how poorly cities and counties record and report their own data and depend on the CDC. I want to see more decentralized recording and reporting.

I have no idea how political things are at the CDC. Many there claim that they have had their budgets cut below workable levels. That's entirely consistent with the stated purpose of the current administration.

We should get used to not having anything useful at the federal level.

<comment><USER5> > We should get used to not having anything useful at the federal level.

Snow Crash, here we come.</comment></comment></comment></comment></comment>


Ask HN: What do you think about crowdfunding of gifts? - <AUTHOR>

I am thinking of something like "Crowdfunding a user's wishlist" where their friends pool some money from 5$ to whatever price, so help a particular user reach and get the wished item. I lnow this already exists but what ese you think can work <comment><USER3> I'm not too clear about what's being asked here - alternate ways of having a group pay for a gift? Well, beyond having everyone pay a portion - <USER2> necessarily the same portion - the group could have a fundraising event together and use the funds to buy the gift.</comment>


Delaunay and Voronoi on a sphere - <AUTHOR> https://www.redblobgames.com/x/1842-delaunay-voronoi-sphere/ <comment><USER2> > _For most of my Voronoi map generation projects, I don't actually use > Voronoi, but something similar. I move the points from the circumcenters to > the centroids. Not only is this cheaper to calculate, it ensures that all > the region edges have a reasonable length. With Voronoi, some of the edges > have small or zero length, and that makes it harder for me to place roads > and rivers using those edges. I have written more about this topic here._

He is basically doing a form of relaxatation similar or equivalent to Lloyd's Algorithm[0], no? Adrian Secord used this way back in 2002 already to create stippling images[1], see also Mike Bostock's notebook[2]. Would iterating a few times maybe improve results even more?

Tangent: I have been experimenting on and off with implementing more advanced variants of Secord's stippling algorithm in the past two weeks[3]. It's been a lot of fun! A bit too much at times, Observables makes the interactive feedback loop a bit _too_ easy.

[0] [https://beta.observablehq.com/@mbostock/lloyds- algorithm](https://beta.observablehq.com/@mbostock/lloyds-algorithm)

[1] [https://cs.nyu.edu/~ajsecord/msc_thesis/ajsecord_msc_thesis....](https://cs.nyu.edu/~ajsecord/msc_thesis/ajsecord_msc_thesis.pdf)

[2] [https://beta.observablehq.com/@mbostock/voronoi- stippling](https://beta.observablehq.com/@mbostock/voronoi-stippling)

[3] [https://beta.observablehq.com/@jobleonard/untitled](https://beta.observablehq.com/@jobleonard/untitled) (Yes, that still needs a _lot_ of optimization. I know)

<comment><USER3> Philippe Rivière did quite a number of iterations[1] on d3/Bostock's geo- voronoi, culminating in a proposed Voronoi Projection method[2].

[1][https://beta.observablehq.com/collection/@fil/voronoi](https://beta.observablehq.com/collection/@fil/voronoi)

[2][https://projet.liris.cnrs.fr/mi2/posts/2018/10/05/voronoi- pr...](https://projet.liris.cnrs.fr/mi2/posts/2018/10/05/voronoi-projection- en.html)

<comment><USER2> Oh wow, thanks! I missed those. Will look into it - maybe he has optimizations I missed and vice versa.

If only Observables had something like pull requests and a way to have meta- discussions on notebooks... but it's addictive enough an environment as is ;)

EDIT: He even has a Spherical Lloyds Relaxation sketch[0], how appropriate! :D

[0] [https://beta.observablehq.com/@fil/spherical-lloyds- relaxati...](https://beta.observablehq.com/@fil/spherical-lloyds-relaxation)

</comment></comment></comment><comment><USER4> Red blob is one of the best programming sites! I love the interactive demos and the clear writing style. They always strike a good balance between rigor and intuition.

<comment><USER5> Thanks!

<comment><USER6> Your articles are so good I've felt the need to actually build a game around one of them. Because unfortunately I don't need any of the articles for my current game. :(

</comment></comment></comment><comment><USER7> > _But how do you computer a circumcenter for a triangle on a sphere? I found > a solution on stackoverflow and implemented it._

Why is it necessary to calculate the circumcenters in 3D? Why not calculating them in the projection to the plane and then back-projecting them to the sphere? Perhaps it's necessary to calculate the Voronoi regions in the plane too.

<comment><USER8> It's pretty easy to do it in 3D. Doing anything on a 2D projection is hard, because the space is so distorted. When you can easily measure distances, this is a lot easier.

It's a little weird that their results are inside the sphere. I don't fully understand the equation, but it looks to me like it's using angles/rotations from a to the centre, so I would expect it to remain on the surface. Maybe the problem is just numerical error?

Of course, if they're projecting the solution back to the surface anyways, the simplest way would be to find the centre of the triangle in xyz space, ignoring the sphere, then projecting the result back to the surface. As long as the triangle isn't larger than half the circumference, the shortest distance through the sphere would correspond to the shortest distance on the surface.

To be honest, I'm more surprised they projected to a plane in the first place. If he was doing it all from scratch, it would probably be simpler to do the triangulation in 3D.

<comment><USER9> I'm assuming the loss of height comes from measuring distances directly between points instead of along the surface of the sphere. Much cheaper, but by design you'll cut through the sphere to connect each point

<comment><USER8> I think you're right. The circumcentre equation is just more complicated than the centroid calculation I was imagining. They're doing exactly what I had suggested in the third paragraph.

There may also be a nice derivation of the triangle centre on the sphere coming from quaternion math that would avoid renormalization. I wonder...

</comment></comment></comment></comment><comment><USER10> I've used CSSGRID for this [http://www.ncarg.ucar.edu/ngmath/cssgrid/contents.html](http://www.ncarg.ucar.edu/ngmath/cssgrid/contents.html)

It's solid and easy to bind from anything with an FFI.

<comment><USER11> It took me a bit to realize that your link has nothing to do with the _other_ CSS Grid: [https://developer.mozilla.org/en- US/docs/Web/CSS/CSS_Grid_La...](https://developer.mozilla.org/en- US/docs/Web/CSS/CSS_Grid_Layout)

</comment></comment><comment><USER12> By accident I figured out how to draw a simple Voronoi pattern: draw lots of planes at the same distance from a center point, each plane perpendicular to that center point. [https://www.openprocessing.org/sketch/611667](https://www.openprocessing.org/sketch/611667) (click </> to see the code). Probably someone did it before already :)

<comment><USER13> Sounds similar to drawing intersecting cones at each point, which is a pretty common method I think. For example: [http://alexbeutel.com/webgl/voronoi.html](http://alexbeutel.com/webgl/voronoi.html) A nice thing about that is if you draw cones with just 4 sides (so, pyramids..) you get a manhattan distance voronoi pattern (or something that looks very similar at least).

</comment></comment><comment><USER14> While the stereographic prohection trick sounds neat, it looks like it could produuce a bad triangulation if the input points are distributed non- uniformly. Indeed the 2d Delaunay triangulation algorithm tries to build the most uniform triangulation, but the projection step creates distortion which means a uniform projected triangulation might map to a non-uniform 3d triangulation.

I'm not sure it is an issue because some other factor may compensate this issue, but there should be a rigorous analysis of the stability of this approach to various inputs.

<comment><USER15> I'm not sure if delaunay by itself would produce "regular" triangulations. To get some kind of regularity, you'd generally need a refinement step where more points are inserted. Of course, this could be difficult with the given projection.

<comment><USER14> Yeah I used regular as a shorthand but nostly I meant that it would flip edges to avoid thin triangles.

</comment></comment></comment><comment><USER16> Nice! I was looking for this the other day, would have been nice to find a writeup on this site about it (since its writeups are always so clear). I ended up doing hexagons on a sphere (with 12 pentagons). There's a writeup on this site about that too. It goes to great length going around the pentagons, but for my purpose they're not an issue.

</comment><comment><USER17> Tessellating a sphere is one of those never ending areas of study because no solution feels 100% satisfying

</comment><comment><USER18> Perhaps an easier (and more robust) way to do this is as follows:

1) Take your points in 3D, and add the point at the origin

2) Compute Delaunay in 3D

3) The 2D faces not containing the origin is your triangulation.

To get the Voronoi tessellation:

1) Circulate the faces of each vertex in order (use orientation test if they are not ordered yet)

2) Connect the circumcenters of each 2D face you visit.

Voilà!

<comment><USER2> Well, conceptually maybe, but I have some doubts regarding:

> _2) Compute Delaunay in 3D_

How much slower is 3D triangulation compared to 2D? How does it scale with more points? And just as importantly: how _complex_ does the algorithm get when we want to improve performance?

I'm not saying you're wrong - if anything I hope _I 'm_ wrong, but I suspect the answers to my questions are "significant", "badly", and "very", which would mean this is not easier/more robust in practice (or it comes at the price of being unacceptably slow).

The reason I think so is Julia's Voronoi/Delaunay package[0]. It implements an algorithm from an extremely dense (to non-astronomers) astronomy paper[1]. Even the name is intimidating: _" E pur si muove: Galiliean-invariant cosmological hydrodynamical simulations on a moving mesh"_

Page five and six of the paper lists a short history of triangulation algorithms, making it clear that Delaunay triangulation so important for scientific research that many people have given it considerable thought.

Sadly, I cannot really follow the algorithm explained in that paper. It seems to fall for the inevitable _" algorithm by PhDs with complex enough math that you need a comparable PhD to being to grok it"_-curse (and/or I am just too dumb).

Of course, if someone already did the hard work of implementing really fast and robust 3D Delaunay libraries to steal from... ;)

(the Julia package only implements the 2D algorithm. Sadly)

[0] [https://github.com/JuliaGeometry/VoronoiDelaunay.jl](https://github.com/JuliaGeometry/VoronoiDelaunay.jl)

[1] [https://arxiv.org/abs/0901.4107](https://arxiv.org/abs/0901.4107)

<comment><USER19> Computing Delaunay on a sphere isn't exactly the easiest either, distances get rather tricky and there's no simple projection that preserves all of them.

<comment><USER2> True, but it can be decomposed into different steps at least (trying to find less-wrong projections, effective 2D triangulation).

The complexity of working with 3D spaces typically feels worse and harder to untangle to me.

It's like.. I dunno, having two jugglers juggling ten balls each and passing them between each other, or one being asked to juggle twenty[0]. But that is a personal thing - it may also just be sign I'm bad at maths in 3D space.

[0] [http://www.juggling.org/papers/limits/](http://www.juggling.org/papers/limits/)

<comment><USER19> In the end it's a trade-off between having an extra dimension to deal with, or having to deal with a non-euclidean space. Between the two it's nearly always easier to go for the higher dimensional euclidean one, but exceptions might exist.

Of course if you want an approximate solution then projecting the sphere to 2D might be an option, but glueing together the different projections required could be a bit of a hassle.

</comment></comment></comment></comment></comment><comment><USER20> Oh nice, this used to be my go-to interview question for a numerics team at <generic-tech-giant>. Solid write up!</comment>


Why a*a*a*a*a*a cannot be optimized to (a*a*a)*(a*a*a)? - <AUTHOR> http://stackoverflow.com/questions/6430448/why-aaaaaa-cannot-be-optimized-to-aaaaaa

<comment><USER2> When I first read the headline, I definitely thought that was a regular expression which could be "optimized" to a+. I guess I'm more inclined to read "*" as the Kleene operator than as multiplication...

<comment><USER3> I'm glad to know that I'm not alone in doing this.

</comment></comment><comment><USER4> In numerical analysis class _numerical stability_ was a major theme[1]. It was very definitely eye-opening how quickly rounding/truncation errors can bite you in seemingly trivial situations!

On the other hand, if I have a function that works on parameters in a specified range (say, 0.0 to 1.0) and returns results which is supposed to be correct to a specified accuracy I would _love_ to have the compiler do all the possible optimizations without having to specify a compiler flag (doing so for, say, just a single function can be quite annoying!). Maybe approaches like Haskell's type inference will, eventually, produce significantly faster code because they can do things like this?

In a somewhat related case, it would be awesome if the compiler recognized properties like associativeness, distributiveness, commutitiveness of composite functions and rearange things optimally for performance. It's really nice to see so much development in languages and compilers at the moment (llvm, javascript, functional languages like Haskell, etc.) :°)

[1] <http://en.wikipedia.org/wiki/Numerical_stability>

<comment><USER5> So you want something like GCC's -funsafe-math flag.

</comment></comment><comment><USER6> The short answer: Because floating point math is not associative.

[http://en.wikipedia.org/wiki/Floating_point#Accuracy_problem...](http://en.wikipedia.org/wiki/Floating_point#Accuracy_problems)

</comment><comment><USER7> As a user of Stack Overflow only when google brings me there, I'm curious as to why the answer received so many upvotes? It is certainly a good answer, but the score seems disproportional to the utility.

<comment><USER8> I just feel sorry for the guy that answered. He's got +685 upvotes at time of writing and no dvs so he should have ~ 7,000 points from this, but apparently SO imposes a daily cap of 200.

<comment><USER9> I think the Daily Cap is intended for situations just like this. So if you see someone with 5k+ reputation it's a good sign they've given good answers to a fair few questions (or asked good questions) over a period of time rather than just got lucky with a question that found its way on to Twitter. Because reputation entitles you do certain things like close questions SO is careful about how you can earn it.

<comment><USER8> Yeah makes sense. Still, I'd be a bit gutted :)

</comment></comment></comment></comment><comment><USER10> There are other ways of dealing with "fake real numbers" (which is what doubles are)

One example is interval arithmetic. <http://en.wikipedia.org/wiki/Interval_arithmetic>

None of them seem very mainstream: the predominant thinking is that floats are "the right way" to badly approximate real numbers, that works well enough except when you're working with pounds and pence, when "everyone" knows the right way is to use fixed point...

That's not going to help the above associativity problem, but it fits in the theme of "LAAAA LAAAA LAAAA lets gloss over the bits of floating point that don't follow the rules"

</comment><comment><USER11> Google Cache version: [http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...](http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fstackoverflow.com%2Fquestions%2F6430448%2Fwhy- aaaaaa-cannot-be-optimized-to-aaaaaa)

</comment><comment><USER12> It can. But only for integer data types.

As already pointed out, for floating point data types the two versions could (and probably will) result in slightly different answers due to rounding issues.

<comment><USER13> Why does it being different matter? Compilers can do all kinds of things that change answers.

<comment><USER5> They can't do it on code that doesn't invoke undefined behavior. This is not undefined behavior.

<comment><USER13> Obviously they can't do _whatever they want_ but they can decide if they want to store variables in registers or main memory, they can change the order of a variety of operations, etc. Does C specify order of evaluation with multiplication? If so I wasn't aware of that. But you'll still have some compilers giving you 32 bit precision on intermediate results and some giving you 80 bits.

<comment><USER5> > they can decide if they want to store variables in registers or main memory, > they can change the order of a variety of operations, etc.

As long as they follow the "as if rule", which states that any transformations that is done to code that does _not invoke undefined behavior_ will produce the same final result as if the transformations were not done. Reordering floating point multiplications does not follow this rule.

(Watching stuff in a debugger doesn't count for this rule)

<comment><USER13> 1\. Are you saying that multiplications _have_ a specified order? I asked that but didn't get a response.

2\. The compiler is allowed to either leave the float inside the FPU or store it back to main memory after each operation, is it not? These give different results.

Somewhere around here I have a chart of the differences in floating point outputs of different GCC versions. And no, fastmath is not on.

<comment><USER5> Yes. Multiplication is left associative. I'm not sure that C defines the precision of floating point operations, although I think it sets an upper bound. I may be wrong, and I think that the C99 spec (optionally?) pushes compilers to conform to the iee754

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Is this on the front page of HN because of the many upvotes it got, or did it get the many upvotes because it is on the front page of HN?

<comment><USER15> It got many upvotes (or a small number of upvotes directly after being posted) which pushed it to the front page of HN, where it gets greatly increased visibility and hence more upvotes.

</comment></comment><comment><USER16> Because it brings down Stack Overflow?</comment>


Ask HN: Sensor emulation for your physical machines - <AUTHOR> At iotify.io we enable emulation for I2C/SPI based sensors with virtualized hardware, such as TMP105, HCSR04, ADS111x etc. One of the possibility is to enable such sensor emulation also on real hardware such as your linux desktop machine or a physical raspberry Pi.
The idea is to install a mock SPI/I2C driver on your machine and emulate the sensor you would like develop software for, by running our emulator program.
Off course there will be certain limitations here in terms of speed and accuracy of emulation, however for general programming purpose this would be fairly accurate and cut down your software development time drastically.
Would that be interesting for you somehow? Would love to know your thoughts. <comment><USER2> > however for general programming purpose this would be fairly accurate and > cut down your software development time drastically.

Having written drivers for that kind of sensors I would rather use automated tests (unit & integration). Maybe you could explain why your approach is better than just using mocks ?

<comment><AUTHOR> Sure,

One immediate benefit I could see is the independence of hardware board (even those without any controller). You could run and schedule automated test on VM, without instrumenting your code. This is more relevant for System tests and integration.

Also since we emulate transactions at bus layer, it works more accurate rather than software tests. We recently found a bug in a driver where it had a hardcoded time to wait for response, instead of waiting for interrupt status. Such a thing would work in real hardware but fails on our simulated tests.

Last but not least, sensor manufacturer could provide more accurate models of device behavior through our software which could then be tested against compensation values applied in your driver.</comment></comment>


Black Founders Hackathon: My Experience - <AUTHOR> http://www.drurly.com/blog/2013/02/10/black-founders-hackathon-my-experience/

<comment><USER2> Thanks for sharing. When you decide to expound upon the "natural bootstrappers" theory I'd like to read that.

</comment><comment><USER3> One of the things I like best about computers and the internet is race is not brought into the mix.

</comment><comment><AUTHOR> Me too. Thx for the comment</comment>


Ask YC: what are those fields in the profile page? - <AUTHOR>

(talking-about '(showdead noprocrast maxvisit minaway)) <comment><USER2> <http://ycombinator.com/newsnews.html></comment>


Utterances: Lightweight comments widget built on GitHub issues - <AUTHOR> https://utteranc.es/ <comment> phoe-krk > No lock-in. All data stored in GitHub issues.

How is that not a proprietary lock-in if all your data is stored on a single company's servers?

People keep on treating GitHub and other corporations as public services. They're not.

<comment><USER2> GitHub is at an interesting inflection point. Before the acquisition, VCs stoked the growth by giving away bandwidth and storage. Now that GitHub is a Microsoft property, the same continues because MS has been on a ten-year mission to build goodwill in the developer community.

That may not last forever. The original GitHub people will gradually drift away once their vesting concludes. If overall growth stalls, Microsoft management may yet feel the temptation to start squeezing GitHub for cash.

I suspect they'll acquire NPM along the way too, to have a better lock-in in place.

<comment><USER3> Microsoft won't acquire npm for sure.

I highly doubt MS will ever squeeze GitHub for cash also. It's about integration and azure.

They have proved by now that they are not Oracle and they are doing the opposite of them.

\- making development more open ( .net core vs Java)

\- making tools more open ( eg. Sms vs MySQL, vscode, ...)

Both have clouds. Microsoft is adding/creating more free tools/services as their onboarding funnel. Development ease is their motivation.

Oracle buys popular things and starts licensing them. They try to force existing clients into their cloud ( MS makes it optional). Oracle's motivation is management influencing

<comment><USER4> Microsoft (like many companies before, and many companies in the future) change. The went from cool, to not cool, to cool again in the eyes of the developer hive-mind.

I don't think we can say for sure that Microsoft will forever act the way they are acting now, as in the end it's run by people and those people eventually become replaced with others.

Saying that a company has "proven" something and that means they will act a certain way forever seems unhealthy.

</comment></comment></comment></comment><comment><USER5> So this is a comments app that uses Github's issue tracker service as a data store. Is this a round hole / square peg mismatch of problem and solution?

I'm asking honestly what other people's opinions of this are because whilst it looks good it: 1) looks like the kinda of hacky solution I try to avoid building when trying to fit together incompatible data objects and data storage. 2) uses Github's systems for purposes other than they were intended, which seems slightly unethical or at least impolite to me.

<comment><USER6> > _uses Github 's systems for purposes other than they were intended, which > seems slightly unethical or at least impolite to me._

I wonder where the line is drawn here, and whether it really is unethical to use GitHub to store comments. Is something of this sorts explicitly or implicitly mentioned in their ToS?

Along the same lines, will hosting files on directly on Github and using that as our primary resource (raw.githubusercontent.com...) be considered unethical or impolite?

<comment><USER5> I hadn't thought to look at GitHub's ToS as that would have been too obvious! I did just have a quick look now. Nothing too specific in there, but then these things often are general so that discretion can be used later. A couple of things that might catch this out:

\- "Abuse or excessively frequent requests to GitHub via the API may result in the temporary or permanent suspension of your Account's access to the API. GitHub, in our sole discretion, will determine abuse or excessive usage of the API."

Utterances uses the GitHub API and its demo page makes 4 requests to api.github.com. The API docs state a limit of 5000 requests per hour. That's quite a lot and within what a low volume blog would get, which I think is the main use case for this app. But if your blog gets really popular then you might ring alarm bells at Github.

\- "Responsibility for User-Generated Content" As this is all user generated content you, as GitHub account owner, are responsible for it not breaking GitHub's content guidelines and you had GitHub permission to do with it as they see fit. GitHub are the ultimate decision makers about your user's content, not you or Utterances.

[https://help.github.com/en/articles/github-terms-of- service](https://help.github.com/en/articles/github-terms-of-service)

</comment></comment></comment><comment> phil-opp An interesting fact about this is that the author is on the Microsoft docs team, which uses a similar system for docs.microsoft.com [1]. So I don't think that GitHub has a problem with this approach.

For an example of Microsoft's system in use, see the "Feedback" section on [2].

[1]: [https://github.com/MicrosoftDocs/feedback/issues/396](https://github.com/MicrosoftDocs/feedback/issues/396)

[2]: [https://docs.microsoft.com/en-us/azure/azure- functions/funct...](https://docs.microsoft.com/en-us/azure/azure- functions/functions-dotnet-class-library#feedback)

<comment><USER7> GitHub is owned by Microsoft though, so there's no guarantee they won't have problems with someone else doing this.

</comment></comment><comment><USER8> I can't imagine GitHub are going to be very thrilled with this. Maybe as a one off you'd fly under the radar but making it more widely available seems kinda silly.

I like how it's marketed as 'no ads, always free'! Not so difficult to do when you're (ab)using someone else's service to handle all your data.

<comment><USER9> I think GitHub is okay with "creative" uses of their system, as long as one doesn't push the limits and doesn't make a business from it.

Infamously, CocoaPods was serving directly from GH, maxing out out five server CPUs and using terabytes of traffic, and their response was fairly sympathetic: [https://news.ycombinator.com/item?id=11245652](https://news.ycombinator.com/item?id=11245652)

<comment><USER8> > I think GitHub is okay with "creative" uses of their system, as long as one > doesn't push the limits and doesn't make a business from it.

Being on the front page of hacker news feels a lot like "pushing the limits".

</comment></comment></comment><comment><USER10> I've seen a couple apps like this now where the app is basically a parasite on something else. Seems like a an abuse of goodwill.

"Check out SnooFS: the free cloud storage solution built on Reddit comments! Basically instead of paying for your own storage, SnooFS generates you a personal subreddit and uploads your data as text, video, and images to be hosted on Reddit's servers! No limit to storage - upload as many TB as you want!"

<comment><USER11> This is not a good comparison. While I agree with you that a project like SnooFS is using other people resources in a bad way, projects like this are more of a proof-of-concept than anything else. I don't believe people would actually trust their files in a manner like this.

On the other hand, whereas GitHub issues are not intended for external blogs comments, it is already used like this and for blogs hosted on GitHub Pages. This is just an automation tool. If GitHub sees a problem with this in the future they can always change their terms of use (and that's why anyone should only use a system like this for ephemeral stuff).

</comment></comment><comment><USER12> I looked into using Utterances a while back, but decided against it.

From my blog post [0]: This product requires an external server to be up and online at all times. And while they do promise to be always free without ads, they don't promise to be always available. And while they are open-source and I could always decide to host my own Utterances server/bot, I'd prefer to host nothing at all. This isn't a super deal breaker, because in the end, all content is stored in GitHub Issues.

[0] [https://pknopf.com/post/2018-10-13-comments-for-static- sites...](https://pknopf.com/post/2018-10-13-comments-for-static-sites-using- github-issues/)

<comment><USER13> you could have pushed solution a bit more to create the github issue when creating blog posts - like use a github token to generate issue when the issue does not exist for blog posts.. utterances feature that I liked is the bot that creates the issue for you automatically and also scans the github repo for comments based on title..

<comment><USER12> > you could have pushed solution a bit more to create the github issue when > creating blog posts

I guess, if my solution were a "product", as opposed to a one-off.

</comment></comment></comment><comment><USER14> I have been using utterances for a couple months and absolutely love it. It simplified my stack so much as I could finally shutdown my crappy REST comment api

</comment><comment><USER15> This is brilliant! If your blog is hosted on GitHub it's even more useful and comments will be closer to the source.

</comment><comment><USER16> Just embed a real comments platform for free like Disqus, or Discourse. There are plenty of better options that make this pointless for anything more than a "just because" project.

</comment><comment><USER17> This is awesome! Great work. Any support for nested replies coming?

<comment><USER12> Not likely, since it sits on top of GitHub issues.

<comment><USER18> That doesn't preclude them from building nested replies. For example, they could add a line like `Reply-To: <comment-url>` to the comment to establish its parent.

<comment><USER12> Yeah, but that feels like a square peg/round whole.

What if someone comments in the issues directly, on GitHub?</comment></comment></comment></comment>


The Science of Trap - <AUTHOR> https://medium.com/@CodedByCam/the-science-of-trap-915b3ef77bab <comment><USER2> An interesting read.

I only became familiar with the term 'trap' recently - though I was already familar with the idea. I think that most people are. One of the best commentators on it that I have come across is David Simon - creator of The Wire. If you get a chance to read any of his articles or interviews on US society and the economy I highly recommend that you do. It's worthwhile if only to be reminded that the economy isn't just about government, corporations, and finance.</comment>


The Hacker's Guide to Investors - <AUTHOR> http://paulgraham.com/guidetoinvestors.html <comment><USER2> "Since valuations are made up, founders shouldn't care too much about them. That's not the part to focus on. In fact, a high valuation can be a bad thing. If you take funding at a premoney valuation of $10 million, you won't be selling the company for 20. You'll have to sell for over 50 for the VCs to get even a 5x return, which is low to them. More likely they'll want you to hold out for 100. But needing to get a high price decreases the chance of getting bought at all; many companies can buy you for $10 million, but only a handful for 100. And since a startup is like a pass/fail course for the founders, what you want to optimize is your chance of a good outcome, not the percentage of the company you keep." [Excerpt taken from the Essay]

This is exactly the reason Technorati is finding it hard to sell, whereas MyBlogLog got sold within no time and Newroo even before they could launch the product.

</comment><comment><USER3> 'Most investors are "bottoms" in the sense that the startups they like most are those that are rough with them. When Google stuck Kleiner and Sequoia with a $75 million premoney valuation, their reaction was probably "Ouch! That feels so good."'

I don't think I've read a funnier paragraph about venture investing. Brilliant observation.

<comment><USER4> It's not just investors. This is a good practice anytime you're trying to sell a big ticket item to a potential customer. It gives them permission to believe the price is worth it.

</comment></comment><comment><USER5> It's telling that the "comment" link for this essay goes here and no longer to Reddit.

<comment><USER6> That might be bad; it means that this community will grow in the same way as Reddit did. Which was fine for a while, and maybe it'll be fine here because the powers that be here are less religious about not messing with the content.

<comment><USER7> We're determined to keep the site focused, however many users we get. We kill submissions that are egregiously off-topic.

<comment><USER8> While seeing News.YC grow is fantastic, it's a little disheartening to watch the community loose its "small town" feel. It seems that as things become bigger, the comments become more anonymous and users loose their sense of social restraint.

This is actually why I left reddit. As the site grew, I became increasingly frustrated that anything I said contrary to popular opinion was mercilessly downvoted & derided, regardless of the actual quality of the comment.

Reddit now cultivates one set of values & opinions. Anyone who disagrees is hounded & ridiculed until they leave.

<comment><USER9> From the web site's perspective, karma is a mechanism for internal calculations, and is in no way a measurement of your intellect or morality (?) or whatever else. And karma can't be turned into money for you, so why bother at all? :)

That's why a possibility of being downvoted never stopped me from commenting, be it reddit, slashdot, or YCnews.

One lesson that I learned from reddit in particular, is that if you are interested in the topic, you should read all comments, all the way down the page, because there might be something there, in the negative karma area.

<comment><USER7> Karma reflects what the other users of a system think of you. So it can be meaningful to the extent other users are good judges.

<comment><USER9> Karma and all sorts of voting in general have a flaw: they reflect Average Joe's opinion unless, of course, you have a narrow social/professional group as your user base. The broader your group the lesser are standards of your social website unfortunately. Wasn't it one of Reddit's lessons?

That's why I think there are two types of winners in this game: those with good implicit ranking mechanisms (Google, Flickr) and those with good human moderation (Slashdot). Those based on explicit voting are taking the risk of being taken down by broad and unfocused masses.

<comment><USER10> Well there are a couple solutions. One, you could tabulate votes based on the karma of the users. So someone with higher Karma gets bigger weight. That will probably focus the discussionsa and submissions a lot.

Two, you could have interesting comments, based on people voting them up or down, and their replies.

Also you could do some kind of geomtric progression instead of linear, or combine that with the voter's own karma.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I would like to comment your (P.G.) other essay, about Unions (An alternative theory of Unions): I'm sorry i'm posting here, I did'nt found the link to comment the exact essay.

What you said (and what you usually says) is right from the point of view of a person non really interested in the quality of other people's life.

Is quite obvious to see that the world is producing a lot more than before and that the difference between poor and rich is becoming wider (in USA, your country, more than in Europe, but we are copying you in this too...): the question is not if they were paid more than they were entitled for, and now their price is "the right one".

The question is: which kind of society are we building? Which kind of countries are we shaping? Which world we want to live in? A world made of people who can stand, one beside the other, without slave (official or unofficial...).

You want a society where the stronger eats the weaker. It's not the world I want. I don't want to earn so much, it's not there happiness. Is not buying things that brings happiness: I'd rather prefer a society where the state take part of the resources to take care of people that are lessa ble or lucky or whatever...

I want a better Atene not a better Sparta. And if you have studied philosophy (that you wrong said not teaching nothing to people...very unlucky words) you would had known that no society can resists in such a disparity. You know history better than me: our time, in the west, is not so full of revolutions, but just few years ago we were killing each others...remember that if you push someone's shoulders against a wall, you force him to fight or die.

</comment><comment><USER12> The essay neglects what happens to the 9 of 10 companies that don't, as far as the VCs are concerned, pan out. Closing them down means they have to give any remaining money back to the investors -- including their own fees they had already pocketed. Any dollar the company doesn't spend before it dies means money from the VC's own pocket.

The solution is to drain the company. The VCs install executives they owe favors to, at massively inflated salaries. They make the company hand over millions to "market research" and outsourced marketing companies. They make the company sign big service and equipment contracts. Each of these deals means a kickback or a favor owed. Best of all is if the money goes to one of the properties not being drained, or somebody the VC owes, or personally owns stock in.

It's no accident so many companies folded after buying unnecessary enterprise- grade Oracle and Vignette licenses.

</comment><comment><USER13> I remember a few years ago Paul was proclaiming that as the cost of starting a company keeps going down, VCs will become extinct. It is interesting to see how the perspective is changing. Now Paul says you need investors to gain advantage over competition even though, oftentimes, a startup needs very little to make a product that people want.

<comment><USER4> I can't tell why point 22 shouldn't be titled "Sometimes you need capital other than sweat equity". It's not clear to me why this couldn't come in the form of debt. The only type of debt I recall Paul mentioning is the convertible kind.

I mean, other than the fact you'd have to talk someone into giving you that loan at a reasonable interest rate. Talking investors into giving you the money as a bet for an astronomical interest rate would be easier for companies with no collateral. Still, if you have a revenue stream and can show how a capital expenditure would increase it, it would at least be worth considering.

</comment></comment><comment><USER14> Great essay, Paul. There are indeed a lot similarities between Vcs and women behaviour patterns. (angels are more like asking a good male friend for some borrowed money...simple, direct, no hiding terms...) Take the "investors" from the subtitles and replace it with "women" and the information is going to work just as right.

I will think more on your points..

thanks again

MJ

</comment><comment><USER15> "Google came along three years later and kicked Yahoo's ass" ha ha.. its cool to read it from Y!ou.

and a very cool article. great points.

</comment><comment><USER16> VCs look for Sergey & Page? It seems to me that the hype about these two was pure PR, but who actually brought all the business to the company (including the AOL deal) is Omid Kordestani - who, as little as it is known, was third in amount of stock owned, and also has half of the company report to him.

</comment><comment><USER17> _That means they're less likely to stick you with a business guy as CEO, like VCs used to do in the 90s. If you seem smart and want to do it, they'll let you run the company_

"Let you run the company" ? Surely a single round of funding doesn't take majority ownership from the founders?

<comment><USER18> There are a number of ways that a VC who owns less that 50% of the company can still push through changes like this.

In some cases this will flat out be a condition of investment, so it is agreed on in advance. If you are really anxious to close the deal it is easy to see why you might agree.

In other cases the composition of the board might be such that a majority might vote for a CEO change. This can be the case when, in addition to the founders and the VCs on the board, there are "independent" directors who might vote with the VCs. If the independents+VCs is greater than 50% of the board, they can usually make a change of CEO.

If the VC does not have 50%, but no individual founder does either, it is possible for the VCs to convince some of the non-CEO founders that it would make sense to bring on "professional" management to increase the possibility of success. Particularly if the founders have some disagreements, this can be tempting.

One other thing that can happen is that as a company goes out to pursue additional rounds of financing, the existing VCs can use that process as leverage to force a change. For example, if they say that they won't invest their pro-rata share in a new round, that can often be a warning sign to other investors. So, the VC might threaten to withhold that investment to convince the CEO to step down.

Majority ownership means a lot, but it is not everything.

</comment></comment><comment><USER19> The essay says "You should not start a startup which requires a lot of money". But some startups genuinely require much more money than webapps do. What should a person do in that case, other than being at the mercy of the investors?

<comment><USER20> I suspect there's a hidden upside to a startup that require a lot of money...it's going to be more difficult for competitors to get off the ground as well.

</comment></comment><comment><USER21> I am overwhelmed ... seriously I never had such a precise dose about investors.

I am reading all articles one by one for last 6 hours.

And I will continue doing so. Because everything I find here so right and complete.

thanks a lot...

</comment><comment><USER22> Having been a co-founder of two VC-backed startups, I can say that everything in this essay makes a lot of sense, sounds very plausible, and is entirely consistent with my experience. Great essay!

</comment><comment><USER23> best piece i've read about angel / venture investing in a long time. nice job :)

note: i'm one of a small group of ex-geek angel investors out here in silicon valley, altho admittedly i'm small fry compared to most others. i've done 5-6 deals averaging ~$25-50K, and only because i'm crazy and my wife isn't watching too closely ;) i was fortunate to be at PayPal from 2001-2004, but not so early that i'm rich enough to retire just yet... maybe someday.

enjoyed the article; keep up the great writing!

\- dave mcclure <http://500hats.typepad.com/>

</comment><comment><USER24> In your articles, the target content of an annotation hyperlink should also have a hyperlink that takes the user back to the place in the original content where they were at...

</comment><comment><USER25> This story is really poor without Venture Hacks <http://www.venturehacks.com/>

</comment><comment><USER26> Very inspiring, Paul. I'm so sad I missed the talk. Here's hoping you have a gig somewhere around the time of WWDC in June!

</comment><comment><USER27> Great article in many ways but i nearly fell off my chair when i saw the photos of the team at Redpoint.......that was scary.

</comment><comment><USER28> What is 'fuck-you money'?

<comment><USER29> <http://www.urbandictionary.com/define.php?term=fuck+you+money>

<http://www.everything2.com/index.pl?node_id=680458>

<http://www.google.com/search?q=jfgi>

</comment></comment><comment><USER30> FOUR STARS, THE FIFTH STAR RAN ACROSS THE STREET. loveit

</comment><comment><USER31> Great essay. How about turning it into a "rich illustration" so everyone can see it and talk about it? Look at my site to see what Dill can achieve <http://www.equityfingerprint.com/.> Anyone like the idea?</comment>


Dapper, Google's Large-Scale Distributed Systems Tracing Infrastructure - <AUTHOR> http://highscalability.com/blog/2010/4/27/paper-dapper-googles-large-scale-distributed-systems-tracing.html <comment> brown9-2 Fascinating writeup, looking forward to reading the original paper

link: [https://docs.google.com/viewer?url=http://research.google.co...](https://docs.google.com/viewer?url=http://research.google.com/archive/papers/dapper-2010-1.pdf)</comment>


The trailer park is the computer - <AUTHOR> http://www.roughtype.com/archives/2008/12/the_trailer_par.php

<comment><USER2> That's rather a clever solution.. i'm rather annoyed M$ came up with it first :D

<comment><USER3> Actually, Sun came up with it first.

But Google won't let that happen, oh no! [http://arstechnica.com/news.ars/post/20071010-google- patents...](http://arstechnica.com/news.ars/post/20071010-google-patents- datacenter-in-a-shipping-container-ignores-suns-blackbox.html)

<comment><USER4> Actually, I think the Army came up with it first. I could have sworn they've been prepared for dropping in boxes of servers with power/network hookups into warzones for awhile.

</comment></comment></comment><comment><USER5> Fun video!

</comment><comment><USER6> What if it rains?

<comment><USER7> Containers are sealed.

<comment><USER6> A bit late for the comment, but, if the containers are sealed, then isn't cooling required after all?

</comment></comment></comment><comment><USER8> > (No word on whether employees at the new centers will be required to wear > wifebeaters or carry around 30-packs of Busch Light.)

oh jesus I lol'd at that</comment>