Show HN: Witness – A Web Application Using IPFS and Ethereum - <AUTHOR> https://witnessdb.com <comment><AUTHOR> What's up HackerNews! The last couple of months (as a coding project), we have been working on this web application that leverages Ethereum and IPFS to allow users to create permanent links to files. We wanted to provide an entry level dashboard, where people could really use Ethereum as well as IPFS, so that they could see that it doesn't have to be so difficult to do something useful with it.

How it works: the short version ([https://witnessdb.com/about](https://witnessdb.com/about) for the long version)

So on the webpage, you can upload a file together with your Ethereum address. We will then be storing that file, either until correct payment is made to our Ethereum address or until the expiry date, which is one hour later. When either of the 2 is triggered, the file and all corresponding metadata is deleted, except for the logs we keep for a week, to resolve any errors.

If payment is made, our IPFS node adds the file to IPFS, gets the CID of that file, sends that back to our Ethereum node and the node signs a transaction, with the CID as input data, to send it back to you. This creates a permanent link, and, since we use multiple pinning services beside our own server, almost permanent uptime. If, for example, one of the IPFS nodes falls away, there will be others. And if they all fall away, all one has to do is upload and host the same file on IPFS again, and, since the files are content addressed, the same link, that was included in the Ethereum blockchain, will work again.

If you have any questions, advice, or anything else, feel free to comment or to contact us at firstname.lastname@example.com.

We hope you like it.</comment>


Show HN: Create a Free Job Board Website in Minutes - <AUTHOR> https://jobboardfire.com <comment><AUTHOR> Hey Hackernews,

I spent about 3 months full time building jobboardfire.com and I launched just a couple of days ago.

I honestly didn't feel good about posting on HN since I am not active here, but the response has been so overwhelmingly positive in the community I decided to get over it and make the post :)

The idea is to help makers with a niche audience monetize their efforts without having to find and deal with sponsors. You can create a niche job board in minutes, and you're in full control of your revenue.

I'd love to hear what you guys think!</comment>


Immutable Infrastructure is the future - <AUTHOR> http://michaeldehaan.net/post/118717252307/immutable-infrastructure-is-the-future <comment><USER3> > Ultimately in the end it means more time for everyone to focus on business > logic versus thinking about deployments, so I'm a fan of that.

I find this amusing: our company is migrating to Docker right now, and over in operations I'm spending more and more time thinking about deployments than I've had to since I started doing operations work.

I have to think about "what major functionality has changed in Docker in the last three months, and how does that impact any/all of our images?"

I have to think about creating frequently updated base images, and how to deploy these updated base images across our regions.

I have to think about making the image layers as small as possible, to limit the bandwidth impact of updating images.

I have to think about making as few image layers as possible to avoid DevMapper IO overhead.

I have to think about externally mapped volumes to keep necessary IO as fast as possible.

I have to think about asymmetric TCP, docker vs host network interfaces, natting, and service discovery.

I have to think about private registries, token based authentication systems, and redundancy.

My developers have been able to focus on business logic since they hired an ops team. Will the amount of thinking go down over time? Some of it: the bits which can be automated fade to the back (at least until the core Docker functionality changes yet again), but there are bits and pieces will necessarily change with every deploy.

<comment><USER4> The difference is the pain you are experiencing with Docker is potentially transient, whereas the problems with configuration management on the wild internet are intractable, and even unquantifiable. With Docker the scope of changes you have to deal with is at least knowable.

I say "potentially" because I think the jury is still out whether Docker can live up to its promise. Clearly it has a real purpose and value add above traditional configuration management, but the churn is an indication of how hard a problem it is. Plus, even in an ideal case, you still have to deal with security updates and other inevitable version updates and things that invalidate your current images.

<comment><USER5> The big problem is that docker/container image creation is now buried deep inside an app's build system. This means that your build system is now a critical part of your infrastructure.

<comment><USER6> Isn't that the case with any continuous deployment pipeline?

Best to use the CD system to do the deploy, and avoid "hold my beer, I've got to emergency deploy this via SSH" which is high risk for minimal gain.

<comment><USER5> No I don't mean pushing patches to your App, I mean critical system libraries.

Because they are baked into the container, to do critical patches you need to rebake the image.

The Docker bit will be mostly painless, unless you've don't something stupid, however the bits around the app can and will changes.

The amount of times I've tried to use a build job from 3-6months ago and it fails horrifically is far too often.

</comment></comment></comment></comment></comment><comment><AUTHOR> A couple relevant snippets:

      Caveat - I think images must come from a build system.
      Using anybody's canned images as a baseline is reckless.

      Config tools still have a place - in building the automated
      systems that allow folks to focus on business logic, but I
      think there are going to move down-stack to doing things
      like automating OpenStack.  The longer term future is about
      cloud/virt systems like this provisioning themselves, but
      they are still yet a bit too complicated in the way they are
      going about it, but I feel it's coming.

(The post's author, Michael DeHaan, wrote Ansible in 2012, but left the project earlier this year to pursue other interests.)

My thoughts on the subject are much the same—but I think it'll take a few years for the tooling to reach the level of polish we currently have with best-of-breed CM and general provisioning tools. It's not as easy to go from 0-to-infrastructure with a Docker-based workflow (especially if you have your own registry, etc.) as opposed to a VM-plus-CM-based workflow.

<comment><USER7> author here.

"but left the project earlier this year to pursue other interests" \- Hi Jeff! I haven't really shared reasons for leaving the company to date and can't go into that.

I also don't think it will take years and think immutable is there today.

I think we're there today with a bit of skill and minor bit of work on top, but a little bit of work from cloud/virt solutions will push us over the hump - to be able to codify the upgrade-flip idiomatically within cloud/virt systems, so you don't need something else to do it for you. I do look forward to that being surfaced.

Things like Amazon's ECS in particular strike me as particularly interesting.

<comment><AUTHOR> > I think we're there today with a bit of skill and minor bit of work on top, > but a little bit of work from cloud/virt solutions will push us over the > hump.

I think that's true, but my timeline is based on how long I see it taking 'mainstream' enterprise companies to adopt immutable infra—for many of the orgs I've worked with, they've only recently completed a sea change from dedicated servers to virtualized 'cloud' deployments.

So it really depends on who you're working with; many businesses are making the move today, but cautiously. Once the early adopters complete rolling things out to production and working out the kinks, we'll finally get to the late majority/stability, and I won't have to commiserate with the thousands of sysadmins stuck with dozens, hundreds, or thousands of VMs :)

</comment></comment></comment><comment><USER5> I quite like immutable infrastructure. It means you have a rollout/roll back with a flip of a dns/connection.

However I see a lot of things about docker and think two things:

1) most people really wany a mainframe 2) shared filesystems really are brlilliant.

Let me unpack that:

a mainframe provides a massive amount of hardware, a hypervisor and scheduler. This means that you can control a bunch of isolated processes through one one system easily. Something that you can't really do in docker yet (fleet/kubernetes arn't there yet. in a mainframe you can use a single script to control an entire system)

Quite a lot of web config management is about shipping packages to different machines. Almost all of this config, and therefore complication can be removed by using a shared filesystem.

For example we have many version of java. For some reason they are in seperate repos. This means that if you want to change version (openJDK to oracle etc) you have to change config. With a shared file system, in the $PATH, you'd just say _oracalejava-1.8 $programme_ or _java-1.7 $programme_

If you make your deploys to a similar shared filesystem, then to change config is basically a case of ssh machine, kill old process, launche new process. Job done.

This makes each machine a dumb execution system, minimal state is contained in each node.

With NFS coming to AWS, that'll be the model for my new infrastructure. the reason why? because it works. In HPC thats how we've been managing high scale workloads for years.

</comment><comment><USER8> I'd like to see a polished common configuration API.

Currently, we have Chef, Puppet, Ansible, and Salt (amongst others) all working to create a sane common abstraction on top of a rainbow of configuration files and command-line arguments.

Each of them have their strengths, and frankly they're all impressive in their own right. But there's only so much you can do to reign in the chaos of the bazaar.

The Docker workflow certainly has its merits. It's great for narrowing dev- prod parity and repeatability. I've embraced it, but I'm a bit anxious that we, as a community, might end up creating bigger black boxes -- Dockerfiles upon Dockerfiles.

<comment><USER7> Hmm, I think your boxes can be still pretty transparent in that case - <USER2> anything more so, as you've got single-bash files versus perhaps directories and directories of content?

In most organizations, all those Dockerfiles should be yours, and in source control.

Relying on the blobs from others shouldn't be neccessary for most applications. Yes - in large organizations, a management problem probably does arise, but I think if you find copy/paste rising up you have to push that down into the base image, basically?

I don't think a configuration API helps to be honest - what you would do is turn them all into a "greatest common divisor" type scenario, where as they feel different because they were trying to be different.

I think you're best solved by organizationally mandating one of them within your company, as painful as that may be.

</comment></comment><comment><USER9> > While PaaS has not become a reality for everyone...

A telling aside. Much of what he wants already exists in Google App Engine (and probably in Elastic Beanstalk, too, but I haven't tried it) — sans the need to manage the underlying OS.

Interesting Google is going the other way with Managed VMs running on top of Kubernetes. Perhaps they will meet in the middle somewhere?

<comment><USER10> I thought Google was running containers in kubernetes? AFAIK you can install Kubs on VMs

<comment><USER11> "Managed VMs" is a service offering within Google App Engine that lets you use any runtime (e.g., Python, Node.js, Go, C) but get the benefits of the GAE PaaS auto-scaling, versioning, etc.

It actually works by shipping a docker container to the Google Container Registry (privately scoped to your project), spinning up a "VM" that shows up in your Compute Engine instances list that you can then SSH into if you want (this is why you're both right; they call it Managed VMs, it shows up in your GCE instance list, but they literally are, I think, running your docker container, probably with Kubernetes under the hood).

<comment><USER9> This is exactly what's happening as I've seen it.

</comment></comment></comment></comment><comment><USER12> For those looking into this topic only now we interviewed 6 people who have been doing this for some time, collected their answers and published them + did a hangout with them here: [https://highops.com/insights/immutable- infrastructure-6-ques...](https://highops.com/insights/immutable- infrastructure-6-questions-6-experts/) (pure content, no sales pitch anywhere)

</comment><comment><USER13> Very interested in this subject. Is there a comprehensive guide on how I can pull this off TODAY with e.g. AWS?

<comment><USER14> It's only one piece of the puzzle, but at my last company I wrote deploy_thing[1] for exactly this. An immutable config bundle and an immutable artifact tag combine to create a deploy that can be launched and put into production with an AWS auto-scaling group. Need to change a configuration, you burn down the auto-scaling group. This was a transitional step for us before moving to Mesos, but it's a good example, I think, of how to approach the problem from a minimum-viable level.

(I'm currently playing with moving it to OpenStack.)

[1] [https://github.com/eropple/deploy_thing](https://github.com/eropple/deploy_thing)

<comment><USER15> The URL is throwing 404, probably due to it being private.

Would love to see it. I am working on something similar.

<comment><USER16> It looks like it was supposed to a hyphen, not an underscore:

[https://github.com/eropple/deploy-thing](https://github.com/eropple/deploy- thing)

<comment><USER14> Whoops, yeah. My bad, I switched from an underscore to a hyphen halfway through the project. It's still inconsistent, because we had a case of company-going-unders and I haven't needed it since.

</comment></comment></comment></comment></comment><comment><USER17> Stateless servers with kubernetes seem like a great thing to do this sort of thing with.

<comment><USER9> Why go that low, though? Why not go with Managed VMs first?

<comment><USER17> Kubernetes gives you freedom about where to run your stuff since it works on multiple providers and your own hardware. Once you learn how to set it up, it isn't too bad.

Google managed kubernetes cluster gives you the best of both worlds anyway.

<comment><USER5> A decent VM system will give you HA and load balancing (ie migrating VMs from overloaded hosts) for free.

Something docker/kubernetes still can't do.

Its also worth bearing in mind that the "vm penalty" is almost trivially small compared to the cost of dev time.

<comment><USER18> > […] (ie migrating VMs from overloaded hosts) for free. > Something > docker/kubernetes still can't do.

This doesn't solve issues arising from the VM outright crashing though, does it? (I don't see how it could.) At the end of the day, I still need to solve that myself, and if my application can gracefully withstand being crashed, then docker/kubernetes _can_ migrate from overloaded hosts: just crash container.

I could probably also throw in something to gracefully die on a SIGTERM, but I feel like once you can withstand a crash, throwing in a SIGTERM is fairly straightforward. The only difference is that one trains traffic, the other just outright 500s it. (Though, perhaps there's more work involved there than I realize.)

Ultimately, I want crash resistance. I want to run Chaos Monkey. I can't, right now, because I know all too well what would happen.

<comment><USER5> In HA mode, you specify that this VM must be running. If its not do a list of certain actions.

But the thing is, making your app crash gracefully can be incredibly hard, and can almost always take a lot of dev time.

its cheaper in terms of planning and execution to have two have an HA pair defined in the cluster, and another HA pair defined in software (i.e. behind a varnish node or the like)

You can have virtual IPs so that if a node is not responding the HA partner picks up the traffic. If thats properly locked up, the hypervisor can kill the machine and restart it.

as for: >migrate from overloaded hosts: just crash container.

try doing that with a clustered something, the host becomes overloaded, kills the app. not only does the traffic shift off to other nodes(which might already be started to overload), it takes resources to sync back into the cluster.

You don't want this behaviour as it causes failure hysteresis. (that is, as soon as you start to reach breaking point, the whole thing collapses and refuses to come back up, without stopping incoming traffic)

</comment></comment></comment></comment></comment></comment><comment><USER19> Yes, I agree, but the issue is still how do you build that infrastructure (be it an AMI, a docker image etc..)?

Docker file sare simplistic, so you end up using the same tools that were available before (ansible, salt, bash etc...).

What we're doing right now is move what we used to do at "configuration time" to "build time".

<comment><USER7> My point was you don't need to use the tools you use today, _except_ to do the version flip (and probably to deploy the subtrate - unless you are doing a cloud-image solution and not trying to do something on-premise). And this will get better when cloud providers embrace higher level cluster operations more natively.

And build time is the way to go for everything you can push down into build time. There still may be some need for service-discovery type applications.

<comment><USER19> Agreed, moving more and more stuff to the build, lighting up an image should be nearly instant, so we can do auto-scala etc... so no more "pip install -r" when bringing up an image, that's now part of the build.

But the landscape for tools to build that image, be it a docker image or an AMI, right now, is the same. I find myself "going back" to ansible but now using it to build images rather than change online VMs (could be any tool, I know ansible and it suits my way of thinking).

</comment></comment></comment><comment><USER20> So by immutable he means... systems you don't patch? That's it?

</comment><comment><USER21> Wrong! It's the present!</comment>


India's Call-Center Talents Put to a Criminal Use: Swindling Americans - <AUTHOR> http://www.nytimes.com/2017/01/03/world/asia/india-call-centers-fraud-americans.html?ref=technology <comment><USER2> For many of us it can be hard to imagine what kind of gullible dweebs go for this. The other week I was quite surprised to learn from family that my father had given money to one of these scams (the "you have computer virus" variation). This is the man who brought our first personal computer home in the early 80s, got me set up with BASIC, still keeps his Fortran code around, i.e. not technically illiterate by any means. But you know what? He's in his 80s, and though he doesn't show any signs of dementia/senility/Alzheimer's, he just doesn't have the energy and interest to keep up with all this stuff anymore, and at his age he's used to getting a lot of _legitimate_ calls from strangers working at doctors' offices, benefits agencies etc. The same man who taught me to be overly paranoid about anything a stranger asks of you now doesn't have the willpower to see through these scams - why yes, his 7-year- old malware-riddled Windows PC sure does seem like it could have a virus, and this seems like oh just a business trying to profit by cleaning your computer for you, and if they can manage it where all these anti-virus companies have failed him then great! We're really in an era where extracting money from old people has never been easier.

<comment><USER3> My dad is technically illiterate but all he needs is a web browser so I got him a Chromebook. It is more than enough for most people and if Google can keep it malware free it is a big accomplishment.

</comment></comment><comment><USER4> "If they reached a person who was sufficiently terrified or gullible — this was known in the business as a "sale" — they would instruct that person to buy thousands of dollars' worth of iTunes cards to avoid prosecution, they said…"

Fascinating story but how is it that people believe their government accepts payments in iTunes gift cards?

The money transfers also referenced in the article sound a little more legitimate (though still not sounding kosher) but is there some reason to believe that a US government agency would ever ask for payment in anything other than dollars?

<comment><USER5> That was my first thought. That said, it sounds like they may be targeting first generation immigrants, and their successes come when they get through to someone who's not very familiar with US norms, and perhaps rather more familiar with the concept that problems sometimes go away after making illegitimate payments in unconventional ways to officials.

My second thought was to wonder how purchases and redemptions of thousands of dollars worth of iTunes gift cards managed not to be flagged up by Apple, bearing in my there's certainly enough money flowing through their systems for law enforcement to be very interested in monitoring their compliance with KYC/AML regulations?

<comment><USER6> They're probably just reselling the cards. No need for anyone to buy digital assets from Apple.

<comment><USER7> eventually someone needs to buy digital assets from apple for the cards to be worth anything

<comment><USER8> Not if a large enough group of people is willing to accept iTunes gift cards as payment.

As long as they are a token that is sufficiently expensive to get hold of, I don't see why an economy can't work even if nobody ever spends them with Apple. It'd be like an economy based on gold coins in which nobody ever melts the coins down for their value as raw gold.

<comment><USER5> My understanding is that the real bottleneck is that if you want to buy iTunes gift cards in large denominations you have to go to Apple or a reputable retailer and specifically ask the vendor to put up to $500 on the card and charge it to you. If you're doing that several times in a row to it probably ought to raise a flag with Apple, the vendor or possibly your bank.

Relative to cash or gold, the token also has the not insignificant problem that it's time limited and can be secretly spent or voided, which should result in the card being substantially discounted (and checked for validity with Apple) each time it changes hands. It's also officially "not for resale"...

</comment></comment></comment></comment></comment></comment><comment><USER9> Off-topic: I've noticed in the past few years that many call center workers have a new, distinct sort of accent and cadence. I don't think this is just a change in the language demographics of the workers because (1) I can still usually distinguish Indian speakers, although I could be wrong, and (2) it's really a different shared cadence rather than just different sounds.

Has there been any systematic change in how the language training for call center workers is done?

</comment><comment><USER10> It's unfortunate that such a scheme exists, which pollutes the youth of the nation. I too received several calls from an "unknown" number trying to extort money by having me install some anti-virus software to fix a non-existent computer issue.

</comment><comment><USER11> I'd really love to have a uBlock Origin/AdBlock type of program to maintain my phone's calling number blacklist.

eg: If more than X Android users block a number it should block automatically for everyone.

Guessing the blacklist must not be accessible via the Android/iOS APIs or this would already exist.

<comment><USER12> This kind of scam, though, works just fine if they change their phone number every day, hour, or minute...and with VOIP, there's little added cost or complexity to do so.

There really needs to be something for phone numbers similar to rfc2827 for ip spoofing. Or, better still, a reliable way to map a phone number to a legal entity.

</comment></comment><comment><USER13> Normally I tell these guys I'm with the National Terrorist Tracking Center and we've determined they are a terrorist, etc. The last time I decided to change it up a bit and went with, "What are you wearing?" etc. On speakerphone. With my wife listening. Well, wife now. We were in the parking lot of her hair salon having her hair done for our wedding. We have a similar sense of humor. You'd think by now I'd be on _their_ do-not-call list.

<comment><USER14> I've listened to enough of these calls on youtube to realize most of these scammers think they're untouchable (and surely have been for several years) so unfortunately I doubt telling them you're from a terrorist tracking center will have any impact :)

While not an Indian scam, I was getting tons of calls for the vacation package scam for months from random phone numbers. If you're not familiar with it, they basically say "You've one of the following: A brand new SUV, and HD TV, or a vacation package! Just come to our office to find out what you won". I'm sure it's blatantly obvious to HN readers that you haven't won any prize and instead they'll try to sell you on the vacation package, but this one bothered me because it fooled my parents. I did eventually get them to stop calling me, but the contents of those calls aren't exactly HN worthy :/

</comment></comment><comment><USER15> Anyone who gets a lot of this crap in your phone, I recommend TrueCaller. Been a lifesaver, gets probably 19/20 of the scam and spam calls (at least for me, YMMV).

I got one of these WAY back in the day from some doofus saying he was from the FBI and he was outside my house. Yeah...no cars out there for 2 miles in any direction, told him he was a bloody idiot and hung up. He actually called back and tried to get me going again! Gotta give him points for determination.

</comment><comment><USER16> The call center might be indian, but the guy making most of the money is always an American. The people making these calls are reading of a script and entering data into a database. This script and the numbers are provided by an American client - and some of that is legal outbound marketing also. Looking at the script, it is non trivial for any agent to know whether it is legal or not.

</comment><comment><USER17> More high paying American jobs going overseas :(

In a serious note; I'm from a country where reputation is king and a handshake seals a deal so I was not used to the shadyness I experienced living in the US. Homeless people with made up stories, used car salesmen hiding serious flaw in their cars, hidden charges and fees on services, optional insurance that isn't optional, worthless employee stock options, bank accounts secretly opened with forced overdrafts, online universities, kickstarter, financial services, HMOs, Haitian charities, lobbyists, housing bubble, tech bubble etc. etc. The point is that the US has plenty of home grown 'scams' and the only thing happening here is that otherwise marginal scams are profitable enough for Indias. It's like worrying about losing $100 to muggers on a street while your pension is being eaten up by fees.

I'm not saying don't worry about the small stuff, what I am saying is that, to me, I see the US as the mecha of frauds.

<comment><USER18> >I see the US as the mecha of frauds

Oh god, I'm imagining a fraud-based Gundam now, thanks.

FYI, you want 'Mecca' in this context. A 'mecha' is typically a reference to giant robots, etc. [https://en.wikipedia.org/wiki/Mecha](https://en.wikipedia.org/wiki/Mecha)

</comment></comment><comment><USER19> Although not a scam like this, my parents were tricked into buying an "antivirus" product from a phone call from India. The whole thing was a little bizarre as it wasn't an outright scam. I never got to see the program in working order but I believe it was an actual attempt at creating a real AV product, although probably bundled with spy/malware. By the time they asked me for help their laptop running Windows Vista was riddled startup errors, most referring to non-existing registry entries. My only guess is that the "company" or whatever it was hit some sort of kill switch, leaving their software in a broken state. It took me a while to clean everything up. In the end I think my parents spent a few hundred dollars on the product and nothing suspicious ever happened with their bank account.

</comment><comment><USER20> Relatedly, anyone know how/why the Do Not Call Registry has become totally useless? I get probably 10+ spam calls a week now, often for business loans and such (I don't own a business). It's made phone calls the worst way (most likely to be ignored for a long time, or missed entirely) to get in touch with me.

Just confirmed, my number's on it and has been since '04\. I get about as many junk calls as I did pre-registry now, though it worked really well for the first ~8 years.

<comment><USER21> Cheap, unregulated IP telephony and disposable phone numbers have made it easy to spam phones, unfortunately.

<comment><USER12> Plus the ability to spoof caller ID with almost no chance of being caught.

</comment></comment></comment><comment><USER22> You should be able to forbid incoming calls from certain countries on your line. Or international calls at all.

This would be very useful for grandparents. Why isn't this a thing yet?

<comment><USER23> because VOIP will get around that.

<comment><USER24> Yes, but it will increase the cost to the scammers and filter out the ones that can't figure it out.

Possibly have a reroute rather than a block so it's harder to detect. Reroute the calls to a voice mailbox that essentially saves to /dev/null.

<comment><USER22> Can you reroute to a pay service? So every time they call you they get dinged?

</comment></comment></comment></comment><comment><USER25> It is surprising US gov does not take this seriously and has not worked with Indian govt to stop these fraudulent organizations. The main players in the scam from Ahmedabad has not been caught as per the report. Also I am happy and slightly worried that the 2 boys who informed trade commission has come out in the open. It is better to be anonymous when you report such things especially if you are in India.

</comment><comment><USER26> In this podcast the host records a call with one of these IRS scams.

[http://tomwoods.com/ep-729-the-real-story-of-the-epipen- fias...](http://tomwoods.com/ep-729-the-real-story-of-the-epipen-fiasco-plus- tom-takes-on-scammers-over-the-phone/)

Starts at 11:58. It's quite entertaining.

</comment><comment><USER27> You can safely replace Americans with 'citizens of any non 3rd world country'.

<comment><USER28> Nope, it's mostly people in the US that fear their governments like that.

I don't see anyone from Finland, Iceland, or Holand falling for this sort of thing (language barriers aside), because they don't run around scared of the government.

<comment><USER29> It seems scammers are targeting first generation immigrants to US more than anyone else. Now - as a immigrant myself I can imagine how traumatic it can be to get call from IRS when you don't know your way around tax system.

Obviously - people on HN are an exception but often times - life of an immigrant hangs by a thread - "there is an EAD renewal coming up in Feb if it doesn't get approved (for some reason), you lose your job, lose your home, may even have to go back to your home country".

</comment></comment></comment><comment><USER30> Indian version of the Nigerian 419.

<comment><USER31> What's the India's governments postion on this?

<comment><USER32> I don't think a govt would have any position on this. The law enforcement agencies are actively working on tracking and finding out these people which is how this came into limelight.</comment></comment></comment>


Security is Mathematics - <AUTHOR> http://www.daemonology.net/blog/2008-03.html <comment><USER2> The best security researchers in the world are almost uniformly not trained in mathematics. Here's a short list of top-tier researchers. Spot the mathematicians!

* Mark Dowd

* John McDonald

* Alex Sotirov

* Dino Dai Zovi

* Charlie Miller

* Michal Zalewski

* Aaron Portnoy

* Dave Aitel

* David Litchfield

* Barnaby Jack

This doesn't invalidate the blog post, but I will go on to suggest that quite a lot of people with extensive formal training in mathematics either (a) have/had careers in software security with less spectacular results than e.g. Aaron or Michal or (b) have produced, despite incentive to the contrary, some really crappy code.

<comment><USER3> Leaving off the top cryptographers from a list of security researchers seems a bit disingenuous. However, including cryptographers might make Colin's argument trivially obvious, since so many of the top crypographers come from mathematics backgrounds. Therefore, I'll just add Rolf Rolles to your list, and note that he does come from a mathematics background.

<comment><USER2> Neither Colin nor Schneier was talking about cryptography. Cryptography and security are not the same thing.

Rolf Rolles is a very smart guy, but he's not a security researcher; he works in content protection and reverse engineering. Having said that: sure. That's one. One. :)

</comment></comment></comment><comment><USER4> Computer security is a social science, so degrees in ethnography, epistemology, or organizational behavior are a lot more relevant than mathematics. Agreed that math teaches you rigorous thinking and questioning assumptions, but outside of the narrow areas of cryptography and systems analysis the specific skills you learn aren't that important for security work.

<comment><USER5> Right. I don't think thorough economic analyses come into play nearly enough when people think about security.

<comment><USER4> Also an excellent point. Ross Anderson started pushing the term "Security Engineering" around 2000 and economics were a big part of it.

<comment><USER6> Can you elaborate on the economics involved, please? Sounds interesting.

<comment><USER7> Economics is about the study of choice, at a deep level: the study of choice under conditions of scarcity, or with constraints (a definition like that is in most introductory textbooks). It's almost like psychology applied to crowds of interacting agents.

(Some people seem to get the idea economics is like accounting but vaguer, like a climatologist is to a weatherman or something. Macro economics is the bit that gets in the media most often, but it's also the most ideology-based rather than fact-based.)

<comment><USER5> One example: The universal truth of "DRM Doesn't Work" actually simply means "DRM isn't strong enough to for big companies to stand up to the ravenous appetites of everyone on the entire internet."

This is why big companies with content everyone craves have such a hard time with DRM -- there's just too much firepower arrayed against them. If you look closer, you find that "DRM Doesn't Work" isn't quite true. It's just not as strong as Phillips or Sony would like it to be.

</comment></comment></comment></comment></comment></comment><comment><USER8> _Knuth is famous for the remark "Beware of bugs in the above code; I have only proved it correct, not tried it", and the implicit statement that a proof-of- correctness is not adequate to ensure that code will operate correctly is one I absolutely agree with_

My boss told me a similar story of a computer science professor giving a cross-group talk in which he pitched the concept of formal methods to a group of physicists who, among other things, programmed collectors for particle experiments. (Supposedly this happened at Cornell in the seventies.) The CS professor enthusiastically and animatedly proved the correctness of an algorithm for solving a simple graph-coloring game and then asked whether there were any questions. One of the physicists raised his hand and asked, "How fast does it run?"

"That's the beauty of formal methods! Now that I've proved the algorithm correct, I already know it will produce the right answer. There are far too many possible inputs to verify correctness via testing, so there's actually no point in running it at all."

<comment><USER9> You can see that computer science is an applied science. A mathematics professor would have given a proof that such an algorithm exists or, more likely, that algorithms exist for solving several more general problems, and left it at that.

<comment><USER10> And unless you were especially lucky, the existence proof would be non- constructive.

<comment><USER11> I still hope, that somebody finds a non-constructive proof for P=NP.

</comment></comment></comment></comment><comment><USER12> Where the author's narrative breaks down is when he draws a parallel between security and _proofs of theorems_. The closer connection is between security and _adequacy_ of theorems.

It is true that you need to make sure your software conforms to its specifications and that process does involve informal (or formal) proof-like reasoning, but that is only a small part of the challenge. _This_ is the part that mathematicians would be good at, but other technologies are good at the this as well (type checkers prove weak properties, verification tools prove stronger ones). None of this requires a "twisted mind", just attention to detail.

The problem of writing software specifications that correspond to the _abstract notion of security_ is the tougher task. In math, the closest analogy is figuring out what theorems people actually care about. While I don't know for sure, I'm skeptical that a math education emphasizes this skill. Security takes this skill a step further and requires Schneier's "twisted mind" to consider all the real-world ways that things could go wrong (including, among other things, the incentives that might motivate an adversary) and write specifications for secure, but useful, software.

<comment><USER13> Obviously I can't speak for Colin Percival, but I think that the point of the article is quite a bit simpler:

I read this as saying that the _mindset_ required to write proofs is similar to the _mindset_ required to write secure software. The proof mindset is useful for considering "all the real-world ways that things could go wrong."

I think the paragraphs about Knuth's famous quote just muddy the water.

<comment><USER14> _the mindset required to write proofs is similar to the mindset required to write secure software_

Bingo.

<comment><USER12> My point wasn't intended to be as low-level as it came across. Perhaps a more clear restatement is that I suspect that the attention to detail that I associate with the "proof mindset" isn't quite the same thing as the "twisted mind" that Bruce Schneier talks about; so I'm not convinced mathematicians are more likely to have that skill.

</comment></comment></comment></comment><comment><USER15> Forget security, _programming_ is mathematics. If you program, you should be doing this whether you're writing security code or not. Nothing saves me more keystrokes or debugging time than proving things about my algorithm before I code it, and I know this comes from math because my CS-only friends _can't do it_. I don't care if you want to go in to algorithm theory or get a software job at a bank, if you're a CS major, you need to take some rigorous math or you'll be at a disadvantage.

<comment><USER11> You can even prove that. It's called the Curry–Howard isomorphism ([http://en.wikipedia.org/wiki/Curry%E2%80%93Howard_isomorphis...](http://en.wikipedia.org/wiki/Curry%E2%80%93Howard_isomorphism)). Guess who has a the highest bid on ads for `curry howard isomorphism' on Google?

</comment></comment><comment><USER16> I am not sure that I buy this. There are plenty of people who have internalized a painstaking and rigorous approach to problem solving, often from a young age. While many of these are also those who would excel in a mathematical environment, a mathematical education fails to capture any of the specific details of security.

<comment><USER17> I don't think he is trying to say mathematics is sufficient to be good at security, just that training in mathematics develops the right mindset for security.

I have a degree in math and can see how my attitude changed as I progressed. When taking my first analysis class I was sure it is no coincidence the word begins with anal. It took a while for me to develop habits of skepticism about things that seem obvious at first glance. That's the attitude I think he is describing.

<comment><USER14> _When taking my first analysis class I was sure it is no coincidence the word begins with anal._

I'm going to steal that line, if you don't mind. :-)

 _It took a while for me to develop habits of skepticism about things that seem obvious at first glance. That's the attitude I think he is describing._

Yes. The attitude of "I don't care if this _looks_ right; am I absolutely certain that it _is_ right, in all possible universes consistent with my axioms".

</comment></comment></comment><comment><USER18> This article is correct, except it omits one important point... writing programs is harder than writing a proof. Especially security code. With sufficiently complex proofs it is often hard to find holes in the proof, but with security code (and code in general) there are ways to attack it, that just isn't doable with standard math proofs. There's no notion of "fuzzing" with proofs.

But in any case, the gist of the article is correct -- the rigor used in math proofs is the MIN bar for security code.

<comment><USER16> >writing programs is harder than writing a proof

Which programs and which proofs?

<comment><USER18> Any program function can be cast as a theorem (although vice-verse is difficult). Proving this theorem is easier than writing the corresponding program function.

And by easier, I mean that the proof is easier to pass off as a correct proof than the program is to pass as a correct program. Of course, writing an actually correct proof is just as difficult as writing an actually correct program -- for the most part. Of course sometimes, due to real world constraints in programs (like dealing with fault tolerance or races for perf) correctness in programs can become magnitudes more difficult.

<comment><USER4> I agree in the abstract, but ...

\- what's the largest program you've written? \- what's the largest program you've proved correctness of?

So in reality, meaningful proofs are much much much harder than writing programs.

<comment><USER18> _what's the largest program you've proved correctness of?_

But that's the point. With security code, while you may not prove the correctness of it, there's a black hat that's trying to find a counterexample to your "proof".

Whereas for 99% of proofs that are published in the literature no one is trying to prove that there are flaws in the proof. As someone who reviewed CS papers I would always try to really read at least one proof in the paper. Not skim, but really scrutinize it. Probably 75% of the time I could find a problem with the proof. Usually one that was easily corrected, but it was still wrong. But it took substantial effort to do this (which is why I only did one per paper and just read the other proofs).

Some recommended reading: <http://www1.cs.columbia.edu/~angelos/Misc/p271-de_millo.pdf> [http://research.microsoft.com/en- us/um/people/lamport/pubs/l...](http://research.microsoft.com/en- us/um/people/lamport/pubs/lamport-how-to-write.pdf)

</comment></comment></comment></comment></comment><comment><USER19> But isn't this ignoring a holistic view of security and the fact that many flaws comes down to human errors, not only in code, but in procedures and organisations. It seems to me that by saying: security is math, there is a risk of ignoring that part of the problem.

</comment><comment><USER20> Or more generally, everything is mathematics.</comment>


Network Analysis Reveals 'Super Entity' of Global Corporate Control - <AUTHOR> http://planetsave.com/2011/08/28/who-runs-the-world-network-analysis-reveals-super-entity-of-global-corporate-control/

<comment><USER2> Stunning revelation: banks do business with everyone.

Next up: rain is wet.

<comment><USER3> The report goes well beyond who does business with whom; it traces the lines of control among transnational corporations (TNCs). FTA:

 _"despite its small size, the core holds collectively a large fraction of the total network control. In detail, nearly 4/10 of the control over the economic value of TNCs in the world is held, via a complicated web of ownership relations, by a group of 147 TNCs in the core, which has almost full control over itself. The top holders within the core can thus be thought of as an economic "super-entity" in the global network of corporations."_

It would be interesting to see a followup on the individuals who sit on the boards of the 147 TNCs. It's likely to be a pretty exclusive club, since directors often sit on the boards of more than one corporation, further consolidating the decision-making authority and creating a potentially catastrophic single point of failure in the world's financial systems. We should consider restricting directors from serving on more than one board, to decentralize authority and create a more robust and diverse system of corporate governance.

<comment><USER3> Not all of the companies are banks, but even if they were, it is nonetheless a shocking degree of centralized control. It isn't just that these companies have large stakes in other companies, but that _they all have large stakes in each other_. Consequently, there is a lack of effective oversight by independent shareholders, not to mention the obvious opportunity and incentives for anti-competitive collusion. And the study wasn't conducted by wild-eyed conspiracy theorists, but by a group of Swiss economists. For a more scientific take on the study, see [http://www.sciencenews.org/view/generic/id/333389/title/Fina...](http://www.sciencenews.org/view/generic/id/333389/title/Financial_world_dominated_by_a_few_deep_pockets) .</comment></comment></comment>


AMD's Zen goes mainstream with Ryzen 5: 4cores,8threads,from$169 - <AUTHOR> https://arstechnica.com/gadgets/2017/03/amds-zen-goes-mainstream-with-ryzen-5-4-cores-8-threads-from-169/ <comment><USER2> So if they build their 6 core CPUs by disabling a core in each of the 4 core CPUs, is this something people might be able to reverse engineer to enable the disabled cores ?

Or would they physically disconnect the core on a hardware level ?</comment>


Google's Voice Search Finally Hits The iPhone  - <AUTHOR> http://www.techcrunch.com/2008/11/17/googles-voice-search-finally-hits-the-iphone/ <comment><AUTHOR> Downloaded and tried it out... you know what? It works nearly perfectly (90%?) for traditional searches... terrible for names.

Really wish it worked with address book!</comment>


Spawn of Groupon: Coming soon ... a lot of them - <AUTHOR> http://www.slate.com/id/2280963/pagenum/all

<comment><USER2> The business of Groupon (local deals) lends itself particulary well for copycating: target a city (or a country) where Groupon is not present (or expected to come soon), do everything that worked for Groupon, and learn from their mistakes (if any).

In Croatia we've got several Groupon copies (incl. copycats of copycats :-) The main one (Kolektiva) is doing rather well and expanding into the region already.

This is opposed to other global successes that simply make no sense copying or adapting for local market, such as Facebook, Twitter, Flickr or YouTube (we've had our share of those, too).

Would Groupon's eventual entrance to this region demolish the local copycats? Once they're a known local brand, not neccessarily.

OTOH, copying in the same market Groupon are already in and doing well (what article talks about) doesn't make much business sense to me.</comment>


How can you learn a word without knowing the words within its definition? - <AUTHOR> When I lookup the definition of a word, there is often a word in the definition that I don't know. This forces me to either navigate away from the definition that I'm currently looking at or open up a new tab in my web browser. This is a very minor problem. But it is well defined and it bothers me. I decided to make my best effort to solve this problem by making my own online dictionary that automatically provides the definitions for words within the definition.
See here:
http://treegle.xyz/define.php?w=querulous
http://treegle.xyz/define.php?w=consummation
http://treegle.xyz/define.php?w=incorporeality
http://treegle.xyz/define.php?w=tetrabranchiata
http://treegle.xyz/define.php?w=endoderm <comment><USER4> This is a great idea, and I love how you implemented it so that a definition can be broken down into its component words' definitions (and so on..) - <USER2> that I can study the whole tree of meanings in one view. It makes sense visually and mentally.

As a funny aside, the few times that I tried to follow all the way down - <USER3> a child asking "why?" repeatedly, asking for the meaning of every word and its definitions - I ended up at the word "being".

<comment><AUTHOR> Thank you so much for the kind comment! I really appreciate it. Yes, it is fun to just keep clicking and see where it goes.

I actually did some ranking to measure the connectivity of words in the dictionary that I used. I made this little word cloud to show off the most highly connective non-trivial words: [https://imgur.com/iqJ1Iwb](https://imgur.com/iqJ1Iwb)

<comment><USER4> Fascinating.. Looking at the visualization of "highly connective words", my mind automatically tried to find some pattern or sense in those particular words - why are they the most connective? Does it mean that there are the most number of definitions that contain (and are related to) these words? I wonder if that signifies something about the "culture" of the English language, what people most often think/talk about when using it (edit: cats apparently! :).

As a side note, something that struck me when I first visited treegle.xyz, was that the definition of "quarrel" included the word "etc." in it:

 _quarrel - a small opening in window tracery, of which the cusps, etc., make the form nearly square_

The use of this "etc." bugs me for some reason: it seems to assume that the reader knows how a window tracery is built, and the word adds no value to the definition - and makes me wonder what components other than "cusps" they meant.

Anyway, wonderful experiment (and project name too).

<comment><AUTHOR> Thank you again! I really appreciate all of your thoughtful feedback.

Yeah, one way of measuring connectivity is counting how many definitions that a word appears in. Also, yeah, sometimes there are text artifacts in definitions and words, phrases, or abbreviations that don't add any value to the definition.

From research that I've done, this happens in online dictionaries (not often, but occasionally). I've done a lot of work to clean up the definitions in my dictionary and provide the top ranking definitions first, but some artifacts still slip through the cracks.

I really appreciate all of your great feedback and welcome any comments or discussion anytime! :)

</comment></comment></comment></comment><comment><USER5> Wordo allows users to click every word in the definition, try it here: [https://wordo.co/querulous](https://wordo.co/querulous)

<comment><AUTHOR> Cool!! Thank you very much for sharing!! I actually never heard of Wordo until now. Do you work with Wordo? If so, wanta collaborate? :)

<comment><USER5> Yes I helped create Wordo. I am nerdy about words and definitions. I contribute to Wiktionary.

I'd like to collaborate, not sure how but lets get in touch!! Add me on FB or Twitter: [https://facebook.com/eftegarie](https://facebook.com/eftegarie) [https://twitter.com/aminozuur](https://twitter.com/aminozuur)

</comment></comment></comment><comment><USER6> Very cool! Should try to pick the relevant definition when there's many though. Even your very first example gives the wrong one for quarrel, you need to click through 7 definitions before you get the right one.

<comment><AUTHOR> Thank you very much for the feedback!

So I actually talked with a dictionary expert that was a developer for WordNet. He told me that he spent tons of time trying to determine which definition is the right one. He came to the conclusion that dictionary authors quite often disagree on the ordering of definitions and that it is a lost cause to try to rank definitions.

I disagreed with him though. I think that definition form, word usage within the definition, and definition popularity can all contribute to selecting a "right one". That's why I applied statistical techniques to rank the definitions and reorder them to hopefully put the "right one" first.

Sadly, it seems that I didn't do such a great job for you with the word "quarrel".

Feedback noted as this will help when I start collecting data from users and make a push to improve my statistical analysis.

Thank you again and please let me know if you would like to discuss this further with me. Hope all is well. :)

<comment><USER7> I had the same issue as the other commenter. I also didn't quite understand the "word (1/15)" as it looked like there were around 15 words in the definition to begin with. Maybe you should just show all of them, vertically, until the user selects a new one.

<comment><AUTHOR> Thank you very much for the follow-up reply in regards to this! The worst definition that I've found is if you search the word "hello".

However, I actually like the first definition of the word "word" quite a bit. This demonstrates that there are differences from person to person.

Bringing this difference to attention, you're right, it would make sense if there was a button to click to just expand all of the definition at once.

Further, when a user selects one of them, I could record that data and incorporate user's preference of definition into my statistical analysis to provide better definitions and better orderings.

I really appreciate your feedback and if you would ever like to discuss further, please let me know! :)

</comment></comment></comment></comment><comment><USER8> Didn't figure out you can click more then the blue words until I read comments here

<comment><AUTHOR> Thank you for your feedback! Yes, that is an issue that I've heard many times. I've tried to solve it many different ways.

The issue is that the definition has to be readable while also conveying that the words are clickable without just adding a comment that says all these words are clickable.

I found that making some of the words look like buttons often conveys that those words are clickable and as you accidentally hover over other words, you detect that all of them are clickable.

Any ideas on how to solve this issue are greatly appreciated! If you would ever like to chat about this, please let me know. Hope that you have a great day!</comment></comment>


De-chunkifying Sequences in Clojure - <AUTHOR> http://blog.fogus.me/2010/01/22/de-chunkifying-sequences-in-clojure/

<comment><USER2> wouldn't it be better to have the intuitive behaviour by default, and the space-optimised behaviour as a configurable option?

<comment><USER3> The chunking behaviour is transparent unless you have a side-effect in your sequence function, which isn't sensible anyway. The chunked behaviour performs significantly better for the majority of cases which is why it's on by default, I believe.

Rich (creator of Clojure) addressed concerns similar to yours in this reddit discussion:

[http://www.reddit.com/r/programming/comments/afyav/clojure_1...](http://www.reddit.com/r/programming/comments/afyav/clojure_11_rc1_out_cuts_some_overhead_of/c0headd)

He also discusses chunked sequences in a video here (near the bottom of the list, the sound is pretty bad):

<http://tomfaulhaber.blip.tv/>

<comment><USER4> >transparent unless you have a side-effect

Only if you believe the side effect of using the CPU doesn't count.

</comment></comment></comment><comment><USER5> Is there any way to de-chunkify sequences in an exponential way ("uncover" twice as many elements each time instead of a constant number)? Would this be useful?</comment>


Startups: Practice your pitch and find a co-founder - <AUTHOR> http://ontechies.com/2011/09/21/practice-your-pitch-and-find-a-co-founder/

<comment><AUTHOR> Are meetups a good place to find tech co-founders? what are your thoughts?</comment>


Why Most LED Headlight Upgrades Don't Really Work: An Expert Explains - <AUTHOR> https://jalopnik.com/why-most-led-headlight-upgrades-dont-really-work-an-ex-1843070472 <comment><USER2> Daniel Sterns got a pretty cool website. [http://www.danielsternlighting.com/](http://www.danielsternlighting.com/)

I was using his advise when I upgraded my 240z headlights, a huge difference.

</comment><comment><USER3> TL;DR: halogen housings are designed for LED bulbs and so among other things you end up with an inferior beam pattern.

Older vehicles and Jeeps with sealed halogens where you can replace the entire bulb and housing as a unit can benefit from a switch to LED. There are recommendations at the end of the article.

Most of the article content explains why you can trust amateur reviews on the Internet or even your own eyes.

<comment><USER4> ^^arent ^^cant

<comment><USER3> Yes. Sorry. Don't know how I got two mistakes into such a short summary. :-(

</comment></comment></comment><comment><USER5> Jalopnik is utterly unreadable on mobile.

<comment><USER3> [https://outline.com/aEEYZm](https://outline.com/aEEYZm) any better?

<comment><USER5> That is significantly better, thanks</comment></comment></comment>


Ask HN: How to check whether research paper algorithm was patented? - <AUTHOR> As I currently interested in Machine Learning, a lot of research paper proposed algorithms.
My concern is how do I know if the algorithm was patented?
I want to (but not yet) implement some algorithms based on research paper to play around. <comment><USER2> I was under the impression that algorithms couldn't be patented, even in the US. Only software implementations (in the US) or devices using them. Algorithms are just maths.

</comment><comment><USER3> > I want to (but not yet) implement some algorithms based on research paper to > play around

They have to catch you first and then you have to be big enough for them to care.</comment>


Things no one tells you before an Antarctic expedition (2015) - <AUTHOR> https://www.telegraph.co.uk/men/active/11315994/Ten-things-no-one-tells-you-before-an-Antarctic-expedition.html <comment><USER2> I was there for a whole year, in a scientific base of my country. Being a controlled environment, I couldn't relate much with the items, except for

> 10\. Re-entry. > There is often a huge sense of isolation and disconnect > when you come back to everyday life. For so long, you have been out in the > wilderness and singularly concerned with survival and mileage, so when you > get back to the real world and people talk about their jobs, or what they > did at the weekend, it all feels foreign. You must remember that people have > their own lives and their own interests. Just because you like Antarctica > and polar expeditions, it doesn't mean anyone else should give a damn about > you or what you did.

It was hard to come back to the real life...

<comment><USER3> People from the Shackleton expedition went straight to the WWI trenches after returning from Antarctica.

<comment><USER4> And many of them died in the war. After IMHO the most extreme adventure a bunch of men have ever undertaken, where not a single man died.

This book [0] is one of the most astonishing I have ever read. Anyone reading this grab a copy, you won't regret it. It's quite a unique story in all human history, and superbly told.

[0] [http://books.wwnorton.com/books/Shackletons-Boat- Journey/](http://books.wwnorton.com/books/Shackletons-Boat-Journey/)

</comment></comment></comment><comment><USER5> > A normal man burns about 2,500 calories in a day. We burn between 7,000 to > 9,000.

This kind of thing is fascinating to me. It reminds me of the guy [1] who took 64,000 extra calories of olive oil along on his tiny-yacht trip across the Atlantic, because it's so dense in calories. Or the fact that on the day a climber summits Everest, they'll burn around 20,000 calories. That's almost 40 McDonald's Big Macs worth of energy.

1\. [http://www.yachtingworld.com/extraordinary- boats/undaunted-t...](http://www.yachtingworld.com/extraordinary- boats/undaunted-the-42-inch-yacht-still-hoping-to-become-the-smallest-boat- ever-to-cross-the-atlantic-107559)

<comment><USER6> Last year I tracked 294 runs and my app calculated I burned 260,900 calories (over 2,040 miles). Funny enough I calculated my average calorie burn per day of snowboarding at 8,000 calories right between the estimate provided from the article.

A lot of people will talk about calories in/out, but the body is far more complex. For starters diet will dictate the primary fuel source (glucose or fat), a body that burns fat as the primary source of energy will have nearly infinite energy supply while glucose store will empty relatively quickly, and once that's used up the body will start breaking down the amino acids in muscle tissue and converting it to glucose.

Like you I find nutrition very fascinating, but I'd take that olive oil (healthy fat) over 40 Big Macs any day.

<comment><USER7> Fat vs glucose being the energy source depending on diet? Where can I find more info about this?

<comment><USER8> The body switches to burning fat based on insulin levels. A very bad diet can make you insulin resistant and eventually have diabetes type 2, but it is reversible.

The difference between a normal person and somebody with insulin resistance is that the latter will feel hungry for longer before starting to burn fat.

Contrary to what the GP says, you need to be low on fat (think extremely skinny) before the body starts scavenging healthy non-fat tissues.

<comment><USER6> >Contrary to what the GP says, you need to be low on fat (think extremely skinny) before the body starts scavenging healthy non-fat tissues.

The process of converting muscle tissue into glucose falls under the umbrella of gluconeogenesis.

If you burn up your glucose stores, your body may turn to fat (more efficient than converting muscle to glucose), but the body can "skip" the fat burning and turn to the break down of muscle to convert the amino acids (proteins) into glucose. Hint: its build right into your post...Insulin. If a body burns up glucose, and there are high levels of insulin in the blood, then the body will go into gluconeogenesis to breakdown muscle to convert the amino acids into glucose instead of burning fat.

<comment><USER9> Hyperinsulinemia ([https://www.mayoclinic.org/diseases- conditions/type-2-diabet...](https://www.mayoclinic.org/diseases- conditions/type-2-diabetes/expert-answers/hyperinsulinemia/faq-20058488)) is mostly prevalent among those with Type II DM (insulin resistance promoting over-production of insulin in a physiologic attempt to compensate). I don't believe all that many "normal/healthy" individuals have this issue. So while gluconeogenesis is a viable pathway for fuel, in most individuals lipid metabolism will not be skipped over for gluconeogenesis because as mentioned previously it is the slowest and least efficient pathway for ATP production. Someone with a persistent high carb and low fat diet may be in a similar state but with high demand for energy - such as the conditions described in the article - the most efficient pathways will be utilized predominantly, unless the individual went to great lengths to prevent it via their diet.

</comment></comment></comment></comment></comment></comment><comment><USER10> > Middle aged people tend to make better polar explorers. Not so much because > they are physically more capable, but more to do with their mental capacity. > Out on the high polar plateau there is nothing but endless white stretching > off in every direction. You ski for 12 hours a day and because of the wind > and cold, it's almost impossible to talk to your team mates. So, in effect, > you are alone in your head for all that time. By being a bit older and > having a bit more life experience, it helps fill the blank canvas that is > Antarctica.

I always wonder if the same would apply to soldiers. A former special forces soldier I know said that they didn't look for jocks (though you need some athleticism); they looked for people with the ability to perform as a highly functional team member under extreme stress and exhaustion - sort of like the developer who maintains their sense of humor, keeps everyone loose, and still turns out work to the highest standards after a week of 18 hour days, with a deadline breathing down your necks and an angry boss. It seems to me that older people are generally more capable in that regard.

> [the butter] tastes revolting, but then your body just craves the fat > content and you eat the butter like blocks of cheese.

He needs a bit of better butter. I highly recommend eating Plugra butter straight, assuming that your heart doesn't need all that blood all the time. Really; go buy some and you will come back and thank me. I can't even imagine how good it would taste in the author's situation.

(I have no affiliation with Plugra.)

<comment><USER11> > Plugra butter

It's god-tier. I haven't eaten it straight but in thick (1/4") slabs on fresh bread. Found even better butter in Iceland, flew home with 5 pounds of it. Somewhere between butter and triple-crème cheese. Got odd looks at customs, but they had no problem with it.

<comment><USER12> What brand from Iceland?

<comment><USER11> I don't remember, I think it was a local, no-brand butter. The 5lb was one big block.

</comment></comment></comment></comment><comment><USER13> > It may seem stupid celebrating traveling 100km when you have 18 times that > distance to go, but never underestimate the power of denial.

I think this quote applies well to entrepreneurship

<comment><USER14> It's hard to know what to celebrate, as it's often not as easy to quantify as a kilometre

<comment><USER15> Celebrate bookings, revenue and customer successes!

Celebrate teams who work well together.

Don't celebrate fund raising.

</comment></comment></comment><comment><USER16> Is anyone else bothered by the unit switching this guy is doing?

> On the traverse of Antarctica we were trying to cover 1,850km. After the > first week, we had only done a few miles total and then had to climb 3,000m > onto the high polar plateau.

That's 3 distance units in two sentences where 1 unit would suffice with almost no changes ("a few miles" is approximately identical to "a few kilometers").

<comment><USER17> Perhaps the second unit is "meters," as in, "climbed 3km onto the high polar plateau."

<comment><USER16> For sure it is, and that one is almost reasonable, as meters tend to be used more than miles or km for elevation.

The switch between miles and kilometers with no cause bothers me more than that.

<comment><USER18> In Scandinavia at least we use mile for 10 km. Not sure how common it is elsewhere.

<comment><USER14> An imperial mile is 1.6km in the UK and USA

</comment></comment></comment></comment></comment><comment><USER19> not too off topic: I've been reading "The Worst Journey in the World" \- fascinating!

also, to help with the general mood I bought a bottle of this whisky: [https://www.whiskyshop.com/shackleton](https://www.whiskyshop.com/shackleton)

cheers!

<comment><USER20> Great book! You may also enjoy this story : [https://www.newyorker.com/magazine/2018/02/12/the-white- dark...](https://www.newyorker.com/magazine/2018/02/12/the-white-darkness)

<comment><USER19> Dude, after reading the Atlantic article I remembered hearing about that expedition. hard core ..and this pic, its timeless [https://www.newyorker.com/projects/interactive/2018/180212-g...](https://www.newyorker.com/projects/interactive/2018/180212-grann/assets/photo/finals/r31463.jpg)

</comment></comment></comment><comment><USER21> I would highly recommend this blog about surviving in Antartica (and not loosing all your SANity points ;)

[http://sme.wikidot.com](http://sme.wikidot.com)

</comment><comment><USER22> >> We burn between 7,000 to 9,000. That means supplementing your dehydrated food with slabs of butter. In the first few days of the expedition, it tastes revolting, but then your body just craves the fat content and you eat the butter like blocks of cheese.

I wonder how many sticks they eat a day. 1 stick is around 800 calories. Eating a stick of butter is a popular food challenge video on YouTube, but some guys eat 4 sticks (1lb) without any problem, in just a few minutes.

</comment><comment><USER23> -30C is actually not that bad when the air is dry.

<comment><USER24> it's also much easier to stay dry, and thus warm, at -30 than at -2

<comment><USER23> Try -30 and 75% relative humidity. It takes a few weeks for the humidity to go down, but during those weeks you will freeze your ass off.

</comment></comment></comment><comment><USER25> Why not peanut/almond butter instead of butter?

<comment><USER26> Turns to rock in the cold

<comment><USER27> Almond could have also a small amount of cyanide. Bad idea if you plan to eat a lot of the stuff.

<comment><USER28> AFAIU only bitter almonds, which are not used to make almond butter, contain significant amounts of cyanide. You could eat pounds of almond butter and not have an issue.

<comment><USER27> Is interesting, so I did some calculus.

If we assume a 75Kg standard male human the lethal dose of cyanide would be 37.5 mg (0.5 mg by Kg)[A]. A Kg of sweet almonds has more or less, 25mg of cyanide [B] therefore if you eat 1,5Kg of almond butter in a short space of time you could reach the lethal dose.

Is a lot of butter but:

1) If you eat less you could still vomit or have stomach problems that could lower your chances of survival in such hostile environment.

2) the maker could had used some cheaper bitter almonds in the mix to lower the price. Bitter almonds have much more cyanide so even a few could lower the lethal oral dose.

And 3) there is a possible interaction with vitamin C suplements, that turn amygdalin in cyanide [2].

[A] [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3793392/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3793392/)

[B] [https://www.almonds.com/sites/default/files/content/attachme...](https://www.almonds.com/sites/default/files/content/attachments/2014aq0004_amygdalin_publication_overview.pdf)

<comment><USER28> That is 3.3 imperial pounds of sweet almonds. I offer that one would not be readily able to consume even half that much.

<comment><USER27> Eating half of the stuff wouldn't be so difficult in a diet that needs to replace 7000-9000 calories each day. 750 g of almond butter has around 4600 calories. A reasonable value to eat if choosen as the main source of fat in the diet.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> Middle aged people tend to make better polar explorers

Perhaps for the same reasons they tend to be better entrepreneurs.

<comment><USER30> Like having access to capital?

</comment></comment><comment><USER31> Good for that guy but by 'Antarctic expedition' I was expecting something different.

I'm a lot more interested in going to Antarctica, spend a few months there as part of some scientific research team. Or maybe just go there as a part time low skill worker, so that my whole trip is funded and at the same time I don't have to work more than a few hours a day. I just want the feeling of having lived in Antarctica for a few months. (internet access is a must).

<comment><USER18> They need electricians, technicians, mechanics, carpenters, cooks, probably sysadmins and much more over there. It's absolutely possible to get work in Antarctica and other remote scientific research stations for "normal" people. The American station at McMurdo have a population of 200+ people in the winter months and over 1000 in the summer months.

edit: See this link[0] for some information about life in Antarctiva and how to get a job.

[0]: [https://www.coolantarctica.com/Community/find_a_job_in_antar...](https://www.coolantarctica.com/Community/find_a_job_in_antarctica.php)

<comment><USER31> Thanks. Looks like a very useful url (saving for future).

</comment></comment></comment><comment><USER32> > _putting in 12-14 hour days of pulling a sled in minus 40C, you have to_

Oddly they include the redundant "C" for -40 but don't include it, or the "F," in the next paragraph:

> _by running outside naked in minus 30 and rubbing yourself down with snow_

Then they restore redundant ones a few paragraphs later:

> * It may be as low as minus 40C outside* . . . _which in minus 40C is quite > high_

<comment><USER33> This is quite the nitpick.

<comment><USER34> We have had the units nitpick for distance and temperature now. There must be another, wonder if we can get a third?

<comment><USER35> On this page, [https://news.ycombinator.com/item?id=17055920](https://news.ycombinator.com/item?id=17055920) is the nitpick for energy.</comment></comment></comment></comment>


Ask HN: Very strange favicon on Gmail. Has anyone seen this? - <AUTHOR>

I don't know when I first noticed this but on gmail,  the favicon displayed is different for my account but not anyone else's that I've talked to. It's a round flower with a yellow symbol in the middle that looks like the end of a crescent wrench.
Here's a link to it:
http://imgur.com/MlcXQRX
When I search for it on Google Image search, I can only find 8 results for it, all on Chinese sites.
http://preview.tinyurl.com/oj99epk (with preview link so people can see the full google search url before navigating to that link)
Has anyone else seen this or at least know what the symbol is? I don't recognize it at all. <comment><USER2> Appears to be an error on Gmail's part. See this discussion for more info including official response: [https://productforums.google.com/forum/#!category- topic/apps...](https://productforums.google.com/forum/#!category- topic/apps/general-discussion/TWJHXfDjRpU%5B1-25-true%5D)

<comment><AUTHOR> Thank you for this. I tried searching for an answer before posting here and did not find that discussion.

</comment></comment><comment><USER3> This happens when you are logged into google apps as admin.

<comment><AUTHOR> Strange, because I also get it on my work Google Apps email account even though I'm not an admin on that account.

<comment><USER3> Interesting. Since I am admin on my Google Apps account, I assumed it must be for that. Guess all Apps accounts get it.

<comment><AUTHOR> In general I find it very odd for a company to change the favicon for a domain or site since it's meant to aid which recognition of what tabs go with what sites you are familiar with. Putting an icon that is unrelated to your own logo destroys the ability for the user to recognize their gmail tab quickly. At best, their intent could be that this is meant as a placeholder favicon until the user sets his/her own custom one. But even in that case, I'd except the regular Gmail favicon until the user feels compelled to seek out this configuration and set it themselves.

</comment></comment></comment></comment><comment><USER4> One of my PMs had this last week. We assumed it was some sort of maintenance mode indicator given the spanner icon. A mystery indeed!

</comment><comment><USER5> Oh I only have that on my corporate account and not my business account. I figured it was something one of the admins did.

</comment><comment><USER6> Strangely I only see this favicon on one of the two linked gmail accounts I am currently logged into.</comment>


Webapp free trials - CC required vs no CC needed - <AUTHOR>

Does anyone have any data on conversion rates comparing the two approaches? I often wonder if the (assumed) increased number of signups when no CC is required is offset by a lower rate of conversion to paid status. <comment><USER2> I don't have any statistics to back up my answer, but I suspect that requiring a CC at signup will decrease your revenue. I know personally, I do not sign up for things that require my credit card. I blame gyms for this. It is the classic stereo type where you sign up and then forget to cancel. Time is very important, so I don't want to deal with having to cancel.

My webapp as a free trial (very little information required, username/pw) and a free demo (no information at all required.) My support costs are virtually 0 for trials and demos. In fact, any customer asking a support question ends up being a paying customer. They actually want to use the product. I want to maximize the number of prospects at the top of my sells funnel, so I reduce the barrier to trial to as little as possible.

If anyone has done an A/B test on this, I would like to know the results.</comment>


What are the best resources for studying AI/Machine Learning? - <AUTHOR> I'm interested in AI/machine learning and have started reading 'Deep Learning'. Was wondering if this is a good place to start off. Any recs would be appreciated! <comment><USER2> [https://github.com/ZuzooVn/machine-learning-for-software- eng...](https://github.com/ZuzooVn/machine-learning-for-software- engineers#becoming-an-open-source-contributor)

<comment><AUTHOR> Appreciate it!</comment></comment>


Keeping browsing experience in users' hands - <AUTHOR> https://blogs.technet.microsoft.com/mmpc/2015/12/21/keeping-browsing-experience-in-users-hands/ <comment><USER2> From the original article: "To address these and to keep the intent of our policy, we're updating our Adware objective criteria to require that programs that create advertisements in browsers must only use the browsers' supported extensibility model for installation, execution, disabling, and removal."

Require, eh? I love it when you talk dirty Microsoft!</comment>


What is a good high level language that is also highly efficient? - <AUTHOR> My personal interests, as well as most of my career, have led me to very high-level languages such as Ruby and Clojure.
However, I've recently become interested in some problem domains that are usually best approached by more low-level languages, which provide the maximum level of memory efficiency and performance, as well as suitability for raw binary operations. Unfortunately, having been thoroughly spoiled by managed memory and strong typing, I break out in hives at the thought of undertaking an extensive project in C or C++.
So what are some good languages for this? D is interesting, but I'm a bit turned off by its lack of support for concurrency. Haskell can theoretically work in this domain, but it appears that it's quite difficult to reason about its performance without an inordinate level of understanding of its implementation details. Go looks interesting, but I haven't had a chance to explore it deeply yet (it's on my list.)
Are there any other options in this space? <comment><USER2> I think you should take a close look at the ML family. Well, I'm not sure how good their concurrency support is; I doubt it's as good as Go's. But they have very good compilers, and a reputation for being good for numeric work. They are strongly typed and garbage-collected, but differ from Haskell in giving you the option of writing imperative code when you want, and in generally having a more familiar programming model (they are strict, like most languages, rather than lazy).

OCaml has a small but strong following in the financial services world -- it's used by algorithmic traders, who are known to be performance-sensitive, to put it mildly. And Standard ML has the MLton whole-program optimizing compiler.

I have to qualify this by adding that I haven't used either of these tools myself, but for certain kinds of problems, I would definitely give them a closer look.

</comment><comment><USER3> You can see statistics here <http://shootout.alioth.debian.org/u64/benchmark.php> and make your own benchamarks. I'd say JavaScript is pretty fast for being a high-level scripting language. It's gettin' faster everyday with every new browser version. JavaScript is no longer web-only, you can build desktop applications and write server code with NodeJS.

</comment><comment><USER4> Go. I'd definately move it to #1 on your list :) I've been using Go for a while now and I gotta say the more I use this language the more I start to love it. Its incredibly well thought out, the libraries are powerful and well designed, the documentation is clean and extensive, plus its a great mix between High and Low. And, in my opinion, as much as I like node for letting me do js on the server, Go does it better.

</comment><comment><USER5> Oberon, Go, Common Lisp, Matlab/Octave for some problems, R for some others, APL/J/K for others.</comment>


Ask HN: Articles like Sam Altman's startup playbook? - <AUTHOR> I really like that website, as well as his latest blog post.<p>Do you know of anything similar, perhaps written by someone else? <comment><USER2> You may have heard of Pieter Levels[0], the creator of Nomad List, RemoteOK and Hoodmaps. I'm assuming you are planning to learn more about how to make a startup. There are two core resources that I find very useful from his writings.

\- He documented[1] how he build Hoodmaps[2] while streaming. He got a functional app built as soon as he could and built upon user feedback. You learn how he bootstrapped his way up and you realize how to do that.

\- He wrote a book on how to bootstrap. That book[3] was made online while collaborating with others. It was sort of a community effort. I think it is very well written.

[0] [https://levels.io/](https://levels.io/) [1] [https://levels.io/hoodmaps/](https://levels.io/hoodmaps/) [2] [https://hoodmaps.com/](https://hoodmaps.com/) [3] [https://makebook.io/](https://makebook.io/)

</comment><comment><USER3> [http://blakemasters.com/peter-thiels- cs183-startup](http://blakemasters.com/peter-thiels-cs183-startup) is a classic in the genre. Notes from Peter Thiel's Stanford course.

<comment><USER4> Never saw this, thanks for the link. I found [http://blakemasters.com/post/24578683805/peter-thiels- cs183-...](http://blakemasters.com/post/24578683805/peter-thiels- cs183-startup-class-18-notes) to be written extremely well.

</comment></comment><comment><USER5> Blogs \-- [http://paulgraham.com/articles.html](http://paulgraham.com/articles.html) [http://www.aaronsw.com/weblog/](http://www.aaronsw.com/weblog/) [https://www.fast.ai/topics](https://www.fast.ai/topics) [https://blog.codinghorror.com/](https://blog.codinghorror.com/) [https://www.gwern.net/](https://www.gwern.net/)

Books: \-- Founders at Work

</comment><comment><USER6> [http://blog.eladgil.com](http://blog.eladgil.com)

</comment><comment><USER7> [https://pmarchive.com](https://pmarchive.com)</comment>


How A Facebook Game Makes Zynga Millions - <AUTHOR> http://www.businessinsider.com/how-to-get-completely-addicted-to-a-stupid-facebook-game-2009-12

<comment><USER2> Could this facebook game thing be a fad?

I remember back in high school when web games like Earth 2025 (games.swirve.com/earth/) were quite the rage and everybody was playing them. This lasted for a year or so until the novelty wore off. Some still play but the casual players are gone and the audience is a tiny fraction of what it once was.

I've noticed that my FB friends that play FB games tend to stop playing after a couple months. The games are mindless, cookie-cutter and repetitive for the most part.

<EDIT>I don't think WoW is a good comparison as there is clearly a huge depth between it and Zynga games. The experience is entirely different.

"Easy come, easy go" could apply to this market. I mean these games come out of no where to millions of players. These are not hardcore gamers that develop strong loyalty and build communities, but "casual" players that probably started playing because their friends are.

"Casual" gamers are notoriously fickle. Look at the Nintendo Wii, which is the most popular console but has the least average amount of titles bought per owner (which is where the real money is.)

In 2-3 years I would not be surprised that after all this over-exposure these x-ville games will be significantly less popular. These "games" have more in common with Tamagotchi and Beanie Babies than Wow or Call of Duty... </edit>

<comment><USER3> Some of us played for years, long after the fad wore off. The difference between the swirve games and facebook is that a community grew up around the game. From what I've seen of the facebook games, it's mostly your existing friends. I haven't heard of Mafia Wars meetups like E2025 or Utopia had, for example. (And yes, there were ways to get extra turns via various offers. I remember having to research something on goto.com every day, as one.)

What swirve did well is create a community. That's what an online game should aspire to, and I have only seem glimpses of that with the facebook games, even with the obnoxious updates.

<comment><USER4> There were Facebook clones of Swirve games that had similarly rich communities around them, but those games don't make as much money as the X Wars or the X Ville games.

</comment></comment></comment><comment><USER5> They have a great idea on making money of users. Instead of charging a larger amount to let them play the game, they charge a numerous smaller amounts for different objects in the game. First, people are more willing to part with, let's say, 25 cents for that one cool fish than with 25 dollars for a game. Second, once you get them pulled into the experience, they will be even more willing to spend money. Surprisingly, I don't see that kind of pricing used much in other areas.

<comment><USER6> It seems like it worked well in the arcades. Back when I couldn't afford a Playstation or a TV, I could rent some time on Tekken, and even got to play it with my girlfriend and meet other people at the arcade.

I haven't ever bought anything on Facebook, but it would really improve the profitability of these games if there was a super easy payments system there to avoid the huge hurdle of the first time someone has to get the credit card out of their wallet. Once they have the numbered stored, incremental purchases are lubricated, as in the case of iTunes, where it is very easy to make a casual $0.99 purchase.

</comment></comment><comment><USER7> The minute you refer to the game as "stupid" you lose the ability to understand why it works.

<comment><USER8> I don't really see why. We can pretty much all agree that the lottery is also 'stupid', but it works, and it's quite clearly understood why it works.

These sort of games work because they get people addicted, and then blackmail them into paying money to make the games easier for them.

<comment><USER9> The only way they could be blackmailing you is if they said something like, "if you don't spend money, we will tell everyone on facebook how much you suck at maintaining virtual fish!"

I don't think this is exactly the case. They sell a service. Whether you deem it a service of value or not is irrelevant.

<comment><USER8> The fact someone sells a service doesn't mean it's right, proper, etc.

Gambling is heavily regulated for a reason. I would say that games like these should be regulated just as much.

Imagine going to the arcades, playing street fighter II, and it saying "We know you can't get on the score board because you suck, but if you pay $20 we'll put you at the top of the score board anyway". Would that be completely fine and above board?

<comment><USER7> Like many drugs, gambling is heavily regulated because of puritanical values, not because regulation helps reduce the social impact. These games are not gambling at all, and share no more in common with gambling than any other form of capitalism.

And yes, it would be totally fine. If you don't like it you don't have to play Street Fighter II. And given that it costs 50 cents a play and has a steep learning curve, that's effectively what they do in a roundabout way.

<comment><USER8> They share a lot. They are addictive, and the further in you get sucked, the harder it is to stop. Because of this, the further in you get, the easier it is to be exploited and taken advantage of.

I don't think it's about being puritan, it's about protecting the most vulnerable members of society from themselves.

For example, say you get 95% of the way through a game, then the game asks for $100 to get past an absolutely impossible stage, they'd probably get a fantastic amount of people spending the $100 reluctantly. Which IMHO isn't a nice way to do things.

<comment><USER7> You can't protect people from themselves, that's the problem with those laws. Research shows this time and time again. Anti-gambling laws don't protect gamblers, they just move them from safe, legal, regulated casinos to scammy underground gaming halls and instant bingo ticket parlors. Anti-drug laws don't decrease drug use, they just increase violent crimes.

But that aside, thankfully capitalism doesn't require you to find a "nice" way of doing things. I'm as addicted to shaving as any player is to a Facebook game. (We could both stop, but don't want to.) I'm even more addicted to food. But that doesn't mean Gilette and Whole Foods are scammers.

<comment><USER8> I don't think that's a good analysis. Anti gambling laws does indeed push the hardcore gamblers into underground gaming halls. But the important thing it does is stop lots of people getting hooked in the first place. Same with drugs etc.

Having said all this, it's clearly extremely lucrative to setup games like this.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Good at least to see someone making games for people other than the hardcore crowd.

IMO, this shows that in gaming there isn't a straight line of worst-to-best but instead there's lots of different types of games that appeal not only to different types of people but different moods a person is currently in.

</comment><comment><USER11> I had an email saying a Zynga user with my email address had withdrawn money from a Mastercard (which wasn't mine - nor do I own a Mastercard). Emailed Zynga to tell them about this odd semi-fraudulent activity, and they couldn't give a toss. Total idiots.

I didn't lose any money, but it was unnerving.

</comment><comment><USER12> I believe that giving coins for inviting friends is explicitly disallowed in Facebook's TOS.

</comment><comment><USER13> Is that article just a couple of screenshots of them playing a game??? That is even cheaper than a virtual machine gun in Mafia...

</comment><comment><USER14> Ironic.

While a lot of us are thinking about cool new tech, lisp, twitter, and all the other kinds of stuff we love talking about on HN, these guys are writing simple flash aquarium apps and raking in millions.

Perhaps running your own startup about a lot more than simple monetary success. I know I want to make people's lives better in addition to controlling my own destiny.

But still, sure looks like a sweet spot to be in. I bet the field is probably way overcrowded by now, though.

<comment><USER15> Field is "never" overcrowded.

Before Google beat the crap out of everyone there was Yahoo, Altavista, Excite etc. Before iPod came there were numerous mp3 players. Before Zynga, there were numerous Facebook apps and countless Flash games.

So, if you want to do it and have a good idea, I'll say do it, give it a shot. Whats the worst that can happen, some time wasted. Lather, rinse, repeat...

<comment><USER16> Search doesn't benefit from a network effect, whereas social games do. It's the same defense that Ebay/Craigslist enjoy (though admittedly less ironclad).

Someone like Zynga has brutally low customer acquisition costs compared to a new social game developer (because they can cross promote to existing players for only the opportunity cost of showing other low-CPM banners).

</comment></comment></comment><comment><USER8> This sort of thing is worse than gambling. I'd say there's a strong case for regulating things like this. It's just preying on the addicted/weak/stupid surely.

It's almost a bait and switch:

1\. Get user addicted to game 2\. After some time, tell user they can progress quicker through the game if they pay money (Blackmail).

<comment><AUTHOR> How is that any different than how I used to pump quarters into Street Fighter II arcade games back in the day?

<comment><USER17> The difference is the barrier to entry / improvement. In the case of a quarter machine slot game it's pay to play, while it's a bait and switch for a game which only allows you to continue by paying more money regardless of how well you are doing in the game. It's not necessarily illegal, but it surely is deceptive and won't win the game any fans.

<comment><USER18> I've been playing one of the zygna games myself.

To the level I've got, plenty of things would be easier if I was willing to spend money, but I haven't found anything I can't do for free.

<comment><USER19> I believe that is strongly tied to why they have become so popular so fast. You can go into the game, pick it up, and become fairly good quickly. If you continue on with it, you slowly get better as time goes on. You then get a friend to join, and they have to start at the beginning. They could spend the days/weeks it took for you to get that far, or they can spend $5 and get there in a tiny fraction of the time.

To generalize it, its easy to get a handful of people to do something. If you offer it to them for free, there are plenty of people who will go out of their way to advance as far as possible. Once those people start getting friends involved, the friends will want to get that far too. By offering them a quick advancement in exchange for money, you can then make a tidy profit.</comment></comment></comment></comment></comment>