Ask HN: Who pays for remote worker travel to office? - <AUTHOR> If a remote job requires occasional visits to the home office (e.g. for 1 week every 2 months), does the employer or employee cover this travel/lodging cost? Thank you! <comment><USER2> Required visits, or even those that imply a visit is required, should compensate you for your travel. This should be done overtly through per diem and reimbursement. A company could try and tell you something like "we pay you more because you'll cover these costs" but that hurts you in regards to taxes.

We are a remote-first company.

Employees all converge on our home office for a company retreat once or twice each year. The company pays for reasonable transportation, lodging, and meal expenses e.g. you can't take first class on Christmas and expect to be reimbursed 100%.

Remote employees can also visit home base semi-regularly, e.g. quarterly, and the company will pay for transportation and lodging (I don't think we pay for meals on optional travel).

Any employee can also attend events and the company will foot the bill as long as it benefits the company or provides professional development e.g. Nodevember, Elixir Conf, and this includes speaking or simply attending.

<comment><AUTHOR> Thanks for the comprehensive answer, really helpful! Would you say there's a "norm" or are companies all over the map in terms of occasional office visit coverage for their remote employees?

</comment></comment><comment><USER3> At my last company where >50% of the employees were remote: yes. Although the office-visits were less often. Mostly we got together twice a year.

</comment><comment><USER4> It's always been employer paid for me.

<comment><AUTHOR> Thanks, good to know. And is this at a smaller company (e.g startup) or larger, established company?

<comment><USER4> Always larger, established company.

</comment></comment></comment><comment><USER5> employer for me.

</comment><comment><USER6> employer</comment>


Introducing Soylent 1.6 - <AUTHOR> http://blog.soylent.com/post/146357422357/introducing-soylent-16-powder/? <comment><USER2> I was going to try it, but adding a soy product to it (namely, a "soy protein isolate") wasn't a smart move.

</comment><comment><AUTHOR> of specific note:

>In addition to sensory and macronutrient improvements, Soylent 1.6 is the first powder iteration to use whole algal flour and high oleic algal oil - innovative ingredients that are yet another step toward sustainable food production.</comment>


Show HN: Webhook – run shell commands on incoming webhooks - <AUTHOR> https://github.com/adnanh/webhook <comment><USER2> Sounds cool but the fact that it co-opts the generic term as its project name is a bit off-putting. Does it really have to be named that? It comes off as trying to grab credit for something pioneered by others.

Still it seems really cool and useful... hope the author can be sensitive to the issues raised by the naming, but that aside, looking forward to playing with it.

</comment><comment><USER3> Like xinetd and cgi. I'm sure I'm forgetting a few more variations on the same theme.</comment>


Am I an academic? - <AUTHOR> http://www.zephoria.org/thoughts/archives/2009/08/25/am_i_an_academi.html

<comment><USER3> Let me summarize: The author works at MSR and is annoyed that he or she is seen as being inferior to "real" academics in the university system.

The author points out that he or she is as much of a scholar as any professor, but I'd argue this could (and should) be extended even to people who are not called researchers.

The general problem here concerning a group of people with special state- granted privileges is not new.

<comment><USER4> danah is a woman FWIW.

<comment><USER3> Thanks, that's what I thought but I wasn't 100% sure.

</comment></comment></comment><comment><USER5> As a completely biased view of someone who's no longer in either academia or industry, industrial research, at least in HCI, is a funny place. Sometimes, I get the feeling that the major academic research labs try too hard to be universities to their own detriment. There's a pretty steady flow between universities and research labs, moreso than between product groups and research labs. I feel like the industry researchers I meet seem more concerned about impressing their academic peers than their bosses.

It seems like research in other fields of computer science are tied more closely to practical applications: Systems, Compilers, Distributed Computation etc. but it's rare to find that kind of work in HCI.

</comment><comment><USER6> A defining characteristic of academia is publication. Everything an academic discovers should be revealed to the public as soon as possible, and genuine questions should be answered thoroughly. This ideal isn't 100% lived up to, but it is the socially acknowledged goal and practice generally comes pretty close.

This is where MSR is something different. Work there is published if and only if it is in Microsoft's interest to do so. Often a bare outline is published: enough to impress people but not enough for an outsider to duplicate the work. This isn't academia.

Xerox PARC and Bell Labs back in their respective days did function like academia.

<comment><USER7> _Work there is published if and only if it is in Microsoft's interest to do so._

Do you have any evidence for that claim?

 _Often a bare outline is published: enough to impress people but not enough for an outsider to duplicate the work. This isn't academia._

Actually, there are plenty of research papers that describe a system in some detail, but not nearly enough detail to allow an "outsider to duplicate the work". Both academics and industrial researchers sometimes accompany a research paper with a working prototype; in both cases, they often do not.

</comment></comment><comment><USER8> This article seems more compelling in its criticism of academia than in its defense of industry as a setting for pure research.

<comment><USER9> well noted by David Berry in the comments: """ >It is interesting to note that regardless of your claims to be in a 'better' or 'similar' position to an academic you continue to use academia as the anchor point of a frame of reference. I don't see any need to make that claim - the work in a corporate R & D environment is just different - it is based largely around performativity (here I am thinking of Lyotard).

A conceptual framework that I think you might find helpful..<elided for brevity>...

I personally think that there are important differences between universities and corporations linked to their respective knowledge domain and notion of contribution (e.g. to the public good vs private gain). To miss this is to collapse all of social life into the market. """

</comment></comment><comment><USER10> It must have been interesting to work for the biggest tech company's research division.

</comment><comment><USER10> The entire world is full of academic that have been sedated by failing school systems.

</comment><comment><USER11> > At other times, there's a hint of condescension, as though the question is > actually: "Couldn't make it in academia, eh? Stuck in industry, eh?"

Wow. Just wow.

If you're in academia, and you don't do original research, you've got to be an _amazing_ lecturer/teacher to make yourself worth a damn to society. Most of American education from middle school on is credentialing based on your ability to follow instructions carefully.

You could say it "shows how well you'll fit in at a job" if you're being charitable; you could call it "obedience school" if you're being less charitable.

Without fail, _all_ of the wealthiest people I know didn't graduate college and half of them didn't graduate high school. Engineering and programs that follow a curriculum similar to engineering do okay. But most of the rest is junk unless your goal is to be a moderately salaried reasonably secure employee. High school and college never have and can't teach you what you need to be perform on the highest levels.

Mark Twain said it pretty well: "I have never let my schooling interfere with my education."

<comment><USER11> Someone just voted this down anonymously - please, come out and make yourself known so we can have a discussion.

True story: A good Chinese-Canadian friend got a PhD and was offered a professor's post. Then he jumped onto a part time project before taking his professor's post that hit it big, found it enjoyable, and got quite wealthy from it. He lectured one year before quitting to go private, and laments the time and money he wasted in academia. Maybe 10 people on the planet read his thesis.

So, anonymous downvoter, are you a graduate student? Or a high school teacher or professor perhaps? I paid for all my school bills myself. I attended university full time while running a company full time and putting 20+ hours into a startup. And you know what? I estimate I'd be worth something like $100,000 - $250,000 more if I'd put the efforts into work and getting paid for it and had the tuition money for investments later. I had exactly three highly useful university classes: Business law, project management, microeconomics. Maybe 4 or 5 somewhat useful classes, and the rest were an epic waste of time and money. So, please come out and discuss with me, especially if I've struck a nerve. It's a nerve that should be struck, discussed, and worked out. Society will be better and the would-be academic will be wealthier and more productive.

Edit: It's funny watching the score of the parent go up and down. I'm hanging around, waiting for a reply so we can get a discussion going if anyone would like to. But people would not like to. They don't want to come and say, "You said this, which I sort of agree, and you said that, which I think is wrong, and here is why." No, they read the above and go, "OhmygoshnoIdon'tlikethat." Or something like that - I don't know exactly, because they don't weigh in and establish why they disagree.

I took time and wrote my take on American education and the fact that the wealthiest people I know are not college graduates. Will there be dispute? Discussion? A half dozen people or so have voted the comment up now, another half dozen have voted it down _without explaining why_. If this were a less civil environment, I would call those people cowards - not cowards for not confronting my views, but cowards for not confronting themselves.

I know education/academia is a big part of identity for a lot of people. Confront yourself if you are an academic, weigh in on this thread. Am I mistaken? I would love to learn more. Please share your perspective. Maybe I will disagree with you and discuss, maybe I will agree with you and learn and amend my own perspective. But I've written candidly, thoughtfully, with real observations I've had and some people have voted that down anonymously without explaining why. Please join the conversation, if you can confront these foreign ideas in your mind.

<comment><USER11> I will try one last time - I invite anyone who disagrees to share their disagreement. Was there not enough civility? I've shared my experiences on the American system, and my opinions, and I've taken time to write them and share anecdotes. Something like 6-8 people found them useful and voted up. Something like 7-9 people as of now found them upsetting/wrong/something and voted them down. The comment score has been swinging. This is apparently quite polarizing to people.

I'd really like to know why - agreement or disagreement, actually. I would truly, respectfully like to hear it. I've shared my experience and opinion, and would like to hear yours. Or your rationale for saying "this comment ought not to have been made and/or is completely wrong", which is what a vote against says.

Was it uninsightful? Misguided or inaccurate? Not enough politeness? Certainly, there was some thought and introspection before writing. I am at a loss to understand people's views on this - I will not speculate further, but instead, again, humbly, ask for a reply so that we may have a discussion, if you feel it worth your time to make known how you feel.

<comment><USER12> I imagine some of your upvotes are like mine: I don't really agree with what you said, but I still think it's a valid, civil comment. So I upvoted it from -1 to 0. I consider that a correction upvote.

Personally, I'm not interested in engaging you in discussion because I think you've painted a caricature of our educational system - recognizable features are there, but greatly exaggerated. Addressing all of these would take more time and effort than I want to invest in a discussion that I've seen and participated in before.

Also keep in mind that people don't owe you a response. Scolding people into talking to you is not a good tactic.

<comment><USER11> > Personally, I'm not interested in engaging you in discussion because I think > you've painted a caricature of our educational system - <USER2> > features are there, but greatly exaggerated.

Interesting - that's fair. I suppose a lot of people's experience differs too, so it's easy for people to talk past each other. I do know quite a lot of people, including a lot of self made people, and it's a subject I've discussed a lot. I've done teaching and training myself and I think our system is in disrepair, but perhaps I should be more balanced and less caricaturizing.

> Also keep in mind that people don't owe you a response.

Owe? Well, certainly not, though perhaps it's considerate for someone to explain why they downvoted a comment and it lets discussion get going. My own sense of decorum is I'll downvote noise ("right on! lol!" type posts) without explaining why, otherwise I won't unless there's already a good reply explaining why the disagreement.

> Scolding people into talking to you is not a good tactic.

I'm torn by whether to make a joke or a serious reply to this. I'll go the serious route: There's no scolding involved. I think people downvote identity- held issues without writing a disagreement, and I think it means people's worldviews don't evolve as quickly as they could, both mine and others'. I've had some fantastic disagreements with my comments in the past that led to very good discussion where I've learned a lot. For instance:

<http://news.ycombinator.com/item?id=723610>

So, I appreciate replies. Especially on an identity-level issue, yes, I'll absolutely ask again if I think people might be kneejerk voting based on identity. I want to learn on here, and want to be entertained, and I want others to learn, and I want others to be entertained. With discussion, we can do that. That's why I invite it. Thank you for your response.

<comment><USER13> > I'll go the serious route: There's no scolding involved.

Yes, there was.

You seem to think that downvotes are a bad thing. They're actually feedback that you don't get in most circumstances.

You seem to think that you're owed feedback that you like. You're wrong.</comment></comment></comment></comment></comment></comment>


Ask HN: Dress code for interview with Trendy/Hip Web Development company? - <AUTHOR>

I've always worked in a place where business casual (shirt and tie) was common, what should I wear on a job interview with a trendy/hip company where the dress code is casual. <comment><USER2> Jeans and a collared shirt. If it's a senior position throw a coat over it if it looks right, but don't throw the wrong coat on (yes, it's a total judgement call)

</comment><comment><USER3> A bohemian skirt, a headband, and some flats.

<comment><USER4> Sensible heels can also work, as can boots. If you're interviewing for a position that will involve working on physical infrastructure, make sure your interview shoes let you walk comfortably through a (very, very cold) server room.

</comment></comment><comment><USER5> My Standard: Jeans + A collared shirt. No Tie.

<comment><USER6> \+ satchel, macbook, mid length beard, turn up on a fixed-gear bicycle sipping a decaf skinny soy latte.

(Apparently it is hip)

</comment></comment><comment><USER7> I would cruise the local thrift stores for a flashy, patterned (possibly polyester) collared shirt and wear that with dark jeans and shiny dress shoes.

</comment><comment><USER8> Just because you chose a great username:

if you're wearing a tie, wear a coat.

</comment><comment><USER9> this should do it

[https://pbs.twimg.com/media/B74_WxACEAEzXli.jpg](https://pbs.twimg.com/media/B74_WxACEAEzXli.jpg)

</comment><comment><USER10> My advice is to just wear your casual clothes.</comment>


Ask HN: Why is WolframAlpha serving rendered text images instead of plain text? - <AUTHOR>

I am after some thoughts on why they would be doing this. I am a developer/designer and cannot think of any good reason for doing what can be done in CSS. Any ideas?<p>Sample : http://www4d.wolframalpha.com/Calculate/MSP/MSP6202195gdebi63ebi5b100001e27378a70be39cd?MSPStoreType=image/gif&s=46<p>* srry, for unclickable link <comment><USER2> I asked Stephen Wolfram about this and he explained that it was because sometimes the answers contain complex mathematical formulae that are difficult to render in HTML and that since he wanted a consistent display, his preferred solution was to just use images all the time.

<comment><USER3> Wikipedia occasionally has complex mathematical formulae & it seems to be working fine. This isn't a hard problem.

<comment><USER4> those formulae are rendered as images

<comment><USER5> ... whereas text is rendered as text, is his point. But I understand the original explanation. It's all Mathematica, so it makes sense to let Mathematica format it and then spit it out as images.

</comment></comment></comment></comment><comment><USER6> How strange... from their FAQ (under Web and other Practicalities - <http://www.wolframalpha.com/faqs.html>):

"Do I need images enabled in my browser to use Wolfram|Alpha?

Yes. All its output content is rendered as images, for consistency."

Perhaps they didn't want to make sure the data was styled & displayed well in all browsers (ahem... ie6)?

clickable: [http://www4d.wolframalpha.com/Calculate/MSP/MSP6202195gdebi6...](http://www4d.wolframalpha.com/Calculate/MSP/MSP6202195gdebi63ebi5b100001e27378a70be39cd?MSPStoreType=image/gif&s=46)

<comment><USER7> While consistency is a good thing, it comes at a relatively high price in this case. Many blocks could be rendered just fine using only HTML and I'd be a much happier user if I could copy text from the search results.

<comment><USER6> Indeed. FYI, if you click on any text in the search results, you're given a text field with its text within it. It's a few extra clicks, unfortunately, but at least they considered that.

<comment><USER7> Did they just add that now? I don't remember seeing the hand cursor over text fields a couple of hours ago.

<comment><USER8> It was there yesterday

</comment></comment></comment></comment></comment><comment><USER9> Perhaps they don't want other search engines 'learning' the questions (via phrases hyperlinked to wolfram) and displaying the answers as summary text?

<comment><USER10> Again, the text of each image can be found in the image element's alt attribute. Since WA already uses images to make formulas easier to print out, I guess Wolfram simply wanted to reuse the code.

<comment><USER9> Turns out, Google is indexing the questions:

[http://www.google.com/search?q=site:wolframalpha.com+inurl:i...](http://www.google.com/search?q=site:wolframalpha.com+inurl:input&hl=en&filter=0&cad=h)

The "meaning of life" and "the ultimate answer" questions feature highly. But even more people seem curious about "unemployment rate in USA".

The answers are not in Google's summary.

</comment></comment></comment><comment><USER11> I don't know for sure - but my guess is mathematica outputs images?

<comment><USER9> This guess makes the most sense: to correctly display formulae. An example from another thread:

<http://imgur.com/gcymm.png>

</comment></comment><comment><USER12> I'd assume that not everything that WA puts out will be text or tables. They've got graphs, complex mathematical formulas, general purpose image manipulation and who knows what else.

It may have made sense to "unify" the rendering engine. This makes the simple case you point out look silly of course.

</comment><comment><USER13> I don't know if I buy the consistency answer. There's ways to do that (even with complicated formula), but it is an interesting way to avoid x-browser CSS issues.

My own hunch is they did it to avoid scraping/botting. Hopefully they switch to text at some point in the future.

<comment><USER4> > My own hunch is they did it to avoid scraping/botting

the text is in the alt attribute of the image. easily scraped.

</comment></comment><comment><USER14> Pretty pathetic as it breaks the site for people with less than perfect vision. I mean they obviously take advantage of machine readable data to populate their database, pretty lame to not spit it back out. Not to mention a huge server overhead--this was a calculated decision.

<comment><USER10> Don't most screen readers read out the alt text of an image? (Yes, the hint here is to check the alt text of the image).

<comment><USER14> There are tons of people who simply increase the text size in their browser. Can't do that with WA. They aren't blind, just older.

<comment><USER10> Most modern browsers can also increase the size of the image with the text.

</comment></comment></comment></comment><comment><USER15> We actually do the same for math equations in LearnHub lessons (via texhub.com). Images are pretty much the only way to present complex math equations to a wide audience.

MathML would be a much better solution only if it were natively supported in IE.

<comment><USER16> Our free MathPlayer plugin for IE enables it to display MathML. Except for having to be installed, it is as "native" as it can get. It even works with screen readers to speak the math for those that need that. See <http://www.dessci.com/mathplayer>.

<comment><USER15> Thanks Paul. I'm aware of Math Player, but I don't like the tradeoff of forcing our users to install a plugin for superior display quality/customizability vs. "it just works". The nature of our user base just doesn't make it feasible IMO.

I would be more willing to take that tradeoff in a LCMS environment though.

</comment></comment></comment><comment><USER17> The special font may not be on every user's computer. Which font is that?

</comment><comment> old-gregg To make you pay for the API.

<comment><AUTHOR> its not like they hide the text that much though;

jsonArray.popups.i_0100_1 = {"stringified": "Brisbane,Queensland","mInput": "","mOutput": "", "popLinks": {"Brisbane, Queensland":"Brisbane"} };

<comment><USER7> Each image tag also has its source data embedded in its alt attribute.</comment></comment></comment>


5 Reasons To Quit Your Day Job And Become An Entrepreneur - <AUTHOR> http://christianwylonis.com/post/83715539133/5-reasons-to-quit-your-day-job-and-become-an

<comment><USER2> None of those 5 reasons are attractive to me:

1.- Do something you're passionate about. I'm already doing something I'm passionated about, I'm in charge of a producton system that Works 24/7 the 365 days of the year and thousands of transactions daily, I created it alone from the scratch, nothing can't apassionate me more right now.

2\. Learn something new every day. That's not exclusive of an entrepreneur, I learn new stuff avery day in my day to day work, and since I'm the architech I decide what new stuff goes in.

3\. Get a daily dose of adrenaline. Believe me, keep such vital system working flawless daily, where a failure can cost thousands per minute gives me anough adrenaline.

4\. Work with people you like. I chose the people I work with, so, no problem there eather.

5\. Prioritize your own work, Same, as an architech I decide priorities, so no problem there.

There are better ways to promote entrepreneurnism, this article is not good at doing it.

<comment><AUTHOR> hey adrian. the post was just meant to reflect what i like about entrepreneurship. if you get the same feeling in your current job then that's awesome. there are many other reasons for people becoming entrepreneurs - these are just mine.

<comment><USER2> Let me tell you what could make entrepreneurship atrractive to me:

1.- Independence from a boss, technically customers bcome your your new boss, but is not the same. 2.- Decide how much income I want, it would depend on me. 3.- Decide from where I want to work. 4.- Decide te kind of relations you want, in a vertical market you don't get much of that. 3.-

</comment></comment></comment><comment><USER3> I have found that most people don't have the discipline to own their own business. It's not only the ups and downs (not having a guaranteed income..like a job), but being able to wake up in the morning and work all day without a boss telling you what to do.

<comment><AUTHOR> I agree with you. If you aren't self motivated then entrepreneurship is not for you.. Some day I'll write a blog post about common personality traits of effective entrepreneurs.</comment></comment>


James Patterson Inc: A look at the author who outsells King & Grisham - <AUTHOR> http://www.nytimes.com/2010/01/24/magazine/24patterson-t.html

<comment><USER2> Robert Kiyosaki (rich dad poor dad) has a story where he's interviewed about his book by journalist who's an excellent writer, and having trouble breaking in. He advises her to take a copy writing course, to help her sell her work. She objects that she became took journalism so she wouldn't have to be a saleswoman. He points to his book jacket's blurb which says "best selling". "It doesn't say best writing," he explains. "You are an excellent writer; I'm terrible at writing, but good at selling." "It's not fair," she sulks.

niche marketing: _Instead of simply going to the biggest book-buying markets, he focused his early tours and advertising efforts on cities where his books were selling best: like a politician aspiring to higher office, he was shoring up his base._

pragmatism: _I'm less interested in sentences now and more interested in stories._

kill your darlings: _"I don't believe in showing off," Patterson says of his writing. "Showing off can get in the way of a good story."_ (Samuel Johnson: Read over your compositions, and wherever you meet with a passage which you think is particularly fine, strike it out.)

 _a marketing genius who has cynically maneuvered his way to best-sellerdom by writing remedial novels that pander to the public's basest instincts._ Sounds pretty accurate.

If writing is intended to match the human story-processing system, analogously to how image compression attempts to match human visual system, then the popularity of writing (aside from sales due to marketing) is a measure of its match to what an ideal story really _is_ (i.e. how humans perceive stories). In this view, a story is not an end in itself, but an attempt to communicate; in contrast, "literature" has become its own subject. It is solipsistic. Therefore, it is _possible_ that this guy's writing will become studied in the future (as his editor said of Dickens), because it is based on reality outside of itself.

 _Just remember that when you go over the mountain to work in the morning, you've got to be singing_ Yeah, I agree with the article's followup on this, that it's not clear that he loves what he does for its own sake, or because he's successful at it. I think he must deeply enjoy it in some sense, because he has tremendous energy for it. Or perhaps he enjoys it _because_ he gives it energy and meaning? It reminds me of the conflicting advice posted on HN, about "do what you love" vs. "love what you do". The latter is certainly essential, for even in loving what you do, _some_ bits of it you won't love and you need to do them anyway. And, as apes, we enjoy dominant status for its own sake (aka "success"), regardless of how we got there. I think enjoying how we get there does matter; but it doesn't have to be entirely for its own sake.

I love these long nyt articles.

<comment><USER3> _I love these long nyt articles._

Me too, but if everyone followed Mr Kiyosaki's (sincere and wise) advice, then we wouldn't get them, _viz._ Seth Godin's capsule-blogging approach of 'one good idea presented in 3 quick paragraphs'.

</comment></comment><comment><USER4> I found that horrifying. All I could think of while reading the article was what if this model takes off? Publishing houses put books together by hiring one meta-author to write an outline for a book, then bid out the actual writing to junior authors. The publishing houses would own the rights to the characters, series, and future books. When a particular series takes off, their only expense is hiring junior authors to "fill in the blanks" on future novels. Sounds immensely more profitable for publishing houses for the current model. Why would a publishing house develop individual authors if the new meta model is so much more profitable?

As interesting as I found the business model, if the end product is anything like Patterson's novels, I fear for the book industry. Would Harry Potter have been written by a down-on-her-luck JK Rowling if she could have gotten work as a ghost author for a publishing house? I could see this being a good thing, but I like my books and the direction scares me.

<comment><USER5> The author doesn't even need to be alive for that:

[http://en.wikipedia.org/wiki/Sidney_Sheldon%27s_Mistress_of_...](http://en.wikipedia.org/wiki/Sidney_Sheldon%27s_Mistress_of_the_Game)

<comment><USER6> Or exist, in the case of the Stratemeyer Syndicate.

</comment></comment></comment><comment><USER7> Here's an ad by Patterson:

<http://www.infomarketingblog.com/write/>

And here's an interview with someone who responded to that ad, worked at JWT, and _also_ decided to start writing novels, instead:

<http://www.infomarketingblog.com/mystery-writer-interview/>

<comment><USER2> That interview showed me that "Die Hard" resurrected the dead metaphor of "diehard". This is a powerful way to capture attention. I might also watch "Lethal Weapon", for it's 3/3min dialog/action structure (and to observe how engaged/entertained I am).

</comment></comment><comment><USER8> Very interesting that he didn't become a full-time author until 20 years after his book was published. I'm always interested in how successful people became that way.

Mr. Patterson was born in 1947, published his first book at 29 years old (1976) and didn't become a full time writer until 49 years old (1996). He's been writing an average of 2 novels per year since then (!) and is getting more prolific with age. Considering that some people never get around to "finishing their novel", I find these data points amazing.

What are you doing today that will be news worthy 20 years from now?

<comment><USER9> > What are you doing today that will be news worthy 20 years from now?

Writing a novel. :)

Seriously though; for every successful writer there are 10's of failed ones. Most get "found" some time after they are first published (fad's like Harry Potter et al tend to be exceptions).

If you have a reasonable amount of writing talent and the spare time to put it down into a book then it's worth doing as a bet against being noticed at some time in the future.

<comment><USER10> > Writing a novel. :)

Ditto. I've worked in writing, and I've been trying to hone my writing skills with novels. Consistency is a key issue in writing. My goal in life is to publish a novel, not a short story so I never practised short stories. I'm now looking to sell some short stories to qualify for SFWA while I'm working on the book I hope is my debut.

I'm 21 and I've worked in writing since ~16. I fail to see how I can become a successful author unless I try to get myself out there. Perhaps my work will click and I'll hit the big time, however that's an aim for later in the game.

<comment><USER9> Im 23 and mine has been on/off writing since about 18. Mostly I've written short ideas/chapters and it's only recently they became a cohesive plot :)

Got some ideas for short stories - but writing them has always eluded me!

</comment></comment></comment></comment><comment><USER11> Good copywriting advice:

 _"I have a saying," Patterson told me. "If you want to write for yourself, get a diary. If you want to write for a few friends, get a blog. But if you want to write for a lot of people, think about them a little bit. What do they like? What are their needs? A lot of people in this country go through their days numb. They need to be entertained. They need to_ feel _something."_

<comment><USER12> "A lot of people in this country go through their days numb."

Man, we rock at _treating the symptom_. I really admire anyone who can help people avoid that numb feeling to begin with.

<comment><USER11> Like who? Are there good examples of people who have done this on a mass scale AND done more than offer empty hope and unfulfilled promises to do so (politicians)?

<comment><USER13> It depends on what problem you are talking about. Something as general as 'numbness', has a multitude of specific underlying causes; to treat those causes you need specific solutions. If you believe that psychotherapy can be effective in treating underlying causes, as I do, than individuals who have helped develop different specific psychotherapy methods have treated (directly & indirectly) causes on a mass scale.

</comment></comment></comment></comment><comment><USER2> Single Page: [http://www.nytimes.com/2010/01/24/magazine/24patterson-t.htm...](http://www.nytimes.com/2010/01/24/magazine/24patterson-t.html?pagewanted=all)

<comment><USER14> I know this is not the place for this, but I really wish submitters would start submitting the one-page articles as the standard.

<comment><AUTHOR> Yeah, sorry, I realized my mistake too late. I was going to delete it and resubmit but it already had a few points.

Being able to edit a URL for 15 minutes after submitting would probably help.

<comment><USER2> You can edit it (I just tested it - don't know how long it's editable though).

<comment><AUTHOR> When I edit I can only update the title, not the URL.

(Which makes sense, b/c someone could submit something that gets voted to the frontpage and then change it to a spam link, etc. But sometimes it's inconvenient.)

<comment><USER2> Sorry, you're right of course.

</comment></comment></comment></comment></comment></comment><comment><USER15> Terrible writer, but interesting and successful business model, including co- writing with many authors.

<comment><USER16> His skill when it comes to writing may not actually be that relevant. These days, people consume stories - and entertainment in general - in lots of different forms: novels, newspaper articles, blog posts, tv series, video games, forum threads and even tweets. Patterson may not be a master artisan when it comes to prose, but he's clearly dedicated to the goal of giving people interesting stories in an accessible format. Perhaps the use of co- authors is his way of addressing deficiencies in his own abilities?

at least when it comes to video games, one's ability to write prose is not a good indicator of an ability to tell interesting stories. I've personally seen talented writers work hard to deliver an ultimately boring game story while non-writers with a knack for plotting and creative thinking can come out of left field with a game like Silent Hill 2 (widely recognized for a gripping and unorthodox plot).

<comment><USER9> Agreed. One of my current fav authors - Raymond Feist - isn't a particularly fine writer - but I really like his stories (especially the earlier ones) and some of the characters (particularly the quirky ones) are utterly engaging.

At the end of the day a lot of what he writes is a bit awkward (and even weak at times) but you dont often notice.

<comment><USER17> On a similar token, a lot of "high literature" looks terrible when you consider the story being told. My latest example is Virginia Woolf's "The Wave". While it is a beautiful book, the story couldn't be more boring.

</comment></comment></comment></comment><comment><USER18> That page has two giant animated Google Search ads and one shows someone typing "impress a french girl." Does Google have a macho sexually repressed Asperger's marketing team too? I think I dislike Google a little more today because of that ad.

Google is running scared in oblong circles and they don't know what to do about it.</comment>


OpenID. Do any of you use it or a service similar? Recommendations? - <AUTHOR>

<comment><USER2> Started with OpenID supported accounts only as a quickstart on my site. Removed it after a while and replaced it by classic email/password based accounts. Observed issues with broken authentication and people were a bit confused with already being logged in because they were already in their gmail...

Conversions declined however due to the required sign up then which was not necessary before.

<comment><USER3> So even with the (supposed) confusion over what OpenID is, you still had a conversion advantage. Interesting.

Interesting still that with that advantage you chose to go back to tradition, and shed the support issues.

<comment><USER2> The feedback regarding came from known users with technical background. I chose clarity and reliability (could not login myself once with my own OpenID) for my long-term users over higher sign-up conversions (OpenID was 2 clicks for login and granting access, now 2 clicks with 4 validated input fields which increases the barrier).

</comment></comment></comment><comment><USER4> i have an open id account, i used it for a few years, now i only use it for stackoverflow family sites. i use myopenid.com. i have no complaints with their service. i really dont see much point to open id after having used it. it doesn't solve any problem for me.

<comment><USER5> +1. It solves the problem of having to sign up for facebook or some other service

<comment><USER3> I had a myopenid account. Closed it when my online surface changed and I didn't want to bother converting or moving it. There just aren't enough consumers to make me interested anymore; I used to hope that it would catch on, now it's clear that it won't.

I think I might have used my google openid to ask a question or two on SO.

I really dislike when sites only allow you to log in with a special id obtained from only FB, or only Twitter, or only with OpenID. Sure, offer all those things, but let me just sign up normally if that's what I want. Those things should be extra conveniences, not _the way_.

EDIT: and what if Google kills my account? I have to be a new person on SO.</comment></comment></comment>


Where the 'No Ending a Sentence with a Preposition' Rule Comes From - <AUTHOR> https://www.atlasobscura.com/articles/why-cant-you-end-a-sentence-with-a-preposition <comment><USER2> Interesting read, I have wondered where this came from. However, from my understanding this has been considered an unnecessary, antiquated practice for quite some time [1].

[https://en.oxforddictionaries.com/grammar/ending- sentences-w...](https://en.oxforddictionaries.com/grammar/ending-sentences- with-prepositions)</comment>


Two Futures Can Explain Time's Mysterious Past - <AUTHOR> http://www.scientificamerican.com/article/two-futures-can-explain-time-s-mysterious-past/

<comment><USER2> > radioactive atoms decay rather than reassemble

Under appropriate conditions of temperature they can "reassemble".

> Omelets don't transform back to unbroken eggs

Well, mud can settle out of muddy water instead of having the water dissolve the mud.

And in principle if stir coffee long enough, then the cream will return as close as we please to where it was when we first poured the cream into the coffee -- this is Poincare mathematics based on ergodic theory.

For the coffee and cream, in simple terms, think of the positions of the cream particles in the coffee. After some stirring, first-cut, all of the possible positions are equally likely. But a huge fraction of the positions look essentially the same and, in total, are very common. There are many fewer positions that look distinctive. So, if we start with the cream in a distinctive position, say, just after pouring it in and stir, then soon we will likely have one of the positions that look the same, that is, _mixed in_. Net, time does not have a direction or _arrow_ here.</comment>


Mu: A minimal hobbyist computing stack - <AUTHOR> http://akkartik.name/post/mu-2019-1 <comment><USER3> > I'd like Mu to be a stack a single person can hold in their head all at > once, and modify in radical ways.

This reminds me of Alan Kay's STEPS project - an attempt to reinvent personal computer in 20K lines of code [0].

Always happy to see efforts in this direction.

[0] [http://www.vpri.org/pdf/tr2011004_steps11.pdf](http://www.vpri.org/pdf/tr2011004_steps11.pdf)

</comment><comment><USER4> This dudes stuff has been posted here recently and it's worth it go read what he's said about his work.

[https://news.ycombinator.com/item?id=21242190](https://news.ycombinator.com/item?id=21242190)

<comment><USER5> Announcement link from that thread: [https://lists.tildeverse.org/hyperkitty/list/tildeclub@lists...](https://email@example.com/message/Z7EBQ2ZCBIQ7YMA7Q3RUJWWB4LBIFS3M)

</comment></comment><comment><USER6> Interesting project.

So far the only desktop OS + compiler I know that can be reasonably understood in its entirety is [http://www.projectoberon.com](http://www.projectoberon.com)

<comment><USER7> Some interesting parallels to choices made in Pascal in the second level language, too.

I'm not convinced that this approach is the best - the first level language is a bit like "literal programming" machine code (not assembler) - but I think a level of simple substitution would help a bit (think m4 as an assembler) - allowing at least mnemonics. The insitence on numbers seem somewhat arbitrary as they still need to be translated from strings (letter sequences) to actual integers[e] - I don't think a table/variable look up would be too onerous.

On the whole this feels a bit more convoluted than building a Forth as level one - but no matter what I applaud the effort.

[e] assuming program source code is text, not binary?

If it's binary I suppose "filtering out" comments might be an approach as opposed to "translating" the source.

<comment><USER8> An interesting thought experiment that I've pondered is what I would do if I was given a system that I had to program without even an assembler.

I've programmed on systems where the only access was through direct memory access to the machines memory, and other systems that had a boot loading initiated by a button that started a paper tape reader. I've also used minicomputers that had to have instructions manually keyed in on binary panel switches directly into memory to start a card reader where the cards contained machine instructions to bootstrap the rest of the boot loader off of the remaining cards.

In every case though, somewhere I had an assembler to write the code I needed. What would I do if I didn't even have an assembler? I could write one, but I don't want to do it in machine code. Now days, the easy way would be to simply construct a cross-compiler or cross-assembler that was written in say python on a different machine.

One alternative is to build a hand assembled, really simple macro system. m4[0] or Calvin Mooers' TRAC[1] are possible prototypes, but these flexible macro systems would be difficult to hand compiler into machine code so one might get by with a really basic, more limited macro system. Then each machine instruction could be encoded as a macro and then a primitive assembler could be written as macros.

However, real assemblers do more work, they generally take two passes because they allow symbols to be used instead of literal addresses. So the next step would be to program a real assembler using the primitive assembly language.

After that I suppose a compiler for a simple language like Pascal, basic Lisp, or Per Brinch Hansen's Edison[2] language could be written in assembly language.

Per Brinch Hansen provides the basic directions for construction a very simple operating system from scratch, including the assembler and compiler in the book _Programming a Personal Computer_ [3].

[0] [https://www.gnu.org/software/m4/](https://www.gnu.org/software/m4/)

[1] [https://dl.acm.org/citation.cfm?id=365270](https://dl.acm.org/citation.cfm?id=365270)

[2] [http://brinch-hansen.net/papers/1981b.pdf](http://brinch- hansen.net/papers/1981b.pdf)

[3] [https://www.amazon.com/Programming-personal-computer- Brinch-...](https://www.amazon.com/Programming-personal-computer-Brinch- Hansen/dp/0137302673)

<comment><USER7> I seem to recall an old text file on programming with just debug.exe - <USER2> thought it was an early phrack magazine article - but I can't seem to find it now. The idea was similar to 5a here:

[http://phrack.org/issues/62/7.html](http://phrack.org/issues/62/7.html)

But the text I'm thinking of was more a how-to on bootstrapping development under win 3.11 if you had no outside resorces, and just a plain install with no other development tools.

</comment></comment></comment></comment><comment><USER9> Author here; I just found this thread. Feel free to ask me anything.

<comment><USER10> What's old is new again.

Your thoughts on the benefits of language slightly higher level than assembler are interesting. Others have trod this path before.

Bliss32 was the systems language for vax/vms back in the 1980s through 2000s. Most of vms was written in it. It was heavily influenced by PL/360 from the days when IBM 360 or 370 mainframes were mostly programmed in assembler.

Both languages emitted very predictable assembler from their higher level constructs. They had no optimizations. But their objectives seemed to be focused on readability and predictable output, like your system.

The source code for 99% of vms was published on microfiche and distributed with the binary tapes. Worth finding a copy and the accompanying text on vms internals and data structures. An excellent intro to nonTorvalds operating system architecture.

<comment><USER9> Fascinating. Glad to have this on my radar.

</comment></comment></comment><comment><USER11> This reminds me very much of 1970s Unix. Unix was also an research exercise into OS and userland minimalism and a new, streamlined language (yes, C) that created a new niche in the "like asm but better" space.

In other words, it had nothing in common with today's Linux. (-:

<comment><USER9> Indeed, much of Mu's design was motivated by the question, "if we imitated the codesign of OS and language that led to Unix and C, given what we know now, what would we create?" This question doesn't seem to be often asked in recent decades, with languages and OSs evolving separately.

</comment></comment><comment><USER6> akkartik, I see the following 3 syntaxes for 'MOV ESP, EBP':

        89/<-                       ebp  4/r32/esp  # copy esp to ebp
        89/<-                5/rm32/ebp  4/r32/esp  # copy esp to ebp
        89/<-  3/mod/direct  5/rm32/ebp  4/r32/esp  # copy esp to ebp

Only the last one contains all information needed to encode the instruction. And the first one is used in the factorial example. Can you explain why all the 3 syntaxes are in use?

<comment><USER9> Yeah, the last one is the 'ground truth' that both translators understand. sigils.subx adds some syntax sugar so you can say

        89/<- %ebp 4/r32/esp

By my self-imposed rules I can't use this sugar until I build it, so there's little code that uses it at the moment. But any future Subx code will use it, such as the implementation of Level 2. You can also see it used in calls.subx, which is another later layer of syntax sugar.

Could you point me at where you see your first two versions?

<comment><USER6> In [http://akkartik.name/post/mu-2019-1](http://akkartik.name/post/mu-2019-1) if you search for the pattern '/89' you'll find the first two versions.

The 3rd one is here: [https://github.com/akkartik/mu/blob/master/apps/factorial.su...](https://github.com/akkartik/mu/blob/master/apps/factorial.subx#L23)

Can you explain in a sentence what rules are used to complete the encoding for the variant:

> 89/<\- %ebp 4/r32/esp

<comment><USER9> Ah, I see. Yes, I mentioned in the post that I was dropping some magic numbers. Mu is intended to be read in a text editor, and I didn't want to scare people too much while reading the post in a browser. Slightly evil, I know.

The concrete rules are illustrated at [https://github.com/akkartik/mu/blob/469a1a9ace9b290658beb9d0...](https://github.com/akkartik/mu/blob/469a1a9ace9b290658beb9d0799b58ce3bc2a4b4/apps/sigils.subx#L9). In this case `%<reg>` always translates to `3/mod <reg-code>/rm32`.

</comment></comment></comment></comment><comment><USER12> Note to self (as the author of the "Mu" editor, [https://codewith.mu/](https://codewith.mu/)) - two letter project names are just asking for name collisions. ;-)

<comment><USER13> And also [https://www.djcbsoftware.nl/code/mu/mu4e.html](https://www.djcbsoftware.nl/code/mu/mu4e.html) the mail client for emacs :)

</comment></comment><comment><USER14> I find this really inspiring! I've got a similar hobby project (that I've been neglecting recently...) but with some different design choices. I don't want to hijack the thread but I thought it might be interesting to compare and contrast.

Instead of targeting x86 it uses Prof. Wirth's RISC CPU for Project Oberon. This is a really simple chip, there is a model function for it written in Oberon that is less than a page of code. It's also very well documented, and emulators exist in Java, C, Python, and Javascript, and there is a VHDL (or is it Verilog?) description which people have used to make FPGA-based workstations.

For the basis notation I'm using a dialect of Joy, an extremely simple and elegant purely functional, stack-based, concatinative language. It's like a combination of the best parts of Forth and Lisp. [https://en.wikipedia.org/wiki/Joy_(programming_language)](https://en.wikipedia.org/wiki/Joy_\(programming_language\))

(I'm pretty sure there's no simpler _useful_ language than Joy.)

To bridge Joy to the CPU I took the high road: a compiler written in Prolog. It would be possible to use Forth lore to bootstrap from the metal up, but I was gobsmacked by David Warren's "Logic Programming and Compiler Writing" ( [https://news.ycombinator.com/item?id=17674859](https://news.ycombinator.com/item?id=17674859) ) and have spent the last year "moulting" from Python to Prolog programmer.

Anyhow, the compiler so far is concise but the model it implements for Joy on the CPU is still very crude. Between life, work, and learning more Prolog I haven't had much time to improve it.

The thing is, Prolog is a very simple language, the compiler is very simple and small, and Joy is also very very simple and small (especially if it's implemented _in_ Prolog), and the underlying CPU is very simple and small. The tricky bit would be to, say, implement a Prolog interpreter in Joy. But if you do that you've closed the loop for self-hosting: Prolog-in-Joy, running on Joy-on-the-metal, implementing a compiler for Joy to the metal, bootstrapped through Prolog on the host.

(It would be simple to convert the Joy compiler in Prolog to a Joy compiler in Joy using the Prolog interpreter in Joy and partial evaluation. FWIW.)

For the OS I'm going to build a simple clone of OberonOS but using Joy rather than Oberon language. I made a model of this OS in Python and Tkinter to guide the reimplementation in Joy. This will also serve as a stress test for Joy: _can_ you implement a whole (albeit simple) "OS" in a purely functional, stack-based, concatinative language? Maybe it sucks?

To sum up, a simple text-based UI/OS inspired by and loosely imitating OberonOS, targeting a simple but capable 32-bit RISC chip, with Joy as the shell and glue language and Prolog as the under-the-hood powerhouse systems language. And the whole thing should fit in under a hundred pages of code.

<comment><USER9> This sounds really interesting. I'm very happy you shared it. I'd love to see it when you publish it. Based on your description it seems like a lot of code, so I'm curious to see how tight we can keep the dependency chain.

<comment><USER14> Cheers! The project is here: [http://joypy.osdn.io/](http://joypy.osdn.io/) FWIW.

The Prolog code is under the ./thun subdir. I apologize for the state of the repo & docs. I need to go through and update everything.

If you look at the Python code the vast majority of it is the type inference module and the library of functions and combinators. The parser, main loop, and most of the library are trivial. Most of the joy.utils.types module is a crude re-implementation of a subset of Prolog and can be discarded. The Prolog version of Joy is even shorter than the Python version.

The Joy compiler (which is only about half done) is really tight and simple (Joy doesn't use variable so no need for a symbol table; Joy doesn't use subroutines so no need for a call stack) and the last half of the functionality won't require double the code.

Meta-programming in both Joy and Prolog is really easy and powerful, and Joy in particular lends itself to a kind of Huffman encoding of your graph (Joy code forms a simple DAG.)

\- - - -

I want to repeat, Mu is really inspiring. I'm looking forward to watching your progress. :-)</comment></comment></comment>


Easy, fast and neat way to build kernel on Debian and Debian based systems - <AUTHOR> https://sites.google.com/site/jestinjoy/blog/debian-kernel-compilation

<comment><USER2> What are the benefits of make-kpkg over the kernel's own 'deb-pkg' make target?

<comment><AUTHOR> That is a new information to me :). Thanks

<comment><USER2> No worries :) It was a genuine question though; I've done some brief googling in the past but didn't find anything authoritative.</comment></comment></comment>


Chan Zuckerberg Initiative announcement [video] - <AUTHOR> https://www.facebook.com/zuck/videos/vb.4/10103120865133051/ <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=12551863](https://news.ycombinator.com/item?id=12551863).

</comment><comment><USER3> "You must log in first."

Sigh.

Edit: The reason I mention this is the disappointing incongruity of announcing a project for the global, public good hidden behind a self-serving walled- garden approach to media.

Facebook Zero is a more meaningful example of this, of course.

I realize this post alone isn't a big deal, but it's part of a fabric of disconnect. One where you get the feeling that the goal of some is to ensure that FB effectively _is_ "the world." And it's a damn shame, because from everything I hear about the people is that isn't actually the goal. But perception matters.

<comment> squeaky-clean You'll only see this message from mobile. It works fine for me accessing on desktop without being logged in.

<comment><USER4> That's even worse.</comment></comment></comment>


How Dropbox hacks your mac - <AUTHOR> http://hn.premii.com/#/article/12457067 <comment><USER2> Please use the direct link to the article instead: [http://applehelpwriter.com/2016/07/28/revealing-dropboxs- dir...](http://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little- security-hack/)

This is also a dupe: [https://news.ycombinator.com/item?id=12457067](https://news.ycombinator.com/item?id=12457067)

Confusing and unnecessary.

<comment><AUTHOR> oh... didn't realised that. Hid it

</comment></comment><comment><USER3> What features does Dropbox actually use that requires it to have this level of access? The author didn't go into detail.

</comment><comment><USER4> This is a link to the premii HN client pointing to a HN thread about the original article.</comment>


Amazon: Behind the Smiles - <AUTHOR> https://www.revealnews.org/episodes/amazon-behind-the-smiles/ <comment><USER2> sounds like a really interesting investigation</comment>


Ask HN: just started a company, which bank should I go with - <AUTHOR>

So I just recently incorporated as an LLC and I'm looking into setting up a business account. What's a good bank to go with and why, especially taking into consideration the current economic conditions? I'm located in the valley. <comment><USER2> Doesn't matter. All depositors protected up to $100k (investment accounts are usually insured for much more) by the FDIC...as long as you think the US is solvent (questionable, at this point, but we're all working with USD, so doesn't matter where the dollars are...if they become worthless they'll be worthless no matter what).

Choose a bank that's got a branch near you...you'll be there more often than in the past. National, or at least in the major cities you can imagine finding yourself in. We've got an account with WaMu, who just merged into JP Morgen (which kinda sucks, as banks go) due to insolvency. I don't plan to move to another bank until the policies and fees change to the JP Morgan Chase standard (which they will), and folks start showing up in the uniforms and trying to sell me something every time I walk in the door.

</comment><comment><USER3> At this point, stick your money under your mattress...</comment>


Ask HN: Would you pay for honeypot logs? - <AUTHOR>

Howdy,
I'm considering launching a subscription service that helps you strengthen your network's security by providing logs of real-world attacks, gathered from a network of honeypots. The logs would be searchable by protocol, vulnerability, and  perhaps more, enabling your IT staff to develop IDS and firewall rulesets from in-the-wild attacks.
Would you pay for this? How much?
I'd also love to hear from anyone who thinks this isn't feasible.
Thanks in advance,<AUTHOR> <comment><USER3> I work within the security operations team of a major global service company, working with private businesses, local, regional and civil government.

Our main pain point is never information - we can get that in spades. Our pet Unix engineer is constantly finding interesting new feeds for us, and I spend a notable amount of time each week keeping up to date with latest developments and any new information sources that crop up.

The challenge is translating this information into sound, actionable, intelligence that measurably provides value to our business and customers. Raw logs of random honeypots are of no interest to us, and if we wanted such a thing we could roll our own relatively easily.

Honeypots based outside of our organization would only be of interest in a few limited scenarios: Firstly, when a major new vulnerability lands it would be invaluable to know right from the start what sort of attacks are being seen in the wild. Ideally it would also be able to look back in time and discover if this zero-day being exploited prior to the vulnerability. Secondly, what we couldn't do is set up honeypots in multiple different sectors and compare attack profiles - eg, between a hospitality company and say a local council.

In both those cases though, what we would want is the results of the analysis and expert recommendations, not the raw logs.

As others have already suggested, what we would be very interested in is honeypots-as-a-service: Being able to drop a fake finance server into our estate and detect access attempts. Create a fake company division website and see who tries to attack it and how. Be alerted to targeted attacks before they actually entire the production estate.

Something I'm fond of saying is that whenever an investigation or assessment is performed, what actually earns you the money is the report at the end. That report and the actionable intelligence within is your product, not the tool you use to generate it.

</comment><comment><USER4> I work in security for a large financial firm and demo enterprise products like these pretty frequently.

My answer to this would be a simple "no". Obtaining and structuring honeypot logs is not hard, and is basically a solved problem. This falls under the greater umbrella of "threat intelligence", and there are a ton of open source and enterprise solutions for threat intelligence feeds and collection. You would have extremely contentious competition, plus odds are a lot of what you're doing can also be done by an in-house analyst with some Python skills and access to public and private feeds.

Some sort of significant value would have to be added on top of the logs, and no, not just categorizing or grouping or ranking the logs.

If it's still honeypots you're interested in, then a better idea may be to offer an "active defense" honeypot service to get early warning on targeted attackers. This can include things like decoy/trap email accounts, web and network services, documents, and more.

Some startups are in this space, but it's a pretty immature field. It also has a lot of problems because many top managers and execs feel very uncomfortable with the idea. My own company has discussed it before but management has declined due to legal concerns, and also the concern that baiting an attacker may make you more of a target.

But I feel this area may be ripe for disruption. Get a few of the big names doing things like this and it's easy to convince smaller companies in the same vertical to do it as well. Actually, some big names may already be doing it, but if they are they're probably hush-hush about it.

In summary: honeypots sitting open on the Internet offer some interesting intelligence, but the honeypot you run and the honeypot anyone else runs will generate roughly the same intelligence and logs. And a lot of these logs are already converted into network indicators and rolled into hundreds of threat intelligence feeds that many security departments are already consuming. You won't be able to generate a lot of value by running and processing your own personal honeypots, in fact I would consider it a massive waste of time from a product or service perspective (though running one certainly is educational and can be fun).

But a honeypot sitting within an enterprise network/domain can be very useful and very valuable to a company. If you provide such a service, I would recommend it as a software suite set up by the client, definitely not as a cloud service.

</comment><comment><USER5> I would suggest startups are the wrong area. Startups barely have money to pay for staff and often don't know or care about their security risk. They also tend to use tools which allay some of that risk (eg: Stripe, etc for credit cards, non-storage of PCI-Compliant data). Mid-Sized companies often have sensitive data, older techniques, and/or budget - and can be convinced of their risk. I would suggest going the routes of medium size business up to lower Fortune 3000 companies. Reason, the CISO position is increasingly going to those in security with Penetration background rather than other areas of sercurity (eg: physical, Identity & Access, etc). You might look at a strategy similar to [http://Phishme.com](http://Phishme.com) which is selling into larger accounts.

[my background: used to implement and sell security into Fortune 1000 account and SMB's]

<comment><USER6> Do you have any ideas as to how to gather budget to release a business on a bigger scale?

<comment><USER5> Security is an odd area. In selling (and implementing products), as well as helping a friend launch his Cloud security business - the market has a huge issue for startups if your approach it incorrectly. As opposed to areas ripe for SaaS penetration, security solving traditional or incremental problems face a large resistance because buyers/stakeholders "won't get fired for choosing Netegrity/Oracle/<largeco>" if something goes wrong. They can always blame it on the consultant implementation team. Plus, there's a large risk to an organization using a new player to solve an old problem. Phishme (not associated, but have friends who know them) took a new approach (email phishing) which wasn't offered by large players. We found this out a hard way in a startup, along with long sales cycles and requirements. For a security offering, the Mach37 accelerator can be a good place to start.

</comment></comment></comment><comment><USER7> I can't answer about whether I'd buy it (I'm not in that market) but you should know that the competition in the space you're considering is, or at least was, pretty fierce. Vendors you should look at include iDefense, TippingPoint, Arbor, and Symantec.

</comment><comment><USER8> I think this would be a tough sell in enterprise environments because the analysis of log data takes time and analysts are likely to say they have enough data from their own logs. They would also get stuck on the differences between the honeypot environment and their own network.

That said, it would be valuable if I wanted to blacklist certain IP addresses.

You may also consider a data sharing service that would provide access to anonymized log data shared among subscribers, this would allow subscribers to get data from real systems. Some vendors market similar services (such as RSA's eFraud Network).

</comment><comment><USER9> This service may be useful to security companies and security researchers or analysts, and for them it shouldn't be hard to get this type of data.

A better service would be to embed somehow honeypots into the client's infrastructure and deduce customized actions in a mostly automated, semi- supervised way.

The problem with security logs (and logs in general) is that they are hard to take specific actions on. I don't even recommend installing an IDS like Snort to most people; you see lots of automated intrusion attempts, almost all just fishing for a vulnerability in an application that you don't even have , now what, are you going to dedicate someone to go through them and see if the infrastructure is vulnerable to them?

<comment><USER10> > dedicate someone to go through them and see if the infrastructure is > vulnerable to them?

No - Somebody has just done that for you, for free.

</comment></comment><comment><USER11> This is a space I spend an enormous amount of time in, so it sounded interesting.... then I didn't get it.

Honeypot logs aren't really interesting - since I don't care what happens inside them. Now, if you could embed your honeypots as a service with companies, and get them to accept data sharing, that's more interesting. If you can somehow integrate the results or share things with Team Cymru or VXShare, it becomes a lot more interesting.

But the thing is - I already get a lot of that value from cuckoosandbox - <USER2> more recently elastic-cuckooo. [https://github.com/drainware/elastic- cuckoo](https://github.com/drainware/elastic-cuckoo).

</comment><comment><USER12> I would use Tilt to quickly test to see if people would buy into the concept. [https://www.tilt.com/campaigns/new?sell=1](https://www.tilt.com/campaigns/new?sell=1)

<comment><AUTHOR> Checking it out, thanks

</comment></comment><comment><USER13> Charge for them to be searchable. That way, people can lookup strings or patterns being sent to their server and see what attacks they match up against.

</comment><comment><USER14> It'd be more interesting if there was service which analyzed the client's logs and recommended specific action (per client), with the unique insight gained by your honeypot network. Something like an API which you hooked up with your infrastructure, fed logs into it, and got periodical security recommendations and alerts in return.

</comment><comment><USER15> Is the eMail in your profile active and working? I have something for you

<comment><AUTHOR> Yes

</comment></comment><comment><USER16> Honeypots have high value when embedded in high value networks.

</comment><comment><USER17> no, can't say i would. i don't see what the benefit would be

<comment><AUTHOR> Good to know. :)

</comment></comment><comment><AUTHOR> This has been very interesting, thank you all for your feedback.

</comment><comment><USER18> Honeypot logs? No.

Analysis and consumables pulled from the logs? Maybe.

Say you provided block lists for smtp/ssh/http which were actively updated, firewall rules, log filters, packet capture filters, &c to help find and prevent some of the illicit traffic on my own network.

For example, when shellshock was around several people posted grep strings to tease attack attempts out of apache logs.

<comment><USER19> > Analysis and consumables pulled from the logs? Maybe

But this exists already in a form of RBL/PBL/XBL/etc. Not that it cannot be done better, e.g. for smoother integration into existing perimeter security systems, but it exists nonetheless and it's free.

<comment><USER20> Agree with cz. Put that in a box that plugs into a wall and gets warm and sell it tor 30k to enterprise companies, and you could have a product.

</comment></comment></comment><comment><USER21> I'm broke</comment>


New Python Bitcoin Library Released by Chainside - <AUTHOR> https://blog.chainside.net/btcpy-released-a-full-featured-bitcoin-library-10f1b81e2ad0 <comment><USER2> Congratulations, the library looks complete and well written, I'll follow closely to see how the OP_CODESEPARATOR issue will evolve, very curious about that, meanwhile, again, grats :-)</comment>


Vim: reorder tabs - <AUTHOR> http://www.vim.org/scripts/script.php?script_id=2520

<comment><AUTHOR> My preference however is to use Shift-Left, Shift-Right to move the tabs:

map <silent> <S-left> :call MoveCurrentTab(-1)<Esc> map <silent> <S-right> :call MoveCurrentTab(1)<Esc></comment>


'Virtually entire' fashion industry complicit in Uighur forced labour - <AUTHOR> https://www.theguardian.com/global-development/2020/jul/23/virtually-entire-fashion-industry-complicit-in-uighur-forced-labour-say-rights-groups-china <comment><USER2> I have a feeling that they are conflating cotton from Xinjiang and forced labour... Convenient.

<comment><USER3> It's not a conflation, it's a direct claim.

> Despite these abuses, the coalition of human rights groups says many of the > world's leading clothing brands continue to source cotton and yarn produced > through a vast state-sponsored system of forced labour involving up to 1.8m > Uighur and other Turkic and Muslim people in prison camps, factories and > farms in Xinjiang. It says that the forced labour system across the region > is the largest internment of an ethnic and religious minority since the > second world war.

Are they wrong?

<comment><USER2> The question is: Are they right?

They are making a claim. It's for them to prove it, not for others to disprove it.

The article says that China is the largest cotton producer and that most of Chinese cotton is produced in Xinjiang. So it is very easy to claim that something might be happening in Xinjiang and then say that the entire fashion industry is "complicit".

But from the article it seems to me that this is based on second hand accounts reported through the blob of "a coalition" from people who have an interest in attacking China and in making their previous situation in China as bad as possible.

They are also mentioning the "Uyghur Human Rights Project". I don't know who they are but their website says that they are based in Washington DC (and they seem to a separatist group that seeks independence for Xinjiang). With the current situation between China and the US, forgive me for thinking that maybe, just maybe, this might be a PR machine in operation (basically psych ops).

Whether these claims are in fact true or not, it seems to me that the media are too happy to take everything at face value.</comment></comment></comment>


Ask HN: Whats the best way to crowdfund supporting local hospitals? - <AUTHOR> The idea is to run a fundraising campaigns to support the staff of local hospitals with gift cards and catering from local businesses that are also suffering.  Are there any good platforms that could help? <comment><USER2> Have a decent society whose government provides adequate funds for health care.</comment>


It's 2017, every city needs buses with USB ports - <AUTHOR> http://www.theverge.com/2017/1/22/14337732/its-2017-every-city-needs-buses-with-usb-ports <comment><USER2> Smartphones hold about a day's charge, which is fairly terrible compared to the old dumbphone days, but fits fairly well with an average person's daily schedule: you return to your place of shelter and charge your phone for about two hours while you sleep.

Having USB ports on a bus is nice, and would likely help out those who forget to charge their phone while they sleep, those who don't have access to a stable residence, or those who used more charge than usual and are now low battery, but is absolutely not a "it's 2017 -- why isn't this a thing" requirement for something as short-term as one's trip on most public transport.

Instead, USB charging-only ports or other ways of charging one's phone should be ubiquitous in places where one spends a long-enough time anyway: long- distance transportation (buses, trains, planes, cars, ferries, etc.), and workplaces, even in places where one must place their phone in a locker for the entire shift.

<comment><AUTHOR> _but fits fairly well with an average person 's daily schedule_

In theory this is true but in practice lots and lots of my friends have dead phones or phones with older batteries or simply don't remember to recharge their batteries. I teach as an adjunct and students often carry chargers with them and plug their phones in during class (though I forbid phones and computers in class: [https://jakeseliger.com/2008/12/28/laptops-students- distract...](https://jakeseliger.com/2008/12/28/laptops-students-distraction- hardly-a-surprise/)).

If you just look around, you'll probably see people with their faces in their phones all the time. This may be a bad thing in many respects (I tend to buy those arguments), but it can be good for public transportation, which lets people do the thing they really want to do. If we want better transportation systems, we have to get those systems to let people do the things they really want to do (i.e. stare into their phones).

</comment></comment><comment><USER3> Plugging phones using USB is a potential security nightmare. QI's style chargers (if were more widespread on phones) would be better for that.

And I bet that companies making those kind of phones would win big if they drop those chargers on buses for free.

</comment><comment><USER4> Yet another attack vector yay!</comment>


San Francisco looks to ban free lunch at tech companies - <AUTHOR> https://www.cbsnews.com/news/san-francisco-looks-to-ban-free-lunch-at-tech-companies/ <comment><USER2> On one hand I see where this is coming from: people like restaurants and having a variety of them, usually a good chunk of their business is from office workers at lunch, and by occupying those offices, tech companies are making the economic situation for those around them worse again, and harming the vibrancy of the areas in which they build offices.

On the other hand, the in-house catering is often better, healthier, more convenient and more efficient than what you would get at a restaurant.

But I don't really think this is an honest attempt at solving a real problem though, I think this is an attempt to have a vote on a wedge issue that London Breed has to either veto or sign, making her a weaker candidate in the next election.

<comment><USER3> This is the first comment related to this issue that has made me stop for a second and consider the whole situation in a different dimension. Like a chess move...

</comment></comment><comment><USER4> The thing that's truly bananas about this -- when I worked in SF and lunch was paid for, we always catered in from local businesses! This sort of benefit doesn't isolate you from the community, it invests in the community. More than once I went to a restaurant that had catered a meal at my job -- places I wouldn't have known existed had I not gotten a free lunch.

</comment><comment><USER5> > that don't go out to lunch and don't go out in support of restaurants every > day

These idiots need a reality check. No business is entitled to customers. Customers choose to go there out of their own free will if the business provides service they need. If it doesn't, then it's time to change products or move onto another business model or market.

</comment><comment><USER6> Of all of the absolutely ridiculous laws that I've seen show up in San Francisco over the years, this is one of the stupidest things I've seen.

</comment><comment><USER7> Next up - you cannot use building restrooms, you have to go out on the sidewalk like everyone else.

</comment><comment><USER8> This is inconvenient for tech workers and will probably just cause more people to bring their own lunch.

If these restaurants want tech customers, why don't they offer catering to cafeterias? It's pointless to pass laws to protect your bad business model

</comment><comment><USER9> Collective punishment because non-tech people are envious? That's the least cool thing I've heard in a while. Mandating purchases from local restaurants would be totalitarianism. I might lean democratic Marxist, but this proposal goes way too far. Perhaps it's just a CBS clickbait and/or proposal to stir a debate? If restaurants offered better food and sold to meal plan services or directly to companies, what's the issue?

</comment><comment> anon-patch-1 [https://www.change.org/p/san-francisco-government-ban- kitche...](https://www.change.org/p/san-francisco-government-ban-kitchens- from-the-houses-of-san-francisco-supervisors)

</comment><comment><USER10> Is the concept of personal freedom dead in SF?

</comment><comment><USER11> Disagree with many things San Francisco does but this has some good things about it. FYI Marc Benioff at SalesForce has always done this for the same reason that the city is citing.

Of course, the traffic would probably get much worse.

</comment><comment><USER12> only 51 existing cafeterias? wow.

stupid proposal, and will never pass.

</comment><comment><USER13> This would be an excellent move.

<comment><USER14> For what reasons?

<comment><USER13> \- Prevent tech companies from asserting bullshit \- If you're lucky, they move out \- Other businesses can thrive \- Even though these rules don't apply to already established companies like twitter and google, can somebody kick them out of SF too? kthx.

<comment><USER14> Ok, we've established your goal. But maybe you could speak a bit about why you have that goal? Can you see any way that these companies may also be benefiting your life?</comment></comment></comment></comment>


Doing it Wrong - <AUTHOR> http://recoding.blogspot.com/2013/03/doing-it-wrong.html

<comment><USER2> A great post. Almost everything we do is broken in some way or another, but I am sure mostly it is better than before, and you writing this way means you want things to be better in the future.

Mingling with experts, or people who are simply better than us is underrated. Most of us would easily go for another job that pays more than the current one, and not only in terms of money. (I, for one, am going for a non programming job that I consider better)</comment>


1 in 3 Rogue pharma domains registered through one registrar, Internet.bs - <AUTHOR> http://www.marketwatch.com/story/legitscript-analysis-1-in-3-rogue-online-pharmacies-with-single-registrar-2012-03-12

<comment><USER2> <ComicBookGuy>Most aptly named domain registrar, ever.</ComicBookGuy></comment>