Privacy Disaster At Twitter: Direct Messages Exposed (Update: GroupTweet Is Likely Culprit) - <AUTHOR> http://www.techcrunch.com/2008/04/23/privacy-disaster-at-twitter-direct-messages-exposed/ <comment><USER2> Twitter should implement OAuth or equiv for it's api. I'm fed up of handing out my password to third party twitter applications.

<comment><USER3> The irony of this is that Blaine Cook is one of the leads on OAuth, IIRC.

<comment><USER2> _"OAuth began in November 2006, during which Blaine Cook was developing the Twitter OpenID implementation"_ [0]

Now that is most strange. Perhaps it's still in development?

[0] <http://en.wikipedia.org/wiki/OAuth>

<comment><USER2> It appears as I wrote this, Blaine has left twitter

</comment></comment></comment></comment><comment><USER3> That's pretty rough. Maybe someday people will just stop using services that ask you for your passwords to other services. It's ridiculous.

</comment><comment><USER4> Why would you use twitter for personal messages? It just doesn't make any sense :/

<comment><AUTHOR> If it's a personal message, it's the equivalent of an sms on the web.

<comment><USER4> Sure. It just seems an odd choice. It's like using a blog to do revision control, by posting your source code as a new blog post each revision.

Each to their own though...</comment></comment></comment>


Dekoh - an open-source challenger to Adobe's Apollo, launches - <AUTHOR> http://www.dekoh.com/index.jsp <comment><USER2> There is a blog entry on their site which compares Apollo with Dekoh. Its totally misleading and is a lie.

<http://www.dekoh.com/blog/news/entry/desktop_ria_comparison_dekoh_verses1>

</comment><comment><USER3> Looks cool, but I worry about all these incompatible widget engines. It seems like a step backwards ("This widget best viewed with X").

</comment><comment><USER4> this is nothing like Apollo. it's a local web server/app, which syncs to web sites

<comment><USER5> Similar to .mac accounts then?</comment></comment>


How Chrome uses a Bloom filter as a quick malicious-site check - <AUTHOR> http://blog.alexyakunin.com/2010/03/nice-bloom-filter-application.html

<comment><USER2> >Bloom filter allows Chrome to use precise verification service practically only when the user actually goes to a malicious web site.

Not quite true. This ignores priors (<http://en.wikipedia.org/wiki/Prior_probability>) How many websites does an average Chrome user visit in a day? Let's pull a number out of the air -- 1000? If, as the article suggests, 1% of them are false positives, the bloom filter will have 10 false positives per day.

How often does a user hit an actual malicious site? Once a day? a week? Let's say once a day. So 1 true positive malicious sites, 10 false positives. Over 90% of positives are false! So most of the time when you need to precisely verify the maliciousness of a site, the site is safe.

Of course, given that you only need to do this check a handful of times per day, this seems like a valid tradeoff, but Bloom filters here are no panacea.

<comment><USER3> Your math is a bit topsy-turvy. You're ignoring the 990 sites it _didn't_ have to check.

That's 10 sites to check out of 1000 - 1% of the load of checking (remotely) all 1000 sites (or 0.9% if you only count the false positives) wasted.

<comment><USER2> I'm ignoring the 990 sites it didn't have to check because it wasn't relevant to the quote I was discussing:

>Bloom filter allows Chrome to use precise verification service practically only when the user actually goes to a malicious web site.

This is saying that most of the time the Bloom filter returns a positive (and therefore Chrome needs to use precise verification), it's a true positive. That's clearly not true.

<comment><USER4> But you've missed the entire point, which is that normally the browser would have to run the slow check on the 1000 sites, now it only has to run the slow check on 10 of them. That's a huge improvement, even if 9 of them turn out to be false positives.

<comment><USER5> You're both right, and I'm pretty sure zck understands and appreciate the time savings that you're talking about. He's just pointing that the author's statement that "only malicious sites needed to be tested" is blatantly wrong.

<comment><USER6> Except, that's not what the author said. He said "practically" that.

</comment></comment></comment></comment></comment></comment><comment><USER7> Anyone who's interested in Bloom filters check a great blog post by Adam Langley about its variants with links to papers: <http://www.imperialviolet.org/2011/04/29/filters.html>

<comment><USER8> context: Adam Langley is a Chrome developer.

</comment></comment><comment><USER9> Here's a link to the relevant part of the Chromium source tree: [http://src.chromium.org/viewvc/chrome/trunk/src/chrome/brows...](http://src.chromium.org/viewvc/chrome/trunk/src/chrome/browser/safe_browsing/)</comment>


Truss: an opinionated assertions API for Clojure/Script - <AUTHOR> https://github.com/ptaoussanis/truss <comment><USER2> I'm glad to see `have!` and friends get into their own package. I've used them extensively in Peter Taoussanis's encore library and was a little afraid of them being labeled 'deprecated' recently. Good to know I won't have to move these into my own utility library.</comment>


Show HN: Startup Stash – Curated directory of 400 resources and tools for startups - <AUTHOR> http://startupstash.com

<comment><AUTHOR> Startup Stash is a curated directory of resources and tools to help you build your startup. It includes 400 products in 40 categories, like for example: Idea Generation, Early users, Marketing, Raising Capital and Customer support. Each category consists of 10 handpicked resources and tools, all with their own detail page that displays some info about the product.

I thought it would be fun to build a simple and useful site that can help you find resources and tools while building your startup. Hopefully Startup Stash will become the first thing you look at when you need a certain tool, just like an oldskool startpage! :)

Would love to hear your thoughts!</comment>


UN report: electronic waste levels surge 20 percent in the past 5 years - <AUTHOR> https://news.yahoo.com/e-waste-levels-surge-20-percent-5-years-150721113.html <comment><USER2> Not mentioned in the article, but I bet it's also due to companies making upgrading and repairing hardware difficult.

<comment><USER3> Hopefully this will help: [https://news.ycombinator.com/item?id=23648890](https://news.ycombinator.com/item?id=23648890)</comment></comment>


Calacanis vs DHH on This Week in Startups - <AUTHOR> http://thisweekinstartups.com/2010/03/fridays-guest-david-heinemeier-hansson-creator-ruby-on-rails/

<comment><AUTHOR> Most of the discussion is over now, but the video will be reposted to this url by Monday. It's the first time I've ever seen someone do a good job attacking dhh/37signals. It's not belligerent, but very probing. Makes me wish I could have seen Calacanis when he was a tech journalist.

<comment><USER2> I think I would have become one of the top 10 tech journalists ever if I had not been cursed with being a CEO/founder.

Sometimes I wish I was still a journalist.

<comment><USER3> And you wonder why people hate you.

"I could have been one of the best ever if I weren't cursed with having to make millions of dollars." It sounds so cocky.

I actually don't hate you (When I first heard of you, I asked a friend of mine "Is this guy a dick, totally awesome, or both?" and I still think "both" is a pretty good way to describe you, so you could say I'm split.), but I hope you see why people do.

<comment><USER4> _but I hope you see why people do._

And like Jobs, Gates, Ellison, Branson, or whoever, I hope he doesn't _care_ if random people on the Internet think he's arrogant or is a "dick." You don't get to even Jason's level by dwelling on this (or, at least, showing it in public).

That aside, if Jason had a ton of time to dump into being a "top tech journalist", would he be up against _really_ serious competition? Cringely? Mossberg? Scoble? Arrington? All awesome in their own ways but the gamut of skill in that game is pretty thin.

<comment><USER5> He seems to care enough to post in nearly every HN thread that mentions him, often pretty defensively, unlike those other people you mentioned...

<comment><USER4> Good point. I guess he's not far enough up the totem pole yet to stop hanging out with us serfs ;-)

Actually, I wish he _would_ try and become a top 10 tech journalist. His writing is good and certainly more entertaining than the constant Mahalo SEO- runaround forced down our throats here at HN..

<comment><USER2> I like to talk with folks.... it's the journalist in me. I don't consider you guys/gals serfs--far from it. I consider you guys the real people who actually do sh#$%t. Most of the folks I get to hang out with are CEOs and VCs who talk about the sh2@#$t their people do. I'm all about the doing....

... thus the reason I'm here with the doers. I'm from the bottom, so I still feel it for the bottom.

<comment><USER4> _I'm from the bottom, so I still feel it for the bottom._

      Don't be fooled by the blogs that I rocked;
      I'm still, I'm still Jason from the block
      Used to have a little, AOL gave me a lot
      Mahalo isn't spam and I still know where I came from.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> 404 error and I can't find the content on the site. Why was it pulled?

<comment><USER6> [http://thisweekinstartups.com/2010/03/twist-46-with-david- he...](http://thisweekinstartups.com/2010/03/twist-46-with-david-heinemeier- hansson/)

<comment><USER4> Cool, but it doesn't play. The video gets a 403 error and the audio a 404 (on the underlying media files).

</comment></comment></comment><comment><USER7> Eh .... 30 seconds in I'm listening to some guy crap on about how awesome Apple are _because_ they only put one USB port in some laptop.

Back to work for me.

<comment><AUTHOR> The interview section from about 45 min to 90 min in was really good, worth coming back to when the full version is posted.

<comment><USER2> Thanks! DHH was an amazing guest with great perspective and obviously he has the talent to back up his positions.

Really enjoyed having him as a guest.... the show will be up at www.thisweekin.com in two hours or so.

best j

</comment></comment></comment><comment><USER8> "Couldn't care less" versus "don't care very much" on "wow, i really don't care".

The blogosphere is like an organism that can eat itself to survive and grow.

</comment><comment><USER9> The interesting bit is where David gets sucked into Calcanis' "more money is best" angle (and in some respects, JC's brain really lucked out on picking up on this weakness).

From what I can tell, DHH is much more focussed on Quality of Life than simple monetary gain which was only briefly touched on (if at all).

Good discussion.

</comment><comment><USER10> I hope somebody (Jason?) starts doing shorter 10m summary videos of this.

<comment><AUTHOR> <http://thisweekintwist.com/>

</comment></comment><comment><USER11> Does anyone have a link to the video?

<comment><USER12> Its usually posted on itunes a day or so after.

</comment></comment><comment><USER13> I was just thinking, it's been about 4 or 5 days since the last rash of "Calacanis is an evil SEO monster bird mecha godzilla thing" blog postings.

<comment><AUTHOR> This didn't have anything to do with that. This was one of the most even yet intense debates I've seen in a while. Most of the time it's either one dominant person that no one is standing up to, or everybody is buddy buddy and I get suspicious about the lack of disagreement. The was healthy debate.

<comment><USER2> I loved it. David is a smart, passionate guy... you don't see that too often in our business. he reminded me of a young Mark Cuban</comment></comment></comment>


YC Summer 18 ( Invites / Rejections ) - <AUTHOR> Has anyone received an invite/rejection email for the Summer 2018 batch yet? <comment><USER2> Last year ours came on April 18 around 8:30PM Eastern 5:30PM Pacific for an early May interview. For some reason I do recall a mention of April 17 this year, so perhaps later on today.

Best of luck to everybody doing great stuff and if you're in the hunt - we are hoping for an invite to interview for YC BIO.

</comment><comment><USER3> There's a live chat for applicants here if anyone wants to join: [https://communities.metachat.com/communities/ycombinator](https://communities.metachat.com/communities/ycombinator)

</comment><comment><USER4> While everyone is waiting

[https://www.quora.com/What-is-it-like-to-be-rejected-by-Y- Co...](https://www.quora.com/What-is-it-like-to-be-rejected-by-Y-Combinator)

</comment><comment><USER5> Rejection. B2B product with traction, Consistently growing revenue, Brick & Mortar 2.0 RFS, India. No AI or any other advanced tech. Good old SaaS. We had a pre-interview video call as well.

Feel sad but I guess the application process did give a lot of perspective. Kudos to all who got it. For everyone else, keep calm and build a business. :)

</comment><comment><USER6> I read some persons already got invite email already, see chat link below [https://communities.metachat.com/communities/ycombinator](https://communities.metachat.com/communities/ycombinator)

</comment><comment><USER7> Or is it possible that the distribution here is really skewed? The ones who got the invites would not be here anxious, they probably ate having a beer and are high already. It's just us. Non invites ganging up.

</comment><comment><USER8> Still no word over in Europe either. Which leaves us with the choice of pulling an all nighter hitting refresh button in Gmail or staring at the ceiling

</comment><comment><USER9> I haven't heard back but, I wish all of you good luck and even if you get rejected be like Phil knight and never stop!

<comment><USER10> Who was Phil Knight? Why did you mention him?

<comment><USER9> The founder of Nike, a real inspiration of mine!

<comment><USER11> Did he... just do it?

<comment><USER9> I believe so lol, got rejected :( but, I am going to make sure they regret there decison and develop the crypto economy

<comment><USER12> I am sorry to hear that. Did you submit late? We did and haven't heard anything so we are super anxious.

</comment></comment></comment></comment></comment></comment><comment><USER6> Waiting, nothing yet, praying I get it. really looking at the ceiling while continuously hitting my email refresh button.

</comment><comment><USER13> We haven't heard anything yet... it's been a week... has anybody else heard anything this week april 24th?

</comment><comment><USER14> Quick question: Do all the founder of the start up receive the email or just the one who applied for them?

</comment><comment><USER15> Still did not receive anything, will post here when I get it. Good luck everyone! Hope to meet you there!

</comment><comment><USER16> This is nerve-racking, I've been refreshing my email every 5 minutes for the last 8 hours

</comment><comment><USER17> A friend just got an invite at 10:50 pm, for those still waiting keep your fingers crossed!

</comment><comment><USER18> Anyone have any good startup ideas? Need a distraction. The suspense is killing me...

<comment><USER19> Ideas are dozen a dime. Lets talk about if anyone failed trying a good idea and how.

</comment></comment><comment><USER20> Very anxious to hear back but nothing yet for me or my co founder (UK and Argentina)

</comment><comment><USER21> Not yet, but I am sure they must be slammed with 1000s of applications

</comment><comment><USER19> I believe the emails will start coming between 6 and 6:30 PM PST.

</comment><comment><USER22> Haven't heard anything yet either. Crossing my fingers :)

</comment><comment><USER23> it is '[PT] April 17, by 10:36PM' now. They said the invitation (or rejection) email will be sent April 17, by 10PM. But did no one get an email for it?

</comment><comment><USER24> No email yet, we had a video call on Sunday! The suspense...

<comment><USER25> For real. I barely have nails left.

<comment><USER24> Startup Idea; On-demand nail-replacement kit for anxious YC applicants.

<comment><USER26> name idea: You Nailed It

<comment><USER24> Nailed it.

</comment></comment></comment></comment></comment><comment><USER27> Just got the email! Aaaaaaaaaaaannnndd its a rejection!

</comment><comment><USER28> It's early morning here in India and no email yet.

</comment><comment><USER7> Do they always send a rejection mail if not invited?

<comment><USER27> Yes they notify you either way

</comment></comment><comment><USER20> Just got a rejection. No issue will keep building.

</comment><comment><USER29> Got the email and yesss, we're coming to SF...

Love from Indonesia!

<comment><USER27> What's your startup?

<comment><USER29> SaaS, B2B. All-in-one platform for selling on any channels, integrated with 50+ partners worldwide.

How about yours?

<comment><USER27> We are on your flipside. If you are selling on any channel then we provide 3pl warehouses based on your inventory. Our AI let's you know where to stock and how much. The link is [http://www.aihello.com](http://www.aihello.com)

We have a mutual match, can you link me your startup?

<comment><USER29> Interesting, I think your site needs to provide more information on how it works, and the features in general... just my 2c.

Sure.. happy to connect. Link to my startup: [http://isellercommerce.com](http://isellercommerce.com)

<comment><USER27> Thanks for the feedback. I am working on your feedback today.

I love your website theme. I will hit you up from your contact is section. I want to know if your customers in EU/US/INDIA would ever need a 3pl service. We have tie up with major warehouses and we can expose our apis to you for free ; we take a commission from the warehouses

</comment></comment></comment></comment></comment></comment><comment><USER30> Still no answer and im starting to piss my pants

</comment><comment><USER31> Our group hasn't heard good or bad yet

</comment><comment><USER32> we have applied before deadline but still did not get any response. do they send answer to all project team ?

</comment><comment><USER33> No email yet here either. Good luck all!

</comment><comment><USER10> Anyone from India who got email by now?

<comment><USER34> Yes

</comment></comment><comment><USER35> Received a rejection just now :/

</comment><comment><USER36> in Sydney, it is already ~9 am of the 18th :) so we should get those emails earlier.

<comment><USER37> In Sydney, I think emails should arrive around 3 PM....stressed out !!

</comment></comment><comment><USER38> Still haven't heard back..

</comment><comment><USER39> Has anyone gotten any email yet

<comment><USER40> Nope, this is agonizing.

</comment></comment><comment><USER41> Nothing yet, waiting nervously

</comment><comment><USER42> Just got the rejection email.

</comment><comment><USER10> Who are single founders here?

<comment><USER17> A friend of mine just got an invite as a solo founder, bio RFS

<comment><USER10> Whats the name of his startup/website?

<comment><USER17> No website, it's a bio startup so don't need a website. Developing new immunotherapy drugs for cancer

</comment></comment></comment></comment><comment><USER43> Just got the rejection email

</comment><comment><USER25> ...

</comment><comment><USER44> Common @simplygoodjars!!!

</comment><comment><USER45> also nothing heard from YC in Japan either. has anyone got mail?

<comment><USER46> 6am in France and no mail

<comment><USER45> ok thanks.

</comment></comment></comment><comment><USER25> No one yet? No one?

</comment><comment><USER37> no emails yet...is live chat working for anyone?

</comment><comment><USER47> Still no emails ?

</comment><comment><USER48> Hands are crossed

</comment><comment><USER44> @simplygoodjars

</comment><comment><USER49> hi, does YC send a rejection email?

<comment><USER36> yep

</comment></comment><comment><USER37> anyone in Australia got email??

</comment><comment><USER14> So?</comment>


Click that'hood - <AUTHOR> http://click-that-hood.com/

<comment><AUTHOR> A rather fun game. The data from Seattle is "official" so calls Ballard "Adams" - a name I've never heard anyone but the city clerks office use. And a few other things of that sort. But by and large it's accurate, and interesting.

The code is here: <https://github.com/codeforamerica/click_that_hood> and interesting to peruse.

</comment><comment><USER2> Wow, I don't know a single neighbor hood in my area...</comment>


Bitbucket Cloud gets a new navigation experience - <AUTHOR> https://blog.bitbucket.org/2017/04/11/bitbucket-cloud-gets-a-new-navigation-experience/ <comment><USER2> So glad they updated the UI</comment>


Minnesota students compete well against world in math, science - <AUTHOR> http://www.startribune.com/local/stpaul/35770434.html?elr=KArksLckD8EQDUoaEyqyP4O:DW3ckUiD3aPc:_Yyc:aULPQL7PQLanchO7DiUT

<comment><AUTHOR> The full study was published today as a .PDF document.

<http://nces.ed.gov/pubs2009/2009001.pdf></comment>


How can I rename / delete my account? - <AUTHOR> For personal security reasons, I'd like to anonymize my old account. Is it possible for me to change the username to something more anonymous? I accidentally shared some controversial views using a username I use on other sites and I don't want people using them against me. <comment><USER2> Email email@example.com for such requests.</comment>


Mockito 2.1.0 - <AUTHOR> https://github.com/mockito/mockito/wiki/What%27s-new-in-Mockito-2 <comment><USER2> I spent my undergraduate thesis on automating the production of mock objects and unit tests using program tracing via the JDK's debug APIs [0]. I'd thought it might be useful to have a tool which, requiring no user input, would output when expected contracts of behaviour (in the context of two objects interactions with each other at production) had changed. I wrote my tool to generate JUnit/Mockito tests. It was almost bulletproof in producing working tests for arbitrary Java bytecode (see the link for examples).

At the end of it I was utterly disillusioned that the vast majority of tests with mocks were actually useful to an end developer. It felt too fragile and made refactoring work much more of a chore. Since then I've tested via constructing independent slices of implementation and pushing sample input/output in. In my experience, it has being vastly easier to maintain such a test suite.

I've meant to go back and open source my tool for a while, but found other parts of life getting in the way. If anyone's interested, would love to chat about it (might help me find motivation to continue the work).

[0] [http://www.doc.ic.ac.uk/teaching/distinguished- projects/2015...](http://www.doc.ic.ac.uk/teaching/distinguished- projects/2015/t.rooney.pdf)

<comment><USER3> I have recently ventured into auto-mocking, see [http://zealake.com/2015/01/05/unit-test-your-service- integra...](http://zealake.com/2015/01/05/unit-test-your-service-integration- layer/), which allows me to run super fast unit-tests, that are really doing end-to-end testing, giving me 100's of end-to-end tests per second. Is that the same line of thought as your "independent slices of implementation and pushing sample input/output in"?

<comment><USER2> That's a really interesting idea. It looks like you're capturing and proxying the latest backend request/response patterns used in its test suite into a frontend test requirement so that you can run them both independently, and thus much faster, whilst still keeping most of the assurances of an end-to-end test. I'm going to have to think about applying that approach to my own projects.

What I actually meant is slightly more literal. The backend of my latest web project is 100% web client invocable functions in AWS Lambda. The frontend is a static site built in redux with sagas. The view is a dumb layer mapping state to html and dispatching redux actions which are picked up by the sagas. Each saga only invokes one lambda function, though does send/receive signals with other sagas. Responses break down into state changes which map to a single react view.

By taking this path all implementation can be visualised as discrete slices of logic. Moving signals `up` and `down` the slice requires request/response patterns between the components. To test, I run a script against the developer staging area which sends API calls to each function and diffs the result with expected response back. It is fragile to any change which affects API responses, but is dumb enough that it gives me confidence to flip the switch turning staging environment into production. Its super easy to maintain and update, though I suspect it'd be difficult to apply the approach to more complex application domains (this is a virtual telephone number service).

</comment></comment></comment><comment><USER4> And in most cases you will regret the web of mocks you have made :)

<comment><USER5> Do you have any examples of where mocking has let you down? I found creating unit tests with mocks and DI extremely easy and satisfying. At least for me, they also provide a pretty convincing argument that the tested code is correct.

Also, they are basically required if you want to do any testing with external services. I'm not sure how else you could create unit tests for DBs etc.

<comment><USER4> Yes. Every project I have ever used with a web of mocks, especially around final things made refactoring near impossible. At some point the codebase got so brittle, it fell apart.

I find it funny that in most discussions around mocking, a database is the given example. 100% of the time when I need a database for "unit tests", I use a database. Not a mock. I don't want to know that when I do select blar from flar I get back the value 7, and hardcode it. I want to actually load the data and see it happen. Because if I don't, how do I know that my code will actually work in production?

Sometimes that involves sqllite (easy but not preferred because I don't use it in production). Sometimes it just involves running a local database that gets built up for a unit test run. Sometimes something like docker, sometimes not. Sometimes a shared "dev" database. Lots of options. But literally every project I have been involved with that used a REAL database instead of mocking it out, has worked better and been more stable and easier to change.

Now for actual external services.. say you call some Netflix API. Yes don't call that for real in a unit test. But you can do that with either:

a) Basic mocking, because you created a very simple API. You don't just call some random driver directly with your code, right? You have an interface in front of it. Then you can mock it with no final or static override crap going on.

b) If your API is clean enough, you can just code up a very simple dummy implementation. Lets you set the return value for methods, then the next call it gives them back.

I don't feel that strongly between A and B above. But I feel very very very strongly about people mocking databases or, even worse, every random call between classes in their own codebase, or someone elses codebase.

<comment><USER6> > I find it funny that in most discussions around mocking, a database is the > given example. 100% of the time when I need a database for "unit tests", I > use a database. Not a mock. I don't want to know that when I do select blar > from flar I get back the value 7, and hardcode it. I want to actually load > the data and see it happen. Because if I don't, how do I know that my code > will actually work in production?

That is not a unit test. What if your database is corrupted? What if your mock Netflix API is buggy? The second you do anything like that you're no longer unit testing. The whole point is you're testing a single method/class in isolation -- Mockito gives you the power to assume external structures (the database) work as expected.

If you don't like unit testing, sure. But unit testing is what Mockito is all about.

<comment><USER4> What if my DB is corrupted - Why did it get corrupted? Sounds like you have a good failure to chase down. It would be even worse if your prod DB got corrupt!

For most use cases, a given piece needs 1 test around it. "The test". If you can test your logic + view + db all in 1 test, you get a pretty huge efficiency gain.. over sitting there writing "unit tests" where you mock what a select * from a database returns. Life is too short to do that.

<comment><USER5> Having just a single set of tests has a lot of draw backs compared to splitting up your tests.

Consider this, we have a simple CRUD app that uses a datastore.

Since you want everyone to be able to run the test suite locally, setting up a local datastore manually isn't an option. You need a script/function that will setup the database.

Because you want your tests to be as deterministic as possible, and you don't want the order that tests are executed in to change the results, you need to setup the database before every test, and then clean it up again after the test.

However, setting up the datastore and cleaning it up again can take significant amount of time. Even if it only takes 5 seconds, when you multiply it out for each test your test suite can now take 100x longer to run.

This means you have now limited yourself to being able to run tests after you have completed large changes, and not incrementally.

Also when a test breaks, you now need to determine if it is broken because your DB isn't configured correctly, or because something is wrong with your code.

You can help mitigate these problems by creating 2 sets of tests. Unit tests and integration test. Unit tests use mocks, and run quickly. Integration tests will create a environment that mimics what you have in prod, and will take a while to complete.

I think you also overestimate how long it takes to write mock tests.

Hopefully this provides some insight into why I think unit + integration tests are the way to go.

<comment><USER4> > Since you want everyone to be able to run the test suite locally, setting up > a local datastore manually isn't an option. You need a script/function that > will setup the database.

Since we want our environment to be reproducible and stored in git, this is a requirement anyway. If your schema is not versioned in Git, and cannot automatically be applied in all environments, including prod, you are doing it wrong.

> Because you want your tests to be as deterministic as possible, and you > don't want the order that tests are executed in to change the results, you > need to setup the database before every test, and then clean it up again > after the test.

No not really. Lots of ways to solve this. For example DJango will run a test in a transaction, ensure it passes, then roll back the transaction. Order thus does not matter, the DB is cleaned up for free.

> However, setting up the datastore and cleaning it up again can take > significant amount of time. Even if it only takes 5 seconds, when you > multiply it out for each test your test suite can now take 100x longer to > run. This means you have now limited yourself to being able to run tests > after you have completed large changes, and not incrementally.

So the old wisdom on this is that unit tests should be able to run in 5 minutes or less. Just a silly Django crud app with a parallel test runner, you can do something like 50k-100k tests in 5 minutes (Most tests take about 1/10th of a second, with several going on in parallel). Past the 50-100k test mark it gets harder to do locally, but is trivial to do in CI (for example, there are several CI as a service services that split your tests between containers, so you can run any number of parallel containers).

> Also when a test breaks, you now need to determine if it is broken because > your DB isn't configured correctly, or because something is wrong with your > code.

Because database state and schema is stored in git, and applied programmatically, we already ruled out the DB. So if a test breaks, it is the code.

> You can help mitigate these problems by creating 2 sets of tests. Unit tests > and integration test. Unit tests use mocks, and run quickly. Integration > tests will create a environment that mimics what you have in prod, and will > take a while to complete.

To me, you had a problem (Database not consistent), and rather solve it in a sane way (store schema in source control, apply automatically) - You solved it in a very roundabout way (worry about which class of a tests a given test is in, write two types of tests, still fight bad schema in prod issues because you didn't solve the root problem (schema not in source control) )

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> After journeying through many languages since my long time with Java that ended in 2011 I have to say I have yet found a mock object framework in other languages that match the expressiveness that Mockito did. Python's mock has the least memorable API I have ever worked with. :-(

<comment><USER8> This is because using Mocks in a language like Python is a bit awkward and unnatural in itself... if you look at the way tests are usually written, there is just little need for it. That's also the reason why only recently unittest.mock was added in the first place.

<comment><USER9> Can you elaborate on this? What is the correct way to test external services that may have side effects in Python?

<comment><USER10> I think maybe because there is no type checking in Python. This makes it more trivial to have objects that quack like a duck, without the need to explicitly create a class that conforms to an interface.

<comment><USER11> FWIW, you don't do that with Mockito either, in Java land.

Mockito will happily use the existing type definition of your dependency, provided that the class declaration is not final (i.e. can't be extended).

<comment><AUTHOR> This is actually not a requirement anymore. Mockito 2 can mock final types and methods.

</comment></comment></comment></comment></comment></comment><comment><USER12> There's been a lot of discussions on Mockists vs Classicists. See Martin Fowler's article: [http://martinfowler.com/articles/mocksArentStubs.html](http://martinfowler.com/articles/mocksArentStubs.html). In my experience, projects that use mocks extensively usually have the most bugs. If you also have integration tests then mocks are ok. But then it's more code to maintain.

Given a choice I would always do "integration test". Fact is you can test a single class/method, reality is that no class/method exists alone.

<comment><USER13> We recently implemented an extensive test suite that can be run with either mocks for service dependencies or in a live configuration, depending on config settings. Before, we simply had integration tests that relied on _very_ specific data across disparate services and running it in CI was a nightmare (to the point that we would typically only run the full suite in a QA environment shortly before a production deploy).

Whereas our integration testing has been responsible for catching hundreds of obscure bugs over the past year, most of the bugs found by our mocks have been bugs in the mocks themselves and I expect that issue to compound due to the brittle nature of mocks in general. Mocks make every change some multiple more expensive in both initial cost and maintenance.

</comment></comment><comment><USER14> This project is the standard case I use when telling people not to choose project names in a language you do not speak. It means "booger" in Spanish.

<comment><USER15> A little one, though.

</comment></comment><comment><USER16> Thank you Rafael, Tim, Marcin #1 & Marcin #2! Great team and great project!</comment>


Y Combinator interview decisions postponed to November 15 - <AUTHOR> We originally intended to invite people to YC interviews on November 13.  But we pushed the application deadline back by 3 days because of Sandy, and it turns out there
is just not that much slack in the system.  We need more time to read applications, so we're going to push back
our deadline too, to November 15. <comment><USER2> Good luck everybody.

If you fail, don't worry, keep learning, iterating and hustling.

We failed last time, made some changes and then successfully raised from great early stage investors.

<comment><USER3> great job! great attitude! who did you raise from and how did failing at YC application help you? I've applied for this cycle. Waiting eagerly.

<comment><USER2> We eventually raised from SV Angel, Floodgate, TechCrunch co-founder Keith Teare (Archimedes Labs) and others. We had enough offers to raise 1M, we took only 700K.

We didn't get much feedback during the interview; Paul, Robert and Trevor didn't give us a hard time, they actually liked the product. 10 minutes feels like a minute.

But the vision we pitched them was rough around the edges. We re-branded the product and changed market positioning completely right after.

</comment></comment></comment><comment><USER4> FYI. Shifting by a couple of days could significantly increase the cost for international applicants because international flight prices often increase steeply in the two weeks leading up-to the the flight date.

<comment><USER5> Paul Graham stated that the interview dates won't be adjusted, just the announcement:

<http://news.ycombinator.com/item?id=4775020>

<comment><USER6> It doesn't matter. If the announcement is made later you buy the tickets later which makes them more expensive.

<comment><USER7> Not only tickets matter for international applicants, I believe, there are a lot of applicants who have a visa-stuff going on... And this is more troublesome than expensive tickets.

<comment><USER6> US Embassies change from country to country so don't read this as gospel, but if you don't have your visa 15 days before the interviews you're probably too late now :(

</comment></comment></comment></comment></comment><comment><USER8> I would cross my fingers but then I wouldn't be able to code very well. Good luck everyone!

<comment><USER9> Good luck to you too :)

</comment></comment><comment><USER10> Any applicants (past, present, future) interested in having an informal meetup this weekend? Whether we get good news or bad news on the 15th, getting together would be a great morale boost and it'll be fun to meet everyone! I happen to be in Silicon Valley, but I'll be there in spirit for fellow applicants everywhere else :)

Contact info's in the profile. Good luck to everyone!

<comment><USER10> I've created a separate post for this: <http://news.ycombinator.com/item?id=4775943>

People from other areas are welcome to start comment threads based on location.

</comment></comment><comment><USER11> Thanks for the update. Good luck everyone.

While we wait I thought i'd create a friendly competition for all the y Combinator January hopefuls. Enter your product or team video here: <http://www.topthat.com/brandon/yCombinatorProductVideo>

</comment><comment><USER12> Thank you for the update and I look forward to 11/15. From looking at the website, all of the photos are primarily male, so I am hoping to add some female diversity to Y Combinator for 2013. What women wouldn't want to be surrounded buy hundreds of intelligent men for three months? :)

</comment><comment><USER13> Will this affect interview dates?

<comment><AUTHOR> No.

<comment><USER14> Thanks for the update!

</comment></comment></comment><comment><USER15> But my f5 key is almost worn out! :) This makes perfect sense, best of luck getting through the applications and thanks for postponing the applications for those effected by the hurricane.

</comment><comment><USER16> Yeah, hopefully everyone on the east code made it through the hurricane and its aftermath okay! It really gave me a perspective on communities helping each other in the local area, even when the government doesn't come in right away. I'm hoping next time around, we'll be able to have tools that enable people to come together and organize more easily. It makes me feel sorry we've taken this long to launch our stuff. Could have used it.

But more than that, of course, I'd rather there not be a next time.

<comment><USER17> I love that "east code" lapsus! Keep coding and good luck to everyone!

</comment></comment><comment><USER18> To the applicants here. I'm using YouTube stats as a metric whether or not our application was read. We have 5 videos in the application: 1 team video that was watched by someone from YC; 3 videos about teams' past work - only one was watched from California in the last 10 days, and we can't be sure it's someone from YC because it's a public video; 1 video showing the proof of concept of our product - not watched. So, I'm guessing this is a bad sign for our application? :)

<comment><USER19> I'm not part of YC so take this with a grain of salt, but I don't think that not viewing videos is necessarily a bad sign based on comments I've seen from the YC founders about the subject. Videos are mainly viewed to see the chemistry between founders. Someone posted on HN the other day who said that last batch their video had 2 views and they got an interview. As long as your written application has all the relevant info, I wouldn't worry about this stuff.

</comment></comment><comment><USER20> We understand.

Sandy made a HUGE impact in the Northeast. I was so appreciative that you extended the deadline a few days for that corridor. Although, that would of meant I could of gone to my best friends wedding...

More time to read applications and give second glances is a plus to ALL of us. Thank you for deciding to alot enough time to make an informed and educated decision about your startup companies.

We look forward to the 15th!

</comment><comment><USER21> Something told me, to search YC interviews,was beginning to think that i was on the receiving end of bad news or no news at all. On the contrary,more time should give applicants a overly decent review and decision. Good luck to every one, hope to see most of you and hearing/collaborate during the program,. Also, thanks to YC for the update and present opportunity. !

</comment><comment><USER3> Thanks for the heads up. I think everyone is waiting impatiently to hear back from you guys. Good call on extending the deadline too.

One question though: I have been checking this site every day for any potential questions from YC regarding my product / startup, just by scanning the "new" and "ask" sections for anything that may be related.

Is there a simpler way to spot if there was a question directed at me?

Thanks!

<comment><USER22> I wondered this too, and was worried I'd miss questions. I poked around though and found this on quora: <http://b.qr.ae/UDFIqn>

Apparently questions are not super common.

<comment><USER23> I remember a few years ago they asked me a question about my application. It was pretty easy to spot. If I remember, the topcolor changed and there was a new menu option that took me to the question (it basically looked like any other story on HN, except only me and pg were commenting).

Now I kind of wish I took a screenshot.

</comment></comment></comment><comment><USER24> If the interview also gets pushed back, then that's 3 more days to work on our product... assuming we get in that is.

Good Luck Everyone

</comment><comment><USER25> You're playing with lots of anxiety here pg! Anyway, hope to see you soon in our interview :) Good luck everyone!

</comment><comment><USER9> That was expected (given the deadline change) but the notice is highly appreciated. Like everyone else, we spent a lot of time going over the application and fine-tuning it. Personally speaking, we are glad you're taking a comparable time reviewing the application given Sandy and all.

</comment><comment><USER26> Whatever the outcome, us start-ups should always takes things in their stride and focus on the end goal. I've always held the belief that things happen for a reason and if you works hard towards something, you will get it, even if it was not the intended path.

<comment><USER27> Totally agree. Fundraising is a tactic, not a strategy.

It makes sense only if you're doing stuff _you would have done anyway_ to build the company.

</comment></comment><comment><USER28> Read news about 3.2M round by Amicus (YC-S2012). Feel very excited! We're solving the same problem in another way - combining micropayments and social graphs for non-profit fundraising. Looking forward for Day X! Good luck everyone!

</comment><comment><USER29> Thanks for the update being in the UK with the time difference we were beginning to wonder if it was bad news but gladly we are still in with a chance. Good luck to all of you and hopefully we'll get to meet you in January 2013!

</comment><comment><USER30> Thanks for the update.I am from India so got this news now. Now the fingers are crossed. I hope for the best. And Also would like to wish you all a Very Happy Diwali.. (Indian Festival Of lights).....

</comment><comment><USER31> More time - a more thorough review process; Perhaps getting an extra minute on their application shall be the deciding factor for some applications =)

Good luck to All!

Believe in your vision and Never give up!!

</comment><comment><USER32> Question... I know it's a small chance of getting a response at all but if you do how do you get it? I haven't found an inbox / messaging area of any description... Cheers

<comment><USER6> You will get a response wether you're accepted or not. It'll be sent to the email of the person who filled out the form.

<comment><USER32> Ah ok, thanks for the info. Cheers Rob

</comment></comment></comment><comment><USER33> (3)more days? :( I need a cigarette! (I don't even smoke)

<comment><USER34> like

</comment></comment><comment><USER35> Thanks for the heads up. I was curious as to what the outcome was. It sounds like applications are really looked at in depth. That's really good to hear!

</comment><comment><USER36> Thanks for the heads up. Like everyone here, we our excited to hear your decisions! Looks like we need to be a bit more patient with this one.

</comment><comment><USER37> Thanks for notifying us, but I'm not sure I can take three more days of suspense waiting to find out! Best of luck to all those who applied!

</comment><comment><USER38> Thanks for the update, much appreciated. Couple of extra days of chewing my fingers off waiting in anticipation ;-)

</comment><comment><USER39> The suspense is killing us!

To others who have went through this before, do you hear back wether you get an interview or not?

Good luck everyone.

</comment><comment><USER40> Thanks for this added transparency! Good luck to all my fellow applicants...I am also down for the meetup!

</comment><comment><USER41> I am nine hours ahead in London, I was actually getting quite nervous, this is tense. Good luck everyone!

</comment><comment><USER42> Any Canadians applying from Ontario? If yes, would love to meet in the Toronto area.

Wish everyone the very, very best!

<comment><USER43> I'm based out of Markham. Where are you from?

<comment><USER42> Kingston (at Queen's University).

<comment><USER41> I am in London too.

</comment></comment></comment></comment><comment><USER44> I'm anxiously waiting - but programming nonetheless :) Any other teams/solo developers in Houston?

</comment><comment><USER45> Appreciate the heads up, thank you.

</comment><comment><USER46> Good luck, everyone. I'm looking forward to seeing the next generation of YC startups launch.

</comment><comment><USER47> Good luck to all. When did most people apply? We applied a few days before the 30th.

</comment><comment><USER48> I'll say it...I'm nervous.

</comment><comment><USER49> Has everyone on the edge of their seat! Excited. Good luck to all.

</comment><comment><USER50> Thanks for the heads up on the date shift, much appreciated.

</comment><comment><USER11> how productive is everyone today? my email client is getting a lot of attention and my dev. env. is not getting much use. LOL. Good Luck to all.

<comment><USER6> Don't worry too much, the emails usually start going out around 7PM Pacific so there's not much to do until that hour.

</comment></comment><comment><USER51> Thanks for the notification and goodluck everyone!

</comment><comment><USER52> Tough decisions, I'm sure. Looking forward to it!

</comment><comment><USER53> Good decision. Best of luck to everyone applying!

</comment><comment><USER52> Anticipation is the purest form of pleasure...

</comment><comment><USER54> Looking forward. thanks for the update.

</comment><comment><USER55> Good luck everyone!

Fly. Wall. Me. Wishing to be one.

</comment><comment><USER56> No worries. Thanks for the notice.

</comment><comment><USER57> What? I was accepted by YCombinator? I am so stoked...I go to tell this to all my friends.....yeeeaaaaaaaaaaa

<comment><USER57> I imagined that I won. why is there a thumb down?

</comment></comment><comment><USER58> Awesome!! See you guys there!

</comment><comment><USER59> And the tension continues.

</comment><comment><USER60> Ohh,its Diwali in India,so had bought extra crackers for the result...wud save them for 15th :)

</comment><comment><USER61> Thanks for the heads up

</comment><comment><USER62> Thanks for update!

</comment><comment><USER63> Pins and needles</comment>


Tell HN: iCombinator back up - <AUTHOR>

Hi all,
Apparently iCombinator.net has been down for the past couple of days. It should be resolved now.
I've also fixed:
- "Next 30 Stories...". Looks like this was also not working for a while. back up! :)
- Instapaper-ing HN items (such as these 'Tell HN', 'Ask HN', etc. stories) will now work. It had previously been trying to instapaper the relative iUI url.
Enjoy and sorry about the downtime!
(thanks to @stephencelis for the heads up!) <comment><USER2> I'd suggest 'nagios' to monitor if your stuff is working. That way you don't need to wait until a user alerts you.</comment>


Surviving AWS Failures with a Node.js and MongoDB Stack - <AUTHOR> http://www.kinvey.com/blog/item/176-surviving-aws-failures-with-a-nodejs-and-mongodb-stack <comment><USER2> Sweet post. I think despite the massive AWS outage last year, a lot of setups still aren't as fault resistant as you'd want. Last year's AWS outage died cuz of a cascade failure on EBS. Have they resolved that issue or should your EC2 volumes not be on EBS on this setup?

</comment><comment><USER3> Amazon is great, but we had a huge outage last year. This helpful to those who are worried. Keep a watch out for these guys at Kinvey. Corn dogs.

</comment><comment><USER4> Useful stuff, the outages had a detrimental affect on a lot of people.</comment>


Ask HN: Am I burned out, or something else? - <AUTHOR> For the last several years I've been feeling increasingly averse to problem solving efforts. The problems I encounter will require 6 hours of research and reading followed by non-guaranteed success followed by reiterating the same process until something works and that's the first step out of several towards progress on whatever the project is.
I want to say for at least a few years now it has been feeling exceedingly difficult to want or really bear that task.
I've had random runs (I don't particularly understand why, but generally it involves me wanting to solve a particular problem of mine and knowing that I can use programming to do so) where I will work like a dog for a couple of weeks then finish or give up on whatever I was pursuing.
But in terms of solving other people's or company's problems it is exceedingly difficult to motivate at all whatsoever. I think if I was going to be homeless I would probably find a way to motivate myself to do it but even then I wouldn't really be that dedicated.
When I do work for other people I usually have a decay in hygiene and self-care habits as well as productivity overtime until either I quit, they fire me, or the project is satisfactorily done. It doesn't ever seem to not happen. The shorter the project the better it is for me in that regard. If it is short and highly compelling sometimes I will just do what I mentioned above and knock it out in a week or less and work basically 16 hour days until it's done.
I really want to understand how to move forward in this situation. My last full-time job the manager basically told me to go on medical leave and get it figured out because he thinks the work is literally killing me. <comment><USER2> Sounds to me like depression or the precursor to depression. I am particularly concerned with your last statement in which you refer to your last full time job... having a stable job or lack of one can really affect your mental health. A job is not just about the money, it provides you with a sense of self worth and the good feelings that you are providing a value to society. Maybe consider finding a job in a different field, even something mind numbing like manual labour that will force you into a routine again, then you can still do your contract work in your spare time without the pressure and stresses you are currently putting on yourself. If that won't work for your situation I would say try treating your current contract work as if it were a full time job, set limits for yourself, go to sleep, eat and exercise aND work at the same times every day. Set yourself both professional and personal goals, write them down and review your progress in achieving them on a regular basis. If that still doesn't work for you, consider consulting a professional for a pharmaceutical solution. Finally clean up your environment and be mindful of how much of an effect a messy unkempt lifestyle can have on every aspect of your mindset. Cleanliness is godliness. Good luck depression is a tough hole to climb out of but it is possible.

</comment><comment><USER3> I think I've been in similar situations, but not as extreme. For me it's always involved depression and its symptoms, and it sounds like you're displaying some of those symptoms. I'd recommend seeing a counselor/therapist for a couple of sessions and see what happens. I only wish I had done that sooner every time I've hit this point.

</comment><comment><USER4> sounds like a motivating hobby might help, maybe one that could eventually turn a profit

<comment><USER3> Good advice. I'm realizing that if I don't have a hobby or two that I enjoy and do regularly, life isn't going well. I see that in a lot of my friends, too. But I also suspect that sometimes you need to deal with something (depression, anger, whatever) before you can get a hobby.

<comment><USER4> sometimes the best way to deal with emotional issues IS to get a good hobby.</comment></comment></comment>


Ask HN: a serious question... - <AUTHOR>

Why do people who don't know what they're doing keep trying to develop facebook killers?
I don't mean any project with a team, but people who don't know the basics of the framework they're using.
I'm serious. I keep seeing it, and there must be something behind this. <comment><USER2> Probably for the same reason that 1000 people + Zuckerberg tried to develop a MySpace killer.

Some people think its fun, some people think its a good way to learn, some people are aiming for the fame and glory. Almost all of them will gain something out of trying, the only people who dont gain anything are the ones sneering from the sidelines.

<comment><USER3> > the only people who dont gain anything are the ones sneering from the > sidelines.

That's not necessarily true. There are people who are concentrating on other ideas instead of doing the same thing and there are people who are investing all their life's savings and borrowing to launch the same kind of idea as Facebook.

<comment><USER2> at least in my experience, the intersection of people who scoff at those building new things, and those actually building new things for themselves isnt that large.

</comment></comment></comment><comment><USER4> Simple. The prestige of being bestowed to have developed a Facebook killer overwhelms any developer's fancy of a cutting edge application. It ain't pretty hard to admit that Facebook is by far, one of the biggest, most widely accepted, and successful web application there is right now.

And not to mention the accompanying monetary rewards that go with it.

<comment><USER5> This is an important point. I always have trouble explaining to people what I'm working on. If you're working on a Facebook killer, when that hot babe at a party asks you what you do she'll actually understand what your working on and might be impressed.

</comment></comment><comment><USER6> Because any webapp of any complexity can be developed in a weekend by a true hacker.

</comment><comment><USER7> Probably for the same reasons people who can't carry a tune try to become the next Lady Gaga and people who can't act try to become the next Dustin Hoffman.

I think that people with mediocre talent have a tendency to look at someone else in the same talent genre and think "I can do that, it looks easy".

<comment><USER8> Lady Gaga is probably a bad example. She's actually a very talented vocalist. Unfortunately the music industry isn't about talent and her music is awful. She's also not "hot" so she has to rely on being weird to be successful. For the record - I hate Lady Gaga with a passion, but I do recognize that she IS talented and not some fake bimbo like Britney Spears who really can't carry a tune.

<comment><USER7> I wasn't implying she wasn't talented. I think she is an example of someone that people might think they can "easily" copy.

</comment></comment></comment><comment><USER9> The Dunning–Kruger effect is a cognitive bias in which unskilled people make poor decisions and reach erroneous conclusions, but their incompetence denies them the metacognitive ability to appreciate their mistakes.[1] The unskilled therefore suffer from illusory superiority, rating their ability as above average, much higher than it actually is, while the highly skilled underrate their own abilities, suffering from illusory inferiority. Actual competence may weaken self-confidence, as competent individuals may falsely assume that others have an equivalent understanding. As Kruger and Dunning conclude, "the miscalibration of the incompetent stems from an error about the self, whereas the miscalibration of the highly competent stems from an error about others" (p. 1127). (from wikipedia)

<comment><USER10> This topic always reminds me of Siver's take on the subject:

[<http://sivers.org/below-average>]

<comment><USER11> "At first, like almost everybody, I thought, 'Yes, but I really am above average!' Then I realized I was doing it again."

What if I quantify that I am above average? Should I assume that, despite my 2400 SATs and 4.0 GPA, that I'm somehow below average?</comment></comment></comment>


Cocos2d Conversion Tips for the iPhone 5 - <AUTHOR> http://blog.makegameswith.us/post/35021622266/cocos2d-conversion-tips-for-the-iphone-5

<comment><USER2> I disagree with a few tips here. Rather than code to exact resolutions (eg: `if ([CCDirector sharedDirector].winSize.width == 568)`) build your games to be adaptive to the screen. That way when a new device is released you don't end up going through and making your code swiss cheese.

A better idea is to maybe make decisions when a size is greater than a certain amount, but still layout to relative amounts to the screen. This will make it easier to support landscape and portrait on 4/3 devices as well and not just 3/2 and 16/9 screens. Perhaps add additional HUD when you have the space.

Better yet, setup your simulator for several different sizes, and every now and then make sure everything still fits: [http://0xced.blogspot.com/2012/08/prepare-your-apps-for- new-...](http://0xced.blogspot.com/2012/08/prepare-your-apps-for-new- iphone.html)

Later come talk to us at Apportable (YC2011 <http://apportable.com/> ) and you can use our SDK to have your Cocos2D game run natively on hundreds of different resolutions and DPIs on Android.

<comment><USER3> To be fair, the author does suggest adaptive strategies all over the article. In practice, it's not uncommon to mix adaptive for the general case together with special cases optimized for a few specific, common and popular resolutions.

<comment><USER2> sure, I don't mind mixing, but I don't vote for checking for exact resolutions, but rather ranges of resolution ratios. Instead of checking for "width == 586" check for width/height and checking to seeing if it's close to 16/9 or 3/2 or 4/3 and then using specific UI for those cases, but still keep the layout relative.</comment></comment></comment>


In Javascript - value =!!value - <AUTHOR> http://love2dev.com/#!article/What-the-Heck-is-!!-in-JavaScript

<comment><USER2> This is true in a whole slew of languages. Here's Ruby:

      irb(main):001:0> 3
      => 3
      irb(main):002:0> !3
      => false
      irb(main):003:0> !!3
      => true

And here's C:

      #include<stdio.h>
      main() {
          printf("%d %d %d", 3, !3, !!3);  // 3 0 1
      }

Even the venerable and (relatively) strongly-typed Python falls prey to this:

      >>> 3
      3
      >>> not 3
      False
      >>> not not 3
      True

Basically any language where the ! operator coerces to boolean (or in C's case, the nearest approximation to boolean). Though personally I tend to agree that implicit coercions are undesirable, don't be too quick to cry JAVASCRIPT WUT, as it has quite a lot of precedence. :)

</comment><comment><USER3> The edited title is very confusing because "\- value = !!value" is not correct. Assuming you mean a dash and not a negative, it's still not correct.

I'm sure the mods will change the title to the one from the actual post: "What the Heck is !! in JavaScript?" which is a much better title.

</comment><comment><USER4> While I get the arguments for not using progressive enhancement in lots of modern use cases, I'm not sure it's wise to require javascript just so the page content can spin into view.

</comment><comment><USER5> Recently wanted to convert a string of '0' or '1' to a native boolean, shortcut value = !!~~value;

<comment><USER6> jsPerf shows !!parseInt(str) and parseInt(str)? true : false as being decently faster...assuming I used jsperf properly.

[http://jsperf.com/test-bool-cast](http://jsperf.com/test-bool-cast)

<comment><USER7> Interestingly enough, it's probably faster to test != '0':

[http://jsperf.com/test-bool-cast/2](http://jsperf.com/test-bool-cast/2)

</comment></comment></comment><comment><USER8> Does JavaScript not have something like "bool(value)"?

<comment><USER9> You can use Boolean(value) but it will return an 'object' of a 'boolean' type, rather than a primitive boolean (it's one of JS's flaws so is generally avoided).

Note: their example of a similar piece of code is not identical, as it won't cast values like null to false. I think the best example of a clear equivalent would be:

        value = value ? true : false;

<comment><USER10> `Boolean(value)` returns a boolean primitive; `new Boolean(value)` returns a boolean object (which you never want).

Compare:

        > typeof Boolean(1)
        'boolean'
        > typeof new Boolean(1)
        'object'</comment></comment></comment>


Airbnb Raises $1.5B in One of Largest Private Placements - <AUTHOR> http://www.wsj.com/articles/airbnb-raises-1-5-billion-in-one-of-largest-private-placements-1435363506 <comment><USER2> Is there any information to be had anywhere about terms? We hear the valuation shouted from the rooftops, but with nothing about the terms, its hard to know what the big number really means. Specifically, does anybody know if this a common stock purchase, or is this some kind of convertible preferred stock/convertible note with a liquidation preference?

<comment><USER3> Almost certainly preferred with 1x liquidation preference meaning investors don't make much of a return unless it sells or trades for well in excess of $25b.

</comment></comment><comment><USER4> Imagine if every Airbnb host had the option of having 5-10% of their earning withheld and used to purchase equity. You'd have a lot of regular people (that helped build the business!) receiving a windfall, instead of a few rich jagoffs getting a bit richer. And on the downside there would be no serious harm. IPOs are finished. Crowdfunding with equity can't come soon enough.

<comment><USER5> Why don't you start a FairBNB.com that does exactly this?

<comment><USER6> Given how gigantic this market is, that's a pretty common occurance (i.e., starting a property/vacation rental/related site).

There's already plenty of other big players like HA, VRBO, FK, TA, rent and countless others. There's even giants that doing this that are not fully devoted to short-term rentals and vacation stuff like CL.

That doen't even touch on the devoted timeshare and timeshare-related stuff. Or, how many convenient insurance companies can you think of that will underwrite policies for these shot-term renters?

There's just so much opportunity in this field....

</comment></comment></comment><comment><USER7> Can we please stop posting articles behind a paywall? I can't read this at all, not even in incognito browser mode.

<comment><USER8> If you copy and paste the link into Google, you can find a version you can read without paying for the subscription.

</comment></comment><comment><USER9> I would be greatly interested to know what it means for later employees who had RSU's since this effectively might set back the IPO dates by at least a few number of years. How does this effects them ?

<comment><USER10> The company could also opt to settle portions of their employees' RSUs for cash if they wanted to offer employees liquidity even in advance of an IPO.

</comment></comment><comment><USER11> Airbnb $25.5Bn $0.9B revs 28.3x 90% yoy

Marriott $20.9Bn $14.8 revs 1.4x 8% yoy

<comment><USER12> Marriott: 200,000 employees, 697000 rooms, 4000 locations hence no more than 4000 cities, 80 countries

AirBNB: 1600 employees (less than 1% of Marriott's), +1.4M rooms (for which they pay no mortgage or maintenance), 190 countries, 34000 cities.

<comment><USER13> Marriott - legal and obeying regulations.

AirBNB - 50 shades of legal gray.

<comment><USER14> Next week in Paris, hotel owners burning cars?

</comment></comment></comment></comment><comment><USER15> You need an account to read.

<comment><USER16> You can read it via [https://www.google.ca/search?q=Airbnb+Raises+%241.5+Billion+...](https://www.google.ca/search?q=Airbnb+Raises+%241.5+Billion+in+One+of+Largest+Private+Placements) if you're so inclined... the article is pretty dry though.

<comment><USER17> The gist is that they are valued at $24 billion pre-money/$25.5 billion post- money and are growing insanely quickly :)

</comment></comment></comment><comment><USER18> Is this Real Life?

</comment><comment><USER19> I wonder how this impact employee options? They still need to wait another 3-4 years for IPO to see what their options really worth. There is also a big chance of a massive reverse stock split for a company with this many rounds of investments.

<comment><USER17> Why do you think there'd be a reverse stock split? The price has been going up, not down. Or you think it would happen to get around the shareholder limit pre-IPO?

<comment><USER10> Stock splits do not change ownership or value. If you own 10 shares pre-split valued at $1 per share, and you have a split 10-for-1, you now own 100 shares worth $0.10 per share.

In general, companies do reverse splits prior to an IPO to push up the share price. It's seen favorably to have a $50.00 IPO price per share vs $5.00 even though the overall value is the same – the headlines read better that your IPO debuted at $50 but increased to $60 vs an increase of $5 to $6.

<comment><USER17> According to Wikipedia, reverse stock splits remove everyone with less than the split factor from the cap table. So if it was a 10-to-1 reverse split then you'd need at least 10 shares or you'd get paid out in cash

[https://en.wikipedia.org/wiki/Reverse_stock_split#cite_note-...](https://en.wikipedia.org/wiki/Reverse_stock_split#cite_note-3)

<comment><USER10> If you have 10 shares or 1 share in a company with tens or hundreds of millions of shares on the cap table, your stake effectively doesn't exist, so getting a cash payout is probably in your favor.

<comment><USER17> Right thats why I didn't understand why the original comment thought a reverse stock split is in the cards

</comment></comment></comment></comment></comment></comment><comment><USER20> Looks like a Chinese buyout, no?

Presumably a good way to get wealth out of China and then clean the money with an IPO. Timely, given the bubble popping in China.

<comment><USER21> No, it's not a Chinese buyout. You're talking about the acquisition of maybe 2% to 3% of their equity. It's meaningless in that regard.

There are two companies in China that could afford to buy Airbnb, that would be reasonable potential buyers. Tencent and Alibaba, neither of which are about to attempt such a purchase. It would cost ~$40 billion to buy them today.

<comment><USER20> > No, it's not a Chinese buyout. You're talking about the acquisition of maybe > 2% to 3% of their equity. It's meaningless in that regard.

Really? Where did that 2% to 3% of equity number come from. I would be _stunned_ if $1.5 billion is going into the company for just that. Even the valuation numbers seem to indicate at _least_ 6%.

And, an even more interesting question is: "Why does airbnb need $1.5 billion if their annual revenue is $900 million?"

People can downvote all they want, but did any of you people _read_ the article:

"Leading the round are private-equity firm General Atlantic Inc., Chinese firm Hillhouse Capital Group, and alternative-investment firm Tiger Global Management, which are collectively buying about a third of the shares allocated for this funding round, the people said.

The deal, advised by Morgan Stanley, includes Singapore's Temasek Holdings as well as venture-capital firms Kleiner Perkins Caufield & Byers, GGV Capital, China Broadband Capital and Horizon Ventures."

That's a hell of a lot of Chinese investors.

<comment><USER17> Yes the company is trying to expand internationally and it makes sense to partner with major players in markets that are significant for them.

As far as the numbers go:

$1.5B / $25.5B = ~5.88% equity

Then you figure the Chinese investors got maybe a third or half of that and you get to the 2-3% that someone else arrived at.</comment></comment></comment></comment>


BVLC/caffe: Caffe: a fast open framework for deep learning - <AUTHOR> https://github.com/BVLC/caffe <comment><USER2> In contrast to TensorFlow which only works on CUDA hardware, Caffe supports OpenCL hardware, including AMD GPUs.</comment>


Show HN: Weekly curated security newsletter - <AUTHOR> https://securitynewsletter.co/ <comment><AUTHOR> I love curated newsletters as a primary source of information, but I couldn't find one about security news that I enjoyed, so I created this one. It's inspired heavily by newsletters like Saas Weekly, Devops Weekly and Cron.weekly.

A bit over 300 subscribers so far, 3 months in. Open rates have been consistent around 60-70%. From all the projects I've done, I'm enjoying this one the most by far. The newsletter is sent with the service Curated, which I'm very pleased with.

Let me know what you guys think, I'd appreciate any feedback.

<comment><USER2> Looking at the archive there does not appear to be a clear editorial opinion about what security news _is_. Some articles are useless in terms of security practice, e.g. the Ashley Madison settlement which is legal news and titillation but there are no lessons or reasons to change security practice.

Good luck.

<comment><AUTHOR> Thanks for the feedback!

You are right, the filter of what makes news is something that I'm calibrating as I write more issues and learn more. I generally try and share only educational articles, like you said. In the case of Ashley Madison I found it to be an interesting story about accountability for lack of security.

But sometimes I'll just share something because it, well, made the news, and got a lot of attention that week, as I feel that's what many subscribers want. Or just something funny.

I do try to stay away from politics, privacy-only news (one can start a separate newsletter on that), and non-actionable news about a small exploit that was found and patched, that helps no one who reads it.

</comment></comment></comment><comment><USER3> Similar: [http://workhack.com/security](http://workhack.com/security)

<comment><AUTHOR> Thanks for the link. I wouldn't necessarily call them similar though. One is a handy list of RSS feeds, the other a newsletter that summarizes selected articles. Still though, bookmarked :-)

</comment></comment><comment><USER4> Looks interesting enough that I am happy to check it out.

Thanks!</comment>


The Arc Debate - <AUTHOR> http://www.lispcast.com/2008/02/the-arc-debate/

<comment><USER2> a bit out of date. links arc0, and didn't someone already write a unicode support patch?

and pg is busy spending his millions? lol maybe that's part of it, but there's also his essays and ycombinator.

and arc doesn't exactly force you to use table based layouts, it just comes with some libraries to support them. soon enough someone will write a css- layout oriented library for arc. it's not very hard.</comment>


Show HN: A tool to discover growing trends and industries amid Coronavirus - <AUTHOR> https://treendly.com/covid <comment><AUTHOR> Hi, this is Mike and I'm the founder of Treendly.com, where we discover and monitor rising trends.

I thought to measure what the impact caused by this global economic downturn is in different countries and industries.

There are some new opportunities arising because of Coronavirus, and we wanted to provide insights into what people are doing and NOT doing in this strange time.

We mainly wanted to answer these questions:

\- What are some growing trends amid Coronavirus?

\- What are the most impacted industries?

\- How are companies adapting?

Let me know how this tool can be most useful to you. Hope it helps!

Thanks, Mike</comment>


Intel vulnerabilities costing 25% CPU performance loss to a cloud provider - <AUTHOR> https://twitter.com/waxzce/status/1128711501206913028 <comment><USER2> Does anyone actually have some benchmarks of the latest gen AMD vs the latest gen intel processors with all mitigations for spectre, meltdown, and the 10 other sidechannel/speculative execution vulnerabilities applied?

I'd genuinely be curious to find out what the eventual results are because as i understand it AMD is not too far away from Intel as a standalone processor, surely in a "real world" scenario they'd be significantly faster?

<comment><USER3> For Linux 5.0 and as of March this year, the performance impact of enabling Linux kernel mitigations for Spectre/Meltdown against various CPUs with the latest microcode (as of March) are:

Intel: -13% for the Core i9 7980XE, -17% for the 8086K.

AMD: -3% for the 2700X.

Reference: [https://www.phoronix.com/scan.php?page=article&item=linux50-...](https://www.phoronix.com/scan.php?page=article&item=linux50-spectre- meltdown&num=6)

Phoronix is due to release new benchmarks tomorrow showing full impact from Spectre/Meltdown/L1TF/MDS. There are some initial benchmarks at [https://www.phoronix.com/scan.php?page=news_item&px=MDS- Zomb...](https://www.phoronix.com/scan.php?page=news_item&px=MDS-Zombieload- Initial-Impact)

<comment><USER4> What about for the newer processors like the 9980XE, 9900K, etc.? I would have assumed that Intel's latest processors have some additional engineering in place to mitigate the spectre/meltdown performance impacts.

<comment><USER5> > What about for the newer processors like the 9980XE

The 9980XE is Skylake. It's not actually a "new" processor at all. Consumer parts were released in 2015 (Core ix-6xxx) & server parts in 2015 as well (Xeon E3-v5).

In fact the 9980XE itself isn't even a new offering in the HEDT space for Intel, as it's basically a rebrand of the 7980XE. The differences are just a soldered heat-spreader instead of paste & a small clock bump to go along with that. It's +200mhz turbo & +400mhz base, complete with a power consumption increase to match.

EDIT: The 9900K (Coffee Lake) does have in-silicon mitigations for Meltdown & L1TF (Foreshadow), though: [https://www.anandtech.com/show/13450/intels-new- core-and-xeo...](https://www.anandtech.com/show/13450/intels-new-core-and- xeon-w-processors-fixes-for-spectre-meltdown)

</comment></comment></comment></comment><comment><AUTHOR> @waxzce: "FYI, as cloud provider we rawly loss around 25% of CPU performances the lasts 18 months due to different CVE and issues on CPU and mitigation limiting capacity using microcode, so we stuff more CPUs, but prices didn't go down at all... That's a kind of upselling. #IntelFail"

<comment><USER6> Is it #IntelFail if Intel had _supply_ issues in last year? It doesn't look like demand was affected by much.

<comment><USER7> Any way you slice it it's an Intel Fail. They've basically had to lower the performance of their existing chips, they've failed on the road map for new chips, and they don't have capacity for more of the existing chips because they thought 14nm would be winding down by now rather than peak production.

</comment></comment></comment><comment><USER8> > If AMD was in a better shape, there is a real market momentup here.

What does this comment refer to? As far as I know AMD is in pretty good shape.

<comment><USER9> They probably can't meet the demand for server-grade CPUs. But I'm just guessing.

<comment><USER10> Most of the current AMD offering, APU, GPU, and CPU is still being fabbed with GF 14nm, which I believe to be very limited in capacity. Once the next generation GPU ( Navi ) and CPU ( Zen 2 ) along with EPYC 2 moves to TSMC 7nm they should be able to flex their muscles a lot more.

I wished they have made the move earlier, like start of this year, but it is now all set for Q3.

<comment><USER11> Amd should probably keep production of whatever they think will sell +20% to account for whatever new Intel screwup is revealed.

<comment><USER10> Pure Speculation, judging from the slight delay ( 1Q ) in EPYC 2 introduction, my guess is that AMD wants the launch and fulfil all the demand of the big cloud provider ( AWS, Azure and Google ) while still have enough Chips for the rest of the market. The worst thing could happen is AMD announced their EPYC 2 and AWS getting all the stock with little left for other Channels.

I have high expectation but I trust Dr Lisa Su and her executive team. And Intel is currently having a new low in my book.

</comment></comment></comment></comment></comment><comment><USER12> We are doing perf testing of the AMD versions of HP/Dell servers. We may tech refresh about 40k servers with epyc-2 if performance is better than Intel. It's about time for some new servers anyway.

<comment><USER13> It seems that they're on track to get epyc into OEMs and cloud providers in quantity. They've been successfully growing the ecosystem in the server space over the last 2 years (Supermicro, dell, HPE, Lenovo all pushing epyc sku's now) so they're very well poised to capitalize on it if they can keep up with supply. The power efficiency gains on 7nm will be pretty tempting to cloud providers and colocation clients alike. If you can put 256 cores (4 epyc2 sockets) into a 1U server and keep it under 1200W that's going to be a landslide win for density and running costs. Factor in pcie 4.0 and things are looking pretty sexy.

I've read that wafer yeilds on zen2 are 70%+ which gives a huge advantage on cost and production efficiency to AMD. I think Intel's skylake yield for an equivalent 28 core die is sub-40%. If anything the limiting factor is going to be TSMCs ability to give AMD capacity on it's very crowded and in-demand 7nm fab.

<comment><USER12> Dell and HP already have them in quantity. We just have to perform due diligence to ensure all of our workloads will remain the same or better performance. Thus far, testing is looking good.

</comment></comment></comment><comment><USER14> What are the possible pitfalls of _not_ runnning spectre et all mitigations, if you're _not_ hosting other people's code, but on your own hardware?

<comment><USER15> Just guessing here, but suppose an attacker is able to get unprivileged code to run on your machine (by taking over some process). He is now able to extract secrets from other processes on the machine that he ordinarily wouldn't have access to. Think SSL keys etc.

But I believe you're right in that those exploits are not as dangerous in a non-shared hosting scenario.

<comment><USER16> I'm not even sure code execution is strictly necessary for this style of attacks.

An attacker could carefully craft network packets to force the control flow of existing software to manipulate the CPU state. They could and then use the timing differences in network packets to read data out.

Would be painfully slow, but theoretically possible.

<comment><USER17> I don't think this is correct. The timing attacks here all require extremely high resolution timers, and network + I/O latency would obscure the variance entirely.

<comment><USER18> People are able to crack poor password comparison implementations over a jittery, latency heavy network. It's possible to get almost arbitrarily high resolution when doing timing side channel attacks, you'll just need many more samples.

</comment></comment></comment></comment></comment><comment><USER19> Don't get married to Intel, if you need big beefy xen or kvm hypervisor machines, there's lots of good EPYC based motherboards.

<comment><USER20> I am planning on making a home-server. Any suggestions for EPYC boards?

<comment><USER21> I'm setting up a home server and decided to just go with Ryzen. You get a bunch of server features (ECC RAM, lots of PCIE lanes, and lots of cores) for a lot less cash than the equivalent EPYC build.

Obviously EPYC has a place but for the home usecase you could use a Ryzen as a substitution for Intel Xeons because of the baseline features of Ryzen.

<comment><USER22> Do you need Ryzen Pro for ECC?

<comment><USER23> Nope. Regular Ryzen supports unbuffered ECC modules.

<comment><USER22> What about registered (buffered) ECC modules?

<comment><USER23> Nope, Ryzen and TR don't. Epyc does.

<comment><USER22> Thanks!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> This is an argument for organisations to go back to being on-prem, running their non-public facing workloads privately.

<comment><USER25> How's that an improvement over using 'Dedicated Instances' or the 'Bare Metal' offerings which exist with cloud providers, where you're not colocated with other entities but still enjoy all the benefits of how the infrastructure is managed, flexibility in upscale/downscale (instead of acquiring capital assets which depreciate over 36-48 months).

<comment><USER24> External access to the bare metal is still possible and thus information can be leaked via Meltdown and Spectre

</comment></comment></comment><comment><USER26> Is this a chance for ARM providers to move in and outcompete Intel, especially if they can provide similar tech but with security? Basically an ARMs race?

<comment><USER27> You can't stop this class of vulnerabilities without sacrificing performance because the reason for the performance is also the reason for the vulnerabilities. That's the choice you have, and no brand affiliation will save you.

<comment><USER22> It's not about brand affiliation, AMD and Intel have vastly different implementations

<comment><USER28> Which didn't save AMD from Spectre bugs. And everyone else with high performance speculative execution out-of-order designs also had Meltdown bugs, ARM and IBM, both POWER and mainframe/Z: [https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...](https://en.wikipedia.org/wiki/Meltdown_\(security_vulnerability\))

<comment><USER29> Yet, AMD looks way better considering all vulnerabilities reported so far. Why downplay this fact?

<comment><USER30> AMD was also measurably slower to begin with, in terms of per-core performance. Not just by some small number; depending on the benchmark the difference can hit as high as 40% on the latest architectures. What they lack in single-core perf they make up for in a vastly superior multi-core architecture.

Also, something everyone seems to forget: All of these cloud providers are running Skylake chips, which were launched in 2015. Google Cloud in particular will even give you chips OLDER than Skylake by default if you don't specifically request Skylake. Even assuming instances like an AWS m5a are running on Zen 1, not Zen 2, that's a 2017 architecture.

So you're presented with all these graphs that say "AMD only lost 5%, Intel lost 25%, fuck Intel" but the reality is that Intel was previously far faster than AMD, and they're not even fabbing their best designs for the data center. Intel definitely had more vulnerabilities and they WERE hit harder, but its more nuanced than just blindly wondering why more cloud providers aren't making a fleet-wide switch to AMD.

<comment><USER31> > AMD was also measurably slower to begin with, in terms of per-core > performance.

Not so surprising now that we know Intel merely skipped a lot of checks to get there though. I mean a lot of the vulnerabilities impacting Intel only have been the likes of "when predicting, the processor does it even it shouldn't to avoid the delay from checking".

Is it really fair then to say that AMD doing it the proper way was slower, or that the loss of performance of Intel can't be used as a way to congratulate AMD on being safer on that front ?

<comment><USER32> It would be fair to say that if AMD had the features but implemented in a way that wasn't vulnerable. That, however, is not the case. AMD simply lacks the features.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> Now how much this 25% is in terms of CO2 emissions?

<comment> the-dude About 25%.

</comment></comment><comment><USER34> It's a little funny to see the "use AMD!" comments --- since from what I understand, Intel's optimisations that lead to these side-channels are specifically for performance, so using AMD instead of Intel might mean the same amount performance loss.

<comment><USER29> They have completely different architectures, some optimizations can be done in safer ways.

<comment><USER28> Isn't one of the "secrets" to AMD's post-486 success adopting the general approach the Pentium Pro took along with others in the 1990s, which in turn are based on IBM's 1960s Tomasulo out-of-order algorithm adding speculative execution? This _general_ approach made _all_ out-of-order speculative designs, including ARM, POWER and IBM Z vulnerable to Spectre, so I submit they're not " _completely_ different".

</comment></comment></comment><comment><USER35> Why is nobody suing Intel? They sold defective chips.

<comment><USER36> Is there an End User License Agreement that users agree to before using these chips? If it is anything like software EULA's, then Intel is likely protected from lawsuits for defects.

<comment><USER37> Except unreasonable EULA terms are void in most (all?) of Europe.

</comment></comment></comment><comment><USER38> Intel vulnerabilities are providing additional 25% revenue to Cloud Providers.

<comment><USER39> Most cloud providers are trying to move up the value chain & provide higher margin differentiated services (managed db, queues, etc) instead of staying at the race to the bottom vm market.

These intel mitigations impact those services just like everyone else.

<comment><USER40> Does it? If customers can't run code on those servers, then these CPU level side channel attacks aren't an issue.

This assumes the servers for S3 etc are dedicated to the task.

<comment><USER41> > Does it? If customers can't run code on those servers, then these CPU level > side channel attacks aren't an issue. This assumes the servers for S3 etc > are dedicated to the task.

I'm not sure that follows. Unpatched, most of these Intel CVEs are almost like unpatched local privilege escalation vulnerabilities. Once you've compromised a low privilege process you can sniff your way to more and more powerful credentials on the machine, host, and in the network.

Unless higher abstraction cloud service providers are dumb enough to just run everything as root, in which case this doesn't change anything, they probably can't (competently) get away with not patching these. Defence in depth matters.

</comment></comment></comment></comment><comment><USER42> Perhaps this is the reason for Intel's recent push on their self created version of Clear Linux?

<comment> yjftsjthsd-h How does that help? You still take the perf hit?

<comment><USER42> Tests on Phoronix show Clear having significant wins in a number of tests. They have done so by rewriting libraries to perform well with Intel hardware. Those who complain about a 25% performance hit elsewhere can now be shown pretty good performance with Clear that isn't attainable with other distros.

<comment> yjftsjthsd-h Oh, gotcha; boost from optimizations cancelling out against loss from patches. I would argue that that still constitutes a performance loss since before the patches you could run with just the improvements get better performance rather than neutral. But you're not wrong.

</comment></comment></comment></comment><comment><USER11> I bet Google isn't so giddy now about being FIRST!! [1] with Skylake in the data center a couple of years ago, or "going on all-in" with Intel on the Chromebooks (it didn't even give AMD a chance until very recently...), despite Chrome OS being one of the very few operating systems that are truly architecture agnostic.

Now it's paying dearly for that mistake, with up to 40% performance loss on Chromebooks due to the disabling of HT:

[https://www.techrepublic.com/article/mds-vulnerabilities- lea...](https://www.techrepublic.com/article/mds-vulnerabilities-lead-chrome- os-74-to-disable-hyper-threading/)

Google broke one of the most basic business rules: never rely on a single supplier. You're always worse off _in the end_ , even if the exclusivity deals seem very tempting in the short-term.

[1] [https://cloud.google.com/blog/products/gcp/compute-engine- up...](https://cloud.google.com/blog/products/gcp/compute-engine-updates- bring-skylake-ga-extended-memory-and-more-vm-flexibility)

<comment> yjftsjthsd-h > "going on all-in" with Intel on the Chromebooks

Weren't Chromebooks on ARM before x86?

> Google broke one of the most basic business rules: never rely on a single > supplier. You're always worse off in the end, even if the exclusivity deals > seem very tempting in the short-term.

I don't think this is _universally_ true, although I agree that it's probably prudent. Diverse options/suppliers are a risk mitigation, but they do have a cost.</comment></comment>


Stimulus: 7 billion for broadband, 15 billion for science research - <AUTHOR> http://www.cra.org/govaffairs/blog/archives/000725.html

<comment><AUTHOR> Hmm, " _For every dollar invested in broadband, the economy sees a ten-fold return on that investment._ "</comment>


Arsenic and Old Leeches - <AUTHOR> https://www.laphamsquarterly.org/roundtable/arsenic-and-old-leeches <comment><USER2> I'm not sure modern medicine has come that far [1,2,3]. Let me be clear, I am not advocating for alternative medicine, which is a step in the wrong direction. Rather, solid science is the answer and the combination of science and medicine has given us some of medicine's most amazing tools like antibiotics and vaccines.

1\. [https://www.theatlantic.com/health/archive/2017/02/when- evid...](https://www.theatlantic.com/health/archive/2017/02/when-evidence- says-no-but-doctors-say-yes/517368/)

2\. [https://arstechnica.com/science/2014/12/when-the-doctors- awa...](https://arstechnica.com/science/2014/12/when-the-doctors-away-the- patient-is-more-likely-to-survive/)

3\. [https://en.wikipedia.org/wiki/Opioid_epidemic](https://en.wikipedia.org/wiki/Opioid_epidemic)

<comment><USER3> Well, alternative medicine that actually works is usually re-labelled medicine. e.g. vaccines are thought to have had origins in China way before the scientific revolution.

An exception is the Alexander Technique (AT), which I think cured my RSI, despite medical doctors and physiotherapists being unable to help. AT hasn't been incorporated into mainstream medicine yet, presumably because nobody can explain how it works (though it doesn't make any obviously superstitious claims).

But this lack of good explanation goes way further, beyond alternative therapies and into the heart mainstream medicine. There is a problem with medical science, imo. Most 'testing' and clincical trial related-work is beset by _empiricism_ , wherein many treatments are assessed without an idea of how they allegedly could work.

As I understand it, this is why a large proportion of medical studies can't be reproduced: we understand by now that theory without experiment leads nowhere; most of us don't yet appreciate that _experiment without theory is equally useless_.

This is why I see even Science in its present form as insufficient for medical progress.

Rather, solid _engineering_ is the more reliable answer, which is essentially the approach of the anti-aging SENS Research Foundation. Our philosophy should be, as far as possible, to engineer and fix the body, repairing its accumulated damage and so forth _before_ it gets ill or aged.

<comment><USER4> I don't think I agree with this. While medical diagnosis has often required some sort of overarching theory (which is usually advanced beyond our available treatment options), treatments (pharmaceuticals in particular) have most commonly been discovered empirically.

If we were to wait for solid theory before using such treatments, we'd probably still be living in the medical stone ages!

</comment></comment></comment><comment><USER5> We still hang on to some pretty barbaric stuff because there's not currently anything better. Chemotherapy comes to mind.

</comment><comment><USER6> Leeches are still used to prevent blood from pooling in tissue, and a variety of other things.

The pharmacists I'm related to order them from the almost comically named "Leeches USA": [http://leechesusa.com](http://leechesusa.com)

</comment><comment><USER7> The way this was titled and written I kept expecting there to be a link between Arsenic and leeches, but then the article just ended. Maybe that's my misunderstanding, maybe it was the article's.

<comment><USER8> It's a reference: [https://en.m.wikipedia.org/wiki/Arsenic_and_Old_Lace_(play)](https://en.m.wikipedia.org/wiki/Arsenic_and_Old_Lace_\(play\))

<comment><USER7> Ah I see, Thanks</comment></comment></comment>


Mark Zuckerberg's Fortune Surpasses $100B - <AUTHOR> https://www.bloomberg.com/news/articles/2020-08-06/zuckerberg-s-fortune-surpasses-100-billion-with-facebook-surge <comment><USER2> For anyone trying to comprehend a $100B net worth. Watch this video 100 times: [https://www.youtube.com/watch?v=8YUWDrLazCg](https://www.youtube.com/watch?v=8YUWDrLazCg)

<comment><USER3> Sometimes I think about these things, and put it in a different perspective.

The richest man on planet earth, could only afford a few block of properties in one of the most expensive cities in the world. [1], a tiny tiny dot on the Map.

[1] [https://youtu.be/t5jI2oMyO0Y](https://youtu.be/t5jI2oMyO0Y)

</comment></comment><comment><USER4> No... his STOCK HOLDINGS now exceed $100B. If Facebook is deemed by the FCC to be in violation of Section 230 those stock holdings will plummet rather quickly. If he cashes them all out right now THEN his actualized net worth would be $100B, but until then it's only paper wealth: a figment of a banker's dream until they are sold. Bloomberg knows better than to publish crap like this.

<comment><USER5> I like this reasonning, but otoh nobody has a lot of money in cash. When you count somebody's fortune, you must also count assets that may produce different valuation when sold.

<comment><USER4> It's an _unrealized_ asset. It can be included as a footnote on his personal net worth but isn't part of it until it's sold. For a founder, the red-tape involved in selling stock is significant and they must wait for the market to absorb the announcement of their intention to sell. I recall when Bill Gates sold something like $200M of his stock to pay for his lake-side mansion and that the SEC filing went out of the way to express that Gates didn't really want to sell anything but it was the only way he could finance his new mansion... in other words, there's no insider knowledge about Microsoft that prompted his selling. For Zuck to cash out he would have to announce well in advance and then say he's going to sell X percent every first trading day of the month (or whatever period he defines) whether the stock is going up or down in order for it to not be taken as an insider move.

(In fact, selling covertly or converting stock to any financial instrument covertly -- what's called "buying a collar" \-- is quite illegal and will land you in jail if caught.)

<comment><USER6> You are quite naive. These people don't have to sell their stocks in order to finance something like building a house. They get massive loans using their stocks at collateral.

<comment><USER7> Some of Larry Ellison's emails with his financial advisor became public and talk about doing just this.

<comment><USER3> It is common practice for nearly all those wealthy people relying on stocks. What I am interested in is the interest rate they get on those loans.

<comment><USER6> It's actually lower than retail bank interest rates. For example, if they get a huge mortgage, usually it is at least 100 basis points lower. This is because these people are considered extremely low risk.

<comment><USER8> I have heard it is pretty common for them to get 1 or 2% because the banks usually want to win their business.</comment></comment></comment></comment></comment></comment></comment></comment>