Ask HN: Automating large Enterprise business operations - <AUTHOR> Hi HN. I'd like some advice about automating business operations - what to consider, what technologies or framework to look out for etc. For background, I'm working for an ICT service provider, and just got promoted to look into enterprise-wide automation and system. My team is small, but I report directly to the C-level. Frankly, I'm a hobbyist programmer, and was only promoted to this post due to my enthusiasm and small track records i.e. handling CSV files for analysis etc.
The ultimate goals are to improve lead time in service delivery, reduce aging tickets, and reduce cost. I currently see gap in performance management, where the bosses do not have clear visibility or simply do not trust the performance metrics.
Simultaneously, there are lean internal consultants doing studies and making recommendations. Also, middle managers are being trained in Six Sigma, acquiring "belts".
To reiterate, how do I start assessing the situation and what kind of technologies or methodologies associated with this scenario? Is it SOA, workflow engine, ERP etc? How feasible is using standard web framework i.e. Django or Flask for business automation?
Thanks. <comment><USER2> This is a LOT to read up on, but seriously consider mesos + aurora. It is really incredible stuff and Twitter uses it for huge production environment. The Mesosphere guys have better documentation with Marathon, but it has a lot of catching up to get to the feature set of Aurora.

I happen to be the tech lead of a team that builds internal tools for an "enterprise" company primarily using Django and Flask. Build it and then show the business how it is useful. Sadly, that means you might need to write a lot of high quality docs or high quality clients (if you write an api). I tend to favor "api first" development.

<comment><AUTHOR> who ended up maintaining the internal tools? do you hand it off to the IT team?

<comment><USER2> My team, who writes those tools for the 'IT Team', but really the entire company ends up consuming them.

Our company's bread and butter is low latency stuff and we're a small team of webdevs who exist in the IT side of the company, but code fulltime. I quite enjoy it actually.

</comment></comment></comment><comment><USER3> That's a pretty big, open question. There's a ton of literature out there that you could (and probably should) read, and no simple HN post can do justice to the scope of process automation / BPM / workflow, etc.

For some background on business process / workflow automation, a few good books to review would include:

[http://www.amazon.com/Essential-Business-Process-Modeling- Mi...](http://www.amazon.com/Essential-Business-Process-Modeling- Michael/dp/0596008430/ref=sr_1_31?s=books&ie=UTF8&qid=1419303981&sr=1-31&keywords=bpm)

[http://www.amazon.com/Fundamentals-Business-Process- Manageme...](http://www.amazon.com/Fundamentals-Business-Process-Management- Marlon/dp/3642331424/ref=sr_1_34?s=books&ie=UTF8&qid=1419304137&sr=1-34&keywords=workflow+automation)

[http://www.amazon.com/Smart-Enough-Systems-Competitive- Autom...](http://www.amazon.com/Smart-Enough-Systems-Competitive- Automating/dp/0132347962/ref=sr_1_1?s=books&ie=UTF8&qid=1419304165&sr=1-1&keywords=smart+enough+systems)

[http://www.amazon.com/Social-BPM-Bpm-Workflow- Handbook/dp/14...](http://www.amazon.com/Social-BPM-Bpm-Workflow- Handbook/dp/1461146305/ref=sr_1_1?s=books&ie=UTF8&qid=1419300569&sr=1-1&keywords=social+bpm)

[http://www.amazon.com/iBPMS-Intelligent-Systems-Workflow- Han...](http://www.amazon.com/iBPMS-Intelligent-Systems-Workflow- Handbook/dp/0984976469/ref=sr_1_2?s=books&ie=UTF8&qid=1419300569&sr=1-2&keywords=social+bpm)

[http://www.amazon.com/Real-Life-BPMN-Analyze-Automate- Proces...](http://www.amazon.com/Real-Life-BPMN-Analyze-Automate- Processes/dp/1480034983/ref=pd_sim_b_8?ie=UTF8&refRID=1YW0HA39FP97W6RBE47T)

That said... for starters, I'd back up to the issue of truly understanding the business need you're trying to address, and figure out a methodology for mapping the technological capabilities you will implement, to the business strategy. To that end, I'm a fan of a technique called "capability cases", and actually wrote a series of blog posts on that topic a while back. I'll refer you there for more on that topic:

[http://fogbeam.blogspot.com/2013/01/why-capability-cases- are...](http://fogbeam.blogspot.com/2013/01/why-capability-cases-are-must- when.html)

[http://fogbeam.blogspot.com/2013/02/so-what-is-capability- ca...](http://fogbeam.blogspot.com/2013/02/so-what-is-capability-case- anyway.html)

[http://fogbeam.blogspot.com/2013/05/capability-cases-part- th...](http://fogbeam.blogspot.com/2013/05/capability-cases-part-three- sample.html)

The other positive thing about the Capability Cases methodology is that it helps IT people learn to "speak the language" of LOB executives (and, to some extent, vice versa, if everybody buys in), and helps bridge that gap between "the business side of things" and "the IT side of things".

Anyway, if you get through all that and decide that some sort of BPM system is for you, there are a handful of high quality, popular, Open Source BPM engines out there that you could consider. If nothing else, they could enable you to get to a good POC quickly and without spending a bazillion dollars. One popular option is Activiti:

[http://www.activiti.org](http://www.activiti.org)

It uses the industry standing BPMN2 notation. Stay away from anything that mentions BPEL, and stay away from Oracle products. Especially Oracle products that involve BPEL.

Depending on how complex your needs are, you might not actually need a dedicated BPM / workflow engine. In that case, you could certainly code up automation code in any general purpose language of choice. But be careful of going down the path where you wind up rebuilding the wheel.

I'd also advocate taking a careful look at the idea of "Social BPM", which focuses on making BPM systems more flexible and less rigid, and introducing aspects involving social connections between humans.

I'm not trying to be overly self-promotional here, but I will refer you again to a couple of posts I have previously written on this subject, which may be of use to you:

[http://fogbeam.blogspot.com/2013/05/social-events-bpm-oh- my-...](http://fogbeam.blogspot.com/2013/05/social-events-bpm-oh-my-but-what- about.html)

[http://fogbeam.blogspot.com/2014/02/on-solving-social- aspect...](http://fogbeam.blogspot.com/2014/02/on-solving-social-aspect-of- bpm.html)

Like I said, this is a big topic. I could talk about this stuff for days on end, or until you died from boredom. :-)

Seriously though, if I can be of any further assistance, feel free to drop me an email.

<comment><USER4> What do you think about [http://viewflow.io/](http://viewflow.io/) [https://github.com/viewflow/viewflow](https://github.com/viewflow/viewflow) ?

<comment><AUTHOR> Looks interesting. Any testimonials? Or community where it is discussed about?

<comment><USER5> Let me give a few notes here as i'm the author of django-viewflow. I stumbled with workflow problems in 2004, wrote simple django-fsm library in 2010, and decide that I could do more in 2013 with django-viewflow.

Common web frameworks like django or flask solves only technical problem related to HTTP/Client/Server functionality and nothing related to business logic organization except simple CRUD support.

It works pretty well if you going to create data entry applications for your business. Data entry applications allows end users to enter the data and do some queries and reporting. Basically you are offer for end user a set of forms for data entry, grid for end user queries and set of reports for things that couldn't be achieved with simple grid filtering.

The usage pattern for worker is to enter the data, run the query/report and decide what to do next. This style of applications allows unlimited ways for interaction for end users, and adopts many scenarios.

But very fast it became not enough. The breakpoint happens when you came with idea, that you need something like `STATE` or `STATUS` field for one of you entity. This probably happens when you try to organize workers pipeline and collaboration.

And this ruins your well designed CRUD application. Mix of hidden state changes and crazy querying randomly scattered over the code makes hard to have a whole picture what really happens. After a half of the year, team of 5 developers could produce working but cluttered application that really hard to change to adopt new business process requirements.

The core problem that common web MVC pattern have nothing related to people collaboration. Fortunately there was a lot of research in this field, starting from 198x.

And the answer is - we need an explicit workflow layer (yeah, so pythonic)

You can take a look to [http://www.workflowpatterns.com/](http://www.workflowpatterns.com/) It's pretty formal and hard to read, but it contains set of common patterns that happens when you trying to describe people workflow.

From historic point of view, there was discussion - what is the best way to represent people collaboration visually, what building blocks should be used and etc. In the 2004 there was several popular approaches for this like ebXML, BPEL, and many other formats.

At the 2014 we have the answer - only BPMN products became successful with the time. I think you will not very surprised with this fact, if you will know that BPMN is the only format designed for understanding by humans first. Other formats was designed like bad visual programming language and they are failed.

The core difference of BPMN that you have a gate nodes explicitly separated out of task nodes. This give you unlimited amount of flexibility, and most systems allows to skilled programmer develop very custom gate logic to accommodate all process requirements, embedded into reusable flow building block.

And the last part. The rise of workflow systems happens in the 200x. There was the time when UI-only programs declared as the way to happy user experience. Missing UI tools for system administration was declared as main problem of Linux operation system. Nowadays, UI for administration mostly failed. Today is the rise of script languages like Chef, Salt, Puppet, and DevOps as profession for system administration.

This sort of things became happens even with existing workflow tools, like jPBM based [http://camunda.org/](http://camunda.org/)

I believe that should happens with any existing workflow software. With good designed library or language for workflow specification, developing application would be faster than any ui programming.

So, as the result of thoughts described above, Viewflow is the library that offers an additional layer for django web framework allows explicitly specify people workflow and takes out the workflow logic from django views.

You can take a look for shipment views example, when I start i didn't expect that so complex workflow could be exality extracted out of the views - [https://github.com/viewflow/viewflow/blob/master/tests/examp...](https://github.com/viewflow/viewflow/blob/master/tests/examples/shipment/views.py)

The future of workflow looks like we will have not only well specified business process but mix of process and cases to accommodate best things from data entry and workflow application styles. There is even existing standard for this - CMMN. And it looks like it would be very soon implemented in many workflow tools.</comment></comment></comment></comment>


Review my new web app: connecting people with similar goals to help each other - <AUTHOR>

On our web app you can set your life goals, you can add obstacles to them and the community will help you solve them.
You can ask specific questions and the community will again try to do their best to help you out. We are also trying to connect you with people who have similar goals so you can help each other.
And we reward users for being active in the community with giving more attention to their goals.
If you are interested in checking it out --> http://www.targetgarden.com and the invitation key is: HNROCKS. Hope you like it!
We would greatly appreciate any feedback! <comment><USER2> I realize you're just in beta right now, but it would be nice to see a little more how the site works without having to sign up. The video is cute, but doesn't really say much about how it all works.

Without seeing what's inside, I'm not sure what separates your site from something like <http://43things.com/>

<comment><AUTHOR> Thanks for checking it. We indeed are in beta right now and you are correct with the sign up part. We actually had it first made in a way that you could check it out without having to sign up. But because if you went in without signing up the two widgets (the badges and timeline) were missing and we thought the user experience would be better with them. But if you're still interested in checking it out without having to sign up go to: www.targetgarden.com/explore directly. It still works.

What we hope will separate us from other sites, like the one you mentioned, is collaborative work on your life goals.

We are trying to set up the app in the way that the users will be stimulated to help each other with their life goals. The more positive feedback your answers or solutions to other peoples goals get, the more traction your own goals get. How? Well for now you appear in the users who helped section(now there is just one user:) more often and you also appear with the profile of every user that you gave help to.

Have fun! Roq

</comment></comment><comment><USER3> It's broken on Chrome, Firefox works okay.

<comment><AUTHOR> Thank you for letting us know, we'll check it out.

</comment></comment><comment><AUTHOR> clickable link: <http://www.targetgarden.com/></comment>


Ask HN: How to prove that I have been hacked? - <AUTHOR> My IP address has been blocked by some websites in these 4 days. I did not do anything illegal or post any illegal or provoking comments. I also feel that I have been hacked, everybody can see my activities with or without Internet connection.<p>What should I do to at least provide evidences that I am being hacked? <comment><USER2> Have you played around with running a Tor node in the past? Some websites have block lists that automatically block known Tor IPs and it's possible that you ended up on a list like that.

<comment><AUTHOR> I never play with tor node.</comment></comment>


Media misreports study showing women code better than men. Here's what's unsaid - <AUTHOR> https://www.techinasia.com/women-coders-men-better <comment><USER2> That paper seems somewhat suspect. In their interpretation, they essentially hang their hat on the most _suspect_ data that shows a percentage difference that just might lie in the margin. Scanning their other figures, the, so- called "reverse discrimination" that other findings suggest are well outside the error bars they plot. It doesn't further inspire my confidence that the authors are _not_ psychologists but are _computer scientists_ , which might explain such they make the mistake of weighing small changes so much...although that's because my impression of CS people is they don't deal with empirical data that much, which I may be wrong about.

Their findings still might give evidence towards their hypothesis, but more because acceptance rates are _on-par_ with men instead of beyond men as it was when their gender is obscured.

</comment><comment><USER3> I remember being drawn into the world of computers decades ago. Online your physical characteristics were irrelevant, your words and ideas were all that mattered.

When I read articles like this, it makes me think that some people don't like that.

</comment><comment><USER4> If that vice article has taught us anything, it's that Diana Tourjee is sexist. As her vice article shows, whether or not she thinks that she views men as equals, men's actions are not being judged impartially.

</comment><comment><USER5> "[...] as much as we want to see gender equality in the workplace, this cannot come at the expense of credible reporting and nuanced debate."

Amen.

</comment><comment><USER6> did everyone miss the big-ass "NOT PEER REVIEWED" disclaimer on every page of that report?

Like, seriously, read the damn paper people [https://peerj.com/preprints/1733.pdf](https://peerj.com/preprints/1733.pdf)

<comment><USER7> If it's not ready, it shouldn't have been published.....

<comment><AUTHOR> The intent is to gather public feedback first before peer review. But I guess the media got a hold of it and ran too far with it.</comment></comment></comment>


12 proven ways to get your post to the top of digg - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2008/07/12-ways-to-get.html <comment><USER2> "Write what you believe, not what sells."

Godin doesn't do this at all. His books are filled with vapor and words that don't need to be coined.

The most frustrating part about Godin is this: even though 90-95% of his posts are either mediocre or trash, the remaining 5-10% are gold.

<comment><USER3> Im pretty sure he drinks the kool-aid, he makes.

</comment></comment><comment><USER4> Seth Godin's twitter stream is a set of links to his blog posts. He most certainly does some things just for the traffic. How couldn't he? He's a marketing guy.

</comment><comment><USER5> Does not deliver!</comment>


Ask HN: What is an SAP consultant good for? - <AUTHOR> Hello,
I have worked for the past 10 years as an SAP consultant and I pretty much I have had enough. I did not find it challenging, corporate culture is not something I value in high regard and I am more of a maker inside.
Almost a year ago I started with Android and have brought myself up to speed with it, at least I would say for a junior position. At the moment working on publishing my first app.
Do you think I am taking aright direction, how else could I maybe use my previous experience except for Project management and Product management positions? Mind you, I am 40 so a lot of people look at me like I did something very wrong by deciding to change my career. Your thoughts are welcome and encouragement also :)
Cheers! <comment><USER2> > a lot of people look at me like I did something very wrong by deciding to > change my career

No matter what you choose in life, lots of people will think you did something wrong; no option ever pleases them all and many individuals seek something to criticize, an outlet for their own unhappiness; any risk is just blood in the water for them. Also, the more vision you have, the fewer people will grasp it until the results are sitting in their laps, and not always then. They generally are ignorant about your life, often about these issues in general, and it's none of their business anyway. Their opinions are a non-issue; don't let the ignorant masses drag you down to their mean. Are they so happy?

That said, if you step out of your comfort zone expect to get kicked in the teeth and knocked on your a--, concussed and feeling defeated, a little more frequently. As long as you know that's part of the process, you can get back up again. The ignorant masses will say, "see! I told you so! I knew that would happen", like the stock broker who always says the stock will go down and gets lucky some days. Their idiocy is just comic relief. Make sure you know who really is loyal and cares about you; you only need 1 or 2; they are your support.

A bit of a rant, but I hope that helps.

<comment><AUTHOR> It does and thank you for it! Definitely stepped out of my comfort zone and at the same time that it is as it is, sometimes vague and stressful, it is this feeling of freedom that really makes up for it.

</comment></comment><comment><USER3> That SAP experience is a big asset in my opinion, and I am envious of you :-)

You know all the problems, the good, bad and ugly with SAP. You could create a product to do something better than SAP in an area where it under-serves customers.

Or create a product to improve the experience of using SAP for certain customers. Or better interfacing to other systems. There are many things you can build a business around with a massive potential global market, of companies with plenty of cash to spend (they purchased SAP after all!)

Definitely continue learning stuff you love as a 'maker'. I think if you can bridge the gap between the enterprise and cool 'modern' ways of doing things, you could be on to something.

<comment><AUTHOR> If you are envious in a sense you want to get into it, I would say it is possible. Depending on where you work now and what would you like to do but really a lot of the educational material can be found on internet. Their courses are too expensive and I would say all of it you can catch by reading the materials and having access to a SAP server.

Check this link for some more insights: [http://scn.sap.com/community/career- center/blog/2012/05/01/l...](http://scn.sap.com/community/career- center/blog/2012/05/01/learning-sap-when-you-dont-have-a-sap-job-already--web- sites)

</comment></comment><comment><USER4> People are always going to tell you that you made a bad decision. But in reality, it's up to you to decide how you can make the most of what you've accomplished.

There are always opportunities and advantages in what you do. You just have to know how to communicate that your experience with SAP for 10 years is valuable. An example would be that you're familiar with the enterprise software industry and you've been up great networks with your clients. By leveraging your experience, you can help startups sell better enterprise software and help them avoid pitfalls.

People told me I made a mistake starting my career as a software engineer at a smaller, startup-culture company. Then they told me I wouldn't be able to get into larger companies. I've got experience in both large and small companies and this makes me invaluable because almost all small companies aspire to be large companies. And I can help them navigate their journey. For large companies, I can help them become more innovative through my experience with smaller companies.

Bottom line: It's how you communicate and how you view things. You've got tons of potential and plenty to offer.

<comment><AUTHOR> Thanks for your insight, I would totally agree that in communication lies a lot, I guess I got a bit down with my attitude :)

</comment></comment><comment><USER5> You'll have those 10 years of experience in your back pocket in case of emergency. Until then, do your thing, take risks, learn and grow.</comment>


The usefulness of useless knowledge (1939) [pdf] - <AUTHOR> https://library.ias.edu/files/UsefulnessHarpers.pdf <comment><USER2> Essentially a very discursive 1939 collection of stories of scientists (Hertz, Maxwell, Faraday, Gauss, Ehrlich, etc) who "out of sheer curiosity" developed the background science that later led others to develop practical (and monetised) applications. There is some discussion of advantages and disadvantages of seeking knowledge for the sake of it, a brief mention of the (then) situation in Germany and Italy (where "the effort is now being made to clamp down the freedom of the human spirit") and it finishes with a glowing description of the Institute for Advanced Study (Princeton), where the author worked.

<comment><USER3> > essentially a very discursive...

I thought so too. But the topic is interesting. Mathematicians especially brag that what they do is valuable in proportion to its uselessness. Personally, I like spending time in useless things. Recently I was learning APL which is a totally useless endeavor for me. But then I look at other things I do and I cannot say that they are useful either. Then there is curiosity. There is no end to things to be curious about. I'm curious about so many things that I could never reach the end of curiosness with one topic. Curiousness or temptation comes at first as a very strong motivation but the next day the curiousness stregth diminishes and a new and stronger curiousness appears and attracts me so I go towards it forgetting the thing I was curious about the day before. Curiousness is also a question. We are curious means we are searching the answer for a question we asked or was asked to us. Something we saw or heard can show itself to us as a question. Then we go looking for its answer. But all answers raise more questions then they answer. So there is an infinite chain of questions. Curiosity is infinite. In her book The Manipulated Man Esther Vilar [1] writes that general curiosity for curiosities sake is a male attribute; a woman is curious only about things that have direct effect on her. This seems like a more sane and intelligent world view. That must be the reason all examples given in original article are men.

[1] [https://news.ycombinator.com/item?id=18692364](https://news.ycombinator.com/item?id=18692364)

</comment></comment><comment><USER4> If you revel in the joy of learning "useless things," that's fine. Just realize you are wealthy in time, energy and cognitive power being able to do that.

People learning "useless things" are often found in between pride and defensiveness. Wealth & ability can impress people. But dedicating so much time for yourself is sort of selfish.

The problem is that learning "useless things," which is rooted in a form play, turns into something more--that is a self-centered approach of securing yourself in a social hierarchy.

<comment><USER5> This is a bit dismissive of anything that considered valuable RIGHT NOW.

Gone are the humanities, the social sciences, the histories, the ancient linguistics, all of which depending on who you are could consider to be play around, while the rest of us serious people work for a living building software.

<comment><USER4> I left a math PhD program due to health reasons. Looking back, none of my reasons for studying math was for the potential usefulness of the ideas I was studying.

It was all for social status and personal play reasons.

Investing in ideas that may pay off in the future is an excellent idea. But except for the cream of the crop, few people will actually have their useless knowledge turn into something useful.

I suspect many people push this point about potential returns because they want to "get paid to play" as well as participate in a system that allows them to gain social status. If they convince others to support them using some argument about useless knowledge being useful, then they can continue in this way.

My only point is that I wish more people were open about that. Yes, research pays off, but if you are in a position of being able to learn lots of "useless knowledge," you are already doing well in terms of health, intellect and status. Don't bemoan too much about your life.

</comment></comment></comment><comment><USER6> You can order this very interesting and eminently revisitable essay in physical form from Princeton University Press:

[https://press.princeton.edu/titles/10924.html](https://press.princeton.edu/titles/10924.html)

</comment><comment><USER7> Ironically, the same author of that report, Abraham Flexner, destroyed accessible effective medicine for many people in the USA by essentially saying things like folk remedies, herbalism, cultural differences, gender differences, and so on were useless knowledge.

See: [https://en.wikipedia.org/wiki/Flexner_Report](https://en.wikipedia.org/wiki/Flexner_Report) "The Flexner Report is a book-length study of medical education in the United States and Canada, written by Abraham Flexner and published in 1910 under the aegis of the Carnegie Foundation. Many aspects of the present-day American medical profession stem from the Flexner Report and its aftermath. ... In a very short time, medical colleges were all streamlined and homogenized (all the students were learning the same thing) ... Flexner sought to reduce the number of medical schools in the U.S. to 31, and to cut the annual number of medical graduates from 4,400 to 2,000. ... A repercussion of the Flexner Report, resulting from the closure or consolidation of university training, was reversion of American universities to male-only admittance programs to accommodate a smaller admission pool. Universities had begun opening and expanding female admissions as part of women's and co-educational facilities only in the mid-to-latter part of the 19th century with the founding of co- educational Oberlin College in 1833 and private colleges such as Vassar College and Pembroke College. ... Flexner viewed blacks as inferior and advocated closing all but two of the historically black medical schools. His opinions were followed and only Howard and Meharry were left open, while five other schools were closed. His perspective was that black doctors should only treat black patients and should serve roles subservient to white physicians. The closure of these schools and the fact that black students were not admitted to many medical schools in the US for 50 years after Flexner has contributed to the low numbers of American born physicians of color and the ramifications are still felt more than a century later. ...When Flexner researched his report, "modern" medicine faced vigorous competition from several quarters, including osteopathic medicine, chiropractic medicine, electrotherapy, eclectic medicine, naturopathy and homeopathy. Flexner clearly doubted the scientific validity of all forms of medicine other than that based on scientific research, deeming any approach to medicine that did not advocate the use of treatments such as vaccines to prevent and cure illness as tantamount to quackery and charlatanism. Medical schools that offered training in various disciplines including electromagnetic field therapy, phototherapy, eclectic medicine, physiomedicalism, naturopathy, and homeopathy, were told either to drop these courses from their curriculum or lose their accreditation and underwriting support. A few schools resisted for a time, but eventually all either complied with the Report or shut their doors. ..."

Key treatment modalities abandoned as a result included spending time in the sunshine (which we now know gives you essential vitamin D), an emphasis on good nutrition (which is not a "procedure" doctors can be trained in and bill for), and other aspects of having a happier life like humor and so on (e.g. what Dr. Andrew Weil or Patch Adams write about). Alternative medicine has spent a century fighting back on such topics.

Another consequence of that report is that the American Medical Association and the "MD" established a stranglehold on medical treatments. MDs became in short supply and could charge large amounts of money. So medical treatment of any kind became much less accessible for most people. And when you did have money to pay a doctor, they would invariably be a white male and not a woman or minority who you might be able to relate to more easily if you were the same.

Also ironically, the Bamberger family, who wanted to give back to the city of Newark in some way for the success for their department store there by creating a medical school and teaching hospital in Newark, NJ, were instead talked into funding the physical creation of the Institute for Advanced Study in Princeton. Some of that is mentioned here: [https://www.ias.edu/flexner- legacy](https://www.ias.edu/flexner-legacy)

One big irony about Abraham Flexner is that he was very interested in hands-on education. While Flexner's excellent recommendations for making K-12 education "hands on" were ignored, his recommendation for making medical education "hands on" in terms of learning specific procedures were adopted by the mainstream instead of learning to see the bigger picture of a unwell person's life -- like Patch Adams advocated for instead with the Gesundheit! Institute. [https://en.wikipedia.org/wiki/Patch_Adams](https://en.wikipedia.org/wiki/Patch_Adams)

I have some other comments on that theme here: [https://pdfernhout.net/to- james-randi-on-skepticism-about-ma...](https://pdfernhout.net/to-james-randi- on-skepticism-about-mainstream-science.html) "The Flexner Report a century ago (1910) began a purging process of alternative medicine practitioners in the USA. It lead indirectly to people like Herbert Shelton for being persecuted and prosecuted decades later for telling people age-old wisdom that sunlight, whole foods, and occasional fasting (and avoidance of stuff like cigarettes) could cure or prevent most chronic disease, and could do it better than mainstream medicine at the time (something that modern medical science is grudgingly coming to admit). Herbert Shelton may not have had the whole truth, but he had part of a bigger older truth, and he was harmed by a mainstream medical-financial system by advocating for that truth from the past and from his own experience."

I also include there a section of the older version of that Wikipedia article since removed: ""The Report (also called Carnegie Foundation Bulletin Number Four), called on American medical schools to enact higher admission and graduation standards, and to adhere strictly to the protocols of mainstream science in their teaching and research. ... One of the consequences of Flexner's advocacy of university-based medical education was that medical education became much more expensive, putting such education out of reach of all but upper-class white males. The small "proprietary" schools Flexner condemned, which were contended to be have been based in generations-old folk traditions rather than relatively recent western science, did admit African- Americans, women, and students of limited financial means. These students usually could not afford six to eight years of university education, and were often simply denied admission to medical schools affiliated with universities. At the same time, the Report tended to delegitimize existing women doctors and doctors of color. While many such doctors continued to practice, usually within underserviced clienteles, they did so under proscribed circumstances and for less pay."

And as I also mention there, From Marcia Angell: "The problems I've discussed are not limited to psychiatry, although they reach their most florid form there. Similar conflicts of interest and biases exist in virtually every field of medicine, particularly those that rely heavily on drugs or devices. It is simply no longer possible to believe much of the clinical research that is published, or to rely on the judgment of trusted physicians or authoritative medical guidelines. I take no pleasure in this conclusion, which I reached slowly and reluctantly over my two decades as an editor of The New England Journal of Medicine."

So, while the IAS is indeed a wonderful place as far as it goes, it is too bad Abraham Flexner did not advocate more broadly on the topic of the value of a diversity of knowledge and a diversity of exploration by a diversity of explorers -- especially in the medical field.</comment>


Ask HN: Anyone know what this DNS TXT record is? - <AUTHOR> There are two DNS TXT records for example.com, one is an SPF record but I can't find out anything about the other one:
$ dig example.com TXT +short
"v=spf1 -all"
"$Id: example.com 4415 2015-08-24 20:12:23Z davids $"
Does anyone know what the second TXT record relates to?
Thanks,
Elliott <comment><USER2> This looks like like RCS keywords, which are used also by other version control systems, such as CVS or Subversion:

[http://svnbook.red- bean.com/en/1.7/svn.advanced.props.specia...](http://svnbook.red- bean.com/en/1.7/svn.advanced.props.special.keywords.html)

I... I don't know why would anyone put one in a TXT record. It's likely a mistake.

The other example domains (example.org, example.net) don't have such record.

<comment><USER3> If you are managing your zone data in RCS or similar, why not expose that information in DNS as well? Could be useful for debugging.

Indeed, on 2015-01-01, it said "$Id: example.com 3280 2014-12-10 00:15:12Z spowell $".

It does not look like a mistake to me.

<comment><AUTHOR> Thanks for your input, I think you're right – it's deliberate, but seems like a pretty wasteful use of DNS TXT to me. Every SPF lookup is dragging that much bigger record with it too and it serves no real purpose for anyone other than the administrators of the example.com zone. It seems like a strange thing to put in this zone particularly because it's used in so many examples.

<comment><USER3> I bet this was in before the SPF also went in. You should feel free to take this up with IANA, of course :)</comment></comment></comment></comment>


The Present Phase of Stagnation in the Foundations of Physics Is Not Normal - <AUTHOR> http://nautil.us/blog/the-present-phase-of-stagnation-in-the-foundations-of-physics-is-not-normal <comment><USER2> Previously on HN (4 days ago, 250pt, 180 comments):

[https://news.ycombinator.com/item?id=18493019](https://news.ycombinator.com/item?id=18493019)

Looks like the author republished on Nautilus.

<comment><USER3> I must have missed that. It's still an interesting read.

</comment></comment><comment><USER4> This article has a huge number of problems. To say "not a single one" of theory prediction was right overlooks the Higgs. To call all the theorists work "predictions" and calling them "wrong" is employing phrases which undermines the scientific method of hypothesis testing and devalues the work of people trying to understand the foundations of physics. To do those tests and get null results is valuable. We could not make progress with those questions still open.

<comment><USER5> The Higgs boson was predicted in 1967 whereas the article talks about physics in the last 40 years, which excludes that prediction. 40 years is not a particularly cherry-picked number. If HEP hadn't produced a confirmed prediction in _30 years_ that still would be worth calling stagnation.

Your understanding of the scientific method is flawed. I can come up with thousands of HEP predictions that would be easily falsified, causing a proliferation of null results and all of them absolutely worthless.

A null result is useful when it points you in a better direction.</comment></comment>


Ask HN: Living in a hacker house – Is it worth it? - <AUTHOR>

Im currently living in a hacker house where people have their own seperate bedrooms.
Its great for networking, parties and meeting cool people etc, but the place is not being maintained.
After living somewhere for a while, it's hard to maintain perspective. If you had a choice to live in poorly maintained living conditions but with cool people, vs living on your own in a studio, what would you choose? Does anyone know of hacker houses in SF that have decent living conditions (preferably with seperate bedrooms)? <comment><USER2> The Embassy, SF really fits the bill. It's beautiful. [http://embassynetwork.com/location/embassysf](http://embassynetwork.com/location/embassysf)

</comment><comment><USER3> My own place that I can maintain, decorate and arrange how I like, walk around without worrying about my state of dress, cook what I please, keep the joint vermin free.

Vs.

Living with a bunch of scruffy fellows who can't, or won't, clean up after themselves, who attract ants.

How is that even a hard choice to make?

First thing to buy for your new place is a cast-iron skillet. Season it, take care of it, and you'll have a great bit of cookware you'll use for the rest of your life.

</comment><comment><USER4> It's much like the issue for those who go to STEM Universities, dorm or off campus housing. And I would choose off campus every time, nothing worse then living in someone else filth and having to tell someone every night that they should turn down the music/tv/yelling because you need to sleep for work/class tommorow</comment>


Ask HN: Why is this person making fake GitHub PRs? - <AUTHOR> This GitHub user, first active today, is making huge PRs in random (?) projects with plausible descriptions but incorporating dozens or more of other people's random existing commits.
https://github.com/HarryHamilton
Is this common now? What are people hoping to accomplish this way? <comment><USER2> Since there are exactly 4 PRs, I bet he wants a free t-shirt.... [https://hacktoberfest.digitalocean.com/](https://hacktoberfest.digitalocean.com/)

</comment><comment><USER3> May be due to Hacktoberfest? [0]

[0] - [https://hacktoberfest.digitalocean.com](https://hacktoberfest.digitalocean.com)</comment>


Thanks to Time Dilation, Earth's Core Is 2.5 Years Younger Than Its Surface - <AUTHOR> https://futurism.com/thanks-to-time-dilation-earths-core-is-2-5-years-younger-than-its-surface <comment><USER2> Isn't the volume at the center of a large mass also larger?

I assume we have factored space curvature into our calculations for the behavior of stars and black holes, but I never see it talked about.

</comment><comment> j-krieger Can the same phenomenon be seen inside the sun? Does the estimate of when the Sun will expand into a red star account for this?

<comment><USER3> At the end of the article they say for sun it's 40,000 years.

</comment></comment><comment><USER4> Does this then portend that volcanic magma expelled has a younger half-life?

<comment><USER5> Not sure what you mean by volcanic magma half life but keep in mind the time dilation effect are minuscule, amounting to 2.5 years out of the 4.5 billion years of the earths age.</comment></comment>


Why this praying mantis is wearing tiny 3D glasses - <AUTHOR> https://www.theverge.com/2018/2/9/16996006/praying-mantis-3d-glasses-machine-vision-biology <comment><USER2> How to keep him interested. Show a bugs life?</comment>


Comparison of Erlang Runtime System and Java Virtual Machine [pdf] - <AUTHOR> https://ds.cs.ut.ee/courses/course-files/To303nis%20Pool%20.pdf <comment><USER2> It may be worth mentioning that project Loom [1][2] aims to add continuations and lightweight threading to Java. It is lead by Ron Pressler, the author of the Quasar library mentioned in the paper.

Also, JDK 11 (Hotspot) comes with a new concurrent non-generational garbage collector (ZGC) [3] that has an average pause time of 1 ms [4]. It is still an experimental feature, but that will most likely change over time.

[1] [http://cr.openjdk.java.net/~rpressler/loom/Loom- Proposal.htm...](http://cr.openjdk.java.net/~rpressler/loom/Loom- Proposal.html)

[2] [http://openjdk.java.net/projects/loom/](http://openjdk.java.net/projects/loom/)

[3] [http://openjdk.java.net/jeps/333](http://openjdk.java.net/jeps/333)

[4] [https://youtu.be/tShc0dyFtgw?t=4m58s](https://youtu.be/tShc0dyFtgw?t=4m58s)

</comment><comment><USER3> > "Erlang is to locks what Java is to pointers"

That's a great quote(citation is in the paper), I'll have to remember it for future use.

</comment><comment><USER4> I never used a JVM language before the JIT compiler, so I have no personal experience with the speedup it introduced. But if Lua (and LuaJIT) are any indication, I am super excited for BEAMJIT.

For BEAMJIT, I can imagine that the same work will take a different number of reductions before and after the JIT compiler has modified the code. Are there going to be any scheduling issues that will arise because of these reduction changes (or any other aspects of the JIT compiler)?

<comment> Const-me > I never used a JVM language before the JIT compiler, so I have no personal > experience with the speedup it introduced

Speedup in runtime, slowdown on startup. Early versions of Android (before 2.2 i.e. before 2010) used Dalvik JVM that interpreted the byte code.

BTW, apparently google still can't decide what's the best way. After couple of years, in 2013-14, Google threw away the JIT and introduced another JVM, with AOT compilation instead of JIT.

After another couple of years, in 2016, Google re-introduced JIT to the new JVM while keeping the AOT. It's complicated but AFAIK they work together on modern Android.

<comment><USER5> The AOT compiler introduced with ART wasn't a clever decision.

When Microsoft introduced AOT compilation from Singularity into Windows 8, the compilation was done at the store, with dynamic linking done on-device.

Windows 10 UWP brought full static compilation on the store via .NET Native.

Google instead decided to do AOT compilation on the devices, which meant users had to wait several minutes, or even hours after major updates took place.

So with 7.0 they backtracked, using a quick interpreter written in Assembly, followed with a JIT doing PGO, which then took the overall information to feed into the AOT compiler, only called when the device is resting.

Updates trigger the process from the beginning.

Now with P, they will be sending PGO metada back to the store and share it between devices at installation time.

Yet, WP devices with AOT compilation at the store always felt faster as comparable Android class models.

</comment></comment></comment><comment><USER6> Most of the problems raised in this paper from 2015 have been acknowledge by the JVM architect in a 2017 talk[0] , and are know in the work of getting fixed.

JVM is getting Fibers , Non Mutable Array (which would prevent from race condition) and other important upgrade to make the VM safer and faster.

Obviously this will take years before being ready.

[0][https://www.youtube.com/watch?v=OMk5KoUIOy4](https://www.youtube.com/watch?v=OMk5KoUIOy4)

<comment><USER7> In the talk (starts at 24:50) he speaks about adding something like goroutines to JVM and expresses his belief that it can somehow solve concurrency. It solves basically nothing mentioned in the paper, since paper's focus is on fundamental shared state concurrency problems and sharing state won't change a bit.

</comment></comment><comment><USER8> Isn't beam still slow for computations? I envisioned doing something with NIF's, rustler and rust to break out anything computationally intensive.

Perhaps jvm is still a better purpose tool due to this.

</comment><comment><USER9> Can Erlang share memory between threads?

<comment><USER10> No, Erlang can only send messages between it's processes. Java can share.

<comment><USER11> To clarify that a bit -- while the semantics are that erlang can only send messages between processes, what the BEAM actually does under the hood can certainly involve memory sharing, for efficiency reasons. E.g. binaries >64 bytes are stored outside of the individual process heaps, and are just sent as references rather than actually copied (unless sent to a proc on another node in a mesh, of course).

Since everything's immutable, from the programmer's point of view the behaviour is identical to if it was copied, so the sharing is an implementation detail that doesn't affect the semantics.</comment></comment></comment>


Designer News discussing Hacker News' discussion of Designer News - <AUTHOR> https://news.layervault.com/stories/608-designer-news-on-hacker-news

<comment><AUTHOR> Kind of a meta-post experiment :)

See <http://news.ycombinator.com/item?id=5091763>

<comment><USER2> Should we discuss your experiment?

</comment></comment><comment><USER3> > _Now I'm just waiting for someone to post this discussion on Hacker News..._

Now I'm waiting ...</comment>


Half-Life HeadCrab Zombie Rendered in WebGL w/ animation - <AUTHOR> http://www.webgl.com/2012/04/webgl-demo-half-life-zombie-model/

<comment><USER2> While this doesn't really show anything we haven't seen before done in WebGL, it's good to have because it shrinks the perception of the gap between browser and native apps/games.

We saw tons of demos of what WebGL can do (i think the Quake one still being the best port of a destkop game to webgl), now it's time to bring the games to the browser, even if just one zombie at a time.

<comment><AUTHOR> I definitely agree with you. One of the hurdles (from what I can understand) is that not many of the WebGL frameworks support robust physics and collision detection (Fundamental to any 3D game). This is being addressed however, most recently by the CubicVR WebGL framework, which you can see an example of in their 'Physics Vehicle Truck Heightfield Demo' [http://www.webgl.com/2012/03/webgl-game-demo-cubicvr- physics...](http://www.webgl.com/2012/03/webgl-game-demo-cubicvr-physics- vehicle/)</comment></comment>


Find Your Kevin Bacon:  Dig Your Well Before You Are Thirsty - <AUTHOR> http://www.trendslate.com/2010/11/10/dig-your-well-before-you-are-thirsty/

<comment><USER2> "Thirsty", not "Thirty"!

That's something different altogether.

<comment><USER3> Indeed. And would make for an interesting article, too.</comment></comment>


Ask HN: Resources to build VMs for an Opensource project - <AUTHOR> Hi,
I want build VMs for an open source project (https://github.com/frappe/erpnext). This requires booting a vm and exporting its image. VPS services like DigitalOcean and Linode are superslow. I didn't have much success with Travis-CI as well.
My current setup is ansible + packer + virutalbox and it builds quite fast on my local.
Is there any vm build service that we should be looking at? $10/mo seems to be a good budget for this. <comment><USER2> Hi peedy

I can provision a dedicated server (baremetal) if you can't find what you need elsewhere. You don't have to pay. Email me at _joeh_ whereDomain is _unixy.net_ if you're interested.

Cheers

</comment><comment><USER3> [https://pve.proxmox.com/wiki/Roadmap#Proxmox_VE_4.0](https://pve.proxmox.com/wiki/Roadmap#Proxmox_VE_4.0)</comment>


File Sharing Made Easy - <AUTHOR> http://wespam.com <comment><AUTHOR> An anonymous file sharing service, with no signup, email, or any other personal information.

The goal is to make a simple and easy going service for sharing files, links, text, code etc.

The reason for this service, we found it too complicated to share files or links between different devices, especially if it's not personal devices. Most of the similar services require either a login, an email or have an URL you can't remember.

I won't spoil all the features and functionality, but if you have a minute or two, give it a try, all feedback are much appreciated!

You can find the service at wespam.com

/Wespam</comment>


Sample Mean - <AUTHOR> https://www.datayou.org/lessons/sample-mean <comment><AUTHOR> Hi Friends - just a quick note regarding notation. I messed up the sigma notation for the arithmetic average. Though I have updated the transcript, the video currently has the incorrect notation. This shall be fixed later this evening. Apologies for the confusion.

<comment><AUTHOR> Issue with video fixed, uploaded, video replaced, and all set to go. Enjoy!</comment></comment>


Corporate Social Responsibility has become a racket - <AUTHOR> http://www.telegraph.co.uk/finance/newsbysector/industry/11896546/Corporate-Social-Responsibility-has-become-a-racket-and-a-dangerous-one.html <comment><USER2> _The social responsibility of a private company is actually very straightforward. It is to make a decent product, which does what it says it will, and isn't dangerous in any unexpected way. It is to charge a fair price. It is to honour its contracts. And it is to pay its staff and suppliers on time – and, within reason, to pay its taxes promptly as well. If it can do all of those things, and do them well, it is already making a hugely responsible contribution to society._

While I do agree with this premise, I also believe that most, especially here in the US, would recoil from a company that declares a limited CSR. The common mentality would probably be: "Those fatcats should be using a sliver of their mountains of money to help humanity!"

What's interesting is that once you've popularized, formalized and then legislated CSR... what would would have is a set of regulations. In my view, the pressure on corporations to bullshit CSR has everything to do with our collective absence-of-faith in regulations/public sector: "The government will just screw the system up even more if they take more money. But this sneaker company is super amazing at making sneakers: surely some of that ingenuity will translate into the betterment of our society!"

Needless to say, smartness in one area is not smartness in all, and the person who is focused on business is not necessarily going to deploy her or his best efforts on doing what is essentially the government's job.

Summarized by Larry Ellison (I can't believe I'm quoting him):

 _" A corporation's primary goal is to make money. Government's primary role is to take a big chunk of that money and give it to others."_

<comment><USER3> > _The social responsibility of a private company .. is to charge a fair > price. ._

(And I believe implicitly it's to make a decent profit)

I believe that statement is reminiscent of a world that no longer exists. While this may have been true in the 70s, 80s and even 90s, it's simply not true of the world anymore.

No company charges a "fair" price anymore. The price a consumer pays for a product is entirely divorced from the cost to manufacture said product. The price a consumer pays has been maximized to "whatever consumers are willing (and able) to pay".

Similarly for making a "decent" profit - companies did this for years, even decades, and each year they were expected to make more profit than the previous year. Now, the expectations are completely out of control. That's why when a Bank or big company "only" make billions in profit it can be called a failure.

<comment><USER4> > _No company charges a "fair" price anymore. The price a consumer pays for a > product is entirely divorced from the cost to manufacture said product. The > price a consumer pays has been maximized to "whatever consumers are willing > (and able) to pay"._

Yeah, that's true, but hasn't it been always? "Whatever consumers are willing (and able) to pay" is pretty much the definition of "price" in Econ 101.

</comment></comment></comment><comment><USER5> Perhaps it's because CSR is just a facade. Too often we're seeing companies branding themselves as customer-centric, and with the large volume of tehchnology-illiterate in the population, people believe anything/doesn't question their own consumption and The consequences hereof. I have friends who volunteer 6 months in Thailand to work with children only to come home and post instagram pictures of new Nike sneakers once every month (as far as I know Nike doesnt exactly have the vest reputation in regards to child labour).

Most of the time, I feel like people don't give a shit about their consumer habits because they are not motivated by The difference these habits make in the long run ør in a global perspective. It's all about getting those likes. "Supporting" companies with a good CSR profile is a good step towards these likes.

Look up how many people shared and signed up for anti-Kony marches in social media and find the articles that show how many actually showed (it was under 100 I think).

I may be extrapolating here, but I don't think my point can ever be proven even of I'm right.

</comment><comment><USER6> CSR in my opinion is a scam by default. A company's job is to maximize shareholder value by doing what it is supposed to do the best. Whatever money the company puts into CSR is essentially taken away from the share holders.

<comment><USER7> Except that (i) measures which improve corporate image often increase shareholder value and (ii) shareholders freely choose to invest in companies knowing they have chosen to spend a portion of revenues on CSR initiatives, and very rarely revolt against corporate boards over CSR

<comment><USER8> Exactly! The whole point of CSR is to make money by making the company look good. In modern capitalism, corporations exist solely to maximize profits. By that principle, you can figure out why a corporation does anything by simply following the money. This is just another example of that.

</comment></comment></comment><comment><USER9> You have to actually do something to impose the correct incentives if you want entities to act in a particular manner. I'm not convinced that in the absence of CSR these incentives would have been imposed - which seems to be the lynch pin of the telegraph's piece - and see no evidence to support it.

</comment><comment><USER10> The premise of this article seems to be that if VW didn't spend so much time and money on CSR, that their emissions cheating would have been prevented. That seems rather far fetched to me. It's not really clear how one would have any impact on the other.

<comment><USER11> The point of the article is that CSR is simply a marketing expense to a corporation and has no relation to the actual social value of the corporation.

Recognizing that is the first step toward actually making corporations socially responsible by setting limits on them from the outside.

<comment><USER10> Outside limits already exist. The entire scandal is that they cheated their way past those limits.

I mean, you're right that CSR is basically a marketing expense, but I still don't see how getting rid of it would fix anything here.</comment></comment></comment>


Comparing Elixir and Erlang variables - <AUTHOR> http://blog.plataformatec.com.br/2016/01/comparing-elixir-and-erlang-variables/ <comment><USER2> And now all your Elixir case clauses, in order to be "protected" and as something that will grow into "best practice", every lhs of `->` will have to be pinned (use `^`)...

How is that an improvement from, say, copy/pasting code^W^W knowing what you are doing when introducing a variable? I mean, your functions are not meant to be too long anyway.

Oh and happy-case programming gets also noisy now, since you have to put pins everywhere (or bad state will propagate).</comment>


Nike shoes face a potential ban from competition for being too fast - <AUTHOR> https://qz.com/1786040/nikes-vaporfly-shoes-face-a-potential-ban-from-competition/ <comment><USER2> What if the shoes were nothing more than adaquate, and the marketing alone increased the athletes performance? It is already a very self-selecting subset of many elite athletes with the inherent bias that brings. But shoes are only going to improve, and soon other brands will be an advantage. I see this as no different to tires in auto racing getting lighter and grippier as materials science progresses. This offers us some insight; The way auto racing deals with the problem is to make the manufacturer provide tires/shoes for the whole competetion. Its brilliant marketing, and the advantage issue is solved.</comment>


Ask HN: Have the terrorists won? - <AUTHOR>

Given the fact that we appear to now be surrendering the very freedoms the "terrorists" wish to take, does this call for an Al-Quaeda victory lap?
One further, is an initiative like PRISM actually an act of domestic terrorism?
One more, wouldn't the logical response to a terrorist attack be granting of more freedom and liberty to the American people (to signify they can't break our stride)? <comment><USER2> It amazes me that an attack which cost only a few hundred thousand dollars could provoke a decade of mass paranoia, a widely applauded loss of freedom, trillions of dollars in wasted wealth, billions of hours of wasted time, and many thousands of deaths.

So, yes to more freedom, and please refuse to be terrorized [https://www.schneier.com/essay-124.html](https://www.schneier.com/essay-124.html) . Freedom is the absence of coercion, and that is all the security I care to have. The chance of being murdered by a politically motivated hot-head is so low that it doesn't even register on my list of concerns.

</comment><comment><USER3> "You heretic of the great states of America, you doubt our leaders? The very men that lead our children through education, a no child left behind policy. Or the war to protect our freedom from Iraq an Afghanistan how can these men terrorize America, and to say they surrender to Al-Qada, how dare you!" \- A likely response from about 70% of America(a guess based off no statistics)

Too bad the statement above confuses me! That's the exact reason why they commit domestic terrorism... ahh the irony!

It will make for a good story in the future called "The Fall of Advance Humans". It shall be a mere legend as near primitive people will wonder, how this advanced world could destroy itself.

Then 1000 years later, history would have been repeated, and there will be a legend called "The Fall of the Advanced Humans, That Once Wondered How an Advanced World could destroy itself... They found the answer"... etc.

sorry for the rambling. I like your post though I agree 100% that PRISM is an act of terrorism on our freedoms.

"They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." ― Benjamin Franklin

<comment><USER3> "I predict future happiness for Americans, if they can prevent the government from wasting the labors of the people under the pretense of taking care of them." ― Thomas Jefferson

</comment></comment><comment><USER4> Yes, absolutely the terrorists are winning. This was their plan all along. As Dan Carlin (common sense, hardcore history podcasts) says, the terrorists are trying to be like annoying fleas on a dog. They want the dog to bite itself to pieces. Their plan is working flawlessly - and so quickly, it's scary.

There are nearly 40,000 drunk driving deaths per year. If we are willing to give up privacy for security, why aren't there DUI checks on every onramp? Drunk driving kills more people than terrorism by orders of magnitude.

</comment><comment><USER5> We in the USA are much more likely to die from chronic illness due to overeating/soda that a terrorist attack. If you want to kill Americans, just buy stock in Coke and McDonalds.

</comment><comment><USER6> The terrorists had won the moment the "PATRIOT" act came onto being.</comment>


Trailmeme a new kind of publishing - <AUTHOR> http://www.trailmeme.com/

<comment><AUTHOR> It's an interesting variation on slashdot/reddit/HN that allows a submitter to specify and curate a sequence of websites to be visited. Part of the Xerox Trails project. Venkatesh Rao of <http://www.ribbonfarm.com/> is the product manager.</comment>


Unglue.it has launched. Crowdfunding for creative commons ebooks. - <AUTHOR> https://unglue.it/

<comment><USER2> I don't get it... why does it cost $7,500 to make an ebook?

<comment><USER3> It doesn't cost $7,500 to make it. The book exists; we're proposing to make it _free to everyone on earth_ , forever, with Creative Commons licensing. The $7,500 is to compensate the author for potential loss of royalties -- make it worthwhile for them to give it to the world.

Thanks for asking questions; it helps us to communicate better.

<comment><USER2> Oh whoa, totally misunderstood the site. I would suggest keeping this definition:

 _unglue (v. t.) 1. To pay an author or publisher in full, up front, for publishing a Creative Commons ebook._

At the top of the site (had to click through a few times to find it)

<comment><USER3> Thanks! I will be writing a proper About soon, and it really helps to have feedback from people who haven't been following us and talking to us for months. Turns out my brain is too everywhere-all-at-once on launch day for me to write coherent sentences right now, but it'll be coming soon.</comment></comment></comment></comment>


Profanity List: collection of bad words (potentially useful for anti spam) - <AUTHOR> http://www.mdaniels.com/profanity/

<comment><USER2> thanks for adding!</comment>


Show HN: TraceBTC, accounting and more for Bitcoin - <AUTHOR> http://tracebtc.com/

<comment><USER2> > Run detailed forensic traces on coins originating from an address. Most > routing, laundrying and obfuscation can be traced through to it's final > destination.

Minor detail, but you want "its", not "it's".

</comment><comment><USER3> Was wondering how long it would take before someone built something like this.

</comment><comment><USER4> Signup button broken :(

<comment><AUTHOR> Opps, fixed.

<comment><USER4> "TraceBTC"in the container links to [http://wbpreview.com](http://wbpreview.com)

<comment><AUTHOR> Thanks :)</comment></comment></comment></comment>


Google Injects Ads And User-Generated Content Into iPhone Maps - <AUTHOR> http://www.techcrunch.com/2009/10/03/google-injects-ads-and-user-generated-content-into-iphone-maps/

<comment><AUTHOR> no such thing as a free lunch</comment>


How we cut our site's load time by 87% - <AUTHOR> https://firstname.lastname@example.com/how-we-cut-our-sites-load-time-by-87-383d2f43d6c3#.n4sihdet2 <comment><USER2> This article mostly covers a pretty impressive load-time reduction through caching, but I was left a bit worried by its implication. I've always been taught that you build your app and if the load times are prohibitively expensive, investigate where you're hanging and then maybe involve caching.

It seems like the article is just blanket recommending caching as a load-time fix, which can introduce overhead. Anecdotal case and point, I used to run a web app for fellow college students to get their cheapest textbooks. I saw that the load times for the page were so long (2+ seconds) that people were navigating off before it had even loaded. And, most of the time, they were just trying to go back to see what they had looked up for their courses. So I started utilizing localStorage to keep hold of loaded data from the client. It went great... until the next semester when everyone had the old cached data. I misappropriated localStorage and, because of it, screwed up royally.

I'm hardly advocating against caching, obviously, I just hope there's nobody currently working on an unfinished app who implements caching far before it's needed (and in my case, incorrectly).

> So how do I measure?

> Stopwatch. Multiple runs. Median. __

> If it gets to the point where you can't press the stopwatch buttons quickly > enough, it's time to go home.

This part confused me. Isn't it somewhat trivial to use something like `selenium-webdriver` and time the shell command to run your script that calls it?</comment>


Why you should be wary of relying on a single histogram of a data set - <AUTHOR> http://stats.stackexchange.com/questions/51718/assessing-approximate-distribution-of-data-based-on-histogram/51753#51753

<comment><USER2> As mentioned, one should really be using a kernel density plot instead of a histogram, except when there are already classes in the data.

In R, one can simply do:

      library("ggplot2")
      library("datasets")
      ggplot(faithful, aes(x=eruptions)) + geom_density() + geom_rug()

which gives a chart like this (<http://jean-francois.im/temp/eruptions- kde.png>). Contrast with:

      ggplot(faithful, aes(x=eruptions)) + geom_histogram(binwidth=1)

which gives a chart like this (<http://jean-francois.im/temp/eruptions- histogram.png>).

Edit: Other plots mentioned in this discussion:

      ggplot(faithful, aes(x = eruptions)) + stat_ecdf(geom = "step")

Cumulative distribution, as suggested by leot (<http://jean- francois.im/temp/eruptions-ecdf.png>)

      qqnorm (faithful$eruptions)

Q-Q plot, as suggested by christopheraden (<http://jean- francois.im/temp/eruptions-qq.png>)

<comment><USER3> But then you would have to choose a certain kernel and assume the data conforms to that distribution which isn't always true.

<comment><USER2> Indeed, but that estimate is likely to be less misleading in most cases than a histogram(which is just a uniform kernel that is always aligned with bin boundaries).

<comment><USER3> One particular parameter of the kernel, bandwidth, can result in highly misleading visualization given arbitrarily chosen values. Here is an example [http://en.wikipedia.org/wiki/File:Comparison_of_1D_bandwidth...](http://en.wikipedia.org/wiki/File:Comparison_of_1D_bandwidth_selectors.png)

The smoothing give unsavvy readers a false sense of accuracy. With histogram they can at least tell it's an approximation.

<comment><USER4> Yup. Luckily there are good methods for choosing the bandwidth:

[http://www.umiacs.umd.edu/labs/cvl/pirl/vikas/Software/optim...](http://www.umiacs.umd.edu/labs/cvl/pirl/vikas/Software/optimal_bw/optimal_bw_code.htm)

</comment></comment></comment></comment></comment><comment><USER5> Yes, probability density estimation might be fun, but the simplest thing to do when comparing distributions, if you're worried about binning issues, is to plot their empirical cumulative distribution functions.

<comment><USER6> Completely agree. If your audience gets them, that's the most robust, easiest to interpret way to visualize a distribution (continuous or discrete). But it may require a few words of explanation depending on the audience.

</comment></comment><comment><USER7> This is what you should be doing:

      plot(density(Annie), col="red")
      lines(density(Brian), col="blue")
      lines(density(Chris), col="green")
      lines(density(Zoe), col="cyan")

This is the plot you get: <http://i.imgur.com/sY2awX7.png>

</comment><comment><USER8> Reminds me of <http://en.wikipedia.org/wiki/Simpsons_paradox>

<comment><USER9> Hmm, reminds me much more of Anscombe's quartet: <http://en.wikipedia.org/wiki/Anscombe%27s_quartet>

</comment></comment><comment><USER10> Interesting paradox. I haven't seen that many statisticians using just a histogram when determining whether a certain distribution fits data reasonably. Kernel Density Estimators are a much better choice (for continuous data, like the data in the post), but they are also affected by your choice of bandwidth. When it comes down to it, like going to the doctor, sometimes the best choice is to get a second (or third!) opinion. For what it's worth, drawing a QQ Plot (something I've seen in every statistical consultation I've ever done) reveals the dependent structure of the data immediately and obviously in the form of a perfect linear relationship between any two variables.

<comment><USER2> Indeed, although Q-Q plots are very unlikely to be understood by people who don't have a good grasp of statistics, whereas a misleading histogram will be (and probably without knowledge of the caveats behind histograms).

<comment><USER10> A great point, but therein lies my biggest complaint with the simplification of statistics that I see in the startup world--sometimes the technical details are actually important. As an analogy, while mass-production has given us a car that anyone can operate, we are largely helpless when one breaks down. Complications abound when individuals try to leverage an overly-simplistic view of a subject (raise your hand if you've heard "We are 95% sure the true [...] lies in this confidence interval").

To the credit of the shadier individuals in my profession, this histogram subtlety nicely highlights how it can be quite easy to bend the data to your argument using ad-hoc procedures (KDEs, hists, QQs, boxplots). A carefully chosen bin width, smoothing parameter, or covariate can present a different view of the data than some other parameter/covariate. That's why it's nice to have other statisticians capable of reproducing and disseminating the work.

</comment></comment></comment><comment><USER11> Is this basically just an effect of quantization aliasing?

<comment><USER12> In other words, rounding error.

There's a great story of a histogram of heights in Napoleon's army having two peaks, eliciting all sorts of theories. Reality was that height in the army was normally distributed, but that the data was collected in centimeters and people were looking at a histogram binned by inches. The middle bin contained only two centimeter counts while the bins on either side contained three each, thus having dramatically more counts.

<comment><USER13> Would love to find the citation for that one...</comment></comment></comment>


Wikipedia website suffers global outage - <AUTHOR> http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=10656680&ref=rss

<comment><USER2> How did that article manage to shift from a report of outage to an editorial on why Wikipedia is bad for college research?

<comment><USER3> And why is the entire second page quotes from Twitter about it, and the link to the "latest discussions about the outage" a Twitter search for "wikipedia"?

<comment><USER4> Welcome to what passes for the mainstream media here in New Zealand.

<comment><USER5> The media crisis befalls both Trans-Tasman nations. SBS did a segment on news broadcasts across NSW and found out most "breaking news" segments were recorded days in advance, and in one session where the announcer deliberately changes outfits. Viewers would wait for updates on bushfires and other similar regional crises and they would be "updated" on news about the flavor of the month, rapist footie player leaving a nightclub or doing shopping.

American media, however, is as efficient and fervent for their corporate sponsors as any militant death-squad. In America, the footie player's ethnic origin would be researched and the rape case made into a race-war, or the victim tied to a political party in some fringe manner.

</comment></comment></comment></comment><comment><USER6> I still think they should have taken up googles offer to host them for free, no strings attached,

[http://www.technewsworld.com/story/tech/google-wikipedia- hos...](http://www.technewsworld.com/story/tech/google-wikipedia- hosting-40554.html) <http://meta.wikimedia.org/wiki/Google_hosting> <http://en.wikinews.org/wiki/Google_offers_to_help_Wikipedia>

<comment><USER7> Yahoo gave them some server space in Seoul at one point.

</comment></comment><comment><USER8> I think some articles lately are too "news" and not enough "hacker". There's very, very little information in this article, and Wikipedia being down for a little while isn't especially intellectually stimulating.

</comment><comment><USER9> The perils of only having one datacenter :(

<comment><USER10> I was reading some item (on HN probably) about how they have a big one in Tampa, Florida, a small one in Amsterdam and are planning on building another big one in Virginia.

That said, the article mentioned a time when a failure in Amsterdam lead to a failure to fall over to Florida which took out the whole service for a good while.

<comment><USER11> I live in Tampa. We are the Lightning Capitol of North America {insert Wikipedia link here}. Right now is the rainy season here, and generous amounts of lightning. It's basically the monsoon season. So the power sucks here, and even if you have excellent generators, as Home Shopping Network does, the network connectivity is still bound by local limitations. Tampa is a terrible place to put a data center.

<comment><USER12> I think it's there for historical reasons, because Jimmy Wales used to live there, so his company was there, and now it's a significant project to move everything.

<comment><USER11> It's well worth doing. Putting a datacenter in Tampa is like putting a lighter factory in the middle of the fireworks district.

</comment></comment></comment></comment></comment><comment><USER13> Dear commenter: Wikipedia down? No, that's _not_ just like Google going down.</comment>


FDA agrees to expanded access program for MDMA-assisted psychotherapy for PTSD - <AUTHOR> https://www.healtheuropa.eu/mdma-assisted-psychotherapy-for-ptsd-approved-by-fda/96931/ <comment><USER2> Title is a little unclear, this is for an "Expanded Access Program", for individuals who are unable to participate in a clinical stage 3 trial. [1]

"Sometimes called "compassionate use", expanded access is a potential pathway for a patient with an immediately life-threatening condition or serious disease or condition to gain access to an investigational medical product (drug, biologic, or medical device) for treatment outside of clinical trials when no comparable or satisfactory alternative therapy options are available. "

[1] [https://www.fda.gov/news-events/public-health- focus/expanded...](https://www.fda.gov/news-events/public-health- focus/expanded-access)

</comment><comment><USER3> Here is what MAPS (the organization running the Phase 3 trials of MDMA- assisted psychotherapy and the same organization that applied for expanded access) has to say about this: [1]

Donate to MAPS, people, if you believe in this!

[1] - [https://maps.org/news/media/8008-press-release-fda-agrees- to...](https://maps.org/news/media/8008-press-release-fda-agrees-to-expanded- access-program-for-mdma-assisted-psychotherapy-for-ptsd)

</comment><comment><USER4> Click bait title

<comment><USER5> Agreed, how about we change it to: "FDA Agrees to Expanded Access Program for MDMA-Assisted Psychotherapy for PTSD"

<comment><USER6> Ok, we'll use that. Thanks!

</comment></comment></comment><comment><USER7> There's an entire industry of psyche meds already. And they all have 'trials' proving their efficacy. Do those pills not work? Is it all a sham?

<comment><USER8> Many psychiatric medications exist, but since most of the things we group together as depression or generalized anxiety or others are some subset of a large number of possible causes, efficacy of these pills for any given person is rolling the dice, and takes O(months) to test a given med (for depression and bipolar meds, at least - O(weeks) per dose change).

Plenty of people can testify to the efficacy of some of these meds for them personally, but even within families, having an immediate family member who responded well to a given drug is no guarantee it'll work well on you (though it's still better odds than without that data).

Also, drugs+therapy leads to a better outcome, generally, than just drugs. So having more tools available, particularly a tool that improves the efficacy of therapy, is definitely a win.

<comment><USER9> This is different than other medications. You dont prescribe it. It's only used during therapy sessions. Long term use IIRC causes brain lesions or something like that.

<comment><USER10> > Long term use IIRC causes brain lesions or something like that.

This is actually FUD based on an experimental mishap: [https://en.wikipedia.org/wiki/Retracted_article_on_dopaminer...](https://en.wikipedia.org/wiki/Retracted_article_on_dopaminergic_neurotoxicity_of_MDMA)</comment></comment></comment></comment>


Donut Rendering Project - schiller-silvio http://movement.stanford.edu/courses/cs348b-competition/cs348b-05/donut/index.html <comment><AUTHOR> I love how they state their objective ("photorealistic donut rendering") as if its importance were large and self-evident. Gotta love basic research.</comment>


New Data Shows Pinterest Users Look But Don't Buy - <AUTHOR> http://www.forbes.com/sites/jjcolao/2012/07/13/new-data-shows-pinterest-users-look-but-dont-buy/

<comment><USER2> This makes perfect sense. What Pinterest offers are not links to products, but a stream of aesthetically-pleasing visual stimuli that are constantly new and interesting, but fleeting.

Their other major product is self-satisfaction. The act of re-pinning is a way to prove your taste to others, and when your pins get re-pinned or liked, the reward in terms of self-aggrandizement is fairly substantial.

Could they do better to convert people to purchasers? Probably. If there was a buy link on many of those images, I'm sure people would click it and consider. As it is, they're not trying for that, because they're not in the business of selling products; they're in the business of providing emotions.

<comment><USER3> I think it goes beyond that. As an anecdote, I'm getting married in April and my fiance is using pinterest to collect and organize all our ideas for the wedding. We'll end up buying probably 10-20% of what she has pinned, but over the next 6 months. By internet click-through funnel micro-measurements, when we buy it will look like a direct purchase rather than attributed to the channels we discovered the product on. Unfortunately, being able to determine the source and measure return on it is roughly the same as TV advertising and I don't know of any company that provides that sort of analysis for internet campaigns.</comment></comment>


Ask HN: Is security by obfuscation sufficient? - <AUTHOR> I am currently working on a web application that allows users to upload files. There is much more to it than this of course, but I am asking the following question solely in relation to the storage of files.
I am planning on using a CDN (such as Amazon's S3) and my question is simple: How effective is obfuscating the names of publicly available files using a UUID for security purposes? For example, naming a file something like this 4b013ca21ba608373efb4717.jpg.
I would be fascinated to hear any thoughts from the HN users. Certain questions spring to mind, like:
- How easy would these be to guess? Can there be any guarantees of uniqueness?
- What is the best algorithm to create them?
- Should I just make them all private and use authenticated access controls?
I understand that this is an application specific question, that depends on what level of security I require, among other factors. But, for purposes of this discussion, lets just say that it needs to be high, but no Fort Knox: if a file was comprised it would not be critical.
Thank you in advance for any help. :) <comment><USER2> Random file name: You can create an md5 hash of the original file name and use that for the public file name. From what I understand it's extremely unlikely to have two strings hash into the same value. It's also long and nearly impossible to guess.

Security: I had a similar need for my website and figured that if I'm the only one that knows about the URL then it's secure. I was dead wrong. Some browser plug-ins look at each url you enter and spider them. I know this is true because I started to see Alexa hit unpublished admin URLs on my website.

Unpublished URLs != Security.

<comment><USER3> If you compute a string that is say 32 characters long using just letters and numbers, then there are 62^32 possible combinations. This number is 58 digits long.

In this case, extremely unlikely just means never unless you are being attacked by say Russians with secret technology and a room full of supercomputers. The world will almost certainly end before anyone guesses one of these numbers or before you generate two that are the same.

You can look at the probability table for the Birthday Attack in this Wikipedia article and decide how unlikely you would like this event to be: <http://en.wikipedia.org/wiki/Birthday_problem>

Also from the article: "In theory, MD5, 128 bits, should stay within that range until about 820 billion documents, even if its possible outputs are many more."

<comment><USER4> You're also relying on the unpredictability of MD5 here, which is not so watertight as it was once believed to be:

<http://en.wikipedia.org/wiki/Md5#Vulnerability>

</comment></comment></comment><comment><USER5> It's not clear what you're trying to secure against. Are you worried about securing a particular image so that only certain designated users can see it? Are you worried about the original name "leaking"? Are you worried about someone iterating through all of your images?

In general, relying on a "secret" URL is not a good way to keep things secret. Google has a nasty habit of finding URLs you thought had no links. Definitely tune your robots.txt to keep the images off legit search engines.

<comment><USER6> _Definitely tune your robots.txt_

But if you put exact URLs in your robots.txt, then a normal person could pick them up from there and access your content.

Make sure you use a directory structure and forbid all files from the content directory :-)

<comment><USER3> It's also worth pointing out that only the likes of Google and Yahoo will even look at robots.txt.

Some other crawler may walk in there, then create pages that link your files, and then Google could link those pages, and it's game over.

</comment></comment></comment><comment><USER7> Obfuscation via a suitably-long unpredictable URL _can_ work, but as others have noted, there are a number of ways such an URL can leak -- toolbars/browser-plugins being one of them. Also, that a user can easily forward the URL to others to grant access may be a bug or a feature, depending on your preferences.

One often overlooked leak: the 'Referer' [sic] header. If your document is hypertext, and includes outlinks to elsewhere, and the authorized user(s) click those links, those outlink-target sites may receive your confidential URL as a 'Referer' header. As some sites then publish their referrers, in one way or another, the 'secret' URL could wind up in public.

Remember this before creating a 'Competitors' page with outlinks on a 'login- required' but plain-HTTP wiki!

<comment><AUTHOR> Yes. This concept of 'leaking' the URL is becoming apparent to me. I naively assumed you could keep them semi-private (by simply not telling anyone), but this approach is doesn't appear to hold up.

It's a great point about the referrer header too. Thanks!

</comment></comment><comment><USER8> First of all, Amazon S3 is absolutely not a CDN.

 _How easy would these be to guess?_

There is a 1:3e38 chance of two randomly generated UUIDs colliding.

 _What is the best algorithm to create them?_

[http://en.wikipedia.org/wiki/Universally_Unique_Identifier#I...](http://en.wikipedia.org/wiki/Universally_Unique_Identifier#Implementations)

 _Should I just make them all private and use authenticated access controls?_

If your users don't want other people peaking at their files (DropBox): yes absolutely. If your users don't care (HotorNot), then no.

<comment><USER9> "Randomly generated UUIDs ... To put these numbers into perspective, one's annual risk of being hit by a meteorite is estimated to be one chance in 17 billion [24], that means the probability is about 0.00000000006 (6 × 10−11), equivalent to the odds of creating a few tens of trillions of UUIDs in a year and having one duplicate. In other words, only after generating 1 billion UUIDs every second for the next 100 years, the probability of creating just one duplicate would be about 50%. The probability of one duplicate would be about 50% if every person on earth owns 600 million UUIDs."

for smarter than brute-force random UUID algs, the odds of collision are lower.

</comment></comment><comment><USER10> There are two things to consider: First, you need to make sure that your filename is a long, unique, hard-to-guess string, that is easy to generate. This rules out all 5 UUID specifications:

Version 1: MAC + timestamp => easy to predict

Version 2: MAC + some other static data + partial timestamp: => Also easy to predict

Version 3: MD5 of some file or random string => If an attacker has a file, he can generate the MD5 hash himself and see if you also have this file.

Version 4: Random data => slow

Version 5: Same as version 3, but with SHA1.

Your best bet IMHO is to use the HMAC of the file. This will defend you against all the flaws that using an unique ID would have.

The second step is to ensure that your secret links don't leak. You can employ robots.txt to disallow robots, use dereferer.org or anonym.to to hide away referers, but you still won't be secure, as someone can still copy and paste the link. If that is ok with you, then you can stop reading now.

You could of course add an EC2 machine between the user and your S3 storage that makes sure each link only works once, but this would be expensive and counter-effective. However, Amazon S3 allows you to create a request that can be made via HTTP GET and that is only valid until a specific time. (See the API documentation, chapter "Authentication and Access Control"). This will allow you to generate a new URL every time you want to serve a file to your client. The URL will only be valid for a specific time period. The downside is, that this again is time-demanding and that all caching on the user side will be useless.

Good luck!

</comment><comment><USER11> Let me try to answer your question in a different way.

There are two things, security and the perception of security. For arguments sake, even if we assume that the method of simply creating UUIDs for file names is secure (which as several people have said is not a valid assumption), I would argue that it does not provide a good enough perception of security.

So, if your users are really concerned about security and afraid that others will look at their files, a simple solution as above would just not cut it. You will have to really convince them that your system is really secure. Now, no matter what you use, UUID, MD5, SHA1/2/256 etc. to them it won't make a difference and that may mean that you will lose users.

Based on that, my suggestion would be to do what you said above, make them all private and use authenticated access control. This will provide security as well as perception of security and get you more satisfied users.

</comment><comment><USER12> The secret filename is not only on the wire but will show up in history and logs, which makes it a step down from basic HTTP authorization. I'd use at least digest authorization for anything that matters in any way.

</comment><comment><USER13> if you are suggesting that you leave these secret urls open to the entire internet, and just rely on them being inaccessbile, you're looking for trouble. Depending on the type of documents, at the least your users may not be happy about them being unauthenticated, and I personally would worry about legal issues. Add authentication.

</comment><comment><USER14> It depends on your risk profile. For a bank, no. For an lolcatz photo site, sure.</comment>


Principles of Reactive Programming Starts Today - <AUTHOR> https://class.coursera.org/reactive-001/class

<comment><USER2> And I was just wondering what ScalaCheck would be good for. Registered for this class a while back glad that it started.</comment>


New app turns you into a walking iBeacon.  - <AUTHOR> http://www.getloopd.com

<comment><USER2> Bye, Bye Business Cards. The Loopd app does it all and more. Great for mixers, conferences and trade shows.

<comment><USER3> This could be powerful tool at a host of business/social venues to increase human interaction, connectivity and relational impact.

</comment></comment><comment> mac-r what is iBeacon?</comment>


Bill Gates: How Paul Allen Changed My Life - <AUTHOR> https://www.wsj.com/articles/what-i-loved-about-paul-allen-1539862016 <comment><USER2> Would someone please post a non-Paywalled link?</comment>