Indie Game Removed from Switch After Dev Reveals It Has a Hidden Code Editor - <AUTHOR> http://www.nintendolife.com/news/2019/04/indie_game_removed_from_switch_eshop_after_dev_reveals_it_contains_a_hidden_code_editor <comment><USER3> _> The narrative that has played out online is exactly what's wrong with this trashcan fire of a world.

>Everyone is an armchair expert. Everyone thought the worst. You've seen that I've been called a dick, idiot, and everything in between. Because sensationalised news sells. If the narrative was 'I added a sandbox to A Dark Room that lets you mod the game and provide a medium for kids to code (and technical parents to show their kids what they do),' it would have gone unnoticed._

This is just desperate. Nintendo are notoriously protective of their platforms and their IP. It has been an essential part of their business model for over 30 years, going back to the NES10 chip. Expecting Nintendo to disregard their own Terms of Service because this specific breach is well-intentioned is utterly naive.

Rajan says: _" I snuck it in assuming that plugging in a USB keyboard and pressing the "~" key wasn't part of the test plan"_. He intentionally deceived Nintendo as to the nature of his app by including a hidden feature that allows for arbitrary code execution. He announced the existence of that feature on social media. What else did he expect to happen?

<comment><USER4> The fact that Nintendo were always like this does not mean it is okay. If there's anything wrong with this story it's how everyone seems to silently accept it is okay for a company to tell you what you can run on the hardware that you "buy" but not really own.

<comment><USER3> That's not the story at all. Rajan entered a voluntary agreement with Nintendo, through which his game would be distributed on their platform. He deliberately deceived them about the presence of a potentially security- critical feature, thereby breaching that agreement; Nintendo took the perfectly reasonable decision to remove his game from their platform.

There is a perfectly reasonable debate to be had about bootloader unlocking, sideloading and consumer choice, but this is not that debate. The issue here is fundamentally about someone intentionally deceiving a business partner.

Sidebar: There are no shortage of tablet-ish computers that will run arbitrary code. The Joy-Con controllers are class-compliant and will work with any Bluetooth host. There are open alternatives, but a lot of people buy the Switch specifically because it offers a curated experience with clear age ratings and effective parental controls.

To meaningfully contribute to the debate on walled gardens, it is first necessary to acknowledge their relative popularity compared to open platforms. If walled gardens were universally and unconditionally bad, it is implausible that they would have such broad market acceptance. In the case of Nintendo, this issue is particularly acute - many informed observers credit the NES10 chip and the Nintendo Seal of Quality with saving the video games industry.

<comment> xkcd-sucks So all one needs to do to make exploits/jailbreaks/backup loaders for switch is to get a Nintendo developer account? Sounds like a win

<comment><USER5> ... and buy separate devkit hardware (relatively cheap compared to Wii U days, but still), make an actual game (devkit does not play retail games, and retail console cannot install dev-signed apps), get it through TRC/lotcheck, pay the fees to publish the game, give trailers/launch material to Nintendo, never once mention its secret purpose as a jailbreak, and then secretly share it with all your friends without any bit of the hacker community finding it out. Extremely easy.

<comment><USER6> > never once mention its secret purpose as a jailbreak

The switch is completely thoroughly irreversibly jailbroken at the hardware level already. I don't think the secret purpose was to be a jailbreak.

<comment><USER7> > The switch is completely thoroughly irreversibly jailbroken at the hardware > level already.

This has been fixed in hardware revisions since about a year ago. Getting a unit that is vulnerable to the so-called RCM exploit has become increasingly difficult.

(The boot9strap exploit against the 3DS, on the other hand, was never fixed. One wonders why.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> The narrative in the article also misses the following point, which I've seen many times over the years, in both game dev and non-game dev shops:

 _It is massively unprofessional to ship an Easter Egg without broad consent to do so._ Planning a fun "secret" for your users? Great! Surprising people involved in _the publishing pipeline_ , esp. in a "will I get caught" way? Not so great. That's where Rajan went off the rails.

<comment><USER9> Indeed. Although this isn't sexually explicit, it reminds me of the trouble Rockstar got in after the Hot Coffee fiasco. Their publisher had to pay out hundreds of millions of dollars.

(Edit: pkroll is correct, the final penalties were $21 million.)

[https://en.wikipedia.org/wiki/Hot_Coffee_mod](https://en.wikipedia.org/wiki/Hot_Coffee_mod)

<comment><USER10> Everything about that scandal was stupid. In an M rated game (recommended for 17 and older), the protagonist could date women, be invited into their homes, and then the player would hear the sounds of the characters having sex. Fine, whatever. The game also allowed the player to sleep with prostitutes on the street to regain health, which would either cost them money or, if the player completed missions to become their pimp, earn them money.

The revelation that, in addition to those kinds of sex, a crude sex minigame could be revealed, if one made a bit flip to a config file with the help of third party software or hardware, led to:

* $21 million in penalties.

* The city of Los Angeles suing the company.

* A class action lawsuit whose initial plaintiff was a lady who bought the game for her 14 year old grandson, which would end with 2700 claimants being compensated.

* Hillary Clinton calling on the FTC to "take immediate action."

* Senator Lieberman, working with Clinton, proposed a law making the sale of violent games to children a federal crime.

<comment><USER9> I agree, the reaction was completely, 100% nuts.

But such an Easter egg could put Nintendo in a similar situation, and I can see why they can't let developers get away with hidden content like this. It would set a bad precedent.

</comment></comment></comment></comment><comment><USER11> I wasn't able to find their developer policy, but I'd assume this is a pretty cut and dry case of violating the policies he agreed to when he submitted the game for review.

Nintendo is very protective of running pirated or unofficial games, ever since the late 80's, when knock-off games were rampant and leading up to today with DRM. I'm sure it's against their policies to sell a game where users are allowed to write arbitrary games/code without Nintendo approval.

It would be different if the game was sold as a Ruby interpreter, because then they could at least verify it's capabilities and make an informed judgement about whether they should allow it.

<comment><USER12> [https://developer.nintendo.com/](https://developer.nintendo.com/)

To get an account there, you must agree to a few things, one being an NDA, and to get a Switch dev kit you must agree to a few more things, as well as go through a case-by-case evaluation of your game idea, if you are not an established game developer.

We won't be seeing the agreement(s) that were likely broken, and if you can see them, you are under NDA.

</comment></comment><comment><USER13> > The apps would be tied to the game itself, and would only be able to run > when loading up that game, but you can see why Nintendo would take issue > with its implementation.

I have a few guesses, but no, I don't see why Nintendo took issue with this. Is it because users could damage their devices with access to something like this? Is it because this could somehow be used to undermine Nintendo's DRM or cheat in online games?

<comment><USER14> There's definitely an argument to be made about how this dev should only be shipping to hundreds, thousands, or millions of personal devices via Nintendo's infra only what's printed on the tin.

My hacker nerd side is all giggly.

My security and consumer conscious sides bristle at the idea some dev thought it was a great little in-joke to ship this to unsuspecting users.

<comment><USER15> > dev should only be shipping to hundreds, thousands, or millions of personal > devices via Nintendo's infra only what's printed on the tin

That's a very long-winded way of saying, "He should only sell what was advertised."

> unsuspecting users

Nobody is forcing anyone to find or access Easter Eggs. It wasn't malicious nor annoying, it wasn't even accessible unless you attached a keyboard. I haven't seen any backlash from "unsuspecting" buyers, only Nintendo.

I see the potential worries from a security perspective, but as an "unsuspecting" consumer, why would you care?

</comment></comment></comment><comment><USER16> _> you can see why Nintendo would take issue with its implementation_

Actually, I don't see why. The interpreter only runs inside his game. It doesn't root the machine. Why would anyone object to this?

<comment><USER17> The implementation is based on mruby, which is riddled with bugs. I spent some time reversing A Dark Room before it got removed. I am confident that there are bugs allowing ROP, from which point getting CFW is a matter of privesc. We have privesc to bootrom on every firmware version up to 7.x (inclusive).

This is obviously bad for nintendo.

<comment><USER18> The games themselves run in a sandbox and should not have access to the greater OS, hypervisor or arm trustzone which are on the switch.

<comment><USER19> Assuming the jar has no holes. The jar apparently has holes and the brain inside it can peek out.

<comment><USER18> I haven't seen any exploits from application level getting access to the OS. There is basically one exploit being used on the switch which uses a bug in the nvidia chip at boot which gives you a higher level of access than the OS and all of the security checks. Its such a powerful exploit that can only be fixed by a hardware change that no other exploit is needed.

<comment><USER17> You didn't look too hard then. Deja vu got released recently. It's a chain from unprivileged to bootrom. Got fixed in 8.0.0, the very latest firmwares. Look it up at [https://switchbrew.org/wiki/Switch_System_Flaws](https://switchbrew.org/wiki/Switch_System_Flaws)

It's currently the only known chain, and might be the only one in existence. And yet it's a big threat. In practice, A Dark Room isn't a particularly interesting entrypoint due to requiring an usb keyboard (web browser is easier to open). But it's understandable that Nintendo would want to keep those entrypoint to an absolute minimum. Especially since newer hardware revision exist which fixed Fusee-Gelee, the BootROM bug you talked about.

</comment></comment></comment></comment></comment></comment><comment><USER20> I follow him on Mastodon, where this all played out: [https://ruby.social/@amirrajan](https://ruby.social/@amirrajan)

His explanation: [https://ruby.social/@amirrajan/101991299426077446](https://ruby.social/@amirrajan/101991299426077446)

He did security checks: [https://ruby.social/@amirrajan/101986725826245184](https://ruby.social/@amirrajan/101986725826245184)

<comment><USER21> > He did security checks: > [https://ruby.social/@amirrajan/101986725826245184](https://ruby.social/@amirrajan/101986725826245184)

This is worth nothing to Nintendo and should be worth nothing to other people. This should've been done as a collaboration with Nintendo in order to actually bring Ruby to the Switch, not snuck in.

</comment></comment><comment><USER22> A Dark Room is a _very_ good game. It's available on many other platforms - highly recommend you check it out!

<comment><USER23> NGL I am not huge on Ruby (dont hate it just do more with Python) but I would buy that game just to code in Ruby in the game as weird as that sounds. I love out of the box easter eggs.

</comment></comment><comment><USER24> I love the amount of control we are using over our devices. It is not like people can do anything malicious with it.

Anyway; so like Apple (less and less luckily), Nintendo forbids editable code to run on their devices? Or is it allowed if there is a gaming aspect involved? Or just not at all?

<comment><USER25> You can purchase a BASIC interpreter on the 3DS eShop. It's called SmileBASIC, and it's pretty full featured. [http://smilebasic.com/en/](http://smilebasic.com/en/)

It doesn't make intuitive sense to me why a BASIC interpreter would be allowed, but not a Ruby interpreter. The difference is likely that Nintendo was never informed about the Ruby interpreter.

While I wish everything was user-modifiable, I'm generally okay with game consoles being locked down, because they don't bill themselves as general- purpose computing devices. I can't run my own software on my BluRay player either.

<comment><USER26> It was the deception by the developer. He chose to hide it from all reviews and gave a false description of what the product to sell on the platform was.

<comment><USER27> I really don't think an easter egg like this is enough for "false description of the product".

Is Excel 97 not a spreadsheet program?

<comment><USER25> Was Excel 97 submitted to a separate authority for testing and validation prior to release? It was, don't you think the authority should have been informed of any hidden functionality or easter eggs?

<comment><USER27> It was submitted to a lot of stores with harsh requirements for shelf space, acting partly on testing and partly on trust. I'd say the authority there is comparable, and no they didn't need to be informed as long as the program admirably performed its job with no malicious code.

</comment></comment></comment></comment></comment></comment><comment><USER28> I have often wondered...

Could you make a video game for these platforms, Nintendo or iOS, where there is a fully... is endogenous the word? virtual machine in the game world that you could program on? Like, the registers and compute cycles weren't real ticks, they actually happen within the game loop?

Like, if I made a space sim¹, and the flight computer ran on PICO-8², and there were actual transistors in the spaceship model, and there was a terminal with actual wires that go to them, would that get banned from the app stores?

¹ (similar to what 0x10c was intended to be)

² [https://www.lexaloffle.com/pico-8.php](https://www.lexaloffle.com/pico-8.php)

<comment><USER29> Nintendo does tend to allow things that let users "code" their own games, as long as it's well-checked and the devs are upfront about it. See SmileBasic([http://smilebasic.com/en/](http://smilebasic.com/en/)), a commercial BASIC interpreter for 3DS that let's you make simple games, condoned by Nintendo and sold on the eShop. Coincidentally, it led to 2 separate exploit chains that allow for native code execution - <USER2> doesn't want any of that and it's understandable that they want to avoid any possibility of it happening, especially if the groundwork for such an exploit is getting snuck in as a legitimate game without even telling them about it. People will always find their way around sandboxes and limitations, especially on a highly targeted system like the switch.

</comment></comment><comment><USER30> What about people who already bought it? Does it stay installed on their consoles? And if they uninstall it, can they download it again?

It's probably moot because I'd expect Nintendo to demand a patched version of the game with Ruby removed to replace the existing version for those who bought it even if Nintendo decides not to allow it up on the store again.

<comment><USER31> I can't remember them pulling games off consoles - when people discovered games allowing code execution on the 3DS, Nintendo either marked patches as mandatory as soon as they were ready (so you couldn't play without updating) or attempted to block the exploit on the OS side (as they did with _Cubic Ninja_ , since the studio behind it shuttered)

</comment></comment><comment><USER32> Well, this was to be expected. I was wondering when it was announced how long it would take for Nintendo to drop the hammer.

</comment><comment><USER33> In what way was that code editor malicious? Did it allow i.e. creating your own games, modifying other games etc? I don't think so, since I'd expect apps on such platforms to be totally sandboxed. If you could only enter data into it via a keyboard, you couldn't even use it to download programs off the internet, except doing it the 80s "let's retype those ten pages of code into my computer" style.

<comment> crooked-v If it's a full implementation with OS-level access, a USB device that fakes keyboard input could do all kinds of spyware-like stuff with only brief access to the hardware, and without most users even knowing it's possible.

<comment><USER34> It doesn't allow OS-level access -- its limited to the game/app sandbox.

Also Nintendo does have a full BASIC interpreter available for sale on their app store.

</comment></comment></comment><comment><USER35> There goes my idea of porting Core War to the Nintendo Switch. Ah well.

<comment> crooked-v The 3DS has a sandboxed BASIC implementation available complete with exporting and loading programs ([http://smilebasic.com/en/](http://smilebasic.com/en/)), so other programming-in-a-VM games would probably be fine, presuming the developer was actually upfront about that at the time so proper security and content-rating testing could be done.

</comment></comment><comment><USER36> That's wild because Super Mario Bros contains a built-in code editor (via arbitrary code execution easter eggs), and Nintendo is OK with that.

[https://www.youtube.com/watch?v=OPcV9uIY5i4](https://www.youtube.com/watch?v=OPcV9uIY5i4)

<comment><USER37> Isn't that a bug though and not a feature? Also running the inputs to generate compileable code isn't feasible on the original console because of the required precision of the inputs and only possible on emulators?

<comment><USER38> No, a person can do it on a real console [https://www.youtube.com/watch?v=hB6eY73sLV0](https://www.youtube.com/watch?v=hB6eY73sLV0)

<comment><USER37> Thank you, I stand corrected.

</comment></comment></comment></comment><comment><USER39> Another recent post here on HN is from the app developer himself. Only hours ago, he told detractors "not to worry" about Nintendo's response. And now this.

</comment><comment><USER40> I will never understand why people buy consoles. By doing so, rather than getting some kind of pc, you are doing nothing but paying a lot more in order to greatly restrict your options and make all your gaming utterly beholden to some corp. It used to be the case that consoles were more convenient and faster to play games on. Now the opposite is true. To run a console game you have to make and sign into an account, be online, it will need to update its OS, then update the game, and loading times are enormous.

<comment><USER41> For me at least, the appeal is that the Switch is capable of being handheld on things like the commute and flights. PC gaming is not as convenient or portable, and mobile gaming is not nearly as pleasant of an experience.

You don't have to be online to run a Switch. And the Switch uses solid state memory so loading times are pretty good.

</comment></comment><comment><USER42> I read every word of the post (including quotations) and watched every second of the video. I've played on a Switch (owned by someone else).

Can someone ELI5 what the issue is here or why there's any reason for remorse? Since it's a text adventure game, what's the difference between the game as allowed (text adventure) and the sandboxed bundled ruby? What's the difference between those 2 things? (A sandboxed ruby seems strictly equivalent to a text adventure game to me.) Not trying to be obtuse, just don't get it.

<comment><USER43> One issue that can easily crop up - the sandbox has bugs that allow access outside the game. This makes the game suddenly more than just an adventure game, and could be exploited. This is what Nintendo is trying to prevent here.

<comment><USER42> Oh okay. That's surprising to me because Ruby is a web language, so you would think that no, it wouldn't really have any known bugs like that. And again, if you're talking about potential bugs I'd think the text adventure game (or any game) might have bugs too. I still don't get it though because isn't it the user's hardware?

Is there some more context here? I'm still confused.

</comment></comment></comment><comment><USER44> And this is what happens when people don't _own_ the hardware they buy. Instead, they get awful DRM'ed bullshit, with a monopolistic store 'owner' digitally forcing whatever they say on their fiefdom.

The first computer I had access to had BASIC built in. Having control of a computer of what runs and not is an absolute basic right of ownership.

And from these computers called "game consoles", you the purchaser have none of that.

<comment><USER45> What surprises me is the number of people who seem to be agreeing with Nintendo in this case.

I guess the Overton window is shifting away from a position of software freedom; which is unfortunate. :-/

<comment><USER46> Well, there's two separate issues at play, and then how they combine.

There's whether you should be able to run your own code on your own device, which I think most people here are on board with.

Then there's whether you should be able to misrepresent what you've agreed to ship through someone's network when you've presumably signed contracts and made statements about that end up being untrue. I think most people would agree that Nintendo should have the ability to control what they allow in their store.

Finally, there's how these interact, because you can only really run stuff on the switch that Nintendo allows in their store, which makes the issue much more complicated.

Which part of the issue someone focuses on will likely inform how their comment is formed, but also how they interpret other people's comments, whether they are really focusing on the same aspect of the issue or not.

<comment><USER47> My sentiments exactly. To branch a little bit, Nintendo has been historically focused on preventing piracy. It makes sense given their consoles tend to be the easiest to hack of the big 3.

If you remember what happened on the 3DS with Cubic Ninja [0], that game's level editor allowed the console to run homebrew code. That was inevitably another vector for piracy at a time where Nintendo was already grappling with the for-profit piracy enabler that was Gateway.

Based on this I can't personally say if Nintendo is against homebrew running on their consoles or if they're trying their hardest to prevent piracy, at the expense of homebrew. I do think that the feature included in A Dark Room would have had better chances of staying if the dev hadn't kept it a secret through the publishing process, though.

[0] [https://wikipedia.org/wiki/Cubic_Ninja#3DS_homebrew_exploit](https://wikipedia.org/wiki/Cubic_Ninja#3DS_homebrew_exploit)

</comment></comment></comment></comment><comment><USER48> Looks like this new platform is getting flooded, and Nintendo's quality control is not keeping up. A game like this should have never been allowed a release - just from the poor visual quality alone.</comment>


How 2 Indian snake catchers caught 14 Burmese pythons in 2 weeks in Florida - <AUTHOR> http://www.mnn.com/earth-matters/animals/stories/indian-snake-catchers-caught-burmese-pythons-weeks-florida <comment><AUTHOR> It reminds me similar story, in my place. Well-known company (who spends millions in Cricket) hired snake catchers to get rid-off snakes from their region - which also has employee's houses. But in few weeks ,they stopped coming because company didn't pay them promised money.

I hope these two snake catchers get paid more than their translators! Translating from English to Tamil is easy and the real credit/money should go to these catchers not translators. Even USD-2000 will make huge difference to their lives. (If I'm not wrong USD-2000 will be equivalent to 2 or 3 years salary)

</comment><comment><USER2> Maybe the tribesmen could teach others? </s>

<comment><AUTHOR> I read another report,which says they are in-fact teaching others on this. So that wild-life organizers can take of themselves :)</comment></comment>


Are concert tickets too cheap? Ticketmaster thinks so - <AUTHOR> https://www.marketwatch.com/story/are-concert-tickets-too-cheap-ticketmaster-thinks-so-2019-12-26 <comment><USER2> Because they get huge profits from each tickets they sale and the "fee's" associated with it. The more they can jack up tickets, the more money they make. One might call them a monopoly imho.</comment>


Books about Silicon Valley - <AUTHOR> https://medium.com/swlh/silicon-valley-books-you-should-read-in-2020-a4dd1e01084b <comment><USER2> Yet another list of Amazon affiliate links from this same submitter (tag petacrunch-20).

Ironically, it's behind the Medium paywall.</comment>


Steve Jobs Is Receiving Cancer Treatment at a Clinic in Stanford - <AUTHOR> http://nymag.com/daily/intel/2011/02/steve_jobs_is_receiving_cancer.html <comment><USER2> This is none of our damn business.

</comment><comment><USER3> "Judging from the photos, he is close to terminal. I would say he has six weeks."

How on earth can you deduce that from looking at some photos?

<comment><USER4> Easy: be a sleazy doctor and market yourself as the go-to guy for tabloid news money quotes.

</comment></comment><comment><USER5> From personal experience (My Dad died from pancreatic cancer), if the cancer has re-appeared, Steve's odd's are not good at all. Beating it once is never a guarantee that it's completely gone, and beating it a second time is relatively unheard for cancer of the pancreas.

Of course, this sort of speculation has no place in the news, especially basing it on a diagnosis through pictures. The doctor who is quoted should be ashamed of himself, no reputable doctor should engage in gossip.

<comment><USER6> On the positive side, Steve previously had a rare, treatable form of pancreatic cancer (see [http://www.sfgate.com/cgi- bin/article.cgi?file=/c/a/2004/08/...](http://www.sfgate.com/cgi- bin/article.cgi?file=/c/a/2004/08/02/MNGMJ816F41.DTL)). If this is a recurrence of that, and they've caught it in time, then the odds may be significantly better.

<comment><USER5> The treatment the first time around damages your body an absolutely immense amount, I can't even imagine the toll it must take a second time around. I have an infinite amount of respect for cancer sufferers.

<comment><USER6> From what I read, Steve had no chemo or radiation -- just an operation to remove the tumor.

</comment></comment></comment></comment><comment><USER7> We know he has cancer, and we know he is taking a medical leave of absence. How is it news that he is receiving cancer treatment?

<comment><USER6> It's just confirmation. The judgement from the (uninvolved) doctor that Jobs looks like he may have six weeks to live -- that's ominous. And probably not true, given that this guy's judging by someone's appearance in a photo.

</comment></comment><comment><USER8> I hope he gets every chance he can, because I hope everyone with a horrible disease gets every chance they can.

And the speculating doctor ought to be ashamed. "First do no harm" doesn't specifically exclude reputations or privacy.

</comment><comment><USER9> Everyone involved with that tasteless speculation should be ashamed of themselves.</comment>


Ask HN: What are your predictions for the Pixel 3? - <AUTHOR> If you haven't read the article about how some YouTubers were contacted by Google, asking permission to use clips from their video, you should.  Does anyone else think that the Pixel three is going to be really radical, like a phone with 5 cameras? (Just a weird example) <comment><USER2> There've been many leaks and photos of the Pixel 3 already [https://techcrunch.com/2018/08/22/this-is-the-google- pixel-3...](https://techcrunch.com/2018/08/22/this-is-the-google-pixel-3-xl/) Doesn't look radical to be me.</comment>


Signals of an unsustainable future coming from Davos - <AUTHOR> http://failedevolution.blogspot.com/2016/01/signals-of-unsustainable-future-coming.html <comment><USER2> If you read the actual report (instead of that guy's blog), the information is rather positive:

      >Overall, there is a modestly positive outlook for
      >employment across most industries, with jobs growth
      >expected in several sectors. However, it is also clear
      >that this need for more talent in certain job categories
      >is accompanied by high skills instability across all job
      >categories. Combined together, net job growth and skills
      >instability result in most businesses currently facing
      > major recruitment challenges and talent shortages, a
      > pattern already evident in the results and set to get
      > worse over the next five years

Mike Rowe has a great foundation to help people who are trying to find those job: [http://profoundlydisconnected.com/usatodaywhatdoesagoodjoblo...](http://profoundlydisconnected.com/usatodaywhatdoesagoodjoblooklike/)

<comment><USER3> As someone who has been on the job market for a long time recently, I am not encouraged by this.

What I've observed is that in response to chronic talent shortages, larger organizations prefer to downsize, cut corners, scale-back offerings, and produce output of lower quality. Meanwhile, smaller organizations do not have the budgets necessary, so they try to portray working for them as a lifestyle choice. They offer foosball, on-site beer or coffee, and meaningless amounts of largely worthless equity.

What both types absolutely will not do is to compete via wages, benefits, or healthful employment accommodations (for example, private working spaces instead of undifferentiated desks in an open-plan office).

The "challenge" of recruitment is not how to attract qualified (let alone 'the best') candidates ... rather it is how to reframe the business such that high quality is not required for executives to maintain their lifestyles.

It's a massive _flight from quality._ It's very frightening.

<comment><USER2>
      > As someone who has been on the job market for a long time recently,

That's too bad. Have you done anything to increase your skills?

<comment><USER3> Yes, many things. Interviewers are often ecstatic about my skills and experiences, but ultimately say they would prefer to hire people less-skilled who are cheaper and (especially) more willing to sublimate away basic human needs (such as for privacy or vacation) while still working for lower wage.

<comment><USER4> Might I suggest giving Ruby a shot? Companies that use Ruby generally look for more experienced devs.

<comment><USER3> I would love to learn Ruby -- it is a beautiful language. But I am unaware of the scientific and data-science world for Ruby. I am not seeking front-end work, and Ruby has a (perhaps undeserved?) reputation of mainly providing jobs of that variety.

<comment><USER4> I interviewed on Friday for a company called Emcien that does data science work.

[http://emcien.com/](http://emcien.com/)

If you're willing to move to Atlanta, they're an option. Send me an email if interested, look in my profile. Heck, even if you're not, they're still worth talking to.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Wealth inequality is already a problem today. I would argue that since it's an issue already, AI, technology and automation has largely nothing to do with wealth inequality as it exists today.

The problem of wealth inequality was predicted to occur within capitalism long ago by a man named Karl Marx. So compelling were his predictions that entire societies have been constructed (and overthrown) in attempt to create a system that is more fair. Russia and China are the two biggest failed experiments in trying to solve this problem. Karl Marx may have been wrong about communism, but he is most famous for being right about wealth inequality and capitalism.

What Karl Marx said about inequality is this: It happens because of the private ownership of the means of production. As long as the lifeblood of the economy, its vital resources, factories and technology are owned by a tiny group of individuals, as long as production is governed by the law of capital accumulation and not the needs of society as a whole, poverty, injustice and capitalist crisis will remain and ultimately grow. Workers produce everything; the ruling class produces nothing, yet the ruling class own everything.

Take for example your typical Tech corporation: Apple. Apple makes $1,865,306 of revenue per employee. The top senior software engineer gets paid around $222,550, which is a number that is far higher than the average salary of an apple employee.

What is evident is this: The people who do almost all of the work in apple (engineers) are only getting paid less than a fifth of the revenue they generate. Where does the rest of this revenue go?

It is used to increase the incomes of a few people who do much less or no work. C-level executives pad their salaries with a huge portion of this money. Tim Cook alone got 10.2 million in 2015 and that's not including stock options. While tim cook is a very capable individual, his salary indicates that his work output is equivalent to the work output of 50 engineers. Can a single human produce output equivalent to 50 engineers? I would argue no.

The rest of the money is either distributed as dividends or reinvested back into the company in the form of infrastructure improvements or just money in the bank. Who directly benefits from this? The Shareholders or in karl marx's words: The people who own the means of production. These are the people attending davos. They are the real problem, it has nothing to do with AI.

<comment><USER6> The problem with US used to be some people were richer the others while in Soviet Russia almost everyone were equally poor, wasn't it?

<comment><USER5> No. Soviet Russia use to be a wealthy country. They got into space before the united states. Either way please read my comment. I never said communism was the solution. Capitalism is only a better system than communism, but it is still a system rife with problems.

In capitalism you get 1% of the population who own 50% of the worlds wealth which you characterized as:

"The problem with US used to be some people were richer the others"

I think the problem is bigger than that.

</comment></comment></comment><comment><USER2> The blog relies on some negative quotes about AI from the paper. The hypothesis is that AI will make most workers obsolete.

The paper is not a definitive declaration of what will happen, rather it is a survey of CxOs and HR managers. These people have expertise but their expertise is not predicting the outcome of AI.

<comment><USER7> To be fair though, these are the people who "tell" the market what a product should or should not be. If they say they expect AI to replace workers faster and faster, it means that's what they _want_ AI to do, that's where the market is going -- and where the market goes, technology will likely follow one way or the other.

<comment><USER2> It's what we all want. AI to do our job so we can play.

That's exactly what a "robot butler/maid" is for. [http://p-fst1.pixstatic.com/54652b06697ab07b10007e4a/_w.540_...](http://p-fst1.pixstatic.com/54652b06697ab07b10007e4a/_w.540_s.fit_/rosie- robot-jetsons.jpg)

</comment></comment></comment><comment><USER8> To quote Glenn Reynolds, "I'll believe there's a crisis with the people who say there's a crisis act like there's a crisis." These are the people who lecture about sustainability but fly 1500 private jets into Davos in the age of Skype.

<comment><USER6> This is about what I think as well. I don't walk around telling everyone that AGW is a hoax but in technical forums I sometimes ask only to be met with downvotes and quotes about 2500 scientists can't be wrong.

That said I do a lot of the right things for the "wrong" reasons: I recycle because I don't like wasting perfectly good resources, I take the train because that means I can code on my way to work (and I don't enjoy driving when tired) etc.

</comment></comment><comment><USER9> ">Overall, our respondents seem to take a negative view regarding the upcoming employment impact of artificial intelligence, although not on a scale that would lead to widespread societal upheaval—at least up until the year 2020."

Four Years is just one election cycle, so buckle-up and enjoy the ride, make sure you're ahead of the tide.

</comment><comment><USER10> "In the middle of the pyramid, a restructured class will serve and secure the domination of the top."

<comment><USER11> What happens if this high-skilled labor pool chooses new goals?

<comment><USER10> They can get the power and replace the current elite like during the French Revolution.

I think the history will continue to repeat itself until someone explain it with something like science (non-cultural).

I see the structure of the society like an electromagnetic field or like gravity. Something people don't know the existence.

<comment><USER12> I guess you could take a look at complexity theory.

<comment><USER10> Very interesting. Thank you.

<comment><USER12> I came across that field when I tried to find out answers. I found this is the best way to have a better understand for lots of things so far. It shows a better model for many "dynamic structured" things.

<comment><USER10> I agree with the "non-linear" aspects of the theory.

Agents infuence the system and are themselves changed by the result. We can see that in politics.

Mankind deseperatly needs this kind of tool to survive. Philosophy or principles are not shared enough to avoid conflicts and wars. Something neutral could help.

Thank you again :-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> Oldie but a goodie "Economics of Nanotech and AI" (Robin Hanson, Foresight 2010) [0].

[0] [https://vimeo.com/9508131](https://vimeo.com/9508131)

</comment><comment><USER13> As anyone who works in technology will tell you - "its turtles all the way down".

As long as the internet is held together by duct-tapes - I do not think there is going to be a shortage of jobs.

I always find it amusing when tech people think they can make someone else unemployed with a script.

Oh gosh - this package manager is awesome - said no one ever.

The real reason for job losses is with income inequality caused by dysfunctional govts.

</comment><comment><USER14> the difference between the US and Russia is that in the US, anyone has the opportunity to change their own economic situation if they want to.

<comment><USER15> I think there are millions of people in the US who "want" to change their situation. I don't think the US you are describing actually exists

<comment><USER14> If you have 5 kids, you probably can't easily change things: [http://www.allenbwest.com/2016/02/hilarious-judge-judy- conte...](http://www.allenbwest.com/2016/02/hilarious-judge-judy-contestant- inadvertently-explains-exactly-whats-wrong-with-liberalism/)

But anyone with half a brain can start going to local libraries to get interested in subjects, attend community college, apply for new jobs, learn a trade, etc etc

<comment><USER10> A lot of people are interested by nothing.</comment></comment></comment></comment>


The road of running Nginx with WebAssembly - <AUTHOR> https://medium.com/@syrusakbary/running-nginx-with-webassembly-6353c02c08ac <comment><USER2> I'm missing the use case here or understanding webassembly wrong. What is the use of running a webserver inside your webbrowser?

<comment><AUTHOR> The goal of Wasmer is being able to run WebAssembly not just in the browser, but also in servers at native speed.

<comment><USER3> Why though?

<comment><AUTHOR> There are a few reasons:

* It opens the possibility of having universal binaries regardless of the host operating system. That means running Nginx, Python, ffmpeg with just one binary (rather than one for each architecture)

* It could mean an easier interaction between languages (similar to GraalVM is doing Truffle) - without any recompilation

<comment><USER4> So, very simply put, it's like Java?

<comment><USER5> Yes, but with potentially much better (wider) industry adoption and support.</comment></comment></comment></comment></comment></comment>


[Show HN]: Test your arithmetic against other HNers with my first Socket.IO app - <AUTHOR> http://get24.jit.su I created this game for my game dev course at Auburn University. The game was created using nothing but open source technologies and is available on Github --> http://github.com/CoryG89/Get24 <comment><AUTHOR> I created this game for my game dev course at Auburn University. The game was created using nothing but open source technologies and is available on Github --> <http://github.com/CoryG89/Get24></comment>


Closing the Loop: The Importance of External Engagement in CS Research - <AUTHOR> https://blog.regehr.org/archives/1582 <comment><USER2> Jon Blow said--I believe--in a tweet that he decided against academy when reading grad students' papers proving the optimality of some algorithm where, in practice, caching was of prime importance (or something to that effect).</comment>


I have lost all respect for TechCrunch - <AUTHOR> http://martinweigert.com/i-have-lost-all-respect-for-techcrunch-or-secret-how-to-push-a-startup-the-silicon-valley-way/

<comment><USER2> Just to play the devil's advocate:

A lot of news getting on sites is PR agencies using their relationships with authors, and trying to get interesting stories out. It could simply be the case that Secret's PR firm is closer to TC than Whisper's.

Of course, ideally all articles would be free of such biases, and would be written and accounted for justly; but I don't think such news-sites/blogs exist.

</comment><comment><USER3> "News is something somebody doesn't want printed; all else is advertising." - William Randolph Hearst

</comment><comment><USER4> [https://www.quora.com/Secret-app/Why-does-Secret-get-so- much...](https://www.quora.com/Secret-app/Why-does-Secret-get-so-much-press)

<comment><USER5> The fact that it's on Quora is irony in and of itself, given that couple of years ago TechCrunch was flooded with 'articles' about it and how it'll take over the world.

</comment></comment><comment><USER6> i think many people did so some time ago.

<comment><AUTHOR> You are referring to my headline? Yeah I was especially patient :)

</comment></comment><comment><USER4> Secret's just a Instagram/Snapchat/WhatsApp wannabe. Those VC's are hoping as hell.</comment>


Theranos is back with support - <AUTHOR> http://www.inc.com/kimberly-weisul/theranos-supporters-and-there-are-some-speak-out.html <comment><USER2> No it isn't. There is no substance in this article. "Theranos is different in that it's run by a woman." It's a PR piece.

</comment><comment><USER3> "Theranos' science is sound, technology works," claims members of the firm's board who are massively financially vested in it's success.</comment>


XKEYSCORE: NSA's Google for the World's Private Communications - <AUTHOR> https://firstlook.org/theintercept/2015/07/01/nsas-google-worlds-private-communications

<comment><USER2> One thing about all of this that really surprises me is the scale of it ... I was genuinely and unhappily surprised to discover just how large a covert programme can be kept entirely hidden from the general public & most politicians.

I'd always naively assumed that working at this scale would guarantee leaks much, much earlier.

<comment><USER3> Except for the minor detail that it literally wasn't kept hidden...

<comment><USER4> It was kept hidden for a very long time, considering the size and scope of the operation.

<comment><USER5> Sept of 2001 until Oct 2002?

It's just that... you know... literally no one wanted to talk about how a US military department was using capabilities traditionally described as acts of war to subvert US infrastructure and analyze the behaviors of US citizens. There were terrorists!

Just like they didn't want to talk about it in the 90s, when the US government tried to claim that encryption was a regulated government technology and while US citizens are technically entitled to munitions, something something 2nd amendment, if you export anything more than 44 bits, you're in serious trouble.

</comment></comment></comment></comment><comment><USER6> I guess the good thing in all this is that it's what you'd expect if you took Carnivore from the 90s and threw a ton of intelligent people and pervasive fibre access at it. There doesn't seem to be anything breakthrough, like "holy shit they can _do_ that" kind of stuff.

Now yes, the scope is amazing. And I was getting this technical excitement just reading the system. So many questions! Like, how do they distribute jobs fairly or deal with resource over use? What stops some dumbass oper from submitting a super-expensive query? How do they manage all this stuff? It's pretty damn neat.

I'm wondering what the impact of TLS is on all this. Cause it seems like that'd sort of destroy this system, eh?

Edit: [https://www.documentcloud.org/documents/2116191-unofficial-x...](https://www.documentcloud.org/documents/2116191-unofficial- xks-user-guide.html#document/p1) \- Interesting how they are really explicit how USSID 18 stops them from doing stuff. Like they give the example of finding a phone number without a country code. Not allowed! Unless you combine it with something that'd limit it to foreign countries. But they note it's not a 100% solution.

<comment><USER7> The tone of the references to USSID 18 makes me feel like they are tongue in cheek.

For example this one: [https://www.documentcloud.org/documents/2115979-advanced- htt...](https://www.documentcloud.org/documents/2115979-advanced-http- activity-analysis.html#document/p91)

They are saying: are you unsure if an IP is a proxy? Well, given that you know so little about it, query all the users on the IP... you know, as long as the IP is USSID 18 compliant... given that you know so much about it already.

Hrm.

<comment><USER6> Hard to tell. I remember seeing in the docs somewhere that they suggest capturing for 5 minutes and checking out to make sure it's OK to investigate further.

As a practical matter, what more can they do? I wouldn't expect them to actively try to give up on following leads. Seems like the intent of the law is being attempted to be followed.

</comment></comment></comment><comment><USER8> I'm curious about their discussion of web forums. See the provided slides:

[https://www.documentcloud.org/documents/2116268-web-forum- ex...](https://www.documentcloud.org/documents/2116268-web-forum-exploitation- using-xks.html#document/p2)

It says they have "full take for US web forum servers under FISA coverage", and "passive collection for OCONUS [outside continental US] web forum server traffic". What does "FISA coverage" mean? They have warrants for specific forums, or a general warrant giving them access to thousands of forums?

I run a fairly large OCONUS message board. Are my visitors all in XKEYSCORE? I wish the release were more specific.

<comment><USER9> Time to install an SSL certificate and force encryption on all visitors, eh?

<comment><USER8> That's hard for a web forum with BBCode -- posts can load external images on non-HTTPS domains.

I suppose I can have the BBCode alter the URLs to point to my domain, and use nginx to proxy the image loads. I'd have to be careful to make sure users can't proxy malicious scripts and stuff into the page (because it'd be same- origin); is there a standard solution for this?

</comment></comment></comment><comment><USER7> The app has a field for "justification" and in the examples, some of them are:

> Chinese webmail users

> Iranian webmail users

Oh.

<comment><USER10> Where did you see that?

<comment><USER7> In some of the screenshots in the linked Powerpoints: [https://www.documentcloud.org/documents/2116255-using-xks- to...](https://www.documentcloud.org/documents/2116255-using-xks-to-enable- tao.html#document/p35)

</comment></comment></comment><comment><USER11> Does anyone else notice (intentionally?) poor redaction? In one screenshot, two IP addresses are visible, then blacked-out in two other places on the same presentation slide - [https://imgur.com/SLyjhmp](https://imgur.com/SLyjhmp), for example.

<comment><USER7> One of those IPs points to an Iranian IT company :P

</comment></comment><comment><USER12> Does using a VPN prevent any of these? EDIT: And I guess Google servers have most of Android users' home Wi-fi passwords. Which means NSA could pretty access any devices in those homes?

<comment><USER13> I'll just assume that most home routers have backdoors baked in; a number of those have been found by various folks.

<comment><USER14> They don't even need to have intentional backdoors (as in, designed for spy agencies/law enforcement). The chances of a random home internet appliance not designed with serious cybersecurity considerations in mind (as opposed to "good enough to stop the average snooper/criminal") not having root-worthy vulnerabilities that can be exploited from the upstream provider is close to nil.

Remember, most of these things have as their only threat model someone trying to gain access from the Wi-Fi side before authentication. I doubt many vendors seriously consider questions like "can the cable connection to the ISP be used to take over the router?" or take steps to prevent it. For many devices, that sort of access could be considered as a potentially legitimate feature (think, customer support and remote diagnostics).

<comment><USER9> And cable modems download their configuration from the ISP's CMTS when they're powered on.

<comment><USER15> I could almost bet that they don't even validate certificates, IF they use any kind of encryption at all...

<comment><USER13> Nope. [https://defcon.org/images/defcon-18/dc-18-presentations/Blak...](https://defcon.org/images/defcon-18/dc-18-presentations/Blake- bitemytaco/DEFCON-18-Blake-bitemytaco-Hacking-DOCSIS.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER10> ""The National Security Agency's foreign intelligence operations are 1) authorized by law; 2) subject to multiple layers of stringent internal and external oversight; and 3) conducted in a manner that is designed to protect privacy and civil liberties. As provided for by Presidential Policy Directive 28 (PPD-28), all persons, regardless of their nationality, have legitimate privacy interests in the handling of their personal information. NSA goes to great lengths to narrowly tailor and focus its signals intelligence operations on the collection of communications that are most likely to contain foreign intelligence or counterintelligence information.""

<comment><USER6> Even if the oversight isn't that great (do we know how much abuse happens?), it does make sense that they would try to narrowly focus their ops. It doesn't actually benefit them to spy on random users. At the end of the day, we can only assume most of the agents do actually want to get "bad guys". (As compared to say, me, who'd love to have an XKS login for the trolling possibilities alone.)

</comment></comment><comment><USER16> Now comes the hard part of wondering what to lookup. Shall we search for financial crimes? Nah...by the time we develop the expertise to write the query the crime has changed. Shall we find the next Boston Bomber? Nah...even more complicated. So what do we look for? The easy stuff...Godzilla for example. Someone has to keep watch.

</comment><comment><USER17> The advantage of NSA revelations is that it helps to educate people to form a justified contempt for secret services and governments.</comment>


There are more guns than people in the United States - <AUTHOR> https://www.washingtonpost.com/ <comment> xkcd-sucks There's also more shoes than people in the United States

</comment><comment><USER2> _it goes on forever — and — oh my God! — it 's full of guns!_</comment>


Ask HN: What to do when facing a bootstrapping issue while integration testing? - <AUTHOR>

The abstract question I had:
What to do when faced with this situation: I need to test a piece of software for logical correctness. But the computation is so complex that in order to generate the test cases and expected results, I need the very program I am building.
Real Life situation:  I wrote an AI program for a class that plays the 9 men morris game. It implemented both MINIMAX algorithm and ALPHA-BETA pruning in order to find the best move given a current board position. How do I test if my implementation is correct? How do I generate the test cases because, it is very tedious (maybe not, but if it is) to work out game tree algorithms by hand?
PS: I am a beginner programmer and a CS student learning from my mistakes. One of my past failed project taught me the importance of unit testing. I am just trying to figure out what my current project is trying to teach me. So I apologize in advance if this is a totally newbie question. <comment><USER2> I have faced somewhat similar problems, testing complicated physics calculations. A few strategies:

\- There are special cases where it is feasible to do a calculation 'by hand' (actually with a calculator or a much simpler program). The complicated program should get (nearly) the same answer as the hand calculation in those special cases.

\- Any solution should have certain properties which it is feasible to check 'by hand'. For example in physics there are often conserved quantities (energy etc.). Or the output should change as a known function of one of the inputs, if you have a series of test cases where only that one input varies.

\- Instrument the program. Write assertions that check intermediate results. Each intermediate result should be a known function of preceding intermediate results - write code which checks that.

That last option is similar to the formal verification recommended in another answer. In flow-blown formal verification you try to write a proof that the intermediate result is the intended function of the preceding intermediate results, for all allowed inputs -- and then you produce a chain of such proofs from the input to the output. It is often much easier to just write code to check the intermediate results.

<comment><AUTHOR> Yes!, these strategies make sense: \- I could for example, run a tic-tac-toe game against the game tree algorithms and test it instead of nine-men morris game which is more complicated. I never thought of that!

\- I wonder if there is a systematic procedure than can enumerate the fixed properties for algorithms. I guess this is the hard part in formal verification theory.

</comment></comment><comment><USER3> Well, to throw in a wildly out of context Einstein quote: "We cannot solve problems by using the same kind of thinking we used when we created them.".

What I'm trying to say: you cannot generate a set of test problems using the program you are trying to test, unless you know the program is correct, which is probably why you want to test it to begin with (unless you are just writing tests to prevent regression). On a side note: if you ever find yourself working on machine learning, you'll find that the same goes for rigorously separating your training set and benchmark/test set).

Formal verification of software is hard. It's a huge field of research. If you really want to prove your algorithm is correct (not your implementation of it!), you're probably better off going the mathematical or formal modeling route. If you want to test your implementation, maybe you don't need to test every single case. A set of carefully hand-crafted test cases might go a long way.

<comment><AUTHOR> Thanks for your reply. Yes, my question pertains to testing my implementation of an algorithm, when hand-crafting the test case is hard to do.

</comment></comment><comment><USER4> Is there any way you can preset a search path in your algorithm? Since these are heuristics based, it wouldn't be a bad idea to walk a finite subset of the game tree for each side and ensure the "best decisions" are made. You could also test subsets of the algorithm's nodes to determine they are pruned properly. My background is mainly in NLP, so I only have the basic knowledge of game playing, but usually bootstrapping manually can and is the best route..

Usually tests are deterministic, but when you start throwing probabilities in the mix, a max likelihood/score for anything usually comes down to a hand crafted situation..

<comment><AUTHOR> Yes, compared to formal verification etc handcrafting seems much easier to do for most algorithm implementations.</comment></comment>


The Product Development Triathlon - <AUTHOR> https://www.facebook.com/notes/kent-beck/the-product-development-triathlon/1215075478525314 <comment><USER2> Kent Beck discovers the S curve. Of which Peter Norvig says

> You could say that Google makes its living by finding problems that have > this kind of shape [0]

Kent Beck says,

> I hope I've convinced you that this really is an awesome awesome stick.

No, not without an example.

[0] [https://www.youtube.com/watch?v=T1O3ikmTEdA&t=22m55s](https://www.youtube.com/watch?v=T1O3ikmTEdA&t=22m55s)

</comment><comment><USER3> The Conjoined Triangles of Success

</comment><comment><USER4> Maybe something is going around today. I just published a similar article about how a start-up is not like a marathon, but more like the tour de france [https://medium.com/@pedalpete/a-startup-isnt-a-marathon- it-s...](https://medium.com/@pedalpete/a-startup-isnt-a-marathon-it-s-the- tour-de-france-a36d0754b6c2)

<comment><USER5> Full of drugs, male-dominant, and if you removed all the cheaters you wouldn't know the name of the one guy left?

</comment></comment><comment><USER6> from the comment section in the article:

> Part of the key is letting go of the idea of experiments "failing". An > experiment only fails if you fail to learn from it. Experiments should turn > out the way you expect half the time, if you want to maximize learning.

i guess the principle being propounded is that of 'fail early and fail fast' or be wrong as fast as you can. because, to be wrong as fast as you can implies that you sign up for aggressive and rapid learning. more importantly, failure is a manifestation of learning and exploration. if you are not experiencing failure then you are making a far worse mistake...

as in science, experiments should be considered fact-finding missions that over a period of time inch towards greater understanding. which implies, that _any_ outcome is a _good_ outcome, because it yields new information. if your experiment proved that your initial hypothesis was wrong, better know it sooner than later.

unfortunately, this is easier in a lab, than in business :(

<comment><USER5> I look at it from the perspective that Google, Facebook, Microsoft, etc., are all giant tombs of knowledge. I mean can you imagine all the engineering solutions at Google only in random memos, emails, and water cooler talks? Even if you fuck up colossally as long as you add SOMETHING to that tomb it's contributing to the company.

</comment></comment><comment><USER7> Reminds me of David Andersons talk about risk profiles [https://m.youtube.com/watch?v=YBPa0FE4hRs](https://m.youtube.com/watch?v=YBPa0FE4hRs)

</comment><comment><USER8> Mods, please add Kent Beck to the title

<comment><USER9> It looks like you've been downvoted, but I think it's notable that Kent Beck, the creator of Extreme Programming, has written something that includes: "what if those waterfall folks aren't wrong, what if they are solving a different problem than I'm solving?"

<comment><USER10> I thought you were paraphrasing. That's exactly what he wrote!

This is an interesting article IMO. I don't think many of the organizations I've worked in are mature enough to shift their process as they cycle through these phases, though.</comment></comment></comment>


Defense of Amazon's Face Recognition Tool Undermined by Only Known Police Client - <AUTHOR> https://gizmodo.com/defense-of-amazons-face-recognition-tool-undermined-by-1832238149 <comment><USER2> « Currently, the only known law enforcement client using Rekognition is the Washington County Sheriff's Office in Oregon. (Other clients may exist, but Amazon has refused to disclose who they might be.) Worryingly, when asked by Gizmodo if they adhere to Amazon's guidelines where this strict confidence threshold is concerned, the WCSO Public Information Officer (PIO) replied, "We do not set nor do we utilize a confidence threshold." »

That's worrisome indeed. Understanding confidence thresholds is _essential_ to using software like this. Thinking they don't "utilize" one means they don't understand the first thing about it.

<comment><USER3> > Understanding confidence thresholds is essential to using software like > this. Thinking they don't "utilize" one means they don't understand the > first thing about it.

Thresholding is not the only way to make use of a classifier that ouputs a confidence score. In particular, the slide shown in the article indicates that they use the confidence score to sort search results in descending order. That means that there is no fixed threshold and the PIO's statement is not worrisome at all.

The system described is much less dangerous (in terms of overconfident decisions) than one that only returns results matching a threshold, because it means that the user also occasionally sees low-confidence results and learns that they can't simply defer decisions to the machine.

<comment><USER4> Unless the cops aren't exactly virtuous actors... which they frequently are not. You can't assume they care if the results are good.

It is another tool to justify police action with a low true positive rate.

<comment><USER5> > It is another tool to justify police action

"We were following the AI _leads_ " is the perfect excuse for parallel construction[1] (evidence laundering).

If Rekognition supports limiting the search to the people in a specific town (or other small group), it might be possible to force someone to be _somewhere_ on the list of matches. That would give bad actors the perfect tool for manufacturing "probable cause".

[1] [https://en.wikipedia.org/wiki/Parallel_construction](https://en.wikipedia.org/wiki/Parallel_construction)

<comment><USER6> If parallel construction is in your threat model then does the existence of a slightly better face search database really matter?

<comment><USER7> Damn, beat me to it

</comment></comment></comment></comment></comment></comment><comment><USER8> If all of your users are using your product wrong, the problem is not your users.

</comment><comment><USER9> I should do a version 2.0 that just has a colorimeter and a probably cause light.

</comment><comment><USER10> This article, and all the "fear of FR" articles in general do not describe how FR is used. 'What is the process of an FR analysis' sure would be useful in this discussion.

It's quite simple: a face image is submitted, and then a sorted by "match score" result is available. This is the same gallery, now sorted in respect to the submitted face image. That "confidence threshold" (also called verification threshold, and a number of other similar terms) is the threshold within the sorted results after which one can generally discard possible matches between the submitted face and a face in the gallery because the similarities between the submitted face and the candidate face have little resemblance. Imagine a series of faces on a horizontal row: the left-most is the highest match score, and moving right is the next highest in the sort, and so on moving to the right. The left-most image looks the most like the submitted face image, and as one moves right each image is a little bit less similar.

This confidence threshold loses accuracy when a) the submitted image is a less than a perfect image (often the case), b) the gallery is composed of images that are less than perfect (often the case), and even c) the types of cameras used to generate the images are radically different, with different dynamic ranges and potentially poor video encoding parameters. As a result, a few things are done: 1) multiple images (even if less than ideal quality) (and if available) are added to the gallery for each person, and 2) the confidence threshold is treated as a soft number, with sliders even to dynamically grow and shrink the net cast by the analysis. Also notice this is interactive - that implies a human operator. The entire FR process is a selection guidance tool, not an authoritative selection tool. The FR operator is keenly aware of the fact that they are sifting through a large number of low quality data points. FR is a tool to help sift sand.

Disclaimer: I am a lead developer of a leading FR product. Not Amazon's.

Also, to speak about racial bias in FR: it is a stretch to call it "racial bias", perhaps more of a "low facial dynamic range invisibility". Both people with very dark skin and people with very pale skin have the same situation: there is very low variation from the brightest non-highlight part of their face to the darkest part of their face. This means there is very little distinguishable information for FR to use, if it can even identify the portion of an image that contains a face. Such individuals are simply hard to see with FR, and when identified and tracked as a face, there is very little information to use for differentiation. I don't know if I'd call that a "racial bias". These people are almost FR invisible, which benefits them in this situation, making them very hard to distinguished with FR analysis.

<comment><USER11> > I am a lead developer of a leading FR product.

Wish you'd spend your time on something that will move the needle in a more positive direction. The long term applications of the tech that you are making are downright scary.

<comment><USER10> Who do you think is correcting FR users misunderstandings and insuring the poor practices you're reading about do not come true? I think my skills are critical here.

<comment><USER12> What makes you think that you (or anyone else for that matter) are capable of preventing the abuse of FR? I appreciate that you and many others in the space are working with the best intentions, it just seems like any potential benefits of FR are dwarfed by its potential use as a tool of oppression.

<comment><USER10> What makes you think that you (or anyone else for that matter) are capable of preventing the abuse of FR by walking away and declaring an easily created technology simply taboo? It is going to be developed, like it or not. May as well have intimate knowledge of it, help to educate others, and actually know how to defeat it. Walking away you're just blind.

</comment></comment></comment></comment></comment><comment><USER13> This article is kind of buzzy, doesn't really make sense, and never actually states what amazon is defending their tool from.

<comment><USER14> A poor understanding of ROC curves. A concept that is surprisingly difficult to explain to people with low maths abilities and will lead to misuse. Even without the "confidence" not being a true probability. My anecdote is I made a classifier to speed up the search through a list of images. It worked great and saved lots of money. There was an auto accept (no review) for a confidence greater than 95%. After a while they get back to me and say "we have run some analysis and it is getting about 5% or the auto accept wrong, how can we make it get them all correct?". Of course set the threshold to 100%. But then it doesn't accept anything. Then give me a few years and more devs to develop the classifier to make it more powerful. Can't you just tweak it to make it better... And so it goes</comment></comment>


Study: Teams work best when members are physically close together - <AUTHOR> http://www.collisiondetection.net/mt/archives/2011/01/_when_i_wrote_a.php <comment><USER3> This is a topic very interesting to me, because over the years I've written a lot of call center and customer service software used by distributed teams. I also worked as a developer remotely for Linden Lab for long time, which had a highly distributed workforce, using Second Life and other things as a primary interaction platform. There are things I've observed when writing software used by distributed teams that make a huge measurable difference in productivity.

When working remote, it's easier to feel like it doesn't really matter if you put your nose to the grindstone, since nobody can tell. So I found it made a dramatic difference in productivity when I implemented a simple sidebar that showed what ticket each member was working on, and how long they'd been working on it. It was intended to be sort of like an office: in an office, when you see your team members working away, it's a little more emotionally difficult to take time off to surf your favorite website or something.

For customer service, video game mechanics help a lot: completing each ticket gets you closer to your goal. Keeping quality metrics up gives you a visible indication that you're a good person. It's not easy to implement and sell these kinds of features, but it's also not easy to keep people motivated (whether they're remote or not).

Scrum and frequent voice communication help a lot as well. There are downsides to distributed teams, but there are big upsides, as well. Distributed teams, while not perfect, have many benefits. The key to making it work, as with so many things, is to figure out ways to make everyone care and want to do their best. In absence of that vital culture of giving a shit, even a team that's co-located together is not going to do well. In my experience, that culture of excellence is even more important than being in the same place.

<comment><USER4> Is there an example of the sidebar you're talking about that we can look at?

</comment></comment><comment><USER5> "So they gathered info on 35,000 papers in biomedical research where there was at least one Harvard author, calculated where the authors lived, and examined how influential the papers were — based on how many citations they received."

Hmm. The papers they looked at were from 1993 to 2003, and remote collaborative technology has improved a lot since then. Other teams may have very different dynamics that biomedical researchers and Harvard professors. Hard to know what to take away from it.

<comment><USER6> If you took 35 startups that span continents and are no more than 2 years old I think the results would be significantly different.

I've worked in close proximity and remotely - you can't beat a small team of motivated developers working where they are most comfortable - <USER2> through Campfire, Google Docs and Github.

</comment></comment><comment><USER7> It has been my experience that _if all other things are equal_ , working together beats working remotely.

Of course, if you are a young startup and you have a choice between an ok hire working locally and a star working remotely, all other things are not equal.

Some companies would always take the local guy. Some would hire stars wherever they find them. Some would hire neither and wait for a local star. I certainly can't generalize about which strategy is the best.

<comment><USER8> please dont say 'star.' please.

<comment><USER7> "Star employee" is a term with plenty of history and a meaning most people grasp. "Rock star" is another thing entirely, and not what I think of when hiring programmers. I also don't think of hires as prestidigitators or thaumaturges, even when using the term "magic" to describe technology.

</comment></comment></comment><comment><USER9> I've had very good results working with the owner of Set For Marriage, despite him living in Houston and me always either in San Diego or Olympia.

I think the reason is because we talk on the phone or over Skype throughout the day and coordinate things over Basecamp. I'm not sure if it helps that I'm the only developer on the project right now and mostly have creative control (he's down with anything as long as it sounds good), but we're hoping to get another developer on board soon so I'm curious to see how it works out.

It has been difficult working with some remote clients in the past where there wasn't that level of communication, and I've found that daily phone calls work much better than even chatting over instant messenger. I'd like to see how Campfire would work out, but it's difficult to get people to stay on Campfire all day unless they're completely sold on the idea.

</comment><comment><USER10> Co-location saved a big project at a crucial point, after I had done my best to inject a wrench into the project.

A few years ago, I raised some concerns about the hacks we were doing at the end of a sprint review session. As part of the innocent "does anyone have anything else to say". This completely derailed everyone and the senior product management was surprised. This was about 60% into a 1.0 product. As a result, our scrum master and tech lead flew the other two members of our team who were remote in - and we had intense/design/coding sessions in a conference room for a very long week. We were able to address all of the hacks and get on the right track going forward. With my unsolicited comment, I was able to surface a lot of what was being unsaid (remember, techies at times of stress can tend to clam up). By co-locating the entire team for one week (on very short notice - travel arrangements were made the next day), our tech lead was able to address the problem straight on and bond our team stronger.

I can personally attest that my best coding sessions have all been pairing in person. Face to face is still the best collaboration mechanism out there. Even the best Campfire session is just a transcript of the human drama.

</comment><comment><USER11> I wonder why MS found a different result when they studied the issue: Does Distributed Development Affect Software Quality? An Empirical Case Study of Windows Vista, [http://research.microsoft.com/apps/pubs/default.aspx?id=1382...](http://research.microsoft.com/apps/pubs/default.aspx?id=138224)

<comment><USER12> Two things leap out at me:

1\. The OP's study and the MS study were studying people in different fields.

2\. The OP's study and the MS study are studying two different things. The OP's study measured how many citations published papers got, while the MS study measured a lack of bugs. So you might be able to say that collocated workers produce better quality work but don't make significantly more mistakes.

</comment></comment><comment><USER13> I'm a developer who usually works remotely. I agree that people work better together when they are in the same place, but by having a distributed team you are not restricted to recruiting just people from a certain area and so the standard of the people in the team can be higher. So for teams that require a fairly specific skill set, teams that are recruited from anywhere in the world and working remotely would often outperform teams recruited from one area who work in the same place.

</comment><comment><USER12> I think this subject is more nuanced than these studies. A few things that come to mind:

* Do the personalities of the workers have an effect? I would imagine that introverts could handle remote collaboration better than extraverts.

* Does the type of job matter? For instance, I would imagine that it might be a lot more difficult to build a remote team of investment bankers than it might be to build a remote team of programmers.

* Are certain phases of a job easier to handle remotely? For instance, perhaps coming up with an architecture needs to be collocated but the actual process of coding might be more productive if handled remotely. Or perhaps writing a research paper can be handled remotely, but editing it needs to be collocated.

I do find the third of these points the most interesting though. It might be possible that there are certain parts of a project that are bottlenecks unless collocated. Thus, it might be possible to build a remote team, but fly them in for critical parts of a job.

Regardless, I think this study is interesting, but I'd take it with a grain of salt. I don't doubt that this is true for the average person. But that's really not relevant. What's relevant is whether it's true for _your_ team and _your_ job.

<comment><USER14> >> * Does the type of job matter? For instance, I would imagine that it might be a lot more difficult to build a remote team of investment bankers than it might be to build a remote team of programmers.

>> * Are certain phases of a job easier to handle remotely? For instance, perhaps coming up with an architecture needs to be collocated but the actual process of coding might be more productive if handled remotely. Or perhaps writing a research paper can be handled remotely, but editing it needs to be collocated.

Nitpicking, but I think the 3rd question is invalidating the way the 2nd is phrased. Comparing investment bankers and programmers is difficult to put as apples to apples. Easier to compare investment bankers to architects or analysts to programmers at a detailed level (although admittedly many investment bankers would be their own analysts, just as many programmers would be their own architects). Perhaps the 2nd question would be better phrased as "Does the type of industry matter", rather than "Does the type of job matter".

Here's one anecdote of where it's easy enough for financial guys to have analyst work done by non-colocated people, and still achieve success: [http://www.businessinsider.com/pine-river-bejing-china- beiji...](http://www.businessinsider.com/pine-river-bejing-china-beijing- quants-math-geniuses-2011-1)

</comment></comment><comment><USER15> How is this relationship any different from saying that if two Harvard professors publish together it receives more citations than if a Harvard and non-Harvard (remote) professor publish together. Seems pretty obvious given that the quality of authors will go up, including the their ability to promote their work.

I'm always surprised how scientists do such bad social science even though they perceive social science as very bad science.

<comment><USER16> The same study found that collaboration inter-city is more productive than collaboration intra-city. That would not be expected by your "two Harvard professors" theory.

In any case it shouldn't be hard to reproduce with a larger sample of universities.

<comment><USER17> > _That would not be expected by your "two Harvard professors" theory._

Maybe, maybe not; consider that the other college "intra-city" is MIT, and presumably they also included Northeastern and BU and BC on the list. Just knowing that a professor teaches at a school in the Boston metro area raises the prior of them being at a top school.

</comment></comment></comment><comment><USER18> The most efficient I have ever been was when we had 4 of us sat around a large desk, a coder doing UI, a coder doing back-end, a user/business expert and a data-migration expert. When I wanted to check what was going on, I just had to twist my monitor and point at it to ask if I was doing the right thing. Vastly superior to even working 30 feet from someone else.

</comment><comment><USER19> I've always wondered about the efficacy of distributed teams. It's easy to see people all over the web that expound the virtues of not working in an office. 37signals comes to mind here, since they are always warning of how working together in an office is only distracting to productivity.

I've found it to be quite the opposite. When working together in a group, everybody seems to motivate each other and work gets done faster. That's why founders who share an apartment that doubles as an office seem to be most successful IMO (insert marriage joke here).

In the end, my guess is it just comes down to either team size or personal work style. There's no one rule that can be applied to everybody. Obviously, if you have a team of more than 20 people, being close together isn't going to make much difference since you aren't interacting with everybody anyway.

The last line regarding having people brainstorm separately is particularly interesting though:

"That's because the problems of face-to-face dynamics go away: The "virtual" group is better."

</comment><comment><USER20> My co-founder has been out of town for about a month now and while not substantial (yet), I see my productivity sliding. I have come up with some hacks to prevent this. But there is a kind of intensity/momentum that gets generated when the two of us are in the same room. The effects of colocation are probably different on different people but in my case at least, I need to be in close proximity to my team.

</comment><comment><USER21> Within the, slightly mumbo jumbo, world of research into team dynamics (yes it exists, yes it is a surprisingly large field) they relate this to something called "information richness".

i.e. Speaking to someone face to face includes visual and tonal clues to accompany the information. Digital communications can be a lot less rich (the worst being discussion forums and similar) which causes all sorts of complexity problems - a lack of engagement, misunderstandings, offence taken at wording (we all know how tough sarcasm is to convey online I am sure).

Then you factor in the problems of different timezones, company and country cultures and varying tool preferences and, yes, it seems obvious that virtual teams will suffer.

This paper seems pretty good from a quick read through; however I think there is a big caveat - they are studying academic research papers. Which is fine, but only one data point.

A lot of effort has been put into new management techniques for remote teams and, nowadays, _within a corporate project_ you will often find virtual teams working as efficiently as (or even better than) co-located equivalent.

But you need a good team manager to pull it off.

</comment><comment><USER22> I've worked remotely for 10 years. 5 different startups.

Its had its ups and downs, but its working better now that ever. We're using an always-on collaborative tool that removes all the friction: Sococo.com

Our project has taken 3 years and involved Engineers/managers in 4 states. We've interacted daily and in a ad-hoc manner. Now we're doing Agile development to some degree, and thats working too.

The article mentions Skype etc. We're way beyond that. Any conclusions may be stale.

<comment><USER23> Why do you use sococo. I just visited the site and it just looks like skype with a weird Office UI ? Is there more to it?

<comment><USER24> Possibly because he works there?

<http://www.linkedin.com/pub/joe-altmaier/6/38b/996>

<comment><USER22> You bet! I spent 3 years of my life consulting with these folks, helping with architecture, coding the network and voice components, recruiting for the UI and server-side.

It started being useful two years ago. We were our first users. Our productivity climbed, and our travel bill halved immediately.

Its nothing like Skype. No "phone call" model at all. You're instantly connected, can see everybody in your group at all times, you can tell who they're talking to, when they're done.

The map feature is more useful than it might seem. You can tell what your team members are doing, who they're talking to, whether the staff meeting has started, if Bob is in today etc.

I didn't call out my involvement this post, I've done that on half a dozen posts before, sorry.

</comment></comment></comment></comment><comment><USER25> The research is probably best applied to what it studied, producing 'influential' research papers.

It could well be that the papers were more 'influential' because with having the team co-located it got enough notice within the network to gain popularity. What I mean by this is that with 5 people in a concentrated area talking about a paper that it got to the 'front page' of what academics in the area were working on.

It's like saying teams work better closer because those teams got more links to the front page of HN because they each upvoted the story enough to get it on the front page where it could gain enough votes to stay.

</comment><comment><USER26> To say that this study doesn't support the broad conclusion is being generous.</comment>


A Time-Lapse Map of Every Nuclear Explosion - <AUTHOR> https://youtu.be/LLCF7vPanrY <comment><USER2> Funny how they made such powerful weapon, that could potentially wipe out life from the entire planet, sound muscially pleasing in this video. Old school cool.</comment>


World faces deflation shock as China devalues yuan at accelerating pace - <AUTHOR> http://www.telegraph.co.uk/business/2016/07/07/world-faces-deflation-shock-as-china-devalues-at-accelerating-pa/ <comment><USER2> It seems the only problem this will create is capital flight.

Since the Chinese typically use USD for payment (Euro also), this will only effect those who would convert USD to Yuan. It will also make foreign brands more expensive for the average Chinese.

Look to Real Estate getting more expensive in the US, Canada, Europe. It is a favorite for Chinese moving their wealth out of the country.</comment>


Is there anything you wish you knew at 16 as you made decisions that shaped the rest of your life? - <AUTHOR> http://reddit.com/info/5yvva/comments/

<comment><USER2> Be very careful with advice from people who don't know you and don't necessarily care what happens to you, i.e. people on some anonymous forum.

For example, #1 on the highest rated comment is horrible advice. It has screwed up the lives of many, many people and will adversely affect all the future relationships of anyone lucky enough to get away with it.

<comment><USER3> Seems like arbitrary morality is the only thing against safe sex.

<comment><USER2> Even if all you care about is yourself, this isn't true. Plato explains this in the Republic. Indulging in extreme pleasures dulls their effect, while making us want more extreme pleasure. This makes us more dependent upon the changing world and at the mercy of our bodily desires and others. Not a recipe for a fulfilling life.

<comment><USER4> You're preaching ascetic suspension of earthly desire in the Make Something People Want forums?

<comment><USER2> Where did I say that? I suspect you are just jumping to conclusions based on the fundamentalist stereotype; not that I'm one of those, either. There is a position inbetween having alot of promiscuous sex and having no sex. I am merely stating why I think alot of promiscuous sex can be a problem. People are, of course, free to do whatever they want and don't have to listen to me.

Anyways, I'm not trying to be a troll. People keep misunderstanding or needing elaboration, so I explain and elaborate. If people ignored what I said I wouldn't see a need to keep posting.

</comment></comment></comment></comment></comment><comment><USER5> I recently sent this link to my 16 year old brother: <http://paulgraham.com/hs.html>

There's a lot in there I wish I'd known.

</comment><comment><USER6> _Make good friends. Hang around smart intelligent educated 'moral' people. Form networks - these networks matter to get jobs, etc. Remember, 90% of the good things you get in life (jobs, stock tips, hot dates) will be informally, via your network of friends/colleagues._

On my first day of high school, my dad gave me a priceless piece of advice: Don't be friends with people just because they're available and easy to be friends with. Seek out the people worth befriending, and become their friend no matter how hard it is.

I didn't really understand him at the time, but 15 years later it strikes me as one of the most valuable things anyone has ever told me.

<comment><USER7> This is expected advice from a father, as mine dispensed something similar as well.

But those described are not friends, but merely partners.

To me, friends are those who will be around during bad times as well as good. In other words, they'll be around even when your "worth" is very low.

<comment><USER6> Yeah, that is an important distinction.

</comment></comment></comment><comment><USER8> Not all that much, really. I'm mostly satisfied with the decisions I made up until my 3rd year of college or so. And given that a lot of the problems that began then were related to a relationship, I'm not sure that there was anything I could have known that would have made a difference.

</comment><comment><USER7> \- start your spiritual journey asap

<comment><USER9> how about a rational exploration instead

<comment><USER10> same thing</comment></comment></comment>


A Statistical Error in the Estimation of the RDA for Vitamin D - <AUTHOR> https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4210929/ <comment><USER2> Yesterday's discussion: [https://news.ycombinator.com/item?id=15867918](https://news.ycombinator.com/item?id=15867918)

</comment><comment><USER3> I wonder Vitamin D deficiency is to blame, or a major factor, in the increasing rates of depression. My personal hunch tells me that it's not simply due to people becoming more willing to seek treatment. Wikipedia [0] mentions that vitamin D supplementation typically shows no effect for patients with depressive symptoms and only moderate effect for patients with diagnosed/diagnosable depression, but from reading the linked article [1] it seems like the studies they base this research on perhaps weren't using enough Vitamin D according to the new research

[0] [https://en.wikipedia.org/wiki/Vitamin_D#Other_conditions](https://en.wikipedia.org/wiki/Vitamin_D#Other_conditions)

[1] [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4008710/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4008710/)

</comment><comment><USER4> TLDR;

> It also estimated that 8895 IU of vitamin D per day may be needed to > accomplish that 97.5% of individuals achieve serum 25(OH)D values of 50 > nmol/L or more.

Compare that with 600 IU (current "Recommended Dietary Allowance").

A word of caution though:

> As this dose is far beyond the range of studied doses, caution is warranted > when interpreting this estimate. Regardless, the very high estimate > illustrates that the dose is well in excess of the current RDA of 600 IU per > day and the tolerable upper intake of 4000 IU per day [1].</comment>