Newly Discovered Smallpox Samples - <AUTHOR> http://www.cdc.gov/media/releases/2014/s0708-NIH.html <comment><USER2> The most impressive part of this for me is that there is international law and oversight which was immediately brought into play. WHO representatives being invited to watch the destruction? That is both extremely responsible and acknowledges an authority outside of the US government. That mindset is far too rare in this country.

<comment><USER3> > immediately brought into play

Actually, we have no idea how quickly things were brought into play. The article is carefully worded to note the date when the virus discovery was _announced_ , not when the vials were actually found.

For all we know, this was could have been bouncing around between departments for weeks, months, etc.

<comment><USER4> Its unlikely it was bouncing around for long. Both NIH and CDC have long standing, and rehearsed, plans for the discovery of select agents and toxins, including dealing with sample discovery in less-than-appropriate containment. I work with a few select agents and while there's a ton of bureaucracy around it (Forms in not just triplicate but quadruplicate), that bureaucracy is both for the safety of everyone and for quick reaction to hazards. For examples, every log for our BSL-3's is reviewed within a few hours of modification. If a question comes up, users have 4 hours to respond to them. If they fail to do so certain containment procedures go into effect.

The entirety of the discovery, initial testing and planning phase likely took less than 2 days. If there's one thing either organization doesn't fucked with, it is select agents and toxins.

</comment></comment></comment><comment><USER5> Since the virus survives freezing there's certainly some frozen bodies that harbor the disease as well. The idea is sort of dismissed in [1] but the CDC quotes there are more about the prospects for a pandemic then whether the virus is likely present all over the arctic (etc.) or not.

[1] [http://gizmodo.com/will-smallpox-reemerge-in-siberia-as- corp...](http://gizmodo.com/will-smallpox-reemerge-in-siberia-as-corpses-thaw- from-1514969971)

edit:

According to [2] things like tundra smallpox are the reason the US didn't want to destroy the last lab samples.

[2] [http://www.livescience.com/2403-climate-threat-thawing- tundr...](http://www.livescience.com/2403-climate-threat-thawing-tundra- releases-infected-corpses.html)

<comment><USER6> They haven't destroyed the last samples. There are official samples in America and Russia still.

<comment><USER7> Can you provide any references to that effect? I'm pretty sure the closest we still _officially_ have is a virus that is derived from smallpox, which they convinced to jump species and infect apes.

Unofficially, well... case in point.

<comment><USER8> From TFA:

      By international agreement, there are two official World
      Health Organization (WHO)-designated repositories for
      smallpox: CDC in Atlanta, Georgia and the State Research
      Centre of Virology and Biotechnology (VECTOR) in Novosibirsk,
      Russia. The WHO oversees the inspection of these smallpox
      facilities and conducts periodic reviews to certify the
      repositories for safety and security.

<comment><USER7> Thanks. It's a little surprising to me since I seem to remember one of Richard Preston's books ending with VECTOR and CDC destroying their samples (and doing the species jump to create something that would theoretically infect monkeys but not people). Perhaps my recollection is incorrect...

I remain amused at how wrath of god people can get with the downvoting. :)

<comment><USER8> I can't speak for the others, but I almost downvoted you. And the reason is simple: the article was an eight paragraph piece, with your remark neatly answered in the sixth.

People can get a little mad when contested by something refuted in the (short) required reading.

But you are a little right. There was a big push to destroy all samples, with USA and Russia fighting to keep them for military reasons.

[http://en.wikipedia.org/wiki/Smallpox_virus_retention_contro...](http://en.wikipedia.org/wiki/Smallpox_virus_retention_controversy)

</comment></comment></comment></comment></comment></comment><comment><USER9> I think bringing up Biohazard[0], a book about soviet bio warfare experiments and the culture they were conducted in seems pertinent. In particular it is illuminating, if not factually accurate, how Soviets covered up accidents at their bio weapon research facilities. Book paints a grim picture of how this could have been handled, in light of that I applaud actions taken by NIH and CDC.

[http://www.amazon.com/Biohazard-Chilling-Largest- Biological-...](http://www.amazon.com/Biohazard-Chilling-Largest-Biological- World-Told/dp/0385334966)

<comment><USER10> I was initially keen to read this, as it appears to be one of the only works on the topic of the Soviet bio-warfare program. However, the author's scientific credibility and "authenticity" (for lack of a better term) has been called into question: [https://en.wikipedia.org/wiki/Ken_Alibek#Criticism](https://en.wikipedia.org/wiki/Ken_Alibek#Criticism)

However, there are some Soviet bio-weapon incidents I've read about which were verified _(by people other than Ken Alibek)_ as having genuinely occurred.

</comment></comment><comment><USER11> Confused about this part:

"Additional testing of the variola samples is under way to determine if the material in the vials is viable (i.e., can grow in tissue culture). This testing could take up to 2 weeks. After completion of this testing, the samples will be destroyed."

Why not just destroy the samples outright? What's the reason for incubating a live sample and then destroying it?

<comment><USER4> On discovery (or receipt) of a select agent you always, _always_ , test for viability. There are a few reasons, a few that rank high on the list: they want to know how long smallpox can survive in inappropriate storage (too hot, freeze/thaw, etc); they want to genotype and phenotype this sample for records in case it shows up else where; viable, unpassaged smallpox is rare.

<comment><USER11> Makes sense. Also, I just realized, is if it's viable was there any opportunity for exposure.

</comment></comment></comment><comment><USER12> Scary to put it lightly. You'd think that we would be more careful with such things. I could only imagine who actually found the sample, and if they even realized what it was without Googling. An even worse thought would be if they were to just throw it in the trash.

<comment><USER13> I'm pretty sure anyone that speaks a Romance language may recognize 'variola' as smallpox. I guess the original label used the Latin name. Also, in a CDC laboratory, I'd bet dollars vs pennies there's already a protocol for handling "old badly labelled samples" that includes "not opening" and "not misplacing".

<comment><USER14> It began at the FDA, which doesn't routinely handle substances of this type. That's why it was transferred to NIH in Bethesda temporarily while the CDC team came up from Atlanta.

<comment><USER4> Well, no, it began at the NIH. NIH handed the labs over to the FDA, and apparently missed a vial during the move.

<comment><USER14> Ahh. Yet still, it was not found at CDC by CDC employees more likely to be trained to handle highly infectious samples.

</comment></comment></comment></comment></comment><comment><USER8> Just to remind everyone what we are dealing with here: [http://en.wikipedia.org/wiki/History_of_smallpox](http://en.wikipedia.org/wiki/History_of_smallpox)

      During the 20th century, it is estimated that smallpox
      was responsible for 300–500 million deaths.

Half a billion people dead, _after_ a vaccine was discovered. And that was one century of the 12,000 years it has existed.

That's why I get shivers from the opening of [http://en.wikipedia.org/wiki/Smallpox](http://en.wikipedia.org/wiki/Smallpox):

      Smallpox *was* an infectious disease...

      [...]

      To this day, smallpox is the only human infectious
      disease to have been completely eradicated.

</comment><comment><USER15> Was there not a debate recently on wether to dispose of the last vials of smallpox because there would be no need to produce a vaccine as the virus had been eradicated.....

<comment><USER16> Not sure where I read it, or heard from someone, but it was about how some such similar disease (maybe even smallpox) that produces scabs and how someone found a scab from it in a library manuscript. This is somewhat similar.

<comment><USER17> Wikipedia: "In March 2004 smallpox scabs were found tucked inside an envelope in a book on Civil War medicine in Santa Fe, New Mexico. The envelope was labeled as containing scabs from a vaccination and gave scientists at the Centers for Disease Control and Prevention an opportunity to study the history of smallpox vaccination in the U.S."

<comment><USER18> So these scabs would be the product of infection with vaccinia and not variola, if my understanding is correct.

</comment></comment></comment></comment><comment><USER19> Wondering why we are keeping two samples? Is it for future use 'just in case' or is there some great reason I am missing?

</comment><comment><USER20> Question for those with knowledge -- would a 60-ish year old sample still be virulent/communicable/whatever?

<comment><USER21> Possible, but not incredibly likely unless it was prepared via freeze-drying for long-term storage. I wouldn't want to huff it, though.

<comment><USER22> "They were freeze-dried, intact and sealed, forgotten and packed away in a cardboard box, officials said."

[http://www.latimes.com/science/sciencenow/la-sci-sn- smallpox...](http://www.latimes.com/science/sciencenow/la-sci-sn- smallpox-20140708-story.html)

<comment><USER21> Yeah, so that's a bit scarier. Lyophilized samples are fairly shelf-stable. There's a much better chance they'd be infectious.

</comment></comment></comment></comment><comment><USER23> Can anyone comment on how bad it would be if this sample were viable and exposed to a populated area?

<comment><USER24> People are only infectious after the rash appears, and remain infectious for about 2 weeks. Transmission usually requires prolonged face-to-face contact with an infected person. Prior to the rash appearing, the infected person will feel lethargic and ill, and will likely take to bed.

So if there were a potent enough exposure event, it would be fairly easy to recognize and contain. Smallpox wouldn't make a very effective biological weapon (except for psychological effect).

</comment></comment><comment><USER25> How are virus samples such as these usually destroyed? Heat? Chemicals?

<comment><USER26> Autoclave.

<comment><USER27> Which uses heat.

</comment></comment></comment><comment><USER28> "eradicated"

<comment><USER29> in the sense that no human is currently infected with smallpox. The virus itself is kinda resistant. It notably resists freezing, so it is very possible that the virus survived in the permafrost.</comment></comment>


How corrupt is your country? - <AUTHOR> https://pbs.twimg.com/media/ClKPq7MWMAANQFl.jpg <comment><AUTHOR> One of the least corrupt countries was populated by prisoners: Australia.

How did Australia do it? Starting from a clean version 1?

</comment><comment><USER2> It says perception, not reality.</comment>


Ask HN: What to do when you feel "developer loneliness"? - <AUTHOR> Strange title, I know, let me explain...
I am doing software project management and development in a small media company with about 15 people. My job is good and I like my work, but sometimes I feel kind of "lonely" in that sense, that I have nobody to talk about technical/work problems.
I have two colleagues in my team, but they aren´t developers at all (one now gets to know his ways around CSS) and so I have nobody to get ideas or input from when I face problems or need some kind of "technical inspiration" on how to tackle a problem. On the other hand, when clients send their devs for meetings or trainings, the atmosphere is much better for me, because they often are on a similar level...
Now, getting a second developer would probably be the solution for this loneliness, but the financial situation does not allow this right now and it's unclear for how much longer...
This gets me frustrated from time to time, so I thought I might ask over here, as some of you might be working for small companies and have similar "feelings" or problems.
What are your ideas or solutions on this? How do you handle that feeling? Local dev meetings? StackOverflow sleepovers?!?
edit: Let me add: While this may sound not really serious, it´s actually kind of a big deal for me as I am getting more and more frustrated by having nobody to get at least a little valuable feedback from. My colleagues are just like "Well, I don't know that kind of stuff, you are the pro here, find a solution and tell us..." Trying to engage them to think about problems like these has not worked yet... :-( <comment><USER2> 1) Go to meetups. 2) Go to conferences. I've found a good conference revitalizes me on many levels, when I start feeling l don't want to do this anymore, when I am in a rut. I find a good conference makes me love my job again. 3) Find a friend to chat with about problems you have. But watch out. It is very easy to just bitch about how things suck at work. You might need that from time to time but doing that all the time will just frustrate you more. 4) Find an online forum and participate there but don't overdo it. Forums are full of a lot of young programmers or wannabes that can be more frustrating than refreshing. 5) DON'T work overtime when you are frustrated, you don't want to burn out. I've seen programmers that burned out. That's not a pretty picture.

You can also talk to your coworkers about some of your problems. Try to dumb it down or find somebody who can understand some of the more technical problems. Being able to explain something often is enough. Some people talk to themselves or a puppet or a rubber duck. That never helped me, I need a person. What you will find once you have another programmer around is that THAT might not help. We have different specializations and personalities. Not all of us are good for talking through problems. Similarly, not all none programmers are shit for talking through problems.

Other than that, I can only recommend a hobby that has nothing to do with programming or technology. Something you can more easily find other people to talk about. Having another go to THING might help you compensate for not being able to talk as much about programming issues as you would like to.

<comment><AUTHOR> Thank you very much for your answer.

I already burned out one year ago and it was no fun at all. I don't wish this for my worst enemies and so I'm trying to be careful about not doing old mistakes again.

And I think not being able to talk about what stressed/frustrated me from a work side was maybe one of the parts that led to my depressions last year.</comment></comment>


North Korea Halts Talks with South Over US-South Korea Military Excercises - <AUTHOR> https://www.cnn.com/2018/05/15/politics/north-korea-suspends-south-korea-talks-us-military-drills/index.html <comment><AUTHOR> Reuters is also reporting: [https://www.reuters.com/article/us-northkorea- missiles-south...](https://www.reuters.com/article/us-northkorea-missiles- southkorea-talks/north-korea-suspends-talks-with-south-scheduled-for- wednesday-idUSKCN1IG2ZI)</comment>


Ask HN: Is there a tool to follow public activity of celebrity/entrepreneur,etc? - <AUTHOR> <comment><USER2> Set up a Google News alert. It will send you an email every time the person is mentioned in the news.

</comment><comment><USER3> twitter?</comment>


Struggle with Self-Control? Take Yourself Out of the Equation - <AUTHOR> https://www.nytimes.com/2018/06/10/smarter-living/improve-self-control.html <comment><USER2> When I was a kid, we simply didn't have dessert after meals. Ever. Everyone was skinny.</comment>


Pence Will Control All Coronavirus Messaging from Health Officials - <AUTHOR> https://www.nytimes.com/2020/02/27/us/politics/us-coronavirus-pence.html <comment><USER2> I expect that the US public will be unable to trust the US Government during this outbreak. I'm hopeful that experts like the CDC and other public health officials "leak" information to the Internet or elsewhere so the public can find out what's going on in their country.</comment>


Beyond Heatmaps: Visualizing Eye Tracking Data - <AUTHOR> http://www.gazehawk.com/blog/beyond-heatmaps-visualizing-eye-tracking-data/

<comment><USER2> If you are interested in eye tracking and HCI it's worth reading up on saccades (<http://en.wikipedia.org/wiki/Saccade>) and eye tracking (<http://en.wikipedia.org/wiki/Eye_tracking>)

I didn't do much HCI but worked with some HCI labs that did saccade analysis with photography and photo manipulation. Fascinating stuff.

</comment><comment><USER3> I think what's missing in the formatting is the dimension of "time" - I noted this on the article comments as well.

I'd love to see an animation that reflects the visual attention of multi-user studies across time span.

Throw out the noise, give an "average" of how and when users see each page element and then you're solving not only for the "where" but also the "when".

That's a crucial piece of data in trying to solve for user abandons, etc.

<comment><USER4> (GazeHawk intern here.) That's definitely a good approach if you presuppose the existence/obviousness of distinct page elements, which is a whole beast in and of itself.

Right now we allow our customers to define "Areas of Interest" in our reporting system, and we immediately display statistics like average user time on area, average rank of area (ie how many other areas, on average, did users look at first) and so forth. However, it's unclear to me how to represent these numbers in a visually intuitive way in the case where there are 50 distinct areas.

One possibility we're exploring is coloring different areas with different intensities based on some index composed of these features. However, it's not clear what the right formula for this index is, or if it's the same in all situations.

</comment></comment><comment><USER5> Am I the only one who looked at this title and thought they were talking about hurricanes? Seemed topical...</comment>


Octant: A tool to help devs understand what's going on in a Kubernetes cluster - <AUTHOR> https://github.com/vmware/octant <comment><USER2> How does this differ from the official Kubernetes web dashboard?

[https://kubernetes.io/docs/tasks/access-application- cluster/...](https://kubernetes.io/docs/tasks/access-application-cluster/web- ui-dashboard/)

<comment><USER3> Explanation by the co-authors here: [https://twitter.com/mlbiam/status/1159164155255021569](https://twitter.com/mlbiam/status/1159164155255021569)

</comment></comment><comment><USER4> why does it start up on a _random_ port, which is different each time? and it's not configurable? that makes it a real pita to run in a docker container...which is kind of the environment.

<comment><USER5> (i'm the author)

We had a choice to make. We could have used a port, but then would have had to find a solution for when that port was used. So the choice was made to use a random port.

<comment><USER4> i think you should re-consider this choice for a few reasons. \- every software has to do this, and they pretty much just do it and make it an option to configure. \- just assume folks will run this in a docker container and it becomes an entirely mute point. \- you have literally ostracized your core audience by making it impossible to run in a docker container.

just some thoughts. wish i could try it, but i'm not firing up my linux vm just to do so, knowing I can't run it reliably anywhere (because if it's choosing random ports, how will i now it won't randomly conflict with something?)</comment></comment></comment>


Let's Encrypt: Looking Forward to 2019 - <AUTHOR> https://letsencrypt.org/2018/12/31/looking-forward-to-2019.html <comment><USER2> The thing that has always impressed me the most about Let's Encrypt has been Boulder (their CA server). Not for its code quality, but the fact that they have been able to create a fully transparent, open-source CA server that meets the Web PKI and the CA/Browser forum's baseline requirements.

Most of the time in incredibly regulated sectors, most of the products you see are huge, proprietary, and generally crap. It's such a rare treat to see a nice, simple thing that works in such a bureaucratic environment.

It really shows that Let's Encrypt are completely driven by wanting this thing to exist and be amazing, since they will slog through all the baseline requirements to get there. Most other open source initiatives fail when they reach the compliance stage because the work just becomes completely not fun.

Kudos to all the people at Let's Encrypt, and I wish y'all a very happy new year!

<comment><USER3> I wouldn't call Boulder Open Source, but rather Libre as it is under MPL 2.0, a file level copyleft license.

<comment><USER4> What definitions of open source have any traction that the MPL, any version, is excluded?

<comment><USER3> Open source as a term was popularized as a way to promote licenses that are not "viral" (aka requires release of modified versions of code). This is why many developers default to the BSD license and similar, despite how it allows others to come along and close up their work, like what Sony did with the PS4.

</comment></comment></comment></comment><comment><USER5> Let's Encrypt is awesome—it's great to be able to not have to deal with buying and renewing certs, and I think the ease of doing this now is great for securing the Web. It's great to hear that they're spinning out ISRG as a separate organization to do the same thing for other parts of the Internet.

The only thing that worries me about LE is that it's almost _too_ easy. What happens when 90+% of the Web is running certificates from the same issuer? Are there any plans to run alternate free ACME CAs to prevent Let's Encrypt from becoming a single point of failure?

<comment><USER6> > _The only thing that worries me about LE is that it 's almost too easy. What > happens when 90+% of the Web is running certificates from the same issuer? > Are there any plans to run alternate free ACME CAs to prevent Let's Encrypt > from becoming a single point of failure?_

Not that I've given it deep thought, but do you think their core strategy would fundamentally make it easier for a second wave if it ever came to that? Compared to traditional CAs Let's Encrypt is all about automation and rapid expiration, and they've not only built significant open source tools to that effect but also gotten the community used to operating that way. At least at a high level it seems like they had a steeper hill to climb just in terms of being quite different from before, but now that the standards have improved and practices are in place it'd be a lot easier for everyone to simply point at new ACME CAs if LE ever went down, and old certificates would then cycle out rapidly and automatically. Obviously actually establishing a good new CA that would be trusted wouldn't be trivial itself, but it's also more abstracted from the end user then before. And there are major entities that could step up in an emergency.

I may be missing something here, but at least my feeling has been that LE is not merely providing a good service for now, but permanently improving the entire ecosystem in a lasting way and that if root forbid a meteor hit them or something it'd still be possible to recover better then before.

<comment><USER7> Absolutely. Not only has it encouraged other capable companies to start their own CAs, switching between CAs will pretty much be a endpoint configuration. Think that's already the case with the test vs production server, no reason it can't point anywhere else.

</comment></comment></comment><comment><USER8> _We pride ourselves on being an efficient organization. In 2019 Let's Encrypt will secure a massive portion of the Web with a budget of only $3.6M. We believe this represents an incredible value and that contributing to Let's Encrypt is one of the most effective ways to help create a more secure and privacy-respecting Web._

That is incredible!

<comment><USER9> A focused non-profit attacking a real problem can be extremely effective. I hope the rich tech people on HN strongly consider building or donating significant amounts to tech non-profits and open source. Certainly this is more impactful than another advertising network investment.

<comment><USER10> The concern I have is that these vital non-profits (one might say critical infrastructure, depending on the org) have to go hat in hand to the community each and every year for their operating funds, whereas if they had an endowment or some other investment account backing them, they'd be able to survive in perpetuity.

At a 4% withdrawal rate, Let's Encrypt would need $100 million invested to not need to ask for funds in the future (assuming they don't drastically increase their operating expenses).

Governance and oversight is mandatory though; Wikipedia has net assets almost near $113 million [1] and requires less than 600 servers to operate (plus colo costs, connectivity, technical staff, etc). On the other end of the spectrum, OpenStreetMap costs $118k a year to operate [2].

[1] [https://en.wikipedia.org/wiki/Wikimedia_Foundation](https://en.wikipedia.org/wiki/Wikimedia_Foundation)

[2] [https://twitter.com/floledermann/status/1057254329290235907](https://twitter.com/floledermann/status/1057254329290235907)

<comment><USER11> > whereas if they had an endowment or some other investment account backing > them, they'd be able to survive in perpetuity

There's a strong argument that entities like Wikipedia having to constantly go back to the community trough to survive, assists in keeping them well behaved. I prefer to keep Wikipedia begging and slightly desperate, rather than obese, detached, entitled, crusty and overly bureaucratic.

The user community that funds them can kill them off through funding deprivation in a short amount of time if Wikipedia decided to become a scumbag. Their annual cost to operate has perpetually increased, it's closing in on $100 million now (three or four more fiscal years at the rate they've been increasing it). They wouldn't survive long without the donations flowing in every year. They could plausibly make a large deal with eg Google on advertising if the user funding dried up due to bad behavior, however that would just be more likely to accelerate their implosion.

It's dangerous to the mission of a charity / non-profit to hand it a position of certain financial perpetuity. All organizations are very much susceptible to bureaucratic creep and wandering off mission in such situations. It's why many of the great philanthropists (Buffett, Gates and Carnegie to name a few) have sought to expend their fortunes relatively rapidly in charity rather than have the charitable trove exist in perpetuity via a perma-institution for parasites to attach to over many decades.

<comment><USER12> This is a great comment and a really valuable perspective. I have to note, however, that financially precarious nonprofits can also veer off in bad directions, or become ossified, or whatever, and the result is they fail outright.

A benefit to Wikipedia's situation is they go directly to their user base for funds. When nonprofits are financially precarious or dependent and rely on small numbers of moneyed donors, they can just as easily go off mission and/or become corrupted.

<comment><USER13> > When nonprofits are financially precarious or dependent and rely on small > numbers of moneyed donors, they can just as easily go off mission and/or > become corrupted.

What you're describing is exactly the situation that Mozilla has been in for the last decade or so, and I always feel a little uncomfortable about it. The vast majority of their income is from search deals with one or two vendors.

</comment></comment></comment></comment></comment></comment><comment> move-on-by > The [BGP hijacking] solution we intend to deploy in 2019 is multi- > perspective validation, in which we will check from multiple network > perspectives (distinct Autonomous Systems).

This is really exciting. The CloudFlare BGP hijack and subsequent attack of myetherwallet.com could have been much more successful if they had also been able to get a valid certificate. Having this multi perspective feature would make it even harder to get a valid cert during a BGP hack. Of course those falsely attained certs would still be logged publicly in a certificate transparency log- but better the cert never gets created to start with.

> We had planned to add ECDSA root and intermediate certificates in 2018 but > other priorities ultimately took precedence.

I was particularly looking forward to ECDSA. Not for any real reasons other then I want to try it out. I currently have their 4096 bit RSA cert on a raspberry pi and the SSL negotiation is particularly slow according to Newrelic. Im curious to see how EDSA performs on a raspberry pi.

<comment><USER14> You would get a significant speed-up just going to 2048 bits RSA. EC would be even faster but slightly more work. You don't need 4096, unless somehow your Raspberry Pi is the target for a powerful adversary and you don't rotate the keys (like a CA). The Let's Encrypt defaults auto-rotate keys on each renewal.

Note however that you can go to EC today. Your device doesn't care about the CA keys, so those still being 4096 bit RSA makes no major difference to you.

<comment><USER15> > Your device doesn't care about the CA keys, so those still being 4096 bit > RSA makes no major difference to you.

Your device _does_ care about the CA keys, because it has to validate the certificate chain. But the Let's Encrypt CA uses a 2048-bit RSA key, regardless of the size of the key you're using.

<comment><USER14> The client cares but the server needn't, and since they're saying it needs a certificate from Lets Encrypt I presumed it's a server.

For a server the certificates are just a pile of bits to be transmitted. Server software could be introspective but in general it isn't, e.g. it doesn't do AIA chasing.

But you're correct that I had misremembered the root as being 4096 bit and it's actually 2048.

</comment></comment></comment></comment><comment><USER16> _"We are also planning to introduce a Certificate Transparency (CT) log in 2019. All certificate authorities like Let's Encrypt are required to submit certificates to CT logs but there are not enough stable logs in the ecosystem. As such, we are moving forward with plans to run a log which all CAs will be able to submit to."_

I'm glad to see that they're prioritizing this. Not a giant leap but still an important step for ensuring the stability of the CT system and the trustworthiness of the CA system.

</comment><comment><USER17> I absolutely adore what Let's Encrypt has done for the Web, and I proudly wear the hoodie they gave my company for our sponsorship. It's amazing what a company of 11(?) people can do, most of which probably don't even do any development.

However, I really think that they need some (free) competition --- their market domination is becoming a little extreme. Someone else offering free certs via the ACME protocol would be nice

<comment><USER18> I very recently learned that BuyPass (a paid CA) now offers a version of their DV product via ACME

[https://www.buypass.com/ssl/products/acme](https://www.buypass.com/ssl/products/acme)

The way that I learned about this is that acme.sh (the awesome ACME client by Neil Pang) announced support for BuyPass alongside Let's Encrypt:

[https://github.com/Neilpang/acme.sh/wiki/BuyPass.com- CA](https://github.com/Neilpang/acme.sh/wiki/BuyPass.com-CA)

Obviously this is really great in every respect, including a potential opportunity for finding compatibility bugs with ACME implementations.

So perhaps what you were hoping for has already happened!

(Edit: also, thanks for your support for Let's Encrypt!)

(Further edit: apparently the BuyPass ACME certs are valid for 180 days, as against Let's Encrypt's 90 days, but only let you list approximately one domain per cert, as against Let's Encrypt's 100 domains per cert. [https://community.letsencrypt.org/t/acme-sh-supports-tls- alp...](https://community.letsencrypt.org/t/acme-sh-supports-tls-alpn-mode- and-buypass-com-ca-now/81114/4) It's still awesome to see more options for ACME support and definitely makes it more credible that it wouldn't be as serious a problem if Let's Encrypt went away some day for some reason.)

</comment></comment><comment><USER19> Those statistics are unbelievable! That is a huge portion of the internet that went to https.

If anyone from LetsEncrypt is reading, I just want to say thanks. Your tools have enabled me to quickly and easily set up encryption for several domains and sub domains.

And your documentation is great. Being able to select an operating system then a server and receiving crystal clear instructions on how to proceed is fantastic for a non devops guy like me.

Moving forward easily and painlessly will absolutely never be underappreciated on my end. Thank you!

</comment><comment><USER20> Encryption related things I'd like to see become easier (not free):

* Code signing, particularly driver signing on Windows (thanks for making this very difficult for open source, Microsoft)

* Script signing, a-la Powershell AllSigned mode (even though it's caused me pain in the past and needs better IDE support)

</comment><comment><USER21> Not only they are free of charge, but Let's Encrypt certificates are some of the most technically featured ones too.

\- Embedded SCTs, so you don't have to worry about certificate transparency.

\- Must-stable flag support.

\- ECDSA leaf certificates.

Digicert is doing an excellent job too, although expensive, trying to push the tech forward with new flags such as signed HTTP exchange, but LE is not only free, but they are _better_ in many ways.

<comment><USER22> "Must-staple"

<comment><USER21> Thanks, yep I should've double checked for typos.

</comment></comment></comment><comment><USER23> Point to note, VPS service like Bluehost have started providing Let's Encrypt SSL certs to all domains by default requiring no further effort. I hope others such as Hostgator, InMotion Hosting etc. follow the suit.

<comment><USER24> Supposedly CPanel has LE support nowadays, so most companies should get it when they upgrade.

<comment><USER23> Yes, the user can upload a certificate via CPANEL manually using a service such as Zero SSL; but bluehost does those automatically & there's no action needed for updating the certificate every 3 months (as is the case when done via cpanel) in VPS.

<comment><USER24> No, I'm not talking about manually uploading a cert; I'm talking about AutoSSL, their feature that automatically requests and installs an LE cert: [https://blog.cpanel.com/announcing-cpanel-whms-official- lets...](https://blog.cpanel.com/announcing-cpanel-whms-official-lets-encrypt- with-autossl-plugin/)

<comment><USER23> Good to know, thanks.

</comment></comment></comment></comment></comment><comment><USER25> Let's Encrypt is one of the best things that has happened to the Web in the last few years. Everyone wants (and needs) SSL/TLS, and there was no reason for companies to be charging so much for the service. Kudos to the authors and maintainers of something that saves so many people time and money each year.

</comment><comment><USER26> > The feature we're most excited about is multi-perspective validation. > Currently, when a subscriber requests a certificate, we validate domain > control from a single network perspective. This is standard practice for > CAs.

I wonder how many other CAs do this as well? The third sentence suggests few.

<comment><AUTHOR> The third sentence means it is standard practice to validate from only a single network perspective today.

I have heard we would not be the first CA to do multi-perspective validation, but as far as I know we would be the only CA of significant size doing it. I do not know of other CAs doing it today, but we have not done an exhaustive survey.

Also, architecture and implementation details matter for this kind of feature. How many perspectives, what networks... We are lucky to be working with a great group from Princeton that has been helping us design our implementation.

</comment></comment><comment><USER27> Lets encrypt should get involved and get the starttls-everywhere project happening like they did for the web.

[https://starttls-everywhere.org/](https://starttls-everywhere.org/)

</comment><comment><USER28> Other than SSL are there any other parts of websites and web presence that are relatively expensive now and could be done pro bono non profit? Maybe a TLD domain that would be absolutely free??

<comment><USER29> Well, .tk[0] is a free TLD, but it's not specifically non-profit.

[0]: [http://www.dot.tk](http://www.dot.tk)

<comment><USER30> They tend to hijack domains when they get popular.

<comment><USER16> I remember punk bands/fanzines using .tk back in the early 00s. I'm quite surprised they're still around :)

</comment></comment></comment></comment><comment><USER31> What happened in June/July? It looks like they had 50% growth in those two months alone.

<comment><USER32> If I had to guess, it's probably related to Chrome marking HTTP sites as "Not Secure" in July 2018. A lot of sites were probably scrambling to get certificates before Chrome 68 was released.

[https://www.neowin.net/news/chrome-68-will-mark-http- website...](https://www.neowin.net/news/chrome-68-will-mark-http-websites-as- not-secure)

</comment></comment><comment><USER33> > multi-perspective validation

This one caught me by surprise earlier in the year. When I was building some new infrastructure to support HTTP-01 validations in a multi-region deployment (routed using least-latency), one day I suddenly started seeing what looked like multiple validation requests hitting my EU deployment. Had me very confused for a few minutes, first thinking my logging infrastructure was suddenly very broken, or I had somehow configured my load balancers to cross regions, except the requests were coming from many different public addresses.

After some more minutes of digging and I found out about multi-perspective validation on the staging environment.

Anyway, good idea. And it seems to work from what I've seen. It seems just a surprise when it turned on while I was literally working on code/infrastructure to handle validations.

</comment><comment><USER34> Getting a free wildcard from them has made my whole setup so much nicer and more dynamic. I absolutely love it.

</comment><comment><USER35> Let's encrypt is one of the best things to happen to the web recently. Great stats.

</comment><comment><USER36> Let's Encrypt and certbot have made my sysadmin life so much easier by allowing me to manage certificates within the terminal and without having to deal with annoying CA UIs that try to sell you tons of stuff you don't really need.

And all that for free!

If you are a regular user, please consider donating to the cause: [https://letsencrypt.org/donate/](https://letsencrypt.org/donate/) You can make a one-time donation or set up a recurring one.

</comment><comment><USER37> $3.6m budget, I love this. For the impact they've made, this an extremely efficient. If a government program tried to do the same thing we'd be talking billions.

</comment><comment><USER38> great service to public</comment>


Clang Is Now Used to Build Chrome for Windows - <AUTHOR> http://blog.llvm.org/2018/03/clang-is-now-used-to-build-chrome-for.html <comment><USER2> Have seen a couple interesting articles[0][1] highlighting the weirdness of building Chromium on Windows, so hopefully this LLVM improvement will be a step towards a smoother process.

[0] [https://randomascii.wordpress.com/2018/02/25/compiler-bug- li...](https://randomascii.wordpress.com/2018/02/25/compiler-bug-linker-bug- windows-kernel-bug/)

[1] [https://randomascii.wordpress.com/2017/07/09/24-core-cpu- and...](https://randomascii.wordpress.com/2017/07/09/24-core-cpu-and-i-cant- move-my-mouse/)

<comment><USER3> Hey, those are mine! Those two issues (and this one: [https://randomascii.wordpress.com/2018/02/11/zombie- processe...](https://randomascii.wordpress.com/2018/02/11/zombie-processes- are-eating-your-memory/)) are equally problematic with clang. Two of them were problems with Windows, and one was a flaw in a Microsoft system management component.

Luckily they are all mitigated, fixed, or being fixed, so my Chrome builds run much more smoothly now.

<comment><USER2> Thank you for chiming in! Your articles are wonderful!

</comment></comment></comment><comment><USER4> We first started fiddling with Clang for Chrome in late 2010: [http://neugierig.org/software/chromium/notes/2011/01/clang.h...](http://neugierig.org/software/chromium/notes/2011/01/clang.html)

The original work was just finding bugs in the codebase and compiler. It's gone so far!

</comment><comment><USER5> > if your project is Windows-only, you can get a second compiler's opinion on > your code, and Clang's warnings might find bugs

GCC (mingw.org and mingw-w64 triples) has existed and been able to do this, including and especially cross-compiling, for a long time. No need to manually download a Windows SDK either.

edited to add: to be fair, it's not ABI compatible with MSVC. But it deserves a mention and it's an easier option than MSVC-style build systems for many open source projects.

<comment><USER6> mingw-w64 llvm maintainer/developer here.

Over the past 2-3 years, with great help from a few other LLVM devs I have slowly pushed for native clang support for mingw-w64. With the current in tree HEAD you can now build and bootstrap mingw-w64 with a llvm-only toolchain (no binutils or gcc, thus no disregard of the PECOFF SPEC)

The stack is as follows. LLVM+CLANG+LLD+COMPILER- RT+LIBCXX+LIBCXXABI+LIBUNWIND+MINGW-W64.

The libraries and executables built this way can be dropped into visual studio quite easily, the two environments are now basically interchangeable. This also means we can borrow the PDB debugging work by Zachary Turner and/or any msvc features added to llvm for free that was done by the various googlers working on chrome. See a talk from Reid on the most recent LLVM developer meetup for more info on PDB and how it works. There has been no formal release of this environment yet but you should see something in the coming weeks/months. I keep build scripts here for those interested.

[https://github.com/martell/mingw-w64-clang](https://github.com/martell/mingw-w64-clang)

I'm due another cleanup of the repo now that wine 3.0 is out so I can actually run x64 tests within a linux docker container. I'm going to be doing some blogging to make this more visible with various partners that want to support this.

The most interesting part of this for me was implementing a llvm-dlltool alternative to binutils dlltool that actually works within the PECOFF spec so msvc lib.exe and link.exe likes what it produces.

[https://reviews.llvm.org/rL308379](https://reviews.llvm.org/rL308379)

<comment><USER7> This sounds great, it's been a long time coming and I'm sure many people will appreciate being able to debug their mingw generated executables in Visual Studio.

I did all of the PDB stuff in LLVM, happy to help if you need it (ping me on the mailing list or IRC)

<comment><USER6> Updated the comment to reflect this. :) Thanks for all the good work. Will ping you when I move onto that stage for support.

</comment></comment></comment></comment><comment><USER8> > On the other hand, if all platforms use the same compiler, if it builds on > your machine then it's probably going to build on all platforms.

This also works the other way: buggy code that "works" in Clang may now go unnoticed.

This means it will be harder to build Chromium using GCC or MSVC. I see that Arch Linux already has to depend on Clang to build Chromium [1], which isn't very reassuring.

[1] [https://www.archlinux.org/packages/extra/x86_64/chromium/](https://www.archlinux.org/packages/extra/x86_64/chromium/)

</comment><comment> Ono-Sendai Great work by the Clang team, well done!

I'm a bit surprised to see that build times in Clang are worse, and that resulting binary performance is comparable.

Maybe that will change when the Clang build starts to use LTCG, as the article mentions.

<comment><USER9> Yeah, just things that aren't optimized yet. Windows headers, etc have very different hot spots and need different paths to be fast than linux/mac ones.

For reference, in distributed builds, the build times are ridiculously faster using clang. (it shaves many hours off the time).

<comment><USER10> Is that due to the use of PCH in MSVC, so the hotspots only happen if the headers change?

What does clang offer in this regard? Is incremental build sufficient?

<comment><USER9> No, clang offers precompiled headers as well.

It's literally things like "parsing large numbers of pragmas is slower in clang because nobody has bothered to optimize it".

This is not uncommon for very different codebases.

Clang was, for a long time, many times slower at compiling the linux kernel, for example, because the linux kernel headers have a _huge_ amount of inline assembly and nobody ever bothered to optimize the parsing paths for inline assembly. (now somewhat fixed).

This is just the very typical "hey, when you change the use cases dramatically, you may need to retune/rethink how certain things are done"

I think people just may not realize how wildly different these types of codebases are in what types of statements/things occur.

</comment></comment></comment></comment><comment><USER11> I didn't realize that clang is mostly a drop in replacement for cl, and matches the C++ abi. That in of itself is awesome.

<comment><USER3> clang isn't. clang-cl is (after years of work by the clang-cl team at Google). They had to do a lot of work, especially around PDB (symbol-file) generation.

<comment><USER7> More precisely:

clang-cl is a drop-in replacement for cl (even the command lines are the same).

But clang-cl is just a driver for clang, and it's still possible to get the ABI compatibility without clang-cl, but you have to know what you're doing and get the flags right.

</comment></comment></comment><comment><USER12> For those interested in Clang history, here's Chris Lattner giving a tech talk at Google introducing LLVM and Clang.

[https://www.youtube.com/watch?v=029YXzHtRy0](https://www.youtube.com/watch?v=029YXzHtRy0)

The Clang discussion begins at 18:53

</comment><comment><USER13> Interesting. It seems Google is moving away from anything gpl/gnu lately (fuchsia, etc...)

<comment><USER14> I think it is mainly due to their concerns over the Tivoization clause which is added to GPLv3

<comment><USER9> Again, no, we didn't care.

First: We were already publishing all our GCC changes, as we did all our work upstream (we worked on a staging branch in the gcc repo, and changes were moved to trunk as fast as possible) Plenty of other companies used our branch and we were happy with it.

We do all our work upstream for clang/llvm as well, and pull compiler releases when upstream is green according to our internal testing. (Pretty much the only cherry picks are a small number of reverts sometimes)

Second, literally nobody has ever come and expressed a concern about using GCC to me.

I've had to explain the runtime and libstdc++ exceptions to people, but that was the other way around -- They weren't worrying, and I needed to make sure they worried and shipped source when they ship it as a .so.

</comment></comment></comment><comment><USER15> With Microsoft producing MSVC/C2 compiler with Clang frontend, I am surprised they did not abandon the MSVC at all - they have a hard times even at supporting C99, not to mention modern C++ technologies. And all those tools and plugins built around Clang/LLVM. MSVC is a legacy of XX century and should be abandoned for good.

<comment><USER16> They don't have any hard time supporting C99, from Microsoft point of view C is done, time to move on to C++.

> We do not plan to support ISO C features that are not part of either C90 or > ISO C++.

[https://herbsutter.com/2012/05/03/reader-qa-what-about-vc- an...](https://herbsutter.com/2012/05/03/reader-qa-what-about-vc-and-c99/)

All the updates regarding C99 and C11 in Visual C++ are related to ANSI/ISO C++ requirements regarding C compatibility, as Herb states.

Regarding legacy, Visual C++ is one of the top C++ compilers doing incremental compilation and linking, which still beats Rust compilation times on Windows.

<comment><USER17> Microsoft backpedaled not longer afterwards. See, e.g.,

[https://blogs.msdn.microsoft.com/vcblog/2013/06/28/c1114-stl...](https://blogs.msdn.microsoft.com/vcblog/2013/06/28/c1114-stl- features-fixes-and-breaking-changes-in-vs-2013/)

and

[https://blogs.msdn.microsoft.com/vcblog/2013/07/19/c99-libra...](https://blogs.msdn.microsoft.com/vcblog/2013/07/19/c99-library- support-in-visual-studio-2013/)

They even added C99 compound literals and designated initializers:

[https://msdn.microsoft.com/en- us/library/hh409293(v=vs.120)....](https://msdn.microsoft.com/en- us/library/hh409293\(v=vs.120\).aspx)

Compound literals could _never_ be added to C++ because the syntax and semantics conflict with existing C++ constructs.

<comment><USER16> C99 and C11 library support is required by ANSI/ISO C++.

As for the minor language changes, there was a blog post that I cannot locate now, stating it was to the extent required for porting well known projects to Windows, the remaining features would depend on key customers feedback.

</comment></comment></comment></comment><comment><USER18> Who are the "we" they refer to in this blog? Are they Google's devs who build chrome, or are they clang's devs? If they are clang's dev, why are they building chrome? I am completely confused on this one.

<comment><USER19> Google employs a large number of clang devs. I would not be surprised if it was close to 50% of all clang (and LLVM) devs.

</comment></comment><comment><USER20> And why not use mingw gcc? Do they find somthing wrong with it?

Edit Mingw-w64 its quite nice and includes gcc without all stuff cgwin does.

<comment><USER21> Why use it? llvm is the future anyway and lots of players have a stake in it and contribute to it.

In fact, there are way too many c++ compilers if you ask me. I would gladly accept a world where clang is the one and only.

<comment><USER22> >I would gladly accept a world where clang is the one and only.

And luckily you don't have any saying in such matters.

<comment><USER21> Sure. I just vote with my feet, like many others.

</comment></comment></comment></comment><comment><USER23> Last time I tried to build Chrome/Chromium I had to mess about with this build system called Ninja. (Which worked well it was just awkward to set up on Windows). Is that still in play?

<comment><USER24> Ninja is used because it's simple, multiplatform and very fast. The mainstream alternatives offer at most 2 out of 3.

<comment><USER25> "it's simple": yep, so much so that you inevitably need a meta-build system. In the context of Chrome, the build system only offers 2 out of 3.

<comment><USER26> It's by design that you need a meta-build system. Ninja build files were not designed to be written by hand, not even ninja itself has hand written ninja files.

<comment><USER25> Yes, I understand that it's designed that way.

My point was that, in the context of Chrome using ninja, the claim that "Ninja is used because it's simple, multiplatform and very fast. The mainstream alternatives offer at most 2 out of 3." is a bit odd considering that the decision doesn't seem to be ninja vs mainstream alternatives but rather ninja+gn(or gyp or whatever else) vs alternatives.

</comment></comment></comment></comment></comment><comment><USER27> Did the LLVM folks fix the C++ structured exception handling incompatibility between MSVC compiled DLLs/programs and LLVM compiled ones? This was a problem for many years.

<comment><USER28> Yes.

(To the extent possible. There are some edge cases left, but they're _very_ rare. Essentially all the real-world code we've seen works now.)

<comment><USER29> Tried to install Clang 5.0 Visual Studio integration, unfortunately it seems that I need to install VS 2015 (v140) compiler since it doesn't work with VS 2017 (v141).

</comment></comment></comment><comment><USER30> I've tried clang for windows twice. Each time the problem hasn't been the compiler, which works well, it has been which library to use with it on windows. Clang 5.0 worked well up until I needed the filesystem library, which isn't there. Does anyone know if it still relies on the visual studio C++ library?

<comment><USER26> clang-cl is just a compiler. It relies on VS to provide the C and C++ standard libraries. VS 2017 has the filesystem library and it should work with clang-cl 6.

<comment><USER3> To elaborate on that, if you want to build Chromium for Windows you currently still need to install Visual Studio. We don't use its compiler anymore but we use its linker and other tools, its header files, and its libraries. Many Chromium developers also use it for editing code, and for debugging code.

Chrome is currently built using VS 2017 15.3 (that's update 3). Eventually we will probably upgrade to VS 2017 15.7 in order to get more STL conformance, linker improvements, etc.

<comment><USER31> You need the MSVC build tools and the Windows SDK. You don't need the entire Visual Studio.

<comment><USER32> Can you get the VS 2017 build tools separately any more?

<comment><USER33> Yep: [https://www.visualstudio.com/downloads/#build-tools-for- visu...](https://www.visualstudio.com/downloads/#build-tools-for-visual- studio-2017)</comment></comment></comment></comment></comment></comment>


New Study Exposes Gender Bias in Tech Job Listings - <AUTHOR> http://www.wired.com/wiredenterprise/2013/03/hiring-women/

<comment><AUTHOR> I was a bit shocked to see this printed in Wired. They're claiming that "analyze," "determine," "leader," "competitive" and "dominant" are masculine code speak. Am I insensitive for feeling these are gender neutral words?

Full paper at [http://www.fortefoundation.org/site/DocServer/gendered_wordi...](http://www.fortefoundation.org/site/DocServer/gendered_wording_JPSP.pdf?docID=16121)</comment>


When a Prospect Asks for Customization it Means He/She is Not a Real Buyer - <AUTHOR> http://jonsteinberg.com/?p=820

<comment><USER2> When I was in construction, we made most of our profit off changes. Every change has a price tag. Part of the price is how much you want to do the change. Ugly changes don't come cheap. Changes we suggested do come cheap. Any salesman who can't attach a price tag to a change request isn't doing his job.

<comment><USER3> Certainly, with ongoing jobs, this is definitely true. For enterprise software, this customization is basically the bulk of the business.

However, the article is about a product with a single codebase, dealing with _potential_ customers, rather than actual customers. (The auther doesn't specifically spell this out in the article, but that's how I interpreted it) That situation is completely different, as he isn't talking about building customizations into the contract, he's talking about customers who say "add this feature AND THEN I'll buy it (for the original price)."

So you're right, but you aren't talking about the same thing at all, even though it may seem like it at first.

</comment></comment><comment><USER4> I disagree that those aren't real buyers. Many rich people are so used to getting their way that if you won't bend a little and include those windows treatments, they'll just go find someone who will.

Look at it from the other perspective: If the seller will walk away over 1%, they aren't a real seller.

Seems just as likely, doesn't it?

<comment><USER5> This reminded me of awful Craigslist buyers that always seem to be short 20 bucks when they arrive. A slightly different situation since CL scumbags are usually looking for a spontaneous discount of > 10% vs. 1%, but funny nonetheless. I'd stay firm just out of principle, but you don't always have that luxury as a seller.

<comment><USER6> Why would you call them scumbags?

Granted, the buyers are disingenuous, if they truly have the cash and it would be better to phrase discount request differently, but in what world, CL prices are always fixed?

This short 20 bucks technique is a very basic,naive, yet effective negotiating tactic 101, which was taught in all the 70s,80s books on trading (and probably also goes back to Babylon).

If your ad specifically said $75firm then then it is their loss for not reading and trying to negotiate.

If however you didn't specify a firm price, then in person to person dealings a little haggling is expected. Not fair to call a person a scumbag then.

Most of the time you should be the one with the power since the buyers have to come to you and your loss of time is less than theirs, if the deal does not close.

<comment><USER7> I'd call them a scumbag if they said on the phone, "yeah, I'll pay $100," then show up with $80 saying they were short. They hope you take the deal to just be done with them. Yes, it's a sometimes effective strategy, but still scummy in my opinion to say one thing and then make another lower offer at the last minute.

<comment><USER5> Bingo -- this is exactly what they do. I consider this a serious angleshoot because we agreed upon a price and this is to me a verbal contract. To have someone fudge the terms of the contract by taking advantage of a 11th hour switch is unethical IMO. I would much rather send them on their way out of spite, and I'll have a grin knowing that they wasted $4.00 of gas to walk away empty handed.

</comment></comment></comment></comment></comment><comment><USER8> If your product integrates with existing systems in any way, or even is still just a fairly minimal product, this doesn't really apply. You can have clients who are willing to pay for example for reports your product generates, but it's useless to them unless your product accepts data from one of their systems. You still need to prioritize requests, but to say they're not real buyers is extreme. If you don't believe they'll really become clients, that's what contracts (and maybe letters of intent) are for.

</comment><comment><USER9> There are certain customers and prospects, and certain industries, where this is endemic, where you just have to stop listening to customers. Sometimes they actually do not know what they want/need. If you faithfully log feature requests, you might find there is very little commonality. If you still have a customer base, it just might mean you actually serve your target audience/industry something useful.

</comment><comment><USER10> Working in a customer-facing position, I have a hard time not wanting to champion every legitimate feature requests that comes in. However, I've learned that if I want to get engineering to work on something when it really counts, I have to be very judicious about what I send their way.

Thankfully, having a product with multiple customization options (API, plugins, javascript and CSS), I can always give the customer the opportunity to write their own feature, and if it's simple enough, I'll just write some code and do it for them.

</comment><comment><USER11> Our experience with the software engineering tool PREfix in the 1990s was very different. our $4 million site licencse with Cisco depended on customization and so did several other $100k-plus deals. When the customer's needs are slightly different than your offering, you can either say "no" and walk away, or work with them to come up with something that works for both of you -- which may not be possible or worth doing, but it's at least worth exploring.

Agreed though with Earl's point about "don't do business with dicks"

</comment><comment><USER12> The author seems to think that people who are nitpicky before sale use their feature requests as a way to avoid making a purchase.

The solution, from my perspective, is to have individual feature requests be bankrolled by the requestors. Tie features directly to dollar amounts, and ignore the totally oddball. Or you could price them to the point that the customer wouldn't buy them (or you're laughing yourself silly all the way to the bank when they do).

<comment><USER4> People frequently do this and it can lead to feature creep. You can easily end up with a product so complicated that the general user is turned off by the interface.

I think it's important to decide whether you want to be a powerhouse that can do everything, or a very simple tool that does 1 job really well... Or exactly where you want to be between those 2 extremes.

I don't have a problem with turning down small customers that want custom changes, but when that customer comes along that is as big as all your other customers combined, you almost have to agree to what they want.

<comment><USER13> Customization can actually be an important part of a business model. The problem is how to behave when it's not part of it, and here I agree with the author, the customer is asking for "something else".

I've been in a startup that used to say yes to every stupid request possible to get a customer and yes, it destroyed the product, because we had some general and generic features available to everyone and a lot of stuff that was very specific and not reusable. This means that even if you get the client, you're raising maintenance and development costs (and probably performance - if it's very specific if/else are your friends) without investing in your product and in future clients, and this is _very_ bad for a business, because the customer _owns_ the product and you don't.

Actually, I believe it's the single worst thing that can happen to a startup - case is, it always happen when who is in charge is not a tech guy but a seller, and the reason is that while costs are hidden to his eyes (developers do weird things in dark rooms) the benefits are high.

Unfortunately, you're gonna pay such decisions sooner or later :)

</comment></comment></comment><comment><USER14> I don't think it is as black and white. It could be a signal that they aren't a real buyer, or it could be a signal that they do want to buy.

This is what I say when a potential customer of significant value asks for a feature. "That is an interesting feature. That is the first time someone has requested that feature. I think it might have some value in our core code base and other customers might find it useful. I can build the requirements for the feature into your PO. I'll find out when we can deliver that functionality and we can start working on it as soon as the PO is signed."

</comment><comment><USER15> This is open to interpretation. I would say a customer who comes along asking for something you don't already have may present itself as an opportunity. If, in fact, you're already planning to do X and X is the thing the potential customer is asking for and you charge him double what it would have cost you to build it anyways (and it was in your list of "features" all along), then why wouldn't you? It ends being "free" money and you land a new satisfied customer.

While I agree with the article, there are, as always seems to be the case, many exceptions.

</comment><comment><USER16> From the article: "My father has had prospective buyers of multi-million dollar apartments threaten to walk away from a deal because of an additional $10,000 in closing or alteration costs at the 11th hour." And you have a problem with that? Seriously?

I have a hard rule that after many painful lessons is now inviolable. Every single time I've broken this rule it's hurt. Don't do business with dicks. If we negotiate a contract and you toss in another $10k at the last second? Hell, I don't care if you try, but the answer is absolutely not. We had an agreement, you changed it, the answer is no.

If that answer doesn't satisfy them, well, they already lied to me once. They're dicks. I don't know what else they're going to try to screw me on, but they already tried once and are going to try again. The only answer to someone tossing an extra $10K in and daring you to walk away by saying you're not a buyer is tell them they're assholes and you'll never do business with them again.

Life is too short to have dicks in your life trying to screw you at every turn. If someone isn't honest, drop them and count yourself lucky.

<comment><USER17> _We had an agreement, you changed it, the answer is no._

No, you don't have an agreement (morally or legally) because you haven't signed the contract yet. There's a reason courts place such high emphasis on having a written agreement: they leave little room for assholes to alter the deal after the fact.

Does adding in extra costs at the last minute make you a shrewd negotiator? Perhaps. Unprepared? Probably. But does it make you a dick? Not by itself. If you have a deal in writing and someone throws in extra expenses after the fact, then they're an asshole. And you have recourse.

<comment><USER18> No, if you have a written deal and someone throws extra expenses, they are breaking the law and they are IDIOTS, not assholes.

If you have a verbal agreement and someone tries to push a last minute scam like this, they are dicks and they CANNOT be trusted. Thus, you should walk/run away.

(I remember pg mentioned this in a post about VCs..)

____

Edit: It wasn't pg but jacquesm:

<http://jacquesmattheij.com/How+To+Sell+Your+Company>

"...Lo and behold, they actually tried to change one of the material terms of the deal AT CLOSING. These folks were not to be trusted at all. We immediately said "GOOD BYE!" and hung up the phone..."

</comment></comment></comment><comment><USER19> This is really not a problem. All you need to do is get this client to sign a contract before you make any changes and everyone can get along just fine.

<comment><USER20> The other word for "signing a contract" is "buying". Have you had a lot of luck getting customers to casually sign contracts before making a purchasing decision?

Lots of companies play games with contingent contracts (especially with first lighthouse customers). But the phenomenon this post is talking about seems pretty clear: the people who say "Can you implement X, and then we can talk more?".

Just the fact that you brought contracts into this seems to me to confirm his point.

</comment></comment><comment><USER21> That's funny. If they're not a real buyer, does that mean I don't have to declare it as a real income?</comment>


Ask HN: How do you get better at coding? - <AUTHOR> I'm trying to get insights from developers for a school project on how they get better at coding.
The survey below contains just 6 simple questions to answer. Or just answer here. THANK YOU!
https://goo.gl/forms/emc16fdMC8UkTYYh1 <comment><USER2> I get better at coding by coding.

No, really. You can read all the books, blog posts, open source code samples you want, but nothing will substitute writing code.

I maintain a handful of side projects as well as write code daily for my job. Plus, I love it. Also, my side projects usually encompass something I have no idea how to do, which quickly elevates my skill level. I love learning, so it works for me.

<comment><USER3> I think I "read" about programming for something like 15 years (books, blogs, HN, proggit, irc chat)

I started actually _coding_ seriously and properly the past 1-2 years. Easily learned a hundred-fold more by doing it, literally.

I think too often I told myself I'm "not good enough to make something serious". And you know -- it was probably true. But _that doesn 't matter_. Just start, things will fall into place, sometimes you'll fail, sometimes you won't. It's just the only way really.

<comment><USER4> > I think too often I told myself I'm "not good enough to make something > serious". And you know -- it was probably true. But that doesn't matter. > Just start, things will fall into place, sometimes you'll fail, sometimes > you won't. It's just the only way really.

it's not true, most "serious" things aren't that difficult or complex

</comment></comment></comment><comment><USER5> I write code on personal projects every day. Sometimes when time is an issue it's just a single line bug fix or an update to some documentation, but regardless I get a little green square on my Github graph _every day_. It has two important effects. Firstly, it means I have to keep coming up with new things to write code for to stop it getting boring, so I explore a new things a lot. Secondly, it's made me think about how I can stop wasting time when I code, and how I can use my tools better. I've been doing it for about 200 days now, and I've definitely improved already (this is after being a developer for 20 years so far).

</comment><comment><USER6> Practice.

1\. If I'm learning a new language, I pick a topic I know well and try to apply it in the language. Typically the first pass is nonidomatic, and I iterate as I learn more about the language. 2\. If I'm learning a new algorithm, I use a language I know really well. 3\. If I'm learning a new framework, I pick a smallish project and dive in.

Most of it is throw away, and I've found that takes a lot of pressure off.

</comment><comment><USER7> The one thing I've figured out over the years is to not make your goal be "be great at coding". That's an ambiguous goal, and it's easy to move the goalposts on that one. I find that that kind of goal encourages a narrow, syllabus-y definition of learning that doesn't encourage the kind of trial- and-error that's crucial to grokking the difficult parts of programming.

Instead just learn how to solve your actual problems or entertain yourself using programming /today/. Making your friends websites, making games for / with your kids, making an app to water your plants, making spreadsheets to manage your finances, automating that annoying manual thing you do at work, making goofy software that converts images to pixel art, whatever floats your boat.

You have to make a lot of bad things to start making good things. So start making bad things, and enjoy it while you're at it - I've made my fair share.

Do a little bit of programming every day. Do it for now, and not for later. Set yourself a direction every so often, but not much more than that. Review your own work and see what was not great, and figure out what to learn next to make it better. Show your work to other people and ask them for help, or enjoy together. It's much more pleasant to look back later and continually be surprised how far you've come.

</comment><comment> yoz-y Your questionnaire is missing a few important questions (in my opinion). You should ask for the responders current status (student, professional - if so freelance/employed) because this will quite probably color the answers. (Unless everybody will just put "by coding" in the Other section). You should also ask for the number of years of experience, or at least a ballpark. The way one learns changes depending of what you already know.

Edit: and to answer your question. At first I learned by reading other's people code and trying stuff. Adapting existing base bit by bit can go a long way. Back then I had no internet.

At university most of the curriculum was theoretical. We have done very little actual coding and most problems were too small. Often too specific and vague at the same time.

Nowadays I learn by coding. When you re-read your code from a few months back it should look bad, this is the sign that you have progressed. If there are no idiomatic ways of solving a particular problem, I try to find a better way to implement it each new time.

Finally, I try to talk to people smarter or more experienced than me.

If I would change one thing, it would be to do more projects in university and make them follow agile methodology with the teacher as product owner.

</comment><comment><USER8> A major characteristic of a solid programmer is how they structure and modularize their code. This is not something you can learn from books because it ties strongly to the problem at hand. But you can get much better at it by delving into other solid open source code related to the problem. It took them many iterations to get it right, so there's a lot to learn from that.

For example, if you want to write an SQL parser/analyzer, take a stab at how you'll structure it, then try extracting this piece from postgresql. Compare and contrast. You'll learn how a good modular code looks like and start learning how to apply such patterns to your code.

Delving into a code base without a goal isn't helpful imo. You need to have a main goal like fixing a bug, adding a feature, or extracting a piece to integrate it into your own code.

</comment><comment><USER9> I disagree about it being all about practice. That's like saying basketball players get better just by playing basketball. It's about the right kind of practice.

The best kind of practice is the one you dread most.

Last year I kept hitting the semicolon, curly brackets wrong and getting the capitalizations off. I deliberately practiced typing those for dozens of hours. These things really helped me stay in flow instead of stumbling.

I used to dread all the complicated architectures of modern Android. So I did a few app sprints trying to find simpler ways of building one from scratch and seeing which corners I can cut.

I felt that I was too slow in coding things that weren't copy paste. So now I've been doing some 'sprints' by doing Hackerrank or Project Euler as fast as possible and then taking a long break from them.

</comment><comment><USER10> 1\. Read Books/Online

2\. Use Anki for difficult memorization

3\. Use mindmaps for difficult concepts

4\. Practice Coding

5\. Sleep and Exercise for mental health

I've also found a low carb high fat diet helps me focus a lot more ymmv .

</comment><comment><USER11> 1\. Practice. 2\. Read good open source code, design patterns, understand and apply. 3\. Repeat.

</comment><comment><USER12> I believe a large part of getting better at coding is reading about good coding practices and simply reading other developers' code, regardless of its quality. For example when I was in junior college a programmer-on-duty recommended I read Kernighan and Plauger's "Elements of Programming Style." Reading this style guide had an immense impact on me. Following that book, I discovered Kernighan and Plauger's "Software Tools" which illustrated important aspects of the UNIX philosophy (and good design principles) such as "Write programs that do one thing well" and "write programs that work together."

</comment><comment><USER13> Avoid becoming too dependent on referencing easy/fast solutions online when you hit an annoying problem. I've found that it's extremely valuable to go through forced stretches of time where I won't allow myself to do quick solution look-ups using Stackoverflow et al., forcing me to work through more problems and keep improving. There is always some deadline to get some thing done, so it can be extremely tempting to turn to Google to quickly move on to the next problem. I think that's reasonable so long as you mix it up and make sure your skillset is well maintained.

</comment><comment><USER14> The old adage of "practice makes perfect" definitely applies.

However, working with other smart (ideally smart _er_ ) people really helps a lot. Code review of my own code is helpful. But also reviewing other people's code. I find that reviewing other people's code from projects I am familiar with is more valuable than just reviewing any code.

I'm also a musician, the same approach applies there too. I always try to play in bands where I'm the worst player (though hopefully good enough that my playing satisfies the others in the band). That way I'm always learning and pushing limits.

</comment><comment><USER15> I jump into a new language, a new technology, and immerse myself in it. Ask Qs on SO, read books, but write code. This is how I taught myself how to code when I was a teen, and it's been very effective ever since, as I have moved from teen to undergrad to grad student to professional. Solo self-education via practice, supplemented by voracious reading.

I would quantify a key difference between an effective intern and an ineffective intern as "has this person written 10KLoC". Writing software is a _craft_ , and crafts require practice.

After initial competence is achieved, i.e., you can do your first coding language/tech and be comfortable, you need to choose another, different, one and repeat the process. It will break individual understandings of that one system and show you commonalities. Then, do it again. Even more different. Rinse, repeat. The breakthrough and toughness are required for getting better.

At a certain point, the problem of "learning how to code" or "getting better at coding" disappears and you need to understand how to work with others and building work products for them - open source or otherwise. On and on it goes.

</comment><comment><USER16> 1\. Write big enough programs of your own such that you experience them collapsing under their own weight. That forces you to see the consequences of your actions. Only then can you really learn how to structure things better.

2\. Try to learn the underlying technologies thoroughly. For example, try writing a simple C compiler and linker. That will teach you about a lot of things that a lot of the programming world sits on top of.

<comment><USER17> I've learned no greater lesson about program structure than the time I finally got around to writing test cases for my first modest (~10k lines of C) personal project.

</comment></comment><comment><USER18> Be aware of the three paradigms ([http://wiki.c2.com/?ThereAreExactlyThreeParadigms](http://wiki.c2.com/?ThereAreExactlyThreeParadigms)). Get proficient in at least one language for each of them. It will get you a host of transferrable knowledge.

Tinker a lot and don't be afraid to make your own mistakes (and learn from them once you've recognized them).

</comment><comment><USER19> By reading (esp. code), writing code, and reviewing (i.e writing about code).

Reading, esp. code (including learning new languages and reading in them), shows me new paradigms, new idioms, new ideas, sometimes parts of new ideas which may click together later. Sometimes the patterns may however be subtle and not easy to notice by pure code reading; in such cases reading free-form prose (blogs/etc.) can help notice them. Also reading code invariably provides examples of bad code, to be remembered as a warning and something to try to avoid.

Writing code introduces need for actually choosing some of the learned approaches, excercises the learned theory, ingrains it, shows the shortcomings and costs of particular patterns/approaches, their nuances, where they fit and where they don't, allows to experiment with them.

"Exchange with coworkers" is usually also reading in my case, i.e. code reviews.

And I just realized that also doing code reviews helps me improve coding in one more way: I sometimes discover stuff when I'm trying to express in words why I find some peer's code jarring, troublesome, or confusing.

</comment><comment><USER20> For me it's a combination of active and passive modes:

By active I mean actually coding. I usually have a side project or two that I'm working on (although sometimes barely at all) and I try to pick projects that involve working with a tool, platform or skillset I haven't tried yet. That's how I've gotten into things like deep learning, computer vision and 3D graphics that I wouldn't normally get to use at work.

By passive I generally mean podcasts. As a front end developer, I recommend Shop Talk Show, DevChat.tv's podcasts, Toolsday and Codepen Radio (and for people who are new to CS entirely, Base.cs is an awesome podcast). I'll put one of these on while driving or playing a zone-outable video game and just absorb.

I suppose I should also recommend things like Pluralsight and Lynda.com for getting an introduction to a topic I'm completely unfamiliar with. These are invaluable, but only if combined with actual experience in the thing you are learning. If I take a course on there and don't apply it soon after, I'll generally forget most of what I learned.

</comment><comment><USER21> As everybody else is saying, practice practice practice.

I'll add one extra on top of that: it's important to practice on real, complete, non-trivial programs that actually do something. Ideally it'll be a large project because that will give you practice in working with other people, API design, refactoring, testing, debugging, and reverse-engineering.

</comment><comment><USER22> 1\. Get a job when you have a good mentor, senior/lead dev that is actually doing his job, not just a manager. That person should be rather strict

2\. Fix tons of bugs. You will get exposure to all kinds of issues and shortcomings that people before you made. Those who do not know history's mistakes are doomed to repeat them (or any variation of this quote)

3\. Talk and work with others. Software engineering is a team sport. Surround your self with smarter than yourself, that often works best.

4\. Teach others, share your knowledge. No matter if they are more junior or senior, it does not matter. That will make you understand problem even better.

5\. Build simple things. KISS and done. Simplicity is the ultimate sophistication. Do not try to impress others with how complicated your software is, try to do that other way around if you have to.

</comment><comment><USER23> Every Sunday, I go through the things I did that week (including work and social events) and ask "how could that have gone 10% better?" Then I see if I can apply those ideas to future projects.

Years of accumulating minor improvements based on real projects I actually worked on have compounded.

</comment><comment><USER24> Spread your knowledge around, read on oop, read on functional programming, learn what google and Facebook do in a situation, learn to get good enough to criticize with confidence. If you can't criticize a situation with confidence then learn more about it.

<comment><USER23> Definitely agree - IME the best programmers can usually give a long list of informed complaints about their favorite tools, as well as reasonably discussing alternatives.

</comment></comment><comment><USER25> I apply the 80/20 rule recursively. It's something I caught myself doing at some point and now I tell junior devs to do the same thing.

If you spent most of a day on something, nobody is going to notice an extra twenty minutes to fix it up a bit more. Especially if it means fewer production issues with that code. On a sane project the interesting problems are given to the most reliable people, not the fastest. So look at th code one more time than you deem necessary.

Try to look at it the way someone else will or the way you will in six months when you touch it again. Do the commit comments match the code? Can you tweak the code a bit to make it mean what you said? Then do it.

</comment><comment><USER26> By coding and reading other people's code.

<comment><USER27> > reading other people's code

+1 for reading other people's code. I'll build on that by adding:

\- by learning to make your own code readable

\- by working with people who want to make code reviews a priority

</comment></comment><comment><USER28> The same way everyone else does: by doing it.

... and then suffering through withering dismissals of my urgent questions on stackoverflow and also facing condescension, ridicule or getting ignored by people who can help me at work. Seriously.

</comment><comment><USER29> Lots of coding, bad, good, better, messy, etc.

Challenge yourself, to try the hard task once in a while (prove to yourself, those "I could do that much better" thoughts), attempt "proof of concepts" (at least) of your wild ideas. You will be surprised how far you can get.

Exchange ideas and accept bitter pills of criticism, yeah sometimes you will have to admit you got something wrong and now you have to rethink how to do something. Once you get over that you will find new opportunities and also have a new story about "back in the day I was so bad at this, I..."

</comment><comment><USER30> 1\. Write code for side projects 2\. Read others code for similar projects in same language.

On #2, for example, if you are working on a todo list backend in python, try to find existing solutions for todo list backend in python. Then you can see what others using in their solutions and try to bring them into yours.

I understand, this approach is not applicable for everything but I have found lots of gems this way.

<comment><USER31> Conversely, avoiding looking at what others have done and doing it yourself can help loads too.

Only when you get stuck and cant figure something out with your current knowledge set, should you venture to look at others solutions.

Or after you have completed your solution and are curious about what others have done. You might find a library that makes your life way easier, but had you started out using that library, you wouldn't have the best understanding of the nitty gritty details.

I will admit sometimes I get a little ambitious with what I want to do and end up looking at other solutions to see just how complex we have to go.

</comment></comment><comment><USER32> Lately, by fixing bad code. But otherwise I find a project I am passionate about and go forward. I appreciate the wealth of tutorials available, but I generally find those boring because it doesn't accomplish my goal. I genuinely appreciate those tutorials/blog posts etc because they make for solid reference material.

</comment><comment><USER33> Everyone here is saying by coding. I largely agree. However, there is probably 10% of my time where I talk to others who are way better than me, know about topics I want to learn about and then go learn. A lot of times you can save a bunch of time by getting knowledge from the best vs a random guide online.

</comment><comment><USER34> I get better by giving myself some time to explore new topics. One recent example was giving myself "time" to learn Jest and writing more frontend unit tests. Took < 30 minutes to learn it and I was good to go, but we're all so busy sometimes we don't allow ourselves time to learn.

</comment><comment><USER35> Contributing to an open source projects is a great way of learning too. It forces you to read and understand the project's code and concepts behind it. Then you practice coding by implementing your new feature. You also need to test it thoroughly. Finally, you will get a code review for your code.

</comment><comment><USER36> "Lisp is worth learning for the profound enlightenment experience you will have when you finally get it; that experience will make you a better programmer for the rest of your days, even if you never actually use Lisp itself a lot."

\- Eric Raymond, "How to Become a Hacker"

<comment><USER37> The exact same thing can be said about many other subjects, even not related to IT at all. As an example, inspiration for simulated annealing, an ML technique, comes from welding.

</comment></comment><comment><USER38> I get better by taking on projects and challenges that I have never done before. It forces me to learn quickly and I encounter more problems, bugs, issues, that I have not encountered before which I learn from, and become a better developer.

</comment><comment><USER39> Get feedback from more experienced programmers and learn how to improve your code. Get feedback any way you can-- people contribute feedback for a variety of reasons other than altruism.

</comment><comment><USER40> Write code fast that you're going to throw away. Write code carefully that you'll have to maintain for a long time. Maintain other people's code.

</comment><comment><USER41> By thinking about it.

</comment><comment><USER42> See what others are doing wrong, notice what I think and realize that I never want someone to feel like this when reading my code -> IMPROVE.

</comment><comment><USER43> 1\. Eating crow when customers find my bugs.

2\. Rewriting, rewriting, rewriting

3\. Trying new languages for fun (I ported a LAMP website to Node to learn about node+express)

</comment><comment><USER44> It's not enough just to code more.

You have to be exposed to code written by other people in order to see _better_ ways to do things.

</comment><comment><USER45> 1\. Choose a project I don't have a clue how to do but I also find interesting

2\. Dive in head first knowing a ton of research will need to happen

3.

4\. Profit

</comment><comment><USER46> Pairing.

Bouncing off ideas, war stories, snippets, learning and sharing alternative ways to solve problems. Priceless.

</comment><comment><USER47> Everybody mentions coding... how do you make sure the coding is an improvement activity?

</comment><comment><USER48> Learn from your own code, compare other's coding practices.

That worked for me.

</comment><comment><USER49> I think the questions are too opinionated !

</comment><comment><USER50> How do you get to Carnegie Hall? Practice.

</comment><comment><USER51> Coding.

</comment><comment><USER52> i take courses on udemy and coursera.

</comment><comment><USER53> You... code.

</comment><comment><USER54> Do it.</comment>


Adobe Investigates Corporate Network Security Issue - <AUTHOR> http://blogs.adobe.com/conversations/2010/01/adobe_investigates_corporate_n.html

<comment><USER2> So, any guess if updating from Adobe to fix "PDF zero-day bugs" ( <http://www.macworld.com/article/145670/adobe_patches.html> ) remove or install what ever trojan/malware that may or may not have entered Adbode's Corporate Network (and may or may not have been further distributed)?

</comment><comment><USER3> I hope Adobe et. al. have deployed some log archival & query (SIEM) solution like SenSage (<http://www.sensage.com>). If so they'll have records needed for forensic reconstruction of the attack, and find a way to remedy their problem. If not, they're flying blind (or at least near-sighted). It will be interesting to see whether this is an inside job.

</comment><comment><USER4> So adobe is one of the 20 companies. Others?

</comment><comment><USER5> Someone managing to slip malicious code into the Flash Player or Acrobat Reader installers is pretty much a worst-case scenario; the possibility of someone _working for the Chinese government_ doing so is even worse. I don't think that's actually likely, but the idea that someone might have been trying is sobering. It's nice to see some degree of openness from Adobe about it.</comment>


DocuSign's experience migrating from Angular to React - <AUTHOR> https://www.youtube.com/watch?v=l5K01MAi2Ek <comment><AUTHOR> Here are the slides if you can't watch the video: [https://www.slideshare.net/inovia/docusigns-road-to- react/](https://www.slideshare.net/inovia/docusigns-road-to-react/)</comment>


Planckian Dissipation, Strange Metals, and a Quantum Speed Limit - <AUTHOR> https://www.theatlantic.com/science/archive/2018/11/planckian-dissipation-strange-metals-superconductors-electron-speed-limit/576484/ <comment><USER2> Is it just me or does it seem like the more we study the universe the more discrete it becomes? That coupled with weird things like imaginary numbers and magnitudes of infinities makes me believe we need a to rewrite most of our math using an axiomatically discrete number system.

<comment><USER3> > does it seem like the more we study the universe the more discrete it > becomes

the continuity has been a wonderful tool for the last 4 centuries since its development. It is kind of not surprising that such a convenient (and simple in many senses) model starts to show it limitations when stretched to and beyond the edges. It wouldn't the first nor the last time that what we see as edges happens to be horizons of the new deeper levels of science.

>using an axiomatically discrete number system

we've been there. I think the next step is what is popularly known and manifests itself as fractals - i.e. the p-adic numbers calculus/geometry/etc seems to be an entry point into the post-continuous world where things look continuous at some scales/aspects as well as discrete at another scales/aspects.

<comment><USER2> Who should I read to learn more about the state of the art in discrete mathematics applied to physics?</comment></comment></comment>