The Two Day Manifesto - <AUTHOR> http://twodaymanifesto.com/?atm=email

<comment><USER2> If you're using the technology a lot, the developers should already be diving into the codebase and improving it.

No software is perfect and sometimes the best way to fix your code is to actually fix whatever dependency is causing the problem and push it upstream.

I find it disingenuous to imply that developers should not be venturing outside the little garden of code they or their company has written except on certain days and that the developer will even have a choice in the matter.

<comment><USER3> > _I find it disingenuous to imply that developers should not be venturing > outside the little garden of code they or their company has written except > on certain days and that the developer will even have a choice in the > matter._

In my experience, developers often do everything possible to avoid working on dependencies (in a way that can be contributed upstream). While it may be the case that developers in SF or other big developer hubs do so, where I live most developers are content to either hack a fix into it, or work around it in their app code instead. Luckily, it makes getting a job easier for myself as I do have a number of open source contributions I can point to, which a lot of other devs around here lack. I had to explain to a recruiter what GitHub was, once.

</comment></comment><comment><AUTHOR> I own a little agency here in Bolivia, and we will start doing this this month. It's a fantastic idea and one I hope catches on. Imagine the contributions if everybody did even a little slice of work.

Documentation, refactoring, updating the readme, whatever!

</comment><comment><USER4> Question for maintainers of popular open source projects: Would you prefer two days of developer time/month, or a comparable cash donation?

Charitable organizations often prefer the cash [1], but open source is different -- I suspect many developers have more context and preparation than the typical volunteer. On the other hand few people will be as efficient in a code base as the original authors.

[1] ([http://www.theguardian.com/voluntary-sector- network/2014/mar...](http://www.theguardian.com/voluntary-sector- network/2014/mar/03/which-would-you-rather-have-time-or-money))

<comment><USER5> Well formatted bug report, with test case to reproduce issue is most helpful.

</comment></comment><comment><USER6> "Simply schedule it in like you would any other work."

When I schedule in work, usually it involves a client paying me for that work. One of my clients for one of my larger ongoing projects expects my team to produce 20 days of development a month. How exactly do I explain to them that instead we will be doing 18 days of development for them, and two days contributing to, say, Rails? I don't think they'll really see that two days of contribution to the improvement of Rails is equivalent to two days of adding features to their product.

<comment><USER7> Your team will still be producing 20 days of development a month. The whole idea behind a manifesto like this one is to introduce a new kind of task into your pipeline.

What does "20 days of development" really mean? Does it exclude unit tests or integration tests? Does it exclude writing developer docs? Does it exclude performance tuning?

All those are development tasks whose purpose is to make your product better in different ways. This manifesto posits that working on the open source software your product is based on will also make your product better. To me, your question indicates that you haven't yet decided whether this proposition is true.

<comment><USER6> You are very intuitive. My comment initially read "I don't think they'll really agree...", and then I changed the last word to "see" when I realised I wasn't sure whether I even agreed with it myself.

My team certainly does do things like writing unit and integration tests and developer documentation, and these are things I do charge clients for (though sometimes even these things can be difficult to explain as a line item on an invoice - but, as others often say here, the kind of clients who are problematic about that sort of thing are perhaps not the clients you really want to work with).

Personally I would have a hard time explaining to a client that we spent their paid-for time improving something "for the greater good" that may or may not have a direct, quantifiable benefit for them.

<comment><USER8> Raise your rates 10%, and bill 18 days per month. Or eat the 10% yourself.

</comment></comment></comment></comment><comment><USER9> The idea of donating 2 days a month seems great but I feel the site isn't arming developers well. These are some example questions that might come up in conversations:

1\. Depending on your work environment, you may work in a place with lots of legacy code. After all, why should an employee work on open source when we could be improving our legacy codebase and slowly modernizing it?

2\. How do we know the work contributed will be brought to use (aka merged in)?

3\. Can and how do we donate to project X instead providing your time? We have some tight deadlines and we need everyone on board.

Marketing to your employer you need 2 days a month seems like a nonstarter. As in programming, start small, build a strong foundation and iterate. See what works.

Maybe you could start with 2 hours per week (1 day month) and see how that goes. This will get you, the developer, and the company who employees you comfortable with this arrangement.

Companies like to feel comfortable.

</comment><comment><USER10> This is fine, but in my experience, when I try to contribute to open source projects I use at work - the outcome a lot of the times is a few days to weeks (and in one case 2 years) of radio-silence on the PRs/issues that may or may not result in a merge or any response at all. Most of the time it does result in merges, but sometimes just talking to the author and asking if he needs help with something takes time. So it doesn't scale for most projects.

Another approach (we're also doing) is to open-source components of our code that might gain from a small community adoption. A side effect is that it contributes to creativity and the quality of work, and teaches people how to deliver high quality software.

</comment><comment><USER11> Why not give developers 2 days a month to work on projects of their choosing? If the project they want to work on is an open source project, then great.

This is what we do at my company.

<comment><USER12> Why not give a developer two days to work on building a desk in his/her garage?

Basically because the desk only affects the developer's private life. Why not just replace such a "project" with two more paid vacation days?

Working on an open-source project typically enhances lives of all of its users (and maybe even the for-profit entity that employs the mentioned programmer). Psychologically it's a different thing.

<comment><USER3> If you look at it from a different perspective, being able to work on personal projects means your place of employment gets the skills you develop, has a chance to offer help and support or even invest in the idea together with you. It's brilliant for morale as well, and something that I love about my current place of work.

</comment></comment></comment><comment><USER13> Speaking from personal experience, if I'm using a dependency within our application that I see fit to improve upon, I usually take the initiative to add that improvement --whether or not upper management approves of such behavior. I think this manifesto is great in that it encourages developers to contribute, but it's almost implied, that many developers who implement these tools, find requirements that would fit not only their needs but others as well.

I recently implemented a very popular templating engine for our new project. Saw an improvement that could be made to the repo and did a quick PR on a fix. Done. I understand not all issues are that fast to fix, but it's default behavior on my part to fix the actual dependency (or find an improvement) while I'm working. In other words, I find that such actions are morally in- sync with the item at hand. I hope to see others share a common thought- process.

Make open-source part of your routine and see how far it takes you.

</comment><comment><USER14> I think that developers and companies will benefit from this as much as the open source community will. One of the best ways to get better at coding is to read other peoples' code, especially well maintained open source code. Whether you pick up style tips or best practices from someone else's work, or sharpen your own eye by figuring out how you could have done it better. Analyzing an open source project is also great for learning a new language or familiarizing yourself with a new programming paradigm. In many ways this is equivalent to telling your employees "Spend two days a month honing your skills in a productive way".

I would definitely do this whenever I wasn't rushing to meet a deadline or dealing with a full bug queue.

</comment><comment><USER15> This is an equivalent to having 10% of your engineers work full time on OSS. I'm not saying it's a bad thing just that it's a big ask.

I think it'd be better if companies instead opened their own code.

</comment><comment><USER16> Only 2 days? It's 2015!! You'd think that we could afford doing what each and everyone of us _loved_ the whole damn time and not just 2 days while slaving away the rest of the month.

<comment><USER17> A la 2015… Since it started becoming clear that technology was advancing fast, changing everything and the process would continue for a long time, we've had this semi-utopian idea about the future.

If machines are making stuff, improving tools for the home and the workplace (vacuum cleaners & injection molding machines) will chip away at the number of hours we need to work. The future will be a leaser society. Part os this have come about. There are a lot more services and a bigger portion of total consumption allocated to various optional or "lifestyle" decisions. Most of us working in "developed economies" can certainly afford as many plates and electric kettles as we can use easily. In my grandmother's time, you got plates and sugar bowls for your wedding and your inheritance and tried not to break too many in between. But, some fundamental "human condition" issues have gone unsolved?

When I first thought about these things as a kid I didn't know that people had been making the same speculations for nearly 100 years.

I don't really know to say 'why.' But, I do think a good chunk of our consumption is competitive, and therefore resistant to adequacy. Real estate is competitive. Schooling is competitive. Status symbols are competitive. You can own the latest gadget for cheap, if you're willing to wait five years until prices drop (what would be the price of a brand new iphone 1 in 2015?).

Anyway… I think it's unhelpful to great improvements with cynicism. 2 days a month is a decent starting point. If you really want to work on whatever you want to work on without financial considerations.. you need to figure out a way of doing it for yourself. Otherwise, 2 days is not bad.

</comment></comment><comment><USER18> This is a great idea and limiting it to two days will help corporates not feel like they're "wasting" too much money (you know, because developers are "resources" and if they're being used for something else it's a "waste"; at least I've had that experience in the past).

Though I'd love to see a little more flexible "manifesto". Some months maybe do 3 days, or maybe crunch month you do 0 and the next month you do 4; I'd hate for this to be taken entirely literal.

</comment><comment><USER19> This works better in larger organizations than smaller ones. In a large org, there are more people working in the same capacity which creates more redundancy and allows for one person to keep doing the business's day-to-day specific work while another goes into open source community for longer term benefits.

At a smaller startup, there isn't that extra redundancy so any time one spends investing in future stability or performance comes at great opportunity cost to finding product market fit.

<comment><USER20> What's the cost of not having the OSS code to power your startup, and having to reimplement it from scratch or paying a huge license to some commercial vendor?

</comment></comment><comment><USER21> Great idea. In terms of how to pitch this to businesses, one angle I haven't seen mentioned so far is to emphasise how improvements in open source dependencies not used by competitors could give you a direct commercial edge. For example in my previous company we had our own DSL for algo trading algorithms that used LLVM, whereas all our competitors solutions were Java based. Any performance improvements we contributed to LLVM would benefit us but not our competitors.

</comment><comment><USER22> I like the idea. The only problem I see from a companies' perspective is that open source technology suddenly becomes costly which then makes commercial options more viable and in long term could harm OSS.

</comment><comment><USER23> This is a novel idea, but 10% of an employee's time seems high.

</comment><comment><USER24> Will be implementing this in my department and every department I'm a part of from here on out.

</comment><comment><USER25> Open Source needs to become a charity. Most businesses don't mind wasting resources on charity as long as it generates good PR.

Two day manifesto makes it sound like a tax. Companies don't like taxes.

</comment><comment><USER26> Donate.

The Two Day Salary Manifesto would be much better.

</comment><comment><USER27> I'm going to oppose this. Like 20% time, it ends up becoming a negative space and, despite the best intentions behind it, backfiring and making our cultural enemies stronger. "Agile", at its inception, wasn't the toxic micromanagement nightmare that it has become. We have to be more careful about what we put out there. Implying that 10% of an employee's time for this autonomy ought to be enough is dangerous.

Engineers should be able to improve and maintain the open-source libraries on which they rely _whenever they fucking want_. Working time, weekend time, 6:20 in the morning, whatever. Four fifths of these fucking companies would run better if they were run by people who actually do the work.

If engineers are managed down to 2-day increments of time instead of 2 months, then you need to fire 90% of your managers because there clearly isn't enough real work for them, so they're micromanaging. No one who is smart enough to write good code should ever have to justify days of his own working time. Fuck that, and fuck the whole shit pile of "Agile" nonsense that forces us to pretend that it's OK when senior engineers have to justify weeks and days of their own working time, often to non-producing "scrum masters" and "product owners".

I realize that this is a well-intended statement, but it's wrong-headed because companies where manifestos and official policies are needed just to shore up an engineer's basic autonomy to do valuable open-source work with _his own working time_ are companies that don't deserve to live.

</comment><comment><USER28> If only... There are some things in Nancy that I'd love to make some small changes to, if only to get some more comprehensible errors output when the Razor viewengine blows up because you typo'ed something in a view. I love NullReferenceExceptions...

BTW: Is there something weird going on with justification on this page?</comment>


Computational Category Theory in Python III: Monoids, Groups, and Preorders - <AUTHOR> http://www.philipzucker.com/computational-category-theory-in-python-3-monoids-groups-and-preorders/ <comment><USER2> Can someone explain to me what Category theory actually contributes to mathematics beyond the contents of abstract algebra, graph theory, and set theory? Because every interesting result I've seen just looks like it comes from those other branches with some different terminology. Does it actually lead to any unique or synergistic results that the others fail to produce with their own axioma?

<comment><USER3> It's more helpful to view category theory as a language.

Most undergraduates learn mathematics in the language of sets. If they're doing algebra, then the underlying structures of their groups, rings, etc. are always sets. Same for topology and logic (e.g. classical model theory). An extreme example of this set-theoretic thinking is defining the real numbers in terms of Dedekind cuts.

Category theory, very slowly, changes this perspective. If you study this for years, you will come to realise there is more to mathematics than sets. And your way of thinking will shift. You will learn to ask different questions. For example, instead of defining things in terms of their underlying set (often breaking symmetries), you will ask 'does it have a universal property?' and so on. Note, there are still tons of reasons to use sets / ZFC, even when working with categories mostly. But I do not want to get into that and it's irrelevant for the point I'm trying to make.

Final note: the 'language of sets', i.e. the language of undergraduate mathematics, is very different from set theory. 'Set theory' is like the language talking about itself. The same goes for pure category theory.

<comment><USER4> Set theory was developed to make analysis "rigorous" by the standards of 19th century mathematicians, who were probing the edge cases of the more intuitive (or maybe handwavey) assumptions from the 17th–18th century. Here's Rudin to explain: [https://www.youtube.com/watch?v=hBcWRZMP6xs](https://www.youtube.com/watch?v=hBcWRZMP6xs)

In the 20th century it became trendy to (a) try to base _everything_ on set theory, (b) write mathematics in a very dry and formal style, taking inspiration from the Bourbaki project.

My impression is that undergraduates are taught in the language of sets partly because it is serviceable for describing the subjects they are trying to learn (esp. analysis) but also more importantly because mid-20th century mathematicians who set up the curriculum we are still using wanted to thoroughly teach (indoctrinate?) undergraduates the trendy style of the time.

Personally I think it has been a mixed bag; the style is a big turn-off to many people, and ends up chasing people out of mathematics who could otherwise make valuable contributions. The people who remain seem to mostly like it okay though. YMMV.

<comment><USER5> I have some problems with this comment.

First, why the scare quotes around "rigorous"? Set theory literally did make the foundations of analysis more rigorous.

Second of all, we don't use set theory because it's "trendy" or because we want to "indoctrinate" undergraduates, we use it because it's the best known foundation for mathematics. If there was something less complicated or annoying that worked, we'd use that instead. But as far as we know, there isn't, and there are good reasons to believe we won't find something better.

</comment></comment></comment></comment><comment><USER6> I suggest to the author that they rephrase the title to something like "...Theory in Python Part 3..." to make it clear that this is the third installment in a series, not specific to Python version 3.

<comment><USER7> Yes. I was thinking, "I've never seen Python 3 written as Python III before".

</comment></comment><comment><USER8> Not a bad attempt at all, but it doesn't showcase how expressive things could be. What would be really cool (and arguably Pythonic) could would be to use Python's operator overloading to what these abstract entities would look like, in the same way that the the builtin `set` is used.

</comment><comment><USER9> Hey, author here! Neato! I'm on HN!

<comment><USER10> I haven't read all the way through yet but this seems pretty great. Some rough edges, sure, but it's accessible, fairly comprehensive, and concise.

Have you seen "Multi-Level Languages are Generalized Arrows" by Adam Megacz? [https://arxiv.org/abs/1007.2885](https://arxiv.org/abs/1007.2885)

<comment><USER9> Thanks! I haven't seen this one before. I'll check it out!

</comment></comment></comment><comment><USER11> Ok, the basic question: what is dom and cod and why does this article spend the time explaining the basic concepts but never gives a definition of the only obviously unknown concept?

<comment><USER9> Sorry, this is the third part of a series. I think I said what those were in the first part but I'm not sure

dom and cod are the domain and codomain of a morphism. They are functions that given a morphism will return the object at the head or tail of the morphism.

I don't think that these articles are a very good self contained explanation of category theory. At the moment, I've been aiming at a supplement written in concrete python to something more thorough.

<comment><USER12> More generally, I think all the naming could be improved. Why not write out "domain" and "codomain"? Why abbreviate "identity" as "idd", is that standard anywhere? Why use "mplus" and "mzero"? The latter is as in Haskell, I believe, but there they must do it that way because they can't overload the identifiers. Inside Python classes you don't have that restriction.

<comment><USER9> A good point. If my goal is educational (and it 2/3 is), these stupid short names are a huge oversight. I honestly didn't think about it much.

I think I started from known Haskell names, some conventions that I may have absorbed from catlab.jl and other places, and some unthoughtful accidents. I really really wanted id to be the identity, but I'm pretty sure it's a python keyword. I added a d and vowed to never speak of it again. Ever written a program about schools and had to use the variable Klass?

I don't feel too bad about mplus and mzero. It's still pretty clear that they are something like plus and zero, but the m gives you pause. And it should, since in one case mplus is in fact multiplication.

If this was rolled out into a library maybe I'd have both long and short names? I'd never want a library to have only long names for really common things. cod and dom don't actually give me a seconds pause. I like them having the same length too. Makes code prettier and easier to read. I also intend to replace some things with operators which would be even more inscrutable to a newcomer. @ has to be compose for example (to mimic numpy).

<comment><USER12> > I really really wanted id to be the identity, but I'm pretty sure it's a > python keyword.

It's a built-in function, but you can overload it within a scope you control without problems:

        >>> id
        <built-in function id>
        >>> id = 7
        >>> id
        7

> And it should, since in one case mplus is in fact multiplication.

Good point! I take this part back.

As for having identifiers the same length, I know the urge, but usually find the superficial "elegance" it's not worth it.

</comment></comment></comment></comment></comment><comment><USER13> (I realize that I am probably too late to get an answer.)

Besides Category Theory, what other topics are worth reading about to broaden one's CS background? I write a lot of code without formal CS training so I was hoping to expose myself to interesting, preferably "mind-blowing" topics without having to take a course or go through the whole SICP.

<comment><USER9> Author here. I don't recommend category theory. There are lower hanging more mind blowing fruit.

I'm having a hard time thinking about a blog posts worth of content that is mind blowing. Mind blows tend to take more investment than that.

I'd recommend checking out an algorithms course [https://ocw.mit.edu/courses/electrical-engineering-and- compu...](https://ocw.mit.edu/courses/electrical-engineering-and-computer- science/6-006-introduction-to-algorithms-fall-2011/) This one is very good. Has free videos.

I'd recommend giving functional programming a try. I'm an FP fiend. I found SICP tough going though.

I'd recommend giving low level programming a try.

Learning prolog is pretty mind blowing [http://www.learnprolognow.org/](http://www.learnprolognow.org/)

Digital Circuitry is pretty mind blowing [https://www.nand2tetris.org/](https://www.nand2tetris.org/)

Making interpreters can be pretty mind blowing [https://craftinginterpreters.com/contents.html](https://craftinginterpreters.com/contents.html)

</comment></comment><comment><USER14> One day I might read something that will undo my conviction that category theory is the mathematical equivalent of literary critical theory. But alas, it is not this day.

</comment><comment><USER11> This article doesn't properly use self within python classes. On top of that the author couldn't even apply a code formatter to the code so there's a bunch of missing/extra spaces.

It also doesn't even try to make the given code applicable to real problems. It seems as if someone writing an article of how to use functions.partial while never mentioning when those partials could be practically used.

All in all, 0 respect for the reader; seems like a badly typed retelling of a university course.</comment>


Wrote a book in 2 weeks. This is what I learned - <AUTHOR> https://danielbusta.com/writing-book/ <comment><USER2> Hi, and welcome to HN. Nice work on getting something done and "out there" ... I hope it does well.

Quick thought ... if you want people to contact you directly, about the book, or about anything else, you might want to put contact details in your profile. Again, not essential, but many people don't realise that this is an option.

<comment><AUTHOR> Hi, Colin! Thanks for your kind words and for your good vibes. (Thank you for spotting my mistaken reply, too)

I just followed your advice and updated my profile info. Hope you have a great week!

<comment><USER2> Not a problem, happy to help. Hope all goes well, and that you also have a great week ... and beyond!

Cheers.

</comment></comment></comment><comment><USER3> Congrats! One thing that I would struggle with in that time period is knowing whether or not what I wrote was any good.

I find that I need to sit with content I've written for at least a few days before I have a sense for how well the content reads. I definitely over estimate the quality in the beginning. Do you have this experience at all?

<comment><AUTHOR> Thanks Ryan! Been there, done that. I think you just need to make peace with the fact that whatever it is you're writing never will be as good as you want, especially at the beginning. Just try to write in a clear, concise and simple way, and ship constantly so you get feedback. That's what gonna make you a better writer IMO</comment></comment>


Are We Harming Our Children by Banning "Risky" Play? - <AUTHOR> http://www.guardian.co.uk/education/2008/aug/03/schools.children

<comment><USER2> _"... 'Risk-taking increases the resilience of children,' said one. 'It helps them make judgments,' said another. Some of those interviewed blamed the 'cotton wool' culture for the fact that today's children were playing it too safe ..."_

I'd agree with that. One of the problems with not letting people try things is they have no real gauge on what is dangerous and what is not. So they tend to over react to things that are not dangerous and underestimate the danger when it really exists.

 _"... The research also lists examples of risky play that should be encouraged including fire-building, den-making, watersports, paintballing, boxing and climbing trees. ..."_

Add to that: rafting, caving, rock climbing, bush-bashing, shooting, building structures with rope & poles, long distance bike riding, tree felling (axe and chainsaw), motor bike riding, tractors, swimming at surf beaches ( _a mob of tourists drowned at a beach last year where I happily swam as a youngster_ ~ <http://www.google.com/search?q=anglesea+drowning+beach+surf> ) ... the list goes on. You do get a sense of what is dangerous and what you can handle. Having done all those before I was 14 meant I had a huge head start on my peers. To the point where even at Uni I'd done enough different things to leave experienced pro's wondering where I fit the time in for all these things.

There is a downside though. If you do make a mistake there is a pretty good chance you will get injured. If you don't you will fail to build up the store of experiences that you can call on in the future ~ <http://flickr.com/photos/bootload/2730793708/>

So what does it really tell you about over protective parents?

</comment><comment><USER3> "A major study says parents harm their children's development if they ban tree-climbing or conkers"

Does the word study in England not imply empirical research published in an academic journal?</comment>


Zeit.world: free global DNS - <AUTHOR> https://zeit.world <comment><USER2> The post title and linked page don't make it obvious that this isn't a standalone service; it's a feature of their "now" hosting service. So you can't use it for your app unless you host it with "now".

"now" has a free, highly limited tier for open source projects, but their standard tier is $15/month.

<comment><USER3> We've been getting lots of great feedback and usage on our OSS tier. Improvements are coming. Many of the limits are in place to prevent abuse.

<comment><USER4> I think the worst part is limiting the number of deployments you can do per month.

> 20 FREE deploys per month

This isn't good. I think the latest meta is that We want people to deploy early and deploy often. If something escapes code review (which lets face it: we make mistakes and is probably just two or more "Looks Good To Me") we want to catch it and deploy a fix as quickly as possible.

Do deploys really cost that much in terms of compute resources for you? Or is it just an arbitrary differentiator?

</comment></comment></comment><comment><USER5> The title is misleading. It's not a DNS service, but a node.js hosting platform similar to Heroku.

Custom domain is not included in the free tier: [https://zeit.co/now#pricing](https://zeit.co/now#pricing)

If you're on a paid plan, you'll get Geo-DNS for "free".

</comment><comment><USER6> But what's the catch?

<comment><USER3> Co-founder of ▲ZEIT here. There's no catch. If you deploy with [https://zeit.co/now](https://zeit.co/now), DNS is free.

Here's a little .gif showing the entire process if you're curious: [https://twitter.com/rauchg/status/746093788272037888](https://twitter.com/rauchg/status/746093788272037888).

<comment><USER7> How are you going to make money?

<comment><USER3> We charge individuals and teams according to their growing capacity needs (number of deployments, bandwidth, storage, etc).

Check out [https://zeit.co/now#pricing](https://zeit.co/now#pricing).

<comment><USER8> Pretty confused. You said there was no catch, but it looks to have pretty low caps on bandwidth and number of monthly deployments, among other things.

It still looks like a really interesting product, but it seems disingenuous to say there's no catch when clearly it's not totally free.</comment></comment></comment></comment></comment>


Is your Twitter password secure? - <AUTHOR> http://www.ismytwitterpasswordsecure.com/

<comment><USER2> First impulse = view source.

No no no no no

No no no You idiot.

Do you see "twitter.com" in the address bar? No, you don't. Don't ever type your
                        login and password to Twitter on a site that isn't twitter.com. Same with Facebook.
                        And LinkedIn. I guess what I'm trying to say here is, you're an idiot. Don't be an
                        idiot.

<comment><USER3> I find this kind of stuff awesome. Makes the developers seem more relatable, I guess.

</comment></comment><comment><USER4> Education re: passwords and security is an absolute must for the wider Internet-using public right now. I work in a place where colleagues are constantly asking "what's so-and-so user's password?" and are then surprised - and actually a bit put-out - when I tell them we have no way of finding out. Just alerting people to the fact that nobody should even be able to find this kind of stuff out is a valuable service; same goes for phishing.

</comment><comment><USER5> This is why two-factor authentication is important. In one of my favorite examples of how effective it can be, Gabe Newell demonstrated his confidence in Steam Guard by giving out his Steam username and password.

</comment><comment><USER6> So you want us to submit our password and username to an unknown entity? At that point, no, its not secure, even if its FKoieoSF()$902358#f9J#90JP[V, which, incidentally, is my password.

<comment><AUTHOR> Try typing on it. (the HN crowd is not really the target for this experiment)

</comment></comment><comment><USER7> It did immediately send up red flags with the "hey, lemme check your password safety by you GIVING me your password!" As I thought about it for a second though however, I tried to envision from memory what's the difference between these particular login forms versus legit twitter logins? (I'm at work so no twitter access) It looks pretty similar from what I can remember besides the submission button I suppose..

</comment><comment><USER8> You should search twitter for your site right now. It's blowing up haha

[https://twitter.com/search?q=ismytwitterpasswordsecure.com&#...

<comment><AUTHOR> Tell me about it. Never been more glad to have used S3 to host some files. Instant scaling...

</comment></comment><comment><USER9> First thing I thought, is someone really trying to pull one on HN? Very well done, I hope that someone tries it not realising what it is and becomes more aware.</comment>


Kickstarter says it consulted scientists before banning bioengineered organisms - <AUTHOR> http://www.theverge.com/2013/8/7/4595876/kickstarter-founder-yancey-strickler-explains-ban-GMOs

<comment><USER2> They forgot to put it in quotes. They consulted "scientists".</comment>


Feature request for beautiful Google+ - <AUTHOR>

Google+ getting beautiful by the day- One feature missing- "People" <comment><USER2> ...also all the beauty, takes a hell of a long time to load.</comment>


Mechanisms of Coronavirus Cell Entry Mediated by the Viral Spike Protein - <AUTHOR> https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3397359/ <comment><AUTHOR> ycombinator.com/item?id=22431196

there is a very specific region of the spike protien identified to interact with the ACE2 receptor

ACE2 receptors are molecular features found in the lung the heart and kidney, the ACE2 receptor become an entry point when exploited by the coronavirus and this is why those particular organs are challenged by this virus</comment>


IPv6 can boost mobile performance, battery life - <AUTHOR> http://www.itworld.com/internet/335395/ipv6-can-boost-mobile-performance-battery-life-proponents-say

<comment><USER2> Skimmed through the article to understand how IPv6 will improve battery life and I get following:

* Because NAT is not necessary with IPv6 every device can be directly reached by services like Twitter. In contrast today the device has initiate the connection to the services on a regular basis, which drains the battery. * "Accessing sites and content over the Internet is usually faster with IPv6 than with IPv4 because with the new protocol it requires fewer "hops" between network nodes": I cannot comment on this but I would like to know why IPv6 will use fewer "hops"?

The article goes as well on to say that communication providers will offer static IP addresses to their customers. We will see, but I am a little bit worried what this can mean for security if everybody in the InterNet can easily reach every mobile phone. Imagine new exploits in the TCP/IP implementation. It would open the door to infect a huge number of devices...

<comment><USER3> I'm actually more concerend about privacy. Now tracking a device is even easier than before. No more downloading of illegal contents!

<comment><USER4> While I somewhat agree about the tracking (if every device gets a /64, then, while the device can chose the host part, the network part is fixed, so site owners would just track the network part to uniquely identify a device or subscriber), I don't see the argument about illegal contents.

To track a downloader of illegal content, you'd still have to go through the users provider and the provider can easily determine who actually downloaded that content at a time.

So as long as providers cooperate, it's not easier or harder to track down a pirate with IPv6 than it was with IPv4

</comment></comment></comment><comment><USER5> This is pure speculation and cherry-picking. There are significant differences between IPv4 and IPv6. If you want to prove that IPv6 will boost performance and preserve battery life, run 2 identical devices limited to each and report the results.

Also, how does a device keep an address when it switches between cellular data and WiFi? How does IPv6 make this and similar issues go away?

<comment><USER6> > Also, how does a device keep an address when it switches between cellular > data and WiFi? How does IPv6 make this and similar issues go away?

It doesn't (unless people use Mobile IPv6, which seems unlikely). However, changing IP address is a small potato problem compared to the problems caused by keepalives and NATs. A device will know when its IPv6 address changes and can re-initiate its TCP connections. Right now, a device doesn't know when a NAT/stateful firewall has timed out one of its connections or decided to start NAT'ing to a new public IP address, which is why constant battery-draining keepalives are needed.

</comment></comment><comment><USER6> Things will be simpler without NAT for sure, but the article assumes that carriers won't still have stateful firewalls with IPv6 that also require battery-draining keepalives. If IPv6 mobile networks don't have stateful firewalls, then the battery-draining keepalives could be replaced by battery- draining port scans and other probing/DoS attempts by attackers.

On the other hand, perhaps if the carriers sparsely assign IPv6 addresses from their vast address space, it won't be feasible for attackers to scan for nodes as they do now.

I think the article is premature in suggesting anything about how IPv6 will be implemented in mobile networks in practice.

<comment><USER7> It seems incredibly unlikely that anyone is going to be able to do a active network scan of an address block to find devices with IPv6. Each _end-user_ is granted a /64 network which has over 4 billion times the number of IPs than exist on the entire IPv4 internet.

Even with MAC-based IPv6 autoconfiguration to reduce the number of IPs you have to scan using tables of assigned vendor prefixes, you still have a truly massive number of IPs to scan before you find anyone.

Put another way, it would take over 500,000 years to just send an ICMPv6 packet to a /64 block (assuming you could even narrow it down to a /64 which itself seems just as unlikely) with a 1 Gbps connection (over ethernet).

<comment><USER6> If a mobile phone is given a /64 that means that entire /64 is routed to the phone, so any attempt to scan it (even if it doesn't find the actual address in use by the device) will cause battery drain.

But maybe attackers just won't even try.

</comment></comment></comment><comment><USER8> I am not convinced about the polling argument to save battery life.

Yes, IPv6 could do that, but so can IPv4. Google have already demonstrated how to detect and adapt to the NAT device's timeout. Devices can just as easily hold a TCP connection open with minimal keepalives. All that is needed is for carrier NAT devices to increase their timeouts, and Android will detect this and start using less frequent keepalive intervals. 30 seconds (as from the article) can become 30 minutes. I'm sure the other smartphone OSes can either do the same thing or already do.

No IPv6 is needed. As much as I'd like to see IPv6 adopted, specious claims do not help.

<comment><USER9> If carrier NAT devices increase their timeouts, they're going to have to keep more stale connection information in memory, which means they'll need more memory to handle the same number of users, which will cost carriers money. They're not affected by their users getting less battery life because most customers won't realise it's the carrier's fault, so why should they change anything?

<comment><USER8> Compared to the costs to carriers in implementing IPv6? That's nothing.

I'm not convinced there will be that many extra stale connections, either. Do a significant number of phones switch IPs so often that there will really be a problem, or do they tend to get the same ones back?

</comment></comment></comment><comment><USER10> well, ipv6 defines periodic router-advertisement messages that results in ipv6-hosts recomputing currently active parameters e.g. mtu, lifetime for link-prefixes etc. in the worst case, say when the ue is idle, this might result in paging, which in turn causes establishment of radio-bearers, moving ue from idle to active state etc. etc. which most definitely _cannot_ be good for battery life.

also, the claim about "With a static address, it's easier to keep a data session alive while a smartphone or tablet travels with the user from one cell to another" is slightly disingenuous. typically address allocation in cellular networks is via an end node like ggsn or the pgw (lte). cell-to-cell movement doesn't constitute a "rat" (radio-access-tech) change. only when you move from lte coverage area to say a cdma area, handover procedures kick in, and then too, for session continuity reasons, end-node-address doesn't change...</comment>


Polr – A modern, minimalist, and lightweight URL shortener in PHP - <AUTHOR> https://github.com/cydrobolt/polr <comment><USER2> Not to dis Polr, but if performance and minimalism are your thing, there are a lot of nginx + lua + redis URL shorteners on github.

Two random'ish selections...

[https://gist.github.com/MendelGusmao/2356310](https://gist.github.com/MendelGusmao/2356310)

[https://github.com/sanshi0518/shorturl- nginx](https://github.com/sanshi0518/shorturl-nginx)

<comment><USER3> Just a few seconds of searching for a go based one yielded: [https://github.com/samwierema/go-url- shortener](https://github.com/samwierema/go-url-shortener)

</comment></comment><comment><USER4> Yes, 4192 files and 32MiB, quite minimal.

<comment><USER5> Maybe it's some kind of dadaist minimalism?

</comment></comment><comment><USER6> Why is the entire vendor directory in github? I'm fairly certain some of those packages cannot be redistributed like that.

<comment><USER7> Agree. What is the point of using composer or any dependency manager if you check-in the vendor folder?

<comment><USER8> Because your project is useless when a dependency is removed in the future. It happened to me one time and now I'm really considering to include the vendor folder in my own repository.

Of course a dependency manager is still very useful to setup a new project.

</comment></comment></comment><comment><USER9> Wouldn't a minimalist implementation just look up shortened URLs in a map and spit out a redirect to the original URL? Seems like that could be done in a few KiB.

<comment><USER10> TBH, You can pretty much do a single PHP file, with no dependencies, and without mod_rewrite. Just site.com/?fDS- for example, and it redirects. Storage can be MySQL or some other DB or even a flat file with locking.

</comment></comment><comment><USER11> URL Shortener in 43 lines of Haskell.

[http://bitemyapp.com/posts/2014-08-22-url-shortener-in- haske...](http://bitemyapp.com/posts/2014-08-22-url-shortener-in-haskell.html)

</comment><comment><USER12> Congratulations on the release but I can just discourage people to use URL shorteners. They obfuscate key information, are potentially a security risk as a result, require extra http requests and what happens in the future when you turn the service off? A trend I've never fancied.

<comment><USER13> On the other hand if you're linking to something you don't control and you need to track stats then use branded URL shorteners.

Sometimes there are valid use cases for things.

</comment></comment><comment><USER14> I'm always amazed to see minimalist used to describe a dozen placeholder directories and files. That said, the code is clean and modern php.

<comment><AUTHOR> Minimalist in regards to its design, perhaps not the code structure :)

In contrast to other projects such as YOURLS, Polr tries to be minimalist by avoiding heavy graphs or unnecessary bloat.

<comment><USER15> The structure is good. You can read what's happening clearly. It also shows what's a laravel idiom and what is modern php. I giggled a bit when reading the user factory code. It feels so enterprise. Not a bad thing in itself. I was just happy to see php code that is not a ball of mud held together by holy water. :)

<comment><AUTHOR> Haha, I totally agree. Reminds me of this: [http://www.willa.me/2013/11/the- six-most-common-species-of-c...](http://www.willa.me/2013/11/the-six-most- common-species-of-code.html)

<comment><USER15> I hope to one day be able to code like the cat. :)

</comment></comment></comment></comment></comment><comment><USER16> Good on you for making it, but I have to side with the comments here that it's not only not lightweight, I personally also can't see what's so modern about it - I'm not hating on PHP but even as a language that's an old beast.

</comment><comment><USER17> Serious question: Is URL shortening still a thing? What are the use cases?

<comment><USER13> Tracking stats when you're linking to something you don't control

</comment></comment><comment><USER18> Nice that's it's in php/MySQL so it works anywhere.</comment>


Green threads explained in 200 lines of Rust - <AUTHOR> https://cfsamson.gitbook.io/green-threads-explained-in-200-lines-of-rust/ <comment><USER2> Co-routines are very useful and likely underused, but sometimes you are actually better off being able to pass the control to a given thread directly, other than having a scheduler involved.

Anecdote: almost a decade ago, I was responsible for an NVMe-like implementation (hard- and software). The 3rd version of the firmware recognized the various components as threads, but there was no need for preemption (which would require expensive locking). Traditional scheduling would work, but you actually know exactly which thread should execute next (hardware will signal done), so an explicit yield_to() was far cheaper and only slightly more expensive than a function call.

<comment><USER3> If you have any knowledge of it, what are your thoughts about the Erlang scheduler & Erlang's concurrency model?

<comment><USER2> Funny enough we actually started prototyping with Erlang for subsequent project (which was cancelled before it went far). Unfortunately I don't know enough to know what's special about the Erlang scheduler (if anything), but as I understand the Erlang concurrency model, it's mostly about not sharing memory (forces explicit communication). That's obviously going to eliminate a host of bugs, but it would have been way too expensive for the mentioned firmware.

Once we got started with Erlang I was pretty turned off. The pretty examples you see in tutorials aren't what you'll be using. Instead it's framework upon framework, far from elegance IMO. I was happy to not have to deal with that again. Today I'd probably choose Rust for the same task (static types FTW).

(EDIT: typos)

<comment><USER3> Given that Erlang is sufficiently different from anything else I've seen, it doesn't surprise me that trying to be productive in Erlang before you knew it well enough was suboptimal experience. I like it, and more specifically Elixir, quite a bit, but the learning curve was steep.

<comment><USER4> It's fair to say Erlang's strength or appeal is not the language itself but the platform you instruct with it. That's also where the learning curve is.

</comment></comment></comment></comment></comment><comment><USER5> I feel like "200 lines of Rust" is a little misleading considering how much explaination there is. It's like saying you can learn all of string theory in 0 lines of Python.

<comment><USER6> it seems like in every post there's a naysayer about something. you're complaining about an article that explains a difficult topic extensively and generously - in my day you had to pay really really good money for that. who cares if the title focuses one aspect of the explanation? sure it's a little deceptive but it's such a minor cost to you that you literally spent more time complaining than they deceived you out (click link with false notion, see length, close page). LPT: being critical in and of itself does not make you look smart.

</comment></comment><comment><USER7> Part of the code is:

        unsafe {
            std::ptr::write(stack_ptr.offset(SSIZE - 16) as *mut u64, hello as u64);
            ctx.rsp = stack_ptr.offset(SSIZE - 16) as u64;
            gt_switch(&mut ctx, &mut n);
        }

Only the last line should be unsafe — the first line appears to be writing in bounds to a Vec, which is easy (and much more readable) in safe Rust.

Linux used to do its actual context switch in C with inline asm, and it changed to being in straight asm a while back. This was absolutely a win. Rather than trying to make everything work out behind the compiler's back, it's much more straightforward to write a function in asm that does the stack switch.

<comment><USER8> The ptr::write is needed because the stack vector contains bytes and the code wants to do a pointer cast and write a u64. It could be done in safe Rust with u64::to_ne_bytes and a copy_from_slice or something like that, but since all of this code is extravagantly unsafe anyway, I think it's reasonably clear to Just Do It :)

</comment></comment><comment><USER9> Isn't one downside that the inline assembly will not be peephole-optimized by the code generator (LLVM)? E.g., you'd be saving and restoring registers that are not even used.

<comment><USER10> Not really.

You potentially don't know who is "resuming", and so don't know what registers they will clobber. It would only be a "downside" if 1) your code uses a register 2) no other possible green threads do, and that isn't an invariant any compiler I know will promise, especially in the face of FFI calls.

If you're at the point where you want to do register allocation and spilling optimization across multitasking points, you're probably better off writing your own compiler instead of expecting a thread runtime to do it for you.

For comparison, _normal_ threads have the same downside: the kernel saves and restores all registers (even more than what the example does), so you're not doing any worse than that.

</comment></comment><comment><USER11> FWIW, there is POSIX-specified functionality (swapcontext and friends) for changing the user thread context: [http://pubs.opengroup.org/onlinepubs/009695399/functions/swa...](http://pubs.opengroup.org/onlinepubs/009695399/functions/swapcontext.html)

<comment><USER12> It's very slow though, at least if you believe the Boost docs. They have various context-controlling types. One of them is called ucontext_t, and falls back to ucontext. Then there's fcontext_t, which is basically a more advanced version of this article. Boost's docs claim it is much faster than ucontext.

</comment></comment><comment><USER13> [https://github.com/dlang/druntime/blob/v2.086.0/src/core/thr...](https://github.com/dlang/druntime/blob/v2.086.0/src/core/thread.d#L4071)

D's implementation ^ (Linked partly because the inline assembly is very clear)

</comment><comment><USER14> Great explanation! Although I have to wonder, why did the author choose to use Rust for this project? As far as I can see, it didn't really use any of Rust's advanced features not available in C or C++, like tagged unions, pattern matching, advanced type system, traits, borrow checking…

For what it's worth, I translated the whole code into C++. And it's essentially the same: [https://gist.github.com/kccqzy/c404b8614f39f854f137dcc9284b0...](https://gist.github.com/kccqzy/c404b8614f39f854f137dcc9284b0b87) And it runs correctly on macOS and Linux when compiled with clang.

<comment><USER15> Why would one pick C or C++ over Rust for this project?

<comment><USER16> Much easier to build, for me at least.

I tried installing Rust and building the example, but then it complained about nightly features, and I didn't have time to figure that out.

C/C++ are mainstream languages, and building is as simple as g++ test.cpp.

<comment><USER17> Using nightly features is as simple as inserting +nightly as the first argument to rustc or cargo (assuming rust was installed with rustup, which is the default way to install it).

So in this case, it's just `rustc +nightly green_threads.rs`

</comment></comment></comment></comment><comment><USER18> The explanation of the asm! macro is great, I've always been a little confused by it.

It does make me thinking about how this could be useful in the context of Futures and async/await.

<comment><USER19> > It does make me thinking about how this could be useful in the context of > Futures and async/await.

At its core, when you pass a Future (really, a chain of futures, but in the end that's still a Future) to an executor, the executor creates a stack for it. An executor with multiple futures will then switch between them, sorta similar to the code seen here. The details depend on the exact executor, of course, but the fundamental idea is the same.

One of the nice things about the futures design is that you can know exactly how big the stack needs to be, so the resizing stuff isn't an issue.

<comment><USER20> The long term plan for this was/is to actually connect them to futures and the async story in rust, adapting this to be an executor and implementing our own futures (though I probably have to implement a simple reactor and fake some IO operation in e seperate thread as well). However, it's quite a bit of rework and better to seperate this in two parts, but I feel it could be a good way to build brick by brick towards a pretty good understanding for those interested.

</comment></comment></comment><comment><USER21> Beautiful docs

</comment><comment><USER22> Now that there is a lot more interest in green threads, I was wondering if anybody knows why back in the days Java dropped the support of green thread in favor of native thread?

</comment><comment><USER23> Daily reminder that goroutines don't require a context switch.

<comment><USER19> A _kernel_ context switch. Neither do the ones described here.</comment></comment>


Experts Say Humans Can Live to 1,000 - <AUTHOR> http://www.dailygalaxy.com/my_weblog/2008/11/can-humans-live.html

<comment><USER2> This is not really surprising: they already did so some couple thousands year back in history.

Side note, if you don't believe it: all cultures in past had the vision of a perfect world in the beginning of human history, and a continuous growth of evil since then.

Only a few centuries back, some humans invented the "homo sapiens" theory...</comment>


Here's a billion dollar idea for an app - <AUTHOR> http://local-guide.tumblr.com/post/26401821211/location-based-q-a-is-the-future

<comment><USER2> Nice idea...especially what is happening around here...does twitter / news trends partly your question...but its not in one place!

</comment><comment><USER3> Siri?

Judging by reviews of the latest Android, that's getting there too.</comment>


Matthew Prince: CloudFlare Was Inspired by Project Honeypot and the DHS - <AUTHOR> https://www.law.uchicago.edu/news/matthew-prince-00-discusses-cloudflare-cloud-computing-journal <comment><USER2> And ironically, when I try to read "the rest of the interview" I get an Error 520 page … from Cloudflare.</comment>


Looking for Tech Co Founder East Bay CA - <AUTHOR> I am in the Concord area and looking to talk through a number of ideas, prototypes I have and the like with someone more technical than I am or at least as technical. The ultimate goal is building and distributing some great stuff via a great team.
Being close by would be great, but distance isn't a deal breaker as virtual can work very well too.
The hope is to find a good fit individual or two to hack around with to find a big idea.
I am most interested in non-conventional business models, as opposed to the VC route. I do love Peter Thiel's ideas of leverage.
I have done this stuff for years and have been fortunate enough to no longer need to chase a paycheck anymore. That said, I have better ideas, experience and more interest than ever before in smart, important and clever outlier hacks.
Thanks, and let me know if you are interested. <comment><USER2> Are you sure this is what you should be looking for?

 _The hope is to find a good fit individual or two to hack around with to find a big idea._

You'd do well to look for a good fit individual or two to work with long term. But not as well to look for a big idea. People are more important than ideas. What will you do if (when) the idea changes? Break up? Considering how hard it is for people to attune themselves to each other, finding people you want to work with is the problem you have to "solve" first anyway.

Stop consciously trying to look for ideas. You are better off following a passive route of not ignoring discomfort when your subconscious brings it to your attention.

<comment><AUTHOR> Thanks for the feedback. Not the best phrase I guess.

I also agree that good fit in a team is critical and couldn't agree more with your notion of the subconscious coming up with most of the breakthrough ideas. I rely on that heavily using interest, frustration and tinkering as the guideposts, figuring out the right question and then doing something else or nothing at all and letting the big part of the mind do its thing in its own time. Might be the best habit I ever developed.

</comment></comment><comment><USER3> Maybe we need a monthly networking thread on HN. A place to talk about what you are working on, what you need, who you are looking for.

</comment><comment><USER4> It would be helpful to know how technical you are and at least something about the ideas and prototypes that you have.

</comment><comment><AUTHOR> Just to clarify - for me the San Francisco East Bay Concord area includes Walnut Creek, Pleasant Hill, Alamo, Martinez, Pittsburgh, Antioch, Danville, San Ramon, Dublin, Oakland, Berkeley and the like. Silicon Valley, San Jose, Marin County tend to be too far to make it work well.

</comment><comment><USER5> You might want to put contact info someplace, most people put it in their HN profile.

<comment><AUTHOR> Thanks. I updated the summary on my profile and included my email and some of the details suggested in other comments as well (didn't realize it was hidden).

</comment></comment><comment><USER6> How do I contact you?

</comment><comment><AUTHOR> Ah. Thanks, Jeff

</comment><comment><USER7> email address?

</comment><comment><USER8> craigslist.

<comment><AUTHOR> Yep. I certainly have tried Craigslist for such, but it does not compare with this audience IMHO.</comment></comment>


Ask HN: How horrible is the SF to Silicon Valley commute? - <AUTHOR>

I just moved to SF from NYC for a bit. I commute to Mountain View each day. I'm not willing to live in the Valley, and it seems lots of other people living in SF feel the same way.<p>Does the commute influence your decisions on where to work? Why don't companies have offices in SF? I can't believe they think it's a good idea for employees to lose 2-3 hours every day in this way. <comment><USER2> SF is notoriously anti-business and the center-of-mass of Silicon Valley is probably somewhere between Palo Alto and San Jose (depending on the sector) which is why businesses have offices on the pennisula and not SF. Also, costs are much cheaper outside of SF. Its not your company's fault if you choose to live in SF and commute.

</comment><comment><USER3> The commute is horrible, whether by car or Caltrans.

Many firms locate down in the heart of the valley for many reasons including that office space is considerably less expensive, infrastructure is theoretically somewhat more robust, traditionally the biggest money firms are down there, many of the firms down there are related by chains of nepotism, there are fewer "distractions" for workers in those boring areas, executives can afford more posh places down there, ....

The valley proper, back when I worked there, had all the elements of an old- school company town: easy for workers to move into, hard to move out; collusive hiring practices across firms; not much to do beside eat, work, sleep, and pay rent; even its own set of camp-follower brothels. It's an ugly, horrible environment and you're darn right it influences the decisions of some to simply not work there.

<comment><USER4> Just to present an alternate viewpoint: I live in Palo Alto and actually like it! At least for me it's hard to think of a place where I am free to set my own schedule, choose my own office, leave whenever I want, enjoy gorgeous weather, and visit friends at Stanford in the same way that you'd think of a 19th-century company town.

<comment><USER5> Palo Alto doesn't quite count; it was a town first and then Silicon Valley grew around it. Palo Alto is the best part of Silicon Valley and has the most expensive rents to go along with that.

</comment></comment></comment><comment><USER6> Your question is a little bit weird -- you're asking how horrible your own commute is? Or are you asking why more companies don't have SF offices?

For the latter, it seems obvious that real estate and infrastructure are cheaper in the Valley.

For the former, it really depends on where you live in SF.

If you are driving a car to the Valley, how far are you from the 280 or 101? Does your employer allow you to work your schedule around the rush hours? Are you working for a startup where you are expected to put in long hours and possibly even spend a lot of time with coworkers outside of the office?

If you are taking CalTrain, how far are you from the nearest station? I lived in the Sunset for several years and commuted to Palo Alto; it was a bit maddening, mostly due to the long time it took to ride MUNI to CalTrain. Door- to-door was around 100 minutes, but it was 100x less stressful than driving. Plus, I could catch up on news/email on the train. On the rare days that I'd drive in, I'd arrive at work already feeling beaten down.

While it's true that there's plenty of cool stuff going on in the Redwood City-Sunnyvale corridor, I still prefer life in SF. I'll speculate that you'll hear a lot of startup-centric people here bagging on it, but to each his own.

</comment><comment><USER7> I commuted to Google for 4 years. Even with the bus it was tough. I was the same though, living in the valley is not really an option, and I'm glad I didn't.

Some advice:

\- live as close as possible to the highway or caltrain. this means soma, potrero, the mission, or noe valley.

\- negotiate at least 1 work from home day. friday is the best. (although wednesdays are usually easiest to ask for first)

\- work off peak.

It's possible to get your average commute to about 45 minutes, which isn't so bad (still gets old though).

</comment><comment><USER8> At least two companies in the South Bay (Google, Yahoo) hire daily shuttles for employees living in San Francisco, and most offer some form of compensation for those who take public transportation. Are you really _losing_ 2-3 hours when you could be processing email on your smartphone, or reading the news and social updates that you would otherwise dick around with during the workday?

</comment><comment><USER9> > Why don't companies have offices in SF?

Some do. Perhaps you should ask your company why it doesn't. Or maybe you should work for one that does. Or even work for an SF-based company.

> I can't believe they think it's a good idea for employees to lose 2-3 hours > every day in this way.

What fraction of your co-workers commute from SF?

</comment><comment><USER10> If you live near Soma or Potrero Hill the commute to Mountain View is often faster than the commute to the other side of San Francisco.

</comment><comment><USER11> Out of curiosity, what's it like on/from the east side of the Bay? I have a standing invitation to be a roommate in the Concord area. BART to downtown I'm familiar with, but I don't know what to expect if I have to head south.</comment>


OpenID 2.0 for Google Accounts is going away - <AUTHOR> https://support.google.com/accounts/answer/6135882 <comment><USER2> I must say, having switched from Google OpenID 2.0 to Google OAuth2.0 for authentication on our site I raised an eyebrow when I belatedly read on Homakov's 2013 blog[1] that OAuth2.0 was never intended for authentication, only authorization for certain discrete resources. At least with Stack Exchange doing it I'm in good company, but - if Egor is correct - it raises the question what's really a good choice for authentication nowadays.

[1] [http://homakov.blogspot.com/2013/03/oauth1-oauth2-oauth.html](http://homakov.blogspot.com/2013/03/oauth1-oauth2-oauth.html)

<comment><USER3> Mozilla Persona is the right approach to authentication. Unfortunately, Mozilla sucks more at marketing than Microsoft did in the late 90s and Persona got near null interest from developers that weren't already concerned by the very real dangers of OAuth and the uprise of Facebook/Twitter authentication.

Persona is still there. It's still maintained, despite getting no funding, but that doesn't mean developers can't pick it up. If you are interested in authentication, learn about it. Implement it. Support it. Convert people.

[https://www.mozilla.org/en-US/persona/](https://www.mozilla.org/en- US/persona/) [https://developer.mozilla.org/en- US/Persona](https://developer.mozilla.org/en-US/Persona)

<comment><USER4> Plus, if you use Persona, your users get automatic Google OpenID Connect (and others).

<comment><USER5> Howso?

</comment></comment></comment></comment><comment><USER6> OpenID, OAuth, and the like have just made things more confusing for both devs and users alike, IMHO. Wasn't it supposed to "unify" things and make it easier and safer for everyone?

For example:

\- a site might offer to login via Facebook, but I'm afraid to in case my friends' Facebook news feeds get spammed.

\- I want to offer an easy login for my users, but which OAuth provider do I pick? Which OAuth, OpenId _thing_ am I supposed to use? They all look the same! But different!

</comment><comment><USER7> We used OpenID 2.0 for our internal auth system to provide SSO across domain names and we just finished implementing OpenID Connect. I can't even begin to describe how much of a difference there is between the two, OpenID Connect is completely painless while OpenID 2.0 fought us every single week.

Can't wait to migrate everything over to Connect instead.

</comment><comment><USER8> According to the page at [https://developers.google.com/accounts/docs/OpenID#shutdown-...](https://developers.google.com/accounts/docs/OpenID#shutdown- timetable), the first user-visible warnings appeared in November 2014 (unless disabled by the site operator). 6 months is not an unreasonable timeline to make some minor adjustments to your auth system to make it OpenID Connect compatible (from a quick glance at the migration page, it basically required adjusting the auth URL and adding a few extra params).

<comment> vertex-four OpenID Connect is an entirely separate protocol from OpenID 2.0. Essentially, it's an extension of OAuth2, which is difficult to implement correctly on your own. Libraries are available for most languages for it, though.

<comment><USER9> OAuth 2 is not difficult to implement as a consumer.

<comment><USER10> Have you read the specs? Getting it "working" is trivial, but to guarantee security there are a lot of considerations and checks you must or should do that are easily overlooked.

<comment><USER9> Pretty much all of the security considerations are factors for the provider and not the consumer. Consumers should use validated TLS and encrypted storage, but beyond that consumers have more to worry about keeping their own application secure.

</comment></comment></comment></comment></comment><comment><USER11> So this seems to affect… a lot of services. I'm surprised it's not getting more coverage. Unless this message appears when it doesn't need to, a massive number of prominent services rely on this, such as StackOverflow (if you attach it to a google account obv.).

<comment><USER12> Stack Overflow has already addressed this issue: [http://meta.stackexchange.com/q/244367/61654](http://meta.stackexchange.com/q/244367/61654).

<comment><USER11> Oh I see, it comes up for me because I specifically use OpenID through my domain. That's just my problem then.</comment></comment></comment>


Steps to Navier-Stokes in Python - <AUTHOR> http://nbviewer.ipython.org/github/barbagroup/CFDPython/blob/master/lessons/01_Step_1.ipynb

<comment><USER2> I'm a big fan of the style used here, specifically the extra CSS on top of default IPython notebooks. If you're curious, like me, as to where the special styling is coming from – take a look at the last cell of the notebook. It imports some custom CSS into the notebook by reading it from a file, and this gets carried over to nbviewer since the output is stored in the notebook.</comment>


Dynamic Typing and Nan Boxing - <AUTHOR> https://leonardschuetz.ch/blog/200908_nanboxing <comment><AUTHOR> I wrote this article to give other people an introduction to NaN-boxing. Please let me know what you think!</comment>


Ask HN: Javascript Key Mapping Plugin - <AUTHOR>

Hey Guys
There was a plugin (jQuery) released on HN a couple of days which made it extremely easy to map keyboard characters to functions etc. Unfortunately I can't seem to find the plugin. I'll be really grateful if someone can point me if  he/she has the link to the plugin I'm referring to.
Thanks a lot! <comment><USER2> I don't know if it was this one, but it's dead simple to use: <https://github.com/OscarGodson/jKey>

</comment><comment><USER3> Wasn't it Shortcut.js? <http://www.mattytemple.com/projects/shortcut-js/>

</comment><comment><USER4> Probably this one:

<https://github.com/madrobby/keymaster></comment>


There's No Such Thing As 'Natural' Search Results ... - <AUTHOR> http://www.techdirt.com/articles/20110921/12515116041/theres-no-such-thing-as-natural-search-results-search-results-are-inherently-biased.shtml <comment><USER2> I think the Senators have a problem with Google's size because they analogize it to other corporations of the 19th and 20th centuries whose size went with considerable power. Google does have plenty of influence, but it does not have the kind of legal power through capital ownership an old-time vertically integrated conglomerate had or that a telecommunications company often has now.

Migrating from Google to another service, or suite of them, wouldn't be terribly difficult, especially since they seem to be fairly good about data portability.</comment>


PayPal exec aims to "obliterate passwords from the face of the planet" - <AUTHOR> http://arstechnica.com/information-technology/2013/05/paypal-exec-aims-to-obliterate-passwords-from-the-face-of-the-planet/ <comment><USER2> Forget CISPA and such, I'd say that initiatives like this are the biggest threat to internet freedom and anonymity.

Unless burner phones become available that support FIDO protocols and that can be purchased for cash, this idea will make "Login with Facebook" seem like child's play by comparison.

<comment><USER3> (Shrug) The fact is, passwords suck. They need to go away. How would _you_ fix them?

<comment><USER4> Please give some reasoning along with your claim.

In what way do they suck, in which cases? Do they really need to stop being used?

I'm not just being pedantic. I just haven't had any problems with the concept of passwords as a security measure. Many implementations are flawed, but that is a different manner.

</comment></comment></comment><comment><USER5> Using Smart-cards for authentication is a great idea. The problem of this is that you could be forced to have a unified identity across all accounts. This has potential privacy and blacklisting implications.

David Chaum knew this all in 1980 and proposed a great solution: Allow each user to keep a database of pseudonymous identifiers such that one is associated with each organization will be automatically presented when needing to authenticate.

"Security without Identification Card Computers to make Big Brother Obsolete": [http://www.chaum.com/articles/Security_Wthout_Identification...](http://www.chaum.com/articles/Security_Wthout_Identification.htm)

Edit: It should also be noted that if you use multiple pseudoanymous identities no PKI is necessary which solves a major MITM and infrastructure problem. You simply link a public key to your paypal/gmail/whatever account upon creation. Only paypal/gmail/ needs to know about that mapping.

</comment><comment><USER6> Ughhh... Biometrics (fingerprints, eye scans, etc...) are not secrets.

This is the umpteenth iteration of a bad idea.

<comment><USER7> This. Bruce Schneier's extended version: <http://www.schneier.com/essay-019.html>

<comment><USER6> Thanks for the link. Can't imagine how I missed this.

</comment></comment></comment><comment><USER8> I might be too late to jump in here, but here are my thoughts on TwoFactor authentication using "unique"* biometrics.

If I scan my fingerprint in to authenticate or scan my retina, on a device that knows my physical location, that is a more literal check-in than anything that exists today. Essentially a check-in would have near absolute certainty that the actual person authenticating was at that place at that time.

That's scary to me; one may have a GPS on their phone today, but that's the phones identity, not the owners. If one signs ones credit cards with a thumb print or a retina scan, one is proving beyond any shadow of a doubt that one was present at that place at that time.

This may or may not be something one wants and one should be conscious of the realities of biometric authentication.

*Just because no one has presented a copy of a retina that can pass a retina scan does not mean one does not exist.

<comment><USER9> _> That's scary to me; one is proving beyond any shadow of a doubt that one was present at that place at that time._

To some, I imagine they feel could the opposite: Reassurance against wrongful accusations of crimes not committed.

</comment></comment><comment><USER10>
        The so-called "Internet of things" adds another wrinkle. Barrett talked about
        development of refrigerators that can sense what food is inside them and
        automatically order replacement groceries. Perhaps such technology will be
        commonplace in a few years—and your refrigerator will need a way to pay for food.

        "It begs the question, do you really want your refrigerator to know your PayPal
        password?" Barrett said. "Unless we can solve that problem, life is not going to
        be good."

This is a problem that has already been solved. You create an authentication system that supports different privilege levels. You create a secret key for your fridge on a secure device (after authentication with your _password_ ). You then transfer this custom-made secret key to your fridge which gives it the privilege to spend no more than X amount on groceries to a small list of trusted vendors.

The biometric solution discussed in the article doesn't even solve this problem. Do you really want your fridge to store your fingerprint or retina data?

The part I have a hard time understanding: even if you register your phone as a trusted device and scan your fingerprint on your phone to log in to paypal, all your phone is doing is sending a secret key to paypal's servers (where's it's presumably hashed and stored).

How does that solve the problems the article identifies?

        "Left to their devices users will pick horrible passwords and then they'll
        reuse them all over the place," Barrett said.

        Various data breaches have exposed millions of user IDs and passwords.
        While passwords are typically exposed in an obscured or "hashed" form,
        increasingly powerful processors and password cracking programs allow
        even novice hackers to convert them into plain text

Biometrics _forces_ you to use the same secrets to authenticate yourself with every service, and if weak security allows an attacker to reveal the "plaintext" equivalent of your fingerprint or retina scan, you're _fucked_.

Any system that's used to increase the security, entropy or uniqueness of your biometrics for each site you register with could equally be used to protect a single, strong master password instead. At least you could change that if it somehow got hacked.

</comment><comment><USER11> > A USB stick loaded with FIDO software could also work, allowing users to > authenticate to computers they don't own.

Much easier. Malware will just switch to stealing those instead.

<comment><USER12> If it's a custom made stick, and not just some dumb mass-storage, it could do the crypto authentication in the stick itself, without ever copying the private key to the main device. It's basically how smartcards work.

<comment><USER11> So a Yubikey then.

<comment><USER13> They are a part of FIDO.

</comment></comment></comment></comment><comment><USER14> Sounds like the person who's sitting next to me in the coffee shop will be able to log in to my bank if he loads the web page faster than I do.

</comment><comment><USER15> When I was at IronKey, we had the same sort of idea -- add security via two factor authentication. That second factor? A physical token, in this case a USB drive w/ on board crypto chip (think USB drive as a smartcard).

That pretty much went not too far.

Anything that requires you to carry an additional device is doomed to failure.

<comment><USER16> What the problem with the physical token the cost, the configuration, or just lazy users?

</comment></comment><comment><USER17> If they do this in an open way, it will be one of the best changes for the Internet in a long time. If it is done I. A closed way, a great force for evil. Devil is in the details for sure.

Something g which lets users delegate their security to some kind of sent, and then authenticate to it with various challenges (including biometrics), and allows a cooperative s unity policy between users and administrators (where each action has a different risk profile, so sending money to a pre approved account is low auth required vs something like changing your auth credentials...) is the solution. Not sure if this is it.

</comment><comment><USER18> So now the problem has been reduced to any one of n biometric data, that you can NEVER change? That seems lovely.

<comment><USER19> There are a certain class of biometrics called "Revocable biometrics." You combine the biometric data with a password, and you can revoke it by merely forgetting a password.

</comment></comment><comment><USER20> <http://fidoalliance.org/>

Looks worryingly "closed".

<comment><USER21> Oh wow, I think they might be colour blind.

<http://i.imgur.com/EQCRE5P.png>

</comment></comment><comment><USER22> Why would you want your phone to be the key to your most secure data?

Also from what I've seen in the past most finger print scanning and cheap, "organic" identity verification tech is not reliable and easily circumvented.

Despite not being perfect, basic password authenication (or even better- pass- phrase) is a security mechanism that's easily understood, easy to implement and can be pretty secure.

(Although still possible to do badly/incorrectly as we keep seeing).

<comment><USER23> Not just that, but in lesser-developed countries biometric identification can be dangerous. If you get mugged for your ATM card, you can tell them your PIN and they'll let you go, free to repeatedly use your card until you freeze it. But if you need a fingerprint to authenticate, they're going to let you go too, and maybe with one less finger.

Not really a concern in America, but in other places like Mexico, Latin America, India, Asia...

<comment><USER18> > Not really a concern in America, but in other places like Mexico, Latin > America, India, Asia...

Well it would be if biometrics became widespread.

<comment><USER19> India's uID project has the biometrics and identity information of over 327 million civilians. This means they've reached about a third of their goal of creating a nation-wide identity and biometrics database.

[https://en.wikipedia.org/wiki/Unique_Identification_Authorit...](https://en.wikipedia.org/wiki/Unique_Identification_Authority_of_India)

</comment></comment></comment></comment><comment><USER24> Well, a "PayPal exec". I think we can skip reading this article :)

</comment><comment><USER25> This is just what we need. Idiots from Paypal shaping the interwebs.

<comment><USER26> Rumor has it that if someone gets offended at a post you wrote online and reports you, PayPal will freeze all of your online accounts in one fell swoop.

<comment><USER27> Fell indeed.</comment></comment></comment>


A Software Guy's Look at Electric Bicycles - <AUTHOR> http://www.osnews.com/story/25007/A_Software_Guy_s_Look_at_Electric_Bicycles

<comment><USER2> Power-assisted bicycles have been a solved problem since 1946. The answer is a small petrol engine, most ideally realised in the Velosolex. A 50cc engine weighs no more than a 400w hub motor and speed controller, but provides several times more power. A kilo of petrol holds 65 times more useful energy than a kilo of lithium-ion batteries.

While European law exempts low-powered electric cycles from regulation as a motor vehicle, the motor may not operate above 25km/h, rendering them minimally useful for all but the most infirm of cyclists. Most US states regulate electrically assisted bicycles as mopeds, conferring no advantage to electrical power.

The electric bicycle is a solution looking for a problem.</comment>


A Better Limit Order for Trading Bitcoin - <AUTHOR> https://blog.sfox.com/introducing-tortoise-a-better-limit-order-92d77be0b9e7 <comment><USER2> Pricing seems pretty lol for something claiming to market itself to hf traders.</comment>


Pete Flint (Trulia, LastMinute) joins NFX Guild to power accelerator's growth - <AUTHOR> https://medium.com/@peteflint/why-im-joining-nfx-guild-d73112d9c162#.5rpd5iloa <comment><USER2> For those just hearing about NFX, it's a pretty fascinating team/story.

James Currier and the NFX team run an accelerator that is basically an expert level boot-camp for teams specifically focused on Networks, Marketplaces (and now, other verticals).

The team was way ahead of the inherent value of 'marketplace' & 'network' focused teams, and I would highly recommend them as a resource to any young to mid-stage team focused on marketplaces/networks/etc. (Note - they are industry agnostic, focus specific). Very founder friendly, and good folks.

Also, I'm happy to answer questions for any founders looking for help developing a marketplace/network.

(Full Disclosure - our team was in the first batch of the program.)

</comment><comment><USER3> Makes me really proud to be a lifetime member of NFX! Great addition to the program. I'm jealous of the fall batch of startups! Pete is a great mentor</comment>


How I Wrote a Search Engine in 6 Weeks - <AUTHOR> http://www.embought.com/blog/show/5?t=How-I-Wrote-a-Search-Engine-in-6-Weeks

<comment><USER2> I will suggest that you read the article again and revise your judgement. This is why.

I founded a search engine (web, images, video and business search) now in Alpha, with limited resources as well; trust me I know how hard it is.

Simple questions, how good is your crawler? (You shouldn't implement a scheme for each web site, though I understand for your business it kinda make sense)

How much information do you have in your repository? (You should consider data in TB if not you are still far from any trouble) Ferret is a great indexing tool but how much data can it index? How scalable is it? Looking at the tech behind Ferret, how much resource does it use? How good is your relevancy model? (This question is tightly link to your indexing)

I loved your idea, Just one thing: work on the relevancy again; I searched for 'ruby on rails' and got 'ruby' only related results first the <relevant ones> after. Also I will suggest you cache images to enhance user experience. Please don't take my review personal.

<comment><AUTHOR> That's good advice. I'll admit the scaling aspects of Ferret, and Rails at this point, scare me quite a bit. My goal right now is to continue to expand my index and learn what's working and what's not.

As was mentioned in another comment I'm looking into other, more long term, indexing solutions (possibly SOLR), so hopefully that will help in the relevancy area. I'm also working on an in-house ranking algo to better sort results.

I appreciate your feedback.

</comment></comment><comment><USER3> 6 weeks? Why so long? - (just kidding) I am building a search engine as my current project. It took all of a weekend to get it up and running. I didn't do it alone my friend helped so I guess maybe that doesn't count ;) We've been crawling for a little under 3 weeks and I keep making interface and search- results tweaks but otherwise it works "ok". I am in the process of switching it over to S3 (maybe EC2) - after that change I think I'll open it up to the public.

<comment><AUTHOR> Sounds cool. let me know when you launch I'd like to take a look.

</comment></comment><comment><USER4> Why do they use a cartoon of Ann Coulter as their logo?

<comment><AUTHOR> Haha. I hadn't ever looked at her like that.... now I may have to change it.

</comment></comment><comment><USER5> Thanks for sharing your experience.

For doing product search at the few-hundred-thousand-item scale, I would suggest SOLR rather than Nutch from the Lucene family.

You'd need to do your own crawling/scraping, but the indexing is solid, simple, and flexible. (SOLR's pedigree is from CNET's own product search.)

<comment><AUTHOR> Thanks for the info. I have looked at Solr and it looks great. I'll give it a try and write up my thoughts. [Edited to correct iPhone typing mistakes]

</comment></comment><comment><USER6>
      a. You wrote a crawler, not a search engine.
      b. Ferret will bite you in the ass.
      c. For a really good off the shelf crawler, look at Heretrix.

<comment><AUTHOR> Since you can go to www.embought.com and search for products I would have to say your wrong. If I had only written a crawler I would have a nice collection of webpages on my hard drive and nothing more. Why are you so down on Ferret? what problems have you had with it? Just making an off the cuff statement without facts to back it up doesn't make you look very credible.

<comment><USER7> Just on the Ferret side of things, it does have a pretty bad reputation in some circles. Google for "ferret "corrupted index"" .. there are 59 results alone just for that limited query.

I don't use Ferret myself (I tried it once; it seemed pretty good) but I'm very well read in the Ruby community (I run Ruby Inside and RubyFlow) and I've seen more than enough people saying bad things about Ferret, how it corrupted their indexes, concurrency issues, and what not, to personally avoid it. Solr and Sphinx seem to get a far better rap.

..

I should add that I had a play with your site after reading your article, and it's pretty good. There's a lot of trash out there in this field and you've pulled together a good site. Kudos.

<comment><AUTHOR> Thanks! I really like ruby inside as well, you have a lot of great info there.</comment></comment></comment></comment>


Delicious Founder Creates New People Search Engine, Skills.to - <AUTHOR> http://www.readwriteweb.com/archives/delicious_founder_creates_new_people_search_engine.php <comment><USER2> Bookmarking and tagging Twitter profiles instead of webpages. Delicious for Twitter profiles.</comment>


Ask Hackers: Are Firefox extensions secure? - <AUTHOR>

Could Firefox extensions access my passwords stored in Firefox? Are you using extensions working with your passwords ... to check your new mail by example? <comment><USER2> AFAIK they're not isolated, i.e. running with the same privileges as the rest of XUL code, including Firefox UI itself. In the realm of a browser, I can imagine quite evil XUL extensions.

I cannot tell anything about the level of isolation for XUL runtime itself though - i.e. how protected the rest of your computer is from XUL code.

</comment><comment><USER3> It's the same as installing any piece of software. So yes, they could.

</comment><comment><USER4> This is why I never save passwords : simply for the just in case possibility.</comment>


Show HN: CommonJS Based OCaml Development - <AUTHOR> https://github.com/jordwalke/CommonML

<comment><USER2> I really like some aspects of CommonJS/OCaml -- while digesting the whole thing, I've put together an `opam-boot` tool that does the standalone bootstrap so that you can build OCaml/OPAM applications without either OCaml or OPAM installed.

[https://github.com/avsm/opam-boot](https://github.com/avsm/opam-boot) (still unannounced and being debugging, but essentially working)

I'm liking the Merlin integration in CommonJS as well -- perhaps specialising it for js_of_ocaml applications would be one way to deploy it.

<comment> def-lkb Do you mean making Merlin works in a Js_of_ocaml environment?

I am not familiar with JS programming model, but I think it should be possible to turn Merlin into a worker and have synchronous loading of "cmi" files via some service (I don't want to do control inversion on the whole typechecker :)).</comment></comment>


Potato Salad Kickstarter Campaign Raises Over $53,000 - <AUTHOR> http://www.forbes.com/sites/johngreathouse/2014/07/08/potato-salad-kickstarter-campaign-raises-over-41000/

<comment><USER2> Currently at $44,000. Probably a typo in the title? Though a few suspect pledges have been removed, or cancelled, I think.

[https://www.kickstarter.com/projects/324283889/potato- salad](https://www.kickstarter.com/projects/324283889/potato-salad)

</comment><comment><USER3> Forbes is wrong about the food photo. Almost any photo of actual food is probably going to look a bit grim. There's a reason food photographers use boat varnish.</comment>


Google Waves Goodbye To MySQL In Favor Of MariaDB - <AUTHOR> http://readwrite.com/2013/09/14/google-waves-goodbye-to-mysql-in-favor-of-mariadb#awesm=~on7hpqtOWbGfkC

<comment><AUTHOR> "Revenge or no, this mass migration will definitely have a negative impact on Oracle's open source relational database." \- Brian Proffitt</comment>


Elizabeth Warren advocates for explainable AI to prevent perpetuating bias - <AUTHOR> https://www.bloomberg.com/news/articles/2019-11-14/elizabeth-warren-slams-goldman-over-apple-card-bias-allegations <comment><AUTHOR> Contrary to dramatic original headline, her quotes are less about Apple Card or Goldman, more a topical hook for "debate over the role of algorithms in consumer finance" and her platform on "issues tied to access to credit for consumers."

 _"We're all beginning to understand better that algorithms are only as good as the data that gets packed into them," Warren said. "And if a lot of discriminatory data gets packed in, in other words, if that's how the world works, and the algorithm is doing nothing but sucking out information about how the world works, then the discrimination is perpetuated."_

 _It's the company's responsibility to come forward with the information about how that algorithm was designed and the exact impact of it, she said. "And if they can't do it, then they need to pull it down."_

Interesting to think about a possible Warren administration Consumer Financial Protection Bureau (CFPB).</comment>


Show HN: OpenRent (YC Reject) launches today for online rentals in the UK. - <AUTHOR> http://www.openrent.co.uk

<comment><USER2> Really slick. Especially love the login window.

Getting landlords in requires a strategy beyond just being cheap. uPad, which does a significant portion, but not all, of what openrent will do charges £50-£100 and isn't really making a dent after a number of years and lots of advertising (not quite Outdoor advertising giants yet, but they haven't the margins to justify it either).

Also, leveraging Rightmove, good move.

What's the ultimate aim? Just being a 'better' agent?

<comment><AUTHOR> Thanks!

The ultimate aim is to be a better experience for both landlords and tenants, whatever that takes. We feel we have a feature set which makes the lives of tenants and landlords much safer and easier.

It's more than being a better agent, it's being a marketplace where rentals are made simple. Landlords don't _need_ a fully managed service in a lot of cases, and tenants are crying out for something better. There are a lot of pain points in the current system which we aim to remove.

I think by being a tech startup we have a few advantages, but clearly the biggest challenge is getting landlords on board with the concept. We will do our best in that regard, and hopefully one day, renting a property won't be such a painful experience!

</comment></comment><comment><AUTHOR> First off, thanks to the people who gave feedback discussing landing pages when I commented before [1]. Given the interest, thought I'd post it as as a "Show HN" story now we've launched!

Would love any HN feedback (good or bad!), on any aspect of the site/service.

And any landlords in the crowd, we'd love to hear from you! HN Landlords would be our ideal first customers!

[1] - <http://news.ycombinator.com/item?id=3878319></comment>


Metro Trains Melbourne – Legacy Train Control System Stabilization - <AUTHOR> http://www.equicon.de/index.php/en/virtualization/reference-projects/metro-trains-melbourne <comment><USER2> Link to PDF: [http://www.equicon.de/images/Virtualisierung/LegacyTrainCont...](http://www.equicon.de/images/Virtualisierung/LegacyTrainControlSystemStabilization.pdf)</comment>


Internet Compulsion Disorder: - <AUTHOR> http://www.theatlantic.com/health/archive/2011/12/internet-compulsion-disorder-should-we-include-it-in-the-dsm/249905/

<comment><USER2> "Over hundreds of thousands of years, our hunter-gather ancestors ate diets that were mostly vegetarian and low in fat, salt, and sugar"

Who do they think ate all the Pleistocene Megafauna? Hmm? Hmm?</comment>


Russian Elite Started Self-Testing Covid-19 Vaccine in April - <AUTHOR> https://www.bloomberg.com/news/articles/2020-07-20/russian-elite-got-experimental-covid-19-vaccine-from-april <comment><USER2> Very interesting. American Elite are often antivaxers and preppers while Russian Elite go out of their way to take new vaccines.</comment>


Why Your Tomato Has Zero Flavor - <AUTHOR> http://online.wsj.com/article/SB10001424052702304830704577494804105404584.html

<comment><USER2> Also probably because they've been chilled.

Many supermarkets, shops and people chill their tomatoes. That's a serious mistake, because it inactivates one of the major sources of flavour in the tomato.

That's why cold tomatoes generally taste crap.

<comment><USER3> Exactly the same with strawberries- chilled they lose a lot of the taste.

A lot of this can be worked around by going to farmer's markets/growing your own and picking traditional varieties which have been selected for taste over appearance.

</comment></comment><comment><USER4> Paywall...</comment>