Why venture capital doesn't build the things we really need - <AUTHOR> https://www.technologyreview.com/2020/06/17/1003318/why-venture-capital-doesnt-build-the-things-we-really-need/ <comment><USER2> This is a longer and more interesting article than I expected, but the title doesn't exactly reflect its contents. Is there a sentence in the article that could serve as a more representative title?

The primary profile subject is Ophelia, which is a YC-funded startup trying to address the opioid crisis. They did a Launch HN back in March: [https://news.ycombinator.com/item?id=22570133](https://news.ycombinator.com/item?id=22570133). (I hope it helped!) The article tells how they successfully raised $2.7M at Demo Day. But the way the article is framed, titled, and mostly written, you actually expect a different outcome while reading it.

(Edit: I found one spot where the author describes the question she was interested in exploring. That seems more representative, so I've changed it to that for now. Better suggestions welcome.)

(Edit 2: since now people are reacting reflexively to the question "Is venture capital producing the kinds of inventions society needs?" in the title, I've reverted the edit. If someone can suggest an accurate and neutral title, we can change it again. The current title is both misleading and linkbait, which are both of the reasons why the HN guidelines ask for a title to be changed.)

<comment><USER3> Ironically, the underlying issue addressed seems to be, "why are VCs the only people investing in research?"

Software investors are going to invest in software.

What's Wall Street investing in?

What are the Fortune 500 investing in?

This article was almost so good. I wish they would have kept asking questions and looking at research spending in general.

<comment><USER4> Too me it seems like the private enterprise is not the right place too look for funding for meaningful research, at least not in the current economy.

<comment><USER5> I think the problem is that there isn't really anywhere to look for funding for meaningful research. The public sector isn't really picking up the slack right now.

<comment><USER4> Well, many government agencies offer funding for research. That seems like a good system.

</comment></comment></comment></comment></comment><comment><USER5> "Other ideas he'd considered earlier were more like moonshots—hotels for homeless people, for example."

I'm curious to know whether those moonshots were ideas he decided to not pursue himself, or if he was talked out of those ideas by VCs? I've noticed a trend of some founders I know starting with big ambitious ideas and then, after getting into an incubator or talking to a few investors, somehow coming to the realization that [generic software company] is the idea they're actually really passionate about pursuing. Also happens after they talk to some professors, but professors at wharton are likely not representative of academia in general I think. It seems even within the circle of people that have access to VC and such opportunities, even if they aren't originally representative of your standard software startup, they tend to be pushed towards that, maybe explicitly, maybe implicitly, i really don't know.

<comment><USER6> Is 'hotels for homeless' even a moonshot? The concept of providing short term accommodation for homeless people is hardly a novelty: it's just that since homeless people are hardly flush with cash it's mostly been the preserve of social enterprises, charities and local authorities

The only thing about it that might be a 'moonshot' is trying to persuade VCs they can build a billion dollar business from the concept, but that's because it isn't a billion dollar business idea and it shouldn't really need a conversation with VCs to figure out they're not the funds you should be pitching if housing the homeless is your priority.

<comment><USER7> > hotels for homeless

you mean like homeless shelters?

<comment><USER6> Yep. In the Covid era homeless people are even being sheltered in regular hotel chains.

</comment></comment></comment></comment><comment><USER8> This critique, which annoyingly has little to do with the headline, is a regurgitation of many of the surface level critiques that have been made of VCs for years. Nothing novel about it.

It also wonders off to random topics, like Elon's new baby's name. I have a lot of respect for Elon, but a) I don't care what his baby's name is and b) what in the world does that have to do with the article's main topic??

I usually enjoy articles from this publication and was looking forward to reading it but was sorely disappointed by the end.

Reader beware.

</comment><comment><USER9> The answer is pretty simple: "Capitalizm". It doesn't fix all the problems. It fixes them for creating profit, and not every serious problem promises profit when solved.

<comment><USER8> ~Capitalizm~ Capitalism is purely a theoretical idea. Free markets as capitalism defines them are impossible. Perfect information, competition, price taking, ect, which are baked into the economic theories of capitalism are simply not feasible.

Often our critiques of capitalism are not critiques of capitalism at all. In fact they're criticisms of monopolies and oligopolies in our modern society, which are antithetic to capitalism.

The American economy is an aristocracy. VCs, the big ones at least, are members of that aristocracy. Many of which are filled with smart good hearted people. But there are some incentives baked into their position of power that we need to be cognizant of.

Edit: "free-market capitalism" would probably have been a better term. Clearly that was not the point I was making.

<comment><USER10> > Often our critiques of capitalism are not critiques of capitalism at all.

While this is superficially true, the structure of capitalism arguably makes such concentration of wealth and power inevitable, so the phenomena of monopoly and oligarchy are intrinsic features of capitalism. Not free markets, but capitalism, i.e. the system where individual, private citizens own the means of production.

I'm not sure yet whether I think that capitalism can ever be made work for the people (including the underclass that our society currently consumes as human fuel to keep the status quo). I think it's quite possible that it will foil all attempts to reform it. But we'll see.

<comment><USER8> I'd argue that free markets are a requirement of the definition of capitalism, but like the term "communism" the definition has become squishy.

I agree that your definition inevitably leads to income inequality.

Either way, I think we agree on the nature of these problems.

<comment><USER6> 'Capitalism' was a term conceived by Marx and despite Marx and many other anti and pro-capitalist economists having much more to say on the subject, has always had a pretty straightforward definition of being an economy characterised by capital owners hiring wage labourers to generate returns on their capital. A definition sufficiently succinct to describe both the excesses of Silicon Valley and the grim poverty of the Industrial Revolution.

The definition relies on the assumption the distribution of capital is sufficiently unequal for workers to need/want to work for capitalists to earn wages and the market sufficiently free for it to be possible for capitalists to hire workers to generate returns. But both the Marxist arguments that capital must inevitably become so concentrated that capitalists won't need to pay workers above subsistence levels [until it leads to revolutions] and the free market economist argument that competition will resolve this [and pesky social democrats will ruin it] are firmly in the 'squishy' parts of the definition.

('Communism', which had competing definitions before Marx started writing about it, has always been a bit squishy...)

<comment><USER8> Fair enough. I learned - in an American college - that "capitalism" was a term coined by Adam Smith in "Wealth if Nations", which apparently was an incorrect conflation made by my Econ professor.

The term "free-market capitalism" is used often by politicians and economists, but apparently that term is conflating two distinct concepts by your definition.

That illustrates my point that the term's meaning has morphed since it's coining. Even the Wikipedia page's disagrees with both of us!

> The initial use of the term "capitalism" in its modern sense is attributed > to Louis Blanc in 1850

> Marx did not extensively use the form capitalism, but instead capitalist and > capitalist mode of production, which appear more than 2,600 times in the > trilogy Capital

[https://en.m.wikipedia.org/wiki/Capitalism](https://en.m.wikipedia.org/wiki/Capitalism)

What a rabbit hole! We're officially lost in the minutia of term definitions. Time to log off of HN for the weekend haha

</comment></comment></comment></comment></comment></comment><comment><USER11> > But where was the cure, or the better protective gear, and why hadn't > venture capital—the financial engine of innovation—funded those ideas?

> the cure

Doing anything medical is very risky because of the enormous cost of FDA approval.

> protective gear

The surge in demand for masks is likely to be temporary, meaning if you build a huge factory to crank them out, the demand is likely to dry up before the factory is completed.

<comment><USER12> > because of the enormous cost of FDA approval.

Then one would expect some other country, with better costs for regulatory approval, to be a hotbed of medical innovations. Are there any examples?

<comment><USER11> Good question. I expect many countries don't have a regulatory approval process at all, and simply rubberstamp FDA approval.

Nevertheless, medical tourism is a thing to get non-FDA approved treatments. For example, "60 Minutes" ran a segment a few months back on a Cuban cancer treatment unavailable in the US due to the FDA, and I've read about a Thai hip replacement procedure that is not FDA approved, but lots of Americans go there for it.

I also don't know what US law has to say about a US company developing a drug for non-FDA use outside the US. Certainly, it would not be a good public relations move, and may be a legal and liability minefield. Would you be willing to risk your investment capital in such a venture?

</comment></comment></comment><comment><USER3> Software is made in the image of it's funders.

Separately, individuals in the United States prefer to consume the majority of their income rather than invest it.

We have restaurant delivery because the people with money like getting their food delivered.

Can anyone name a problem that VC money could solve, that would generate the required 100x return to cover the failures, that would satisfy the "common good" requirement?

<comment><USER13> Preventing or curing every disease. Carbon-free energy. Self-driving cars with >10x lower accident rate. Many more at [https://www.ycombinator.com/rfs](https://www.ycombinator.com/rfs)

None of them are easy, but many of them will happen soon enough to invest in today.

<comment><USER14> We're not going to cure all diseases, being sick is part of being human.

There is no such thing as carbon-free energy available for investment. Batteries have to be constructed, charged and disposed of etc.

Reliably self-driving cars won't happen without a major leap in AI, machine learning by itself is not capable of solving the problem.

It's bedtime stories for adult children.

<comment><USER15> Curing disease is not likely to make more money.

Carbon-free energy: nuclear, storage??

Self-driving cars: just keep throwing money at it, eventually something will cross the threshold of good enough

<comment><USER16> Curing disease is actually a much better illustration of "why won't VC/capitalism fund the 'right' things?"

It is much more profitable to charge recurring "subscription" payments for treatments to keep you healthy-ish, rather than to give you a one-time cure that actually fixes you or removes the disease entirely. This already is a thing: [https://www.cnbc.com/2018/04/11/goldman-asks-is-curing- patie...](https://www.cnbc.com/2018/04/11/goldman-asks-is-curing-patients-a- sustainable-business-model.html)

There is simply no way to align healthcare with capitalism, without creating perverse incentives around every corner.

<comment><USER17> > _There is simply no way to align healthcare with capitalism, without > creating perverse incentives around every corner._

I think there is and we already have it. The combination of every drug needing FDA approval with 20 year patents aligns coming up with new treatments with capitalist funding. Regardless whether you come up with a cure or "subscription model" treatment others can provide it cheaper once your patent runs out. That's why generic drugs that cost a lot of money to create end up costing cents later down the line. Aspirin costs very little at this point. People just expect every new treatment to immediately be available at low cost.

Where it turns perverse is in mostly 2 points:

1\. Regulation changes. It's sometimes easier to lobby for rule changes that allow you to repatent a treatment than it is to come up with a new one. An example of this would be asthma medication.[0] The price of inhalers multiplied in 2008 in the US. Inhalers used chlorofluorocarbons (CFC) as propellant. CFCs were banned to protect the ozone layer, but inhalers got an exception. In 2008 this exception was removed, which meant that drug manufacturers needed a new propellant. They ended up using hydrofluoroalkane, but this is considered a new treatment when it comes to patents. As a result the drug company could charge higher prices because there wasn't as much competition anymore. This is an issue with how patents are granted.

2\. Single manufacturer. When a patent expires for a drug anyone can make it, which drives down the price. However, for some drugs there is only one manufacturer that can keep the price low, so nobody else is interested in making that drug. It then becomes possible for that company to increase the price and people will have to pay it. This was the case with Daraprim (Martin Shkreli).

Despite these two problems, we've never had as many options in healthcare and it is steadily improving. Conditions that were a death sentence just a few decades ago, such as HIV, are now manageable with treatments. I don't think that this shows that the system is irredeemably broken.

</comment></comment></comment></comment></comment></comment><comment><USER18> People often forget that VC is a for-profit industry and that VCs invest money on behalf of investor who are looking for a return on their investment (Like pension funds) and where there are lots of places they can put their money to work. With that in mind, 2/3rd of VC backed companies will fail despite the best wishes of the founders and VCs, which means that to get a market rate return 1/3rd of your portfolio must generate a 10x return after multiple rounds of dilution. What this means is that most opportunities are not venture backable because 10x returns are hard. You can invest in a company at a $10m pre and you need a company to get to at least a $200m valuation (again multiple rounds of dilution). The kind of growth prospects you need to command that are extremely high. VC can address some problems, but not all problems because the risk eclipses the reward. That's okay. At least it can do something which most industries can't do.

<comment><USER19> Exactly. And VC is tiny relative to other asset classes. It's important to match the company's model & expectations with its financing. VC isn't the only game in town: Private Equity, Debt, Bootstrapping, etc. are all viable options too.

VCs are targeting hypergrowth companies with multi-billion dollar addressable markets that can plausibly see liquidity within the fund's structural 10-year lifetime. If this doesn't describe your company, then VC probably isn't a good structural fit.

</comment></comment><comment><USER20> Did not find this article interesting. Very long, not insightful into the reasons behind the title.

It's mostly an intro into VC, YC, KP, and some of the other players and there's some human interest stuff in there along with a comparison to how little money other groups get.

</comment><comment><USER21> > _Software and technology are only one corner of the innovation playground, > and the US has been so focused on the noisy kids in the sandbox that it has > failed to maintain the rest of the equipment._

This about sums up the topic. The article itself even spends most of its time pondering this alluring idea that the VC ecosystem could somehow be reformed to solve societal problems.

The problem isn't an insular background of potential founders. It's that a business can only achieve outsized returns by operating on scalable things - such as computing technology or casual replaceable labor. There is no Uber for <concern of marginalized people>, because marginalized people are an input which those services require to operate! Nobody is delivering groceries during a pandemic from a place of options.

> _[Nikki King is] in a constant scramble for money, relying on grants, > donations, and Medicaid reimbursements._

The money funding an organization that directly helps people is coming from government and charity. There is no monetary profit in this - if there were, Ms King would now own a successfully bootstrapped cashflow positive business. Instead she continues to scrape by.

Ultimately we've got the best society money can buy. Our assumptions of mutually beneficial transactions in a free market creating distributed wealth are not panning out. Instead we've gotten an ever-growing wealth imbalance, with the main goal of the wealthy being to perpetuate themselves. There are many theories on why this has happened or what to do about it, but suffice it to say as long as it continues our problems will only get worse.

</comment><comment><USER22> [https://archive.vn/YIqby](https://archive.vn/YIqby)

</comment><comment><USER7> Am I the only one here that hated this article?

If the point is we should invest more in things - we agree. We all agree. Pretty much everyone with any sense agrees. Even people on the right like Julius Krein have been pushing for nothing but this. The only ones that don't are our bought and paid-for politicians and their corporate cronies...but no mention of them.

But what does that have to do with private capital investment. Seriously? Where is the connection.

Why is it necessary to call out venture capital and "white male culture".

So far as I can tell this article was nothing but a bunch of crass and nasty attacks.

It starts all the way from white males nerds who "have no social lives". He thankfully teaches us that:

> In the white male culture ... those cultures are extremely narrow. For women > and people of color, those cultures are much more expansive.

He then (wonderfully) quotes a failed start up by a black woman to have better substitute teachers that only failed because of lack of Andressen's money. That's some pretty powerful evidence right there.

He then goes on to more directly attack Andressen for the (absurd) notion that a software start up incubator did not help with COVID.

> I revisited the Andreessen Horowitz portfolio, which includes dozens of > software winners, like Facebook, Box, Zynga, and Github, but not many > companies building things that would have been useful in tackling the > pandemic.

Of course anyone who works in tech knows that github and plenty of his startups are used for remote work every single day. But no matter they didn't cure covid, which is his test for good investment. I would love to hear what he thinks qualifies as we literally have no solution for COVID right now except to stay home and wear cloth over our face.

Then he goes on to quote his daughters making fun of Elon Musk and another unnamed executive.

> He doesn't seem to realize he's the Once-ler," she said, referring to the > character in Dr. Seuss's The Lorax

And

> "Who would do that to their kid?" asked Quinn.

> "Don't worry," Lillie said. "X Æ A-12 Musk will be able to pay other kids > not to bully him."

I guess that's a good example of the "expansive" culture of women that we desperately need more of.

Of course most of this this article revolves around Ophelia a software startup trying to help with the opiod epidemic.

No where is it mentioned that the opiod epidemic is not a natural phenomenon, but was manufactured in the most heavily regulated industry in America: healthcare. It came from as far a place from Silicon Valley as you can get.

It was pushed by Big Pharma, their associations, and with the blessing of every government and non-government medical institution.

...but god I hate those Silicon Valley bros and their successful startups.

</comment><comment><USER23> I think the fact is was Musk who 'chose' the baby name evidently and not Grimes, who I guess is just a house wife, sums up the article succinctly.

The writer could have written this without consistently insulting people, especially coming from a place of ignorance.

Musk's Starlink will change medicine in the poorest regions of the world, were at _minimum_ Médecins Sans Frontières can certainly afford it.

But whatever, it's all about the click chasing.

</comment><comment><USER24> Clean-tech was a hot investment area for VCs, for a while.

 _Weathering the Storm: Kleiner Perkins and the Tragedy of Clean-Tech Venture Capital_

[https://digital.hbs.edu/platform- rctom/submission/weathering...](https://digital.hbs.edu/platform- rctom/submission/weathering-the-storm-kleiner-perkins-and-the-tragedy-of- clean-tech-venture-capital/)

The article above shows some of the numbers but it's not quite pointed enough.

The problem with investing in e.g. solar power isn't that it's a dead end technology. Just the opposite. It is a technology that is still rapidly improving on price:performance. But any technology rapidly improving on price:performance, without significant barriers to competition, demands ongoing investment and offers low returns on capital invested. VCs want significantly higher returns than they could get by investing in established manufacturing businesses.

There's too much competition in clean tech. Invent a better mouse trap for the energy sector and in 5 years you'll be competing with Panasonic, General Electric, Siemens, LG, and 4 Chinese companies you never even heard of before.

The same thing happened with the hydraulic fracturing revolution. Competition is too robust to deliver respectable returns, and the capital requirements are high.

 _Chesapeake Energy starts bankruptcy countdown_

[https://www.marketwatch.com/story/chesapeake-energy- starts-b...](https://www.marketwatch.com/story/chesapeake-energy-starts- bankruptcy-countdown-2020-06-15)

 _Former EQT CEO: Shale Gas Revolution an 'Unmitigated Disaster' for Investors_

[https://www.oilandgas360.com/former-eqt-ceo-shale-gas- revolu...](https://www.oilandgas360.com/former-eqt-ceo-shale-gas-revolution- an-unmitigated-disaster-for-investors/)

"The technological advancements developed by the industry have been the weapon of its own suicide."

There are some non-software businesses that have significant barriers to competition, like medical imaging. But those barriers also hinder capital-lean scrappy upstarts. Invent a better MRI machine, and again you're competing with General Electric, _plus_ you need to go through a regulatory gauntlet before selling your first unit.

After rejecting sectors where competition is fierce, sectors with barriers to competition that also hinder startups, and sectors where people can't/won't pay much (e.g. anything based on serving unmet needs of low-income people), there's not a whole lot left but software businesses and software-mediated platform businesses.

</comment><comment><USER25> There are many things wrong with this article. The 16-year old daughter opining about what is wrong with VC is perhaps the most telling though.

None of the article is based on any deep understanding of the issues. It is generalizations about people (alarmingly, with the implication of race and gender) and an industry that the author doesn't seem to know (if you are using The Code as your source, stop...think about what you are doing).

As an example, people don't understand that SV benefiting from government research money is not the same thing as proving that research money was the cause. In fact, lots of other countries did this, and no-one else got anywhere. The UK, in particular, was entirely convinced by the notion that the govt could save the economy in the 1960s...nothing worked, and this attitude triggered one of the most severe crisis in British economic history (much worse than the Great Depression). The rest of the article continues in the same way: pointing to specific examples but failing to see that they don't generalize (the stuff comparing Nordic/South America/US is actually shocking to read as someone who studied economic history, willfully false).

I think the world is going to see more of this. People in tech are always wrong. Their identity is wrong. They aren't "like us". But saying that they fail to innovate is...insane. I am not a fan of tech people or SV at all...it is a hotbed of charlatanism...but that is the point of capitalism, that is why we don't like in wood houses anymore. No-one knows what is going to work ahead of time. The system must be decentralized, and we must not have people like the author trying to say that certain innovations are more valuable than others.

(Btw, one of the big issues that tech has is that lots of young people actually don't understand the real world isn't like the Lorax. There isn't this group of people who are automatically evil, and are causing all the bad things. Life is ambiguous, and people who often end up doing bad things have intentions...life isn't a movie).

</comment><comment><AUTHOR> Found this to be a pertinent article that shows the bytes vs atoms debacle going on.

<comment><USER26> > bytes vs atoms

I really like this

</comment></comment><comment><USER27> Because the things we need don't sell for 1 billion?

</comment><comment><USER28> Betteridge's "Law of Headlines" suggests this headline was written in the form of a question in order to answer it in the negative:

> "Any headline which ends in a question mark can be answered by the word > 'no.' The reason why journalists use that style of headline is that they > know the story is probably bullshit, and don't actually have the sources and > facts to back it up, but still want to run it."[a]

[a] [https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

<comment><USER29> Is the title editorialized or has the publication changed it? As of now, the publication's title is _" Why venture capital doesn't build the things we really need"_, but the submission's is _" Is venture capital producing the kinds of inventions society needs?"_.

<comment><USER2> I changed it for reasons I explained here: [https://news.ycombinator.com/item?id=23655803](https://news.ycombinator.com/item?id=23655803). The article title is misleading.

However, since now it's triggering the Betteridge reflex, and people are reacting purely to the title, I've reverted the edit. If anyone reads the article thoughtfully they will see that the answer to the question can only be "yes and no", but we can't expect that.

<comment><USER28> > triggering the Betteridge reflex

Sorry about that. Won't do it again.

<comment><USER2> Oh no worries! but thanks for saying so.

</comment></comment></comment></comment></comment><comment><USER30> [https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

</comment><comment><USER31> No

</comment><comment><USER32> By definition, yes.

<comment><USER33> No, by definition it's producing the kinds of inventions society _will pay for_. That's not the same thing.

</comment></comment><comment><USER34> I know a lot of people on HN hate VCs, but it is not the role of VCs to invest in companies who build things "the society needs".

They invest in things the society didn't even know it needed.

Of course there are huge flops and failures and near-scams, but I think it's good that these businesses exist, and I disagree with people who stigmatize the entrepreneurs who build the "stupid" startups and the VCs who fund them.

Imagine a world where everyone was building things that everybody already knew they needed. It would be a dull world and very deterministic. Not a world I want to live in.

<comment><USER35> Oh give me a break; no one is saying that we shouldn't innovate.

And I don't think people are hating on VC as a whole, this site is run by VCs after all.

Do you really want to live in a society where people go after businesses to make a quick buck no matter the consequences? I know that I self censor some of my ideas on the basis that I wouldn't want to live with the results if they were wildly successful.

We all have an obligation to create a world that we (not the royal we) would like to live in. And that means constructing things with real, broad societal value. Think renewable energy rather than uber for liquor.

<comment><USER34> this is like saying art should not exist. I'm likening these companies to artists (no value judgement attached).

Artists make stuff they want to make, and it provides value to the world in some way. Otherwise they shouldn't exist. Artists don't deliberately make things with "real broad societal value".</comment></comment></comment>


Tree That Grows 40 Kinds of Fruit - <AUTHOR> http://devour.com/video/tree-that-grows-40-kinds-of-fruit/ <comment><USER2> I did this, on a smaller scale. The house I live in was built on an old orchard and we were graced with one of the very few remaining apple trees in the garden. It produces relatively sour apples useful for cider and cooking etc. We think they are Bramleys but not 100% sure. I grafted a few branches off a Blenheim Orange stock a friend had that had fruited for a couple of years first. 2 didn't work but 4 did and we have two varieties now on one tree. They're in the same pollination group as well and we planted meadow flower mix around it to attract the pollinators so you actually end up with more apples on both parts of the tree. Last year one of the branches snapped off entirely because there were so many apples on it.

Edit: photo from a couple of years back after we nearly emptied it on a cider run :) - [http://i.imgur.com/aYacpT4.jpg](http://i.imgur.com/aYacpT4.jpg)

It's quite easy, perfectly routine and has been done for a very long time indeed. Hundreds of years if not more.

You can take this to extremes if you really want (sorry for the Daily Mail link): [http://www.dailymail.co.uk/news/article-2437247/250-varietie...](http://www.dailymail.co.uk/news/article-2437247/250-varieties- apple-tree--thanks-bit-hard-grafting-years.html)

</comment><comment><USER3> Original URL: [https://www.youtube.com/watch?v=ik3l4U_17bI](https://www.youtube.com/watch?v=ik3l4U_17bI)

</comment><comment><USER4> [https://news.ycombinator.com/item?id=8082035](https://news.ycombinator.com/item?id=8082035)

</comment><comment><USER5> Why is it acceptable to do this on plants but not on animals?

<comment><USER6> It's so much harder to do on animals. We can't just cut a limb, stick it on to another animal, and wrap tape around it.

<comment><USER2> Well we can but you end up with a dead limb and a dead animal.

This happens with the plants occasionally too.</comment></comment></comment>


PowerShell Post Exploitation Tool Aimed at Making Penetration Testing "easier" - <AUTHOR> https://github.com/fdiskyou/PowerOPS <comment><USER2> Looks like fun. Tonight I might try seeing how the new Linux PowerShell fares with this.</comment>


ABI – Now or Never [pdf] - <AUTHOR> http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2020/p1863r1.pdf <comment><USER3> C++ ABI issues seem to be in this paradoxical situation where the language standard powerbrokers simultaneously feel that

a. Having a real binary compatibility story is beneath C++, but

b. The accidental ABI compatibility that exists today is too widely adopted to break.

<comment><USER4> Basically every modern platform (eg free of 90s mistakes) uses the itanium ABI, which defines vtable layout, RTTI layout.

But platforms define the final memory and calling conventions so that can't be part of any language spec - this is not unique to C++.

Windows has its own ABI, which it has had for a long time, so they can't change it, so on x86 windows it will always be that.

<comment><USER5> The ABI discussed here is a bit higher level than that. Even with a fixed ABI for vtables, calling conventions, etc. you still have to care about what happens when you change a "vocabulary type" in the standard library- some changes are source-compatible but binary-breaking.

For example, C++11 broke ABI at this level by changing the representation of std::string.

<comment><USER4> Oof I was unaware of the string ABI break (just had to look it up) - that's kind of gross :-/

That said in general ABI compatibility is expected of all changes, without very good reasons - security seems like a good one, performance alas not - <USER2> assume std::string got the small string optimization because they were already going to break ABI for the threading issues.

Of course it doesn't help that c++ is still C like so implementations/use of data layout gets compiled directly into the client application :-/

</comment></comment></comment></comment><comment><USER6> Am I wrong in thinking that this mild form of schizophrenia ( no official ABI but dont break the ABI) is part of the reason why we now live in a world where all applications talk to each-other through sockets, incurring huge overheads?

<comment><USER7> You can use shmem instead of sockets, which is pretty fast. Not as fast as a direct call, but pretty good; good enough for most purposes.

<comment><USER8> Have you actually measured? The overhead isn't the socket, but the marshaling and unmarshaling, and you need these things for sockets, shared memory, or any other IPC.

<comment><USER7> You don't need to (un)marshal necessarily; stuff like strings, or arrays of integers, can go straight across. And if you have to pass large amounts of data, they'll probably take a form that's _something_ like that.

</comment></comment></comment></comment><comment><USER9> What is the "runtime overhead involved in passing unique_ptr by value"?

The reference is a 1h YouTube video.

<comment><USER10> Short version: it passes a pointer to the pointer forcing a double indirection rather than a single.

Simple attempts to fix don't really work. Not even sure an ABI break will be enough, but it would at least be a minimum requirement.

<comment><USER11> Makes me wonder why anybody takes them by value, and not by rvalue-reference.

But unique_ptr in public interfaces feels like code smell. I have done it, but not proudly.

<comment> Const-me Quite a few times, I've made C++ library APIs like this:

        struct iface
        {
            virtual ~iface(){ }
            virtual void doSomething() = 0;
            static std::unique_ptr<iface> create();
        }

I don't know good ways to replace unique_ptr here.

Requiring library users to #include the concrete implementation is not good: inflates compilation time, pollutes namespaces, pollutes IDE's autocompletion DB.

Can go C-style i.e. pass double pointer argument to the factory, or return raw pointer. But then user needs to remember to destroy the object.

<comment><USER11> Returning them by value is fine. *RVO avoids inefficiencies.

But it would often be better to make a move-only value type, and return that instead.

</comment></comment></comment></comment></comment><comment><USER12> Discussion of whether the next (or any future) c++ release should break abi compatibility.

<comment><USER13> Does C++ have an ABI?

<comment><USER14> Every implementation implicitly defines an ABI due to the size and layout of classes/structs defined in the STL.

Here's a simple example. Suppose we define std::string with the following layout (for simplicity I'm removing the template stuff, SSO, etc.):

      class string {
       public:
        // various methods here...

        size_t size() const { return len_; }

       private:
        char *data_;
        size_t len_;
        size_t capacity_;
      };

When a user calls .size() on a string, the compiler will emit some inlined instructions that access the len_ field at offset +8 bytes into the class (assuming 64-bit system).

Now suppose we modify our implementation of std::string, and we want to change the order of the len_ and capacity_ fields, so the new order is: data_, capacity_, len_. If an executable or library links against the STL and isn't recompiled, it will have inlined instructions that are now reading the wrong field (capacity_).

This is what we mean by the C++ ABI. This is a simple example, but there are a lot of other changes that can break ABI this way.

<comment><USER7> That's not exactly the same. What you're referring to is the library ABI for the c++ standard library. Every library which can be linked to dynamically has its own ABI. The language ABI, on the other hand, describes how every library's ABI is defined, describing things like layout and name mangling. So if, for instance, the language ABI were amended to say that class members are arranged in alphabetical order in memory, then capacity_ will always be at offset 0, data_ at offset 8, and len_ at offset 16; if you change the order of declarations then, the library's ABI won't change. But if the library were compiled with an old compiler that targeted the old ABI, then it would put data_ first, followed by len_, then capacity_. So if you then compiled a new piece of code with a new compiler targeting the new ABI, but linked against it the library, there would be a mismatch.</comment></comment></comment></comment>


Show HN: SoundsMix – Mix sounds to help relax, study or work - <AUTHOR> https://soundsmix.xyz <comment><AUTHOR> Hi all,

I was bored today and I made this little app [https://soundsmix.xyz](https://soundsmix.xyz) to mix sounds and create combinations of sounds to help relax while studying or working. Nothing new and original :)

How can I improve it?

Any suggestions? Thanks</comment>


My Little Pony and /Pol/ - <AUTHOR> https://twitter.com/woot_master/status/1231401516034088961 <comment><USER2> Not sure what to make of this but I can see the synergies.</comment>


UK halts trial of 'useless' hydroxychloroquine in Covid-19 patients - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-hydroxychloroquine/uk-halts-trial-of-hydroxychloroquine-in-covid-19-patients-after-no-benefit-found-idUSKBN23C1YM <comment><AUTHOR> [https://www.recoverytrial.net/files/hcq-recovery- statement-0...](https://www.recoverytrial.net/files/hcq-recovery- statement-050620-final-002.pdf)

full statement from the study authors.

This is unrelated to the recently-retracted Lancet paper of much furor.</comment>


Want to study computer science but lack meaningful areas to work in. - <AUTHOR>

I love programming but after losing interest in games I am a bit confused on what to study at university.
I would be interested in energy or civil engineering but the jobs I don't think would be as much fun as hacking, it is just that I have a hard time finding meaningful areas in computer science. I think Facebook for example is just useless crap that I have to waste time on now because everybody else is on there.
Some areas in CS that interest me: Robotics - automate boring jobs Image analysis - medical imaging Datamining the human genome etc
I don't find internet stuff to meaningful.
How are the chances of landing these types of jobs, are there a lot of them? <comment><USER2> #1, Pick what you love to do, so you are passionate everyday of life instead of hating what you do and being miserable.

From a personal story. I got my degree in Computer Engineering Technology, because I had fallen in love with robotics and computer hardware in high school robotics club. We did the FIRST robotics competition, and that was the best memory I have of high school.

However, after graduation, I've taken a job in the IT sector as a systems admin, and computer hardware has taken a back burner position as a hobby and possibly a side startup skill. I've only been graduated for alittle over a year. Although I haven't landed a job doing hardware like I love, I do have a positive attitude to learn and enjoy the IT side of things. In that view, I have networked with co-workers, employers and peers who have years and years of experience and are sharing it with me. In a matter of a few hours I learned more about software engineering and web programming than college ever taught me.

I wish I was more organized on these thoughts, but I basically have to say, find what you love to do, diversify your knowledge, and be very damn proactive in college, because nobody is going to hold your hand. Get involved in clubs, events, etc. to meet people and network, and find new opportunities. Always talk to your professors about projects you could help with or start up. Do not become a hobbit in your room with world of warcraft or any video games, unless you're passion is to just play video games. Personally we used to hack the games in college and host private servers for downtime after studies.

As far as computer hardware, imaging, robotics, that sort. Computer Science theory plays a huge roll in that for logic analysis. Ultimately I think what you should do, is try talking to advisors, professors, and maybe even try searching for employers and asking them what they look for to prepare you for the industry.

warning, you may think you know what you're doing now, but college opens doors and you will have so many ideas and options, that your dreams may change.</comment>


Domain validated SSL certs for google.com.mg and google.com.im (not Google) - <AUTHOR> https://certsimple.com/blog/domain-validated-ssl-google-com-mg <comment><USER2> Head of Let's Encrypt here.

We were aware of the "google.com.mg" cert soon after it was issued. We didn't revoke the cert for the same reason we don't revoke most certs: as far as we can tell, the cert was issued to the entity properly controlling "google.com.mg". Whether or not that is Google (the company) is not really within our purview.

That said, in this case, as a courtesy, we did notify Google employees and made the decision to report the site to Google Safe Browsing. GSB and SmartScreen are the right places to deal with things like this.

IIRC GSB did block the site for a while, but that block seems to be gone now.

<comment><AUTHOR> > Whether or not that is Google (the company) is not really within our > purview.

Hi Josh. This is mentioned in the third paragraph of the article, but it looks like HN didn't read that far, so probably worth mentioning it again.

I didn't mention LE specifically out of respect for the work you guys are doing, but since you've posted here: why wasn't this flagged as a High Risk Certificate Request before issuing per Baseline Requirements 4.2.1?

Also where is the High Risk Certificate Request check available in the LE source?

Thanks!

</comment></comment><comment><USER3> _66 days later google.com.mg is still owned by not-Google, not revoked, and not on any 'safe browsing' warning lists._

So? Why would a website be in safe browsing warning lists if it doesn't do anything malicious? Does Google own a trademark in Madagascar? If so, they probably can take down this domain by asking NIC-MG. If not, then, unless this website is used for phishing, I don't see any problems with issuing a certificate.

(It's interesting how companies selling certificates switched to scare tactics after Let's Encrypt made DV certs free.)

<comment><AUTHOR> > Why would a website be in safe browsing warning lists if it doesn't do > anything malicious?

Some of the previous arguments in favour of DV have said that safe browsing lists will catch misissuance.

Whether DV certs are $10 or $0 doesn't make a huge difference: they don't check identity.

<comment><USER3> _Some of the previous arguments in favour of DV have said that safe browsing lists will catch misissuance._

Yes, so what is this website doing that warrants this measure? There was no misissuance.

</comment></comment></comment><comment><USER4> I don't get the tone of the article. Why is this a bad thing?

It's not the job of SSL to ensure a domain name is not owned by someone it shouldn't be. That falls to the domain registrar, if you have a problem with someone owning google.com.mg go take it up with the registrar or better yet leave it up to Google as it's THEIR trademark.

I actually find this to be a good thing that someone was able to get a domain, create an SSL certificate for it painlessly and start securing traffic between clients and their web property without having to spend a) tons of money and b) tons of time dealing with antiquated CAs that should be entirely automated.

<comment><USER5> The tone of the article is such because the company writing it only sells EV certs and therefore is on a relentless quest to discredit DV certs as inferior.

<comment><AUTHOR> Author here: DV certificates are inferior. Knowing whose key you're encrypting with is a good thing. DNS providers do not do identity checks.

Edit: 100% agreed with laumars' point below regarding blogs and low trust sites. DV certificates have their place, it's just that high trust websites aren't it. I've added an author tag as requested.

<comment><USER6> Person who just registered certsimple.org and certsimple.net here. Will you issue me a EV cert?

<comment><USER6> I just noticed he's in the UK, so surely he's registered certsimple.co.uk, right? Nope. Yay, now I have another domain!

I will begin issuing EV certs via my new company 'Certs Imple Limited' very soon. You can trust us, we have more domains than that other fly by night organization does.

</comment></comment></comment></comment></comment><comment><USER7> So, in a nutshell, these guys are saying that (a) it's too easy to get a misleading cert and (b) they make it easier to get a certain kind of cert. That's going to be a hard sell. They need to make a case that non-EV certs are worthless not only in terms of security but to consumers - i.e. that you, the certificate buyer, will lose business. Then they need to explain why EV certs are better, and lastly how that superiority can be preserved even on a shorter acquisition timeline. They do none of that. The article is not only too pitch-y for HN, but it's also a _poor_ pitch.

</comment><comment><USER8> So everything is working as intended? Great!

<comment><AUTHOR> That's the third paragraph of the article. Keep reading.

</comment></comment><comment><USER9> This feels a little like link bait. You don't realize till the end that it's a pitch.

</comment><comment><AUTHOR> Author here. As the article mentions, this is how DV SSL works. The issue is that most people outside tech are conditioned to trust DV identifiers.

As a side note, newer versions of Chrome have stopped using 'identity' for domain validated certificates.

A domain validated cert in Chrome in 47.0.2526.106 [http://i.imgur.com/RiISSrU.png](http://i.imgur.com/RiISSrU.png)

A domain validated cert in Chrome 49.0.2618.0 no longer refers to 'identity' [http://i.imgur.com/XkaPDwx.png](http://i.imgur.com/XkaPDwx.png)

The term 'identity' remains in use with extended validation certs - [http://imgur.com/j7fKGt1](http://imgur.com/j7fKGt1)

</comment><comment><USER10> In other words: DV CA does exactly what it's supposed to do.</comment>


How to compile with continuations - <AUTHOR> http://matt.might.net/articles/cps-conversion <comment><USER2> I'll keep this around if I ever need to write a compiler.

<comment><USER3> I don't know if you're being sarcastic, but a compiler is worth writing as a learning exercise, if not also for fun. Not necessarily a matter of need.

<comment><USER4> In my last year at uni, I followed a compilers course "for fun". Some people advised against it, because it would be a time-consuming course with little practical value.

At one of my first job interviews, the interviewer said "Why did you waste your time with a compilers course? What good is that for? I don't see any [insert-tech-hype-of-the-day] on your resume!".

So I went to the next job interview I had lined up, and gladly signed up for their compiler developer job opening.

Serendipity?</comment></comment></comment>


Declaring Email Bankruptcy - <AUTHOR> http://www.avc.com/a_vc/2010/05/email-bankruptcy.html

<comment><USER2> Why not get a secretary? If email is the lifeline to your work-life then it makes sense to pay someone $15/hr on a part-time basis to deal with the chaos. A capable assistant can very easily organize your email saving you the time to do what you do best.

Maybe there is an opportunity here for a web-based solution to this problem. Of course he doesn't want to give someone access to his gmail account. So maybe there's a way to selectively allow someone access to your inbox folder with auditing/logging/organizing features. This way someone else can manage your inbox but not go around snooping for password reset emails.

<comment><USER3> Email can be pretty personal, and in the end someone will have to answer it.

He's not even getting that much mail, if you count it out he says that 'from the beginning of April to the first week of may' he went from a few hundred to an unmanageable thousand.

That's only about 30 messages per day, if he simply kept up with it it would not be an issue. Once the mountain is high enough it can be very intimidating.

Imagine not washing the dishes for a full month.

edit: changed spam in to mail, the point still stands.

<comment><USER4> We don't know how many emails a day he was dealing with. Clearly, he wasn't ignoring email over this period, so many he was already keeping up with 30, 50, 100, 200 emails and this was just the excess.

<comment><USER3> That could be, he mentions 'unread', but reading 30 emails per day on top of whatever he already read is:

\- if it was low, not a big deal

\- if it was high, percentage wise not such a big issue

So it would have to be somewhere in the middle, say around the 30 to 60 emails on top of the ones he's already receiving for it to be a 'big deal'. And even that does not seem to me to be an extraordinary high volume.

The thousand backlogged emails _is_ a big deal, that will take you two days at least to get rid of.

But the majority of those probably does not require an answer, and if it hasn't been read in 30 days it probably wasn't very urgent either and you may be able to lose it entirely without it being a big deal.

People should not become a 'slave to their inbox'.

</comment></comment></comment></comment><comment><USER5> Please someone make email better! This is a huge problem. Gmail is okay, and it's the best web mail out there. Filters are really pretty useful, but as far as I'm concerned, Gmail's two great innovations were 1) it's approach to threaded conversations. IMHO it's "The Right Way" to do it and 2) archiving email as opposed to deleting it.

But, it seems like they've really stopped innovating, and it really leaves a lot to be desired. Labs features are nice, but not really game changers.

Gmail's contact management sucks. I have hundreds of contacts in my contacts list from running the Hackers and Founders meetups, and I try really hard to write notes and metadata about each contact after I meet them, but it's really hard to get at those notes from an individual email.

Xobni really has the right idea with this. If I could easily change the display of emails to threaded conversations ala Gmail and easily get the archive feature, I'd make the switch over to Xobni + Outlook in a heart beat.

I'm more than willing to pay $10 -20 a month to someone that can solve this problem for me....

<comment><USER6> Have you looked at the newer generation of text-based clients? The main one thrown around is <http://notmuchmail.org/>

</comment></comment><comment><USER7> Have there been any email clients/plugins that used Bayesian filtering to sort non-spam email into different categories successfully? For example, is there anything out there that would let Fred Wilson automatically tag all the emails he gets from entrepeneurs asking him to check out their sites and invest in their companies?

<comment><USER8> Well, there was this thing I wrote like 10 years ago called POPFile (<http://getpopfile.org/>) when I had the problems that he is talking about. I haven't looked back.

POPFile grew from POP only to lots of other protocols and many, many people still use it.

<comment><USER9> Wait, you're THAT jgrahamc?! Whoa, small world. I nearly invited you to speak in Japan about POPFile and OSS at the technology incubator that was my ex-ex- day job, but our budget fell through. As far as I know our not-quite-ready- for-primetime POPFile/Outlook integration is still protecting a few hundred desktops next to a rice field.

<comment><USER8> Whoa. Are you talking about QuickPOPFile?

I would have happily come to Japan and spoken, I've been there before and always loved the place.

<comment><USER9> QuickPOPFile was not quite us, but the general idea to make it useful for non- technical folks was similar. (We were going to aggregate filtering across an organization, on the assumption that most folks couldn't be bothered to train emails. Turns out this is easier to do if you are Google than if you want to run a parallel mail infrastructure alongside the one that actually delivers mail.)

</comment></comment></comment></comment></comment><comment><USER10> >But the more efficient I get with email, the more of it that comes in.

Jevons Paradox: <http://en.wikipedia.org/wiki/Jevons_paradox>

</comment><comment><USER11> Keeping your email under control requires an unreasonable amount of discipline. I've managed to avoid 'defaulting' on my email so far, but at a decent overhead rate: Every hour or two, I wipe out my inbox completely and leave only items that absolutely require an action. Most mail is read once and interesting email gets archived by sender name. I have lots of filters set up for people who usually send me uninteresting mail. Everything else is deleted.

I've almost lost control a few times - mostly because of vacations- and I'm certain that I'll hit a tipping point where my time doesn't scale to my inbox size. I couldn't handle my boss' email load, for instance...

Are there any good techniques that scale for dealing with email?

<comment><USER12> Some email, you absolutely need to respond to immediately, and fair enough. For anything that isn't totally urgent, try replying a day or two later. You can stick a reply in a draft folder and fill it out later. This slows down the flow of new email: it cuts out the sorts of mail where you're going back and forth several times in the same day.

</comment></comment><comment><USER3> Looks like someone is in the need of better spam filters.

Just for fun I disabled the spam filter on our mailserver for a few minutes a while ago, took me hours to clean up afterwards. The spam volumes are simply unbelievable, but with proper filtering it really isn't that much of a problem. I think I get about 20 to 30 spam messages per day nowadays that somehow make it past the filter. I do update the filter rules with every message that gets through though, usually on subject or body keywords.

<comment><USER13> But he says they're all non-spam mails.

<comment><USER3> Ah yes, my bad! thanks!

But that's _only_ 30 emails per day!! Where do I sign for that?

<comment><USER2> > Where do I sign for that?

If you want fewer emails, you need to stop signing up willy-nilly.

<comment><USER3> Nah, most of the email I get is because I've built up a fairly extensive net of personal contacts over the years and email (rather than say facebook or so) is my preferred way of staying in touch. The contacts are both business, private and 'mixed', and I really don't mind the volume, it's just that 30 sounds like a great number.

I reply to emails usually very quickly (unless I'm sleeping), even if they are a bit more complicated because I know that if I let it slide the 'mountain' will start to look too high to me to.

It's mostly a matter of discipline.

</comment></comment></comment></comment></comment><comment><USER14> Doesn't bankruptcy imply a _lack_ of emails? ;)

When it comes to dealing with spam, I'm often tempted to change my email address of ten years and start off with a blank slate. I'm genuinely curious to see how long it would take to ramp up. I rarely hand out my [myname]@example.com address, instead using [companyname]@example.com - so, amazon or email@example.com and then filtering spam depending on that. Is it time to start over?

<comment><USER15> Think of email as bills, which need to be paid/responded to.</comment></comment>


Tell HN: Asana.com founded by that other facebook guy just got 9M and is hiring - <AUTHOR> http://www.asana.com/#join

<comment><USER2> What are they doing for a living ? Maybe I'm blind, but I cant find their product/service description, just a list of names that ring a bell, and vague marketing stuff written by a MBA.

Are they just selling hype or doing real stuff? Where can we see it ?

<comment><USER3> They were very talked about when Moskovitz left Facebook to start it. They're basically doing Facebook-for-enterprise.

<comment><USER4> so a better linkedin?

<comment><USER5> i believe the focus is on collaboration

</comment></comment></comment></comment><comment><USER6> _Three 30" monitors. Actually, we let you spend up to $10K on your setup, however you think best._

makes you want to take on VC money with those kind of perks. :) we have a small amount of angel money but as founder I took half salary so we could spend a few bucks on decent monitors and task chairs for the developers. they could be better but we had to cheap it this first round.

I wonder how many hours a day Asana expects developers to crunch? My guys aren't addicted to Facebook/Twitter and we don't have office distractions or other 'perks'. We work all day in the zone, and I usually cut them off at 6pm and force them to go home so they stay mentally fresh.

<comment><USER7> It's surprising how little you need for a truly good setup. Me?

        * $1000 - One 30" monitor
        * $2200 - One 15" Macbook Pro, fully kitted
        *  $100 - One DualLink DVI-DisplayPort adapter
        * $1000 - One virtual development server running Linux
        *  $250 - Amortized cost of the build cluster
        *  $200 - Miscellany (keyboard, sound-dampening headphones)

That's, what, two weeks of salary at retail prices? And the only thing that really needs to be replaced on a regular basis is the Macbook -- two years should be fine.

Considering the potential productivity drop by making someone work on inferior hardware, I cannot understand why you would skimp here. I will tell you that if I ever work someplace that tries to hand me a nineteen inch monitor, or even two of them, I will shell out for my own thirty-incher and bring it to work with me.

<comment><USER6> You act like the web was weaved on 30"s. :)

ps. regarding the $100 DVI/display port adapter... you should check out MonoPrice. I get all my A/V gear from there and it's certainly comparable to overpriced AAPL and monster cables.

[http://www.monoprice.com/products/search.asp?keyword=DVI- Dis...](http://www.monoprice.com/products/search.asp?keyword=DVI- DisplayPort+adapter&x=0&y=0)

<comment><USER7> Appreciated.

</comment></comment></comment></comment><comment><USER8> I love comments in html code.

<!-- I assure you, we typically write nicer code than this. This is git-it- done hacktown. -jr \-->

<comment><USER9> Justin Rosenstein is a funny guy

</comment></comment><comment><USER10> I'm the co-founder of Workstax (<http://www.workstax.com>), a service which, from the sounds of their overview, is very similar to what these folks are going to build.

We have taken ideas from Facebook/Twitter, Reddit, and SharePoint, to build our messaging system for teams:

\- from FB/Twitter, we took the idea of a Feed, Profile (and explicit support for tagging)

\- from Reddit we took the idea of voting up/down to signal to the rest of the team (but we also introduced posting quotas to counter spam, and giving you the ability to use your quota to put posts/documents at the top of the feed)

\- from SharePoint we took ideas about teams, documents, discussion threads, and specifically worked on search to make it better than that of SharePoint.

We pushed these features out just last Thursday and I wrote a part 1 blog entry about it here: [http://joubert.posterous.com/separating-the-important- messag...](http://joubert.posterous.com/separating-the-important-messages- from-the-ir)

</comment><comment><USER11> Interesting that they are now public. They are doing pure server-side JS from what I hear. Back in 2007-2008, they had various code reviews and/or rules to enforce completely stateless programming...they may have automated these manual checks via internal modifications to JSLint or something similar by this point.

<comment><USER12> SSJS eh.. I see the site is served up with Jetty. Must be Rhino inside. Narwhal? AppJet?

</comment></comment><comment><USER13> how many angels/advisors do they have? :/</comment>


The Acme User Interface for Programmers - <AUTHOR> http://acme.cat-v.org/ <comment><USER2> I've seen Acme before. There is this webcast by Russ Cox that shows of what is interesting about it: [https://www.youtube.com/watch?v=dP1xVpMPn8M](https://www.youtube.com/watch?v=dP1xVpMPn8M)

I think it could be an interesting editor. It is a Plan 9 in the sense that it's API is a filesystem that it exports. This means any language that can talk to the filesystem can automate Acme. IIRC, there is a standard app called plumber that can be used to trigger contextually aware actions. It sounds neat.

It is missing something I consider a deal breaker: no syntax highlighting. I know some people vocally dislike it, but I can't live without it. I would also be able to make it a different color than snot yellow. If I'm going to be staring at something all day, I'd like it to look decent.

<comment><USER3> Basically a tiling WM running as a program.

The ability to edit the CLI history reminds me of Archy, of Jef Raskin fame (and as i dive back into it, so does some of the button chords).

And the whole thing really takes composability to its extreme. As should be expected from something that came to be on Plan9.

</comment></comment><comment><USER4> The screenshot is of my screen. I was using it to attach to an OpenBSD co- located server and develop my million monthly page view PHP website.

I'm also a contributor of werc, the system used to develop the cat-v website (though I am not active any more)

I was also one if the last people to talk to Uriel (cat-v originator) before he suicided.

AMA

<comment><USER5> What do you do now? Do you still use OpenBSD?

<comment><USER4> I got fed up with programming data driven websites (I'd been doing them since the 1990s - I'm 46) so I got qualified in AutoCAD, got a job as a draughtsman, did day release in Manufacturing Engineering, got into Six Sigma (I'm a green belt) and am currently doing a degree in Supply Chain Management with a focus on Computational Logistics.

I still use OpenBSD for myself, I went from BSD/386 -> FreeBSD -> OpenBSD. I've never really liked Linux (I'm in the "GNU is not useful" camp) and Free became less attractive over time. I feel most at home on Open.

I don't use Plan9 for much atm. which makes my heart ache.

<comment><USER6> You might be able to use Plan 9 in userspace with 9vx. Thoughts? Or is it just too much hassle to deal with both worlds, when OpenBSD covers most of your needs?

<comment><USER4> Although it is a great technical accomplishment I never got on with 9vx. Plan9port is my usual first installation on a system and plan9 in qemu so I can drawterm in and do stuff.

When I say I don't use Plan9 it is because of a lack.of technical need. I do a bit of Javascript hobby stuff and my Uni work / consultancy is done in Python because of the pervasiveness of Windows.</comment></comment></comment></comment></comment>


A City Data Collaborative for the Age of Autonomous Vehicles - <AUTHOR> https://www.routefifty.com/smart-cities/2017/10/argo-labs-california-data-collaborative/141585/ <comment><AUTHOR> Here's a map of road quality in San Francisco:

[https://demo.streetsdatacollaborative.org/San- Francisco/](https://demo.streetsdatacollaborative.org/San-Francisco/)

I've driven SF streets in the last six months. I'd bet a few Michigan cities using this scale the entire map would be red!

If this data gets collected it needs to be public. In Michigan I suspect the wealth of the area determines how quickly a pothole gets repaired. But you'd never be able to prove it. However with this data if it was open you could.</comment>


A Chinese Artist Vacuumed Up Beijing's Smog for 100 Days and Made a Brick - <AUTHOR> http://qz.com/562319/a-chinese-artist-vacuumed-up-beijings-smog-for-100-days-and-made-a-brick-from-what-he-collected/ <comment><USER2> It's not a brick made out of smog, but a brick made out of 95% clay and 5% smog. Quite an important distinction.</comment>


Guccifer 2.0: DNC's servers hacked by a lone hacker - <AUTHOR> https://guccifer2.wordpress.com/2016/06/15/dnc/ <comment><USER2> The media (and CrowdStrike) blame Russians for it [0]. Heh... yet this blog and the hacker himself, says he did it alone. I guess it's easier to forgive incompetence if you blame the attack on some huge, powerful, resourceful, state-funded opponent. That's why every hacking report of some big organization or company today lays the blame on APTs, China, Russia, NORKs and so on.

Management is off the hook since they don't have to admit that they were hacked by some kid and the security company gets the prestige of 'fighting and outsmarting a state actor'. And everyone's job is more or less safe. Other companies and CIO/CSOs now know that 'Sec Company X' will cover their ass by shifting the blame on some huge entity. Company lawyers are also happy because the liability of such attacks will be less. And the cycle continues. Guccifer, for example, didn't even know how to program and he used his phone to hack [1].

Yes, APTs definitely do happen but I'd bet they happen a lot less frequently than the media and security companies would want us to believe.

[0] [https://www.washingtonpost.com/world/national- security/russi...](https://www.washingtonpost.com/world/national- security/russian-government-hackers-penetrated-dnc-stole-opposition-research- on-trump/2016/06/14/cf006cb4-316e-11e6-8ff7-7b6c1998b7a0_story.html)

[1] [https://en.wikipedia.org/wiki/Guccifer#Computer_hacking_acti...](https://en.wikipedia.org/wiki/Guccifer#Computer_hacking_activities)

<comment><USER3> Here's what I can see in the files:

* The first few documents (1.doc through 3.doc) have metadata which says they were written by Warren Flood. However, the "last saved by" claims is was by Феликс Эдмундович. It also claims that it was created earlier today.

* The 4.doc file said the author was "Blake" and the company was "Grizli777" and it was last saved by "user" and created today.

* 5.doc claims to have been written by "jbs836" at the company "University of Texas at Austin". Again, last saved by "Феликс Эдмундович" and again, created earlier today.

* None of the excel files had anything interesting, except that their creation dates also all said today.

Research:

* There is a Warren Flood associated with the DNC (according to LinkedIn: [https://www.linkedin.com/in/warrenflood](https://www.linkedin.com/in/warrenflood)).

* Google translates "Феликс Эдмундович" as "Felix", Bing and Prompt as "Felix Dzerzhinsky". Googleing "Felix Dzerzhinsky" turns up Felix Edmundovich Dzerzhinsky, the former Director of Cheka... an Russian internal security service. He's been dead 90 years, so I doubt it was really him though.

* Googling "Grizli777" seems to suggest that the user's copy was pirated. Nothing really to go on there.

* Googling "jbs836" finds people (talking about this subject) suggesting that it's James B. Steinberg ([https://en.wikipedia.org/wiki/James_Steinberg](https://en.wikipedia.org/wiki/James_Steinberg)) a Democratic politician who formerly worked for the University of Texas at Austin.

My Take:

* The files are either genuine or someone bothered to find some Democrats names to attach to them. I'm leaning toward genuine since they didn't clean up any other metadata.

* The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym.

* There's no evidence that these files came from a DNC server and not, say, Warren Flood's laptop.

* There's no evidence that the individual who wrote this acted alone or that he is not working for a state.

<comment><USER4> Actually, I'd say that the "Grizzli777" signature is a hint that it's an individual or a small group. State-level actors wouldn't use pirated software - Microsoft Office is cheap for a government, and running 'warez' is really bad security practice, and a great way to have your own systems compromised.

<comment><USER5> For state agencies, assume that they are capable of misleading, but not generally capable of completely avoiding slip-ups.

So "state-level actors wouldn't use pirated software" is not good evidence - they might, both because it's easy and to make it look authentic as an independent hacker. Whether independent or not, if you're good enough to gain access where you shouldn't, you probably know where to get safe pirated copies.

But the Russian name in the most recent save is still evidence, because it's a perfectly plausible slip-up.

<comment><USER4> You can't prove a negative, and you certainly can never prove that something wasn't done by a more capable, more powerful actor pretending to be a less capable and powerful actor. It's the "that's what they WANT you to believe" argument of conspiracy theories.

<comment><USER5> As I see it, there are two options here. One is that a lone hacker succeeded in making it look like the Russians. The other is that the Russians failed at making it look like a lone hacker. Faking stuff is hard, so I'm betting on the failure.

DNC also said they believe it's a Russian intrusion, but we don't know if they rely on the same evidence for that - they potentially have access to a lot more.

Another thing is that Putin's government doesn't seem to be terribly concerned that you know they did something, as long as they can spread just a little doubt or have a fig leaf of plausible deniability. (Otherwise they'd probably not go around poisoning people with polonium). It makes sense if you view them as a sort of mafia: a mafia boss may not want it to be an _official_ matter that he killed some people who got in his way - but he sure wants similar people to know.

<comment><USER4> I think a lone hacker managed to look like he's _a_ Russian. The DNC has every motivation to claim that they have been hacked by "the Russians" as it's significantly less embarrassing to be hacked by a state actor than by an individual.

EDIT: Let's assume Russian state level actor, and that the purpose of the hack is to obtain evidence that will lead to an indictment of Hillary, improving Trumps chances at winning the presidency (a Trump presidency would presumably be very susceptible to strong-man optics and influence form the Kremlin). First strike against that, is timing: You want Hillary to formally secure the nomination first. An (imminent) indictment against the presumptive nominee would surely allow some kind of manoeuvring to hand the nomination to Sanders (or even someone else) in a way that can't be done after the convention is wrapped up. Sanders/Trump is probably in Trumps favour, but not as much as indicted-Hillary/Trump is. Second strike is the publicity. Being hacked, especially by a malevolent foreign power, has several positive PR spins, standing up against foreign interference in a democratic election etc. If you just wanted to hit Hillary, make it look like an anonymous whistleblower from inside the DNC leaking documents to an investigative reporter (Russia certainly has the capacity to make such a plant). Best not to have Russian fingerprints at all on this.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> _I will reprise a comment from yesterday:_

The only thing interesting about this story is that whoever did it "got caught". Sort of. Maybe.

Is there anyone here who really believes that every major campaign organization since, say, 2004 hasn't been completely owned up? What, you think the people that build the software and IT environments for campaigns --- sites that by design have millions of users with persistent accounts, and thousands of staff members at varying levels of privilege --- are the creme de la creme of software security talent?

Because, sure, I mean, everyone I know in software security and pentesting tells me "my first career choice is to go work in IT for the DNC and the GOP", but somehow along the way Google manages after a mighty struggle to outbid the 70k/year cost-center IT organizations offer for security talent.

If there was any interesting "oppo research" on McCain in the DNC servers during the '08 election, I will bet all the money in my pocket versus all the money in yours that the Chinese read all of it long before everyone on the official CC list did.

[https://news.ycombinator.com/item?id=11903136](https://news.ycombinator.com/item?id=11903136)

<comment><USER7> It is also interesting because Charles Koch is listed as a donor to Obama... scratching my head there.

<comment><USER8> Some recent interviews I heard made the Kochs seem less exclusively-Republican than I had previously thought. They're reportedly staying largely out of the 2016 election now that Donald Trump is the nominee. They're now an NPR sponsor too, which definitely caught me off-guard.

[http://www.slate.com/articles/news_and_politics/politics/201...](http://www.slate.com/articles/news_and_politics/politics/2016/05/the_koch_brothers_were_supposed_to_buy_the_2016_election_what_happened.html)

<comment><USER9> As someone who's been familiar with them since before their association with the Republican party, their platform goals are what they typically donate towards.

Marijuana legalization / decriminalization, marriage equality, cancer research, arts, the Smithsonian, PBS' Nova, open borders, school choice, and free market principles. Yes, they donate to Republicans, and no, I don't know why. Also worth noting, they used to donate to Democrats more than they do now, and most of the 'big names' in the Democratic world (Hillary, Harry Reid, Barack Obama, et al) are recipients of Koch donations.

It's definitely possible that they're also spending for nefarious purposes, but I suspect that it depends more on predisposed ideology, or ideology on the role of PACs in society as to whether or not you view them that way.

</comment></comment></comment></comment><comment><USER10> If Guccifer 2.0 writes a blog about "My first 10 minutes on a server" It would be a great read and we would know he reads hacker news.

<comment><USER11> Step 1:

> echo Fuck CrowdStrike!!!!!

<comment><USER12> You might get some interesting results if you aren't careful of history expansion...

</comment></comment></comment><comment><USER13> I read the convincing CrowdStrike detailed and technical description of how the DNC server got hacked. CrowdStrike saw the tracks of two known Russian groups.

The published documents to me look real. The SECRET document from the State Department had the obviously secret item that the USA will not nuke terrorist training camps nor hideouts in Pakistan. Official US policy is that all tools are on the table.

Question is how did the SECRET document get on to the DNC server?

Regarding Guccifer 2.0, I believe this is Russia's obfuscation of their release of these damaging documents. They want to help Trump, but must not admit it for fear that Obama takes action now, Hillary takes action if she is elected, or even if Trump wins - Russians helping him might actually hurt him given the foreign interference in USA elections.

<comment><USER14> Those don't look like actual classification markings, which are required to appear at both the top and bottom of pages. It seems more likely that those are some internal Democratic party markings. Also the fact that the documents seem to be talking about the first 100 days in the future tense would point to them being planning documents produced by people in the party.

</comment></comment><comment><USER15> Seems like the DNC does not have a great track record on computer security. The Sanders campaign filed suit on the DNC. Both Sanders and Clinton may have been able to access each others files.

According to CNN, Wasserman Schultz said: "[The Sanders staff] not only viewed it, but they exported it and they downloaded it... We don't know the depth of what they actually viewed and downloaded. We have to make sure that they did not manipulate the information... That is just like if you walked into someone's home when the door was unlocked and took things that don't belong to you in order to use them for your own benefit. That's inappropriate. Unacceptable."

Maybe you shouldn't leave your front door open.

[1] [http://www.cnn.com/2015/12/18/politics/bernie-sanders- campai...](http://www.cnn.com/2015/12/18/politics/bernie-sanders-campaign-dnc- suspension/) .

<comment><USER16> In that breach, the DNC wasn't the custodian of the data. A shared private vendor used by democratic candidates was.

The causes of the two issues are quite different - in one, an application doesn't have sufficient internal controls to ensure isolated multi-tenancy. The other is a breech by a malicious outsider.

</comment></comment><comment><USER17> If/when wikileaks begins to talk then we'll know if it was a legit leak.

The docs listed aren't the full dump, just "proof" that there is more.

<comment><USER18> Wikileaks is hardly a reliable and impartial third party.

<comment><USER19> Genuinely curious: have WL released unreliable information in the past?

<comment><USER20> Their collateral murder video that claimed to show photographers being killed but ignored or edited out the frames showing someone with an RPG and an AK47 in the same group.

<comment><USER21> This fact is rarely mentioned. Thanks for bringing it up. This editing was not done by Chelsea; she submitted the information as-is. It was indeed WL / Assange who edited the video.

</comment></comment></comment></comment></comment><comment><USER22> Very interesting thread about this here: [https://twitter.com/pwnallthethings/status/74317975006403788...](https://twitter.com/pwnallthethings/status/743179750064037888)

Looks like it may still be Russia

<comment><USER23> It is entirely likely that the hacker is Russian, but state sponsored is a huge stretch.

I don't think that this was a pro-Trump hack either. Opposition research isn't anything new/groundbreaking. It's merely a writeup for quick reference when planning new content, polling, or debate prep. In 2016, this sort of information would be better suited in a wiki-format, but alas a mega-doc will suffice. Leaking it doesn't put the DNC at a disadvantage since this is all public information.

<comment><USER24>
        > but state sponsored is a
        > huge stretch

Why?

<comment><USER23> I very much doubt that a hacker hired by the Russian government would go and create a WordPress and dump documents.

<comment><USER25> Wouldn't that be a good way to make it look like there wasn't Russian government involvement, then?

</comment></comment></comment></comment></comment><comment><USER26> Did they just out Jim Simmons of Renaissance technologies as donating $5,000,000 to the democrats?

Robert Mercer won't be happy:)

[https://www.opensecrets.org/news/2016/06/a-hedge-fund- house-...](https://www.opensecrets.org/news/2016/06/a-hedge-fund-house- divided-renaissance-technologies/)

David Shaw of D.E. Shaw fame is there as well.

</comment><comment><USER27> 2016: Giant meteor hitting the Trump vs Hilary debate and wiping out them and their fervent supporters is our only chance of surviving.

</comment><comment><USER28> media made it sound all but official that Russia hacked them. of course no one ever publishes any proof for these sort of claims.

<comment><USER29> What's that saying again? Never attribute to malice which can be adequately explained by incompetence?

<comment><USER30> Hanlon's Razor

<comment><USER31> I counter with gray's law [1] "Any sufficiently advanced incompetence is indistinguishable from malice."

It's pretty clear that the DNC needs a huge shakeup. DWS is a blathering joke.

[1] [http://joshuabrauer.com/2007/07/grays- law](http://joshuabrauer.com/2007/07/grays-law)

</comment></comment></comment></comment><comment><USER32> That playbook is weak. Real research would be a lot more explosive than that.

How could one prove it? Describe the hack in detail in a message and sign it with a key?

<comment><USER33> I'm thinking the same thing. Is this really all they got against Trump? This way too benign, and none of these are some dark secrets.

<comment><USER34> Or, it's all they can admit publicly to having. (which makes sense in a play book)

</comment></comment></comment><comment><USER35> The x.wordpress.com domain made me smile, is there a history of hackers using one-off free/hosted blogs for releases like this? It goes against every one of my marketing bones, but it is so dam cool.

<comment><USER36> Yes. A deep history.

Paying for a blog is a really bad way to drop documents onto the Internet and stay anonymous.

<comment><USER35> I'd seen pastebin and some others, just not wordpress.com Makes sense.

</comment></comment></comment><comment><USER37> I love how easy attribution is now a days! They use multiple Virtual Machines and and English and Russian fonts, must be Russian.

I also love how both sides instantly blamed the other.

Obviously trump hacked the DNC and then released its oppo research (on him) to hurt Hillary. Either they removed all the bad stuff, or wanted to release it all at once and force the attribution to Hillary.

or

Obviously Hillary Hacked the DNC and released the oppo research on trump to cause an easy document dump and get media attention on all her weak oppo research

No Expert's Opinion or Confirmation Bias going on today.

Edit: It is totally possible some extra "secret" attribution is going on by bigger entities.

</comment><comment><USER38> I am sorry if this is a stupid question but why does anyone care if it's Russia, China or a lone US hacker? What's the point of discussing that over the content of this documents?

<comment><USER39> The understanding of 'why' and 'how' changes entirely depending upon the size of the operation that did this. If it'a a lone hacker, the 'why' is pretty much lost, and the 'how' becomes very embarrassing, because individuals don't have the same access to development resources and zero-days as APT types. On the other hand, if it's an APT, we should assume substantial political scheming (because a for-profit outfit wouldn't do this.) In that case, it would be interesting to know, for example, if this is a Chinese or Russian priority to the extent required for a serious operation to be undertaken.

I'm guessing people jumped on that angle because (a) this is a tech-oriented site; and (b) no one commenting has yet taken the considerable time needed to read that huge document.

</comment></comment><comment><USER7> Among the files made public is one named 'big-donors-list'/

Under a tab named 'Not Met With' and a heading called 'Obama Billionaires' appears the name "Charles Koch".

Obviously, this may indicate that Koch raised funds for Obama in some capacity and that Clinton would like to reprise that relationship. Obviously, that makes no sense.

<comment><USER40> Is the Koch that gave cash to pbs more liberal?

</comment></comment><comment><USER41> These documents are 8+ years old. The National Security document is from 2008. Talks about Don't ask, Don't tell. Discusses Reversing a bunch of Bush Doctrine. Repealing don't ask/don't tell. And is focussed on Obama first 100 days, Not hilary.

</comment><comment><USER42> OT: HN posts are starting to resemble "fake news" in the game Uplink. [1] :)

[1] [http://i.imgur.com/FeFPcwj.png](http://i.imgur.com/FeFPcwj.png)

</comment><comment><USER43> Stuff is always hacked by one person. If that person works for some sort of organization does not really alter the "hack".

<comment><USER39> This is a bizarre position. Do you consider all the prep work to be unimportant. Or are you just saying this for the sake of pointing out a misleading technicality?

<comment><USER43> Bizarre from your perspective apparently.

Don't know what "prep work" you are talking about?

        "Or are you just saying this for the sake of pointing out a misleading technicality?"

no.

</comment></comment></comment><comment><USER44> Guccifer 2.0 is a psyop pumped by the DNC

</comment><comment><AUTHOR> Media stories:

[http://gawker.com/this-looks-like-the-dncs-hacked-trump- oppo...](http://gawker.com/this-looks-like-the-dncs-hacked-trump-oppo- file-1782040426)

[http://www.thesmokinggun.com/documents/crime/dnc-hacker- leak...](http://www.thesmokinggun.com/documents/crime/dnc-hacker-leaks-trump- oppo-report-647293)

<comment><AUTHOR> [https://motherboard.vice.com/read/guccifer-20-is-likely-a- ru...](https://motherboard.vice.com/read/guccifer-20-is-likely-a-russian- government-attempt-to-cover-up-their-own-hack)

</comment></comment><comment><USER45> So is there anything interesting here?

</comment><comment><USER46> Another interesting theory: The Trump campaign alleges that the DNC hacked itself

[https://twitter.com/JTSantucci/status/743194156739108865/pho...](https://twitter.com/JTSantucci/status/743194156739108865/photo/1)

<comment><USER47> Looking at the file, I have to agree... I doubt there was a hack and I doubt this is really their oppo playbook. This looks like Black PR to me... a way to dump talking points easily in the media without having them all come out of Clinton's mouth.

<comment><USER48> What do you mean, all I see is a detailed point-by-point summary of why Donald Trump is a scumbag and some State Department documents that seem to show Hillary Clinton is really smart!

<comment><USER49> It's very possible the supposed hacker is a Clinton supporter and/or Trump opposer and when deciding which documents to publish they naturally tended toward documents which make Clinton look good and/or make Trump look bad.

</comment></comment></comment></comment><comment><USER50> "Guccifer may have been the first one who penetrated Hillary Clinton ... but he certainly wasn't the last."

<comment><USER27> uh...

</comment></comment><comment><USER51> False flag to offset the email server lies.

</comment><comment><USER52> Russia does not have America's best intrest in mind so if they did secretly do this to help Trump, that's more of a reason to NOT vote for him</comment>


Show HN: Podcasts for .NET - <AUTHOR> http://podcastsfor.net/

<comment><AUTHOR> I'm in my car quite a bit 5-6 days a week and like to listen to podcasts. I couldn't find a centralized repository of .NET podcasts so I hacked one together from scratch and learned the basics of ASP.NET MVC in the process.</comment>


Ask HN: What are some examples of great documentation? - <AUTHOR> I've been trying to polish up my skills to write technical and end-user documentation. At this point, I feel like it might be useful to start learning from other people's work and filter out what makes them helpful.<p>What are some examples of great documentation? What makes great documentation for you? <comment><USER2> Qt's document is the best I have seen,

[http://doc.qt.io/qt-5/accessible- qwidget.html#introduction](http://doc.qt.io/qt-5/accessible- qwidget.html#introduction)

I think what made it awesome is

1\. it has lots of examples

2\. it used to be interactive, you can directly comment under the document page about unclear, inaccurate content. sadly, the recent document removed this feature.

</comment><comment> a0-prw Emacs documentation: it's accurate, avoids unnecessary jargon and, while written in a 'friendly tone', doesn't talk down to the user.</comment>