HardenedBSD: Feature comparison vs other BSD distros - <AUTHOR> http://hardenedbsd.org/content/easy-feature-comparison <comment><USER2> The list is mostly the kind of tactical mitigations that get bypassed a lot by private individuals and academia. Clever people write one, clever people break one, rinse, repeat. The untested theory is that they would be really hard or impossible to bypass in combination. The kind of people that could test that have mostly been smashing things like Chrome or mobiles where there's enough users to justify their efforts in terms of fame, money, etc. The real mitigation here is obfuscation of using a platform hardly anyone uses that is also harder than average to target. Then, there's some benefits to the security measures used on top of it. Obfuscation is main reason attacks aren't attempted much, though.

A better list would start with design techniques and assurance activities that led to systems with few to no vulnerabilities during pentests by well-funded, knowledgeable attackers. That's on top of what survives in the field with lots of attention. In the 80's-90's, those techniques included precise specifications of behavior or security policy, ways of proving/testing that in the code, hierarchical layering with simple coding to facilitate analysis, small kernels with most code deprivileged, memory-safe languages where possible, verification that object code matches source w/ no compiler errors/subversions, partitioning GUI's/filesystems/networking limiting apps effects on each other, covert channel analysis of entire system, secure repo's containing these artifacts w/ secure transfer to users, and option to re-run the analyses or rebuild the kernel themselves for independent replication.

Each of these techniques found or prevented many vulnerabilities in systems they were applied to. They even became mandatory requirements under the first, security certification: the TCSEC. Trusted Xenix in 1990 used some of them for that reason. Unlike often-bypassed mitigations, each of these methods still work today. Some work even better due to tooling improvements. The BSD's are largely ignoring these methods to maintain legacy compatibility with insecure architecture, unsafe code, and configuration scripts that can be just as risky. Unsurprising given early attempts at applying strong methods to UNIX, like UCLA Secure UNIX, showed the UNIX design had covert channels and such built in. You couldn't fully secure a UNIX without breaking legacy compatibility in lots of ways on top of a significant performance hit from memory safety and context switching. Led high-security projects to just virtualize UNIX/Linux on top of secure, isolation kernel. Projects that are attempting to follow some of these lessons in low-privilege architecture or language use include GenodeOS, Muen separation kernel, seL4, JX OS, and ExpressOS for mobile. EROS was an interesting older one that added persistence on top of capability-based kernel.

I figure someone should mention the methods that stopped NSA's hackers in various evaluations since they're strangely not on the list.

<comment><USER3> If memory serves me right Tru64 was quite good regarding security mitigations in UNIX, but then Compaq got bought by HP and the product was killed.

</comment></comment><comment><USER4> I would advise taking any claims from HardenedBSD about HardenerBSD with a huge grain of salt. The main code author behind HBSD has a history of his patches to FreeBSD being rejected due to very poor implementation, coding errors, poor quality and not understanding OS and security features design and reasoning and not accepting their reviews and not listening to his peers. He is however very good at getting himself and HBSD a lot of PR attention for bold security claims, but has a very poor record when it comes to quality code.

This list is also not very accurate either: his ASLR patches to FreeBSD were rejected due to quality issues, then they were applied to HBSD. The lack of mark for base sandboxing is another one, where FreeBSD had Capsicum sandbox available for few years now and a lot of base is now Capsicum sandboxed, with more and more coming with every release. I could go on here, but that should give you the picture.

Take this advice with grain of salt as well - I'm a FreeBSD developer, so I might be biased.

<comment> yjftsjthsd-h Sounds a bit like the grsecurity situation on Linux; someone wants to patch the system to be more secure, but in a very specific way and with a tendency to break existing programs and with questionable code quality, leading to mainline refusing to merge their patches without major reworking, which leads to the developer making the patches their own thing while loudly proclaiming that the mainline is terrible and insecure.

</comment></comment><comment><USER5> I've never heard of HardenedBSD before. I thought OpenBSD was generally considered the best choice for serious security, but I'd be interesting in reading up more on how they compare. As someone that's not an expert on the subject, it would help to get some extra info that explains why certain features are useful for improving security.

It's not clear that all these features impact real-world security, but maybe I'm just inexperienced and naive. For example, OpenBSD has "Most of base sandboxed", which seems like a huge deal to me. Knowing how many security issues we've seen in the last 10 to 20 years relating to each feature would help in understanding their impact a lot more.

Some immediate questions that popped up from clicking through their pages: Who uses this OS? There's a few company links, but I had a hard time figuring out what some of them even do. Maybe this is a really dumb question, but why FreeBSD over OpenBSD? Finally, are changes being upstreamed? Can we expect these improvements to eventually make it into FreeBSD?

<comment><USER6> Not only sandboxed, but many are _pledge(2)_ 'd now also.

One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe _syspatch(8)_ changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken)

Same with packages - unless you use mTier to get binary updates, security fixes and updates for packages need to be compiled yourself. Not the worst, but depends how much free time you have to keep on it.

FreeBSD has a larger ecosystem, and seems to be more performance oriented

<comment><USER7> > Not only sandboxed, but many are pledge(2)'d now also.

And here I was thinking that pledge(2) _was_ the sandbox. Did I miss something?

<comment><USER6> In a way, just not in the traditional filesystem sense; e.g., jail, chroot.

Pledge allows a program to 'promise' which calls it is expected to make. For example, a program promising only to use 'stdio', will SIGABORT if you try to open a socket, fork, exec, or anything not part of the stdio group (as defined by pledge)

[https://man.openbsd.org/pledge.2](https://man.openbsd.org/pledge.2)

</comment></comment></comment></comment><comment><USER8> That comparison doesn't seem to include OpenBSD's biggest security feature, their track record of robust code review, eliminating countless security bugs before they're ever exploited.

<comment><USER9> Track record of robust code review doesn't make as much difference as people like to believe. There is a great talk on ccc about this: [https://media.ccc.de/v/34c3-8968-are_all_bsds_created_equall...](https://media.ccc.de/v/34c3-8968-are_all_bsds_created_equally)

<comment><USER10> The video doesn't support your conclusion at all, quite the opposite.

<comment><USER9> His observation on code review was that it did help to find low hanging fruit kind of bugs (int overflows and signedness bugs), but that bugs were still easy to find in OpenBSD, even though he felt like the code quality was much better, than in other BSDs.

If you are just reading the slides, they are too out of context.

</comment></comment></comment></comment><comment><USER11> I have wanted for a long time to see some quantification of these security features, i.e. "What percentage of attacks does feature X prevent in the real world?" and "With all these features combined, how much longer can the OS survive attack vs without them?", but I don't think I've ever seen it.

</comment><comment><USER12> Random number generation, including arc4random() and /dev/*random:

      OpenBSD: ChaCha20
      FreeBSD: RC4
      NetBSD: NIST CTR_DRBG using AES-128
      HardenedBSD: ?
      Dragonfly BSD: xor of outputs ChaCha20 and IBAA

Also on OpenBSD, major 3rd party packages often come with security improvements. For example, nginx and Apache run chrooted, and Chrome is pledged.

I don't have the time to analyze privsep in base among the BSDs, but I can say it's extensive in OpenBSD.

I would love to see pledge support in HardenedBSD. I think they're doing good work. Hopefully FreeBSD can import some of it.

Also, Dragonfly is a first-class BSD citizen and should be included in comparisons. As a recent example, the project leader, Matthew Dillon, has done excellent work relating to Speculative Execution and collaborated with other BSDs which helped everyone. Also I'm pretty sure OpenBSD has imported a number of hardware drivers from Dragonfly.

<comment><USER13> The table in the parent comment lacks versions.

If I am not mistaken, NetBSD uses ChaCha20 since 2015.

[https://github.com/NetBSD/src/blob/trunk/lib/libc/gen/arc4ra...](https://github.com/NetBSD/src/blob/trunk/lib/libc/gen/arc4random.c)

<comment><USER12> Thank you for the correction! I only looked at NetBSD's random(4) manual page:

[http://netbsd.gw.com/cgi-bin/man-cgi?random+4+NetBSD- current](http://netbsd.gw.com/cgi-bin/man-cgi?random+4+NetBSD-current)

So NetBSD uses AES-128 in /dev/*random and ChaCha20 in arc4random(). I wonder why?

</comment></comment></comment><comment><USER14> Kudos on a list where features HardenedBSD doesn't have but others (OpenBSD) do are also listed.

Recently I've become accustomed to seeing overly tuned feature lists where the product in question has, apparently, all the things you could want.

<comment><USER15> Well, this does have an overwhelming number of 'the things you could want'. This serves the same purpose, while attempting to appear more credible by showing a tiny handful of shortcomings in an attempt to convince the reader that you can trust them.

<comment><USER14> What other shortcomings are missing from the list?

<comment><USER15> Regular code reviews like what the OpenBSD folks do. Also, they appear to be back on OpenSSL again[0], and not using LibreSSL like the list claims. If they can't even accurately reflect which SSL library they are using, what else on the list is incorrect?

0\. [https://hardenedbsd.org/article/shawn- webb/2018-04-30/harden...](https://hardenedbsd.org/article/shawn- webb/2018-04-30/hardenedbsd-switching-back-openssl)

<comment><USER16> HardenedBSD still uses LibreSSL in base. The switch back to OpenSSL will be on 01 July 2018, as mentioned in the article you linked to.

</comment></comment></comment></comment></comment><comment><USER17> HardenedBSD no longer uses LibreSSL, they switched back to OpenSSL in April.

[https://hardenedbsd.org/article/shawn- webb/2018-04-30/harden...](https://hardenedbsd.org/article/shawn- webb/2018-04-30/hardenedbsd-switching-back-openssl)

<comment><USER16> HardenedBSD still uses LibreSSL in base. The switch back to OpenSSL will be on 01 July 2018, as mentioned in the article you linked to.

</comment></comment><comment><USER18> Some time ago I made an 'introduction' to the HardenedBSD, you may find that useful.

[https://vermaden.wordpress.com/2018/04/06/introduction-to- ha...](https://vermaden.wordpress.com/2018/04/06/introduction-to-hardenedbsd- world/)

</comment><comment><USER19> > Restrictions on mprotect to prevent switching pages between writable and > executable.

No JIT then?

I could see a locked down server process wanting to drop access to this, but I feel like it's unreasonable to have on by default. (Also looking at you, Apple.)

<comment><USER20> Yeah, you have to manually turn off mprotect for all JIT programs e.g.:

[https://github.com/HardenedBSD/secadm- rules/blob/master/fire...](https://github.com/HardenedBSD/secadm- rules/blob/master/firefox.rule)

</comment></comment><comment><USER21> No insult to the BSDs, but running a less popular OS can help too.

<comment> yjftsjthsd-h "Adobe's Flash plugin is distributed in binary form only, and they do not provide a native OpenBSD version. Considering their security record, we thank them for this neglect."

\- [https://www.openbsd.org/faq/faq13.html#plugins](https://www.openbsd.org/faq/faq13.html#plugins)

<comment><USER7> Case in point. ;-)

</comment></comment></comment><comment><USER22> Hmm no DragonflyBSD

<comment><USER23> would probably need to add special list entries for how far behind dragonflybsd is.

<comment><USER24> what are some of the examples of the entries, that make DragonFly BSD far behind others?

I just finished setting up a number of simple dev/test environments for a simple jdk8-based backed service, on DragonFly 5.2.2, using default DF configs. So wanted to understand what I might need to look for hardening (I am still rather far from production, though) ).

<comment><USER23> Enable this [https://gitweb.dragonflybsd.org/dragonfly.git/commit/2620a64...](https://gitweb.dragonflybsd.org/dragonfly.git/commit/2620a64fdb105a7b4d26a1e555682db9b74c3015)

It will be enabled by default by the next release apparently.</comment></comment></comment></comment>


Which flag should stand for English in a language menu bar? - <AUTHOR> https://netguru.co/blog/3-things-to-keep-in-mind-when

<comment><USER2> US flag for English (Simplified) and UK flag for English (Traditional)</comment>


Ask HN:  Do you relate to the masses? - <AUTHOR>

In browsing the Amazon topseller list, I get the eerie sense of being completely out of touch with the zeitgeist:
http://www.amazon.com/gp/bestsellers/books/ref=pd_dp_ts_b_1
Are you at all in tune with what most people think like and desire? <comment><USER2> The list is an aggregate, and most people probably would only have an interest in a couple of those. It's probably skewed towards new books, too; the sales for things like fad diet books probably drop off quite quickly. Long-term sales might be more interesting, as well. (Speaking as somebody who worked in a public library for about six years, people are more likely to grab something intriguing on a whim if it's free.)

Also, there is no "average" person, just aspects that pop up more frequently when you combine characteristics of lots of people. Individual people, even people you might at a first glance consider shockingly mundane, have their interesting sides. People viewed as a group are like stones that have had most of their interesting scratches and edges polished off.

</comment><comment><USER3> Even worse, this is a topseller list of _people who still read books_.

Which is probably a minority of the US population nowadays.

<comment><AUTHOR> I wonder if the general stats for the books hold in other countries. It would be interesting to see if France or Germany had the apparent weight loss and self-help level of interest that we have.

<comment><USER4> [http://www.amazon.fr/gp/bestsellers/books/ref=pd_ts_pg_1/279...](http://www.amazon.fr/gp/bestsellers/books/ref=pd_ts_pg_1/279-4628317-7272756?ie=UTF8&pg=1)

[http://www.amazon.de/gp/bestsellers/books/ref=pd_ts_pg_1/279...](http://www.amazon.de/gp/bestsellers/books/ref=pd_ts_pg_1/279-4628317-7272756?ie=UTF8&pg=1)

</comment></comment></comment><comment><USER5> 5 out of the the top 25 are self-help books on the topic of eating less.

4 of those 5 are targeted to women, 2 have the word 'girl' in the title.

3 of those 5 occupy spots in the top 4.

</comment><comment><USER6> "Pride and Prejudice and Zombies: The Classic Regency Romance - Now with Ultraviolent Zombie Mayhem!"

I guess there's ONE thing in there I can relate to.

</comment><comment><USER5> 7 of the top 25 are about unhumans: zombies, vampires or demi-gods.</comment>


Ask HN: Which obscure/young programming language has a lot of potential? - <AUTHOR> <comment><USER2> Julia! (see today's 1.0 release) looks a little like Python, all the language features you need to do OOP or functional, LLVM compiled back end for fast run speed.

</comment><comment><USER3> Vue?</comment>


Mnuchin: "We can't shut down the economy again" over coronavirus - <AUTHOR> https://www.axios.com/mnuchin-coronavirus-economy-52235f67-f6e0-41e8-928c-37d5e1b9c3ac.html <comment><USER2> If hundreds of thousands of people can protest in the streets, we can certainly reopen businesses cautiously. Saying that social distancing is unnecessary for a politically fashionable cause is saying that social distancing is unnecessary in general.</comment>


Outsourced: Employee Sends Own Job To China; Surfs Web - <AUTHOR> http://www.npr.org/blogs/thetwo-way/2013/01/16/169528579/outsourced-employee-sends-own-job-to-china-surfs-web

<comment><AUTHOR> I suspect that at places like Microsoft, and Google this is not all that uncommon.

I once interviewed at an insurance company and remember thinking that I would have outsourced the job I was interviewing for. I think though that instead of surfing the web, I would have lined up 2 jobs where I could work remotely and done those as well. That way I would look busy, and be able to earn even more money.</comment>


Elon Musk: AI could be more dangerous than nukes - <AUTHOR> http://www.cnet.com/news/elon-musk-artificial-intelligence-could-be-more-dangerous-than-nukes/

<comment><USER2> Previous discussion:

[https://news.ycombinator.com/item?id=7931674](https://news.ycombinator.com/item?id=7931674)

[https://news.ycombinator.com/item?id=7689579](https://news.ycombinator.com/item?id=7689579)

</comment><comment><USER3> What a terrible ending to the article. What Musk is warning against is a system that is capable of accomplishing it's own goals, and if those goals conflict with our own goals then there will be trouble - especially if the AI is clever enough. Whether or not we are living in a simulation is irrelevant - we are still agents with goals.

Maybe the author was trying to be silly, but, if that's the case I can see why he writes for CNet at not Comedy Central.

<comment><USER4> I think even before AI becomes intelligent enough to potentially destroy us. They will be intelligent enough to get used as smart weapons that are controlled by only a handfull of poeple that seek to controll the world. For Atomic bombs you still need a lot of people to keep them working and effective. AI Robots on the other hand could work, repair and advance themself.

</comment></comment><comment><USER5> This article adds to substance to Elon's cryptic tweet in favor of a cryptic reference to the Tron mythology. It seems to me though that the premise of strong AI warrants a degree of caution by its very definition. It would apparently be capable of all the things we are. But more likely it will be capable of all the things that we can program it to be capable of. the consequence of these actions remains underexamined, in my opinion.

</comment><comment><USER6> Reminds me of Roko's basilisk:

[http://rationalwiki.org/wiki/Roko's_basilisk](http://rationalwiki.org/wiki/Roko's_basilisk)

<comment><USER7> It's a bit annoying that you can't even talk about this stuff without the basilisk interfering. Maybe we're dooming ourselves by laughing at the basilisk incident instead of taking the potentially larger issue seriously.

<comment><USER8> Indeed, it's kind of a round about metaphor for John the Baptists 'repent ye for the kingdom of heaven is at hand'. Which also concisely demonstrates why many don't give the the singularity or related notions (even the possibility of strong ai) credence. It's a little to religious ie unknowable.</comment></comment></comment>


Problems of Traditional Math Notation (2004) - <AUTHOR> http://xahlee.info/cmaci/notation/trad_math_notation.html <comment><USER2> > Traditional math notation has a lot problems. Inconsistencies and > ambiguities. It lacks a grammar.

It doesn't require a grammar, because it is interpreted by humans, not parsed by a computer.

Ambiguity is a major problem in computer languages. It is not so in human languages—human languages are riddled with ambiguity from start to finish. But they've also been developed over a period of hundreds of years to assist human communication.

Math is written for humans to read. Programs are written for computers to read. What's good for one, is very bad for the other. Don't confuse the two—computers are very precise, and very stupid. Humans are very smart up to a point, but no further. Their needs are very different.

<comment><USER3> > Math is written for humans to read. Programs are written for computers to > read. What's good for one, is very bad for the other.

If programs were written for computers to read, we would still be writing them in machine language. Quite the contrary - programming language design is to a large degree a human-interface problem, because programs are primarily written to be read by humans: our teammates, our successors, even ourselves, coming back to the project after working on something else.

The existence of Brainfuck demonstrates that computers are indifferent to the qualities which make a programming language useful or legible to humans.

The irony in your comment that "math is written for humans to read" is that I find traditional math notation to be practically illegible. I typically cannot make any sense out of the pseudocode in a CS paper until it has been translated out of traditional math notation into some more familiar, programming-language-style notation.

<comment><USER4> > I typically cannot make any sense

The operative word here is "I"

And computer languages are obviously designed to be understandable by both humans and computers, but it is still the human that has to bend to the ways of the computer.

<comment><USER5> > but it is still the human that has to bend to the ways of the ...

... elder programmers. who would be called computers in olde times.

The real problem is symbolism, though it's necessary, because only in symbols can we express a wrong statement, while on the other hand you can't take an apple and another apple and have three in the end.

</comment></comment></comment></comment><comment><USER6> Traditionally, mathematicians have a pointlessly hard time when manipulating higher-order functions. This goes from inventing new names for higher-order functions (e.g., "funcational", "transformation"), to constantly using new notations for application (F(g) becomes F[g], becomes F{g}, becomes \int g(x) dx, etc.), to _leaving out the binders_.

The latter is crazy. Consider the expression "F{e^{-t^2-y^2}}", which might stand for the fourier transform of a 2d gaussian, or it might be the fourier transform of t, with a parameter y, or it might just be the fourier transform of a constant function, or... It is only really defined in the surrounding text. The notation is incomplete and while in this example that might not be such a large problem it just gets worse as you pile on complexity. All integral transforms are written like this, as are expected value, variance and so on.

A lot of times notation in math is choosen to be suggestive. For example, the integral and sum notations are actually pretty neat, since they make common manipulations more visually clear. In particular, since the order of integration doesn't matter, putting the binder inside the integral as a "factor" is actually pretty inspired - commutativity makes Fubini obvious. The "d/dx" the author complains about can be made precise and is similarly great. Consider "dx/dz = dx/dy dy/dz", doesn't this just look entirely natural? But there's something about manipulating functions as first class objects that seems so unnatural to mathematicians that it needs cryptic notation to ward of the unwary...

<comment><USER7> If it becomes a problem, it is changed.

Plus there are reasons to treat functions of functions differently. Often there are subtle assumptions made on the domain of a function of a function. The space of functions is just too damn big to work with naturally. Almost none of the things you want to do to functions are applicable to all functions. R^R consists mostly of pathologies and monsters.

e.g. [https://en.wikipedia.org/wiki/Weierstrass_function](https://en.wikipedia.org/wiki/Weierstrass_function)

<comment><USER6> And often we have functions which are only defined in an open neighborhood of zero, yet we still call them functions.

That the set theoretic definition of "function" as a functional relation between sets is rarely useful isn't really so surprising that you need to emphasize that you use a more reasonable notion of function all the time.

And the integral transform notation is frequently changed, but only ever locally and in different ways by different authors. Pick up two books on "Fourier transforms for engineers" and I promise you that you will find different notations for the same thing and probably even different notations within the same book. And none of them will be good.

</comment></comment></comment><comment><USER8> > The equation sign is used ambiguously. (for definition and for equality)

Definition and equality are really the same thing. A definition is just an introduction of a term/variable, and an equality giving it a value. So the only difference is if a term in the equation hasn't been introduced yet.

> The bracketing placement of symbols for absolute value, is not a matching > pair, thus is ambiguous (when nested or sequential).

How was it not a matching pair? I only see two |'s in each equation so they have to pair up. What other way is there to interpret it?

> the notation for differentials "dy/dx" rapes the division notation. The > differential notion has no position in math regarded as a computer language, > as implied by the math philosophies of formalism and logicism.

I believe the original reasoning for notating derivatives as dy/dx is that it is a limit of a faction and so approaches a fraction of infinitesimals. with that background the division notation is simply extended to a new class of numbers.

I am not sure what the second sentence is trying to say.

Also pretty much all of the issues could be solved with gratuitous parenthesis. So we have a solution to get a formal grammar; we use the current notation because it is faster to read and write. So without any concrete proposals, this critique has very little content.

<comment><USER9> Absolute value is ambiguous if you have more than one occurence, like |a|b|c| could be (|a|)b(|c|) or |a(|b|)c|. But as you said, gratuitous parentheses solve this problem. A good typesetting program will also let you display the outer bars larger than the inner ones, so you can match them up even without parentheses

<comment><USER8> > Absolute value is ambiguous if you have more than one occurence, like > |a|b|c| could be (|a|)b(|c|) or |a(|b|)c|.

Yeah, I get the issue in general, but the quote I referenced was specifically referring to the equations from Wikipedia.

My thought is that pretty much any mathematician would not choose to use absolute value bars in a case where it would be ambiguous. For example (|a|)b(|c|) would be instead written |ac|b and |a(|b|)c| would be written |abc|. And so unless it the equations are specifically about showing properties of absolute value (in which case just use parenthesis), I don't see a case where the ambiguity would pop up in real discourse.

<comment><USER10> _For example (|a|)b(|c|) would be instead written |ac|b_

That changes the meaning. You're now relying on multiplication being commutative which is not true for all sets.

<comment><USER8> > That changes the meaning. You're now relying on multiplication being > commutative which is not true for all sets

As I said at the end of my last comment: I don't see a case where the ambiguity would pop up in real discourse. If you are dealing with non- commutative objects you can deal with a few more parenthesis. Just like non- associative objects result in many more.

</comment></comment></comment></comment></comment><comment><USER11> _Typically, mathematicians will just say it doesn 't matter, because by context it makes it clear to humans. I disagree. I think it introduces lots of mis-understanding and garbage into our minds, especially those who have not studied symbolic logic and proof systems (which, is actually majority of mathematicians). The wishy-washy, ill-defined, subconscious, notions and formulas make logical analysis of math subjects difficult. Of course, mathematicians simply grew up with this, got used to it, so don't perceive any problem. They'd rather attribute the problem to the inherent difficulty of math concepts._

You could substitute quite a lot of other things for 'mathematicians/math' and this would ring equally true. I've noticed that people often defend the system they learned within even (or perhaps because?) when its limitations are creating a barrier for potential new entrants.

<comment><USER9> For most of mathematics, potential new entrants would be mathematicians from a different field. Then using familiar notation is actually helping them understand the new concepts, even if it erects a barrier for people with zero background knowledge. But if you have zero background, you'd be better off starting from the fundamentals (and learning the prevalent notation on the way) rather than diving straight into deeper mathematics.

In that, notation is really no different from a specialized language. A sentence like "a monad is a monoid in the category of endofunctors" doesn't make sense if you don't know what those strange words mean; but if you understand the _concepts_ , you probably also know what they are called.

</comment></comment><comment><USER4> I think it's safe to say that the alternative to ambiguity would be a lot more symbols, I'm not sure that would help.

I find that it's very seldom that I struggle to understand an expression because of limits in the notation system, I think this is more a case of someone coming from computer science, where notation by necessity is completely unambiguous, and being dissatisfied with math notation on a philosophical level.

Math notation is a bit like writing down spoken languages, the intention is to provide just enough information so that a native speaker can understand which word is being referenced. It's definitely not to provide an encoding of the sounds that can be decoded by anyone with a simple table of correspondences.

Sometimes I find myself looking at an expression and understanding what is meant, but not really knowing _how_ I can understand it. Like when you intuitively can pronounce a word you've never seen before, but you can't consciously determine what rules you applied to arrive at that pronunciation. I think that is beautiful!

<comment><USER12> If I remember correctly, von Neumann was reviewing someone's dissertation (might have been Minsky's), and someone asked "Is this mathematics?", to which von Neumann replied "If it isn't now, it will be soon."

Doing the CS guys a kindness will probably pay the field back several times over. The latex-fussing and symbol collision in mathematics is not pretty.

<comment><USER4> I don't actually think it is desirable to make mathematical notation unambiguous, if that is even well defined. To again use natural language as an analogy, there are only some 26 letters in most Latin based alphabets, but there are many more sounds. The same "letter", or historical sound, is pronounced differently in different contexts, but since it's almost always predictable based on context or knowledge, the system works.

In the same way, you could say that in one sense (though possibly not the mathematical sense) there are lots of different uses for "=". Most of the time this obviously hasn't been an issue, if it had been, people would have introduced new symbols. For some cases they have done just that, it can sometimes be useful to explicitly distinguish definitions with ":=" or a triangle above the =. In the same way people sometimes use a triple line = for "is identical with". But seeing that everyone knows these symbols, but still make do with just = in most cases, even they are only half useful.

<comment><USER12> If we use ordinary language as an analogy, we're usually all speaking the same one, and ambiguity is manageable.

Whereas in the professions, we are so deep into sub-specialties and sub- languages that even without ambiguity we are approaching a Babel where mathematician does not understand mathematician and lawyer does not understand lawyer.

</comment></comment></comment></comment><comment><USER13> I have seen many computer programmers express their distaste in traditional math notations. I have an opposite opinion, probably because I majored in physics as an undergraduate. Whenever I read/write source codes with heavy math formulas, I feel lost in a sea of verbosity. While the unambiguity renders the trees clearer, the verbosity blinds me from the forest. I always have to step back and write in the traditional form to understand.

Because people with a math background, rather than those with a CS background, dominate the field of math, the notation is unlikely to change ever.

</comment><comment><USER14> The examples in the article don't bother me much, but I've noticed that I struggle a lot more when it comes to linear algebra. It might be due to less experience, but I can easily lose track of which things are scalars vs vectors vs matrices vs tensors. I'm noticing it right now working through various tutorials on neural networks... I get the concepts easily but when I sit down to implement, translating the notation into code is a lot more difficult than the scalar functions I'm used to.

<comment><USER4> Some authors use conventions such as boldface for vectors and capital letters for matrices. There are also often conventions around different types of e.g. scalars. a, b, c are typically used for different things than i, j, k, within a text.

</comment></comment><comment><USER15> TLDR: author complains.

Why there is no Hitchhiker's Guide to Mathematics for Programmers [https://jeremykun.com/2013/02/08/why-there-is-no- hitchhikers...](https://jeremykun.com/2013/02/08/why-there-is-no-hitchhikers- guide-to-mathematics-for-programmers/)

</comment><comment><USER16> Not directly math but Guy Steel's talk at Clojure Conj [0] on computer science type notation touches on related issues and is a great watch.

0\. [https://youtu.be/dCuZkaaou0Q](https://youtu.be/dCuZkaaou0Q)

</comment><comment><USER17> I am glad somebody is finally looking into this! There is an interaction between used/formalized language and thinking and often certain types of definitions and notations force thinking one way, making another way, maybe better in other situations, less visible. As a practical consequence, we might have a potent hammer for certain situations and teach people to nail all problems, instead of using another, more suitable approach based on different mechanics, just because the prevalent way of formalism enforces certain rules and obstructs creativity.

</comment><comment><USER18> How is `||c||a|b|` ambiguous, given the knowledge that taking the absolute value is an idempotent function? I get you could read it as `abs(abs(c)).a.abs(b)`, but no one would. To me, it's unambiguously `abs(abs(c).abs(a).b)`. AFAIK, this also applies to other uses of these symbols and, e.g., norm. (In fact, norm'ing twice doesn't even make sense because the types clash, to use the programming term.) Also, IIRC, in LaTeX the size of the | symbols can be balanced and autoscaled with \left and \right, like parentheses.

<comment><USER19> It is ambiguous because, as you point out, it can be read either as `abs(abs(c)).a.abs(b)` or `abs(abs(c).abs(a).b)`.

A mathematician can of course think about it and know what is meant. But there are many alternate notations that could be used, where such ambiguities don't even occur (e.g., balanced parens).

Autoscaling does seem like a nice solution in this case, which preserves the traditional notation while resolving the ambiguity...

<comment><USER20> _It is ambiguous because, as you point out, it can be read either as `abs(abs(c)).a.abs(b)` or `abs(abs(c).abs(a).b)`_

Except in this case the ambiguity comes from typography rather than notation. ‖c‖a|b| for example is exactly the same statement with different typography and is a lot less ambiguous. The problem here isn't math notation, but trying to apply that notation using only pure ASCII.

</comment></comment></comment><comment><USER21> I have wondered if not postfix is more suitable for writing math expressions. Yes, for simple expressions like 2*3+4 postfix is cumbersome, but for more complicated ones I think it has benefits. F.e: "k fac ln 2 ^ -1 ^" would be "1/ln(k!)^2"

It is easy to see that the postfix expression is just a composition of a bunch of functions "fac ln 2 ^ -1 ^", but not so easy in the infix case. It is also easy to derive the inverse of it: "-1 ^ 1/2 ^ exp fac^-1"

<comment><USER22> I'm fairly sure infix notation is easier to read for associative operations. It's hard to beat the simplicity of a + (b + c) = (a + b) + c.

I'm also not convinced that (a x n ^ *) is going to catch on as a replacement for ax^n.

I think some kind of postfix notation could be nice for category theory though, it always confuses me that X -f-> Y -g-> Z is a diagram for gf, not fg.

</comment></comment><comment><USER23> As a reasonably good computer programmer with a facility but no education in math, when I need to learn something new I always try to find some software program, typically something open source, that implements the math in question. Then I can work through the ambiguities of the equations by looking at the source code.

<comment><USER24> It's cool that you do this, but I wouldn't want anyone to get the idea that it's not worth learning to read mathematical notation.

> the ambiguities of the equations

Mathematical language is the least ambiguous language you will find anywhere, other than executable code.

<comment><USER25> I'm not exactly clear on what you mean by "mathematical language" in this context as mathematical notation is clearly filled with ambiguity, so I have to assume it is something else you are getting at. Can you elaborate on that ?

<comment><USER24> I said least ambiguous, not free of ambiguity. I challenge you to name a community which strives for precise language more than professional mathematicians.

</comment></comment></comment></comment><comment><USER26> 3Blue1Brown made a video about math notation for power/logarithms/roots: [https://www.youtube.com/watch?v=sULa9Lc4pck](https://www.youtube.com/watch?v=sULa9Lc4pck)

It's messy to actually draw a triangle, but there are alternative notations for it.

<comment><USER5> what's messy about drawing?

<comment><USER26> I think in practice a triangle can be too large.

<comment><USER5> if you think large, write large.

</comment></comment></comment></comment><comment><USER27> The main problem with mathematics is the lack of types.

<comment><USER2> It has types—it has tons of types. They're just used very differently than in programming.

<comment><USER27> Which is a problem tho.

<comment><USER2> What do you see as the problems with that?

<comment><USER27> Lack of checkability which slows down progress. Look into work of the late Vladimir Voevodsky [https://www.quantamagazine.org/univalent-foundations- redefin...](https://www.quantamagazine.org/univalent-foundations-redefines- mathematics-20150519/)

</comment></comment></comment></comment></comment><comment><USER28> What's wrong with the expression

(a+b)/a = a/b = φ

Does the author not like that a new symbol is introduced like that?

</comment><comment><USER4> There seems to be a lot of confusion here. Yes, math notation certainly _can_ be used to write ambiguous expressions. This in itself is not the slightest problem, because it doesn't mean that you are _forced_ to use ambiguous syntax, you never are.</comment>


Ask HN: What do you use for recurring billing? - <AUTHOR> I am looking for a simple solution for recurring billing. My requirements are:
- Per user per month. New users can be added or removed any time. Support for initial 14 day trial.
- Per user billing for annual subscription. New users can be added during the year.
I am looking for something that supports True Up accounting model. I have looked into Braintree and Stripe api. None of them seem to support anything beyond simple recurring billing.
What have you used for this type of common billing patterns in SAAS apps? <comment><USER2> Roll your own. Start with a subscription table with a paid_through column, and a payment table for recordkeeping. Your billing code is a daily cron job running a single simple script, that selects all rows with paid_through less than current date, charges each user's card on file, and updates the two tables. Discounts, different subscription terms, receipts, dunning mails are all simple additions to the daily billing script that you can add as you grow.

This has worked for me with tens of thousands of customers and millions in billings, and I've never had to worry about being locked into some payment company's proprietary system. Whatever pricing scheme you initially come up with for your app probably won't be right. You might have 6 plans when you only need 2. You might find out you were charging a flat monthly rate when you really need to be charging per widget or per user or per server. The more you rely on someone else running your billing, the harder it will be to experiment and find the right way to do billing for your customers.

You can avoid being locked in to a payment processor for storing and charging payment info too. I use Spreedly ([https://www.spreedly.com](https://www.spreedly.com)) which provides payment card tokenization and a single unified API for over 100 payment gateways. I can use Braintree today, Stripe tomorrow and ShinyPaymentStartup next year without changing any code or re-collecting billing info from customers.

<comment><USER3> This means you actually store customer credit card numbers and have to deal with PCI compliance? Is ensuring PCI compliance very onerous?

<comment><USER2> Nope, I don't store credit card numbers, payment info never touches my servers at all. I mentioned that I use Spreedly. Spreedly works exactly like Stripe Checkout if you've ever used that. You only store a token referring to payment info they're storing, and pass that token to the API to make charges against it as needed.

<comment><USER4> That's at least $200 to use Spreedly. What benefit have you gotten with it so far? Do you find yourself switching gateways to get lower rates, or do you just stick with one gateway?

<comment><USER2> Actually $150/mo for up to 5000 stored cards. The benefit is mostly peace of mind: a "PayPal horror story" type situation (frozen account), processor raising rates, or payment gateway having an extended downtime event are non- issues instead of major headaches or potential company-enders.

<comment><USER4> Is there reason example of a gateway that was down more than a day or 7? A big player like stripe just vanishing in the night?

Would rather spend $150 on some AdWords or something that has a more realistic chance to do something.

</comment></comment></comment></comment></comment></comment><comment><USER5> Not thrilled with it but we use paypal for our reoccurring payments. Users trust it and don't have to fork over their credit cards, but I get scared every time someone lies and says they didn't authorize the charge and having to prove to paypal that they indeed did get what they ordered fearing they'll freeze our account or something. Also it does cause confusion where the subscription is managed at paypal instead of on our site. That said, it does work 99% of the time.

</comment><comment><USER6> Chargebee works on top of payment gateways like Stripe or Braintree. They give you more flexibility around subscriptions than those payment gateways support out of the box. Plus they don't charge you a fee (excluding payment gateway standard fees) until you make your first $50k in revenue with them.

Your other best bet is Recurly. They have lots of options for subscriptions but it may not make sense if you don't have any revenue yet.

</comment><comment><USER7> Check out these guys [https://www.chargebee.com/](https://www.chargebee.com/)

<comment><USER8> Yup, we've been using chargebee for about 4 years, can confirm they're great.

Get in touch with [https://news.ycombinator.com/user?id=skrish](https://news.ycombinator.com/user?id=skrish)

</comment></comment><comment><USER9> I've looked at all the providers and couldn't find one that was flexible enough and also isnt overcharging, I.e. paying for the service, credit card charges, payment gateway, etc.

That said, I've found cheddargetter to work quite nice. Has an API, includes the payment gateway, and provides enough flexibility for custom prices per subscription. So far I've implemented three startups with it.

Hope this helps.

</comment><comment><USER10> [https://paddle.com](https://paddle.com)

<comment><USER11> Yes, I've also had a good experience with Paddle. It is easy to setup and also handles VAT/taxes.

</comment></comment><comment><USER12> Open Source [http://killbill.io/subscription- billing/](http://killbill.io/subscription-billing/)

</comment><comment><USER13> Check out: [https://www.chargify.com/](https://www.chargify.com/)

</comment><comment><USER14> use a provider if you can integrate in a day or two, then later think of rolling your own if you anticipate any issues. you could find a provider that might be interested in writing certain features for you or has a decent enough api for you to extend.

</comment><comment><USER15> Recurly, Aria, Zuora

</comment><comment><USER16> Memberful.com</comment>


Rancher 2.0 GA - <AUTHOR> https://rancher.com/blog/2018/2018-05-01-rancher-ga-announcement-sheng-liang/ <comment><USER2> We use Rancher 1.6 at my job and it has been widely and rapidly adopted by all of our development teams.

All of our processes are containerized now, even going as far as moving off license restricted (e.g. SSIS) software to open source alternatives to unify our process.

It's been mostly painfree, occasionally there are bugs in Rancher but nothing has been a show stopper.

<comment><USER3> What did you use in place of SSIS?

</comment></comment><comment><USER4> Everybody who wants to run Rancher with zero initial setup can use our managed Kubernetes/Rancher service which we launched today: [https://www.KubeBox.com](https://www.KubeBox.com)

We are still in closed beta but if you are interested, please sign up and we will activate your account asap.

Personally, I think Rancher 2.0 is a fantastic add-on to any Kubernetes cluster for managing projects, users, groups, permissions and workloads and I would like to congratulate Rancher to their release.

</comment><comment><USER5> Tried for an hour to use this version, here's some things that I struggled with:

\- PersistantVolumeClaims: I tried to launch a Postgresql workload and didn't get a warning that I should configure EBS before

\- I tried installing rancher on my machine and later found out that the nodes need to reach rancher

\- I configured Pipeline with Github but I cannot find any ressource about what to do next, I assume that it is a CI service but it's not explicit

<comment><USER6> Thanks for your feedback. I ran into #2 myself when trying to add a DigitalOcean node to a Rancher server running on my laptop. We will address these issues ASAP, at least make the failure scenario more obvious.

</comment></comment><comment><USER7> I choose Rancher 1.x for a large project at my last place, it allowed Researchers to run their algorithms wrapped up in containers. From the start Rancher was the perfect solution that checked all the boxes: really easy to use web interface, LDAP Authentication, automatic deployment of hosts, easy to wrap up deployments into catalog items. But after a few months it was just so unbelievably buggy due to the products maturity.

It's good to see they have got their focus right with version 2.

<comment><USER6> Thanks for using Rancher 1.x, which definitely went through growing pains. The latest Rancher 1.x release, 1.6.17, is actually quite mature and solid. But as much as we like 1.6, the container industry is very different now from the days we built 1.x. With Kubernetes available everywhere, we no longer need to write our own orchestration engine and worry about networking and storage integration, we can focus on things Rancher does well, as you pointed out, things like the web interface, authentication, node (host) management, and the catalog.

</comment></comment><comment><USER8> I've been using it with Cattle for more than a year now, I've saved thousands of dollars in PaaS bills thanks for my little Rancher cluster. I just setup a new Rancher 2.0 cluster controlplane and dashboard in Scaleway Paris with a Worker in Digital Ocean NY. I'm starting to migrate all my apps from the 1.6 to the new cluster. I haven't tried the new CI/CD thing, but it looked great in the training sessions.

</comment><comment><USER9> Heavy rancher user here for managing Kubernetes clusters, the Rancher team has been an absolute dream to work with, fast to fix issues, and have created a super solid product. Very excited for the migration to 2.x from 1.x (:

</comment><comment><USER10> As a heavy user of Rancher 1.6 this is amazing news!

The only gripe I have is the api is not as functional as 1.6, It's lacking features such as upgrading a pod. Other than that it's looking better than ever.

</comment><comment><USER11> Folks sometimes underestimate how much work it takes to build a platform. So I deeply mean this: congratulations.

</comment><comment><USER12> If I only have GKE clusters, what does Rancher mainly offer on top of that?

<comment><USER13> i.e. do i need an abstraction layer over my orchestrator?

Somewhat reminiscent of the early 2000's fad to abstract over databases when in reality folks never 'swap out the db' on real projects.

<comment> gm-conspiracy "fad to abstract over databases"

 _cough_ Is it not called an ORM?

<comment><USER14> Some can be used for that, but it's not their main purpose. Not all ORMs are database-independent (the one we use uses postgres-specific features), and conversely, if you just need independence you're probably better off using something lighter.

</comment></comment></comment></comment><comment><USER15> I have been using Rancher for almost two years now on dedicated servers. Never had any major problems and thanks to it I have saved hundreds of thousands of $.

</comment><comment><USER16> We've been trying the Rancher as our kubernetes management interface, looks promising but we're still in a very early stage of usage.

</comment><comment><USER17> I love the concept of Rancher for someone working in Corporate Atmosphere - where I have to install everything on the companies infrastructure and all the GKE, Fargate and Azure Kubernetes is not allowed... But the people at Rancher failed to recognize that they need to support clustering without any manual intervention to actual click through their UI to achieve clusters - give me an automated joining of clusters method - if you want me to adopt Rancher.

<comment><USER18> (Rancher employee) I'm not sure what you're asking for but the UI is l00% static client-side code. Everything it does can by definition be automated through the API.

Getting the command to import a cluster is ~5 calls from a brand new server container.. Login with admin/admin, set a better password, set the server-url, create a cluster and get the registration token/command for it.

</comment></comment><comment><USER15> Does Rancher now support Rook for PVC?

<comment><USER19> Would love to know if there's a clean / simple integration for something like Rook or OpenEBS. IIRC, I saw a few folks had Rook set up manually on a Rancher-based cluster in the tech preview or beta 2.0 days...

Having a simple way to run your own block storage that could withstand node failures / network issues would be fantastic.

<comment><USER15> I had some time to play with it and managed to setup rook, but I was unable to use it with any of the catalog apps. Ingress didn't seem to work either - what's the point having apps if you can't access them ;) Actually nothing worked in Rancher except its dashboard. I can't understand what's the point of this project is now, as you can have better results with original Kubernetes dashboard and there everything works. I feel very disappointed :(

</comment></comment></comment><comment><USER20> Congrats guys!!</comment>


Translation Startup Unbabel (YC W14) Unveils New Smartcheck Technology - <AUTHOR> http://techcrunch.com/2015/09/11/translation-startup-unbabel-unveils-new-smartcheck-technology/ <comment><USER2> > In July it had its best month ever, surpassing $100,000 in monthly revenue > for the first time

Is this revenue going to Unbabel or just passing through to the translator?

(See #6 here: [http://a16z.com/2015/08/21/16-metrics/](http://a16z.com/2015/08/21/16-metrics/))

<comment><AUTHOR> Hi, this is Vasco, I am Unbabel's CEO. We have a margin, of course, that depends on several factors.</comment></comment>


Synesthesia Encyclopedia - <AUTHOR> http://cytowic.net/Synesthesia/Synesth__Encyclo_/synesth__encyclo_.HTM

<comment><USER2> Thanks for the link. I have a couple of kinds of synesthesia myself (I wrote about my experience here: [http://michaelgr.com/2007/09/14/my-experience-with- synesthes...](http://michaelgr.com/2007/09/14/my-experience-with-synesthesia/) )

<comment><AUTHOR> Cool...I posted this up because I'm pretty sure I have some kind of number- form ("spatial-sequence") synesthesia. I've always been good with math since I can look at a problem (numbers, equations, etc.) and "see" it's shape. This is actually very handy when coding as well (different sorts of coding problems have their own shapes too!)

Anyone else have experiences they can share?

<comment><USER3> Numbers and letters have consistent colors and combine and "influence" each other inside words and large numbers. At an early age I asked my mom to explain exactly why 113 was green, 114 was pink, 115 black, etc. It took a while to get the idea across, and we were both very puzzled. She dug out an article on synaesthesia and we learned together.

I also see colors and shapes in music. Complex melodies are very beautiful. I feel as though I can "move" between "curtains" of different musical voices. I have very good relative pitch because I can see the harmonies.

I sometimes mix up things in very odd ways because they have similar colors: 9->u, 5->e, and (god help me) names like linda->julia and teresa->desiree.

<comment><USER4> I envy you aristus - the benefits certainly sound like they outweigh the negatives!

I wonder if you can induce this in a normal brain somehow, like those tongue- sight or smell remapping experiments.

<comment><USER3> I'm not sure. I don't see colors on a page like others do, and I'm not convinced that my brain is somehow abnormal.

Your idea of smell remapping is very interesting. If I understand you, maybe some sort of biofeedback device can stimulate the sensation. Deaf people use voicemapping software to help them biofeedback their pronunciation.

There are three times in early life when I remember noticing the effect very strongly: when my sister first taught me to sing harmony (age 3 or 4), when I first heard outre jazz (7? I didn't like it) and when I first really paid attention to Bach (8 or 9). Each time I was in a receptive mood and I was confronted with novel stimuli.

There is also a lot of anecdotal evidence for synaesthetic "hallucinations" brought on by drugs, exhaustion, or sensory deprivation. Maybe there are some clues there.

And if all else fails, there's probably a synaesthesia-mode for Emacs. :)

</comment></comment></comment></comment></comment><comment><USER5> A famous synesthete was the late great Richard Feynman. I think he had written it in one of his books that he felt unconfortable with that feeling, and didn't talk much about it.

</comment><comment><USER6> Is any one aware of how to cause synesthesia in people who don't have it, other than using drugs...or by using drugs: keeping it permanent?

<comment> a-priori As far as anyone knows, synaesthesia is a fundamental property of how some people's brains are wired, where the interconnections between two areas of sensory cortex are abnormally strong. Thus, when one area is activated (by perceiving a letter, for example), the activation spreads to the other area (for perceiving a colour). It's something that would develop very early on (probably _in utero_ , and surely by soon after birth).

In adults, you might theoretically be able to induce permanent synaesthesia by repeated Tetanic stimulation of the two areas of cortex simultaneously. This may induce a strengthening of the connections between the two areas via Hebbian learning.

On the other hand, this might destroy your ability to perceive both letters and colour, or cause other brain damage. There would be no guarantee that the results would be of any use to you at all (remember that synaesthesics grow up experiencing the world this way). And that's assuming you could even identify the appropriate areas. Needless to say, no surgeon would do this.

Sorry, LSD is still your best bet. :)

</comment></comment><comment><USER7> What I find massively fascinating about synesthesia is the high coappearance with creativity...

</comment><comment><USER8> Synethesia is a very common (temporary) effect of psychedelic drugs. This means that most everyone has the ability to sense synethetically. It's just a matter of somehow triggering this experience in one's brain.

It's a pity that research on psychedelic drugs is so difficult to do legally in the US (where the overwhelming majority of research money is spent). Otherwise, it might have already been possible to develop drugs that target just the synesthetic experience without bringing on a full psychedelic trip (not to mention the many other benefits that scientific research in to psychedelics would very likely have had).

<comment><USER9> "Synaesthetic and psychedelic mean approximately the same thing." -Gene Youngblood in Expanded Cinema (<http://en.wikipedia.org/wiki/Expanded_cinema>). Good book.

<comment><USER8> This may be true, when "synethetic" and "psychedelic" are used as specialist jargon for describing films or various effects in film. But it's not true in the general, colloquial sense of these terms, which refer to either a type of sensation or to a type of drug.

Psychedelic literally means "mind-manifesting", while the etymology for synethesia comes from "sense" and "together".

The word "psychedelic" was specifically coined as a way to describe the drugs that were previously called "hallucinogens" and "psychotomimetics", and it was an attempt to remove the inaccurate and negative connotations that those other words had.

Synethesia, on the other hand, refers to a specific type of sensation, and not to a drug.

Also, psychedelic drugs have many, many other effects apart from synethesia (which isn't present in every trip or for everyone taking psychedelic drugs, anyway).

So in the usual sense of these terms (not in the sense a film critic might use them), these two words have quite different meanings.</comment></comment></comment>


Carnival Cash: The Cult of Seniority - <AUTHOR> http://www.daedtech.com/carnival-cash-the-cult-of-seniority <comment><USER2> That is an interesting perspective. In my experience it seems a bit too narrow to generalize across companies but I know a lot of folks who have had some bad experiences at companies and then have extrapolated that to an entire industry. It has been interesting meeting folks at IBM who have 20+ years at the same company. Atypical of Silicon valley folks but not unheard of[1]. Having the experience of having been at a company for a while gives you the ability to do things that people who have not been there cannot, in part because you have a better view on where things get done or don't get done.

It is apparent from Erik's response to recruiters[2] that he approaches work in a somewhat mercenary way. And while that can work it sets a tone for your relationship with the people in the company that does not work to your advantage, and can sometimes be a handicap down the road as you re-encounter people with whom you have previously worked.

Companies are communities of people. Communities have norms and values and expectations. It is always uncomfortable when you don't fit in with the community, and some people are better at "finding their people" than others are. I can say though that when you and the community "click" for what ever set of reasons, it can be a wonderful thing indeed, and a real sense of loss when you lose it.

[1] One of my early friends at Intel is still there 30 years later, and the same with folks at Sun I knew who are now with Oracle as part of that acquisition.

[2] From the comment section Erik wrote:

       This is particularly valuable when talking to labor
       salesmen (i.e. recruiters).

       "They have a pool table!"
       "Don't care, what's the pay?"
       "$X"
       "Not enough money."
       "But, they have a pool table, and everyone there will be
        your dudebro and they'll even add rockstar to your
        title!"
       "Don't care, not enough money. Call me back if the
        offer changes."

<comment><USER3> Wanting good pay instead of meaningless breakroom toys makes you a "mercenary?"

I'm all for working hard and leaving a position with everyone feeling like I made a difference, and I'm still close friends with many of my former colleagues and bosses. But at the end of the day my compensation for doing work others want done is my salary and the cash value of the provided benefits.

The cash value of a pool table in the break room is essentially $0, and a recruiter pretending it's not is trying to pull a fast one.

<comment><USER2>
       > Wanting good pay instead of meaningless breakroom
       > toys makes you a "mercenary?"

No it does not, but focusing on the pay first and the environment later does.

<comment><USER4> If I asked a potential employer how many meetings a week people in the position/team usually attend, and they say 20-30, that is clearly too much. But I am reasonably certain I would be criticized by you as using the wrong tone if I said as much.

"How many meetings do people in this position usually take a week?"

"Maybe 20, but it varies."

"That's not good, the interview process should end here -- but tell me if or when you have an environment that is more in line with what I am looking for."

You see how the same problem seems to appear? Unless your critique isn't what I am imagining, pay-first isn't the issue, it's that you think it's a violation of standard norms in hiring situations to have hard requirements, and to bluntly communicate when something is not a good fit. I think you will find that hiring managers do not share this opinion of correct behavior.

<comment><USER2> I think asking for meeting frequency is a good one, and one that speaks to the job as opposed to the remuneration.

When you get the answer "maybe 20, it varies" rather than end the interview, understand the environment. So I'm going to assume that going to meetings for you is something you don't like to do (and I can certainly understand that, worthless meetings are worthless) But in this same stream of questions my next one after 20 would be "How many of those meetings are run by the person in this position?" If the previous person in that position was calling 15 meetings a week it would credible to ask if the job required them to do that (and if so why) or if it was simply their preferred way of operating? If you are leading/managing a project with a fairly large scope you may find it easier to have a short meeting with the sub-project groups than read i _m_ r emails each week, where i, m, and r are issues, members, and replies. But if its a small company and the previous person just wanted to have meetings with everyone to feel useful, that might not be your style either. If there are 20 people/groups that want the person in this position to be at their meeting then its a valid question of how you might want to scale that position in a way that doesn't involve meetings.

Money is a "score" and number of meeting are a "task". Mercenaries go for a big score and don't care about the tasks needed to get there. There isn't anything wrong about being a mercenary, it is just another community of people.

</comment></comment></comment></comment></comment><comment><USER5> I think the author makes a couple flawed assumptions. First: that all people are motivated primarily by money, and second: things that have no direct monetary value have no value.

Some people value the work they do, or the work their company does. Some people value their teams and the people they work with on a daily basis. Some people value working in a nice space, or their own spaces. Some people would like to look back at 65 at what they have built, rather than what they have earned, not really caring that they may have earned 20% less.

I do agree that chasing seniority for title only can be a fools errand. A higher title can be a substitute for self-esteem issues, but on the other hand, it can also lead to higher pay scales.

Also, I've known companies to reward those "corporate idealists" with more than just carnival tickets.... If your company doesn't reward putting in the occasional extra hour and seeing things through to completion, it's a bad company to work for.

<comment><USER6> Agreed.

Who says social comparison (discarded by this article as "carnival tickets") plays no role in satisfaction? Research shows that making more than peers is a better predictor of happiness than absolute income ([http://e-archivo.uc3m.es/bitstream/handle/10016/15313/happin...](http://e-archivo.uc3m.es/bitstream/handle/10016/15313/happiness_perez_JPE_2011_ps.pdf?sequence=1))

Great article.

</comment></comment><comment><USER7> While the caricature is entertaining, I have never worked in a corporation that works at all like what's described. At companies I've worked at, if you're checked out, you do not last. At companies I've worked at, some prodigies have very high positions at 30; some maintenance steady goers may find a good pace in the middle into senior age. A successful corporation lets every employee both contribute, and stretch. And working with experienced people who know what they are doing is the best way to learn real skills that can't be learned from reading an open source project wiki.

<comment> UK-AL That or your an idealist. And those prodigies have token seniority as described.

<comment><USER8> > That or your an idealist. And those prodigies have token seniority as > described.

This is what I don't like about articles like this. It provides a language to put down and dehumanize others without offering anything positive.

29y/o CEO? Sociopath.

Coworker that's been promoted ahead of me? Idealist, just mere token seniority.

I'll earn more money than him by job hopping a few times anyways.

</comment></comment></comment><comment><USER9> I'm now over 45, and I've never, ever worked for a company like that.

So ask yourself: how do bloggers that rant about such companies get this wisdom?

It's always the people that play the game and fail that loudly blame the game.

<comment><USER2> I expect it is unfair to generalize that "people that play the game and fail" blame the game. Rather there are a number of people who do not understand how communities work, and never have, and so they don't recognize when they are being antagonistic to the very people they want to be friends with.

I remember having a conversation with a relatively new programmer who was ranting they were "fed up with all the political BS and just wanted to write code and be left alone." That is a sentiment I completely resonate with, but in this case the "political BS" was folks trying to help this person become more effective in the organization.

What was impairing their efficiency was that this individual wrote code in a vacuum. people trying to integrate with it were frustrated when this developer decides on Friday night that they don't like how they structured the APIs with an opaque handle and convert everything into a callbacks which appears as the new API to the rest of the organization on Monday. It wasn't "political BS" that was causing these folks to be angry with this individual, it was that this individual was actively making their job harder than needed.

But when it became clear that more people where being hindered than helped, I was asked to step in and see if I could help this person see what the real issues were. I was only 50% effective, they understood the issue but decided to leave rather than slow down to listen to the needs of the other engineers. To this day they assert they were 'forced out' but nothing could be further from the truth.

<comment><USER10> > _I was asked to ... see if I could help this person .... they understood the > issue but decided to leave .... To this day they assert they were 'forced > out' ...._

Off-topic rant: For the love of God, will everyone please STOP with the use of _they_ as a gender-neutral singular pronoun. History shows us a better way: Decades ago, feminists coined the term _Ms._ , which has all but totally replaced the old-fashioned _Miss_ and _Mrs._ Those concerned with gender neutrality should do likewise, instead of inflicting ambiguity and inaccuracy on the rest of us by (mis)using _they_.

</rant>

<comment><USER2> I understand your rant, and I've been around for a while, I explicitly use the gender neutral pronoun because of a post I made here where someone took my LinkedIn history, gender of the person, and subject and back tracked it to an individual who later, and quite reasonably, chastised me about sharing in public.

Since that time, I've paid more attention to whether or not I can share an example at _all_ given how easily the Internet allows one to deduce such things. Not surprisingly, the Internet doesn't like obviously fictionalized examples either so it limits my sharing to things about me and things which I can make reasonably opaque.

<comment><USER10> > _I explicitly use the gender neutral pronoun because of a post I made here > where someone took my LinkedIn history, gender of the person, and subject > and back tracked it to an individual who later, and quite reasonably, > chastised me about sharing in public._

That's certainly a valid concern. Another approach would be simply to keep repeating "the person" instead of _they_ , as in: _I was asked to ... see if I could help this person .... the person understood the issue but decided to leave .... To this day the person claims to have been 'forced out' ...._ That's a bit jarring, granted, but at least it doesn't promote linguistic abomination <g>.

On a related note, I was recently at a church service where the prayers had been changed to eliminate _any_ pronoun for _God_. EXAMPLE adapted from Psalm 103: _Bless the LORD, O my soul, And all that is within me, bless God 's_ [vice _His_ ] _holy name._

</comment></comment></comment></comment></comment><comment><USER11> Wow, this is a great read; it also sums up about every company I've ever worked at with more than a couple hundred people. It's amazing how many people will pull in more time than absolutely necessary on things they don't care about, even at tech companies, just to "get ahead."

<comment><USER9> If you've worked for multiple companies that function like that, that probably says more about you.

<comment><USER11> I can't tell if that's a rather passive-aggressive ad hominem or what, but sometimes its hard to know the true inner machinations of some of our "revered" tech giants until you've seen them from the inside. Needless to say that's not somewhere I stay for long.

</comment></comment></comment><comment><USER12> Averaging 60 hours a week - for a career - at a corporate job as a developer? That's not something I've witnessed. Projects can ramp up and down, but sustaining that level of hours for long clips is only something I've seen at startups where the whole team is invested. If you're putting in 60 hours every week, for years, for some corporation, then you've been had.

</comment><comment><USER13> The one thing I disagree with in this is the point about an office. Having an office matters. Being visible from behind sucks, and the open-plan stress means that you spend an unacceptable amount of your leisure time recovering from work instead of actually doing things. I'd gladly take a 10% pay cut not to deal with that. I don't give a shit about having a _nice_ office. I'd be fine with 50 square feet and a small window.

As a programmer, I'd want an office just to have some space where I can get work done. That's not because I'm a true believer or a corporate man. It's entirely selfish: my career will be better if I succeed than if I fail, and these terrible open-plan offices do enough damage to day-to-day performance that I'd rather not be in one. Though I'm a Sociopath/opportunist I generally find that it's usually in my interest to work hard, do my best, and play fair. In a conflict, I'll favor my interests above almost anyone else's, but I also avoid such conflicts as much as I can.

Other than that, I think that the carnival cash metaphor is spot-on. Moreover, I think the spawning issue (i.e. that sociopaths/opportunists don't usually start at the top) is worth note in technology because it's such a young industry. The age discrimination and the Scrum nonsense are all about creating a permanent culture of the clueless/idealist mindset-- at all levels. The VC- funded ecosystem is one where the Sociopaths get to play multiple companies (as investors, advisors, and executives placed into successful companies after the fact) and the checked-out MacLeod Losers (pragmatists) are shut out by the time they wise up. The goal is to produce monochromatically Clueless/idealist companies that the Sociopaths/opportunists in VC can manage from a distance and discard if they become inconvenient.</comment>


Ask HN: How does Gmail detect promotional emails? - <AUTHOR>

I've always wondered what the magic code was that Gmail used to detect Promotional Emails. Is it some super Regex or something far more complex? <comment> noir-york Almost certainly some statistical method - perhaps Bayesian.

<comment><AUTHOR> Thanks for the reply, I assume that would require a large set of actionable data? I'll definetly start reading up on Bayesian Statistics.</comment></comment>


Why indie developers can't win on the App Store - <AUTHOR> http://blog.tapdaq.com/post/67579337537/why-indie-developers-cant-win-on-the-app-store <comment><USER2> The real reason why indie developers can't win on the App Store: There's just too @%!@%@ many indie developers.

Let's look at the numbers from a different direction: Apple reports that the App Store has 1.25 million apps earning $5bn in revenue last year. But 25 companies take half of the App Store revenue, leaving only $2.5bn for everyone else. That means that if you knocked out all 25 of the biggest earners on the App Store, the other 1.25 million apps would see their average annual revenue _double_ to. . . about $4,000 annually. Hot damn! Call home, tell the spouse to put the Hamburger Helper back in the pantry, the kids are eating at Chucky Cheese tonight!

Everyone wants to be a game developer. . . but just like every other job that everyone wants to have, it ends up being a cutthroat business. The big players - the Apples, the movie studios, the recording studios - certainly don't do anything to make it better. But even without them it'd still be wretched place to try to make a living, simply because of sheer volume of competition. There's something to be said for having a day job to survive on while you're trying to make it.

As developers we should count our blessings in that department: unlike for so many other high demand careers, chasing our dreams requires developing skills that are also highly demanded for less glamorous work. We're fortunate to be able to practically default into fantastically lucrative day jobs that still offer reasonably enjoyable work.

By which I mean boring corporate jobs. Working long hours for low pay to go chase somebody else's dream at XYZ startup is probably the wrong choice here. Get the boring 40hr/wk corporate job. You'll make enough money to finance the stuff you really want to do, and better yet you'll have enough free time to actually do the stuff you really want to do.

</comment><comment><USER3> I don't see this topic as being any different than any other business pursuit. As a general rule, it takes money to make money. The very pervasive and (extremely) unlikely perception that your company can "make it" overnight just by building something well only holds those companies back. Create a solid business plan, building a product that is "good enough" and backing it up with a marketing budget has been a tried and true method for decades. The perception is only further deformed by what we see in the media (Instagram being sold for billions, SnapChat being wooed, the Twitter IPO, etc). The quicker you realize that it's harder than a cold day in hell, the quicker you'll pick your business idea off of the ground and make something based on a smart business plan.

</comment><comment><USER4> My guess(es):

1) They rely on the AppStore to do their marketing for them because you could get away with that in the early days (or if you make the front-page consistently). With 1million apps, that's not going to work. Turns out, you have to do the traditional thing and go and pound the pavement, and market your games yourself.

2) The price-points are crap. Selling software for $1 is crap-business, and not every game is compatible with the freemium or subscription model. You really need the price-point in the $20-40 range to be sustainable. You sell 1million games, and you get $700k?! Moving that many units is a massive success and yet all it does it maybe cover your development costs and rent.

3) There's a lot of shovel-ware out there, and it's just too hard to punch through all that noise.

</comment><comment><USER5> Ok, the reason "indie" devs aren't doing as well is if you aren't ballsy enough to charge enough for their apps for them to be profitable.

Consider the $50 game vs $0.99 game. To make the same money from a dollar game you need to sell 50x as many copies basically. As an indie dev with minimal budget, making money in a market where significant revenue means significant volume, it is going to take a lot of advertising to make a dent.

What the bigger companies have done is made games that are F2P with a much higher value via micro transactions. Their revenue per install might be something like $10 whereas the indie dev who doesn't want to charge as much revenue per install might be closer to $5. That means the people with the higher RPI can advertise more or spend more per install and still be profitable.

It's not unfair to indies so much as it is that indies aren't charging enough to make the numbers work. Also, if indies don't have the cash flow to float that $5 per user over 12 months that it takes to get it, they aren't going to be able to afford the $2.50 CPI.

The same economics play out in many, many businesses. Business is always a game of balancing production, operating, and sales costs against revenue. Whoever is best at that wins.

Maybe indies just aren't very good at business.

</comment><comment><USER6> >Overall, King.com spends over $350k (Source: King.com) a day on mobile ads and it can be assumed that the other 4 developers have ad budgets within this range.

I have said this other places, but I will repeat it here. Kudos to them for finding (or creating) a successful niche with high demand. I find it sad though that sooo much money is going to marketing games that don't push technology further, or really fundamentally help things get better.

You could argue that if you add up all the marginal increases in utility/happiness that are gained from playing any of the saga games that it might be a net gain, but I think that is a stretch. I find it tragic that this is how the market allocates resources (time and capital).

<comment><USER7> Blame the piracy laws. These games are, of course, inherently worthless but the current policies are propping them up when innovation should be in other places.

<comment><USER8> That makes no sense. If they were inherently worthless then no one would pay to play them.

You mistakenly conflate cost to produce with value to consumers. Obviously the content has value to consumers.

<comment><USER7> People only pay for them because they don't have any other choice. If it was legal to sponsor an Android fork that had a pirate version of the Play Store, I'm _sure_ all of the hardware manufacturers would be shipping it with their phones.

<comment><USER8> That's irrelevant. You said that the games were "inherently worthless".

You're attempting to twist the language so words don't mean what most people think they mean and I'm not buying it.

<comment><USER7> Fine, you are correct. I didn't think you were nitpicking my choice of words.

They _should_ be worthless.

</comment></comment></comment></comment></comment></comment><comment><USER9> I hate the king.com people. Their mobile app ads are almost malware. They do scammy App Store redirects when you're on certain websites. No, I don't give a shit about candy crush.

<comment><USER8> Yeah, King.Com is pretty aggressive.

The funny thing with Candy Crush is that it's a free app. The only thing that costs money is if you want to "cheat" to get extra turns and goodies to help you get past levels. Totally defeats the purpose of playing a puzzle game, as far as I'm concerned, but they make tons of money off those who are fine with dishing out cash to see that next level sooner.

<comment><USER10> the funny thing with Candy Crush is that it looks like a free app. If you want to keep advancing levels you will eventually need to pay as the difficulty will make it near impossible to win without paying...

<comment><USER8> I'm up to level 197, haven't paid a dime.

</comment></comment></comment></comment><comment><USER11> If by "win" you mean "be in the top 5 grossing", there may be some meat here. But it would be surprising for an independent anything to break into the top 5 grossing in any market, software or otherwise, in a few years.

But if by "win" you mean "earn a comfortable living and possibly modest riches" then I doubt this thesis has any legs at all.

<comment><USER12> The irony that the top developers started as indie developers for the most part, and simply grew their business with successful products seems to be lost on the author.

<comment><USER13> Assuming that that's true (idk if it is), they were there first, when offerings were more limited and the big wigs hadn't gotten in. My little hypothetical appstore game isn't going to compete with offerings like Angry Birds into which probably many man-years have gone in already. OP's point is that it's harder to get in NOW.

<comment><USER12> When is this ever not the case? It's harder to own land now than it was when the government was giving it away for free. That in no way makes it impossible to own land, and no one says stupid things like "Why people can't win the land grab in America".

Build a good product, it will sell. Build an innovative product that scratches the itch of millions and you get onto the top 5 list.

What I see far too often is developers passing off a derivative or poorly executed idea, and complaining that the marketplace is the problem. It's not.

<comment><USER13> I don't see why you're looking at it as an either-or case. I'm sure there are plenty of poorly executed ideas in the marketplace, but that doesn't invalidate my point. To use your land analogy, it's now just getting more and more expensive to buy land in America - just as it's getting more and more expensive (in terms of cost and effort) to put out an application that meets the market's increasingly higher standards.

I'm not saying something is WRONG with the market, I'm making an observation about the state of the market.

<comment><USER12> There are a million apps, and only 5 people that can 'win' the app store at any time. To say it's more difficult to rocket to the top is an inane and obvious observation. It has nothing to do with indie development, it's about the fact that there are 5 top spots for one million apps. By definition, 99.999995% aren't going to win, regardless of whether they are indie or not.

</comment></comment></comment></comment></comment></comment><comment><USER14> @nodemaker I think this raises some really interesting points. Based on my experience moderating an exclusive app entrepreneurs group on Facebook I have seen this come numerous times where an indie developer starts a post in frustration complaining how he needs a huge marketing budget to go up in the ranks on App Store. I hope either Tapdaq or somethings else can provide an effective solution for this problem.

<comment><USER15> What's the group called?

<comment><USER16> Well it's "exclusive" so I wouldn't expect a straight answer ;)

</comment></comment></comment><comment><USER17> Mojang is on the list and they were an Indie developer and they don't do advertising.

<comment><USER18> I often see people treating Minecraft as an unrepeatable exception to all rules, and maybe to some extent it is. But it also proves a number of points:

Graphics don't matter as long as you have a coherent style. Pre-written "story" is not critical to games, and enabling player creativity is something that will be eagerly received. One person really can make a great game all by themselves in a reasonable amount of time.

Amusingly, the only lesson learned by most developers is that people really want block-based worlds. Nah. If you look at Minecraft and Dwarf Fortress as just the _beginning_ of what enabling player creativity in a simulated world can look like, that way lies the future.

The indie road to success is the path not taken by AAA games. There's so much potential for what games can be that hasn't been explored by mainstream publishers, and Minecraft is a superb example of that.

</comment></comment><comment><USER19> Any advice on cheap marketing, or simply how to get the word out?

I've tried emailing a few blogs to get reviews, and now I'm trying to use Twitter (@h4labs). I'm building iOS language learning software. The apps could still use work but I think I'm approaching "useful."

The one interesting observation that I have is that since I wasn't making many sales at $1.99, I raised my price on Monday to $2.99. As of this morning, I already have as many sales this week as last week. In other words, for the people who want my app, the extra dollar doesn't mean much.

By the way, constructive, even brutal, feedback is always welcome.

[http://appstore.com/h4labs](http://appstore.com/h4labs)

Back to work... gotta get one more release before the holidays.

<comment><USER20> Not marketing advice per se, but I highly recommend subscribing to Hack Design [1] and giving more thought to not just the visual design and presentation of your apps, but also the audience. My personal opinion is that non-game indie devs need a niche, what's yours? If you're selling to school kids, then find a good hook. For example, public middle schools in California require Spanish fluency. Sell to the parents of those kids perhaps? Or if you're going after the international tourist, try to combine the language skills with travel info some how: "We'll teach you Spanish before you're plane lands!"

Also, I'm sure I'm not the first one to say it but you've gotta move to iOS7. Do the easy thing and try using all native color scheme. As a design exercise [2] it will help you focus on content.

Good luck!

[1] [http://hackdesign.org/](http://hackdesign.org/) [2] [https://medium.com/design-ux/7348987453e3](https://medium.com/design- ux/7348987453e3)

</comment></comment><comment><USER21> The problem is the ranking- and discovery system. If you are not on any of the charts, you won't be seen. If you would remove the charts, and find some other recommendation system, it might give small app companies a chance, instead of being only about the $$$.

</comment><comment><USER22> There are certainly indy games that have got to the top of the appstore chart. Pou and Plague Inc are two examples (I believe both are single person studios), neither of which have significant viral components either.

</comment><comment><USER23> I came to a very similar conclusion while writing [http://www.nGage.tv](http://www.nGage.tv). I cannot compete with the "big boys" by myself but by empowering developers with a community and an API designed to support the website "theme" (in my case coupling streaming content with social engagements) you have a platform that has a chance of competing.

</comment><comment><USER24> Shorter indie devs: "What's the music industry? Surely we aren't anything like that..."

<comment><USER25> If only I could discover new games/developers at the rate of 1 - 3 an hour, whilst working...

</comment></comment><comment><USER26> I'm curious if these 'elite' developers budget out a chunk of their profits to buy their own apps and/or free-to-play 'points' simply as a means of keeping their games on the top grossing lists.

<comment><USER27> I doubt it. What would be the point of paying your way into the top grossing? I'd bet that almost all "normal" users go only to Top Paid (cause that's the default) and Top Free (cause it's free).

</comment></comment><comment><USER28> I agree with what other have already said. The main challenge is the noise in the store… way too many crappy apps that still take up space.

However, you need to define "win". Just like in any other business if you want to make millions you need to put in big cash (just look at real estate). If you win by having a revenue that allows you a comfortable life, it's still doable.

I've been an independent developer for 4+ years and have been living on it since. I make mostly passive revenue with my apps and play tennis 2-3 times a week during the day. I certainly will not complain.

</comment><comment><USER29> The bit about app store search is so true, in general I feel the app store could get a lot more money out of me if they improved the search functionality and added more linking between apps.</comment>


Mac owners are cooler than everybody else - <AUTHOR> http://advice.cio.com/diann_daniel/are_mac_lovers_better_than_everyone_else A recent study found that Mac owners are more liberal, less modest, and more assured of their superiority than the population at large. <comment><USER2> :-)

If Mac owners are _"assured of their superiority than the population at large"_ then Windows users probably pee in their pants (just a drop or two) every time a dorbell rings, while Linux users are genuinely poised for world domination.

</comment><comment><USER3> This is patently true.

<comment><USER4> Yes, indeed! I bought my macbook just so I could parade it around to show my superiority.

The fact that the general user experience is better than windows and requires less tinkering than linux had nothing to do with it.

</comment></comment><comment><USER5> Why do I care about the opinions of someone that doesn't know the difference between ware and wear?

<comment><USER6> _Where_ did he write that?</comment></comment>


Ask HN: How do you use ORMs? - <AUTHOR> What sorts of things do you do with your ORM, that couldn't be done inside the database?<p>I'm trying to decide Howe much to invest in database abstractions (which sorry multiple tools/languages) vs ORM abstractions (easier to manage). <comment><USER2> I pretty much use ORM for everything database related. I never wanted to spend the extra time learning SQL syntax when I could do everything using an abstraction layer in my chosen language. Of course, this strategy doesn't work for highly scalable applications because you don't want the extra overhead added by the abstraction layer to slow your applications down.

<comment><USER3> This strategy also breaks apart when you have a little more data to be extracted or when you need to reason about performance. It works when you mostly need to put your objects somewhere and retrieve them later.

<comment><AUTHOR> This is kinda the sense I get. But then I keep seeing shops that outsource and there's raw SQL all over and that seems messy too.</comment></comment></comment>