First hour of Gnome 3 usage... - <AUTHOR> http://www.scriptingsysadmin.com/2011/05/gnome-3-or-how-to-make-your-users-feel.html

<comment><USER2> Gnome 3 sounds yucky. Here's a much more meat and potatoes review which is more precise in what they like and don't: [http://arstechnica.com/open- source/reviews/2011/04/ars-revie...](http://arstechnica.com/open- source/reviews/2011/04/ars-reviews-gnome-30-a-shiny-new-ornament-for-your- linux-lawn.ars)</comment>


DoJ says citizens have a broad right to record police officers on duty - <AUTHOR> http://www.theverge.com/2012/5/16/3024042/us-doj-police-baltimore-video-recording-civil-right <comment><USER2> One question with respect to all the reported erasures carried out by police -- on the spot or shortly thereafter.

If recording were indeed a crime (I can't bring myself to write this other than in the conditional), would they not then be destroying evidence of the very crime under which they are acting in arresting and confiscating equipment?

Which itself would be... a crime?</comment>


Zika Transmission from Tears or Sweat - <AUTHOR> http://sciencebulletin.org/archives/5917.html <comment><USER2> actual paper here:

[https://news.ycombinator.com/item?id=12602633](https://news.ycombinator.com/item?id=12602633)</comment>


Topsoil Re-Uptake of CO2 Is a Major Solution to Climate Progression - <AUTHOR> http://practicalhuman.org/climate/b1a93a2fc <comment><USER2> I don't think it's an accident that many civilizations are built on annual crops. People who could move into an area and be fruitful in a few years have an advantage against invaders, or when invading.

We have selected many of the civilizations that relied heavily on cultivating perennials out of existence. And in the case of California we didn't even see that cultivation was even happening.

Why does this matter here? Because the bulk (by landmass) of our crops are adapted to recently cleared land. In most places that means degrading the soil from day one to keep our chosen plants on top. There is almost no carbon above ground, and what is below ground declines every year.

Pumping more into the ground only solves part of the problem. It's a start, but not the whole story.

<comment><AUTHOR> please add any developed thoughts you may have on the matter!

<comment><USER2> I'm mostly alluding to Restoration Agriculture by Mark Shepard, and drawing on Tending the Wild, M Kat Anderson.

</comment></comment></comment><comment><USER3> yup, Allan Savory talked about this in his TED talk and has already converted 15 million acres of desert to grass lands. He calculated that if all deserts are converted to grass lands, the CO2 problem is gone.

<comment><AUTHOR> fantastic

</comment></comment><comment><USER4> I presume the title is a typo. Prorgression? Even dictionary.com doesn't know what that is.

The actual title of the page is... um... well, it doesn't seem to have one.

<comment><AUTHOR> thank you for pointing that out</comment></comment>


Ask HN: Career path for developers - <AUTHOR> Hi All,
I've been developing professionally for 10 years. Lately, I've had an itch. I'm starting to become anxious to move on to something other than full time coding, and I'm starting to think that I'd like to spend more time having "face-time" with people.
I'm not particularly interested in managing. I believe I'm inclined towards demonstrating, guiding, training, advising, etc. As part of a previous job, I was responsible for going on-site, gathering requirements and overseeing implementation of our product, which involved a lot of face to face discussions with new people. I miss the social aspects/challenges of that work.
My question is, have any of you made the transition from developer to a people-oriented role that didn't involve becoming a manager? If so, do you have any advice for a developer aspiring to do just that?
Thanks <comment><USER3> Some of the best career advice I ever got was from a recruiter who had a PhD in microbiology: "Don't lose your technical edge." I sensed that he regretted stepping out of the lab into a sales/recruiting role. He's a great guy but had to step out of recruiting and I met him again when he was working managing contracts for a company I was working for.

So whatever you do, I'd recommend keeping your coding skills. You could do that by starting your own software training company for example, maybe start a site that teaches basic skills to people and couple it with live courses. That's my 2 cents, anyway.

<comment><USER4> The bit about the PhD in microbiology caught my eye here--to people getting bored with "blub" programming: perhaps look into a field like bioinformatics, meteorology, and so on. You'd be working on difficult, "technical" things, but you'd be able to leverage your existing skills and simultaneously assist with the (inevitable?) computational aspects of that particular research.

<comment><USER5> Your comment is certainly applicable to me. I am interested in bioinformatics, but i have no idea how to get started in something like that.

What do you think?

</comment></comment></comment><comment><USER6> Have you considered consulting? By that i don't mean "charge hourly to do development" but true consulting.

I worked for the technical consulting branch of one of the "Big Four" accounting firms as an Oracle DBA for a few years and found that I used my soft skills much more than my technical stuff. Most of the projects I was brought in for where very troubled and usually had a political AND technical problem. The usual method to solve these involved a lot of creativity to implement the best technical solution given the political climate of our clients. It can be very rewarding solving these kinds of issues.

</comment><comment><USER7> Obvious official HN response: do a startup, where your people skills will be just as important as your technical chops, yet you will still take full advantage of your years of experience.

My response: "management" is a fuzzy area. A product manager, for instance, can be very different from a project manager -- and it would involve a lot of what you're talking about.

<comment><AUTHOR> I'm not interested in being a PHB. That is my aversion to management...

<comment><USER8> Then don't be a PHB. PHB is a stereotype and a caricature. Being a good leader is all about people skills, and what you're looking for sounds a lot like what a project manager could do. Note "could": once you step up to management, you become the chief architect of your own job. If you project PHB on it, that that's what you'll be.

</comment></comment></comment><comment><USER9> Interesting question. I don't think I've ever seen it here before.

I am a solo founder working on a startup that needs lots of hands-on hacking now, but the plan is to evolve to the point where a much greater percentage of the resources required will be for people with heavy technical backgrounds doing more face to face stuff with customers.

Perhaps we should talk. Contact me off line please.

</comment><comment><USER10> Consider volunteering your skills for a non-profit and getting into a leadership role. I've done that (without the intention) but it is amazing how involved you can get with the mission/issues of a non-profit organization (where you _don't_ have any financial stake - e.g. salary). Yes, I primarily help with technology analysis/implementation but they listen to me when it comes to marketing (sometimes). Non-profits are interesting because they draw positive-oriented individuals from a wide spectrum of careers. You can learn a lot just by showing up and listening.

My managers recognize it officially as a potentially valuable career growth action (on my own initiative). Not only has it helped me do better at my job, it helps me feel better (diverts some workaholicsm towards something good)

</comment><comment><USER11> I've done a bit of the "technical liason for sales" and that can be entertaining for a short time. You get to be in front of people - <USER2> customers and colleagues - and you get input from both sides. With what you're looking for, that might be a good fit. If you do opt for that, I'd want a cut of commissions for any sales that I helped sell :)

<comment><AUTHOR> Any idea if commissions are standard in roles like that?

<comment><USER12> At least in my company's market, a 'sales engineer' role is definitely going to be commisioned, and it seems like it meets the "demonstrating, guiding, training, advising, etc." criteria.

Lots of oportunities to work with customers, lots of technical involvement, and a strong position to influence product direction. It's also good background if you think you might want to move into product management at some point (or if you eventually get interested in engineering management, for that matter).

But (again, probably depending on market), the travel demands can be pretty significant, and you have to thrive within the culture and pressures of a sales organization. Personally, I think I'd burn out on it pretty quickly.

<comment><USER13> Being a sales engineer is usually commissioned and you get to do lots of demonstrations and presentations, working with customers (read: more prospects than paid customers). It is a very useful experience because you get to do part of a sales job (selling, convincing people, handling disagreements, presentations) as an engineer.

However a lot depends on the size of the company. If the company is fairly large and established, you will hardly be able to influence product direction. In fact, you will most likely be in the position where you might be able to provide feedback to the product team, but you will almost never have the chance to do any hands on improvement to the product. Obviously that is because you are not part of product development/R&D, but believe me, that feeling sucks if you are a good engineer.

If you have never done it before and the opportunity presents itself, jump at it. I learnt tons when I was a sales engineer.

</comment></comment></comment></comment><comment><USER14> Find some big technical problem to solve that's bigger than yourself, and get people involved. It'll all flow from there.</comment>


Constexpr-8cc: Compile-time C Compiler - <AUTHOR> https://github.com/kw-udon/constexpr-8cc <comment><USER2> If you're interested in _sane_ staged metaprogramming:

Lightweight Modular Staging (Scala): [https://scala- lms.github.io/](https://scala-lms.github.io/)

Terra (Lua): [http://terralang.org/](http://terralang.org/)

Compiler Plugins (Rust): [https://doc.rust-lang.org/book/compiler- plugins.html](https://doc.rust-lang.org/book/compiler-plugins.html)

<comment><USER3> Some more insane on the other hand, using {order,chaos}-pp: [http://chaos- pp.cvs.sourceforge.net/viewvc/chaos-pp/order-pp...](http://chaos- pp.cvs.sourceforge.net/viewvc/chaos-pp/order- pp/example/bottles.c?revision=1.10&view=markup)

</comment></comment><comment><USER4> I feel like C++ is moving towards being as useful as a brick. You get a brick and you ask yourself "what can I do with it", and the answer is "everything! absolutely anything!" Then you ask yourself "how?" and the answer is 3000 pages of standards, activities and rules on how to actually use a brick to make truly anything, with 800-page addenums to using boost-brick (i.e. some mortar).

<comment><USER5> I agree with you. If you can't get the job done using _mostly_ that language described in the Brown Book ( _C++ Annotated Reference Manual_ by B. Stroustrup and Margaret Ellis), plus a judicious smattering of some newer C++ ranging from C++98..C++03 (at most), you should fucking retire.

The last useful change in C++ was (circa 2006?) making string literals const. That's it.

<comment><USER6> Oh brother...

What about: lambdas, type inference, tuples, robust templates, compile time constants and code execution, move semantics, expanded PoD, initializer lists, range based for loops, user literals, return type deduction... I could go on and on. All features I use _daily_. And I'm not even getting into C++17.

<comment><USER5> Half-broken, bolted-on garbage that is found in a much nicer form in high level languages which have those things in their _core vision_ from the beginning, or the kind of extensibility which can cleanly support new ideas.

> _And I 'm not even getting into C++17._

I'm with you there, in a way.

<comment><USER7> I don't find auto, lambda, and variadic templates, move semantics and smart pointers to be bolted on. You can write Fortran in any language.

<comment><USER8> You think rvalue references are a natural and elegant construct? That if C++ were designed with move semantics in mind, this is the road they would have travelled down?

<comment><USER9> That's the biggest reason that I like Rust more than C++, even more than lifetime/safety. I've been working on a C++14 application, and "std::move" shows up a lot more than implicit copies, which not only makes the code more verbose, but analyzing performance more difficult. (I _so_ wish I could be using Rust, but, unfortunately, the only FOSS DNP3 implementation is in C++.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I found the README confusing. Basically it appears to compile C -> ELVM IR all in C++ constexpr. Doing this requires preprocessing the input file into a string inside the C++ source file. The result is that ELVM IR is embedded as a string inside the output binary, and running the output binary does nothing but dump this compile-time-computed string.

</comment><comment><USER11> Am I correct in understanding that, contrary to the Turing completeness of C++ template instantiations, the (compile time) computational power of these Constant Expressions thing is intentional?

<comment><USER12> Yes. A "constexpr" function can use a large subset of C++, including calls to other constexpr functions, but the compiler guarantees to evaluate it at compile time, so you can use it where the compiler expects a compile-time constant.

<comment><USER13> > the compiler guarantees to evaluate it at compile time

It doesn't guarantee that.

For example:

      static constexpr int fac(int x) { return x <= 1 ? 1 : x * fac(x - 1); }
      int f() {
        return fac(4); // May or may not be evaluated at run-time.
      }
      char arr[fac(4)]; // fac(4) is evaluated at compile-time.

<comment><USER12> I should have said, "guarantees that it _can_ evaluate it at compile time if needed, such that you can use it where the compiler expects a compile-time constant expression". Yes, the compiler can choose to defer it until runtime in some cases.

<comment><USER14> Can it be forced to be computed at compile-time, by static_assert'ing on the result of the computation?

<comment><USER15> Yes, among other things. As long as a program can't tell the difference (as per the as-if rule), the compiler is free to delay tjee evaluation till runtime.

</comment></comment></comment></comment></comment></comment><comment><USER16> _by relaxing constrains, constant expressions became so powerful that a C compiler can be implemented in!_

I wonder how long it will take before C++ accidentally becomes a Lisp.

<comment><USER17> C++'s template system is more of a dynamically typed Haskell.

<comment><USER18> This video (from the amazing Bartosz Milewski) does a great job of illustrating this:

[https://vimeo.com/7211030](https://vimeo.com/7211030)

</comment></comment></comment><comment><USER19> Now someone just needs to write a constexpr ELVM interpreter and teach 8cc to compile C++14 and this whole thing will self-host!

</comment><comment><USER20> Don't most C compilers compile C at compile time? That's what makes them C compilers.

<comment><USER21> This C compiler is compiled at the same time the C compiler compiles your program. In other words, it compiles C at compiler compile time, where with other C compilers the program's compile time is the compiler's run time.

Hope this helps.

</comment></comment><comment><USER22> See also ELVM's resulting vimscript 8cc: [https://www.reddit.com/r/vim/comments/58hm9n/8ccvim_c_compil...](https://www.reddit.com/r/vim/comments/58hm9n/8ccvim_c_compiler_written_in_vim_script/?st=ivodyglz&sh=2d0b0580)

Machine generated vimscript.. so gross

</comment><comment><USER23> While pretty useless, this is bloody hilarious work!</comment>


Show HN: groups.io - <AUTHOR> http://groups.io/

<comment><USER2> <http://www.groups.io/chat/57>

Hacker News group.

This is a pretty neat project. I can see a lot of design influence coming from FB, wise thinking, as users are afforded immediate interaction clues from an interface they're already familiar with. Well done!

<comment><AUTHOR> Thanks. The FB design influence was intentional because of the reason you mentioned. The groups are private for now I am planning to make that optional.

</comment></comment><comment><USER3> Surprised you haven't added any visitor tracking such as Google Analytics or anything...makes it easier to keep track of user engagement metrics

Looks like a cool product though, good luck with it

<comment><AUTHOR> I have internal metrics. Nothing too complicated just few measurements I care about.

Thanks

</comment></comment><comment><AUTHOR> groups.io is a project I made in my free time to create permanent private group chat with an easy way to share files, links, albums.

I'd appreciate your feedback.</comment>


Flash Ads Are Broken - <AUTHOR> http://www.flashadsarebroken.com/

<comment><USER2> Actually I kind of hope people keep using flash for ads since it's so easy to avoid them by just not having it installed.

<comment><USER3> I totally agree. I dread the day when animated ads move to html5. That's when I'm starting to use aggressive, indiscriminate ad blocking, something I haven't done so far out of consideration for ad funded sites I like.

</comment></comment><comment><USER4> I uninstalled Flash on my Mac about a week ago. Wanted to see if I could reduce the fan noise and heat. The one thing that might make me reinstall is that YouTube only supports 1 in 10 videos in html5, if that.

<comment><USER5> Try this if you use Safari

[http://www.verticalforest.com/2010/06/09/youtube5-html5-conv...](http://www.verticalforest.com/2010/06/09/youtube5-html5-converter- for-youtube-videos/)

</comment></comment><comment><USER6> Nice idea but windowless flash are also more cpu consuming, so ads would use more cpu. I wonder what's the environmental impact of a change like this would be ;)

What's strange was that performance was my original thought when seeing that title, flash is breaking the web is so many ways.

I'm not sure it would change anything for Chrome though, the plugin in a process seems to use the windowless model by default. I'm not sure about that, but the rendering speed while doing my experimentations with <http://swiffout.com> seemed to suggest that.

<comment><AUTHOR> Yeah, Flash is just broken in many ways :)

We have to weigh the performance impact against making sites simply unusable. I've seen so many times where I just can't click dropdown menus or lightbox content because Flash covers interfaces.

</comment></comment><comment><USER7> Or is it just that using Flash for ads is an abuse of the tool?

</comment><comment><USER8> Recently i discover Chrome's Click-to-Play flash builtin feature (you can reach it in Preferences/Under the Hood/Content Settings/Plugins). It's similar to the ClickToFlash plugins for Safari: <http://clicktoflash.com>, but it's integrated in Chrome, you don't have to install anything to use it. Disable flash really enhanced my browsing experience: pages load faster, cpu usage down, more battery time ... If you want to see a specific flash object just click on it.

Too bad they removed the feature in Chromium 9 :( Instead you must block all sites and use a white list for site-wide exceptions.

<comment><USER9> This bothered me too, but you can re-enable it.

Put about:flags in the address bar, and at the bottom is an option for adding back the "click to play" setting.

</comment></comment><comment><USER10> Flash ads are the whole reason I use FlashBlock on Chrome. I don't mind seeing ads to support sites, but asking me to let Flash hog my CPU just to see your ad is more than I can do. Plus, jumping, animated, and ads that play sounds are more than obnoxious.

Also, it's amazing how HTML5 video can play smooth in HD on my netbook, yet Flash videos stutter and act like my computer is dying. All the more reason to wish Flash an early death.

</comment><comment><USER11> In defense of this practice, it seems like the fact that ads force themselves above everything else is quite useful in preventing click fraud.

Wouldn't allowing the flash ads to have a non-window wmode make it would be much easier for malicious websites to trick visitors into clicking on ads that they weren't aware were there?

</comment><comment><USER12> All ads are broken.

Every since I started using NoScript, the page loads faster than ever.

</comment><comment><USER13> Has anyone here considered using an ad blocker instead?</comment>


Telling HN: Having up arrow on right hand side is comfortable to vote. - <AUTHOR>

Instead of ^STORY TITLE, voting is comfortable if it is STORY TITLE^ <comment><USER2> No. Right side is not aligned.

<comment><USER3> So? It's still near the title...

<comment><USER2> I don't know about you, but I don't move my mouse pointer along the title as I read it.

It may just be that I'm old and clumsy, but I would find it very difficult to point to the end of the title. Habit and alignment makes it reasonably possible for me to hit the right thing most of the time currently (I still accidentally hit the down when I meant the up, or vice versa, on occasion...which is very disappointing here, since the arrows then disappear and I can't fix it).

I'm very, very, very much opposed to randomly placed arrows, rather than aligned ones. I would find it deeply disorienting.

I don't usually have strong feelings about bike shed type questions...but on this count I am emphatic. In my estimation your idea is terrible. I can't think of a single benefit to having the arrow at the end of the title rather than the front.

<comment><USER3> I'm indifferent to it, and thought I'd probe your (and others') reasoning. My criterion is that it needs to be close to the title - visual clustering if you will.

But without a proper test, I don't think you or I will be able to judge which is "better".

<comment><USER4> I've conducted tests on similar questions for my day job, and having the arrow consistently in a predictable position proved to be far superior.

Sorry, I can't provide hard data as it's company confidential, but consistency of position has become one of the main design driving forces, so clear was the evidence.

I would be interested in knowing why you claim to be indifferent to it. My tests showed people thought it didn't matter, but their actions were significantly more efficient. Some didn't believe the results, even when shown the measurements.

Why do you think you are indifferent?

</comment></comment></comment></comment></comment><comment><USER5> What testing have you done on this hypothesis?

</comment><comment><USER6> no, the idea should be in a static place if you expect people to interact with it.

</comment><comment><USER7> I like to read more than just the title before I decide whether or not to vote. When I get back, the left is easier because I don't have to read the title again.</comment>


Twitter aims to limit people sharing articles they have not read - <AUTHOR> https://www.theguardian.com/technology/2020/jun/11/twitter-aims-to-limit-people-sharing-articles-they-have-not-read <comment><USER2> It's really hard to imagine who could disagree with this. Devils advocate anyone?</comment>


What's the ROI on Cool? - <AUTHOR> http://cognition.happycog.com/article/whats-the-roi-on-cool

<comment><USER2> The font on that page makes it so hard to read. Instant bounce.</comment>


Magnus: Shazam for Art - <AUTHOR> http://www.magnus.net/ <comment><USER2> Curious how it works on modern art like [https://www.moma.org/collection/works/80103](https://www.moma.org/collection/works/80103) (a solid blue painting)

<comment><USER3> I mean, in post-modernism then exactly everything is art. So there's little point in including it as a category..

<comment><USER4> Just here to take you way-too-seriously and promote a different way of thinking about art :)

Art is an experience, not an object.

Reflecting on an object can help you find an art experience. Some people set out to create special objects designed to help others find an art experience. It's fine to call these art-objects. Other people set out to create performances that help others find an art experience.

Despite the absence of an artist or art-object, some people might have art experiences when they watch a sunset, look through a microscope, or have their understanding turned on its head by an unexpected-but-confirmed result in a dataset.

<comment><USER5> The problem I have with modern art is that it baits the viewer into 'experiencing art' with tricks; by exhibiting the work in exclusive places in fancy ways, putting a long-winded placard about the artist or the piece, attracting certain kinds of people to the events, and creating value around 'getting it.' This context enhances so well that it can enhance nothing into something. It is interesting that it can do that, but to me it was interesting once, then I understood.

<comment><USER4> I feel a little misread, but that might be my fault. I'll try to expound...

\- If you find that engaging with an art-object or art-performance--or even entire categories of them--doesn't help you find an art experience, it's fine to ignore them.

\- If you find placards d(e|is)tract or annoy you, it's fine to ignore them. If you find the thoughts on a placard more interesting than the nearest art- object, it's fine to focus on it. If you find it more interesting to write your own placards and post them on Twitter, that's also fine. It's also fine (well, with _me_ , but perhaps not security...) to print them out later, return to the gallery, and post them next to the work. It's fine to read the placard and decide to dismiss it because you have more interesting interpretation than the artist.

\- If you find it more interesting to sit and imagine what other people are thinking as they browse the gallery, that's also fine. If you're more of a people person, it's also fine to ask someone else what sense they make of a work. It's also fine if you don't give a shit what they think.

\- If you find the gallery's infrastructure or air-quality-monitoring equipment or security system more interesting than the art-objects it contains, it's fine to consider them deeply. It's fine to ignore anyone who notices and thinks you're a rube. It's fine to reflect on how weird people are if someone else walks up beside you and also deeply ponders the same piece of infrastructure. It's fine to come back another time and stick a placard next to it.

\- If you find it surprising or perhaps even galling that someone created an art-object or art-performance, it is fine to accept that it may help other people find an art experience, or accept that it may not be very good at helping any people find art experiences. It's also fine to reflect on why and how it affects you. It's also fine to wonder if the artist is mocking something or someone. It's also fine to wonder if whoever selected thee work got the joke or not. It's also fine to go home and make your own art mocking something you find galling.

\- It's fine to avoid conspicuously pretentious events, venues, and people. It's also fine to go, observe, and make art mocking them. It's also fine to go, and see if any of them spend time pondering the doorstop you stuck a placard next to. It's also fine if it helps some of them have an art experience, whether they get the joke or not.

</comment></comment></comment></comment></comment><comment><USER6> The Android link appears to be broken in the UK... does the link work anywhere? Or is it still waiting to appear on Android?

<comment><USER7> It is broken everywhere...

<comment><USER8> Doesn't seem to be in the Play Store either. Searching "Magnus" turns up other apps with similar names and "magnus.net" returns another art app followed by more like the first search.

</comment></comment></comment><comment><USER9> Didn't Google Goggles do this already?

<comment><AUTHOR> Google Lens + Wescover: [https://www.wescover.com/blog/2019/07/03/press- release-wesco...](https://www.wescover.com/blog/2019/07/03/press-release- wescover-and-google-lens-change-the-way-we-discover-art-designs/)

</comment></comment><comment><USER10> I'd almost install it to see if magnus-the-app would recognize magnus-the- artist[0]

[0] [https://www.lambiek.net/artists/m/magnus.htm](https://www.lambiek.net/artists/m/magnus.htm)

</comment><comment><USER11> hm. what could the strategy of roi be there?

\- data mining/db of the locations of plenty of artworks?

\- mining aided search for new kids on the artblock?

\- finding lost/stolen artworks?

\- what about simple copies?

i have no real clue ...

<comment><USER12> If you can recognize art then you can recognize posters/ads. That would remove the need for any QR code or machine readable printable element.

</comment></comment><comment><USER13> Alternative app name:

"Not Banksy"

</comment><comment><USER14> Interesting to see how it works for black square by Kazimir Malevich</comment>


My tech cofounder drops out. I just receive a 10K investment. What do I do? - <AUTHOR> <comment><USER2> Explain the situation to your investors, offer to return the money, build another company while staying in touch with your investors.

Yes, it kind of sucks. $10k is not enough money to waste goodwill on or potentially voiding your reputation.

Good luck.

<comment><AUTHOR> I'm trying to avoid this. But lets see what happen. Thank you for your comment :)

<comment><USER2> I know you're trying to avoid doing the slam dunk obvious right thing. There's almost zero upside to what you want to do. Even if you're cofounder hadn't left the odds are that your startup would fail. That's the nature of startups.

The $10k won't change that. Your cofounder leaving makes it even more likely your startup will fail. And that means that should the startup fail, your startup will have failed and you will have done the wrong thing.

On the other hand, if you disclose the status to the investor, the worst thing that can happen is that you walk away from a troublesome project with a potential future investor who sees you as a person of integrity. The best thing that can happen is exactly the same as the best thing that can happen if you don't disclose. And the odds of that best thing happening are improved because you don't have to waste energy on a web of deceit and because you have an ally who will talk well of you.

A person is only as good as their word.

<comment><USER3> "Even if you're cofounder hadn't left the odds are that your startup would fail."

I think that's a shitty outlook. Of course your startup has odds of failing, but if you quit on your idea because of this hiccup, your chance of failure is 100%. These things happen. Be 100% up front with your investor, tell him you need some time to find a new co-founder, and then go find one. If the investor can't stomach this challenge and wants his money back, all good - his money wasn't worth the hassle of having an investor with a low risk tolerance. But perhaps he's someone who either believes in you or your idea, and would want you to persevere and get this thing off the ground, not jump ship at the first sign of difficulty.

Your other options are to hire some freelancers/developers to help you take your early stage prototype to a public-facing finish line. Or learn to code yourself, that's always an option ;)

<comment><USER4> > If the investor can't stomach this challenge and wants his money back, all > good - his money wasn't worth the hassle of having an investor with a low > risk tolerance. But perhaps he's someone who either believes in you or your > idea, and would want you to persevere and get this thing off the ground, not > jump ship at the first sign of difficulty.

That's not entirely fair. If the investor had been told there was a team in place, and relied on this in making an investment decision, a co-founder leaving is a material event that the OP has an ethical if not legal duty to disclose. This is especially true since none of the money has apparently been spent.

<comment><AUTHOR> It was my mistake not to explain correctly the situation. The investor knows the fact that the co-founder leaves and I hire a freelancer to continue with the development, no matter this, he decide to invest.

</comment></comment></comment></comment></comment></comment><comment><USER5> Find another co-founder? what is his/her role in the project?

<comment><USER6> Of course this is the obvious answer, but, the op already knows that. They are asking because, they have some conundrum that they can't put heir finger on. We need more information.

Why losing a co-founder is a problem? Only they have the technical ability? Only they have the insight to the sector? The fund depends on their name? The fund depends on the partnership? co-founder is irreplaceable in some way? Op has time limits? Op lacks the technical/social abilities to replace partner?

<comment><AUTHOR> I don't have the technical abilities, that's the only thing. Definitely the co-founder is replaceable. I have just hire someone to continue the work and see how things go before asking to be a co-founder and don't burn money on salaries in this very early stage. What would be your recommendation for me?

<comment><USER6> It's the talent finding question, we are all having and fighting right now. If you watch HN carefully you would see that we have at least 4 - 5 talent finding guidelines or startups popping up daily.

HN is a good place for looking for talent, but you need to give more information about what you want to build. Also you need to create interest in people because it's really an early stage venture with low funding. Considering money is the first incentive you need luck, or you need to show that you have the chance to become a unicorn.

Also you may try angel.co.

So good luck.

<comment><AUTHOR> Thank you for your comment :)

</comment></comment></comment></comment></comment><comment><USER7> [http://odesk.com](http://odesk.com)

<comment><AUTHOR> Thank you for the link! ;)

</comment></comment><comment><USER3> cool idea! DMing you ;)

<comment><AUTHOR> Hi! @ryanalam, I read your tweet but you still didn't DMing me.</comment></comment>


'Big Bang' Isn't Porn, So Why Is China Censoring Hollywood? - <AUTHOR> http://www.bloomberg.com/news/2014-05-14/-big-bang-isn-t-porn-so-why-is-china-censoring-hollywood-.html

<comment><USER2> Doesn't "Big Bang" have at least one gay character? (disclaimer... I have only seen tiny portions of the show).

Maybe this is the reason?

</comment><comment><AUTHOR> take control is everything</comment>


Show HN: Create and Publish a Newsstand Magazine... No Coding Needed. - <AUTHOR> http://uninkd.com

<comment><USER2> You didn't show me anything.

Also, by using all caps and omitting a comma, the following sentence is confusing: "PUBLISH A BEAUTIFUL NEWSTAND MAGAZINE, MUCH LIKE THE MAGAZINE FOR ALL IOS DEVICES." I've never heard of The Magazine, so that didn't help.

Consider, at a minimum: "PUBLISH A BEAUTIFUL NEWSTAND MAGAZINE, MUCH LIKE THE MAGAZINE, FOR ALL IOS DEVICES."

<comment><USER3> My uncle always used to say to me,

"Don't tell me what you're going to do. Show me what you've done."

This website feels like it's trying to get my email by reiterating an idea that was discussed on HN already.

<comment><AUTHOR> If you are interested in publishing your own magazine on Newsstand, then we are definitely interested in getting in touch with you.

If you aren't, then we haven't got much use of it.

Let us know if you are.

</comment></comment></comment><comment><USER4> Good idea, but I think for a 'show HN' there should be actually more to show than just some slogans.

Any plans for cross-platform publishing? Google Play has magazines now as well (as does Amazon): <https://play.google.com/about/magazines/index.html>

<comment><AUTHOR> I know, I know. We are not showing a full product here, or even a half one. We are getting in touch with the people who are interested in publishing a Newsstand Magazine.

We're gonna start with iOS and see where that takes us.

</comment></comment><comment><USER5> This sounds nice, but what's behind the signup link?

Right now all I see is a couple of sentences promising to publish to Newsstand "with the click of a button."

Is this just an idea? Is there a product ready to use? In progress? At the early design stage? What's there?

<comment><AUTHOR> One of the guys behind it here. We have a good chunk of the code already up and running and we're gonna have a demo up before long.

Hit us with an email and we'll keep u in the loop :-).

</comment></comment><comment><USER6> After reading your comments it seems that you are mostly trying to get in touch with people interested in your project/idea. It's been a long time since I sent an email to a service to register or at least show interest.

Why not add a field to add my email info as most launchrock pages do? It would be a lot easier than copy/pasting your target email address to email you.

(EDIT: You might also want to use a dedicated email address for your project instead of one based on you HN tag, mainly because I want to remember why you are writing me back later if you do and your address should provide that which it does not)

<comment><AUTHOR> Very true. To be honest, something went wrong in our backend, just as we posted, so the email form field didn't work. So we had to go old school with email.

</comment></comment><comment><USER7> Well this was a disappointment... Well, this was a disappointment... Well, this, was a disappointment...

Is this going to take my blog RSS and create a magazine, like Google Currents (and others), or is this a Wordpress plugin, or is this an AuthorHouse like publishing model, ...

I feel <http://uninkd.com/> jumped a bit too soon on show and tell.

<comment><AUTHOR> Thanks for the feedback. Will definitely do that the next time.

</comment></comment><comment><USER8> I think you should have had some demo or something ready before you published it to HN. I really like the graphics and style, can't wait to see how your program works!

<comment><AUTHOR> You might be right. I'll keep that in mind for next time.

Hit us with an email and we'll keep you in the loop.

<comment><USER7> But why sign up now to your email? You have already lost me in the sales loop. You made a compelling statement but the followup was lacking.

This would be like me, while driving, seeing a sign that said "free food and drink, come on by". I pull off (because I am hungry), go into the store and ask about the free food/drink. The staff says "We're still developing the concept, give me your phine number and we'll keep you in the loop". Still hungry, I go elsewhere and ignore those free food/drink signs.

</comment></comment></comment><comment><USER9> Show a video or at least a sample published with it.

<comment><AUTHOR> It's coming.</comment></comment>


Foster father takes in only terminally ill children - <AUTHOR> http://www.latimes.com/local/lanow/la-me-ln-foster-father-sick-children-2017-story.html <comment><USER2> I know a lady that works on the cancer ward of a childrens hospital. Strongest person I know, but after reading this I'm not even sure how to feel. Having children comes with the risk of losing them, having children with the full knowledge that you _will_ lose them is on another level entirely.

Hats of to this man, I know I could never do this.

</comment><comment><USER3> Jesus. To not only be a child with a terminal disease, but to also lack parent(s)... I can't imagine the pain and sadness these kids feel. Thank you to this man.

<comment><USER4> And on the other side - it's hard enough being a parent and seeing your kids grow up and not need you. Harder still to be a foster parent and constantly become attached only to have them torn away from you, seeing them go on to situations that may be subjectively worse than the home you gave them.

You give up a part of yourself to raise a child. I simply can't imagine the sort of emotional strength it would take to bury 10 children and show such love to dozens more.

<comment><USER5> Foster parents always have the option to adopt. Not to be a negative Nancy, but the system is pretty terrible and many, MANY foster parents act more as halfway houses for kids than any sort of "parent".

<comment><USER4> Not always. Biological parents, at least in my area, can often reclaim the kids.

<comment><USER6> The goal is usually to reunite the child with their parent, but circumstances often intervene. Children have a larger network of caregivers (aunts, uncles, grandparents, cousins, even church members and family friends) that also play a large role.

</comment></comment></comment></comment></comment><comment><USER7> I read this article when it was first published and was very moved. I was able to donate to him here, if you are interested: [https://www.gofundme.com/bzeek/](https://www.gofundme.com/bzeek/)

<comment><USER8> It's reached 142% of its original goal in _five days_! (That does _not_ mean we can't add to it.)

The GoFundMe has informational updates as recent as today (13 February).

</comment></comment><comment><USER9> He lost his wife, his son was born with significant disabilities and all these kids are dying in his care. I just don't know how he does it. I'd just have nothing left after all of that.

</comment><comment><USER10> My sister worked in an ICU ward for babies as a nurse and she would often cry for days after one of the babies died. Shortly after me and my partner had a son my sister decided to quit her job because she felt even more attached to the babies. She couldn't bear it more.

Just saying this because it must be horrifying to watch your kids die again and again. I guess this man finds solace in the fact that he is making their short lives much better. My respects.

<comment><USER2> One of my children spent the better part of two weeks in such a location. Please thank you sister on my behalf, it's the ones that live that hopefully somehow relieve some of that burden and mine did and I'll be forever grateful to the people that do such work. One day when we came there to feed our child the atmosphere was quite changed and I didn't have to ask anybody what was up. And still, nobody so much as dropped a stitch on that shift or said a bad word. Super impressed.

<comment><USER10> Thank you for your kind words and I'm so sorry to read about your experience (can't find right words...)

<comment><USER2> All is well that ends well. He's fine now but those were the longest days of my life to date.

</comment></comment></comment></comment><comment><USER11> The subtext here is that "Bzeek, a quiet, devout Libyan-born Muslim" would not be allowed to immigrate to the United States today given the "Muslim Ban" Executive Order.

<comment><USER12> Isn't it a temporary ban?

<comment><USER13> The thing about phantom threats to national security is they never seem to go away.

<comment><USER12> So should temporary bans be...banned? It seems there could be use for a temporary ban in the general sense.

AFAIK, this was a good scenario for a temporary ban. More strict anti-terror regulations are announced to be coming, and to prevent people from trying to get in before that ban, you have a temporary ban.

It made sense to me.

</comment></comment></comment></comment><comment><USER14> Another side story is that the girls condition was caused by her mother breathing a pesticide . The mother was probably an immigrant her self that we want to throw over a wall. Also if breathing this pesticide caused this how can it be safe to eat?

<comment><USER15> _if breathing this pesticide caused this how can it be safe to eat?_

Because something going into your lungs and something going into your digestive system has two very different effects.

I'm not saying its good or healthy to eat pesticides, but that's a separate issue than "breathing it in is poisonous, so all forms of administration must be poisonous" isn't necessarily true. For example, your stomach acid often breaks down things.

Having said that, I am of the general opinion that we shouldn't be consuming pesticides.</comment></comment>


Python auto-generated documentation–3 tools that will help document your project - <AUTHOR> https://medium.com/blueriders/python-autogenerated-documentation-3-tools-that-will-help-document-your-project-c6d7623814ef <comment><AUTHOR> Creating an up-to-date, meaningful, easily usable documentation is not trivial. This article shortly reviews 3 tools that could help automate the process. I focus only on Python tools that can be used for internal documentation.</comment>


Elegance and the Surreals - <AUTHOR> http://github.com/raganwald/homoiconic/blob/master/2009-03-07/surreal.md#readme

<comment><USER2> I went through a similar though process recently when doing some language work.

Another slightly more traditional representation down this (slightly reductionist) track is to use two symbols - TRUE and FALSE. Then numbers are simply lists of these symbols (i.e. you use lists to represent the bytes/bits/whatever).

I say reductionist, but it's still tempting as it increases how orthogonal your language is (which goes towards the simplicity/elegance/scale angle discussed in this article).

You can apply similar logic to other firmly-established types such as strings - which can be lists, but are generally more efficient as char* arrays.

In the end, I decided that whilst this approach was great from a purist perspective, I was actually working against my target platform. The reality is that the CPUs I'd be ever likely to target are designed to work with numbers. So I made the compromise not to rail against that (Whereas the LISP machine pictured in the article is almost a vision of another, alternative reality).

One alternative I've considered is putting in lazy evaluation. Things will work as numbers, but as soon as you call a list operation, it promotes it to the list form... Although to be honest it hasn't come up yet, which is somewhat of a surprise, so I'm not sure if I'll ever get around to that.

</comment><comment><USER3> No offense, but making surreal numbers in code seems a bit pointless.

Yes, both mathematics and programming, like any other user interfaces, are built on abstractions, and yes, we benefit by making those abstractions elegant: namely, few, small, orthogonal, and flexible (in the words of the article, "Elegance consists of building something out of a small core of representations that scale well. It is not enough that they be simple, the complexity of what you build must not grow uncontrollably as you try to solve bigger and more complex problems."), but surreal numbers are much easier to understand without looking at a bunch of extra verbose syntax of a programming language. There may be some value in implementing such a thing personally if you're trying to make sure you understand what surreal numbers really do and how they really work, but reading someone else's implementation just gets in the way. I definitely recommend Conway's book. It's loads of fun.

Incidentally, just about every other user interface also benefits from adopting these "elegance" principles (GUIs, hand tools, political systems, etc.). They are among the essential axioms of design, and any designer should keep them always in mind. I think I like the version in the "Zen of Python" best of any wording I've seen.

<comment><AUTHOR> > No offense, but making surreal numbers in code seems a bit pointless... > There may be some value in implementing such a thing personally if you're > trying to make sure you understand what surreal numbers really do and how > they really work, but reading someone else's implementation just gets in the > way.

I'm not offended in the least.

Above and beyond any reasons I may have for writing such code myself, putting code into my essays serves a very important purpose: It makes a personal statement about the balance between code and ideas. There are already excellent sources of information about mathematics and programming languages. For example, the post links to both Mark Chu-Carroll's blog and Paul Graham's essay.

I agree fully that my own writing is far less useful than either of these sources for learning about mathematics or about the design of programming languages. But I must soldier on trying to make my own personal point, and in this case the point includes a certain amount of code.</comment></comment>


What did Alan Kay mean by Lisp is the greatest rogramming language ever designed - <AUTHOR> https://www.quora.com/What-did-Alan-Kay-mean-by-Lisp-is-the-greatest-single-programming-language-ever-designed/answer/Alan-Kay-11?utm_source=programmingdigest&utm_medium=email&utm_campaign=featured&share=1 <comment><USER2> Discussion from 4 days ago (188 comments): [https://news.ycombinator.com/item?id=15558861](https://news.ycombinator.com/item?id=15558861)

</comment><comment><USER3> Is there a paid campaign to get this message out? How many times have we come across is in the last few days?

<comment><USER2> I think people are coming across one of the other two Alan Kay on Quora submissions[0], [1], finding this other answer, and aren't checking for dupes when submitting. This isn't that uncommon of an occurrence, plus the title of the submission for this answer is "Alan Kay on Lisp": it's not immediately obvious that the submission points to this Quora post.

[0]: _Alan Kay Answers "Is There a Successor to Smalltalk?"_ [https://news.ycombinator.com/item?id=15518746](https://news.ycombinator.com/item?id=15518746)

[1]: _Alan Kay answers "What was it like to be at Xerox PARC when Steve Jobs visited?"_ [https://news.ycombinator.com/item?id=15575287](https://news.ycombinator.com/item?id=15575287)</comment></comment>


Ask HN: How are distributed systems as a field of study compared to ML/AI? - <AUTHOR> I currently work on Database Development at Oracle. I would like to acquire knowledge on something other than the DB internals, and I've been recently fascinated with Distributed Databases like CockroachDB, AWS Aurora, Azure Cosmos, TiDB, etc.
So I was thinking I'd dive deep and learn more about distributed systems and possibly try to switch to any of the above mentioned companies.
I would like HN's opinion about the scope for Distributed Systems(& Distributed Databases) as a career choice, compared to the current hot areas like Machine Learning/AI.
A bit of background about me : I did my undergrad in a Non-CS field, but I've had an interest for Computer Science since High School, so the switch to a full fledged CS job was not that difficult. I'm self motivated and willing to spend copious amount of time to learn something that would help with my career. But I'm confused as to what to study.
Should I stick with my current interests (or) follow the industry trend, and try to learn an ML/AI ?
Thanks! <comment><USER2> I'm biased as my work is primarily focused on large-scale distributed physics simulations, and incorporating machine learning into these. As a result, I treat ML very much as a means to an end.

Of course with the caveat that your situation is unique to you so I can't give any definitive answers, I would think long and hard before jumping on the ML hype train. In my experience, it doesn't pay to follow the trend; you've either gotta be first or you gotta be unique. Now that's not to say that doing ML work work will only be restricted to a select few which you aren't a part of, but myself and a few others are wary that the ML hype train (at least as far as deep learning is concerned) might be passing. The days of the AI labs paying million-dollar bonuses are nearly gone, unless (and someone can correct me if I'm wrong) you've got an alternate skill set they're looking for. Of course, that doesn't mean there aren't plenty of people and businesses who would need CRUD-type ML setups; with your experience in databases I imagine that could be a unique angle to attack it from. Whether it's a good idea to try and pivot into a career using ML really depends on your specific situation and the opportunities therein; to get more solid advice I would ask a trusted colleague or mentor, and would not consult people online, even if they are from HN.

For my PERSONAL opinion: I can't speak to what is normally done in other parts of distributed systems, since scientific tools are usually bespoke and don't use the same set of approaches as commercial products. However, just thinking about it from an outsiders POV, it seems to me like focusing more on distributes systems would be a winning combination. I don't think computers will advance enough in the next 30 years that the need for distributed data and compute management skills will go away; hell with IoT you might be looking at a boom down that career path. From my perspective it's only upside if you focus on expanding your skilllset in these areas; if ML continues to thrive there'll most definitely be a need for distributed systems to run these models on. And if an AI winter hits, you'll have a solid set of core skills to fall back on which I don't imagine will go out if favor anytime soon. Those are just my two cents though, of course YMMV.

<comment><AUTHOR> Thank you for taking time to answer this!

I never knew that distributed physics simulations could be a career field. I always thought that such problems would be handled by scaling up vertically or just throwing a super computer at it.

If you don't mind, can you please elaborate a bit about the type of work that you do and scope of problems that you solve every day?

Thanks again!.

<comment><USER2> I can elaborate a bit. Most of the large-scale problems are actually as straightforward as "just throw a supercomputer at it". However, just like when mathematicians say "that's an implementation detail", it turns out that actually throwing a supercomputer at the problem is much more difficult to do in practice than merely setting up some shell scripts to run, especially where scientific computing is concerned. For one, there's usually no concept of "micro services" or "containerized" applications, at least not in my experience. Most of the modern distributed computing practices are actually thrown right out the window when it comes to scientific computing, since the scientists are going to be directly programming distribution schemes via MPI and stuff. The reason is because academic projects don't have lots of money and need to efficiently use every dollar, and because most of the time distribution schemes really aren't suitable for the science. You might have one layer where node interactions occur according to some mathematical and physical criteria instead of "load" or some other abstract flag, for example; that's a bit harder to code for, and it's much better to have a domain scientist who knows the physics deciding how to decompose the problem, instead of a computer scientist who has no idea of the physics adopting a scheme which ignores the problem entirely. Hence why I said most scientific tools are "bespoke".

The result is that most of the distributed systems people are moved to a supporting role, where their job is to develop tooling and libraries to allow for better communication between nodes, for example. I've also heard of some compsci people being directly integrated into these scientific teams to develop specialized APIs and such in-house, but that's a bit more rare imo. These are just some examples of how science and compsci intersect; for example here's one group I know of: [https://www.ornl.gov/group/dcs](https://www.ornl.gov/group/dcs)

</comment></comment></comment><comment><USER3> They're basically everywhere, there's a lot to learn, it's a valuable skill for a potential employer and you're interested. Seems pretty obvious that you should go deeper with distributed systems. Also, your lack of formal education won't hold you back as much as it would with ML. The idea that you should go do math for the next couple of years just because the field seems hot, doesn't seem well thought out.

<comment><AUTHOR> Thank you for taking time to answer this!

I honestly thought that my lack of formal education would be hurdle when learning/working on Distributed Systems. Don't you agree?

Also, I've always wondered how ML models are deployed in production at scale. Building a model using libraries in Python seems fine, but how do they distribute and deploy it in Production?

</comment></comment><comment><USER4> Huh? Seems to me that you should be interested in and learning about all manner of computer related things including Distributed Systems, Machine Learning, and Artificial Intelligence. Knowledge and techniques useful in one context are generally useful in other contexts. The ability to see structure and similarities across systems and applications is invaluable.

<comment><AUTHOR> I'm not quite sure about that. For example, I dont think any major Database vendor has considered using ML algorithms inside a DB. Google did try replacing B-Tree indexes with Neural networks, but that was only a research project and it wouldn't have been possible to scale it up to meet production demands.

But I think I understand where you're coming from and I should definitely try to widen my knowledge base.</comment></comment>


Write come code, win some money - Dev Contest - <AUTHOR> http://www.newcloudapp.com/

<comment><USER2> Rules say: "Entry must not contain parts of other people's work including without limitation other people's or company's applications, software, codes, trademarks, logos, copyrighted materials (i.e., no sampling of other applications, or any other types of third party materials allowed) or other proprietary materials."

So apparently no frameworks, no open source libs, no non-MS libs at all, no jQuery (even though it's supported by ASP.Net--it's still third party--unless you link to google hosting it, and then maybe it's not part of your entry?).

Confusing.

</comment><comment><USER3> Write "come code." Hmmm... Well, you win money for it.

</comment><comment><USER4> as apposed to 'Write some code, earns some money'

Seriously, $5k for writing an app - sounds like a rate for a baseline contract, not a competition where you might not get paid.</comment>


Ask HN: Foreign founders – would you incorporate in the US today? - <AUTHOR> I have been thinking, as an Australian, that were I to found a company today, I would be hesitant to incorporate or headquarter in the US. Obviously it might exclude opportunities such as YC and any investors who only invest into US corporations, but the current political climate US is not exactly stable and I actually think high risk for startups, especially in the following respects:<p>* The president has undermined the rule of law and has challenged court rulings through twitter. This gives me no confidence that if your US corporation was engaged in litigation, especially against the government, that the court's rulings would be respected or followed.<p>* Immigration policy - you would find it increasingly difficult to recruit foreign staff and could be stigmatised for hiring from outside the US.<p>* Pressure to be an 'all American company' - Similar to the above but with respect to outsourcing, there is a risk that if you became successful, the President could at any day tweet negatively about your company.<p>* Risk of war with the world.<p>I'm sure there's more but just some thoughts I've been having. What do other foreigners think? <comment><USER2> I have pondered this question for a while too.

Obviously it is easier for YC to manage its founders and investments if they all embrace a common legal framework. Being a YC company does not necessarily mean your operations are based in the US, only that you incorporate there.

To respond to some of your questions:

> The president has undermined the rule of law....

My understanding is that the actions of the president or any other official can be successfully challenged in court. He doesn't have the last word

> Immigration policy - you would find it increasingly difficult to recruit > foreign staff and could be stigmatised for hiring from outside the US

Not an issue if you operate outside the US. If you operate within the US, you deal with them the same way as your peers.

> Pressure to be an 'all American company' ...

Same answer as stated above

> Risk of war with the world

Nobody is going to war anytime soon. Trump is a fan of theatrics. As recent events have shown, more mature counsel will have its say.

But on a related note, I have always wondered - how do taxes work for YC companies incorporated in the US with operations abroad? Do they pay taxes both countries? This must impact their profitability and chances for survival in their growth stage

<comment><AUTHOR> Hi Lordrminius,

In respect of the first point, while you say the President doesn't have the "last word", there were for example indications of US Customs officials ignoring court orders presumably on the instruction of the white house during the immigration order debacle.

<comment><USER2> That was an isolated incident and not by any means the norm. The US government will find ways to 'f' your company over if they so desire, but it will not usually be so crudely executed. (I'm not a fan of US incorporation by the way)

</comment></comment></comment><comment><USER3> Excellent question. I would recommend the nomadic capitalist.

There is a sheen placed on the US which is waning.

But buying power and corporate freedoms are still better here.

As someone who tried to startup in India and have had success here, the grind may be a bit more currently but still a fan.

</comment><comment><USER4> We can still have a local branch run by trusted collaborators in the US while keeping HQ elsewhere. Same for UK from Europe after Brexit. Relocating in person is not the only option.

</comment><comment><USER5> There are many, many disadvantages of incorporating here. For example, if you are an atheist, or have any other ideas that are anti-mainstream (eg. are critical of dogmatic feminism or runaway capitalism) you may be targeted by the surveillance state, which in my case has already happened.

The added stress compounds the existing stress of running a startup.

If YC opened an international branch, I would leave in a heartbeat. I'm also looking into Techstars, which seems to have some international presence. I really hope YC takes some leadership here.</comment>


Practical Web Cache Poisoning - <AUTHOR> https://portswigger.net/blog/practical-web-cache-poisoning <comment><USER2> I think you can think of this as a generalized technique for turning reflected cross-site scripting into stored cross-site scripting.

The concept is straightforward. You look for refxss in "unkeyed" inputs: those are inputs that alter the output of a cacheable page but aren't themselves part of the cache key. That "unkeyed" property is why his examples are all in things like the X-Forwarded-For header. Caches key on URL parameters (because they key on URLs), but tend not to use that header as a key, so two requests varying only in X-Forwarded-For are, to a cache, the same request. If you can trigger refxss in the unkeyed input, that refxss will be cached and fed to everyone else regardless of whether they use the same unkeyed input. Presto: stored XSS.

While that's super cool, if you're not already familiar with modern web application testing, I think the more interesting part of this post is the tour you get of the methodology Kettle uses to find vulnerabilities in the first place. The XSS examples he's providing aren't "novel"; the novelty is in tricking caches into storing them. But he uses the post as an opportunity to show off some advanced Burp features, which is useful even if you're not going to go test for cache poisoning.

</comment><comment><USER3> "Practical" is right – a seemingly "theoretical" exploit turns out to have serious practical implications. This is a really well-written article with lots of examples.

Excellent work!

</comment><comment><USER4> This is a well written article with many details. What caught my eye was the following.

> "To exploit this, we need to go to hubspot.com, register ourselves as a > HubSpot client, place a payload on our HubSpot page, and then finally trick > HubSpot into serving this response on goodhire.com

> ...

> Cloudflare happily cached this response and served it to subsequent > visitors. Inflection passed this report on to _HubSpot, who resolved the > issue by permanently banning my IP address._ After some encouragement they > also patched the vulnerability."

This made me chuckle as well as get frustrated with how most teams and organizations react to security issue reports by first going into denial. They then try shutting up or preventing the person/entity reporting the incident from accessing the system, while continuing to proceed with "business as usual" and claiming that their systems are perfect. Good that HubSpot did patch the vulnerability soon after in this case.

If someone were to ask me for comments, I'd say people and organizations need to grow up, own up and work better. Such reactions show a lot of immaturity while keeping their users vulnerable.

P.S.: In the Indian context, this kind of a response reminds me of UIDAI (the organization that manages the biometric based resident ID system), which is permanently in denial mode when vulnerabilities related to security and privacy in its ecosystem and all the entities that link to it are pointed out.

</comment><comment><USER5> In 2017 or 2016, there was a Blackhat talks that explained how to trick the web cache on main popular website (including Paypal) into caching any web page. The trick is that many web cache just do a check on the extension (.jpg, .png) to check whether to cache a page or not. If you added ?foo=.png to any page, it would be cached. The host showed how he could trick any web visitor to access their Paypal account home page (if logged in) and cache any page that he would later visit.

<comment><USER6> Yes, this is called Web Cache Deception and is referenced in the article above:

 _Please note that web caches also enable a different type of attack called Web Cache Deception which should not be confused with cache poisoning._

</comment></comment><comment><USER7> The bug for the problem James found with the configuration of Normandy ([https://github.com/mozilla/normandy](https://github.com/mozilla/normandy)), Mozilla's system for distributing Shield studies , is now public at [https://bugzilla.mozilla.org/show_bug.cgi?id=1433134](https://bugzilla.mozilla.org/show_bug.cgi?id=1433134)

We were bitten because django's ALLOWED_HOSTS was set to accept anything and django's USE_X_FORWARDED_HOST setting was true.

</comment><comment><USER8> amazing article. i believe it advances the state of the art. extremely well presented.

</comment><comment><USER9> The website I work at has an advertising partner cache bids and creatives, could these in theory be hijacked?

<comment><USER10> I watched the author's talk at Black Hat yesterday and to my understanding, yes. It's a matter of tricking the cache into storing a request with malicious unkeyed input.

i.e. The cache looks for:

GET /advertisement/1

And caches the request body and other headers as a value with that line as the key. If you can manipulate the same key to have a different value, say by tweaking a cache-specific header, then the body of that GET response (an ad) changes for everyone hitting the same cache. Certainly worth testing with the tools that have been released ;)

EDIT: The tool in question, a plugin for Burp Community + Pro: [https://github.com/PortSwigger/param- miner](https://github.com/PortSwigger/param-miner)

</comment></comment><comment><USER11> This is top notch.</comment>


Data analysis of Australian patent firms - <AUTHOR> https://www.jphwang.com/australian-patent-filings-by-firms-1/ <comment><AUTHOR> Over the last few months, I've answered a few questions on how to choose a patent firm / attorney, and I've also been working on some data analysis / viz stuff on the side.

So I thought I'd combined the two and look at the publicly available data on Australian patent firms and filing data. I found it quite interesting, and it might be helpful if you're looking to find an Australian firm to work with.

I intend to cover data analysis by technology areas / classifications in another part. Let me know if you have any other questions though. Thanks!</comment>


Hydros: How we join Mongo and Redis (by cheating) - <AUTHOR> https://segment.io/blog/hydros-how-we-join-mongo-and-redis-by-cheating/

<comment><USER2> this is related: "MongoDB is dead. Long live Postgresql" [https://news.ycombinator.com/item?id=6801567](https://news.ycombinator.com/item?id=6801567)</comment>


Preventing form re-submission with HTTP 303 redirects - <AUTHOR> http://tumblr.jonthornton.com/post/7902581999/preventing-form-resubmission-and-http-303-redirects

<comment><USER2> Be really careful with this. While all browsers out there speak http 1.1 by now and thus should support 303 redirects, many proxy servers are still living in http 1.0 land.

A proxy shouldn't care about a status code in the 300 range, but it might (maybe erroring out on "unknown" codes as part of some security feature).

And then there are scripts quickly thrown together using the HTTP libraries of $LANGUAGE. You'd have to check these too if you use them in a context where you'd also use a 303 redirect.

For what it's worth: my app is serving pages to users behind the worst possible collections of both enterprise and personal firewalls that seem to mangle HTTP headers at will. Heck, I even have more than 10% IE 5.5 users on one installation.

That said, ever since 2004 I have never had one instance of a browser or proxy resubmitting a form in response to a 302 redirect. But many instances of where leaving the trodden path, was causing the strangest unexpected breakages due to severely broken client software.

As such, personally, I will stay with what works and what the RFC is admitting to generally work even if it shouldn't, instead of experimenting with semantics for no visible gain what so ever.

Sounding bitter? Once you witness AV software altering Content-Encoding headers without altering the encoding, you too would get bitter :-)

<comment><USER3> Proxies don't perform the redirect themselves, so they don't need to support it, they just need to pass it through like any other 3xx.

The last UA I saw that didn't support 303 was Netscape 4.

Body of the redirect response should contain a link to the new page. This way even time travellers form '90s will be able to reach the destination page.

</comment></comment><comment><USER4> This post seems to be based on the belief that everything adheres to the spec. Historically, 302 has always been interpreted like 303 is defined, and never like 302 is defined. For example:

"If the 302 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued."

Does the browser you use do that?

As with cookies, developers go with what works, even if it isn't exactly what the spec says.

History aside, it could be that there is now a difference in how 302 and 303 are interpreted by modern browsers, and I would love to see definitive tests. Any volunteers?

<comment><AUTHOR> I've noticed older versions of Firefox trying to resubmit form data when refreshing after a 302 redirect.

Granted there aren't many people running old versions of Firefox, but why risk it? Even if 302 is generally interpreted like a 303, it's safer to just use a 303.

<comment><USER4> Safer? The risk is that 303 is misinterpreted, and this risk is why we have always used 302. I'd need evidence before taking a chance based on someone's recollection of an older version of Firefox.

RFC 2616 mentions early misinterpretations; they are why 303 and 307 exist:

"Note: RFC 1945 and RFC 2068 specify that the client is not allowed to change the method on the redirected request. However, most existing user agent implementations treat 302 as if it were a 303 response, performing a GET on the Location field-value regardless of the original request method. The status codes 303 and 307 have been added for servers that wish to make unambiguously clear which kind of reaction is expected of the client."

Recommending 303 sounds like a great idea, but the spec's description of 303 is what 302 is in practice, and the latest spec (2616) makes note of this reality. Also, consistent support for 303 is not a sure bet:

"Note: Many pre-HTTP/1.1 user agents do not understand the 303 status. When interoperability with such clients is a concern, the 302 status code may be used instead, since most user agents react to a 302 response as described here for 303."

Without evidence, using 303 is the riskier option.

<comment><AUTHOR> "Note: Many pre-HTTP/1.1 user agents do not understand the 303 status."

The fact is there really aren't any pre-HTTP/1.1 browsers still in use. See: [http://serverfault.com/questions/110932/are-there- internet-u...](http://serverfault.com/questions/110932/are-there-internet- users-connecting-with-http-1-0)

Given that many web apps these days require javascript and CSS and HTTP/1.1 is over 12 years old, I don't think it's realistic to worry about clients that only support HTTP/1.0.

While 302 works in practice, it's safer to use 303, which works by definition.

<comment><USER5> The problem is that the browser is not the only client involved. Corporate/country/personal proxies, firewalls and antivirus software all sit in between some servers and clients, some of them still do not handle HTTP/1.1 correctly, and many of them will alter your headers in transit.

As your StackOverflow link mentions, Squid, a widely used proxy, is _still_ only fully implemented for HTTP/1.0.

<comment><USER3> Corporate/country/personal proxies, firewalls and antivirus software don't perform redirects themselves, so they are irrelevant for status 303 support.

Today all clients that send HTTP/1.0 version support more than HTTP/1.0, e.g. HTTP/1.1 Host header is basically mandatory on the web.

HTTP/1.1 compliance requires some harder things like pipelining support, and full HTTP/1.1 caching proxy has a lot of hairy stuff to deal with (strong/weak cache validators, stitching of partial responses, Vary support, etc.).

You can have quite decent HTTP/1.1 implementation that still doesn't deserve to be called full HTTP/1.1.

</comment></comment></comment></comment></comment></comment><comment><USER6> > _Ruby, Python, and PHP default to an HTTP 302 (Temporarily Moved) redirect._

This is very pedantic of me, but as of HTTP 1.1, HTTP 302 is _Found_ , not _Temporarily Moved_ [1].

[1] <http://tools.ietf.org/html/rfc2616#section-10.3.3>

</comment><comment><USER7> Are there any significant drawbacks to using a 303 over a 302 redirect? I ask because I've seen this advice a number of times before - typically on StackOverflow - and I've seen a lot of recommendations to use 302.

One question I found on a cursory search just now[1] asks whether to use 302 or 303. All three answers submitted to the question recommend 302. The key consideration seems to be backwards compatibility with HTTP 1.0 (the 303 response was apparently added for HTTP 1.1), with the understanding that 302s act close enough to 303s that you don't really need to worry about it. Is this a valid concern, or is this simply an old concern that hasn't died even though the context has changed over the years?

[1] <http://stackoverflow.com/q/5129076/1588>

<comment><USER3> I think compatibility with 1999 "new" version of HTTP is not a concern any more.

The bigger concern I have is that it allows clients to prompt user and re-send POST after 302 (exactly what the redirect trick is trying to prevent).

<comment><USER7> I've seen a few people say that 1.0 compatibility can be a factor with some older proxies and similar services. I just wasn't sure how pervasive an issue it actually was.

</comment></comment></comment><comment><USER8> Django had a ticket for this, and it got closed as wontfix because 302 redirects are known to work fine:

<https://code.djangoproject.com/ticket/13277>

</comment><comment><USER9> The sample PHP code can be done with one call to the header function using the second parameter which allows you to set the http response code. Nice article though, learned something new today.

<comment><USER10> Minor point of correction: the second parameter is a bool asking whether or not to replace a previous similar header. The third parameter allows you to set the HTTP response code.

<http://php.net/manual/en/function.header.php>

<comment><USER9> True. Thanks for the correction.

</comment></comment></comment><comment><USER11> If it makes a difference, Python's urllib handles 301, 303, and 307 with the 302 handler. It also speaks 1.0

[http://hg.python.org/cpython/file/0752215f9f91/Lib/urllib.py...](http://hg.python.org/cpython/file/0752215f9f91/Lib/urllib.py#l661)

</comment><comment><USER12> Great article.

This is another reminder that I should really read the HTTP/1.1 spec someday.

<comment><USER6> Here's the link[1]; get at it.

[1] <http://tools.ietf.org/html/rfc2616>

</comment></comment><comment><USER13> [meta whinge] Cursor trails? _Really?_ In 2011? Is this some sort of GeoCities-esque retro fashion thing?

<comment><AUTHOR> Ha, hadn't thought of it that way, but I can see what you mean. I added it to play around with Canvas, while tying in with the half-tone dot motif in the header.

It could definitely stand to be a bit more subtle, though.

<comment><USER12> +1 for the trails. Have fun. Do what makes you happy on your own site!

</comment></comment></comment><comment><USER14> Wikipedia has a good schema explaining this : <http://en.wikipedia.org/wiki/Post/Redirect/Get>

</comment><comment><USER15> Can anybody confirm (or deny) that all browsers treat 303 correctly?</comment>


Crates.io incident report for 2020-02-20 - <AUTHOR> https://blog.rust-lang.org/inside-rust/2020/02/26/crates-io-incident-report.html <comment><USER2> This seems like a consequence of using thin wrappers of C libraries in rust, or comparably using a java API from scala, where the error handling methodology is significantly different.

In this case, the git2 crate ([https://docs.rs/git2/](https://docs.rs/git2/)) is a thin wrapping over libgit2 ([https://libgit2.org](https://libgit2.org)). To ensure a push went through properly you have to watch what happens inside a callback. The docs state the following:

 _Note that you 'll likely want to use RemoteCallbacks and set push_update_reference to test whether all the references were pushed successfully._

It looks like the only sensible way to utilize this is by closing over mutable state and then checking that imperatively, which is far from idiomatic (this is what they do in the patch). If you were pushing multiple refs it would be even worse!

Usually, when you use some rust code, it's pretty easy to tell what can fail simply by looking at the types - this is a huge win. Thin wrappers can subtly violate this intuition: sometimes errors are handled idiomatically and sometimes they aren't, leading to a sort of false sense of security.

The takeaway here is to use an abundance of caution when utilizing a thin wrapper and to understand just how thick it is, especially with errors.

<comment><USER3> > Thin wrappers can subtly violate this intuition: sometimes errors are > handled idiomatically and sometimes they aren't, leading to a sort of false > sense of security.

Unfortunately common. That said, I think the best route is usually a thin wrapper module, and then a module that attempts to map that to something more idiomatic. At least then there's a clear place where changes/additions in the underlying library should be handled. I've lived the problem of multiple modules that each try to deal with mapping the underlying library itself to an idiomatic interface. They're good for a while, but they always seem much more susceptible to drift in the underlying library causing problems over time.

<comment><USER4> Agreed! This is how I've always developed FFI code, for both Rust and Ruby. A thin wrapper that does little more than FFI and maybe mapping onto native memory-management techniques, and then a separate higher-level wrapper that provides as idiomatic an interface on top of the library as possible.

</comment></comment></comment><comment><USER5> > We should also strive to reduce the amount of time PRs sit in master without > being live.

Simplest solution at the scale and level of reliability that I've had experience with is to effectively say that master is what's live. In other words, a merge to master triggers a deploy under normal circumstances. It'll save you a lot of headaches. That plus one command/click deploy last known good build and feature flagging all major updates pretty much removes the whole deploy process as a significant failure risk.

<comment><USER6> Often times database changes are a complex multi-stage process. Since we're still a small team, we're able to have them merged as a single PR and the author deploys each commit as needed. A complicated CD process would just add more burden on our team at this size, and is really more useful when you have enough people contributing that those sort of complex deploys block other people's work

<comment><USER7> This is counter to my experience, I've worked with multiple small teams (6 people at most), that all have datastore integrations, and CI/CD pipelines generally make them faster.

> those sort of complex deploys block other people's work

I think this is the root cause of your concerns, the database migrations seem to always be backwards incompatible and therefore deployments and migrations need to be synced, blocking other changes.

Typically CI/CD pipelines are never blocked.

Making sure the database migration / code change is backwards compatible is minimally more tedious (i.e. multiple incremental changes across multiple days), but overall speeds up development.

<comment><USER8> I think you make some assumptions that are context-specific.

The decision to always be backwards compatible is just that, a decision. It comes with some really nice benefits around CI/CD, but also adds overhead for certain kinds of development, especially if data models are evolving rapidly. I've been in situations where we made the explicit decision not be backwards compatible due to business context that prioritized these evolutions.

Likewise, deploying to production continuously is not always an option. I've been in situations where customer relationships (contractual or otherwise) require that changes not be made continuously. Accidental outages or regressions are simply not an acceptable risk in some business contexts.

<comment><USER9> On the other hand, without continuous deployment, my experience is that a deployment to live _always_ goes wrong, meaning you have to budget an entire night for one deployment, and hope you'll fix all the issues before next morning.

<comment><USER8> As always, it depends.

I've seen staged releases work quite well at multiple companies and fail miserably at some others.

That said, continuous deployment is the right choice in many/most contexts. I'd just prefer that people see it as a choice instead of assuming that it's the only way that can work.

</comment></comment></comment></comment></comment></comment><comment><USER9> Am I the only one that thinks this postmortem is more professional and clear than many of the ones I see written by actual companies?

</comment><comment><USER10> > We should also strive to reduce the amount of time PRs sit in master without > being live.

I'd love to see an action item to address this. The CI/CD system should be pushing all changes in master to live immediately. Or does a CI/CD system need to be setup for this?

</comment><comment><USER11> not knowing anything about crates, this is a very amateurish and subpar postmortem; provides neither a simple, executive summary nor a technical deep- dive. problems arent annotated (or even clearly identified) and so cant be correlated to solutions or a POAM. everything is written in a very passive, non-action oriented voice. i do not leave this confident that issues have been identified, triaged, and queued for repair or mitigation.

> Deploying the change took way longer than expected

what does this mean? how much longer is "way longer"? what was your RTO goal, how did you fail to meet it, and how will you meet it in the future?

> We should also strive to reduce the amount of time PRs sit in master without > being live.

not a plan. everyones striving at whatever their doing. were you not striving before? how will your accomplish your goal of minimizing non-live time?

> It took 1 hour and 31 minutes from the start of the incident to the deploy > of the fix.

"deploy of the fix" is an unclear statement. does that mean when code was pushed, or when you verified your clients no longer had problems?

<comment><USER12> There is a clear timeline shown at the end which answers the last of these questions — it was 1 hour and 31 minutes until all ill effects of the bug were addressed and service was fully restored.

<comment><USER11> > There is a clear timeline shown at the end

Yes, i saw and it did not clarify my question to which you are responding which is obvious because...

> all ill effects of the bug were addressed and service was fully restored.

...this is not true. The timeline says a customer problem was submitted the next day, and additional action was required to ensure the "service was fully restored"</comment></comment></comment>