Things learned while running your own self-funded startup - <AUTHOR> http://richg42.blogspot.com/2017/09/things-learned-while-running-your-own.html <comment><USER2> You missed the most important part: Keep your sanity.

Trying to get funding is described as "soul sucking" even by Paul Graham and in our experience this is a startup killing move. Very few people talk about mental health for entrepreneurs and for us the most challenging times was talking to investors. If a constant stream of people told you, your business was not worth spending time or money, after how many rejections will you start doubting your company and even yourself?

Investors asking for a stream of documents, asking us to drive down for partner meetings, arriving late at meetings, un-responsive to emails: They all take a toll on the startup and more importantly on entrepreneurs.

Getting funded is a rat race. You get the money and then clock starts ticking for sales, series A,B,C , 10x the returns etc.

The startup newsletter are full of wins, and VC fundings and "we are killing it bro" mentality but how often do we stop to talk about those that failed?

<comment><USER3> _> but how often do we stop to talk about those that failed?_

The failures of VC-funded startups (e.g. recently Juicero, Rethinkdb, etc on HN) are discussed _more often_ than the failures of self-funded startups.

Also, as far as I can tell, a significant number (most?) of the startups listed at autopsy.io[1] are VC-funded. In contrast, the self-funded startups that fail usually die a quiet death without discussion because they were never big enough to be mentioned in Techcrunch/Wired/Engadget/etc.

[1] [http://autopsy.io/](http://autopsy.io/)

<comment><USER4> > die a quiet death without discussion

Perhaps the reason they died

</comment></comment></comment><comment><USER5> Since the article goes into this, a couple things about selling into large companies:

\- The amount that they will try to squeeze you and give you the runaround is highly dependent on the personalities and the resources of the _team_ that you're selling to; it's not generally consistent across the entire company, unless you're dealing with a central purchasing department (hopefully you're not, except for processing your PO). Of course, it also depends on the amount of value that your product provides compared to their current or potential internal solutions, as well as your competitors.

\- Getting paid promptly is much easier if you write your contract with milestones and require receipt of payment for a previous milestone before work on the next milestone begins. Invoice in advance so the "net 30" expires on the day you want to be paid, or demand "due upon receipt" terms.

<comment><USER6> I also use that billing strategy happily. There's another detail that helps with 'training' new clients on good payment behaviour - give them a small % discount on the next milestone if they pay early on the first.

</comment></comment><comment><USER7> > _Open source is great, because potential customers will get a chance to try > out your work without spending a dime or ever talking to you. This boosts > your credibility. On the flip side, if you give away too much, you are > basically competing against yourself when you attempt to monetize your work > as a product._

> _Your open source release should be a demo of the product, and no more. Give > things away with the goal of eventually converting the users of the free > software into paying customers._

Eh, I get it, but I also kind of dislike when people use open source solely as an advertisement. Either open source something useful or don't bother open sourcing it at all. A lot of smaller open source work I've seen is done by people who put a lot of work into making a cool tool who then want to share it with other people that may find it useful and use it for new and interesting purposes.

<comment><USER8> Unfortunately, this is where we are in 2017. For many companies and people, contributing to open source has nothing to do with the Stallman concept of "freedom" \- it has everything to do with PR.

</comment></comment><comment><USER9> Great list. The only thing that I might take issue with is #5: "5\. Every decision must be made extremely carefully. Bad decisions cost money."

Taking too much time on decisions is a good way to kill a new company. Many, if not most wrong decisions you can recover from, and it's very difficult to know what the right decision is beforehand. So a lot of the time the "right" decision is just to do _something_ to learn what the real right decision is and then do that.

<comment><USER10> Generally don't comment that much, but have to agree with your point 200%. Trial and error is the backbone of building a successful stat-up, going from 0 to 1.

</comment></comment><comment><USER11> > 22\. If you're at a company with deep pockets and you want to really have > influence, offer the potential of a very large license fee for key software > middleware. It works.

What is number #22 (sorry, English is not my native language)? Is he talking about clients that offered him a large licensing fee and gained huge influence over him for doing so?

<comment><USER12> The opposite. To a company with lots of money to spend (deep pockets) the author offered the client a large license fee for middleware that was important (to the client).

This is a bit of a mind game. Confirmation bias[0] and the sunk-cost fallacy[1] being what they are, after a client makes what she sees as a large investment in you and your product, she has tied her success to your success.

[0]: [https://en.wikipedia.org/wiki/Confirmation_bias](https://en.wikipedia.org/wiki/Confirmation_bias)

[1]: [https://en.wikipedia.org/wiki/Sunk_cost#Loss_aversion_and_th...](https://en.wikipedia.org/wiki/Sunk_cost#Loss_aversion_and_the_sunk_cost_fallacy)

</comment></comment><comment><USER13> Does anyone know of similar articles to this that they like and wouldn't mind sharing?

I always find these perspectives and retrospectives useful and interesting. Different people always point out different things, because everyone's business is at least slightly different in one respect or another. (be it funding, customer base, product scale, product type, employee count, number of concurrent projects, how successful they were, etc.)

For example, the book "The Hard Thing About Hard Things: Building a Business When There Are No Easy Answers" by Ben Horowitz provided good insight into managing larger tech companies and was enjoyable to read.

<comment><USER14> In general I'd keep an eye on the articles and interviews on indiehackers.com.

Specifically, I recommend checking out these articles: How Seth Godin Would Launch a Business With a $1,000 Budget[1], A Guide to Running a Minimalist Startup[2], How to Launch a Product With No Money and No Customers[3], How to Ship Side Projects[4].

For something a little more comprehensive, check out GrowthLab's Ultimate Guide to Starting an Online Business[5].

[1] [https://www.indiehackers.com/@Louis_Grenier/2cc8c6c79c](https://www.indiehackers.com/@Louis_Grenier/2cc8c6c79c)

[2] [https://www.indiehackers.com/@pjrvs/1187274e54](https://www.indiehackers.com/@pjrvs/1187274e54)

[3] [https://www.indiehackers.com/@cmason/how-to-launch-a- product...](https://www.indiehackers.com/@cmason/how-to-launch-a-product-with- no-money-and-no-customers)

[4] [https://www.indiehackers.com/@lambtron/b04914b36f](https://www.indiehackers.com/@lambtron/b04914b36f)

[5] [https://growthlab.com/guides/ultimate-guide-to-starting- an-o...](https://growthlab.com/guides/ultimate-guide-to-starting-an-online- business/?ref=banner)

<comment><USER13> These are great! Thanks a lot for sharing.

</comment></comment></comment><comment><USER15> Having bootstrapped a couple of successful businesses myself, I think this is chockablock with great advice/observations.

I am surprised he seemed happy with his Valve experience but it is insightful of him to see that it taught him some good bootstrap lessons.

<comment><USER16> >chockablock

I had to google that :)

Funny it's 'x is chockablock with' rather than 'x is chockablocked with'

<comment><USER17> Chockablock is a nautical term (see:double blocked) meaning that two blocks (pulley systems used in ship rigging) are fast against each other and can't get closer. Basically it's a synonym for "full" or "can't move."

Clearly, the term "block" has nothing to do with the word, "blocked."

</comment></comment></comment><comment><USER18> I think I'm going to stop reading any article about what it's like to run a company, until I actually create and run my next one.

Does anyone feel like reading articles has reached a point of diminished returns?

</comment><comment><USER19> Quite a few of the advices can be summarized to:

 _Say "no" when something feels wrong._

This implies that you can say "no"

\- emotionally (you don't feel bad about it and you don't fear missing out)

\- economically (you don't need that money)

Source: I've committed all three types of errors

</comment><comment><USER20> Great read. They do direct sales with each contract individually negotiated and high prices. More common approach for small companies is to avoid such negotiations and sell packaged software at fixed and lower prices but aim for higher volume.

</comment><comment><USER21> I'm unclear about what he means by "Don't blindly sign NDAs". What are the risks, and what items to watch out for would be on the checklist my lawyer would ideally provide?

<comment><USER22> As an example, about a decade ago I was running an eLearning startup.

A more established eLearning company approached us to discuss potential partnering opportunities, and sent over their NDA. Note - I actually read NDA's and other legal docs before signing, to make sure nothing untoward or unexpected is included.

In the above case, they included non-compete clauses (without any limits) specifically so we couldn't compete with them.

Upon asking their (from memory) CEO "WTF?" he was rude/abrasive and that was the last we heard from them.

At a guess, they were just trying a cheap tactic to get leverage over us in some way.

<comment><USER23> Fascinating. I guess they're just arbitrary contracts that can include anything, even if they have a standard name.

</comment></comment></comment><comment><USER24> A link to the product page (Basis) would be helpful to give context. Sounds like a lot of advice veers toward enterprise sales.

<comment><USER25> He does say "middleware" a couple hundred times in the article. Most of his sales advice doesn't apply to off the shelf consumer software.

Doesn't mean the article doesn't look insightful though.

<comment><USER26> I imagine he was selling to techies.

> 7\. If you have a product that a very large company really wants, they'll > still do everything they can to delay purchasing it for the market price. > They'll try to hire you or your partner(s) away individually, or they'll > wait as long as possible to see if you encounter hard financial times and go > under. They won't come and just offer to license your product or buy you out > until they've exhausted all other possibilities.

This is the opposite of normal enterprise sales in my experience (we do HR software). If you are talking to the right person, and you have a solution to their business problem at a suitable price (not too high, not too low) then the very last thing they want to do is to kill the deal with these kinds of shenanigans.

Selling to programmers though is the opposite, and frankly is to be avoided at all costs.

</comment></comment></comment><comment> at-fates-hands Great checklist.

I self funded two startups and the point about targeting small companies is a good idea.

I would also add using a subscription based service (even for development) is the way to go. You can charge a monthly fee for a group of services to smaller clients while development is ongoing with a list of milestones and achievements to keep the project on track while ensuring you have recurring revenue coming in.

If you get multiple clients, you can really set yourself up for success. Having 3-4K coming in every month on a regular basis can keep you afloat and reduce the anxiety of having to send out bill and then waiting to get paid.

</comment><comment><USER27> Are the references to contracts in the article "contract work" i.e contract employee work for someone else in order to help subsidize your startup? If so that's an interesting approach to getting your startup of the ground and maintaining some income. Have people had success with this? I have found lining up contract work to be almost as time consuming as doing a regular FT job. Or am I reading these references wrong and it's your startup doing various short term and tangentially related contracts?

</comment><comment><USER28> Wow, this matches 101% my experiences self-funding my company and product. I made a lot of mistakes that I recognize in the advice given here. Kudos!

</comment><comment><USER29> > Research the concept of "Death Prices".

Google doesn't come up with anything on this one, is there a different term for the same thing?

<comment><USER30> Is this the same as "hidden costs" ? That is a cost not showing up on the bill. For instance the time spent to get the thing working and keep it working.

I've heard it used as argument against linux and free software.

<comment><USER23> No, it's about the initial price you list influencing the value perceived by potential customers. If you set it too low they won't think your product is worth their time or money

</comment></comment></comment><comment><USER31> I find these articles always of interest.

@Rich Geldreich, you might want to link from your blog to your company website [http://www.binomial.info/](http://www.binomial.info/). I only say that because I didn't find a link and I had to google for it.

</comment><comment><USER32> low contrast is hard for me to read

</comment><comment><USER33> there ya go

div.post-body { color: black; font-size: 1.7em; font-family: serif; }

now you too can read the article!</comment>


Swift is open source and why you should care - <AUTHOR> https://www.oreilly.com/ideas/swift-is-open-source-and-why-you-should-care <comment><USER2> I'm not a big fan of exceptions in general, but I do like the direction Swift has gone with multiple aspects of its language design.</comment>


India's ruling party accused of running deceptive Twitter campaign - <AUTHOR> https://techcrunch.com/2020/01/04/indias-ruling-party-accused-of-running-deceptive-twitter-campaign-to-gain-support-for-a-controversial-law/ <comment><USER2> as usual media only shows the opposing protests and completely blacked out the support rallies.

btw a couple of satire tweets and some specific situational tweets with a well known back story (like that tweet of the south indian actress Gayatri Raghuram confrontation with cadres of a rival political party etc) are used to concote some kind of false campaign. this accusation is not just untrue but plain stupid. as always I'm not surprised.

<comment><USER3> Let's just be clear here. Are you suggesting these misleading tweets with the phone number didn't happen, or just that they were satire?

Edit: For those looking to make up their minds for themselves, here's the Twitter search linked in the article: [https://twitter.com/search?q=8866288662&src=typed_query&f=li...](https://twitter.com/search?q=8866288662&src=typed_query&f=live)</comment></comment>


How can we end hunger with technology? - <AUTHOR> https://gist.github.com/obvio171/a49c77ef90011482bcab#how-can-we-end-hunger-with-technology

<comment><USER2> It's good to want to find a solution to the hunger problem, however the problem of chronic hunger is not lack of access to food. It's lack of money to purchase it. Dumping free food on economies that are predominantly made of agricultural workers further exacerbates the problem rather than helps it. What you propose could still be helpful perhaps for disaster relief situations, but that's the minority of the problem.

More facts here: [http://www.worldhunger.org/articles/Learn/world%20hunger%20f...](http://www.worldhunger.org/articles/Learn/world%20hunger%20facts%202002.htm)

<comment><AUTHOR> "the problem of chronic hunger is not lack of access to food. It's lack of money to purchase it."

The idea is exactly to think of ways for money not to be necessary.

It's been done before, albeit not by us.

Our atmosphere is one grand f*cking infrastructure project, and it's all free- to-breathe for everyone.

</comment></comment><comment><USER3> How about direct conversion of C,H,O,N to carbohydrates and proteins using electricity and nanomachines? Farming is an elaborate, fragile system.

<comment><AUTHOR> That would be "as good as it gets" with current science, I guess, so it's great if we can get to that, but I think it's a little farther down on the technology horizon.

<comment><USER3> I'm thinking not so far down. It'll be terribly valuable to 'dial up' a molecule for industry, transportation (lubricants, fuels), business. Imagine a printer toner cartridge that never got empty! SO there's money to be made. Food can't be far behind.</comment></comment></comment>


Ask HN: Best uses for Amazon Echo? - <AUTHOR> I got an Amazon Echo and some wifi enabled light bulbs and electrical outlets for Christmas.<p>What are your favorite uses for it? Any cool "skills" you've made? <comment><USER2> The best use of an Amazon Echo is to connect it to your company's Salesforce account and allow high level executives to ask questions such as "Who was the best salesperson last month?" or "How many deals do we have in the pipeline with a 90% chance or better of closing?"

Or so I thought.

Me and a friend started a startup a year ago to do this, but we found the Amazon eco-system difficult to work with.

I wrote about this a lot a year ago:

[http://www.smashcompany.com/business/i-believe-in- enterprise...](http://www.smashcompany.com/business/i-believe-in-enterprise- software-for-the-amazon-echo)

[http://www.smashcompany.com/technology/how-to-enable-the- sal...](http://www.smashcompany.com/technology/how-to-enable-the-salesvoice- skill-for-the-amazon-echo)

But I eventually became a sceptic, for all the reasons I wrote about previously. You can see a recent comment of mine here:

[https://news.ycombinator.com/reply?id=13214911&goto=threads%...](https://news.ycombinator.com/reply?id=13214911&goto=threads%3Fid%3Dlkrubner%2313214911)

I now believe that voice interfaces for sales database could be useful, but the Android phone might be the better platform to target, and IBM Watson is likely to be the best service to use in the background.

<comment><USER3> This exists: [http://www.tactile.com/](http://www.tactile.com/)

</comment></comment><comment><USER4> Right now Echo/Alexa is still surprisingly bad at NLP(1), so its strength seems to be in simple integrations with platforms that have done the heavy lifting.

I can't, for example, have Echo give me travel times to work by subway or even schedule anything beyond a simple timer.

However, I have converted entirely to Phillips Hue bulbs, a Kasa wifi plug and a Beme eRod curtain rod, with a Logitech Harmony Hub as a bridge for IR devices (like the eRod). With this I can do things like tell Alexa to open and close my curtains (well, "Alexa turn curtains on" since it is bad at NLP so it can't understand "Alexa, open the curtains"). I also have it turning on my Christmas tree lights at sunset and off at 1 am (thanks to the Kasa plug). It's nice to have it turn some lights in my house off and others to 50% with a couple quick verbal commands.

If I had cable and cared I could use the Logitech Harmony to tell Alexa to turn on ESPN, but I've been cordless for a long time.

I still really wish some things were first order operations: it is absurd I can't schedule the Phillips lights to turn on and off at a given time, every day, for example.

I'm still pretty new to everything given I held out for the Echo Dot so I could have something with a 3.5mm out to stream Spotify via my receiver, so I've only had a couple months to dive in. I can see it doing more for me, like watering my plants by hooking up another Kasa plug to a reservoir of water and a fish tank pump.

For now it is better than anything else I've tried (haven't seen/tried Google Home yet), but it is still bad enough at just recognizing my actual voice commands I am hestitant to build more on it until the platform has matured.

(1) When I left Amazon they seemed one of the stronger technical teams and I expected then to have been much farther by now.

<comment> crooked-v You may want to see about running Home Assistant ([https://home- assistant.io](https://home-assistant.io)) locally. It can do recurring schedule stuff (as well as more complicated condition-based triggers), works to make custom commands ([https://home-assistant.io/components/alexa/#i-want- to-build-...](https://home-assistant.io/components/alexa/#i-want-to-build- custom-commands-to-use-with-echo)), and can pretend to be a Philips Hue bridge to get first-class integration with Echo ([https://home- assistant.io/components/emulated_hue/](https://home- assistant.io/components/emulated_hue/)).

</comment></comment><comment><USER5> "What time is it" \-- being able to find out what time it is without looking at my phone makes it a little easier to go back to sleep. My voice is so mumbly when I am 90% asleep that I usually have to repeat this 2-3 times, though!

"Play NPR News"

"Set an alarm for x time"

<comment><USER6> my cellphone does these

<comment><USER7> So does mine! Have you ever met anybody else with a phone that can do these things? Maybe we should start a club where we can share tips and tricks!

</comment></comment></comment><comment><USER8> If you want to build your own, check out this library:

[https://github.com/johnwheeler/flask- ask](https://github.com/johnwheeler/flask-ask)

Found it while browsing HN/new the other day, and it's been fun to play with so far.

<comment><USER9> author of lib here. thanks for plugging it. glad you enjoy!

</comment></comment><comment><USER10> I made a smart home skill for my dorm room. I didn't have any wifi enabled lights, but I created a little IR adapter for some RGB LEDs around the room, and the TV. Ultimately, I was able to ask for the lights in different settings, control the TV (including setting the channel and changing inputs). I eventually want to make it able to control some simple aspects of the Chromecast like the Google home can.

<comment><USER11> I'm emulating Belkin WeMo instead for my lights with a raspberry pi. No Amazon dev account required and it has native support.

[https://github.com/n8henrie/fauxmo](https://github.com/n8henrie/fauxmo)

(Not my project.)

The one thing I've learned about smart home is if you come up with a cool idea of how to do it DIY, someone's done it similarly and better. Wrote my own code for everything and ended up ditching it all for HomeAssistant.

<comment><USER10> I wish I would've known about that before I started... I went into it with the idea of creating a web interface to control everything, and adding in the voice control was easy because I was already using Google auth for the web interface. If I end up adding support for more things (buying some cheap RF controlled switches and creating a module for that), I might go the route to port everything over.

</comment></comment></comment><comment><USER12> Checking my credit card account. Reading my audio books. Playing music. Listing to Radio. Setting reminders. Calculating things, while doing them.

Telling a bad joke, and then saying "Alexa, start my applause."

</comment><comment><USER13> I own a Google Home and I struggle to answer this question. It can do lots of simple stuff _sort of_ well. Activating light switches by voice feels hopelessly inefficient to me when you compare it to just using a light switch - especially when you factor in the cost of the hardware involved. Playing music is also fine if you know exactly what you want, but browsing is pretty terrible. Video is kind of cool ("play show X from Netflix on my TV!") but controls like pausing, rewind etc are also very difficult without reaching for the remote you could have used in the first place.

When it's useful it's great. But it feels like a tool trying to find a purpose still.

<comment><USER14> Why is pausing difficult?

<comment><USER13> Because I'm then talking over a video I'm supposed to be watching. Volume is a better example - I'm talking over the video and it isn't even about to stop. Worse, I'm likely making the request _because I 'm struggling to hear_, and issuing the voice command only makes it worse.

</comment></comment></comment><comment><USER15> Echo is great for info that you need kind-of-right-now, but info that isn't detailed enough that you need to read it.

My favorite uses are:

* Flash Briefing: Weather and NPR news while I make the morning coffee.

* Weather: How cold is it? I'm about to leave and I need to know if I need a sweater or a coat.

* Set a timer: I'm cooking, and I need a reminder in 10 minutes, but my hands are dirty and my phone is on the table in the other room.

<comment><USER16> So I don't mean to be snarky, but what it's useful for is apparently exactly the same things every other device like this has always been useful for, nothing more. What you said is 100% identical to what someone with a Chumby would have said in 2007.

This just kind of fuels. Y skepticism about this kind of product. It's looking for a problem to solve.

<comment><USER17> When I look at the technologies I've dismissed and that then went on to become big, there's a similar pattern: I didn't adequately weight the firm as well as the function.

You're right. These are the easy examples because they're kind of universal. But what _feels_ very different about this is how well and quickly it works.

My wife's 72yr old (and her heavily Tagalog accented English) used Alexa properly on her first attempt. My 5 yr old daughter wanted one for her room because she loves playing it so much.

Ease of use and actually freaking working seems like a game changer.

<comment><USER18> _> Ease of use and actually freaking working seems like a game changer._

I was honestly surprised that Alexa could recognize my voice from across an entire room, me standing in the hallway, _over_ the music I had playing at full volume over the built-in speaker with me speaking at a normal level. That was impressive.

I hate voice technology because it's always been unreliable and shoddy, meaning I could check things faster myself rather than trying to ask a computer to check it for me. "What time is it?" \- "What is the time?" "Time now" "What is the time now?" "Give me the damn time!" Ah forget it. _pulls out cellphone_

The only issues I've had with Alexa is trying to Wikipedia Japanese-related things. Alexa seems convinced I'm speaking Spanish - as any attempt to Wiki something in Japanese gives me a result related to Spain or Mexico.

So we're in complete agreement here. "Actually working" is the game changer. Coupled with an affordable price (the Echo Dot was like $40 on sale? Back-in- the day the same device would hardly work and be worth $200~ and had an Xmas sale of maybe $160~)

</comment></comment></comment></comment><comment> fake-name Teach yourself hardware reversing by figuring out how to get shell on the echo, and (ideally), replace the linux install with your own.

You'll learn a huge amount, and you get the bonus of actively helping subvert amazon'd horribly creepy surveillance infrastructure.

</comment><comment><USER19> I'm jumping onto a stale thread here, but to me the best use of the Echo (or Google Home, etc) is as an accessibility device for the sick and/or disabled. I got a Google Home for a relative with ALS who is fast losing dexterity in their hands. It's getting harder day by day for them to operate TV remotes and touch devices, but now they'll be able to turn the radio on, get news, get weather, control Chromecast-connected devices, add yogurt to the shopping list, etc. Lots of little things that they would otherwise need somebody else to do for them.

</comment><comment><USER20> Linked it to common calendar that my wife and I use for ourselves and the kids - wonderful for when you get that notice about a doctor's appointment and don't want to pick up your phone.

Also use it for capturing a shopping list while walking around the kitchen.

</comment><comment><USER21> set a timer

ask weather

ask for hours of a local business

play music from Amazon Prime library (asking by album name or playlist name usually works)

playing audible audio books (my son can control this without any other device which is cool)

telling knock knock jokes and other kids entertainment

</comment><comment><USER22> Surveillance capitalism.

<comment><USER23> I wondered the other day if the Echo could track people who pirate their Prime shows (e.g. The Grand Tour, which became the most pirated show ever). The show begins with a "Amazon originals" banner with a particular chime. So all the Echo needs to do is listen to that chime, and listen for another few seconds to determine which show it is. Since it's connected to your account, it can see if you have Prime and if you just started watching the show. If it's not the case, it can flag you as presumably pirating the show. Even if they don't do anything evil with it, they can also do metrics of "favorite shows among pirates".

<comment><USER24> This wouldn't be reliable, it's very plausible it's somebody else's account being used.

</comment></comment></comment><comment><USER25> My morning routine consists of asking Alexa:

> Stop

To cancel the alarm

> Ask National Rail to get my commute

The clunkiest of commands - the built-in "get my commute" skill only works for road commutes. My journey involves an overground and an underground train. The National Rail skill is good, but has this weird (I think, platform dictated) trap where you have to tell it "No [I don't want any more info]".

> Do I need an umbrella? / Is it going to rain today?

My experience with the weather skills is hit/miss - I'll get a weather report but not an estimate answer to "do I need an umbrella" (probably/unlikely would be fine).

> What time is it?

I don't have a visible clock at the moment, so I ask this repeatedly to keep track of time.

\--

Overall, the conversational interface feels a bit clunky, and I'll be building a smart mirror in 2017 because I feel it's a better way to communicate status-y information. That said, having to ask for info has been a great way of discovering what information I really want in the morning.

</comment><comment><USER26> Playing music. It's still kinda shit for that because search / discovery is so awkward but it's the only thing I use it for.

<comment><USER27> I was very surprised by this, but had the same experience. The sound is great for what a small device it is, and the stop/play/volume works great, but it can't find songs to save its life.

It struggles with words that are very custom (like the group "rae sremmurd") or that are less common alternates ("clique" is interpreted as "click" and skews the perceived best match)

It also struggles with abstract instructions like "play the first song from this album". It doesn't seem to have the context of "this album" and just starts playing something at random.

<comment><USER28> To be fair, the way _Rae Sremmurd_ pronounces Rae Sremmurd isn't even phonetic. It'd be content if it could get something like The Weeknd.

</comment></comment></comment><comment><USER29> Splitting this up comment into my common use cases.

IoT:

All my lights are Phillips Hue. Outside of the Echo I have HomeKit set up to take care of automatically turning the lights off when I leave my apartment's geofencing zone. When I arrive home from work, I really enjoy opening my door and saying "Alexa, all lights on" followed with ripping my headphones out of my phone and saying "Alexa, Play Spotify" to have her transfer the Spotify session over (more on this in the next section).

It sounds really silly when I look at it now, but honestly when I'm traveling and I stay at a hotel or something, I definitely miss not having to think about turning all the lights off. It's an extra task that's very lightweight, but it feels good to not have to think about. Before I had the HomeKit compatible Phillips Hue bridge I said "Alexa, all lights off" when leaving my apartment every day. That too is a lot easier to do than recognizing that one of my lights is on and needing to go to the room to turn the switch manually.

Music:

I have a real sound system in my apartment but it's so much easier to just have the Echo play music, and it sounds pretty good.

If you use Spotify, you can use the Spotify app to directly stream to your Echo. You can also just be listening to an album or playlist on your phone or Spotify on your computer, say "Alexa play Spotify", and it'll pick up on the same part of the same song with the same queued up next songs. The Amazon Echo competitors I've tried don't do this, they start a new Spotify session and play whatever they feel like (e.g. Google Home defaults to the first playlist in your playlists list.)

Cooking:

I rely on the Echo while cooking a lot. Everything from "Alexa set a timer for 20 minutes" while roasting some potatoes to having it do the calculations for reducing the recipe's ingredients by 1/3 since I'm cooking for one and it's a recipe for three. I like cooking with the Echo a lot more than with the competitors because on the Echo you have a giant blue ring that shows you if it heard you or not. I burnt my sweet potatoes the first time I tried cooking with the Google Home because it has a "face" that faces a specific direction and my oven is outside of that field of view, so I didn't know that it didn't hear my "Okay Google" and set no timer.

API wise:

The "Skills" themselves are really easy to make, but I wish the communication for using your custom skills wasn't so clunky. The only thing that I've actually made with their real API is a simple interface for Halo achievements.

My xbox is in my living room near my Alexa and my friends and I routinely would see an achievement pop up like "Top Gun" and want to know what it meant, but since we're in the middle of the game we can't check now and we'd forget after the game.

In less than 30 minutes I was able to write some JavaScript in the Chrome console to scrape the list of achievement name and descriptions for the Halo 5 website, then make a Skill out of those. Since the list of medals is pretty static, this is a set-once and forget operation.

Now when I'm playing on my Xbox, if an interesting achievement pops up I can say "Hey Alexa, Ask Halo what's Killtacular?" and it responds with the description. The "Alexa, Ask Halo" is the clunkiness I mean. I wish I could just say "In Halo, whats Killtacular?"

For what it's worth, the Skills editor has a really decent flow. Here's what the Skill I'm describing looks like in the interface: [http://i.imgur.com/8VPbt0v.png](http://i.imgur.com/8VPbt0v.png)

</comment><comment><USER30> I hooked it up to my Logitech Harmony remote, so we can tell Alexa to "turn on the TV" and it turns on the TV and amp. When Sonos integration is completed, 2017 is the plan I think, we'll use it for that.

</comment><comment><USER31> How much does Jupiter weigh? How tall is Kareem Abdul Jabaar? How far is it to Los Angeles? Set a timer for 15 minutes. Set another timer for 8 minutes. Play my discover weekly playlist on Spotify.

</comment><comment><USER32> Every few months I ask it the mass of a proton.

<comment><USER33> That's hilarious, especially when she said it again in kilograms.

</comment></comment><comment><USER34> "Schedule and set up a webex meeting with Jack, Jane, Janet, and Joe."

</comment><comment><USER35> just a timer and alarm clock, that's about it.

</comment><comment><USER36> Allowing corporations and governments to spy on you.

<comment><USER37> So you use a flip phone then?

<comment><USER38> More like, so you don't use a phone then?

</comment></comment></comment><comment><USER39> Thought Police. Doubleplus ungood investigation of thought crimes.</comment>


Show HN: Elfin – A homoglyph domain finder - <AUTHOR> https://elfin.josephkirwin.com <comment><USER2> It seems news.ycornbinator.com could be yours if you wanted it! :-D

<comment><USER3> Thank you for the idea and taken!</comment></comment>


Common problems with large file uploads - <AUTHOR> http://blog.filepicker.io/post/27503593299/common-problems-with-large-file-uploads <comment><USER2> Given the title I was expecting the article to provide a solution.

From personal experience, the bigger the file, the more likely you will experience a connection cut in the middle of the upload. That is why the most important thing it to support resumable uploads.

At the moment there is no clear consensus on how to handle that. Amazon S3 has one protocol, Google uses two revisions of a different protocol, one on YouTube[2], another on Google Cloud Storage[3]. Both work by first creating a session that you refer to when uploading the chunks. There is also the Nginx upload module[4] that delegates the session ID to the client for some reason.

And there is no browser client available to my knowledge.

That's all I know folks

[1]: [http://docs.amazonwebservices.com/AmazonS3/latest/API/mpUplo...](http://docs.amazonwebservices.com/AmazonS3/latest/API/mpUploadInitiate.html) [2]: [https://developers.google.com/youtube/2.0/developers_guide_p...](https://developers.google.com/youtube/2.0/developers_guide_protocol_resumable_uploads) [3]: <https://developers.google.com/storage/docs/developer-guide> [4]: <http://www.grid.net.ru/nginx/resumable_uploads.en.html>

<comment><USER3> I miss the ZMODEM protocol. Resumable file transfers over 56kbps was the bomb. Made me feel whole again (pun partially intended) back in '89.

<comment><USER4> Goddamn I had forgotten all about that haha. Rush of nostalgia from BBS scene.

XMODEM was painful. ZMODEM was leet.

</comment></comment></comment><comment><USER5> For the HTTP/2.0 discussion there was here earlier:

A way to continue an interrupted file upload.

Because POST variable are sent in order, if you put the file first and the other variables after, the server never sees them if the file was interrupted. So when I code a form I always put the hidden ones first so at least I can give a useful error message (since I know what the user was trying to do).

It would be better to decouple them and upload the files and the rest of the variables separately.

</comment><comment><USER6> I'd really like to be able to use Dropbox as a magic upload handler for any file I upload on my local HD, not just those in my Dropbox folder. They handle the logic of getting all my files into the cloud. Why can't I point a website to my Dropbox and say here, this is handling the file upload?

<comment><USER7> Dropbox has an API that will (theoretically) let you do this, but there hasn't been a ton of people jumping up and implementing it yet. It'll be cool when it shows up.

<comment><USER8> I've used the dropbox API before to automatically upload photos in a dropbox folder to Flickr. It occurs on an interval (cron job every 2 mins). I'm sure you could do the same thing using FTP or a custom API that exists on your destination server.

<comment><USER9> They released a delta API recently. It's a bit of a pain to perform this task as you can't differentiate between a new file and a renamed file or a file that's been moved from one location to another.

In all cases you get a delete (if the file isn't new) and then a new file event.

I implemented it, and it kinda sucks for this sort of thing. The purpose seems to maintain local state to mirror the state on Dropbox. Not terribly interested in that...I just want to subscribe to specific events (webhooks, anyone?).

This _was_ their solution to the frequently requested webhooks. It falls short. Way short.

</comment></comment></comment></comment><comment><USER10> 8gb+ files? I found a way but you have to use a JAVA FTP Applet. I tested these two here: <http://jupload.sourceforge.net/> and <http://www.jfileupload.com/>

Dragged and dropped an 8gb+ file and left it on for 5 hours. Worked perfectly. No time outs, no errors, and I'm on a shared hosting account at 1and1.

My problem with them is that it wasn't possible to hide the FTP username and password, they were always in javascript files. I whined, I complained, I bitched, and there was nothing they could do about it. :( So you basically had to password protect the whole directory with .htaccess and be very careful with whom you shared the credentials.

If you don't want people to download and install software just stick with JAVA FTP Applets.

<comment><USER11> You could always just hard-code the username/password into the applet and recompile. That shouldn't be too hard...

Or, if you control the FTP server, you could dynamically add and remove random virtual users/passwords to the FTP server (hopefully virtual users). Then when the client javascript gets the username/password, it could only be used once.

<comment><USER12> One could scan the .class file for string literals with relative ease. Obfuscation would be an improvement, but still not completely secure.

<comment><USER13> It would hardly be an improvement. Wireshark would be a first step for most reverse engineers when there's network authentication involved.

</comment></comment></comment></comment><comment><USER14> I've been dealing with browser-based large file uploads, which means dealing with lots of browser-specific issues.

Fortunately, things are getting better, especially for the webkit-based browsers. Firefox still has some issues, and I check <https://bugzilla.mozilla.org/show_bug.cgi?id=678648> pretty regularly. Just today this bug, which was filed in 2003, changed from Status = NEW to Status = ASSIGNED.

Today is a good day.

<comment><USER15> First, I'm impressed that someone was uploading 2gb files back in 2003...

Agreed. Good to see that firefox is going to be able to do more than 2gb soon.

<comment><USER14> That title is a bit misleading.. On some platforms you can already use Firefox to do >2GB uploads, but there is still a 4GB limit..

If anyone wants to help beta-test a HTML5 uploader that calls archive.org's S3-like endpoint under the hood (no IE or Opera support yet, though Opera 12 is now working..): <http://archive.org/upload/>

</comment></comment></comment><comment><USER16> I've experienced this issue before when establishing a publisher backend for a D2D pc game business. It seems to be basically impossible without a Java applet of some kind, and even then it's wonky at best and just 'fails' at worst. The real fix for the issue seemed to be simply providing an FTP connection and letting people connect through the native client of their choosing.

That really seems to be the key for this problem, develop a simple native app capable of FTP uploads, that make it easy for users to deliver files to your app within the context of their use. Most browsers are capable of opening native applications via unique protocol, you could easily enrich the process by having the native app be a part of(or try to blend seamlessly with) major browsers.

</comment><comment><USER17> As plenty of file transfer protocols, clients, and servers support resumable transfers (FTP, SFTP, rsync, proprietary browser-based tools, etc., or even basic HTTP if you arrange for the file to be pulled rather than pushed and your "client's server" has byte-range support), perhaps this should be titled "why you shouldn't use a single HTTP POST request from a browser to upload a large file". The general reason seems to be "because this is not a use case this feature is commonly designed for and tested against."

</comment><comment><USER18> I ran into this problem with <https://truefriender.com/> the solution I used was to use nginx instead of apache, nginx streams the file to disk and then I can handle it with PHP. I still have the 2GB problem but I've tested out Perl and I can go past it, now I just have to implement it.

<comment><USER15> Being on Herkou, been bit many times by the 30 second time out. No luxury of changing it, let alone moving in nginx.

</comment></comment><comment><USER19> It may not work for ginormous files, but I've used a flash swf object to upload to s3, released as part of a Rails gem. The latest version is here: <https://github.com/nathancolgate/s3-swf-upload-plugin>

</comment><comment><USER20> Hi everyone. We developped a solution just for that! Please feel free to look at <http://forgetbox.com> and give us feedback.

Our users send 130GB files, directly from Gmail...

</comment><comment><USER21> Excuse me if this is a stupid question, but why would timeout issues on large files affect something like Heroku more often than other types of hosting services?

<comment><USER22> Heroku enforces the timeout.

<https://devcenter.heroku.com/articles/request-timeout>

<https://devcenter.heroku.com/articles/s3#file_uploads>

[http://stackoverflow.com/questions/7854239/heroku-timeout- wh...](http://stackoverflow.com/questions/7854239/heroku-timeout-when- uploading-big-file-to-s3)

</comment></comment><comment><USER23> I use node.js with this plugin: <https://github.com/felixge/node-formidable/>

Works like a charm!

<comment><USER24> I immediately thought of node with this post. Makes uploading and streaming a breeze!

</comment></comment><comment><USER25> split them into rar/zip files with checksums on client side then upload...</comment>


Golang: How to Connect to MySQL / MariaDB or Postgres Over an SSH Connection - <AUTHOR> https://www.reddit.com/r/golang/comments/5blhz3/how_to_connect_to_mysql_mariadb_or_postgres_over/ <comment><USER2> (removed)</comment>


Show HN: Reflections and Takeaways from Deconstruct Conference - <AUTHOR> https://isaacs-journal.herokuapp.com/shared_posts/lGODBufriLBsKW-xt3qenQ <comment><USER2> Nice post. Please host on your own domain though. I feel that offers better longevity of urls.</comment>


Getting Real 2 update: First draft done, publisher search continues - <AUTHOR> http://www.37signals.com/svn/posts/1183-getting-real-2-update-first-draft-done-publisher-search-continues <comment><USER2> I've been losing interest in 37Signals lately.

As much as I loved DHHs presentation at Start-up School, I'm not completely sold that their "business" advice applies to high-tech companies, its more in line with lifestyle businesses like design boutiques.

Don't get me wrong, their stuff on application development in the original Getting Real was gold. It just helps to understand what type of business their advice applies to.

</comment><comment><USER3> I hope by broadening the target market (to any entrepreneur), it doesn't loose focus and become unrelated to its actual target market - web entrepreneurs.</comment>


VLC: The HTTP interface (macros and RPN evaluator) - <AUTHOR> http://www.videolan.org/doc/vlc-user-guide/en/ch05.html

<comment><USER2> Why would someone want to re-invent ColdFusion 1.0, only 15 years late?

If they'd invented a smooth and tight DSL for doing video control, I'd be impressed, but this has the feel of someone getting excited about RPN and looking for a way to crowbar it into the product. Something relevant (and really cool!) for VLC to do with a build-in web-server would be one-click serving of a H.264 stream directly in a player (sniffing for a HTML5 video- tag, otherwise serving a flash-player). But no, we get RPN and a syntax that'd make a 1999 ASP developer cringe.

For the record: VLC is amazing, and one of my first installs on pretty much any computer. I routinely stick it on friends' Windows machines, only to hear them rave about it a few weeks later, because they never have to troll around for codecs.

</comment><comment><USER3> The HTTP interface on VLC is not new - what would be interesting is to find the reasons for them doing it this way.

As a product VLC is really good.

<comment><AUTHOR> Maybe because everything speaks HTTP, so it's a good protocol for doing remote control? Or you could build a custom controller interface trivially, which could be accessed from a remote control (iPod touch?) on your local network?

</comment></comment><comment><USER4> Seriously? Documentation on the front page of Hacker News? This is some dry stuff. I guess I should just be thankful it's not yet another review of the Go language.

<comment><AUTHOR> It's the hackyness of what's documented. Embed a Turing complete language in HTML, then run it when the page is requested from an embedded HTTP server.

What's not to love? It's either a stroke of genius or an amusingly inappropriate implementation of an embedded scripting language.

</comment></comment><comment><USER5> Nice! Want <video>! :-)</comment>


Planning a Date - <AUTHOR>

Would you guys use an app that helped you plan out your entire date? <comment><USER2> Only if you're dating a computer. Making a few assumptions (you're a guy and it's a date with a girl), I can't think of anything less encouraging to a woman than to realize the date is running to a schedule.

Take a huge risk -- don't plan the date, experience it.

</comment><comment><AUTHOR> The app is user-dependent. It would be the match.com for date planning. People create maps of where they went on a date previously and people can follow that date if they are matched with that person based on their dating needs and criteria (i.e 1st date with a moderate budget. It's more of a convenience tool and saves time from scouring sites like yelp, foursquare, metromix etc.

</comment><comment><USER3> What do you have in mind? I'm curious.

What can be appified other than the most mundane parts of the date? Planning dinner then a movie is boring and can be done probably better with existing apps.</comment>


Launch HN: Fuzzbuzz (YC W19) – Fuzzing as a Service - <AUTHOR> Hey HN,
We're Everest, Andrei and Sabera, the founders behind Fuzzbuzz (https://fuzzbuzz.io) -  a fuzzing as a service platform that makes fuzzing your code as easy as writing a unit test, and pushing to GitHub.
Fuzzing is a type of software testing that generates & runs millions of tests per day on your code, and is great at finding edge cases & vulnerabilities that developers miss. It's been used to find tens of thousands of critical bugs in open-source software (https://bugs.chromium.org/p/oss-fuzz/issues/list), and is a great way to generate tests that cover a lot of code, without requiring your developers to think of every possibility. It achieves such great results by applying genetic algorithms to generate new tests from some initial examples, and using code coverage to track and report interesting test cases. Combining these two techniques with a bit of randomness, and running tests thousands of times every second has proven to be an incredibly effective automated bug finding technique.
I was first introduced to fuzzing a couple years ago while working on the Clusterfuzz team at Google, where I built Clusterfuzz Tools v1 (https://github.com/google/clusterfuzz-tools). I later built Maxfuzz (https://github.com/coinbase/maxfuzz), a set of tools that makes it easier to fuzz code in Docker containers, while on the Coinbase security team.
As we learned more about fuzzing, we found ourselves wondering why very few teams outside of massive companies like Microsoft and Google were actively fuzzing their code - especially given the results (teams at Google that use fuzzing report that it finds 80% of their bugs, with the other 20% uncovered by normal tests, or in production).
It turns out that many teams don't want to invest the time and money needed to set up automated fuzzing infrastructure, and using fuzzing tools in an ad-hoc way on your own computer isn't nearly as effective as continuously fuzzing your code on multiple dedicated CPUs.
That's where Fuzzbuzz comes in! We've built a platform that integrates with your existing GitHub workflow, and provide an open API for integrations with CI tools like Jenkins and TravisCI, so the latest version of your code is always being fuzzed. We manage the infrastructure, so you can fuzz your code on any number of CPUs with a single click. When bugs are found, we'll notify you through Slack and create Jira tickets or GitHub Issues for you. We also solve many of the issues that crop up when fuzzing, such as bug deduplication, and elimination of false positives.
Fuzzbuzz currently supports C, C++, Go and Python, with more languages like Java and Javascript on the way. Anyone can sign up for Fuzzbuzz and fuzz their code on 1 dedicated CPU, for free.
We've noticed that the HN community has been increasingly interested in fuzzing, and we're really looking forward to hearing your feedback! The entire purpose of Fuzzbuzz is to make fuzzing as easy as possible, so all criticism is welcome. <comment><USER3> Can you talk a bit about what you're fuzzing for in Python programs? I feel like I have a good understanding of what cluster fuzzing is accomplishing for C/C++ libraries, but less clarity about the goals for managed languages.

<comment><AUTHOR> Sure! Some of the classes of bugs that remain low-hanging fruit for languages like Python include slowness, hangs, panics, race conditions, assert failures, excessive resource consumption and other Denial of Service attacks.

Other use cases include using fuzzing to compare implementations of libs that require the same functionality, detecting invariant violations, testing implementations that are meant to work together (i.e. serialize(deserialize(x)) == x).

In general fuzzing C/C++ libraries for memory bugs is the most commonly described use-case, but I think there are tons of fuzzing use cases that haven't been thoroughly explored yet.

</comment></comment><comment><AUTHOR> P.s. Know someone who maintains an open-source project, written in C, C++, Go or Python, that should be fuzzed? Please send an email to email@example.com. We'd love to fuzz your code for free on our platform and make the world's open-source software more secure.

<comment><USER4> Can't they do this w/oss-fuzz already?

<comment><AUTHOR> They certainly could if their project is large enough! Every widely-used C/C++ project should use OSS-Fuzz, it's an awesome service.

We support a couple of languages that OSS-Fuzz doesn't (Go & Python as of now), which is why I thought this was worth mentioning :)

<comment><USER5> >We support a couple of languages that OSS-Fuzz doesn't (Go & Python as of now), which is why I thought this was worth mentioning :)

I thought the main benefit of fuzzing was finding memory security bugs. If your program is crashing or otherwise erroring out given crazy input that's something you want to fix because it is potentially exploitable. With Python/Go that's not really an attack vector. So what's the benefit from finding out that some crazy input crashes my Python program?

<comment><AUTHOR> Memory security issues have been the main focus of fuzzing, but it's really useful for other use cases as well, such as: slowness/hangs, assert failures, panics, excessive resource consumption and DOS attacks. We've also done some work with Go to detect race conditions while fuzzing.

You can also do differential fuzzing to compare 2 different implementations that solve the same problem, or fuzz for invariant violations/assertion failures. I think the possibilities extend far beyond just memory safety, and I'm really looking forward to finding other areas in which fuzzing is applicable.

<comment><USER5> Have you guys run FuzzBuzz against FuzzBuzz? If so, how many bugs did you find?

</comment></comment></comment></comment></comment></comment><comment><USER6> FWIW I separated my Oil shell parser into a standalone stdin/stdout filter, which is ready to be fuzzed:

[https://github.com/oilshell/oil/blob/master/bin/osh_parse.py](https://github.com/oilshell/oil/blob/master/bin/osh_parse.py)

[https://github.com/oilshell/oil/issues/171](https://github.com/oilshell/oil/issues/171)

I'm already testing it by running it on more than a million lines of shell [1], which I imagine should provide a very good starting point for the AFL algorithm. I've only fuzzed one thing before but that's my understanding.

If anyone is itching to try out Python fuzzing, this might be a nice and realistic intro.

I made note of Fuzzbuzz on the bug.

[1] [http://www.oilshell.org/blog/2017/11/10.html](http://www.oilshell.org/blog/2017/11/10.html)

<comment><AUTHOR> Thanks for mentioning us on the issue! I'd love to help get that project up and fuzzing

</comment></comment><comment><USER7> I know of a company, called Security Innovation, that tried this in 2002. It went very badly at times. They added training and pen testing, and today they bring in just $20 million per year.

They opened an office in Seattle to fuzz for Microsoft. As soon as they proved that they could succeed, Microsoft hired away all the people, leaving the company with a lease for an empty office.

Generally, companies don't trust outsiders and/or don't see a need. You're up against internal politics too. People within the company don't want to compete with you and don't want to be embarrassed by you.

<comment><USER3> Companies don't trust "outsiders" to do security testing? Veracode was doing 9 figures a few years ago and was recently spun out from Broadcom for almost $1Bn.

Also, 20MM/yr is not a revenue number to sneeze at. Enterprise security is a huge and mature product space and most aspirants in it do not hit that number. These companies aren't Uber, where every dollar coming in is going back out the door with an extra couple dimes to boot.

<comment><USER8> Eeeep.

There's a substantial counterargument to this I need to type up. I understand where you're coming from as someone who once ran a consultancy, Tom, but from the perspective of someone who hires security firms and consumes their services—and this is essentially a TL;DR for the opinion I need to flesh out here—we don't do it because we trust. We do it out of necessity.

TODO: Bryant to flesh this out in between laundry rounds tonight.

<comment><USER3> My name is Thomas.

<comment><USER8> Well, apologies are due as I can't seem to edit that out of my post now. Sorry for making the assumption, Thomas.

But considering the gray patina my earlier comment has developed with time, I'll withhold my point as there doesn't seem to be interest in hearing it.

<comment><USER3> I actually didn't understand your comment and it was downvoted before I responded (I didn't downvote it). I just wanted to make sure people knew how to spell my name.

</comment></comment></comment></comment></comment></comment><comment><USER9> This is a great name, because at least 90% of your customers will find it funny. Some friends in Boulder made a company called RaffleCopter, and its meme-inspired name (based on ROFLcopter) seemed to help it get much more attention than it drove away. [https://www.rafflecopter.com/](https://www.rafflecopter.com/) Another good thing about both names is they work even if you don't get the reference. I think that could be a must.

I don't know much about fuzzing but I'm inspired to give your tool a try if/when I get a chance.

<comment><USER10> We sort of picked the name as a joke at first, but we noticed that it was very memorable (as meme-inspired names tend to be), so we decided to keep it. Don't regret it, yet.

If you're interested in learning more, our docs [0] explain everything from the ground up.

[0]: [https://docs.fuzzbuzz.io/](https://docs.fuzzbuzz.io/)

<comment><USER11> Did you consider "Fuzzbizz?" It's a truer Spoonerism, plus you get the "business" pun. Although maybe that's outweighed by it no longer rhyming. :P

</comment></comment></comment><comment><USER12> This looks great, congrats on the launch! All enterprise software companies should take notes, having a "Buy vs. Build" section on the website is incredibly useful and saves time on both sides.

<comment><USER10> Glad you found it useful - it's a topic that comes up a lot when we talk to customers and we figured we should just be upfront about it.

Wasn't our idea though - we stole it from Labelbox [0] :)

[0] - [https://labelbox.com/buy-vs-build](https://labelbox.com/buy-vs-build)

</comment></comment><comment><USER13> Some feedback going through the docs. For each of the languages you demonstrate a "BrokenMethod" but I don't understand what's broken about it. e.g.:

        func BrokenMethod(Data string) bool {
            return len(Data) >= 3 &&
                Data[0] == 'F' &&
                Data[1] == 'U' &&
                Data[2] == 'Z' &&
                Data[3] == 'Z'
        }

What's broken about this? It returns true for strings that start with "FUZZ", false otherwise, does it not? Python example:

        def BrokenMethod(strInput):
            if len(strInput) >= 2:
                return strInput[0] == 'F' and strInput[1] == 'U'

Other than not being idiomatic I don't see what's wrong with this method.

Next, it's not clear to me how you indicate success/failure of a test. Is success just any program than exits 0 and failure any program that exits non- zero? That would be my guess but the docs don't say.

Typo: [https://github.com/fuzzbuzz/docs/pull/3](https://github.com/fuzzbuzz/docs/pull/3)

This page is missing a link to the find-your-first-bug-in-Python example:

[https://github.com/fuzzbuzz/docs/blob/master/getting- started...](https://github.com/fuzzbuzz/docs/blob/master/getting- started/introduction-to-fuzzbuzz.md)

The docs site loads slowly for me on an older iPad, and there's even a slight delay on a recent Macbook. Looks like it's maybe a font loading issue? (Oh, it's gitbook. How awful. I guess there's nothing you can do about that other than use a different doc provider.)

<comment><AUTHOR> Thanks for the questions & feedback! Concise docs are really important so this is all super useful. To answer your questions one by one:

1) The BrokenMethods are simple examples of programs that crash on buffer overflows/index out of range errors. If you were to pass "FUZ" into the Go method, it would check Data[3], thus causing a panic since there are only 3 elements in the string.

ninja edit: that python method in your comment IS a valid method with no error - a bit of a brain fart on my end when writing out the docs. It's been changed :)

2) In general a failure is any non-zero exit. We do this to be flexible in the way you report bugs. For C/C++ and Python this is usually with assertions, and in Go you can achieve something similar with:

      if !x {
        panic("Error")
      }

We also have other checkers or "sanitizers" that run with your code to look for certain bugs. For C and C++ code we support tools like Address Sanitizer, which report memory bugs like Heap Buffer Overflows and UAFs, and for Golang you can choose to fuzz your code with a race condition checker. These are just some of the examples of more advanced fuzzing methods we support, and we'll be making nicer tutorials/screencasts to showcase those over the coming week.

3) Thanks for the fixes - much appreciated. And yeah, we know GitBook is pretty slow, and we're in the process of moving to another docs provider.

If you've got any more questions please let me know!

<comment><USER13> Great thanks for the answers. Maybe on the broken examples just put a comment on the line that's broken so the reader doesn't have to expend mental effort understanding why it's broken.

</comment></comment></comment><comment><USER14> That's awesome! Would love to use it on popular ruby gems to make sure they are secure (including Rails). Also having a free plan is perfect for experimenting. I predict this company will be a huge success.

<comment><AUTHOR> Really interesting to see the desire for ruby support in this thread! It's definitely on our roadmap.

Shoot me an email at email@example.com and I'll let you know when we launch ruby fuzzing.

</comment></comment><comment><USER15> This is awesome! I wish you all the best and hope that this takes off.

I am curious about how you use AFL under the hood - how do you scale? Do you use a shared kernel and run a worker process for each physical core, or do you do some virtualization or perhaps run with a kernel patch such as [https://github.com/sslab-gatech/perf-fuzz/](https://github.com/sslab- gatech/perf-fuzz/) ? My experience is that you will hit a wall pretty quickly unless you start multiple kernels by using virtualization, or simply having a very slow binary so you don't get a high number of execs/s to start with.

<comment><AUTHOR> We actually distribute the fuzzing workload across physical machines, for precisely that reason. Each instance of AFL gets its own kernel & physical core, and we use a staged synchronization algorithm to make sure all of the machines' corpuses stay up to date.

All of this was done to try and keep the scaling as linear as possible, so that when you double your CPU count you're doubling your execs/second as well.

<comment><USER15> Thanks for your quick reply!

This sounds like a good solution. I was trying to solve this problem on my own as well and ended up making a minimal kernel+afl image that I then boot multiple times using deduplication features in order to save RAM (I don't have 256 gig ram like you do in a proper server). Each instance ends up eating quite a lot of RAM even with a limited root filesystem so that's why I wanted to keep it low. I'm on a 2990wx rig which was kind of a disappointment from a fuzzing perspective because of the limited memory bandwidth, but that's for another discussion.

Do think it would be worth trying out that snapshot approach that I linked in the parent comment or it might not be worth it? I was thinking of rebasing their patch onto the latest master and getting it to work again - sadly the authors seem to have abandoned the project, at least there hasn't been any public changes since a year back.

</comment></comment></comment><comment><USER16> Have you thought of integrating some form of exploitability analysis[0][1] for the crashes|etc. fuzzing locates?

So let's say I upload some FOSS project and end-up finding some crashes|potential vulnerabilities. Have you considered some sort of tie- in|integration to bug bounty programs so that I could get a small pay-out without having to go through the trouble of figuring out how exploitable a given crash might be, and more importantly to actually have to deal with trying to get the attention of the project?

[0] [https://www.microsoft.com/security/blog/2013/06/13/exploitab...](https://www.microsoft.com/security/blog/2013/06/13/exploitable- crash-analyzer-version-1-6/) [1] [https://github.com/jfoote/exploitable](https://github.com/jfoote/exploitable)

<comment><AUTHOR> Yep, we're definitely going to integrate more automated analysis. As of now we do some rudimentary analysis based off the type of the bug (Heap buffer overflow, UAF), read/write size, and similar metrics, but we'll be adding more advanced methods of categorization as the platform matures.

We've been thinking about the best way to use Fuzzbuzz to benefit the OSS/bug hunting community, and the integration idea is a great one. We're also providing free plans with extra CPU power for security researchers & bounty hunters.

<comment><USER16> Nice. I'm sure you've looked into various backends to use (in addition to AFL). Just wanted to give a shoutout to radamsa[0]. My [somewhat not-up-to- date] experience has been that it produced sometimes findings that AFL didn't (because of e.g. different approach relative to infinite input space).

[0] [https://gitlab.com/akihe/radamsa](https://gitlab.com/akihe/radamsa)

In regard to CPUs - my laptop reports 4 CPUs, my workstation 16 - where the value for someone involved in fuzzizng would come in my mind would be if you could take away the hassle of scaling fuzzing 'transparently' to 100 or 1000 CPUs. What I am suggesting here is that on your pricing page you might be off by factor of 100 in regard to what number of CPUs actually make offering compelling to someone who would consider outsourcing their fuzzing infrastructure.

<comment><AUTHOR> Radamsa is awesome! Definitely agree, and one of the goals for Fuzzbuzz is to be able to hot-swap between fuzzing backends without any interface changes (or to use all backends at the same time, to account for differences in findings).

re: pricing, we do offer infinite scalability in terms of CPUs, but that might not be as clear as we'd like it from our pricing page. Or maybe I'm misunderstanding you. Either way, if you have any more thoughts/suggestions on pricing I'd love to hear it.

</comment></comment></comment></comment><comment><USER17> I thought someone had finally done it. Fizzbuzz as a service.

This is even better.

<comment><USER18> Actually, asking someone to write Fizzbuzz as a service isn't a bad idea for an interview question. And now that I've written this comment, it will cease to be not a bad idea in about 30 minutes.

<comment><USER19> Well if you're going to do it as a service you might as well make it enterprise ready. Allow me to introduce you to Java EE Fizzbuzz

[https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpris...](https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpriseEdition)

<comment><USER18> It's 2019. Should be implemented as a Lambda.

</comment></comment></comment></comment><comment><USER20> This looks awesome. Wish it integrated with Ruby projects.

<comment><AUTHOR> Ruby is one of the languages on the roadmap, but it's not super high-priority right now, mostly because we haven't seen a lot of interest. If you have a specific project/use case in mind I'd be interested to hear more about it.

<comment><USER21> Uploaded CSVs or PDFs would be interesting to me ([https://docs.ruby- lang.org/en/2.5.0/CSV.html](https://docs.ruby-lang.org/en/2.5.0/CSV.html)) ([https://github.com/gettalong/hexapdf](https://github.com/gettalong/hexapdf)). There's a fair amount of parsing that's probably not been fuzzed significantly.

</comment></comment></comment><comment><USER22> This is such an awesome service.

Congrats Everest (and team) for making it easier to make software more secure!

</comment><comment><USER23> This looks very nice. I will definitely try it out once support for Java becomes available.

<comment><USER10> Java is one of the next 2 languages we plan to support (hopefully in the coming month).

If you send me an email (firstname.lastname@example.com), I can let you know when we launch Java support

<comment><USER24> I couldn't find any good AFL-like fuzzers for Java, so I wrote one not too long ago: [https://github.com/cretz/javan-warty- pig](https://github.com/cretz/javan-warty-pig). Feel free to take it and hack/reuse it.

<comment><AUTHOR> Thanks for the link! We've been looking at all the current AFL-like/AFL wrappers for Java as we decide how best to implement Java fuzzing in Fuzzbuzz, and yours looks pretty nice.

Definitely going to play around with this :)

</comment></comment></comment></comment><comment><USER25> As a somewhat newbie, how would I use this on say my javascript web app and react native apps?

Thanks!

<comment><AUTHOR> Since the type of fuzzing you can do right now on Fuzzbuzz is language- specific, you wouldn't be able to fuzz Javascript code.

We are in the process of building a fuzzer for generic web-apps, so watch this space :)

</comment></comment><comment><USER16> Godspeed!

I recall there is|was a company based out Santa Cruz, CA called Fuzz Stati0n with a pretty similar concept. Might be good idea to 'compare' experiences.

<comment><USER26> I am the founder of Fuzz Stati0n - now a product security engineer at Looker.

Best wishes and happy to talk.

</comment></comment><comment><USER27> A number of questions:

Do you guys support fuzzing by protocols? Syscalls, REST, or SQL? It might be faster to extend protocol fuzzing than fuzzing by language (I'm not sure though). It'd be cool to have a fuzzer for Apache Calcite; it's a library to slap on a SQL interface to your database.

Any plans to extend fuzzing to property-based testing?

Do you guys fuzz your fuzzer (dogfood)? Probably useful, but also funny :)

<comment><AUTHOR> We don't support protocol fuzzing yet, but it's definitely on our roadmap - <USER2> wanted to start in an area that we felt was lacking the most, and then move into other types of fuzzing. We do have some novel REST API fuzzing techniques in mind that we're really looking forward to implementing as well.

We're also thinking about extending to property-based testing. There are some really awesome hybrid testing tools out there, such as DeepState ([https://github.com/trailofbits/deepstate](https://github.com/trailofbits/deepstate)) which combines Symbolic Execution and Fuzzing behind one clean interface, and we'd really like to push the boundaries of that type of testing.

And yep, we do! Everything is written in Go, which is part of the reason it's one of the first languages we support.

</comment></comment><comment><USER28> A small nit: the video is set with these dimensions: width: 940px; height: 529px;

On scaled display it shows up fairly small and so it's hard to see what's going on without going to full screen. As a quick fix could you enable the full screen button. And as a longer term fix consider recording another version where the windows are smaller or there's some sort of magnification?

<comment><USER10> My bad - I accidentally disabled the controls when I was setting it up. Should be fixed now.

Also, yeah, we're not video experts, so we had a feeling the video might not be the correct format. We just wanted to put something up that showcased the platform without forcing you to sign up, but we'll definitely make sure our next video is in a better format.

<comment><USER28> No problem thanks for addressing. Viewing it on youtube worked for me. Congrats on your launch and best of luck!

</comment></comment></comment><comment><USER29> I started learning about this type of testing by writing Hypothesis tests for Python code: [https://hypothesis.readthedocs.io/en/latest/](https://hypothesis.readthedocs.io/en/latest/)

One of the things that became a source of frustration is writing the specs that define the shape of the inputs.

Does FuzzBuzz make that any easier?

<comment><AUTHOR> That's a problem that we've been thinking about a lot. The way our fuzzing works right now is that your method consumes an array of bytes, which you can then use to build up arbitrary structures. It's simple, but manages to be really generic and flexible at the same time. Of course, it means you do have to define what your inputs look like.

We do have plans to build some tools to make this easier. I'd like to see a scenario where defining inputs is as simple as specifying the data types that your code requires. (Or perhaps even automatic detection, for less complex cases)

<comment><USER30> Some people use Protobufs to solve this, but when I work with C++, I use a class that takes a (data, size) as an input (to its constructor), and implements an overridable Get<T> method.

So you can do: auto s = datasource.Get<std::string>();

For each type I need I override Get<T> for that type. If the data source class is out of data, I throw a specific exception, that I catch at the global level. This works like a breeze and the advantage over protobufs is that it's faster (no Protobuf parsing overhead, errors) and you never consume more than you need.

</comment></comment></comment><comment><USER31> This looks really cool! Fuzzing is something I've been looking into more and more as I learn about it. I'll definitely keep this in mind for the future. Have you guys considered Rust support?

<comment><AUTHOR> We have! afl.rs[1] is awesome, and seeing as it's found some interesting bugs, I think Rust would be a great addition to Fuzzbuzz. It's on our roadmap.

[1] [https://github.com/rust-fuzz/afl.rs](https://github.com/rust-fuzz/afl.rs)

</comment></comment><comment><USER32> Can you add support for social login like GitHub OAuth? Thanks!

<comment><AUTHOR> We're already sort of integrated with GitHub, since you can integrate your projects to automatically pull updates from repositories, so GitHub login is definitely on the roadmap!

</comment></comment><comment><USER33> Why do this in the cloud? Wouldn't it make more sense to make standalone software that does the fuzzing?

<comment><USER34> > It turns out that many teams don't want to invest the time and money needed > to set up automated fuzzing infrastructure, and using fuzzing tools in an > ad-hoc way on your own computer isn't nearly as effective as continuously > fuzzing your code on multiple dedicated CPUs.

</comment></comment><comment><USER35> Sounds interesting! At least I learned something new, fuzzing.

</comment><comment><USER36> Can this be done in Rust?

<comment><USER37> Rust has a bunch of fuzzing tools, see [https://github.com/rust- fuzz](https://github.com/rust-fuzz)

</comment></comment><comment><USER38> Obligatory plug for the OG of Fuzz Testing, Barton Miller: [http://pages.cs.wisc.edu/~bart/fuzz/](http://pages.cs.wisc.edu/~bart/fuzz/)

#OnWisconsin

</comment><comment><USER39> Fascinating!

</comment><comment><USER40> wewlad!</comment>


High quality graphics for Latex documents: The Matlab route - <AUTHOR> https://www.io.ac.nz/blog/matlab-to-latex/ <comment><USER2> Gnuplot is designed to work with LaTeX. If you want a unified appearance, with textual elements on the graph typeset by TeX, then that workflow is built-in to gnuplot.

You can also use TikZ to call gnuplot from within the LaTeX document, or generate TikZ code from within gnuplot.

A very brief introduction:

[https://lwn.net/Articles/628537/](https://lwn.net/Articles/628537/)

<comment><USER3> Gnuplot is something i categorise with Fortran and hand writing latex as "I use use it because my advisor used it, and he used it because his advisor used it...". I understand that they were once the best tool for the job and they still work, but better alternatives have emerged since, e.g. matplotlib, C++/numpy and LyX respectively. I know this is a subjective matter but i feel it's a shame that a lot of scientist don't shop around and hence end up stuck with the "classical" option.

<comment><USER4> Have you used Fortran? Have you tried f2py, which converts Fortran modules into NumPy compatible Python modules? I would rather use Fortran over C++ in a heartbeat for scientific computing. For what it's worth, I thought for years that Fortran was an old crusty language, not worthy of my time, choosing to use C++ instead, and I regret not picking it up sooner.

<comment><USER3> I have used Fortran in a few instances where I was compelled to. I never gave it much of a chance because I didn't like using it, and what's more it isn't nearly as popular as C/Python/Matlab etc. for modern stuff. If popularity (and hence code sharing) wasn't important I'd be using languages I like, like Haskell and Scheme.

All the same your comment makes me think I may have dismissed it too quickly so I'm going to give it another try for my next toy project (even if they index arrays from 1). Thank you.

<comment><USER4> > even if they index arrays from 1

They don't have to! You can set the array index bounds to whatever you want. For example,

        real(8) A(0:n-1)
        real(8) w(-p:q)

are both valid declarations and would be indexed by i=0,n-1 and i=-p,q respectively. If you're using gfortran compile with the "-fbounds-check" flag to save a lot of headaches!

</comment></comment></comment></comment></comment><comment><USER5> I've historically just used matplotlib and it's TeX-based text renderer for labels. Output PDF, includegraphics in a latex document. Works fine, text looks great. [http://matplotlib.org/users/usetex.html](http://matplotlib.org/users/usetex.html)

</comment><comment><USER6> > _But your nice professional looking documents can be ruined because you > insert the wrong type of figures._

Example A of the wrong type of figure for any possible context: 3-dimensional pie charts.

<comment> stargazer-3 Not necessarily. For instance, some academic journals are on their way to allow interactive 3d plots in the pdf files [1]

[1] [http://journals.plos.org/plosone/article?id=10.1371/journal....](http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0069446)

<comment><USER7> 3D plots can useful when the data is _intrinsically_ 3D. But forcing a 3D plot on 2D data, like a pie chart, makes it hard for a viewer to develop an intuition for the data.

<comment> stargazer-3 Fair point, I overlooked the "pie" part of the chart argument. My comment was originally intended to go as a reply to oriettaxx's post.

</comment></comment></comment></comment><comment><USER8> R can output Tikz code. Probably the best option for statistics-related work.

[http://www.texample.net/tikz/examples/tikzdevice- demo/](http://www.texample.net/tikz/examples/tikzdevice-demo/)

<comment><USER9> I second this. I read a paper yesterday and the figures produced by R clashed visually with the typesetting style. The Tikz ones are so, so, nice.

</comment></comment><comment><USER10> If you're not specifically looking for Computer Modern fonts in your figures but just want vector graphic WYSIWYG exports with your pick of font (beyond what Matlab renders natively), my Matlab figure export tool works well:

[https://github.com/djoshea/matlab-save- figure](https://github.com/djoshea/matlab-save-figure)

</comment><comment><USER7> I found matlabl2tikz to be superior to plot2latex. I did my honours thesis with plot2LaTeX+inkscape and my PhD one with a matlab2tikz, so I've had a fair experience with both.

I have created some high quality, complex plots out through matlabl2tikz with no problem. I haven't had the issues the author notes and I'd suggest they file a bug report. The m2t community is active and friendly.

The other bonus of m2t is you can edit the files in PGFplots, which is a powerful and complete language/library. For my use case, it was important that my plots be repeatable, so manually doing it with Inkscape would be tedious. Having easily editable source code allowed me to write scripts to filter the output to what I needed.

The one problem I did find is that pgfplots can be quite slow. This isn't m2t's fault though and can be overcome with TikZ's cache system.

Disclosure: I wrote the path simplification in matlab2tikz, but nothing else.

</comment><comment><USER11> Maybe it's just me, but why can't Matlab just use the Latex fonts in an EPS, and output that EPS as a single file? That sounds like a more robust and less convoluted solution.

<comment><USER12> I think that the goal of the poster is not just the font, is to be able to modify the size/font/color/style when compiling the document (say that you realize you want bold labels, or sans-serif instead of serif when you have a lot of figures already generated).

<comment><USER11> In that case, I'd recommend structuring your scripts such that you can easily rerun them later on (e.g. using a Makefile). That has also other advantages, such as the ability to change graph colors, axes, or even data.

<comment><USER12> This is what I do, really. Regarding styling I have a small styling script that I put after each graph. This small script takes the active figure (gcf) whatever it is, and changes it to my liking. So if I want to change the graph styling at a later stage I modify this small script and then re-run the main file.

But everything in MATLAB, then I just symlink the pdf figures to the manuscript folder, so with an F5 in MATLAB and a build in Sublime I have the manuscript updated.

<comment><USER13> My only problem with doing everything in Matlab (which I used to do) and exporting the PDF is that you can't really match the fonts easily to the main document. I picked a set of fonts (math and normal) for my Ph.D. thesis and I wanted the fonts in the figures to match those in the main body. Using matlab2tikz did that for me.

You could probably do the same thing but do the export of the tikz file instead of the PDF. That's basically what I do.

</comment></comment></comment></comment></comment><comment><USER14> I have taken to using PowerPoint to create the actual charts. Edit them and make them look pretty. Then export as EMF, convert to EPS ([https://www.cs.bu.edu/~reyzin/pictips.html](https://www.cs.bu.edu/~reyzin/pictips.html)) and use the EPS in the Tex document.

Its a very manual process though, but I think the graphics that come out of it seem to be nicer than Matplotlib, and Matlab can do. Am I crazy, or should I really consider something like this?

<comment><USER8> Personally I prefer to generate all plots (and ideally tables as well) programatically. It's more reliable and efficient. Imagine that at some point you decide to include more data in the analysis (or remove erroneous data) you don't want to re-do all the work again.

</comment></comment><comment><USER15> In Mathematica, Export[expr,"PDF"], Export[expr, "SVG"], and Export[expr,"LaTeX"] for math expressions.

<comment><USER16> I was thinking exactly the same. This post just reminds me how easy it is with Mathematica

<comment><USER17> Mathematica is a really awesome tool.

</comment></comment></comment><comment><USER18> I started working on a Matlab command to export plotted data as Metapost paths, and to generate a script that draws the plot. The idea being that you would edit the script to get the style you wanted.

The proof of concept worked well for line and contour plots, but my thesis got in the way of completing this.

</comment><comment><USER19> Does anyone know of an equivalent solution for R/ggplot? I feel sad labelling my plots with R's fonts and equation formatting, but haven't found an alternative.

<comment><USER20> tikzDevice [1] defines a device in tikz terms, which I've used for vanilla R plots, and should work for ggplot, but I'm not positive.

Actually, a quick search yielded [2], so it appears that ggplot2 is supported as well. And apparently supported in one of the knitr examples [3] (if you use knitr, which I highly recommend).

[1] [https://cran.r-project.org/web/packages/tikzDevice/index.htm...](https://cran.r-project.org/web/packages/tikzDevice/index.html)

[2] [http://iltabiai.github.io/tips/latex/2015/09/15/latex- tikzde...](http://iltabiai.github.io/tips/latex/2015/09/15/latex- tikzdevice-r.html)

[3] [https://yihui.name/knitr/demo/graphics/](https://yihui.name/knitr/demo/graphics/)

</comment></comment><comment><USER21> I wonder if there is a similar guide for Scilab.</comment>


First commercial jetpack will sell for $100,000 - <AUTHOR> http://news.yahoo.com/blogs/technology-blog/first-commercial-jetpack-sell-100-000-dreams-flying-163844579.html <comment><USER2> Powered Paragliding is much much cheaper, and much more like flying like a bird does. <http://www.youtube.com/watch?v=TlbQ0xbbpOQ></comment>


Neurons that fire together, wire together, but how? - <AUTHOR> http://dissociativediaries.com/neurons-that-fire-together-wire-together-ok-but-how/ <comment><USER2> Hebb actually talked about causation, not synchrony (firing together):

"When an axon of cell A is near enough to excite cell B and repeatedly or persistently takes part in firing it, some growth process or metabolic change takes place in one or both cells such that A 's efficiency, as one of the cells firing B, is increased"

Synchrony is extremely important, particularly for the formation of cortical columns and neural pruning. But in spike timing dependent plasticity, where growth is potentiated if the presynaptic fires _just before_ post synaptic firing, the connection is actually depressed if up and downstream neurons fire exactly synchronously. (there is a huge amount of variation in this across the brain, though)

<comment><USER2> Note that there is also a mechanism for association between two _pre_ synaptic neurons. Probabilistically, when those upstream neurons fire synchronously, the downstream neuron will be more likely to actually fire. When that occurs, the postsynaptic neuron will, as a result of Hebb's Postulate, increase the connectivity to the synchronously firing neurons. So, "cells that fire together wire together" is more true of presynaptic neurons than pre-to-post synaptic neurons (and the wiring together is occurring through the postsynaptic neuron)

</comment></comment><comment><USER3> I find it strange that the author couldn't find this in a textbook. This is rather common material in a developmental neuroscience textbook or lecture. I've looked through two such books during my (only) course on the topic, and all three sources covered this material.

<comment><USER4> What did they say ? Perhaps you misread what was in the textbooks? My understanding is that the authors questions are legitimate and still not fully answered.

<comment><USER3> Yep, I agree that there are legitimate questions raised which still lack answers. However, I'm responding to the claim that the information the author provides in the summary is not found in any textbook they saw:

> So there you have it, a quick summary of one part of neural connectivity > I've yet to see described in a textbook about the brain, but which really > should be given out there, along with the classic Hebbian principle

</comment></comment></comment><comment><USER5> The question of how neurons find each other to connect was recently studied with experimental connectomics--altering neurons and then mapping their synaptic circuits with electron microscopy--in this paper by Javier Valdes Aleman et al. 2019 [https://www.biorxiv.org/content/10.1101/697763v1](https://www.biorxiv.org/content/10.1101/697763v1) , using Drosophila's somatosensory axons and central interneurons as a model.

If the OP's website Disqus worked (can't ever get the "post" button for comments after login), the above could have gone straight into the page.

</comment><comment><USER6> The connectedness of neurons in neural nets is usually fixed from the start (i.e. between layers, or somewhat more complicated in the case CNNs etc). If we could eliminate this and let neurons "grow" towards each other (like this article shows), would that enable smaller networks with similar accuracy? There's some ongoing research to prune weights by finding "subnets" [1] but I haven't found any method yet where the network grows connections itself. The only counterpoint I can come up with is that is probably wouldn't generate a significant performance speed up because it defeats the use of SIMD/matrix operations on GPUs. Maybe we would need chips that are designed differently to speed up these self-growing networks?

I'm not an expert on this subject, does anybody have any insights on this?

1\. [https://www.technologyreview.com/2019/05/10/135426/a-new- way...](https://www.technologyreview.com/2019/05/10/135426/a-new-way-to-build- tiny-neural-networks-could-create-powerful-ai-on-your-phone/)

<comment><USER7> (See sibling comment NEAT is awesome)

The only reason we architect ANNs the way we do is optimization of computation. The bipartite graph structure is optimized for GPU matrix math. Systems like NEAT have not been used at scale because they are a lot more expensive to train and to utilize the trained network with. ASICs and FPGAs have a change to utilize a NEAT generated network in production, but we still don't have a computer well suited to training a NEAT network.

<comment><USER8> NEAT just doesn't have good, modern GPU powered implementations.

NEAT would totally be competitive if someone actually gets a version running in PyTorch/Tensorflow

<comment><USER9> You may be interested in this implementation [1] which builds the networks using PyTorch.

[1] [https://github.com/uber-research/PyTorch-NEAT](https://github.com/uber- research/PyTorch-NEAT)

<comment><USER7> It uses pytorch (and I'm probably going to use it), but doesn't effectively leverage a GPU for training.

<comment><USER9> What do you think is the best way to accomplish this?

<comment><USER7> You don't. You need a different parallelism model than a GPU provides. It could work well on machines with very high CPU count, but the speedup on GPUs is the main reason bipartite graph algorithms have seen such investment.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Funnily enough over this last weekend, I read a great review on this subject from earlier this year:

"Synaptic Specificity, Recognition Molecules, and Assembly of Neural Circuits" by Sanes and Zipursky

[https://doi.org/10.1016/j.cell.2020.04.008](https://doi.org/10.1016/j.cell.2020.04.008)

For me, the hard part has always been understanding how this whole thing is orchestrated on a cellular and molecular level.

</comment><comment><USER2> When Hebb talks about "reverberation" in neural circuits, he still thinks in advance of our current knowledge of oscillatory neurodynamics. Here he speculates about the short term memory trace that holds position dynamically, prior to physical changes in the synapse:

"It might be supposed that the mnemonic trace is a lasting pattern of reverberatory activity without fixed locus like a cloud formation or eddies in a millpond"

From Hebb's 1948 "Organization of Behavior"

</comment><comment><USER11> Main point: "(..) if the target neuron already has too many connections, it will tend to remove the weakest ones, and this includes the most recent ones. The scaling goes both ways after all – it goes for more synapses when it starts with too few, but for less, if it starts with too many.

But synaptic scaling is not everything. As it turns out, the tips of the growth cone constantly produce structures called filopodia, and these react to specific chemical attractants and repellents. These chemicals are produced by both cells at the target area, and by so-called guidepost cells along the way. There are suggestions that the system for such targeting is fairly robust, especially in early development (and its limitations in later life might explain why spinal cord injuries and the like are so hard to fix)."

</comment><comment><USER12> This makes me want to know how quickly this type of growth happens. Is it on the order of seconds? Minutes? Hours? Days? Is this why when you learn something, take a break, come back later and everything makes more sense happens?

<comment><USER13> I've noticed that there's a weird area when learning a physical skill that there's a strange growth curve. You suck at first, then quickly get to some kind of milestone, then get worse before you get better. It feels like my brain is attempting to delegate some of the motor activity to lower levels before they are 'ready', but in fact it might be an essential part of training those neurons.

<comment><USER14> See _Mastery_ by George Leonard

which is a great book and highly recommended

even if you are not into karate or martial arts.

You have echoed his sketch of punctuated plateaus (p14):

 _The Mastery Curve_

      There's really no way around it. Learning any new skill
      involves relatively brief spurts of progress, each of
      which is followed by a slight decline to a plateau
      somewhat higher in most cases than that which preceded it.

[pdf] [http://index-of.co.uk/Social- Interactions/Mastery%20-%20The%...](http://index-of.co.uk/Social- Interactions/Mastery%20-%20The%20Keys%20To%20Success%20And%20Long- Term%20Fulfillment%20-%20George%20Leonard.pdf)

<comment><USER13> Will definitely check this out thank you

</comment></comment></comment></comment><comment><USER15> Growth cones are only relevant during development and in regenerating neurons which are not common. Everyday neurons do however continuously extend (and contract) filopodia which may reach nearby axon terminals and eventually form a synapse, thus causing synaptic rewiring. Synaptic scaling is usually used to refer to a homeostatic and uniforum up- or down- scaling of synaptic weights and is not really relevant to rewiring.

<comment><USER2> What about hippocampal neurogenesis? Those are spewing out at a nearly constant rate all the time

<comment><USER15> it's still a tiny amount of neurons that are being turned over. About 1.75% of the dentate gyrus is renewed per year.

<comment><USER2> But that's the piano roll that is recording our sense of time!

</comment></comment></comment></comment><comment> greyface- The Neuronal Gene Arc Encodes a Repurposed Retrotransposon Gag Protein that Mediates Intercellular RNA Transfer [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5884693/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5884693/)

</comment><comment><USER16> How do neurons fire less?

</comment><comment><USER17> Memory RNA

</comment><comment><USER18> What if something about the electrical signal attracts growth in certain direction, toward other signals firing at the same time?

Or what if some neuron pairs that are not yet connected share quantum entangled structures, that if activated simultaneously ... but still how does direction occur?

What if neurons emit light, that's why you can stimulate them with light...and what if they can somehow detect the faint light from other neurons and get the direction the light comes from, and grow towards that?

<comment><USER2> You are getting downvoted for speculating on Quantum entanglement, but I think all of your speculations are useful here and to be encouraged.

<comment><USER18> Thank you. so you work in this area? what do you think about the software available for your research? Could it be better or does software not play so much of a role?

<comment><USER2> Yes the software in this area is critical -- and there are major challenges.

<comment><USER18> If it's not too much trouble could you point me to some resources, compilations of relevant software? Maybe I could add some value...

</comment></comment></comment></comment></comment><comment><USER14> Hebbian Learning is just applying the function:

 _enhance transitive closure on a temporal window_

plus the dual negation, whatever that is

under the space-time corollary of De Morgan's Laws:

 _atrophy atemporal uncorrelated direct connection_</comment>