Emergent Tool Use from Multi-Agent Interaction - <AUTHOR> https://openai.com/blog/emergent-tool-use/ <comment><USER2> Nice visualizations and explanation!

You might want to make it clearer that the agents don't actually receive any visual observations, but rather directly the xy positions of all other agents and objects.

This also seems very similar to "Capture the Flag: the emergence of complex cooperative agents" ([https://deepmind.com/blog/article/capture-the-flag- science](https://deepmind.com/blog/article/capture-the-flag-science))?

Regarding the conclusion:

> We've provided evidence that human-relevant strategies and skills, far more > complex than the seed game dynamics and environment, can emerge from multi- > agent competition and standard reinforcement learning algorithms at scale. > These results inspire confidence that in a more open-ended and diverse > environment, multi-agent dynamics could lead to extremely complex and human- > relevant behavior.

This has been well established for a while already, e.g. the DeepMind Capture the Flag paper above, AlphaGo discovering the history of Go openings and techniques as it learns from playing itself, AlphaZero doing the same for chess, etc.

<comment><AUTHOR> Good catch! Will update the post to be explicit that there are many pre- existing awesome results in this vein.

<comment><USER3> Any possibility of releasing the simulation environment? Looks quite cool!

<comment><USER4> At the top of the article are two open source repo links:

Environment Generation: [https://github.com/openai/multi-agent-emergence- environments](https://github.com/openai/multi-agent-emergence-environments)

Worldgen: [https://github.com/openai/mujoco- worldgen](https://github.com/openai/mujoco-worldgen)

Is this what you were looking for?

</comment></comment></comment></comment><comment><USER5> The state space here looks pretty small, it seems to me that with so much training it's just a case of brute-force search. When I think of "tool use" in regards to the intelligence of early humans, I imagine something more like [0] where the state space is enormous and it takes a good deal of reasoning and planning to get to a desired result.

[0] [https://www.youtube.com/watch?v=BN-34JfUrHY](https://www.youtube.com/watch?v=BN-34JfUrHY)

<comment><USER6> It's unclear to me that we navigated the state space so discretely. My guess would be that we used a combination of rock throwing + stock hitting before eventually deciding that combining the two might be fruitful.

After the idea is polished it looks clever, but it may have been invented through a series of mostly random steps

</comment></comment><comment><USER7> Amazing. Very cool to see this sort of emergent behavior.

I also very much enjoyed this section:

"We propose using a suite of domain-specific intelligence tests that target capabilities we believe agents may eventually acquire. Transfer performance in these settings can act as a quantitative measure of representation quality or skill, and we compare against pretraining with count-based exploration as well as a trained from scratch baseline."

Along with the videos, I can't help but get a very 'Portal' vibe from it all. "Thank you for helping us help you help us all." \- GLaDOS

<comment><USER8> Did you see the 'Surprising Behaviors' at the bottom? Pretty funny

[https://openai.com/blog/emergent-tool- use/#surprisingbehavio...](https://openai.com/blog/emergent-tool- use/#surprisingbehaviors)

</comment></comment><comment><USER9> Looks awesome. I tried coding up a multi-agent system for my CS degree and it was incredibly complicated. I was trying to implement an algorithm I found to give each agent emotions of fear, anger, happiness and sadness in order to change their behaviours... it was way more difficult than I expected but you can read more about it here if you're also interested in this stuff. The 3D graphics in this example are way cooler than my 2D shapes.

[https://medium.com/@dshields/working-with-emotional- models-i...](https://medium.com/@dshields/working-with-emotional-models-in-an- artificial-life-simulation-c6309a586e55)

<comment><USER10> This is really interesting, thank you for sharing!

</comment></comment><comment><USER11> The animations are nice, compared to a default visualization with dots and lines moving around. Was this done just for the public release, or was it worth it to researchers to have an eye-pleasing visualization while doing the experiments?

<comment><USER12> The environment was actually an important part of the project. It does physics simulation. Having such a 'realistic' environment allowed the agents to discover all sorts of cheats (they appear at the end of the article).

<comment><USER13> They're talking about the visualization, not the physics. The agents aren't getting visual input. That would make things much, much slower.

<comment><USER14> Right but to fully understand what's going on you need to also visualize the physics in a 3D world - just dots and lines and squares wouldn't fully show what's going on. This may be close to the simplest visualization that made sense

<comment><USER15> The visualizations look great, but wouldn't run on an N64, which had many physics games. I'm wondering the same thing as the OP--was this advanced level of graphics used during the research, or was the styling added after the fact for readers? A low res visualization seems like it would do the job equally well, but maybe not. Curious what they are finding and whether there are benefits to having a great looking visualization during the EDA phase.

<comment><USER16> Researchers have much better graphics tools available to them today than they did in the N64 era. Basic familiarity with e.g. Unity would be enough to run these sorts of simulations.

</comment></comment></comment></comment></comment></comment><comment><USER17> One plausible, perhaps optimal strategy in the second arena is for the hiders to build a shelter around the seekers and lock them in place, circumventing the whole cat and mouse over ramps and ramp surfing (which the seekers would never be able to access). I wonder why this strategy is not arrived at.

<comment><USER18> There are multiple seekers, and the seekers may not be placed close together.

<comment><USER19> At one point in the video, it looked like a hider moving a object past a frozen seeker jostled the seeker with it. I wonder if it's possible to use the objects to push seekers together, then "jail" them.

</comment></comment></comment><comment><USER20> Even my work with basic circuits for sea slugs led to "cooperative" behavior:

[https://austingwalters.com/modeling-and-building-robotic- sea...](https://austingwalters.com/modeling-and-building-robotic-sea-slug/)

I think sometimes we see what we want to see. Not saying it's not interesting work, just that it's less round breaking than you may think.

</comment><comment><USER21> I'm completely amazed by that. The hint of a simulated world seems so matrix- like as well, imagine some intelligent thing evolving out of that. Wow.

</comment><comment><USER22> This is incredible. The various emergent behaviors are fascinating. I remember being amazed a decade ago by the primitive graphics in artificial life simulators like Polyworld:

[https://en.wikipedia.org/wiki/Polyworld](https://en.wikipedia.org/wiki/Polyworld)

[https://www.youtube.com/watch?v=_m97_kL4ox0&t=9m43s](https://www.youtube.com/watch?v=_m97_kL4ox0&t=9m43s)

It seems that OpenAI has a great little game simulated for their agents to play in. The next step to make this even cooler would be to use physical, robotic agents learning to overcome challenges in real meatspace!

<comment><USER23> hmm, yes in the story I'm envisioning the AIs don't wipe out humanity because they have achieved sentience, but just because it turns out killing all humans is an optimizing component of solving some other problem.

<comment><USER24> Asimov 3 rules as the final policy when making decisions should sort this problem out. This assumes that the rules cannot be changed by the AI.

<comment><USER25> I've always been very incredulous that there would be any possibility of taking something sufficiently complex to be considered an AGI and hard-coding anything like the 3 rules into it.

<comment><USER26> By the same token, I'm extremely suspicious of the idea that such a sufficiently complex AGI could also be dumb enough to optimize for paper clip production at the expense of all life on earth (or w/e example).

<comment><USER27> ...and many would say that's because us humans are bad at imagining optimizing agents without anthropomorphizing them. This is a reasonable, even typical suspicion that many people share! The best explanation I know of why it's unfortunately wrong is by Robert Miles in a video, but if you prefer a more thorough treatment, you could also read about "instrumental convergence" directly. If you find a flaw in this idea, I'd be interested to hear about it! :)

Robert Miles' video: [https://youtu.be/ZeecOKBus3Q](https://youtu.be/ZeecOKBus3Q)

Instrumental Convergence: [https://arbital.com/p/instrumental_convergence/](https://arbital.com/p/instrumental_convergence/)

Now afaik nothing in this argument says that we can't find a way to control this in a more complex formalism-but we clearly haven't done so yet.

<comment><USER26> Sorry, just saw this. I think it's his assumption that an AGI will act strictly as an agent that's flawed. It requires imagining an agent that can make inferences from context, evaluate new and unfamiliar information, form original plans, execute them with all the complexity implied by interaction with the real world, reprogram itself, essentially do anything... except evaluate its own terminal goal. That's written in stone, gotta make more paperclips. The argument assumes almost unlimited power and potential on the one hand, and bizarre, arbitrary constraints on the other.

If you assume an AGI is incapable of asking "why" about its terminal goal, you have to assume it's incapable of asking "why" in _any_ context. Miles' AGI has no power of metacognition, but is still somehow able to reprogram itself. This really isn't compatible with "general intelligence" or the powers that get ascribed to imaginary AGIs.

I'm certainly no expert, but I expect there will turn out to be something like the idea of Turing-completeness for AI. Just like any general computing machine is a computer, any true AGI will be sapient. You can't just arbitrarily pluck a part out, like "it can't reason about its objective", and expect it to still function as an AGI, just like you can't say "it's Turing complete, except it can't do any kind of conditional branching." EDIT better example: "it's Turing complete, but it can't do bubble sort."

This intuition may be wrong, but it's just as much as assumption as Miles' argument.

I'm also not ascribing morality to it: we have our share of psychopaths, and intelligence doesn't imply empathy. AGI may very well be dangerous, just probably not the "mindlessly make paperclips" kind.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> This is visually very impressive, of course, but what is the significance of this work? I am not very familiar with intelligent agents research so I don't understand to what extent learning cooperative tool use in an adversarial environment (if I understand correctly what is shown) represents an important advancement of the state of the art in intelligent agents research, or not.

In any case this is a simulation- so it's basically impossible to take the learned model and use it immediately in a real-world environment with true physics and arbitrary elements, let alone with unrestricted dimensions (the agents in the article are for the most part restricted to a limited play area). So if I understand this correctly the trained model is only good for the specific simulated environment and would not work as well under even slightly different conditions.

</comment><comment><USER29> I love how the 3D visualization and game selection make their research immediately relatable - right down to the cute little avatars!

 _" We've shown that agents can learn sophisticated tool use in a high fidelity physics simulator"_

I always suspected to evolve intelligence you need an environment rich in complexity. Intelligence we're familiar with (e.g. humans) evolved in a primordial soup packed with possibilities and building blocks (e.g. elaborate rules of physics, amino acids, etc). It's great to see this concept being explored.

It reminds me of Adrian Thompson's experiments in the 90's running generational genetic algorithms on a real FPGA instead of mere simulations [1].

After 5000 generations he coaxed out a perfect tone recognizer. He was able to prune 70% of the circuit (lingering remnants of earlier mutations?) to find it still worked with only 32 gates - an unimaginable feat! Engineers were baffled when they reverse-engineered what remained: if I recall correctly, transistors were run outside of saturation mode, and EM effects were being exploited between adjacent components. In short, the system took a bunch of components designed for digital logic but optimized them using the full range of analog quirks they exhibited.

More recent attempts to recreate his work have reportedly been hampered by modern FPGA's which make it harder to exploit those effects as they don't allow reconfiguration at the raw wiring level [2].

In Thompson's own words:

 _" Evolution has been free to explore the full repertoire of behaviours available from the silicon resources provided, even being able to exploit the subtle interactions between adjacent components that are not directly connected.... A 'primordial soup' of reconfigurable electronic components has been manipulated according to the overall behavior it exhibits"_

\---

[1] Paper: [http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=669...](http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=6691182CC83AE8577D7C44EB9D847DA1?doi=10.1.1.50.9691&rep=rep1&type=pdf)

Less technical article: [https://www.damninteresting.com/on-the-origin-of- circuits/](https://www.damninteresting.com/on-the-origin-of-circuits/)

[2] [https://www.reddit.com/r/MachineLearning/comments/2t5ozk/wha...](https://www.reddit.com/r/MachineLearning/comments/2t5ozk/what_ever_happened_with_the_evolutionary/cnxfg1s?utm_source=share&utm_medium=web2x)

</comment><comment><USER15> What is the size of these "strategies", measured in weights,bytes, or whatever measurement you look at?

<comment><USER11> 1.6 million parameters. There are some details in section 5 and appendix B.7 of [https://d4mucfpksywv.cloudfront.net/emergent-tool- use/paper/...](https://d4mucfpksywv.cloudfront.net/emergent-tool- use/paper/Multi_Agent_Emergence_2019.pdf)

<comment><USER15> Thanks! I like that section on how batch size affects convergence. I wonder how parameter size limits would similarly affect which Stages could be reached. I would not be surprised if you could hit those stages with 100x or fewer params.

</comment></comment></comment><comment><USER30> Has any intelligence arisen without multi-agent interaction?

Probably belongs in our definition of intelligence.

</comment><comment><USER31> Am I misunderstanding something?

Instead of teaching the "AI" intelligent rules or rules for creating rules for maximising their goals. They teach them nothing, which means they have 0 usable high level knowledge. And the "AI" pure bruteforce for finding empirically best solutions for this ridiculously simple universe.

How is that advancing research? This is just a showcase of what modern hardware can do, and also a showcase of how far we are from teaching intelligence. My brain understand the semantics of this universe and would have been able to find most strategies without simulating the game more than once in my head. So definitely this is a showcase of how far (bruteforce is like step 0) we (or at least openAI) are from making AGI.

<comment><USER32> Some AI researchers believe that using learning methods with no built-in prior knowledge and throwing a bunch of compute at them is the path to building effective AI. I'm thinking of Richard Sutton in particular:

\- Bitter Lesson essay: [http://www.incompleteideas.net/IncIdeas/BitterLesson.html](http://www.incompleteideas.net/IncIdeas/BitterLesson.html)

\- A lecture of his on temporal difference learning, which is a "model-free" method of reinforcement learning: [https://www.youtube.com/watch?v=LyCpuLikLyQ](https://www.youtube.com/watch?v=LyCpuLikLyQ)

I personally don't agree with his emphasis on model-free learning, but it's not the case that people are building model-free RL agents because they don't understand the trade off that they're making.

</comment></comment><comment><USER33> Finally Auotcirricula gets some love! Discussed in some detail in [https://www.talkrl.com/episodes/natasha- jaques](https://www.talkrl.com/episodes/natasha-jaques)

<comment><USER33> Natasha Jaques explains the idea at about 39:50

</comment></comment><comment><USER34> I wonder if it's possible to incorporate a monkey see monkey do aspect to the learning algorithm that could observe human's playing the game and incorporate that information into its models?

<comment><USER12> Yes, it's called imitation learning and is a subfield of reinforcement learning. The problem is that even a small error could gradually accumulate and cause the sequence of actions to diverge. RL agents learn not just how to act in a given situation but also to evaluate possible actions, situations and even to model the environment. That way they can adapt dynamically instead of diverging from the optimal actions.

<comment><USER34> Interesting, ideally it uses the observed human behaviors to seed/inform it's own attempts as a shortcut to advanced behavior without the many millions of generations needed.

</comment></comment></comment><comment><USER35> Great viz, design & structure! But for the first time, I had the impression that you didn't report anything new or different. All the takeaways of this work were pretty obvious given the last couple of years research. Am I missing anything?

</comment><comment><USER36> I have a friend who observed similar emergent behavior in an a-life (gene- based from what I understand) simulation he created, in an environment of "tanks in a maze" (or something like that).

The "genes" consisted a simplified assembler (run on a VM) that could describe a program the tank would use to control itself - it could sense other tanks within line-of-sight to a certain degree, it could sense walls, it could fire its cannon, move in a particular direction, sense when another tank had a bearing (cannon pointed) on itself, etc.

He set up 100 random tanks (with random "genes"/programs) and let the simulation run. Top scorers (who had the most kills) would be used to seed the next "generation", using a form of sexual "mating" and (pseudo-) random mutation. Then that generation would run.

He said he ran the simulation for days at a time. One day he noticed something odd. He started to notice that certain tanks had "evolved" the means to "teleport" from location to location on the map. He didn't design this possibility in - what had happened was (he later determined) that a bug he had left in the VM was being exploited to allow the tanks to instantaneously move within their environment. He thought it was interesting, so he left it as-is and let the simulation continue.

After a long period of running, my friend then noticed something very odd. Some tanks were "wiggling" their turrets - other tanks would "wiggle" in a similar fashion. After a while all he could deduce was that in some manner, they were communicating with each other, similar to "bee dancing", and starting to form factions against each other...

...it was at that point he decided things were getting much too strange, and he stopped the experiment.

Sadly, he no longer has a copy of this software, but I believe his story, simply because I have seen quite a bit of other code and have worked closely with him on various projects since (as an adult) to know that such a system was well within his capability of creating.

At the time, he was probably only 16 or 17 years old, the computer was a 386, and this was sometime in the early 1990s. I believe the software was likely a combination of QuickBasic 4.5 and 8086 assembler running under DOS, as that was his preferred environment at the time.

I've often considered recreating the experiment, using today's technology, just to see what would happen (at the time he related this to me, as an adult, he asked me how difficult it would be to make a more physical version of this "game"; I'm still not sure if he meant scale model tanks, or full-sized - knowing him, though, he would have loved to play with the latter).

</comment><comment><USER37> As always, crazy interesting stuff coming out of OpenAI!

This is the type of stuff that amazes me - I really wish I had more of an opportunity to play with AI/ML in my day to day work.

<comment><AUTHOR> > I really wish I had more of an opportunity to play with AI/ML in my day to > day work.

Anyone who feels this way — we're hiring :)! [https://openai.com/jobs/](https://openai.com/jobs/).

(Also if I can answer any questions about OpenAI, feel free to ping me at email@example.com.)

<comment><USER38> Anything remote friendly? Unfortunately all jobs are in SF only.

</comment></comment></comment><comment><USER39> I dig the fine-tuning tests!

Did you end up using this as a way to estimate how "healthy" the agents are, or was this explored after the system was already working well?

</comment><comment><USER40> Does anyone know if there are some accessible GitHub projects that can do something similar to this? Would like to set up a new project with my nephew :)

</comment><comment><USER41> I, for one, really appreciate the raytracing in these visualizations. I wish for more box surfing examples.

</comment><comment><USER42> Anyone thinks the hiders will learn to box the seekers in entirely before the rounds start?

</comment><comment><USER43> This is just adjoint functors. Pls work out automatic integration. Dual numbers is where the path starts.</comment>


Show HN: Portal - Run apps on your own easy to use cloud server - <AUTHOR> https://portalplatform.net/ <comment><USER2> Sandstorm and portals are awesome. If you add integration with something like OpenStack and deploy the system behind corporate firewalls. I bet it would reduce the hurdles to enterprise sales. (If corporate teams can just one click install new services because they are are hosted internally)

<comment><AUTHOR> Thank you! Portal already supports booting VMs by emulating OpenStack's metadata service, that's how we're supporting CloudInit with Ubuntu and CentOS.

Businesses are an easy sell, but we want regular people on the internet to run their own stuff too :-)

</comment></comment><comment><USER3> Very cool! A few questions:

1\. Is the hardware infrastructure in house or built on another cloud provider? I ask because you offer several server locations. Am I afforded the same up-times I'd find with AWS or Azure?

2\. How do you deal with having multiple apps on the same port? Could Wordpress and another web server exist at the same time? Can I SSH to multiple machines?

3\. Do you have stronger specs on compute power? "Standard" doesn't really mean much to me.

4\. Great domain name.

<comment><AUTHOR> 1\. We're using all of our own hardware, co-located in good datacenters with high quality internet providers. I've been building and deploying servers around the world for over a decade, so I have some strong opinions on this. We may also use rented dedicated servers in similar facilities during the public beta, but that's temporary. Uptimes will be comparable.

2\. You can forward different external ports to the same internal ports on apps (e.g. port 31245 -> port 22 on your Ubuntu app). You can also launch VPN server and then ssh to your servers from inside your virtual LAN :-)

Web traffic is handled by the Portal system, so port 80 and 443 are "intercepted" by default. They proxy HTTP traffic to your apps based on the paths that you specify. You can forward /blog to one WordPress instance and /otherblog to another WordPress instance.

3\. The compute power levels are meant to be relative to standard usage, but benchmarks are probably better for hackers, so we'll do that.

4\. Thank you!

Great feedback, thank you!

<comment><USER4> For (2) can we add different domains to be used? It seems to be like it (from the screenshot, there's a select box for the domains) though I'm not sure. Thanks

<comment><AUTHOR> Yes, you can have multiple domains per account and map paths on them to different apps. Thanks for the questions!

</comment></comment></comment></comment><comment><USER5> This is awesome! I just signed up. A couple of questions:

\- If I want add my own app, will there be docs/examples on how to do that? I'd love to have my own app to deploy something like Jenkins.

\- What are the backup options? If I want to grab a snapshot locally (just b/c), is that possible?

<comment><AUTHOR> Thank you very much!

1\. There will be (basic) developer docs very soon. We'll make sure to send a link to everyone who has signed up.

2\. Yes, you can download snapshots of your data at any time. You can't upload them yet, but that's coming.

</comment></comment><comment><USER6> Looks cool but anyone know what the hardware specs (CPU/RAID/SSD model/etc...) are?

<comment><AUTHOR> Thanks! Performance should be on par with high quality VPS providers like EC2 using SSD instances. We're using all modern Intel CPUs and Samsung SSDs with Linux software RAID, currently.

<comment><USER6> What's the CPU to be exact? If it's something like an sandy/ivy-bridge I was thinking of giving you guys a try. We are not too happy with EC2's specs and looking for something faster.

<comment><AUTHOR> Yes and it should be faster, but I don't want to promise anything until we see what real world usage and performance is like during the beta. Thanks for the feedback, again.

</comment></comment></comment></comment><comment><USER7> This looks great and I'm always please to see products that make it easier for people run their own infrastructure without having to become sysadmins [1]. I especially like the demo video that describes how apps can be added.

However, one of the things I care about is the ability to self-host if I want to (even though I'm personally unlikely to). I can do this with Sandstorm but doesn't look like I can with Portal. Are there plans to make this possible?

[1] I work on a project with similar aims but takes a clean-slate approach, based on unikernels - [http://amirchaudhry.com/brewing-miso-to-serve- nymote/](http://amirchaudhry.com/brewing-miso-to-serve-nymote/)

<comment><AUTHOR> We want people to use Portal because it's the best way to run their stuff, not because of any kind of lock in. Making it easy to move away from Portal will be a core feature. If there aren't good alternatives, we may make it possible to download and run the Portal system on your own machine. Making it easy to export data might be easy enough.

Ultimately though, there's no way to have a server in the cloud without relying on _someone_ , so we're trying to build the ideal service for people who want privacy, performance, security, and freedom.

We hope other people will build similar services, so users have choice, and we will cooperate with anyone who has an open platform.

</comment></comment><comment><USER8> I would love to see an open source architecture with a common underling storage and social capabilities on which we could build apps and interface with others in some kind of decentralized network.

Maybe something like app.net but without a central server with multiple apps. I could install it on my server, dump my photos in there, share with other people, be able to manipulate those images with another app for filters or something. Does that makes any sense? Is there anything like it already?

Sandstorm and portal are cool projects but every app that you install uses it's own infrastructure, it's own database, it's own architecture, and that makes interoperability hard.

<comment><USER7> It's possible but I don't know of anything open source that exists yet. The stack I'm working on deals with the underlying issues you describe, including storage and identity/connectivity (which is the basis of the social network aspect you mention) [1]. I commented a few days ago on how such a system might work for the example of photos [2].

[1] [http://nymote.org/](http://nymote.org/) (which uses MirageOS unikernels [http://mirage.io](http://mirage.io))

[2] [https://news.ycombinator.com/item?id=9026778](https://news.ycombinator.com/item?id=9026778)

</comment></comment><comment><USER9> One question: Your basic package says 1GB of RAM. Is that 1GB available to me or is the OS using some of that to. The reason I am asking is I have been considering something like this to run a Minecraft server for my kids and their friends. Ever since I changed providers their port forwarding is broken and I can't serve it from home. However to run efficiently a Minecraft server needs 1GB to itself so if the OS is using some of that RAM getting the basic service is out and so are the other options since they are not affordable for me.

<comment><AUTHOR> If it doesn't work on a 1GB VPS, it probably won't work on the Standard plan. But it might, if you can allocate a bit less RAM for Minecraft's java process and/or use some swap.

I'm adding this to the list of things to test during the public beta, because we do want people to be able to run Minecraft on the Standard server. Java is just such a memory hog!

</comment></comment><comment><USER10> What's the difference between this and Sandstorm?

<comment><AUTHOR> It's an alternative to Sandstorm. We've made some different choices, like using full KVM VMs instead of Linux containers for apps. Portal also doesn't require that apps know much about Portal itself to be run as apps. They can use their own authentication or the single sign on system.

An unmodified Ubuntu cloud image is a valid (though basic) Portal app and can boot using CloudInit. Real world apps store data on the separate "user data" drive that is attached to all app VMs, which makes them upgradeable. And they almost always have a web interface for the user to interact with.

They can also use the Portal metadata service to interact with the system. But for the most part apps just receive raw TCP/IP traffic or proxied HTTP traffic and work normally.

We began working on Portal before Sandstorm was public, but I can tell you this is the first time I've been happy to see other people working on the same idea as myself. Decentralizing the internet is more of a mission than a competition.

Also, we expect to be able to run Sandstorm as a Portal app, so you could run many Sandstorm apps inside one VM, assuming they're okay with that.

<comment><USER11> What I like about the VM-centric design you've adopted is that 'apps' are long-running by default. Sandstorm in its current form is not great for hosting internet-facing sites.

<comment><USER12> Sandstorm tries to encourage web publishing apps to work in a way that significantly reduces resource usage and improves security. The platform will let an app publish a static web site which does not require starting up the app to serve. The platform also lets an app expose an API which starts up the app on-demand. So the app can publish a bunch of static content which includes Javascript that invokes the API when needed (e.g. when a comment is posted), which then wakes up the app to update the static content.

But, yeah, for a fully-dynamic web site served to a large number of users, Sandstorm currently isn't well-suited. It'll get there eventually, but given that other platforms (like Portal) already cover this use case pretty well, we wanted to focus on the interesting things we can do with fine-grained containers.

</comment></comment></comment></comment><comment><USER13> First of all I think this is awesome! But my question is, the system looks ready...If I pay now, why do I have to wait till April?

<comment><AUTHOR> There's a bit more to do before it's ready. Your card won't be charged until you start the beta, so signing up just reserves your spot as a founding user. Thanks!

<comment><USER13> Signed up!

</comment></comment></comment><comment><USER14> I'm very interested in managed email. But what happens when something goes wrong - for example the database that manages email crashing? Is this supported as a service?

<comment><AUTHOR> Yes, we'll help in almost any case like that. In many cases app developers should be able to help as well. We may not be able to fix a buggy email app, but the author could upload a fixed version and have you upgrade, for example.

</comment></comment><comment><USER15> This is awesome: exactly the kind of simplicity the personal server market needs. I dropped you an email; really interested in making Known work with the platform.

<comment><AUTHOR> Awesome, thank you. I'll reply to your email, but the answer is definitely yes!

I've created a number of SaaS services over the years and the pain of building a scaleable service shouldn't have to be repeated by every single app developer. It's a huge distraction from building a great app.

It shouldn't take much work to get Known running as a one-click auto-upgrading app, but I look forward to your feedback on the process. Thanks!

</comment></comment><comment><USER16> I'm trying to figure out from the site, but there seems to be no info on that. Is it possible for me to host my own Portal (similar to Sandstorm)?

<comment><AUTHOR> Not yet, because we don't think regular people can do that. And it's still a huge pain for technical people.

But it is very possible that we'll release a version of Portal that you can run yourself.

Do you want it as a backup plan? Or because you already have your own server hardware?

<comment><USER16> I'm already running my own server hardware for personal stuffs, so I'm just hesitant to have another one (the proposition is very appealing, but I'm too lazy to maintain both at once).

</comment></comment></comment><comment><USER17> Domain registration and ssl cert are included? How are sites/services backed up? Is it easy to download all apps and data locally for backup?

<comment><AUTHOR> 1\. Portal does support domain registration and SSL certificate creation. You pay for those annually, separate from the cost of your server.

2\. Apps and data are backed up, encrypted, and stored off-site.

3\. Your data is always easy to download. Open source apps are always easy to download. If you choose to use proprietary apps, you may only be able to run those on other supported services. But importing your data from a proprietary app to a non-propritary app should always be possible.

Thanks for the questions!

</comment></comment><comment><USER18> I'm interested for managed email. Signed up!

<comment><USER19> Same here.

</comment></comment><comment><USER20> Your website says:

> _Portal is designed to help create a world in which users are not locked in > by proprietary technology. Portal users should be able to switch to > alternative hosting companies and back again, with little effort._

Could you elaborate on that a bit? Because from the website I get the sense that your Portal software itself is proprietary, not open source, but I could be mistaken.

<comment><AUTHOR> We may end up releasing standalone version of Portal as open source that lets technical users run everything themselves. But that doesn't help regular people and it doesn't solve the problem of renting a server from a trustworthy host.

The biggest issue is lock in, not proprietary vs open source. It's okay that Facebook is proprietary, but we don't think it's right that you can't switch from Facebook to a new social network, without losing most of your data. They create intentionally broken data exporting systems to keep people locked in. They can only do this because they hold all of the data we've given them.

With Portal users control all of the data themselves, so they can give it to any new app they want to use. And they can even export their entire Portal environment and take it to another provider entirely.

Thanks for the feedback!</comment></comment>


These awesome technologies just freakin' disappeared.  why - <AUTHOR> https://insights.hpe.com/articles/these-awesome-technologies-just-freakin-disappeared-heres-why-1704.html <comment> Mk-0 On the contrary, Usenet is alive and well.

<comment><AUTHOR> Damned hard to find nowadays.

There are some usenet groups I miss desperately.</comment></comment>


One year ago today, AT&T's president promised iPhone tethering "soon." - <AUTHOR> http://technologizer.com/2009/11/06/iphone-tethering-on-att-one-year-and-counting/

<comment><USER2> At Anticipation, I had my iPhone tethered throughout the con, and it worked great. (See here for directions: <http://tinyurl.com/n26g4k>) Furthermore, as far as AT&T was concerned, I hadn't been transmitting any data--I checked that very specifically with an AT&T rep on the second or third day of the day.

Note that my phone is not jailbroken. Unfortunately, I allowed the phone to update itself and it wiped out the new network profile that enables this. I need to reinstall it.

</comment><comment><USER3> AT&T can barely keep up with providing phone service at this point. I highly doubt they have the bandwidth to support tethering. The network cant handle anymore load.</comment>


How Big Companies Buy Credit Card Data on Millions of Americans - <AUTHOR> https://www.vice.com/en_us/article/jged4x/envestnet-yodlee-credit-card-bank-data-not-anonymous <comment><USER2> cash and bitcoins are underrated</comment>


On randomized algorithms (in C) - <AUTHOR> http://return42.blogspot.com/2009/06/on-randomized-algorithms.html <comment><USER2> That picture of Doug is old, here's a more recent one

<http://picasaweb.google.com/lh/photo/9flta0OnYb_kvo0sm4a8gg>

and here's one taken before I was born !

[http://www.knowledgerush.com/kr/encyclopedia/Douglas_McIlroy...](http://www.knowledgerush.com/kr/encyclopedia/Douglas_McIlroy/)

Here's he is in 1968 explaining ActiveX to NATO (and I'm not joking, except it's not called ActiveX at the time!)

[http://www.knowledgerush.com/wiki_image/9/95/Software_compon...](http://www.knowledgerush.com/wiki_image/9/95/Software_components_lecture_large.jpg) from [http://www.knowledgerush.com/kr/encyclopedia/Component- orien...](http://www.knowledgerush.com/kr/encyclopedia/Component- oriented_programming/)

<comment><USER3> How about leaving a comment to the actual post pointing at that? :)

<comment><USER2> Sorry, I don't understand you. The big NATO photo is linked from the last URI. Or do you mean the first one, I just found it on google images, I was looking for pics from Holzman's Beyond Photography (<http://spinroot.com/pico/>) which features pics of Doug when he was at Bell Labs and they were inventing "photoshopping" but they are all in the PDFs and I didn't have the inclination to extract them.</comment></comment></comment>


CUDA 11.0 - <AUTHOR> https://docs.nvidia.com/cuda/cuda-toolkit-release-notes/index.html#cuda-whats-new <comment><USER2> I noticed CUDA 11.0 was almost ready for release last week when I went to install CUDA and the default download page linked to the 11.0 Release Candidate. The 10.1 and 10.2 links were buried behind a link off to the side labeled "legacy". The thing is, no library you use is going to be supporting the CUDA 11.0 RC, that's ridiculous. For example, Pytorch stable is on 10.2 and Tensorflow only goes up to 10.1.

This is generally indicative of how poorly organized the CUDA documentation and installation instructions are. The Conda dependency manager has made this a lot easier recently. Especially by, e.g., providing pytorch binaries. Though if you want to use packages like NVIDIA Apex for mixed precision DL[0] you're going to be in for a huge headache trying to compile torch from source while also managing your cuda and nvcc version, which sometimes must be the same but sometimes can not be![1]

[0] Yes, I'm aware that Apex was very recently brought into torch but it seems that the performance issues haven't been ironed out yet.

[1] [https://stackoverflow.com/questions/53422407/different- cuda-...](https://stackoverflow.com/questions/53422407/different-cuda- versions-shown-by-nvcc-and-nvidia-smi)

<comment><USER3> Yeah, and the CUDA 10.0 official Visual Studio demo project build was broken for... looks like a year, at least, because they didn't want to populate the toolkit path. NVidia, you're better than this.

[https://forums.developer.nvidia.com/t/the-cuda- toolkit-v10-0...](https://forums.developer.nvidia.com/t/the-cuda- toolkit-v10-0-directory-does-not-exist/65821/6)

> The Conda dependency manager has made this a lot easier

Yeah but conda is "Let's do dependency management with a SAT solver, it'll be great!" On a good day, it's just slow. On a bad day, the SAT solver spins for hours before failing to converge. On a really bad day, the SAT solver does something "clever."

I've had a couple of really bad days this year. I'm really starting to not like conda very much.

<comment><USER4> > "Let's do dependency management with a SAT solver, it'll be great!"

Debian managed something like this over 20 years ago in dpkg. But somehow people must keep reinventing the wheel.

<comment><USER3> I thought the debian SAT solver was a maintainer tool rather than something that ran every time? In any case, conda's implementation is really quite awful by comparison and they would have been well served by copying something that works instead of building something that doesn't.

</comment></comment></comment></comment><comment><USER5> Everytime I have to deal with multiple versions of CUDA on Linux I feel like poking my eyes out. I get that supporting developer libraries that have to interact with hardware is hard but come on...

<comment><USER6> For something this popular it shouldn't be so hard. I don't think being related to hardware is an excuse. CUDA is not a driver and exists entirely in userspace.

This is the kind of thing that happens when you're dealing with a monopoly.

<comment><USER7> The economic incentive is simple: open-sourcing the driver will allow an open- source API to interact with the hardware, allowing AMD/other competitors to support the same API. So instead of competing at the silicon level, Nvidia chooses to set up unnecessary barriers to entry at massive cost to developers/users.

Like Torvalds says [1]: Fuck You, Nvidia.

[1]: [https://www.youtube.com/watch?v=iYWzMvlj2RQ](https://www.youtube.com/watch?v=iYWzMvlj2RQ)

<comment><USER8> unnecessary? not in the eyes of the shareholders. just compare NVIDIAs stock surge with the performance of AMD. they protect their market and they do it pretty well.

the Linus video is awesome though :-) And I totally understand his sentiment

</comment></comment></comment></comment><comment><USER9> >cuFFT now accepts __nv_bfloat16 input and output data type for power-of-two sizes with single precision computations within the kernels.

This exact sentence is listed both under "New Feature" and "Known Issues". I'm not super familiar with CUDA stuff, but, it can't be both right?

<comment><USER2> Looks like a mistake, should only be in New Features.

<comment><USER10> So a known issue in the known issues?

<comment><USER11> A known known

</comment></comment></comment></comment><comment><USER12> Does anyone understand why such minor upgrades resulted in a major version bump? Is this some sort of stability check point? Or some other versioning convention?

<comment><USER13> Well, I think a new microarchitecture means a major bump. So between that and version bumps to to actual major software features, you get to 11 within 13 years or so.

Also, GCC 9.x compatibility may seem minor to some, but is significant for others. I also think there's some C++17 support in kernels - that's something too.

<comment><USER12> Ooh, I missed those. Support for C++17 is pretty major. Thanks. Perhaps my memory is fuzzy, I just remember the CUDA 9->10 switch having some significant (but not major) performance and feature changes.

</comment></comment></comment><comment><USER14> Interesting that Fedora support seems to have been dropped. Anyone know why that might be?

Edit: oh wait I think I see. Latest supported gcc for CUDA 11 is gcc 9.x, but I think latest Fedora is on gcc 10.

<comment><USER15> I'm guessing it was an oversight in the table given they still have all the fedora installation instructions on the install page:

[https://docs.nvidia.com/cuda/cuda-installation-guide- linux/i...](https://docs.nvidia.com/cuda/cuda-installation-guide- linux/index.html#system-requirements)

</comment></comment><comment><USER16> > Added support for Ubuntu 20.04 LTS on x86_64 platforms.

Huh? I've been using CUDA for a while now on my Ubuntu 20.04 machine

<comment><USER17> That probably just means that they are testing that they are testing that platform in CI now, and are officially supporting it (taking bug reports into account, etc.).

</comment></comment><comment><USER18> I'd like to play with CUDA, but I just got a new laptop without an Nvidia GPU, coming from one that had a built in Nvidia GPU. It's got a thunderbolt port, but unfortunately most of the gpu's are quite expensive at around 400$. Does anyone know any cheaper options?

<comment><USER19> If you just want to try for a few hours, you can add GPU(s) onto a GCP CE instance. Along with the trial credits it should get you a few hours poking around with cuda.

Otherwise, get a pre-owned GTX950 (one that doesn't require external power supply) and a TB3 to PCI-E x16 adapter. Not enclousure, adapter. Should cost you around $200 all in IIRC. And it allows you to upgrade the card furthur down the line since most of the cost is the adapter.

<comment><USER18> Do you know what exactly I should search for when looking for a "TB3 to PCI-E x16 adapter"? Will this utilize all thunderbolt lanes available? I've got a newer laptop that, I believe, has all lanes available.

</comment></comment></comment><comment><USER20> oh great. More chasing to do. Anyone interested in working on the CUDA integration for Go ([https://gorgonia.org/cu](https://gorgonia.org/cu))? PRs welcome, as I am quite short on time.

</comment><comment><USER21> Is there Mac OS support?

<comment><USER22> Nope. That's mostly on Apple though, as they discourage all APIs that aren't Metal.

<comment><USER23> Apple needs to build a completive standard to CUDA.

<comment><USER22> Apple doesn't directly compete with CUDA, they just want total control of their platforms. Metal does have great performance and tooling. In practice nobody does HPC on macs so there's no demand for linear algebra or graph libraries, which are a big selling point for Nvidia over AMD.

The fact that Apple is trying to kill OpenGL and OpenCL and block Vulkan definitely sucks though for anyone trying to do indie games, or open source ML/HPC.

<comment><USER23> Have you looked at OpenGL api's, they are a strange legacy beast. I think Apple does what's best for it's users, even if it has to create a new standard. How about other companies adapting to modern Metal API's instead?</comment></comment></comment></comment></comment>


Boss of Motorola Criticised by Apple's Jony Ive – Code Jar - <AUTHOR> http://www.codejar.org/?p=283 <comment><USER2> I use a Moto X (1st gen) and iPhone 6 every day. I can't tell you the pleasure I get from my Moto X. Obviously Google/Android have more to do with that than Motorola, but it's still a rock-solid, fast, cheap, easy-to-hold device.

My iPhone 6, on the other hand, is an endless source of bugs and frustration.

In short: shut up, Jony Ive. Not everyone is like you. You can't dictate taste.</comment>


World chess championship - analysis of Anand's crushing Game 4 victory - <AUTHOR> http://www.chess.co.uk/twic/chessnews/events/world-chess-championship-2010/anand-topalov-world-championship-game-4

<comment><USER3> Somewhat unrelated:

You know, it's actually kind of funny. I've become such a huge fan of Starcraft and Starcraft 2 over the past year, and it always blows my mind that people can talk about sports and chess seriously like this and been seen as reasonable fans and intellectuals, while if you know any of the big names in Starcraft and their past accomplishments, you're still just another videogame nerd.

Hopefully that's a trend that reverses as time goes on - I'd love to be able to speak in polite company about Starcraft as everyone in this thread is speaking about chess.

</comment><comment><USER4> For a non-chesser like me: what is so remarkable about that game in particular?

(Honestly interested -- was it that Novelty move in the middle?)

<comment><USER5> Anand is long regarded as a solid and classical player, quietly building up his position. Topalov is an uncompromising fighter, always looking at intensifying the struggle.

Every once in a while we get a glimpse of the youthful attacking Anand - <USER2> sacrificial attack with reduced material. Game 4 was another example of that remarkable talent being unleashed.

Over the years, Topalov is famous for games he has lost; it's not often he loses, but when he does it often is because of a brilliancy or dashing attack. Game 4 was one of those performances.

Even though I feel game 2 was a far better quality, game 4 will probably be the game that people will remember.

</comment></comment><comment><USER6> live coverage from today's game will be at <http://www.anand-topalov.com/en/>

</comment><comment><USER7> That was a fantastic game. Bold playing by Anand!

</comment><comment><USER8> The next game should be exciting. Anand is known to be strong with black and he goes in with a one point advantage.

<comment><USER5> Considering Topalov is a notorious slow-starter, or more accurately a very strong finisher, it's set up to be a very interesting clash for the rest of the match. Although this is a head-to-head match, so beating the tail-enders to catch up isn't an available strategy.

So far it's been a sublime performance from Anand to come back after the catastrophic first game. Game 2 was a splendid positional win, and game 4 is vintage Anand after a serious mistake from Topalov.

Anand's best games collection shows a number of wonderful examples of king attacks with reduced material, game 4 is another worthy addition.

All this on the backdrop of a psychological war: Topalov's decision to play by Sofia Rules, not talking/communicating with Anand, Topalov on home ground, Danailov's dual role as Topalov's manager and match organiser - for a player to face that and produce the quality Anand has done in games 2 to 4 is even more impressive.

</comment></comment><comment><USER9> Is there a website that will animate these?

<comment><USER10> Chessbase has my favorite board: <http://chessbase.com/newsdetail.asp?newsid=6288> (search for replay)

Also the best analysis of game 4 IMO - by Anish Giri, currently the world's youngest GM.</comment></comment>


JSON Web Token Validation Bypass in Auth0 Authentication API - <AUTHOR> https://insomniasec.com/blog/auth0-jwt-validation-bypass <comment><USER2> > The Authentication API prevented the use of alg: none with a case sensitive > filter. This means that simply capitalising any letter e.g. alg: nonE, > allowed tokens to be forged.

The option to have 'alg: none' should never be used as it is still the biggest footgun in the JOSE specification. I'm not sure why on earth you need a case- sensitive filter on this, but even giving the user a choice of ciphers to use is a recipe for disaster. Thus JWT is still a cryptographically weak standard.

PASETO [0] or Branca [1] are cryptographically stronger alternatives to use over JWT here.

[0] [https://paseto.io](https://paseto.io) [1] [https://branca.io](https://branca.io)</comment>


Ask HN: Looking for recommendations on decent penetration testing tools - <AUTHOR> We recently had an attack on one of our web applications and following the logs led me to Burp Suite  https://portswigger.net/   I wasn't aware that automated tools like this existed and  I would be interested in running one across our suite of web applications.  Any recommendations?  Thanks in advance. <comment><USER2> Hi,

Burp Suite Pro is indeed the tool of the trade when performing penetration testing of web applications. I would however not call it an automated tool.

While it contains some automated test functionality (Active Scan), using this functionality will by no means give you a conclusive answer on whether there are vulnerabilities present in your application. As an example in my case, I use Active Scan together with other tools and techniques to perform attack surface analysis, so figuring out interesting parts of the application that can receive some priority when looking for bugs.

I would strongly suggest to enlist the help of a professional security company to perform the security assessment and to also verify whether the application and system in question has been compromised in the previous attack.

That being said, I do indeed think it's a good idea to use tools like Burp during the development cycle, and also to invest in secure development training.

<comment><USER3> I am looking to get more into web app testing - Side note: I already have a NetSec degree and work in the field. Should I be pursuing the GWAPT: GIAC Web Application Penetration Tester? Should I just be working through the OWASP Top 10 manual and learn/practice the "Top 10s" first? Thanks !

<comment><USER2> Sorry for the late reply, I missed it.

I suggest you start by having a look at the OWASP Top 10 and the OWASP Testing guide. Also read the Web Application Hackers Handbook 2nd Edition and learn how to use Burp Suite Pro.

I personally have not taken GWAPT so cannot comment on it, but the OSCP certification from Offensive Security is well regarded.

Good luck

</comment></comment></comment><comment><USER4> Check out kali Linux which included many tools including metasploit.

</comment><comment><USER5> [https://pages.bugcrowd.com/vulnerability-rating- taxonomy](https://pages.bugcrowd.com/vulnerability-rating-taxonomy)

Outlines the different security priority, as mentioned above Burp is a great tool for web app testing

</comment><comment><USER6> If it is web-based attacks which are of interest to you at the moment, consider looking into the OWASP Top 10, and also a web application scanner such as Nikto. These should give you a good insight and prompt you with some further avenues to explore.

</comment><comment><USER7> Seconded for Kali (formally backtrack). The amount of tutorials, resources, etc. are more than enough to get you started.

Good luck!

<comment><USER8> Downloading Kali now. Are you talking about YouTube tutorials or do you have something specific in mind? I only know Cybrary as the only decent resource for beginner pentesters.</comment></comment>


Ask HN: How secure should my site/server be? - <AUTHOR>

I'm not new to security, and that's why I ask.  I have created a "payment portal" integrated with Stripe for my [few] customers.  I have gone through various guides for securing debian, apache/node, mysql on dedicated instance, etc., using https only, ssl certs, passed Qualys HTTPS/SSL scan with a 90%/A Rating, performed qualys and other vulnerability scans...but have I done enough?  I'm not storing credit card info, but am storing username, passwords, and basic stats.  I also developed the portal with security in mind taking CORS, SQL-Injection, and other tactics into account.<p>I know security is and should be considered at every layer, but when is there a reasonable amount of security when security is not my primary focus? <comment><USER2> I don't know about 'best practices', but I know of a nice app that's less resource intensive than 'fail2ban': [https://github.com/sofar/tallow](https://github.com/sofar/tallow)

<comment><AUTHOR> Thanks for the link.

</comment></comment><comment><AUTHOR> Since my main concern about security is cardholder data leaks I looked into what it takes to become PCI-compliant [https://www.pcisecuritystandards.org/merchants/self_assessme...](https://www.pcisecuritystandards.org/merchants/self_assessment_form.php), not that PCI-Compliance is the be-all end-all of web security.</comment>


Why Gold Fails as a Hedge Against Inflation (and When It Works) - <AUTHOR> http://greyenlightenment.com/why-gold-fails-as-a-hedge-against-inflation-and-when-it-works/ <comment><USER2> "All paper currencies eventually find the level of their value, which is zero." Voltaire</comment>


Are Uber and Lyft Cutting into Metro's Ridership? - <AUTHOR> https://www.washingtonpost.com/local/trafficandcommuting/are-uber-and-lyft-cutting-into-metros-ridership/2017/12/03/99af8676-d54b-11e7-95bf-df7c19270879_story.html <comment><USER2> > Uber and Lyft have billed themselves as complements to transit, but in > Metro's case, gains by the apps have coincided with service declines that > have sent tens of thousands of commuters seeking more reliable alternatives.

Still, data compiled from several studies in multiple cities suggests that among customers hailing rides instead of using another form of transportation, 15 percent to 30 percent would have used mass transit if not for the apps

That's not good.</comment>


Why Facebook Is Betting on Office 365 and the Microsoft Cloud - <AUTHOR> https://blogs.office.com/2016/07/12/why-facebook-is-betting-on-office-365-and-the-microsoft-cloud/ <comment><USER2> Well, what other options did they have if they want Facebook to be used for collaborative projects with office applications? Libre Office has shown complete resistance to corporate control (remember Open Office and Oracle). Google's offerings are out because they're pretty much who Facebook is trying to compete with here. Apple's software only works on their OS. Every other paid office suite is merely trying to be an alternative to Microsoft's offering.</comment>


JXCore – A Multithreaded Node.js Fork - <AUTHOR> http://jxcore.com/home/

<comment><USER3> This is a tragedy of a product being developed for an audience of zero.

All of these problems have acceptable, established, and time-tested solutions using Node.js itself, without the crippling caveat of lock-in to a new and unproven platform. And yes, despite the copy trying to distract from this fact, this is very much a case of lock-in, because built-in multithreading is _not_ a Node thing. None of the mountain of Node code out there works on that expectation. Furthermore, JX seems to have its own proprietary packaging solution, SQL database, memory store, monitoring, and more. This isn't a point in its favor; it's just more lock-in.

These new features might be great and well-implemented, but if I'm going to benefit from them, I'm leaving Node.js behind and trusting that JX will be supported as well as Node itself is. I have no faith that will be the case. It's (perhaps unfortunately) and self-fulfilling prophecy: I doubt I'm alone in my thinking, and that feeds back into lack of a community coming together to support this fork.

My advice to the developers (who are clearly talented if they can put together something like this) is to refocus your energies on building stuff with (and on top of) Node.js instead of forking it.

Source: some hard-learned lessons

<comment><USER4> A lot of wisdom there. I had similar experiences with SocketCluster.

It used to be a full-stack framework (with a heavy, opinionated client-side part) but I was the only one working on it and when Meteor, SailsJS etc came along, I understood it didn't stand a chance so I pulled out the realtime and clustering features and used them to focus on just the realtime part and it picked up!

What I noticed is that the more opinionated (and more complete) your framework is, the harder it is to build a community around it.

Developers like to use custom combinations of small, SPECIALIZED tools that only handle a SMALL part of the big problem.

... Unless you're a HOT startup with crazy funding... In this case, developers will trust your product by default. Developer trust is hard to gain - <USER2> you're small, you have to play for the long term and keep reinventing and rewriting parts of your project over and over as technologies change.

</comment></comment><comment><USER5> Can't you just do this yourself with the clustering already built into Node... you can manage the clustering yourself [http://nodejs.org/api/cluster.html](http://nodejs.org/api/cluster.html), or use a tool like pm2 to manage your cluster for you [https://github.com/Unitech/pm2](https://github.com/Unitech/pm2).

</comment><comment><USER4> Another alternative is to use process-based concurrency with SocketCluster [http://socketcluster.io/](http://socketcluster.io/) \- It runs on top of plain Node.js (or io.js) - It's just a module.

</comment><comment><USER6> [https://news.ycombinator.com/item?id=7333337](https://news.ycombinator.com/item?id=7333337)

</comment><comment><USER7> Is a multithreaded io.js fork in the works?

</comment><comment><USER8> Doesn't Node already have a Cluster API?</comment>


A 𝝺-calculus interpreter in less than 200 lines of JavaScript - <AUTHOR> http://tadeuzagallo.com/blog/writing-a-lambda-calculus-interpreter-in-javascript/ <comment><USER2> What's that x in a box thing?

<comment><USER3> Probably the greek letter lambda. [https://en.wikipedia.org/wiki/Lambda](https://en.wikipedia.org/wiki/Lambda)</comment></comment>


Where Are You Mr(s) Product Owner? - awa-uk http://www.adventureswithagile.com/where-are-you-mrs-product-owner/

<comment><AUTHOR> The greatest failures of our Agile dev team stem from absent Product Owners. Not because (as the article suggests) the engineers were incapable of deciding product features and direction. But because their hands were tied by the Agile process, which prevented them from proceeding without the blessing of the all- powerful PO.</comment>


Feed Each Other - <AUTHOR> http://feedeachother.com PG didn't accept this idea for YC funding because he was afraid of Google (wimp ;).  <p>We just launched it last week.  It's a new type of social feed reader.  It would be great to hear what you all think.  Thanks! <comment><USER2> Interesting... I'm working on a similar concept with SeekSift.com, but I'm approaching the user discovery/sharing from a different perspective.

<comment><USER3> yours is better for the same reason that originalsignal is better; you can see more headlines on one page like a newspaper. this is pretty much what I use originalsignal for

<comment><USER2> Thanks, I tried to find the right balance between enough content and over- filling the page.

Still, it's intended to be _more_ than just a simple feed reader.

The recommendations system (only _ahem_ slightly behind schedule), based on a system of shared inputs, is what will really make it stand out (or not).

</comment></comment></comment><comment><AUTHOR> Review at readwriteweb here: <http://www.readwriteweb.com/archives/feedeachother.php>

</comment><comment><AUTHOR> YC turned this idea down because PG was afraid of Google Reader (wimp) ;

<comment><USER4> In this case as in most there were several reasons.

<comment><AUTHOR> I know, just kidding around. I'd love to hear feedback from everyone here.</comment></comment></comment>


ChaiScript – Easy to Use Scripting for C++ - <AUTHOR> http://chaiscript.com/ <comment><USER2> I have been looking through it, and examples, and code, and I guess the main question condensing in my mind is one big "Why"? Why use this, why yet another scripting language?

Why not just use Lua, one of JavaScript engines, Python, etc? They all have C++ bindings, all relatively easy to use. All are already used in many C++ apps for this exact purpose... (I guess it's not commonly known in all coder circles, but all those languages can just as easily be embedded in a C++ codebase as this.)

<comment><USER3> JS and Python are slow [see below] and heavyweight. Lua might work, I don't know... but this being header-only makes it pretty nice for simpler situations.

EDIT: Sorry, I wrote this a little too quickly and ended up writing a bit too coarse of a description. I meant JS and Python are both heavyweight to include in a project, and Python is slow both to initialize and to run. I didn't mean JS is slow to run. I don't know how fast it starts up either.

<comment><USER4> It is ridiculous that header-only is considered an advantage. The state of C++ build tools is very poor, and it is harming the language as a whole.

<comment><USER5> > It is ridiculous that header-only is considered an advantage.

Why do you believe it's ridiculous? Being able to integrate a third-party library by just adding a few source files to your source tree is as simple as it gets.

> The state of C++ build tools is very poor, and it is harming the language as > a whole.

This assertion makes no sense, particularly in the light of this discussion. Installing a headers-only library is a solved problem, and even template-heavy libraries such as Eigen are already distributed and installed quite easily with standard linux package managers.

<comment><USER4> I should clarify. Being able to add headers to a project in C++ is easy but adding translation units is not (usually). This encourages header-only libraries even when they are not really appropriate, increasing compilation times etc.

<comment><USER6> Sometimes I wonder why projects are either "single header only" or tens to hundreds of separate modules. One header and one source module would be a nice compromise regarding compile time vs. ease of use.

Yes, I realize that some header only libraries support using the header as either header or implementation, but this still blows up compile time.

<comment><USER7> Does it really blow up compile time? Translation units and optimization are usually where compile time is spent. Having fewer but fatter translation units helps compile times tremendously while most of the time per translation unit is spent in stages beyond the source compiling in LLVM.

Boost is really the only example I can think of where small utility comes at the expense of huge compile time increases.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I just have to upvote this since Jason Turner is one of the creators and I owe a ton of my knowledge about C++ to his videos on his YT channel, as well as his talks at CppCon.

<comment><USER9> He's also co-host of the podcast CppCast :) [https://cppcast.com/](https://cppcast.com/)

</comment></comment><comment><USER10> I really like ChaiScript and have used it in a couple of small game projects.

But I stopped using it because it was insanely slow (in both compile times and runtime performance). Several hundred (if not thousand) times slower than the equivalent Lua code.

That was a few years ago, but skimming through the release notes, it doesn't seem to have been fixed.

<comment><USER11> I bet the compile times would improve if it wasn't header only.

<comment><USER10> Unfortunately ChaiScript needs to be header-only because it's like 99% templates.

You can put all your ChaiScript-related code into an isolated implementation file, and try to avoid touching that file as much as possible. But that only works well for long-term projects, where once you get all the bindings you need set up, you can coast for a while without touching those files.

For short-term projects it's a nightmare because you're constantly touching the ChaiScript files.

There's no inherent reason a header-only library should significantly impact compile times, aside from the fact that the authors usually don't have the foresight to make it efficient. It's also very difficult to find information about how to make templates more efficient at compile time.

</comment></comment></comment><comment><USER12> For the note: ChaiScript is from Jason Turner. He also does CPPCast ( [https://www.youtube.com/channel/UCuCjADS4u3uJDTqUaG0H9dA](https://www.youtube.com/channel/UCuCjADS4u3uJDTqUaG0H9dA)) and is a regular presenter at CPPCon ( [https://www.youtube.com/watch?v=zBkNBP00wJE](https://www.youtube.com/watch?v=zBkNBP00wJE) ).

Many of his videos / tutorials are worth a look if you are interested in C++.

</comment><comment><USER13> Wow this looks awesome, great job! I didn't even know I wanted this until I saw it.

I am worried though how memory management is handled under the hood. Is it possible to use traditional C++ memory management with any of the variables created in ChaiScript?

I'm not saying that I don't trust the implementation, I'd just like more control over it in some cases.

</comment><comment><USER14> Looks very nice! It would be helpful to have a page that compares it to some of the other popular scripting languages for C++.

</comment><comment><USER15> I like this and I see the use cases, however why would I use ChaiScript over Lua for example?

<comment><AUTHOR> To me it looks like ChaiScript is more lightweight and easier to learn.

<comment><USER16> Would that make it a good candidate for microcontroller programming? I have been looking for something more elegant/functional to program arduino with. Anything about memory size on the site?

<comment><USER17> _" ChaiScript is a header only library with only one dependency: The operating system provided dynamic library loader, which has to be specified on some platforms."_

I believe the dynamic library loader requirement is a showstopper for AVR.

</comment></comment></comment></comment><comment><USER18> > ChaiScript has been making stable releases since 2009. No bugfix or feature > is made without a corresponding unit test

Codecov: 72%

Reality is often disappointing...

In all seriousness, looks pretty nice.

<comment><USER19> Since when code coverage is accurate enough for you to make that judgement?

<comment><USER18> Clearly I made the mistake of trying to tell a joke in this sacred forum.

72% is more than high enough for me to believe them, but it's not 100% hence the gag

<comment><USER20> ...Yeah, your joke isn't really successful... I didn't realize it is a joke either.

</comment></comment></comment></comment><comment><USER21> Ha! Chai == Tea in Hindi, for those who are wondering ;)

<comment><USER22> chai is tea in many languages that either inherit from Russian or Arabic

[https://www.etymonline.com/word/chai](https://www.etymonline.com/word/chai)

Edit: apparently the original source is China. Etymonline fail!

<comment><USER23> With few exceptions, the word for Tea in a country depends on how it was originally transported there.

See: Tea if by sea, cha if by land: Why the world only has two words for tea

[https://qz.com/1176962/map-how-the-word-tea-spread-over- land...](https://qz.com/1176962/map-how-the-word-tea-spread-over-land-and-sea- to-conquer-the-world/)

<comment><USER21> Wow. I had absolutely no idea! Thanks for sharing that link, learned something new today

</comment></comment></comment></comment><comment><USER24> LuaJIT w/ FFI seems better imo.

</comment><comment><USER25> I just discovered that raw multi line string don't work on visual studio 2017...

<comment><USER26> With the paratheses? R"(str)"

<comment><USER25> Oh right braces are needed! Thanks!

</comment></comment></comment><comment><USER27> I'm stupid but what's the purpose? Why not just call the function directly without Chai?

<comment><USER28> Calling a C++ function from your scripting language, or a scripted function from C++ are different uses, they're just combined into one for the purposes of a demo of what the code looks like.

edit: For example, there's a fairly clear distinction in a game between engine code and gameplay code. Engine code is run all the time, and should be memory and computationally efficient, and robust. It won't likely need to be changed much, and is OK to spend some extra effort writing it to get all these properties. So C++ is great for this.

Gameplay code doesn't tend to have these requirements, and you may not want to pay the cost to write C++ if you don't need the benefits. And additionally, gameplay code often needs to be rewritten frequently while you experiment with gameplay to find what's fun, or do expansions, or support mods to the game, so a language that's very easy to write in helps a lot.</comment></comment>


Red Hat to join S&P 500 - <AUTHOR> http://www.newsobserver.com/business/story/1612209.html

<comment><USER2> I'm surprised this didn't happen earlier. In corporate land, there have been two server OSs for the last five years: Windows Server and Red Hat Enterprise Linux. Sure there might be the old HPUX or Sun box waiting to be retired, but it's not going to be replaced with something else. SLES often only exists as a bargaining tool with Red Hat support.

<comment><AUTHOR> It's a pretty solid reminder to all those that claim there is no money to be made in open source and that it is somehow 'communist' to be doing so.</comment></comment>


Nereus deep sea sub 'implodes' 10km-down - <AUTHOR> http://www.bbc.com/news/science-environment-27374326

<comment><USER2> Could most of space inside these machines be filled with an inert liquid, perhaps built in as part of the cooling system, or cooled by a heavily armoured refrigeration system, so that most of the submersible was effectively incompressible?

</comment><comment><USER3> Here is the statement from the HADES research team [http://web.whoi.edu/hades/a-sad-day/](http://web.whoi.edu/hades/a-sad-day/)

</comment><comment><USER4> Was it operating at or near its limits? Article said it was 6 miles down, is it built go that low?</comment>


Google Maps may soon show how difficult parking is near your destination - <AUTHOR> https://arstechnica.com/business/2017/01/google-maps-may-soon-show-how-difficult-parking-is-near-your-destination/ <comment><USER2> Great feature. I use an app for finding coffee shops that collects similar info (only about coffee shops) but it's nice to be able to know in advance if parking near a place is free / paid, street / lot, easy / difficult.

One challenge here is that the difficulty probably varies by time of day and day of week.</comment>


Trevor Blackwell FAQ - <AUTHOR> http://www.trevorblackwell.com/faq.html <comment><USER2> I like the "I am not these Trevor Blackwell's" section. Without the clarification, champion MTG Trevor could have convinced me he was Anybots Trevor.</comment>


Lady A (Formery Lady Antebellum) Sues the Other Lady A Over Trademark - <AUTHOR> https://pitchfork.com/news/lady-a-formerly-lady-antebellum-sue-seattle-blues-singer-lady-a/ <comment><AUTHOR> As a small business who had to settle a trademark issue with a large international computer company, I found this interesting.

TL;DR: The country band is suing just to show they own the trademark, not to stop the blues singer or extract money.</comment>


Draft book: Practical Foundations for Programming Languages, RHarper [pdf] - <AUTHOR> http://www.cs.cmu.edu/~rwh/plbook/book.pdf

<comment><USER2> This book is probably one of the most actively revised (in the sense of improving or adding to the exposition) pl texts currently available. Also, a good fraction of pl theory faculty in the US are the academic decendents of the author (Bob Harper)</comment>


Lies vs. Statistics: VPN Virtual Server Locations - <AUTHOR> https://restoreprivacy.com/virtual-server-locations/ <comment><AUTHOR> This is an article that I wrote recently for Restore Privacy.

The focus is identifying the undisclosed use of virtual locations by some popular VPN services. But that's not why I've submitted it to HN.

I'd appreciate comment and criticism about the criterion that I've used for virtual locations. That is, where apparent signal velocity is greater than the speed of light, I conclude that the disclosed server location is implausible. And so it must be a virtual location.

I calculate apparent signal velocity by dividing twice the calculated great circle distance between server and ping probe, by the minimum round-trip time (minrtt). For server locations, I rely primarily on whatever the VPN service has disclosed.

I'd also appreciate comment and criticism about my explanation of how VPN services achieve virtual locations ("How Virtual Server Locations Are Possible"). Basically that they exploit discrepancies between location information that's associated with IP addresses, and BGP advertisements based on address announcements.

Finally, for 195 servers that are apparently located near Nuland, I found an interesting pattern in the ping data.[0]

For ping probes in Europe, minrtt is 1-30 msec. Then there's a gap in observed minrtt across the Atlantic, with apparently much faster transmission. I'm guessing that's because trans-Atlantic cables don't have many routers. Next there are groups for eastern and western North America, with faster transmission than within Europe, but slower than across the Atlantic. That probably also reflects router density. Last, there's a jump to Asia and Australia.

Does that make sense?

0) [https://cdn-resprivacy.pressidium.com/wp- content/uploads/201...](https://cdn-resprivacy.pressidium.com/wp- content/uploads/2019/12/IPv4-Clusters-Colocation-Near-Nuland-by-City-and- Region.png)

<comment><USER2> I spent quite a few years working in the isp/cdn/dns space. Is "virtual location" an idiomatic term for VPN users? The more general industry would probably say youre looking at Points of Presence ("PoPs").

The core of the article is one of (mis)representation. The VPN providers are trying to present broad network coverage with a minimum of expenditure, and the clients are concerned with actual geophysical location. Virtual Locations seems to be a term designed to comingle the concepts, and obfuscate actual location and connectivity.

The clustering is because there simply arent that many physical locations with connectivity to various networks (Internet Exchange Points "IXPs"). Those IXPs are themselves often clustered and associated with a few nearby physical facilities (DCs or Colo(cation) for hosting general compute servers.

You mention companies "leasing" address blocks. Thats probably more correct to say theyre "delegated" from NSPs to clients like the vpn companies.

In general Id find whois/rir data to be of very little use. Theres little to no association or restriction for either of those and where the IP addresses are actually announced or used.

It may not matter for your use/methodology but latency for ICMP is unreliable. Many networks will use a lower traffic priority for it, introducing variable loss/jitter/delay. If at all possible actual TCP or UDP is better for evaluating RTT.

One thing you might look at is the vpn provider network adjacencies in different locations. Many/most NSPs handily include some sort of location identifier (like iata code) in their device names. From those adjacent devices you can probably infer city at least. PeeringDB and/or looking glass portals are another way to deduce network topology and connectivity, possibly narrowing it down to specific facilities.

Lastly your ICMP replies are inherently limited in what you see. Its very likely that there are underlying networks (ie MPLS, or GRE tunnels) that you cant see. Itd be very easy to have an interconnect in AMSIX and tunnel it over to belgium or germany. You wouldnt see that in DNS or ICMP replies, but could infer it through latency.

<comment><USER3> > the clients are concerned with actual geophysical location.

Are they, though? This is, of course, completely anecdotal, but the only real reason I will change the 'location' of my VPN endpoint is exactly that. My suspicion is that most of the VPN users concerns about geography match mine and _actually_ boil down to whether or not it will trick a geofence.

There's going to be some ways in which you can conflate those concepts, since obviously 'virtual locations' will be detectable by some means, as evidenced by the fact that mirmir managed it, but I suspect for a lot of consumers good enough is good enough.

<comment><USER2> I probably should have said "geo-political." Youve noted the contractual aspect, which bubbles up in regional content restrictions.

I was thinking more along the lines of law enforcement as well. Where civil & criminal law, data retention, LEO access, and due process may vary significantly in different countries.

<comment><AUTHOR> Huh. I wonder how law enforcement deals with this.

Naively, I'd expect that it's where the VPN service is incorporated that determines that stuff. But on the other hand, they would need to find a server to impound it. So I suppose that PoPs could be used strategically to impede investigations.

<comment><USER2> I'll prefix this by saying its probably pretty far out on the spectrum of practicality. More paranoia or legal problems than wanting access to region restricted entertainment content.

I dont have adversarial experience with law enforcement, but from what Ive seen it's normally around incorporation, assets, and where the principals are. The government gets access by serving you papers, restricting your assets, or restricting your freedoms.

That side the physical location of the servers will matter for teh same reasons. Two adjacent countries may have different standards of evidence, due process, compelled information, data retention, 'know your customer', etc. Both the country of physical location and the country of incorporation will effectively have access; one directly and one via compulsion.

</comment></comment></comment></comment></comment></comment><comment><USER4> Tangential to this article, can someone clarify on what's good / bad about NordVPN? I've been trusting their services for 2 years now, and I signed up on some ridiculously good offer of 3 years for <$100 a year ago, so I'm locked in for 4 full years. I did this because I trusted the service from reading reviews, but places like reddit are always shitting on NordVPN, both due to their ads (obv not the issue for me) and because of some nebulous "concerns" that no one has been able to articulate properly for me.

I know about the recent hack, but it seems like all of their precautions actually worked in protecting the consumers, and no logs were ever shown to have existed or been stolen.

<comment><USER5> They showed with the recent hack that, to them, maintaining their marketing & reputation is a higher priority than informing their users of possible security incidents, and that they would rather try to cover stuff up than be upfront about matters.

Or at least that's what I gathered reading the recent HN threads.

<comment><USER6> They knew about a vulnerability for MONTHS. They did not fix it and kept it secret. It only came out because of a whistleblower.

This is not the behavior of an organization deserving ANY level of trust.

</comment></comment></comment><comment><USER7> What's the best VPN provider now that PIA got acquired by an Israeli spyware company?

<comment><USER8> Source [1]. Truly insane. I'd never have expected this from a company that cares so much about privacy. Just cancelled my ProtonVPN subscription.

I was going to recommend ProtonVPN but they have a pretty sketch background/history too. [2]

Cloudflare's WireGuard-based Warp VPN [3] might be worth keeping an eye on, but Cloudflare makes it clear that users should not be expecting the privacy guarantees of a "traditional VPN" [4]:

> WARP is not designed to allow you to access geo-restricted content when > you're traveling. It will not hide your IP address from the websites you > visit. If you're looking for that kind of high-security protection then a > traditional VPN or a service like Tor are likely better choices for you.

Perhaps we simply shouldn't use VPN services. [5]

[1]: [https://news.ycombinator.com/item?id=21679682](https://news.ycombinator.com/item?id=21679682)

[2]: [https://news.ycombinator.com/item?id=19266078](https://news.ycombinator.com/item?id=19266078)

[3]: [https://news.ycombinator.com/item?id=19542835](https://news.ycombinator.com/item?id=19542835)

[4]: [https://blog.cloudflare.com/announcing-warp- plus/](https://blog.cloudflare.com/announcing-warp-plus/)

[5]: [https://news.ycombinator.com/item?id=16371030](https://news.ycombinator.com/item?id=16371030)

<comment><AUTHOR> Not to put too fine a point on it, they lost money for too long, and ended up needing a buyer.

I always did wonder how they could offer so much for so little money.

<comment><USER7> How can VPN providers lose money, when a DO Droplet for $5 a month can probably host 5 casual subscribers using things on and off?

</comment></comment></comment></comment><comment><USER9> It would seem that ultimately the only real way to get privacy is to either create a verifiable end to end encryption including the content server not having logs and not compromised and the other way would be pooling of user data in a way that spreads the blame across many people. Otherwise basically everything you do is trackable even if you use a vpn. Is there any other way?

<comment><USER7> If you want real privacy at the consequence of slow speeds and unfortunately a worse browsing UX, you should use Tor.

Every service that is widely available / permissionless AND offers real privacy, will end up getting degraded, CAPTCHA'd or blocked. That shows it works1

<comment><AUTHOR> Yes, agreed.

But I don't trust Tor either, so I'd first use a nested VPN chain. Just in case the entry guard is malicious. And to complicate the traffic analysis a little.

I could go on about this. But I'll be writing more about all this.

</comment></comment></comment><comment><USER10> This is why I just use AlgoVPN. I know where my traffic is going and can install it on any cloud instance I want. At the moment I'm running it on my laptop, phone, and my RPI cluster.

<comment><USER11> But then you get no privacy benefits of VPNs: pretty much all cloud providers will be to tell to law enforcement, given an IP address, who and when rented it from them.

And since you're not, I suppose, reselling your traffic to other users, the liability for problematic traffic will land on you.

<comment><USER12> You have no way of verifying that a VPN lacks that capability. If you want anonymity, use Tor.

<comment><USER11> Correct. It's even more complicated than just trusting a "no logs" policy. You have to also trust that noone with hardware access (rogue VPN company employees, datacenter people, law enforcement and intelligence services) intercepts your traffic or messes with the servers, and that the servers themselves don't get hacked due to some vulnerabilities. Recall how NordVPN recently got hacked because datacenter operator left vulnerable remote management software exposed.

Tor might have its vulnerabilities as well, like all software. Not to forget that pretty much anyone can run an entry guard today and at least associate your IP with usage of Tor..</comment></comment></comment></comment>


CKEditor 5 v1.0.0 beta released - <AUTHOR> https://ckeditor.com/blog/CKEditor-5-v1.0.0-beta-released/ <comment><USER2> This might come across as a bit 'gushy' but it really has had a massive impact on what I am working on and what it enables us to do.

I've been evaluating WYSIWYG editors to use in one of our main products for about a year now. I stopped looking when I saw CK5 back in Alpha 1.

It ticked all of the boxes: modern build architecture, easily extensible, diffs/deltas/transform-ops at the core for collaborative services -- it's made for today and the future. And so much more than that. Where CK4 was great for what is now legacy browsers, CK5 is completely fresh and new for current & future browsers.

I highly recommend checking it out and to absolutely consider using it in a project that needs any form of rich text editing.</comment>