Ask HN: making a living by playing poker online? - <AUTHOR>

Anybody doing this? If you've got decent self control and math skills - can it be a good way to make some extra money? Or do you feel you need like 10 years of experience and full time dedication?
Got interested in it after reading a (probably pretty exaggerated) story on the life of http://instagram.com/danbilzerian
BTW what online sites would you recommend for it? <comment><USER2> Dan Bilzerian does not make a living playing online. His dad was a corporate raider and fraudster and owes the government over $100mm which just magically disappeared. It isn't a stretch to believe the very public major wins and losses of Dan are simply a front to launder some of that money back.

As to your question, if you live in the US, it is nearly impossible to start today and make a living because of the regulations which drove most operators out of the market.

If you don't have connections here, you could study your ads off and play small stakes on the American sites (do NOT play on lock, they are not liquid) until you can clearly sustain yourself at ramen profitability and then move abroad to access the big sites with a wider game variety.

Poker doesn't require very complex math in order to be successful, it requires discipline and deliberate practice. Pick a game that interests you, find a book that teaches the fundamentals and read that several times and take notes. Start playing and review all of your sessions once you finish. Find what you need to improve and set goals for the next session, then repeat that.

When you have a hard time finding places for improvement, sign up to one of the big video training sites and study their videos like a book and follow the same reviewing process. When that seems to run its course, hire a skilled coach that has good reviews and results. Always continue trying to improve.

If you only want to do this to become rich, then stop now. I have friends that have achieved a very high level of success and live amazing lives (one is leaving Vegas now to go to Australia for three months and then either to Macau or back to Vegas), but they are essentially outliers. For most, it never amounts to anything. For most of those that put the effort in, it can be a good supplemental income. For a few of those, it can be a job that allows for great freedom. And for a handful of those, it is a way to get rich.

</comment><comment><USER3> I agree with most of the advice posted here. Making a living from online poker is extremely difficult in the current environment. However, it is possible that the environment could change in the future in a way that makes it easier.

Right now there are a few things making it extremely difficult to make money with online poker. The obvious one is the illegality of playing from the U.S. What isn't so obvious, is that the lack of casual American players has all but destroyed the global online poker industry. Back in the golden age of online poker, there were millions of recreational players who were really horrible, but kept playing as a form of entertainment. As the US Government started intimidating banks into refusing to handle poker-related transactions, a large percentage of these bad players (AKA fish) stopped playing. A few years later, when Pokerstars and Full Tilt were shut down by the feds, all but the most dedicated players left, leaving a relatively small pool of players that tend to be pretty good.

So now that there is a smaller group with a generally higher level of skill playing online poker, it is almost impossible to make a living.

At least three things would have to happen to make poker a good way to make a living in the future:

1\. It has to become legal in the United States

2\. It has to overcome its reputation for being unsafe (millions of people had their pokerstars and full tilt accounts seized.)

3\. Poker has to become extremely popular like it was during the golden era of online poker.

If you are interested in poker, and you can play legally from where you live, I suggest learning the game now. If and when these things happen, you don't want to be one of the fish.

Please note that playing facebook poker won't teach you anything. People play much differently when there isn't any money involved.

</comment><comment><USER4> If you're in the US, it was very do-able before Black Friday (when the 3 major websites got banned), but nowadays it's way tougher since the sites that you can actually play in the US don't have as much action. In the past, you could basically multi-table at the medium-high stakes, break even, and make 60k+ on the rakeback + bonuses the sites give you (like comps from a casino).

But overall, from what I hear, it's just a grueling "job". Especially if you don't have the mindset to handle it, as in you'd have to handle being unlucky for a long time (downswings) and not tilt.

But if you have the right attitude and truly enjoy the game, then yes, you can make a living playing poker online, although you may lose a lot of money initially until you have the skills to consistently out play your opponents.

</comment><comment><USER5> It can be done, very very difficult though.

There are lots of people with good self control and math skills that you are playing against. Tons of training out there that teach new people the math and the ways to play. Even if you play perfectly, you will have big downswings.

Also since its somewhat difficult for people in the USA to play legally, the quality of competition has gone way up since the early days of online poker.

the twoplustwo forums are a good place to learn more

</comment><comment><USER6> You're about a decade too late. Back when Party Poker and Neteller was around, playing weak tight ala "winning low limit holdem" by lee jones was like printing cash.

</comment><comment><USER7> The odds on becoming wealthy from online poker are roughly the same as the odds on founding a startup that makes you a millionaire and requires the same level of dedication.</comment>


Documentary films need more funding - <AUTHOR> https://www.theguardian.com/film/2020/jan/03/documentary-films-need-more-funding <comment><AUTHOR> As a former documentary distributor, I've been thinking about creating a fund, with enough capital this could help make more high-quality docs about science, technology, and culture (not politics or celebrities). Enough people here could probably make this viable if there were interest. Most funds are non- profits.</comment>


Apple - is history repeating itself? - <AUTHOR>

Over the years I've read quite a bit about business, and I love reading biographies of people and companies. I'm just wondering if Apple (or Steve Jobs) are repeating their mistakes from the past.<p>When the Macintosh was first created, it was done so as a completely 'closed' unit - there were no expansion ports like there had been on the Apple II.  Prior to this, Apple had the market for personal computers with their Apple II, but they refused to license the OS and the rest (as they say) is history. I'm thinking that with the iPhone - which I love BTW - and the controlling method which Apple are going about the management of the Apps for it, are they in danger of the same blindness which afflicted them before? <comment><USER2> Apple is profiting a lot from the App store in its current form. Profit is the definition of success in any realistic business.

There is no way to prove that this will ultimately fail when it is so successful now. You can try boycotting them, but then their failure will be your self fulfilling prophecy.

<comment><USER3> The only reason Apple is raking in so much profit from the App Store is because there is no real rival to it. Like I have said on many other HN threads, when the smartphone market matures, Apple will have to become more transparent. If it doesn't and keeps doing stuff like rejecting really useful apps like Google Voice then not only developers, even consumers will start abandoning the device/platform.

<comment><USER2> Apple are treating their developers the same way they treated the music labels and media companies. It worked marvelously for them, why would they change anything?

As far as Apple are concerned, App developers should be thankful they even had a choice in pricing.

</comment></comment></comment><comment><USER4> Apple and Sony both.

Their strategy seems to be that if you try it enough times and apply the lessons from the previous time then one day you'll find that holy grail, a format or a market that is completely yours, and as a result of that a captive audience that you can milk for a long long time.

Sony failed with betamax against the more open format VHS but they succeeded with Blu Ray vs HD DVD.

Apple with the Mac vs the PC (which technically pitted Apple against IBM, but which now seems to be reinterpreted as Apple vs Microsoft).

</comment><comment><USER5> when at first you don't succeed, try again.

</comment><comment><USER6> I don't believe they are comparable. The situation, the products and competition are all different. And I really don't think they failed the first time, they may have lost of to the PCs then but they didn't perish as a company.

Their philosophy has been to create a great product and sell it in one package. And it has worked pretty good for them with Mac line of products.

With the app store model they still get to control the applications that run on the iPhone. Which does give them the ability to not approve any application that would make the user experience with the device undesirable. This control over the app store is being used for tactical reasons by Apple. But obviously whether it was intended reason from the get go, I highly doubt that. Add to this who knows what legal agreements they are bound by with the Carrier. The carrier may say it wasn't us but when things go bad between them I am pretty certain there will be a few people in both these companies looking at those legal agreements.

Whether this is a good thing for developers, no. Whether it is good for Apple, may be in short term but probably not in long term. A more open policy with the approval process would be ideal.</comment>


Airline regulations imply powerful unions imply regular Chapter 11 bankruptcies - <AUTHOR> http://philip.greenspun.com/flying/unions-and-airlines

<comment><USER2> This is from November 2010, but essentially all of his points still hold true today.</comment>


A guy on Reddit reversed engineered TikTok - <AUTHOR> https://twitter.com/d1rtydan/status/1277081198624337920 <comment><USER2> Well, Yesterday, Indian government has decided to ban the App.</comment>


US cities are losing 36M trees a year - <AUTHOR> https://www.cnn.com/2019/07/20/health/iyw-cities-losing-36-million-trees-how-to-help-trnd/index.html <comment><USER2> This is good information but omits some key details. Many urban street trees were planted during greening actions during the 1970s and those trees have lifespans in those environments of about 50 years which means that we can expect large scale die offs of urban trees and should consider not only planting replacement trees but also putting in place a strategy of regularly removing aging or otherwise troubled trees in order to replace them with new trees so that ongoing plantings prevent this kind of large scale die back in the future.</comment>


A Theory of Creepiness - <AUTHOR> https://aeon.co/essays/what-makes-clowns-vampires-and-severed-hands-creepy <comment><USER2> I was hoping that the article would explain the increase in the popularity of 'creepy':

[https://www.google.com/trends/explore?date=all&q=creepy](https://www.google.com/trends/explore?date=all&q=creepy) [https://books.google.com/ngrams/graph?content=creepy&year_st...](https://books.google.com/ngrams/graph?content=creepy&year_start=1800&year_end=2016&corpus=15&smoothing=3&share=&direct_url=t1%3B%2Ccreepy%3B%2Cc0)

<comment><USER3> I'm stating the obvious but it's spiking every October in anticipation of Halloween. Ignoring those spikes and looking at the growth trend that began around 2007, it looks fairly organic and has remained relatively flat since mid 2014. What kicked it off in 2007 I don't know.

The term has simply become a short-hand way of describing something that brings unease. The problem with the term is that people aren't actually describing what characteristics are bringing that sense of unease, thus someone who's a little awkward gets lumped in with far worse characters. So it can be used indiscriminately but it's an easy way to describe something that's difficult to define, hence its ongoing popularity.

<comment><USER4> >What kicked it off in 2007 I don't know.

The internet meme of "creepypasta," probably. See /r/nosleep for the sanitized version. This is the meme cluster that yielded Slenderman, BEKs, and the SCP project.

<comment><USER2> Both of those other memes are on the decline right now: [https://www.google.com/trends/explore?date=all&q=creepy,cree...](https://www.google.com/trends/explore?date=all&q=creepy,creepypasta,slenderman)

You'll find they peaked in 2014, and it took them until 2010 to become popular.

<comment><USER4> Well, Slenderman had the video game Slender popularize the meme, so I would expect the trend to be dominated by people who came to the meme via that game rather than the organic growth. From that chart it looks to me like creepy started spiking around the same time creepypasta did. To be fair, creepypasta is the name of a genre at its origin source, whereas most people are going to see stories downstream of the origin and search for them with queries like "creepy black eye kids" or something.

I guess I would qualify that I think this meme is probably what caused the 2007 spike. Later growth in the creepy space is probably more due to online dating becoming popularized; this would allow creeps to be creepy with virtually no possibility of retribution.

</comment></comment></comment></comment></comment><comment><USER5> I think it's really naive to brush aside the fact that almost all women elicited thoughts of men as being creepy. Women are scared of being raped or worse happening to them, and they're constantly on the lookout for it. This has nothing to do with "categorization", and everything to do with "potentially dangerous".

Being afraid of a creepy guy who won't leave you alone is very different than being creeped out by a clown or an abandoned building.

<comment><USER6> Is it very different though? Both fall within, as explained in the article, the ambiguity and mental paralysis coming from being unable to determine whether or not a threat exists.

<comment><USER7> Agreed. I think a good approximate description of "creepy" might be "ambiguous or novel, absent overt signaling of pacific intent".

Or, more crudely: "wtf" \- "oh, it's harmless".

What's interesting to me is that under such a definition there's a clear notion of intentionality. Something can only be creepy when it's behavior is directed towards an object. While it might be tempting to point towards places that are creepy (e.g. abandoned hospital), I would suggest that these are _eerie_ rather than _creepy_.

</comment></comment></comment><comment><USER8> > a peculiar smile; having greasy or unkempt hair, bulging eyes, abnormally > long fingers, very pale skin or bags under the eyes.

Did Steve Buscemi help define creepiness for the polled group, or did he hit a genetic jackpot of pre-existing ideas of creepiness? (Or both?)

Edit: [https://en.m.wikipedia.org/wiki/Steve_Buscemi](https://en.m.wikipedia.org/wiki/Steve_Buscemi)

<comment><USER9> Anecdotally, I know more than one straight woman who finds Buscemi really attractive. I'm not surprised. He's cool.

</comment></comment><comment><USER10> Interesting side note: The words "Awkward" and "Creepy" don't exist in German and there are no direct or inderect equivalents. It goes so far that it is culturally impossible to have creepy or awkward behaviour.

<comment><USER11> Creepy ~= Gruselig/Unheimlich

Awkward ~= Komisch/Unbeholfen

And the concepts totally do translate to German. A lot of people would describe a "creepy guy" as "gruselig" in German. Actually we've imported the word "Freak" to describe these people.

As an aside: there was a German copy of the "Beauty and the Geek" show that was far more dehumanising and called "Das Model und der Freak" where the entire concept was that "pretty" c-list celebrity women would give a "nerdy loser" a makeover to turn him into a generic alpha male womanisers.

The entire concept was "here's this loser weirdo no girl would ever date, let's make him conventionally attractive and exterminate his pre-existing personality in its entirety". The sole point of the show was ridiculing these "weirdos" and their strange hobbies -- of course the exploitable traits were exaggerated through bad scripting and heavy editing.

A pet peeve of mine is that until recently the words "geek" and "nerd" have often been replaced by "Freak" as movies are translated to German, drastically skewing the intended meaning ("Freak" is almost always an insult). Recently "Geek" and "Nerd" seem to have entered the German language (especially the former, mostly via gaming and social media) so hopefully that's coming to an end.

<comment><USER10> > Creepy ~= Gruselig/Unheimlich

> Awkward ~= Komisch/Unbeholfen

Those translations don't really contain that additional negativity of "Creepy/Awkward". It is hard really pinpoint it though.

> there was a German copy of the "Beauty and the Geek" show that was far more > dehumanising and called "Das Model und der Freak" where the entire concept > was that "pretty" c-list celebrity women would give a "nerdy loser" a > makeover to turn him into a generic alpha male womanisers.

But that was so much more over the top. Those guys were more like "eklig" (disgusting).

<comment><USER12> To me the range of negativity (from let's say "creepy Halloween decoration" to "that creepy old guy" or "a jar full of babys' fingers") is similar in both languages, and something that has to be inferred from context. "Creepy" covers the disgusting axis a bit more, but eklig/ekelhaft covers that area easily if necessary.

The fact that "creepy" is used in German language sometimes points towards that the terms are not exactly identical, but it's a tiny difference and in no way big enough to say that the concept doesn't exist. It's just a shorthand for something that otherwise might require a modifier or explanation, + using English is cool.

</comment></comment></comment></comment><comment><USER13> I've developed my own thoughts about creepiness, since coming across as creepy is one of my biggest fears.

1) The theory of mirror neurons. This theory states that if you are nervous, the other person will pick up on it subconsciously. As the article states, false confidence, even if you try your best to hide it, will come across as a barely disguised nervousness.

[https://en.wikipedia.org/wiki/Mirror_neuron](https://en.wikipedia.org/wiki/Mirror_neuron)

One of the things that I've observed while watching some pick-up artists practice is that those who eventually become "successful" are basically asking nothing of those who approach. They don't fear rejection. In fact, they can be quite entertaining and good listeners. However, for most of these individuals, they probably had to go through a lot of rejections to get to the point where they didn't honestly care what the reaction was.

2) The hover zone/kill zone

Commonly used in pick-up artist terminology. This is easily described as wanting to talk to a specific individual, even approaching within several feet, yet not doing it. I know we've all done this, at some point, at a bar or even at a friend's party. You know the person knows that you are interested in them.

3) Reciprocity

In one of Pedro Almodovar's movies, in the director's commentary on the DVD, there is a man in a woman's apartment who is looking through his host's stuff. The director makes a statement along the lines that "liking without reciprocity" makes it stalking (or worse).

In the very rare times, where a woman who has explicitly hit on me, asking lots of questions, showing interest that is _out of norm_ with the pace of conversation (e.g. we just met), I can attest that it feels creepy as in (What have I done to make you so interested?). In more common circumstances, I recall people who are seemingly interested in you but quickly steer the conversation to something like network marketing.

Given these factors, what can be done to not come across as creepy?

First, don't hover. Talk to someone right away, even if it just a quick introduction.

Second, being quiet can actively work against you in most social situations. Especially when you are meeting new people. To this day, I can be enjoying a party by meeting new people in a group and listening to their stories and (usually) extroverts will ask if "are you having a good time?". Even if I am, it doesn't outwardly show, at least in the manner they'd expect.

Third, the answer may lie in being mindful of reciprocity. For example, talking to a cute individual, what is it about him/her/they that you find interesting (that is not related to something she cannot easily change, like her looks).

When I've talked to my good looking friend girls, they basically say they have to ignore all the attention/cat calls when they walk down the street.

Fourth, to escape the friend zone, you have to make it explicitly clear that you are interested in someone romantically and tell them why. Asking someone out to coffee to talk about their job v. asking someone out to a picnic because you like them.

One last side note - if you walk into a party with a couple good looking friends (male or female), people will automatically ascribe a higher status to you, whether you care to agree with the theory and practice of social proof or not.

</comment><comment><USER14> I don't get the "essence" and living things thing.

I think it boils down to unknown, potentially threatening behavior. The big eyed, tail wagging mix of a dog and a mouse is not so creepy. Walking on to cobblestones and they feel like they are floating scares us. A house painted in perfect white, all lights turned on, but without furniture or any people is creepy.

The funeral director and taxidermist is creepy, because he isn't creeped out by death himself.

edit: reading the other comments: this is about scary creepy, as in "freaks me out", not creepy as in "ugh, leave me alone you perv". Though there are overlaps of course.

</comment><comment><USER15> I sort of explored this a few years ago in a story. A scientist creates rabbit-human hybrids and it causes all kinds of problems precisely because they can't be treated as animals and can't be treated as human.

[https://github.com/johngtait/mixie- novel/blob/development/fr...](https://github.com/johngtait/mixie- novel/blob/development/frankenrabbits.md)

</comment><comment><USER16> The article isn't about the creepiness described in the comments here. It's more about creepiness in general, like in clowns. It's pretty standard stuff actually...creepiness isn't just physical threat, it's a sense of impurity or a pollution of a thing's essence. Clowns are impure in the sense that they are humans gone wrong, with waxlike and distorted features.

<comment><USER17> I think a lot of people have a lot of anxiety around the concept of creepiness and when something that looks like an opportunity to try to discuss and maybe resolve this anxiety presents itself in a community where they feel at home, they jump to discussion.

Of course, an openly-readable Internet forum is a risky place to open yourself up emotionally.

</comment></comment><comment><USER17> When going from riding a bicycle to learning to drive a car, it is very easy to feel a lot of anxiety about it. After all, driving a car on American roads is a very morally strange thing: you are in fact imposing upon other people a risk of death or lifelong-debilitating injury. And you have to work to accept this. Of course you can and should avoid exacerbating that: only drive when sober and well-rested. Don't text and drive. Don't have complex discussions when driving. Scan your mirrors for bikes and motorcyclists. But as long as you are going to get up and go to work, you cannot reduce risk to 0%. And you have to work to accept this. There are even things you can do to actively be much better than most drivers: do the Dutch Reach[1] when you open your door. Spend $10 on a wide-angle mirror[2]. But ultimately you are still imposing an increased risk of death on others. And you have to work to accept this.

Likewise, when going from reading things like [http://tinyurl.com/schrodingers-rapist](http://tinyurl.com/schrodingers- rapist), or various blogs written by and for those on the receiving end of stalking and street harassment, it is very easy to feel a lot of anxiety about the possibility of creeping someone out. But humans are strange and varied people who have all sorts of backgrounds and perceptions. And you have to work to accept this. You still must avoid doing things that will cause a reasonable predictive model of people to feel fear: Keep a situationally-reasonable distance from people. Don't shout things at people on the street. Don't present sexual/romantic intent to someone with a high cost to removing themselves from the situation. There are ways you can trade time/money or your preferences for other's comfort if you choose: learn to choose and wear nicer clothing. Speak in a slightly higher pitch. Avoid facial hair or tattoos. Have a friend smell-check you if your nose is impaired. But ultimately, people percieve things in different ways and some might perceive you as a threat. And you have to work to accept this.

[1] [https://www.bostonglobe.com/metro/2016/09/08/this-cyclist- wa...](https://www.bostonglobe.com/metro/2016/09/08/this-cyclist-wants- drivers-dutch-reach/V2Ei5bEiOCfU6ubxX1r8VN/story.html) [2] [https://www.amazon.com/Fit-System-RM011-Clip- Mirror/dp/B001A...](https://www.amazon.com/Fit-System-RM011-Clip- Mirror/dp/B001A0J2JO)

</comment><comment><USER18> The article states a couple times: "cognitive paralysis is what generates the sensation of creepiness."

It's the most confident statement in the article, but without supplying a reference. Can this be validated?

</comment><comment><USER19> Thinking about movie stereotypes about ie: people who collect hair, I think a distinction should be made between those described as merely "scary" and those described as "creepy".

Take a horror movie. If said collector is a recluse who's history nobody knows about, they're described as scary. If they're out and about, visiting neighbors, trying to relate and engage with people, they are much more likely to be described as creepy.

As such, bringing it back to everyday behavior, I think the critical aspect that determines whether something is creepy or not is whether there is a mismatch between what the person is explicitly informing they want to do (be a friendly neighbor), and whether the person on the receiving end suspects there are ulterior motives (they want to collect hair).

</comment><comment><USER20> I found this essay interesting:

> _It's not "creepy" if he's hot. I freely admit it. When a very attractive > stranger approaches me and tells me I'm beautiful, it brightens my day. When > a guy who is short, fat or balding does it, it makes my skin crawl no matter > how tactful he is about it. I just want him to go away. I'm not alone in > feeling this way. Most women feel the same, but hide the true extent of it > when the guys are around._

[http://theplacetorant.com/ugly-creepy-guys/](http://theplacetorant.com/ugly- creepy-guys/)

<comment><USER21> That's an over the top rant, but as a woman I agree with her basic premise: the "women are less visual" thing is a total lie and tied neatly into the "women desire sex less than men" lie.

Looks are important to many women just as they are important to many men. There's nothing to be ashamed of and there is no point in denying human sexuality.

<comment><USER22> Its not provocative. Its silly and absurd. Stating you have visual preferences is like stating you prefer oxygen. This is innate and widely accepted as normal and unremarkable across human society.

Is there an underlying assumption 'women are less visual'? It's seems like a bit of a straw man because no one can and should generalize.

The next bits about 'knowing your place' puts the author in the enlightening company of a cave man teling women to 'know their place'. I wonder how many will be lining up to defend that.

Self proclaiming yourself as 'good looking' is problematic in itself because this is purely subjective beyond a 1% that everyone widely agree on. To then use this self created pedestal to dismiss and reduce others suggests a unnatural degree of narcissism and likely necessitates a large leap from reality.

<comment><USER21> >Is there an underlying assumption 'women are less visual'? It's seems like a bit of a straw man because no one can and should generalize.

There is, at least in American culture. It is wrong of course.

</comment></comment></comment></comment><comment><USER23> Just take comfort in knowing that female attractiveness usually drops off a cliff far earlier than male attractiveness does. The same girl writing that essay will one day be 40+ and begging for any of those "genetic superiors" to give her five seconds, while the same male "uggo" with a stable income and decent hygiene will be able to take his pick of a bunch of nicer women who didn't view the whole of humanity through the lens of the beautiful people master race.

<comment><USER24> Actually, you can't comment like this here. It's one thing to post inflammatory rants about flamewar topics (like a bunch of others have done in this thread); significantly worse to conjure up nasty things on others and gloat; but adding a personal attack element into the mix crosses into bannable offense. Please don't post like this to HN again.

We detached this subthread from [https://news.ycombinator.com/item?id=12536861](https://news.ycombinator.com/item?id=12536861) and marked it off-topic.

</comment></comment><comment><USER25> I found this reddit comment interesting:

> [–][deleted] 3796 points 2 years ago*x2

Lots of Indian dudes are great guys. Most, even. Smart, funny, sociable, kind, handsome, eyes to kill for, the works.

But just as with every group, some aren't. Some are creeps. Usually creeps have no idea that they're creeps, don't understand why they're creeps, and get mad when people call them creeps. So why are Indian dudes so often creeps? Well, for the same reasons any guy is a creep, with a few cultural factors thrown in. I'll try to explain why in a way that encompasses creepdom as a whole, and which I think might be comprehensible to creeps. Now, if I could establish an informal Creepiness Quotient to describe the feeling someone gives you in the first few seconds they're hitting on you, I would do it as follows.

Creepiness = ( (Awkwardness x Forwardness) / (Attractiveness) ) ^ Persistence

Now, let's look at the factors here, with "you" being a nonspecific potential creep who is hitting on "me," a nonspecific person of sexual interest:

Awkwardness is the extent to which you demonstrate your inability to operate effectively in my chosen social environment. A person who cannot initiate or maintain a comfortable conversation with me is an unappealing choice of partner. Immigrants often score highly on Awkwardness, which is natural-- they're working in an unfamiliar social environment. I think that's unfortunate, because usually it's not at all their fault.

Forwardness is the extent to which you convey that your goal is purely to use me as a sex-thing. If I think you like me because I'm interesting, this is noncreepy and good. If I think you like me because my part fits your part, that is creepy and bad. Men from some cultures tend to be more forward than men from others, depending on the appropriate gender roles in their societies. In my own personal experience, Indians are high on the Forwardness list. I'm not remotely qualified to offer a guess as to why, beyond "lol culture" which is not explanatory of anything.

Attractiveness is a saving grace! Maybe you're hot, maybe you've got a great voice, maybe you've got nice arms, maybe you told a great joke, maybe I like your clothes, maybe you belong to the same subculture I do. Maybe you aren't an obese scuzzlord with halitosis who smells like BO and salmonella. Rules #1 and #2 aren't all there is, but they definitely help. I don't think your ethnicity makes you more or less likely to be attractive as a rule, though some individual people have some degree of preference.

Persistence is bad news. Persistence is when you don't take "no" for an answer. Persistence is when you apply pressure, is when you get aggressive or defensive, and is when you demand explanations for why I won't date you. At high levels, persistence is when you start to give off rape vibes. Persistence is what you get when someone believes they are entitled to sex with me or entitled to a relationship with me, and my opinion on the matter is an inconvenience. Persistence is a creepiness multiplier. An awkward, unattractive dude who says "ey, you got nice tits, I got a nice dick, so, wanna fuck" then leaves when I say no? He's creepy, yes. A dude who is otherwise normal but who won't leave me alone? Way creepier. In my experience, this is where so many Indian guys lose it: the entitlement/persistence factor. Begin with traditional gender roles, teach them to a child of a rich businessman in a society with sharply defined social classes, who has always gotten everything he wants, and who is somewhat inclined to see people 'below' him as less deserving of consideration. Then turn that child into a STEMlord engineering student who has had minimal successful contact with actual human beings. That's a recipe for a guy who thinks he deserves women but doesn't have any idea about how to 'get' them. So he gets persistent, because hey, that's how you succeed at anything, right, you just find what you want and take it? And now he's creepy as fuck.

This whole thing is of course not limited to Indian dudes. Any guy can be a creeper, for similar reasons as above. But if you're asking why so many Indian students in Western universities are creepers, well, that's why: unfamiliarity with their new nation's social norms and gender roles (Awkwardness and Forwardness) combined with a disturbing sense of entitlement and an inability to handle disappointment (Persistence) means high creepiness. EDIT: Women can be creeps too, of course. In the above, I assume the creep is a man, partially for ease of pronoun use, and partially as an reflection of the relatively higher incidence of male creeps.

\- [https://www.reddit.com/r/cringepics/comments/21gf9b/i_get_mo...](https://www.reddit.com/r/cringepics/comments/21gf9b/i_get_more_pussy_than_u_ever_will/cgd2x3b)

<comment><USER24> Please don't. See [https://news.ycombinator.com/item?id=12544564](https://news.ycombinator.com/item?id=12544564) for why.</comment></comment>


Disable WebRTC for Firefox – Defend Your Local IP(s) While Using a VPN - <AUTHOR> https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-disable-webrtc/

<comment><USER2> uBlock Origin (on Chrome and Firefox) can do this too:

In your uBlock options, there's a setting labelled "Prevent WebRTC from leaking local IP address" (its unchecked by default since it can break some WebRTC-powered sites).</comment>


Artificial brains may need sleep too - <AUTHOR> https://www.lanl.gov/discover/news-release-archive/2020/June/0608-artificial-brains.php <comment><USER2> Damn that was fascinating. And it makes a ton of sense too.

In case anyone is looking, here is they paper they presented: [https://drive.google.com/file/d/13u14zNsi7uthLpwCoMrckwhasau...](https://drive.google.com/file/d/13u14zNsi7uthLpwCoMrckwhasauw157I/view)

</comment><comment><USER3> Not sure what "stabilization" means in this context.

But isn't what they call sleeping basically regularization? In particular, mini-batch and drop-out??

<comment><USER4> It's important to note that what is being investigated are neuromorphic processors. i.e. attempts to model biological brains. A paragraph from the article directly addresses why conventional regularization isn't used.

> "The issue of how to keep learning systems from becoming unstable really > only arises when attempting to utilize biologically realistic, spiking > neuromorphic processors or when trying to understand biology itself," said > Los Alamos computer scientist and study coauthor Garrett Kenyon. "The vast > majority of machine learning, deep learning, and AI researchers never > encounter this issue because in the very artificial systems they study they > have the luxury of performing global mathematical operations that have the > effect of regulating the overall dynamical gain of the system."

<comment><USER5> See also:

[https://en.wikipedia.org/wiki/Spiking_neural_network](https://en.wikipedia.org/wiki/Spiking_neural_network) [https://en.m.wikipedia.org/wiki/Hopfield_network](https://en.m.wikipedia.org/wiki/Hopfield_network)

</comment></comment></comment><comment><USER6> A good discussion from May: [https://news.ycombinator.com/item?id=23366516](https://news.ycombinator.com/item?id=23366516)

</comment><comment><USER7> Questions. Does this explain

\- Why we dream?

\- Why we process information while we sleep?

\- Why lack of sleep is associated with serious health problems?

\- Why the amount of sleep is so long - about a third of the day in the most common case - but varies a lot from person to person and by age?

A model of a brain as a neural network that's constantly learning, but for stability purposes needs a restart every so often, doesn't seem convincing in terms of other things we think we know about sleep.

<comment><USER8> 1) REM sleep is associated learning new skills. We can teach experimental subjects a new skill in the laboratory, selectively interrupt their REM sleep, and see that their skill doesn't increase to the same extent as a control group who don't have that phase interrupted. The same isn't true with non-REM sleep. We don't really understand the mechanism though and this potentially does bear directly on the question.

2) Well, it would get in the way of actually living? If you're talking down some stairs and then your brain's motor cortex starts working on consolidating a skill and you fall you'd hurt yourself.

3) I don't think we know that. Possibly we had to sleep for memory related reasons and our bodies just evolved to use that time for other sorts of important housekeeping when it wasn't moving around doing stuff?

4) Learning is very important and takes time. In addition to the procedural memory consolidation in REM sleep we also move long term memory to a more stable form of storage in other phases. But neural nets don't really have anything analogous to a brain's explicit memory so this doesn't really bare on that.

<comment><USER9> #3: Doesn't hibernation suggest the reverse?

Sleep is primarily an energy conserving activity, being able to survive periods of low energy availability (winter) is an evolutionary advantage.

</comment></comment></comment><comment><USER10> For a functionalist, this and every other "more general AI might need X also" is expected. Like, humans need sleep, pain, anxiety, social mediation, etc to achieve our high level of generality. IMO, our base case should be that a sufficiently general AI will need them as well.

I'm very excited by the budding neuromorphic phase of generality research for these kinds of discoveries

<comment><USER11> Production ML systems already do this: servers used for peak capacity are repurposed during lulls to retrain the model and do tasks like compact data. That retrained model is then shared across the system.

So I'd argue that ML systems already "sleep", it just looks more like dolphin sleep due to their similar need for continuous operation.

</comment></comment><comment> Pick-A-Hill2019 (previously submitted by laurex)

[https://news.cornell.edu/stories/2020/03/researchers- sniff-o...](https://news.cornell.edu/stories/2020/03/researchers-sniff-out-ai- breakthroughs-mammal-brains)

</comment><comment><USER12> > The best results came when they used waves of so-called Gaussian noise, > which includes a wide range of frequencies and amplitudes.

Yesterday I was listening again to some videos of rain, to help me relax. I know very little about what happens when we sleep or why we dream. But if it is sort of like exposing our brains to soft noise, then that helps me understand why rain relaxes me.

</comment><comment><USER13> Good idea or bad idea: browser profiles where User enters their level of understanding for a variety of subjects. browser sends the level specific to each web request. Server customizes content, returning the same article, styles ranging from explain-it-like-I'm-five to just-show-the-research-paper.

<comment><USER14> That would depend on how it's exposed to the user. Are you empowering the user to run up and down that scale, or just feeding them whatever your model thinks is best?

<comment><USER13> A slider at the top of the page gradually adding detail and vocabulary?

<comment><USER14> That could be cool. Another idea would be to present an executive summary at the top and more detailed versions as you scroll down. Sort of akin to how pictures load from more -> less pixelated on a slow internet connection.

</comment></comment></comment></comment><comment><USER15> Why do things need to be unconscious for brain repairs to happen? Wouldn't evolution find it advantageous for a mind to stay awake while this happens? Yet no animal has found a way to do so.

<comment><USER16> some animals alternate sleep between each hemisphere, there's a bunch of examples of exotic sleep patterns in 'why we sleep'

<comment><USER15> That's a workaround to ultimately still sleeping.

</comment></comment></comment><comment><USER17> Really tiring of this clickbaity nonsense infecting science and math. This analogy is so tenuous you could snap it with a feather.

<comment><USER18> _"AI may need food too"

"AI may need friends too"

"AI may need training too!"_

<comment><USER19> For ~70 years, the brightest minds on earth have been trying and failing to solve AI. Many of them refusing to consider that something useful can be learned from the human brain; the gold standard of what it means to be intelligent.

Yet today, cutting edge deep learning technology is based on a crude and increasingly inaccurate model of neurons.

If we're now making discoveries that are revealing artificial processes that are similar to our own, it's a sign we're headed in the right direction.

<comment><USER20> >the only indisputable example of intelligence in the known universe

I dispute that any time any day with you, just because we define what intelligence is, do's not mean that we are intelligent.

<comment><USER19> Unless we've specifically defined intelligence in a way that reflects ourselves.

The useful things that we want to get out of an AI system, i.e generalized learning of abstract concepts, are most clearly demonstrated by the human brain.

Since we now seem to prefer down votes over discussion, I'll just leave this with my own speculation that the reason for this strange avoidance of the brain is that it's a dead end for both academia and industry.

It's much easier and more profitable to expand on already existing machine learning technologies than to try and find some revolutionary breakthrough in neuroscience.

<comment><USER20> Well we accepted that animals are intelligent too (no really long ago but still), even that something like a swarm-intelligence exists, but yeah i know what you mean.

EDIT: Wow you changed your comment that much that my comment makes nearly no sense anymore.

</comment></comment></comment></comment></comment></comment><comment><USER21> > spiking neuromorphic processor

what is this pls?

<comment><USER22> My (non-expert) take on this...

A neuromorphic processor is a processor that tries to function as the brain does. I say tries to because the models are still very simplified versions of how we think that a neuron works. The spiking part comes from one of these models. A neuron will only send an electrical signal to another neuron once a certain threshold is met, this is what is meant by a spike. What this allows us to do is to add a temporal/time component to a neural network. You've probably heard of "neurons that wire together, fire together". If you have a lower threshold it means that the neuron you are sending the signal to is more relevant for whatever thought process is going on right now and vice versa. New input can change these thresholds.

The biggest promise of spiking neuromorphic computing seems to be a massive reduction in energy usage while still offering decent accuracy. So for example you could use it to train a neural network to get to 80% accuracy after which you'd let another type take over to get to 95%. This field is still in its infancy though, so expect things to change/improve fast.

<comment><USER5> > neurons that wire together, fire together

i.e. Hebbian learning

Usually with a Hopfield network or something similar.

My personal take is that biologically plausible approaches are attempting to discover (and in lieu of understanding, harness) the algorithms (or mechanisms that cause emergent intelligence) of our brains.

</comment></comment></comment><comment><USER23> Have you tried turning it off and turning it back on? It works for all other computers, why not artificial brains?

<comment><USER24> The obvious answer is that if the source of the problems is in state that is persisted, then an active cleanup process may be required. Turning a database off and on again will not help reduce its index bloat.

</comment></comment><comment><USER25> If lack of sleep is linked to dementia and poor long term learning in humans, and that every living organism in the world sleeps, I can believe machines might need it too

<comment><USER26> That is flawed reasoning. Every intelligent organism in the world needs blood, and machines do not.

Modern airplanes don't flap their wings either.

<comment><USER27> They don't need blood but they need energy, planes don't flap their wings but they need to generate lift. Whatever the function of sleep is, I think artificial minds will likely need it too.

<comment><USER24> We have a handy analogy in the computing world, in that stop-the-world and concurrent garbage collection algorithms both exist. If sleep is pure garbage- collection, then I don't think there's any strong reason to expect it to be required of all possible mind designs.

However, it seems increasingly likely that the empirical question may be answered at some point soon!

</comment></comment></comment></comment><comment><USER28> Haven't read but I'm betting that there's an analogy to disk defragging...

<comment><USER24> How much are you betting, and at what odds? Because I'll take them.</comment></comment>


CircleCI raises $6m Series A - <AUTHOR> http://blog.circleci.com/we-raised-a-6m-series-a/ <comment><AUTHOR> I feel like I owe a special thanks to the HN community. You guys were CircleCI's first customers, and we learned almost everything we know about building a business and having happy customers from HN. This community is amazing, and so much of our success is due to you guys!

<comment><USER3> Congratulations!

The best thing about Circle for me is how fast it is, but more importantly, how fast it _appears_ to be. Some of it I can attribute to clever tech (running tests in parallel in multiple containers for the same build is something that never occurred to us), but a major part is also clever UX.

</comment></comment><comment><USER4> Congrats to Paul and the rest of the team! I have been recommending CircleCI to all of my dev friends ever since my first experience with it over a year ago.

We had a pretty tricky front end testing setup with our Rails app, due primarily to some bleeding edge javascript interactions that needed to be tested in a headless browser. It took ages to get right locally, so I had zero confidence that Circle would handle it. I set up our repo and promptly forgot about, as I was traveling out to SF for Startup School 2012.

While waiting in the lobby of YC for the pre-event dinner, I got an email from Circle (actually, from Paul) that our repo was ready and all tests were passing. PASSING?! Whoa. As I read it, I looked up from my phone and Paul was standing in front of me. I wanted to give him a hug, but I settled for a friendly thank you and a handshake. =)

<comment><USER5> Can you share what you like most about CircleCI? What do you hate most about it?

<comment><USER4> For us, it just worked. I'm a one-man engineering team at a startup, so I don't have the resources to devote to running an in-house CI setup. Circle took care of it for us, and their UI and features are just perfect.

</comment></comment></comment><comment><USER6> Congrats guys. Always nice to have more examples of "See? We're not all doing mobifotosocialgames." Particularly when they're doing so well.

<comment><USER7> Instead, they're helping people doing mobifotosocialgames.

It's a good business selling pickaxes during the gold rush.

<comment><USER8> We use Circle at my Rails consultancy. They make us more productive, which in turn helps us work from wherever we want—a coffeeshop near home or anywhere in the world.

Also, we're using Circle to help with a project for monthly life skills training workshops. Not only will this project save the workshop staff 180 hours a month, but will also make it far easier for trainees to register for the workshop. Circle is, indirectly, working to make thousands of people's lives better each year.

Congratulations Circle, we're really happy for you guys!

</comment></comment></comment><comment><USER9> Congrats!

Good to see a Clojure based stack going places. We use it and have been super happy with it.

</comment><comment><USER10> Does Circle have a way to give builds more RAM yet? We really liked Circle when we first tried it at Conspire but the 2GB cap meant we couldn't stay with it and we've been fighting Jenkins on a daily basis ever since. Our tests involve spinning up 5-6 JVMs to simulate an Akka cluster so we need a _lot_ of RAM.

<comment><USER11> What issues have you run into with Jenkins? Just curious.

<comment><USER10> A few times a week is decides to re-download all our dependencies for reasons we haven't been able to figure out. That's the big one we've been dealing with right now.

</comment></comment></comment><comment><USER12> Super excited to see this news and what the CircleCI team have planned. Can't overstate how much I love CircleCI or how much easier it makes my life. Definitely one of the best services I use day to day.

Congrats to the team! It's well deserved.

</comment><comment><USER13> CircleCI made possible a fundamental change in our dev process. It is now an integral part of our QA process and is present at every step of development.

</comment><comment><USER14> Saw these folks at CloudBeat last year. Thought their pitch was terrible but OMG did I love the product (I still thought they should've won!).

Really glad to see they successfully raised a series A. I believe it was Paul who pitched and when I went up to him afterwards I was blown away by how humble, polite and just plain nice he was. Wishing these folks the best of luck :).

</comment><comment><USER15> Am I right that it only supports github repos? Because however awesome github is, I just prefer not to count how many repos I have. In other words, does it support any git repo? Can't find it anywhere on their pages.

Would make me sad not to be able to use circleci, which has straight forward use and value prop.

</comment><comment><USER16> We've been using CircleCI for a few weeks and it's been a great experience. The product is great and their customer service was awesome - they got back to me almost immediately to help me fix a bug on my end. Great stuff!

</comment><comment><USER17> Congratulations! We've been happily using CircleCI as part our test/deploy workflow for a few months. Github and Hipchat integration works great, the web UI is easy to use, and ssh and parallelization are nice bonuses.

</comment><comment><USER18> Congrats Paul, Allen and team. It's been a pleasure to see CircleCi grow into the incredible fast CI service with a real detail in the UX of integrating into developer workflow.

Can't wait to see what you do next.

</comment><comment><USER19> We use CircleCI heavily at Wave. Love their parallelization feature - <USER2> brought a 25 minute test run down to 12. We could speed that up another 4x or so if we felt like throwing more money at it.

</comment><comment><USER20> We've been on CircleCI for months now and in addition to being an absolutely fabulous product the support has been astounding. Congrats guys, well deserved.

</comment><comment><USER21> Good job guys, product looks nice!

We currently pay for Codeship, anybody experienced both and have some insights to share? (not trying to start a war here!)

<comment><USER22> I personally pay for Codeship for my own projects, and we pay/use CircleCI at up.co. I love both. Both have given us pain in random edge cases where things just don't work, which is frustrating. Both have provided amazing support whenever we needed it. Both have all of the technical needs we require. Both accommodate the exact same Github-based workflow with Heroku & Hipchat.

My suggestion: flip a coin. Or choose based on something arbitrary like which website design you like more. They are both great startups that deserve your business.

</comment></comment><comment><USER23> Huge congrats to Paul & Co - great team, with a great product. It's a genuine joy to watch them do well.

</comment><comment><USER24> CircleCI is really neat, going to ditch the slow CloudBees build server as soon as CircleCI gets the last remaining issues sorted out. Hope the money lets them hire someone who can write proper docs and changelogs :-)

</comment><comment><USER25> Your guy's product is such a boon. Can't even begin to count the hours...no, weeks saved due to it. Great to hear it.

</comment><comment><USER26> This may just be the push I needed to investigate what CircleCI is and what services and/or products it provides.

<comment><AUTHOR> Reach out if you need any help; email@example.com

<comment><USER27> If you open offices in the UK, let me know...

</comment></comment></comment><comment><USER28> Awesome -- hopefully now they can address the memory leak :] (CircleCI is wonderful otherwise).

</comment><comment><USER29> Congrats, guys. Another big circleci fan here. Can't wait to see where they go.

</comment><comment><USER30> Congrats Paul & team :)

</comment><comment><USER31> Congrats, we're a customer and we're approaching 10K builds...

</comment><comment><USER32> Congrats! We use you guys and you absolutely deserve it.

Also, thanks for the stickers!

</comment><comment><USER33> Congrats! My experience with CircleCI has been nothing but positive.

</comment><comment><USER34> Congratulations guys. Great news.

</comment><comment><USER35> Yay! Congrats paul :), keep it up

</comment><comment><USER36> Well done. Great service!

</comment><comment><USER37> Congrats Paul and team!

</comment><comment><USER38> Awesome! Congrats guys.

</comment><comment><USER39> Congrats!</comment>


World of Warcraft Classic Relase - <AUTHOR> https://worldofwarcraft.com/en-us/wowclassic <comment><USER3> I wonder how long Blizzard can still stay in the game. It seems they 're only repeating themselves now. EA is boring but they keep doing their job, as for Blizzard they seem to be fully stopped creating things.

Recently they are only remaking old games StarCraft, WarCraft, World of Warcraft. Basically, the remake doesn't touch the functionality. They seem only want to juice money from their current market.

For more 'real' new games from Blizzard like Overwatch is Okayish, and Heroes of Storms (I can't even be sure about the name) are bad.

Anyway, I think I would play Classic for a while, but I guess it wouldn't be long. Although It was and still is the best game I ever played, without constant releases, it just won't persist - World of Warcraft doesn't mean to be modeled as a game with infinite replay value without new releases. And there won't be new releases because would be branching the game.

<comment><USER4> its Activision wearing blizzard's dead skin. Most blizzard "minds" have left for other pastures.

<comment><USER5> Oh come on, Activision has owned Blizzard for over a decade, during which Blizzard has released many of the most popular games and expansions for WoW.

<comment><USER6> Blizzard had a fair amount of inertia. They had been working on Diablo III (2012) for years but it shows how quickly Activation destroyed what made Blizzard great. The problem was not really core gameplay mechanics at release, it was the final balancing being completely out of whack that destroyed the game. This meant early review where generally positive, but gamers quickly stopped playing as late game was simply broken.

Similarly, Burning Crusade and Wrath of the Lich King are pure Blizzard. Cataclysm (2010) was controversial. On the other hand Mists of Pandaria (2012) was generally disliked, Warlords of Draenor (2014) was an inane mess.

<comment><USER7> I'd disagree that Wrath of the Lich King was pure Blizzard, in fact I'd claim the final patches of Burning Crusade marked the beginning of the end for many players. IIrc, monetization efforts such as faction transfers[0,1] and pets were introduced during that expansion and "casual-friendly" tools such as the dungeon finder[2] and heirlooms[4] were developed to attract more players. All of these changes were already extremely controversial.

[0] [https://wowwiki.fandom.com/wiki/Character_Transfer](https://wowwiki.fandom.com/wiki/Character_Transfer)

[1] [https://wowwiki.fandom.com/wiki/Faction_Change_service](https://wowwiki.fandom.com/wiki/Faction_Change_service)

[2] [https://wowwiki.fandom.com/wiki/Dungeon_Finder](https://wowwiki.fandom.com/wiki/Dungeon_Finder)

[4] [https://wowwiki.fandom.com/wiki/Heirloom](https://wowwiki.fandom.com/wiki/Heirloom)

<comment><USER6> The merger was 7/8/08, years after character transfer from mid 2006.

[4] "The precursors to modern-day heirlooms were introduced in Vanilla/Classic World of Warcraft. Heirlooms up to the Wrath of the Lich King expansion were items that were sold by a specific battleground vendor. There were Warsong Gulch, Arathi Basin and Alterac Valley heirlooms."

[2] This depends on how you mark an expansion. IMO, after the initial bug fixes are put that's the expansion. Everything after that like 3.3.0 is it's own separate patch.

<comment><USER7> My bad, I mistook the character transfer with the faction change service. Still, I remember there being a push for it which seems to be confirmed by the wiki: "initially, there was a 6 month cooldown between character transfers. In late February 2008, the cooldown was reduced to 1 month. In July 2009, the cooldown was reduced to 3 days."

Regarding heirlooms, they were introduced in WotLK:

"Heirlooms that increase experience and scale based on character level were introduced in the Wrath of the Lich King expansion."

The line is blurry, but I believe that a trend was definitely noticeable even in late Burning Crusade. In particular, efforts to attract a broader player base. It is unfortunately surprisingly hard to track and timestamp all the controversial changes introduced to the game.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> For those interested, they at least have a medium size write-up how they created this technically:

[https://worldofwarcraft.com/en-us/news/22646759/restoring- hi...](https://worldofwarcraft.com/en-us/news/22646759/restoring-history- creating-wow-classic-panel-recap)

Here is a live blog of the Blizzcon talk: [https://www.wowhead.com/news=288407/blizzcon-2018-restoring-...](https://www.wowhead.com/news=288407/blizzcon-2018-restoring- history-creating-wow-classic-panel)

My take is one of the original programmers for WoW still at work's at Blizzard and helped great deal with this effort. They were also able to go back in their source Control and pull the code from back then and they've been different current code to previous code in various places to see how behaviour has changed. And then Ford porting old behavior onto a existing client.

</comment><comment><USER9> No, thank you. Same game, same grind, same close-to-real-life (or more!) struggle. It is a drug I have clean of for a few years now. Hard pass.

<comment><USER10> Not even nostalgia could get me to play it. Just think about what running five man instances was like in vanilla. Find a group in chat. Run to the instance (which can take like half an hour if you're far away). Wait another half hour for everyone else to get there. Enter the instance, wipe on the first pack, and the group disbands. That's an hour+ of "playing" a game where you accomplished exactly nothing.

<comment><USER11> I disagree, or at least my experience on private servers hasn't been this. Putting a group together in chat and getting everyone to the instance takes time and work yes, but that generally means you don't bail at the first wipe.

It might not work that way with new players coming in to classic, but making it trivially easy to group and port to an instance has its own problems.

</comment></comment></comment><comment><USER12> There's a nice writeup about how the WoW team went about re-creating a 10-year-old version of their game with modern security and toolchains

[https://worldofwarcraft.com/en-us/news/21881587/dev- watercoo...](https://worldofwarcraft.com/en-us/news/21881587/dev-watercooler- world-of-warcraft-classic)

</comment><comment><USER13> I really wish I could find a game that captures the 5-person PvE experience that was early WoW classic without it turning into a grindfest or a raidfest. You don't even need the loot or the crafting elements. It was the beauty of the tanking, healing, crowd-control and strategy. I've not really found anything that captures this out there (suggestions very welcome!).

Many suggest games like Diablo but it tends to play more as a scaled single player game than a genuine balanced composition group game (i.e. if you're not hearing/feeling "Need healer/dps/tank"! it's not what I mean). MOBAs brought this for PvP but there are many out there that simply like good ol' PvE co-op with character and strategy.

<comment><USER14> I'm sorely disappointed by modern games throwing out class roles. Even WoW got rid of support roles and only left healers. And then there are games where I can't play a healer at all, which simply annoys me - I'm just bored out of my mind if all I can do is shoot at people or be DD. The Division 2 was the latest massive disappointment. Where the first game let you spec into being a tank or a healer, which was incredibly awesome for the setting, the only real meta in TD2 is damage, damage, damage.

<comment><USER15> Is that really the new trend? That's sad. Support and healers being separate was cool. And then tank and varied attacking classes (direct and mage-like). Sorry I don't remember terminology that well. But this could also just be nostalgia talking. And I didn't enjoy rogue type of classes ever.

</comment></comment></comment><comment><USER16> Y'all need to liven up a bit, try to be a bit more positive.

WoW is a landmark in the gaming world and we now have the chance to replay it. Maybe try a RP server. I for one am excited to play it, even though I don't have that much time to dedicate to this.

For the horde!

<comment><USER17> RP servers are a blast. Even if you don't RP, the RP community makes for a much friendlier and livelier server than non-RP ones do, imo. But do try RP! It's a lot of fun and very challenging at times.

</comment></comment><comment><USER18> Everything I absolutely loved about WoW is inaccessible to me 15 years later now that I have kids and a job.

I'm really curious to learn about the sustained user count of those who never played classic.

<comment><USER19> You really just need to either:

a.) Schedule your time better (timebox, baby)

b.) Or get the kids and wife involved

c.) Or stop whining about it.

<comment><USER20> Your comment is completely out of touch.

a) "Scheduling a baby" or children in general isn't a thing. They are full time commitments. Which is the entire point of the original comment. To say nothing of the fact that MMOs like WoW are extremely time demanding games. Its pretty hard to play WoW casually, for small amounts of time, and actually get enjoyment out of it. Which again, is the point of the original comment.

b) Possible, but unlikely. MMOs are pretty niche, and again, giant time commitments. Its unlikely his entire family will be into the idea of all grinding away together online. But sure, its a possibility.

c) At no point was the comment doing anything resembling whining. It was simply pointing out that much of the fanbase that would potentially be enticed to come back to the game by WoW Classic has aged into a stage of life where it will be hard if not impossible to enjoy it the same way they did previously. Its simply an observation, and a good one at that.

<comment><USER19> For the record: I'm a husband and father of two college age daughters. My daughters game casually.

I think you misunderstood the 'timebox baby' comment. I was simply suggesting timeboxing the gaming time. And clearly communicating that with the wife (at the very least). I wasn't suggesting timeboxing baby / children / family time.

To my ear, the statement 'Everything I absolutely loved about WoW is inaccessible to me 15 years later now that I have kids and a job.' sounds like whining: No indication of any failed effort -- just lamenting.

</comment></comment></comment></comment><comment><USER21> Is there a key to getting more into MMOs I'm missing? Once or twice a year I'll pick one up for a week or two and blow most of my free time on it... then get bored and move on to the next thing.

<comment><USER22> Yes. Clan involvement. If you just play alone, you won't get as hooked.

<comment><USER23> Depends ont the MMO as well. For example I only play FFXIV and that's very very single player friendly with a huge focus on story. Same with FFXI that became single player friendly with the Trust system tho that's an old school MMO (akin to Everquest and such)

<comment><USER24> Even FFXIV (my current drug of choice) has limits to what you can do as a solo player. Even the MSQ - the most single-player content in the game - <USER2> you to group up with others every other level and do dungeons. It's a mostly seamless process with all the duty finder enhancements and roulettes that bring existing players back to the old content, but it's still there.

The benefit of a clan/guild/free company can't be understated. They will provide entertainment, support, and access to a set of content that's otherwise very hard to do.

<comment><USER25> From ShB onwards, you can now use the Trust system to solo dungeons and MSQ events. I'd be willing to bet they will port this to older dungeons once New Game+ comes out, although I am not sure if they'll ever do this with roulettes.

<comment><USER24> Trusts do alleviate a portion of it, but there's entire swaths of content you can't do solo (including all of the MSQ-blocking Trials).

I like trusts, but they're definitely a band-aid for a very specific issue (DPS queue lengths).

</comment></comment></comment></comment></comment></comment><comment><USER24> There will always be an audience for a MMO that walks the fine line between too punishing, and not punishing enough. It is, however, a niche genre, and the feeling that many are hoping to recapture with the release of classic will not exist anymore.

The game is, for the serious raiders, too simple. For the casual crowd, it's going to be slow and comparatively unrewarding. The nostalgia hit for people who have played it before will wear off fairly quickly, leaving only those for whom classic WoW hits their sweet spot. At least for a year or two. What will happen once those niche players hit max level and run out of content to do?

<comment><USER26> Had similar thoughts.

I think a lot of people have rose tinted glasses on and simply don't remember how simple the game used to be and how far it's evolved since.

I am curious what they've done with the mechanics though. Some were broken by expacs, some were fixed, wonder what they rolled back and what they left.

<comment><USER27> They rolled back everything except obvious exploits like wall jumping or macroses automating your rotation in one button. It's not pixel-perfect remake, but it's very close to it.

<comment><USER28> Seems a little disappointing if they disabled wall jumps.

Were there any wall jumps that were actually exploitable (i.e. let you do bad things)? Most of the ones I remember just let you get to weird spots in the environment.

<comment><USER29> Theres still plenty of wall jumps, you can find videos of people testing all the classic WSG jumps on youtube. The classic wall-walking doesn't work, but that was changed during vanilla so its to be expected.

</comment></comment></comment></comment></comment><comment><USER30> World of Warcraft 2: The Search for More Money

<comment><USER31> To be fair, it comes with your World of Warcraft retail subscription, and you don't have to purchase the original game again nor the latest retail expansion (Battle for Azeroth) to play it.

<comment><USER14> > To be fair, it comes with your World of Warcraft retail subscription, and > you don't have to purchase the original game again nor the latest retail > expansion (Battle for Azeroth) to play it.

Seems to me like Classic is aimed at players who aren't currently subscribed, who aren't served by the current modern WoW. You know, different demographics and stuff. I know I'm not subscribed, but I'm considering resubbing just for Classic, and I've seen plenty of people in the same position.

</comment></comment></comment><comment><USER32> >Releases August 27, 2019

</comment><comment><USER33> I haven't played WOW since the first version, which I guess is "classic" now. I'm wondering what the draw would be for something like this, as I assume the current version of the game is this plus all the extras and bonuses from the expansions over the years? Is it just nostalgia for the "classic" version or is there some other reason someone would want to play this instead of the updated version?

<comment><USER34> Nostalgia is part of it.

The other part of it is a genuine desire for a more difficult, time-consuming, socially-driven game.

<comment><USER35> Yeah, this.

I was a pretty dedicated player, off and on, from open beta in late-summer 2004 through the Cataclysm expansion in 2012, with a little dabbling later for Mists of Pandaria in 2014.

The game changed a LOT. I was never much of an endgame raid player; I really, really enjoyed the progression through the world with friends, so I did that several times.

As WOW shifted to be more endgame raid focused, world progression got a lot faster, a lot lonelier, and a lot less interesting. OTOH, those first years of playing WoW remain, to me, probably the best video gaming experiences I've ever had (and I'm pushing 50, so I've seen the whole ride).

I'll probably re-up to play some Classic. I doubt I'll stick with it -- I have other things I enjoy doing now that would preclude me from playing more than an hour or two a week -- but it'll be fun to visit that world again.

(Oh, and I should note for non-WoW people that the actual in-game world literally changed -- geography shifted, towns were destroyed, etc -- with the release of Cataclysm in 2010. Among the shattered places left behind were the early-level zones for my first characters. I'd love to see those as they were again.)

<comment><USER33> Ok, got it, thanks for the explanation :) I also really enjoyed the exploration and social aspect of the early part of the game back then, I quit when that was over and seemed as if the rest of it would just be re-doing the same raids over and over trying to get slightly better gear.

<comment><USER35> EXACTLY. That grind held no charm for me.

</comment></comment></comment></comment></comment><comment><USER36> I think the magic is mostly that everyone can start fresh again without the added clutter from the many expansions and without a lot of things handed on a silver platter for the user, also since the leveling process is slower the user might feel more accomplished when they hit the end game.

I wonder if adding a diablo like ladder type system where everyone starts fresh periodically (see Path of Exile leagues) make game a lot more addictive.

</comment><comment><USER37> To repeat what many have said I'm not sure why this is so popular or highly anticipated. I played WoW vanilla heavily 15 years ago, was bleeding edge, had the legendary hammer from ragnaros, and then.. you know.. grew up. Got burnt out and quit shortly after the 1st expansion, got a career, got married, etc.

Why would I go back to that mess? What's the appeal of 5+ hour raids every night in 2019? For content thoroughly covered 15 years ago. "Nostalgia" is no where near enough for me and I would expect that I am the primary demo for this product. Maybe if they gave me my hammer back..

</comment><comment><USER38> The only game that made me play all day long and only do casual toilet stops.

</comment><comment><USER39> eh. i'm excited for it. a few of my friends are, as well.

then again, we must be gluttons for punishment, because we played on nostalrius for a while, too.</comment>


Mathematical finance cheat sheet - <AUTHOR> https://github.com/daleroberts/math-finance-cheat-sheet

<comment><AUTHOR> Contributions generally accepted if anyone wants to play...</comment>


Georgia Takes a Beating in the Cyberwar With Russia - <AUTHOR> http://bits.blogs.nytimes.com/2008/08/11/georgia-takes-a-beating-in-the-cyberwar-with-russia/index.html?partner=rssnyt&emc=rss <comment><USER2> Here's today's article by the same journalist (John Markoff), but some additional information:

<http://www.nytimes.com/2008/08/13/technology/13cyber.html?em>

It seems that Georgia has to currently go through Russia for their Internet communications.</comment>


New clean infinite energy? - <AUTHOR> https://www.youtube.com/watch?v=9FxJkQ3mJ3I Can anyone with more knowledge of the subject comment on this? Is this feasible as a new energy source or is it a hoax? <comment><USER2> My guess is the energy generated by the spinning hemisphere is less than the energy required to move his wrist when holding the magnet...

<comment><AUTHOR> If that's the case, I find it counter intuitive: he barely moves the upper part of the mechanism while the lower part spins like crazy.</comment></comment>


AI-generated music to improve focus, relaxation and sleep - <AUTHOR> https://www.brain.fm/ <comment><USER2> A nice web site!</comment>


Firefox 4 beta 4 released with Pandorama (was TabCandy) - <AUTHOR> http://blog.mozilla.com/blog/2010/08/24/firefox-4-beta-updated-with-sync-and-panorama/

<comment><USER2> Is "Pandorama" in title an intended invention? Pandora+Panorama == Pandorama

I like it.;)

However, the official name is Panorama.

<comment><AUTHOR> Ack, I apparently can't type or proofread. _fail_</comment></comment>


"HTML7 magic" on Facebook - <AUTHOR> http://jasonbos.co/facebook-login-with-only-email-and-html7magic

<comment><USER2> The separate password page is served over https instead of http like the initial page. This allows the initial page to load faster without the ssl handshake overhead while still sending the password over an encrypted connection.

What's unusual to me is that the username field is on the initial page. On most sites I've used that upgrade from http to https, only a generic login button is on the unencrypted page, e.g. creditkarma.com. Maybe facebook a/b tested this setup and found users log in more often.

</comment><comment><USER3> HTML7 is likely a joke on Matt Cutts' twitter status <https://twitter.com/#!/mattcutts/statuses/17066581623>

<comment><USER4> Yes probably. I see a pattern here.

</comment></comment><comment><USER5> I am not logged on Facebook, and I see both email and password field.

Also you can name a class anyway you want pretty much.

<comment><AUTHOR> Of course you can name a class anyway. But the choice of naming it html7magic is pretty intriguing to me.</comment></comment>


Overkill HN: Paying in the Age of the Smartphone - <AUTHOR>

So to pay a coffee via Apple Pay you need...<p>- A bank account<p>- A credit card linked to the bank account<p>- An iPhone<p>- An Apple account linked to the credit card<p>All this complexity. Why isn't the bank account enough? Starbucks could simply send "Please pay $3 to ...." via NFC, you tap "OK" on your banking app and you are done. <comment><USER2> How is the middle man going to get his cut?</comment>


The ethics of the organ trade: do two wrongs make a right? - <AUTHOR> http://gregmankiw.blogspot.com/2010/05/do-two-rights-make-wrong.html

<comment><USER2> In the author's world, people who would otherwise get an organ now will not be able to. If we allowed organ purchases on the free market, they would be allocated by ability to pay rather than by need.

Similarly, a person undergoing financial difficulty may end up selling organs to stay afloat.

In my opinion, the most morally acceptable result is not necessarily the most economic efficient one. The author disagrees, which is fine, but he doesn't look at the downsides to a more efficient system. The dilemmas above are completely ignored by the author, and he only focusses on the end result: economic inefficiency (more home foreclosures and deaths).

I'm weary of any argument that only looks at one side of the coin.

</comment><comment><USER3> The title of Mankiw's post is "Do two rights make a wrong?", not "do two wrongs make a right" as in the HN title. Mankiw argues that it is noble and "right" to voluntarily give someone a kidney. Likewise it's noble and "right" to voluntarily give someone money to help them pay their mortgage.</comment>


Ask HN: What I can learn new in a weekend? - <AUTHOR> <comment><USER2> How about how to relax, unwind and restore your soul.</comment>


Last.fm radio subscriptions - <AUTHOR> http://blog.last.fm/2009/04/22/radio-subscriptions

<comment><USER2> It seems to me like this was a missed opportunity for building a new model for audio-based advertising. Something that inserts adverts tailored to the listner (language, country, music choices etc) in between bits of music. However, I don't know Last.fm well enough to know if this would work - I've only used it a couple of times.

<comment><USER3> Pandora did. [http://www.techcrunch.com/2009/01/20/pandora-radio-starts- se...](http://www.techcrunch.com/2009/01/20/pandora-radio-starts-serving- audio-ads/)

(My apologies for TechCrunch, but it was the first result)

</comment></comment><comment><USER4> From the 'ripping the bandage off' school of PR - and there's a lot of 'owie' in the comments thread. Cringeworthy stuff but ultimately let's hope last.fm's long term viability increases because of the move, and that people get over the shift fast.

<comment><AUTHOR> People who still have access, you mean? All those who feel wronged will go on to other sites and loudly complain about the treatment.

Last.fm's reputation is going to suffer for a while.

</comment></comment><comment><USER5> I wonder how that price compares to other services that actually allow you to pause the music...

</comment><comment><USER6> PR: fail. Do they even have communication people aboard there?

</comment><comment><USER7> very strange business model !

</comment><comment><USER8> And there we have yet another complete communication failure from last.fm.

As if they didn't piss of people enough with their previous announcement, they sure as hell didn't pay attention to the feedback they got there and walked right into the same flaming pit once again.

With communication skills like this it will be interesting to see how last.fm develops from here on.</comment>


Explaining the AMD Ryzen "Power Reporting Deviation" -metric in HWiNFO - <AUTHOR> https://www.hwinfo.com/forum/threads/explaining-the-amd-ryzen-power-reporting-deviation-metric-in-hwinfo.6456/ <comment><AUTHOR> Summary:

>Some motherboard manufacturers intentionally declare an incorrect (too small) motherboard specific reference value in AGESA. Since AM4 Ryzen CPUs rely on telemetry sourced from the motherboard VRM to determine their power consumption, declaring an incorrect reference value will affect the power consumption seen by the CPU. For instance, if the motherboard manufacturer would declare 50% of the correct value, the CPU would think it consumes half the power than it actually does. In this case, the CPU would allow itself to consume twice the power of its set power limits, even when at stock. It allows the CPU to clock higher due to the effectively lifted power limits however, it also makes the CPU to run hotter and potentially negatively affects its life- span, same ways as overclocking does. The difference compared to overclocking or using AMD PBO, is that this is done completely clandestine and that in the past, there has been no way for most of the end-users to detect it, or react to it.</comment>


France is about to open source its tax calculator - l-vincent-l https://www.etalab.gouv.fr/codeimpot-un-hackathon-autour-de-louverture-du-code-source-du-calculateur-impots <comment><AUTHOR> The opening is happening because a citizen has been battling in court for the last 1.5 years and the court finally ruled in his favor....</comment>


Ask HN: ACM membership? - <AUTHOR>

I've been invited to an organizational meeting for an ACM chapter at my college later this week. I took a look through the brochure and got the impression it seems to be targeted more towards students looking to go on in graduate studies.<p>Is this the case? In other words, what are the benefits of being an ACM member? <comment><USER2> I was a member of the ACM for a couple years in my undergrad. All I ever really got out of it was a subscription to the (fairly good) magazine "Communications of the ACM".

<comment><USER3> I would add that CACM isn't what it used to be. Nobody's fault, just the result of an expanding field of study. Back in the day, many classic papers would appear in CACM. Nowadays, they'd more likely appear in a SIG publication.

</comment></comment><comment><USER4> I like the ACM club at my school. Its the best collection of programmers at my school so Its the best chance I get to hang out with coders and similarly minded people. They also had a great hackathon a month or so ago where we got to meet some awesome people and get sponsored by top level companies.

</comment><comment><USER5> The main advantage was access to the ACM digital library where a large number of computer science related papers are found. I don't know if this is still included in the student account or is extra.

</comment><comment><USER6> Also access to Book 24x7 and Safari. And there are on-line courses, which I can't speak to.</comment>


Average Tax Refunds Down 8.4 Percent as Angry Taxpayers Vent on Twitter - <AUTHOR> https://www.huffingtonpost.com/entry/tax-refunds-down-84-percent-twitter-complaints_us_5c5e4576e4b0eec79b2379e4 <comment><USER2> Stupid people complaining about not being forced to give IRS an interest-free loan... priceless.

</comment><comment><USER3> Is your total tax down? Or just your refund? Be better humans.</comment>


Real Paper Airplane Designs - <AUTHOR> http://www.foldnfly.com/ <comment><USER2> 10-year-old me would have loved this so much. A lot of the designs look similar to the ones from The World Record Paper Airplane Book[1], which, for a brief time, got me super fixated on the idea of trying to break paper airplane-relate world records, which, alas, did not pan out...

[1] [http://amzn.to/2dqPejE](http://amzn.to/2dqPejE)</comment>


Simon Willison: Comet works, and it's easier than you think (server push, instead of Ajax polling) - <AUTHOR> http://simonwillison.net/2007/Dec/5/comet/

<comment><USER2> I'm convinced that Comet style architecture is the next big thing. As the libraries and tools mature there will be some pretty nifty implementations of previously impossible or extremely difficult to implement features.

Meebo.com is a good example.

</comment><comment><USER3> Another reason Comet is an appropriate name:

"The data cometh to thou on its own!"</comment>


Security for Open Source Code: Dynamic Analysis Is the Only Way - <AUTHOR> https://blog.sourceclear.com/dynamic-analysis-is-the-only-way/ <comment><USER2> That is not what dynamic analysis means but I appreciate everyone redefining terms to suit their marketing. [https://en.wikipedia.org/wiki/Dynamic_program_analysis](https://en.wikipedia.org/wiki/Dynamic_program_analysis)

<comment><USER3> Agreed. Their definition of static analysis is laughably bizarre as well; there are many security and safety properties that can be proved by static analysis but not by dynamic analysis. Additionally, many of the problems they attribute to static analysis (non-specific versioning and recursive dependencies) are caused by the package managers themselves, and can be solved using static analysis if the build tool is well defined and well behaved.

Their tool has a few major weaknesses:

      1. Builds are not reproducible - Reproducible builds require pinned package versions, which they specifically avoid. This could result in security holes if a dependent package version was bumped after the parent project was tested.

      2. Subject of analysis - Their main target of analysis is the build file. This severely limits the extent of their analysis and requires them to build new tools for each build tool used.

      3. Underestimation - Since a code path must be exercised in order to analyze it, you are guaranteed that the set of vulnerabilities detected is a subset of (or equal to) the true set of vulnerabilities. This is the opposite of what I believe should be the default: Always prefer false positives over false negatives. Both static analysis and binary analysis allow the programmer to over-estimate their analysis, guaranteeing that all vulnerabilities will be found.

<comment><USER4> I'm not sure what you mean by #1, the builds are as reproducible as the build system being used.

For #2, SourceClear doesn't build the software under test, it's hooked into the build via various methods. For Maven and Gradle, those are plugins. For NPM and Bundler, the existing build files contain the complete dependency graphs as determined by the build system. The analysis is quite accurate, I daresay more so than any other tool. Yes, it requires implementation work for each build stack, but that's the price you pay for accuracy.

In response to your #3, SourceClear doesn't report only vulnerabilities verified by call paths, it reports on _all_ components will known vulnerabilities and denotes if a call path was found.

Disclaimer, I'm a Co-Founder and have spent a great deal of time writing scanning code.

</comment></comment></comment><comment><USER5> Interesting. So if I understood correctly, you dynamically analyze the build process (and that's why you use that term) instead of just parsing the build file, because you don't know exactly how the dependencies are going to be resolved from the package manager during the build process. How do you verify that a specific version of a library is used during the build and not some other version (you just do a hash lookup or have a way to generate signatures with small false positives) ? Also, what happens if the package manager is compromised (for example it informs you that she used version 2.0 but instead she used a vulnerable version) ? For the call graphs, do you find the relationships between each procedure for the whole project and if so, isn't that literally static analysis ? Sorry if my questions don't make sense or are trivial, I am just looking it from a research perspective, because I am working on somehow similar things.

</comment><comment><USER6> I agree w/all the confusion regarding terminology. It's still static if you're not executing the code.

But, back to the premise: it would be really helpful if you [the author] could illustrate security defects which can be detected using "dynamic analysis" which cannot be detected with "static analysis." Legitimate, actually exploited/able vulnerabilities would be ideal.

</comment><comment><USER7> I don't understand what exactly they're saying. Seems to me they're comparing apples, oranges, and cherries. I don't know if they're willingly doing this or if they're trying to make the problem sound harder than it is.

You only need to perform whatever security analysis is necessary after all your dependencies are resolved. This does not require anything "dynamic". You just call the packager manager, wait for all the dependencies to be resolved, then verify there are no vulnerable versions, which is just a matter of looking up the relevant pieces in some database somewhere.

Which is fine if that's what they're doing but this article seems to be just smoke and mirrors mostly.

<comment><AUTHOR> We published this because there are lots of legacy tools that approach this problem with two specific weaknesses:

* Many tools just scan a text file where you declare your dependencies, which misses transitive dependencies and won't tell you exactly which versions are in use

* They use incomplete datasets for vulnerabilities, like CVE. Most OSS projects don't create CVEs for vulnerabilities, so it is a mostly useless datasource.

Besides having a complete view of the dependencies, we have a research team that is finding and disclosing new vulnerabilities all the time, which you can see here: [https://www.sourceclear.com/registry/explore](https://www.sourceclear.com/registry/explore)

<comment><USER7> That's a lot more clear and a much better description. I didn't get any of that from the post. Instead you explained several disparate processes each of which has their place in security analysis and declared a specific version the winner.

</comment></comment></comment><comment> r-w Except when the language itself is statically and strongly typed (a la Haskell).

<comment><AUTHOR> I haven't worked with Haskell myself (and we don't currently support Haskell), but it looks like Cabal is the package manager, which resolves the full graph of dependencies for your project.

Most dependencies are specified like "network-info >= 0.2" (taken from a random example: [https://github.com/bitemyapp/blacktip/blob/master/blacktip.c...](https://github.com/bitemyapp/blacktip/blob/master/blacktip.cabal)), which means you don't know which version will actually be used until you build the project. Which is our point in this blog post. If you just scanned that text file, you'd just be guessing at which versions of open source libraries are actually being used.

<comment> r-w I don't have a very in-depth understanding of dynamic analysis myself, so this may be somewhat of a simplistic question: Why not just resolve to the latest version of each library/module present on the system during the first pass through the list of dependencies?

<comment><AUTHOR> The package manager decides which packages are used based on how dependencies are specified. For example, you might ask for library-A >= 1.1, but a transitive dependency specification (a dependency of a dependency) may specify library-A >= 1.0 && <= 1.6. If versions up to 1.7 are available, you'd probably get 1.6. Probably. Because with some package managers, if you have version 1.5 sitting around in a local cache, it may use that instead.

Basically, never try to guess what the package manager is going to resolve. Just let it do its job, just as it does for your production builds, and use that information to look up any associated vulnerabilities.

<comment><USER8> You may be talking about two different situations. "r-w" might be thinking about a build style where compilation just uses the versions of libraries available on the system, rather than going to the package manager on a per- build basis and re-fetching dependencies (so, something more like a C build than a Rust, Haskell, or Node build).

As an aside, and echoed by a few other comments in the thread, what you're calling "dynamic analysis" is what I know as "static analysis", like what I want Coverity to do (watch the build process, and monitor the source that actually goes into each of my build artifacts). "Dynamic analysis" brings to mind something more like Valgrind, or some other tool that monitors and profiles a program during execution.</comment></comment></comment></comment></comment>