Has the NSA Been Using the Heartbleed Bug? - <AUTHOR> http://www.wired.com/2014/04/nsa-heartbleed/ <comment><USER3> One point that sometimes comes up in these conversations--but frankly I think not often enough--is that the NSA does not have a monopoly on the world's brightest engineers and mathematicians: if the NSA knows of a bug, one has to wonder if China, or Russia, also has access to the same bug. The ramifications of this would be the NSA not only being able to see other people's secure traffic, but the potential for _our traffic_ to be intercepted and decoded: this is not, as far as I understand, a win condition for the NSA. I could see the FBI being all for "the world has no secrets anymore", but the NSA has a different agenda.

This is a fundamentally different situation than a backdoor in a parameterized encryption standard, such as ECDSA (which is often referenced in these discussions): there, only the people who built the backdoor can use the backdoor. Here, the backdoor exists in a shared resource, waiting for others-- including your enemies--to take advantage of; that's quite a risk, and unless you've been seeing some weird behavior--such as the NSA distributing heartbeat-disabled builds of OpenSSL for any potential government usage--I think it is a horrible stretch to believe that they've been sitting on this bug (or even having themselves planted the bug), using it as the long-term surveillance means that some people seem to be want to believe.

Frankly, the fact that they've been logging SSL traffic is enough: for systems without perfect forward security, if they don't already have the keys through other means, they just wait for an opportunity like yesterday and then attempt to quickly get the keys they want. I would almost go so far as to claim the NSA was being negligent in their strategy (not that I like this strategy, mind you) if they didn't follow through to that point. But I just don't see it as being rational to believe the NSA is willing to make our own country's secrets less secure if they are seeing benefits using the bug against others; if anything, I could see them trying to secretly (so as not to tip their hand as having had any advanced notice) fix the bug (after using it for a short time period to pull a bunch of keys, of course ;P).

<comment><USER4> Uhm, as NSA and other agencies are responsible for "secure" internal comm, they have methods for that. Sometimes they get broken, probably, but thats their mission to find out, and sometimes let the enemy continue thinking their breakin is effective.

Its the same methods as in 1940, that is, classic intel methods.

Security does not just mean strong crypto algorithms.

If you find your enemy has found a flaw in openssl or some other methods which you are using to communicate - the best way forward is to continue using that - keep the enemy thinking its all good information when its in fact worthless, and move to another method for the real secure stuff, such as steganography or pidgeons.

Anyway, there probably isnt much "really highly, this kills the cat"-type of information goin on the internets, I guess one point of NSA would also be to keep highly classified information to a minimum. Think thats one reason why Navy and others have their own networks parallel to the internet. Where much secrets flow - isolate.

<comment><USER5> These are fair points, but I think the GP comment above was referring as much to political economy type espionage.

Say, for example, china wants to spy on a military contractor. Unless the NSA is sharing its secure pigeon network with every US defense contractor (and many of them, large and small) some pretty important US national security assets might be in play. So, perhaps not "state secrets" but things like technology inside of some tactical weapons guidance systems, or similar. The downside for the NSA of sharing any secret-pigeon networks would op-sec goes down as info dispersal goes up.

 __* Also for companies like a tesla or a space-x who may have purely industrial know how.

<comment><USER4> Tactical weapons guidance systems, tesla and space-x, I believe those are in the category of "NSA will secure this with a bit more tools than given to the public as recommendations".

It could be methods like increasing security for those companies gmail accounts - on the Google internal network and all, closing all normal backdoors on Tesla employee computers, installing NSAs own intrusion detection system on them and such.

And to top it off, feed any Chinese and Russian hackers misinformation through honeypots and "accidents".

In Sweden for example during cold war it was quite popular to install extra instrumentation on jets and provide "just for the soviets" technical documentation - seed confusion and such.

</comment></comment></comment></comment><comment><USER6> The NSA has been squirreling away tons of intercepted https traffic. A week ago it would have seemed as if they were doing so in the hopes of future changes. Either cryptographic advacements, or private keys revealed due to intrusion or court order or what-have-you. Even so it seemed a remarkably weird thing to do. Today, in the light of heartbleed it makes perfect sense, and I think the idea that the NSA has been ubiquitously making use of the vulnerability has to be on at least even footing with the alternative.

</comment><comment><USER7> For the sake of argument, swap out 'NSA' for any large state actor - it's silly to ask this specifically of the NSA and most of the attention is around them because of the Snowden leaks.

Now, would a large state actor involved in offensive black hat hacking have known of heartbleed? I think the answer is likely yes.

Any decently funded team with a dozen good auditors to commit to the project would be watching popular open source projects like openssl, linux, chromium, firefox, apache, nginx, gnupg, openssh, boost, gmp, berkeley db, qt, gtk, etc.

For this part of the project, you only have to grep for low hanging fruit in each new patch that is released for each project, that is usage of: gets, scanf, strncpy, strncat, memcpy etc (or the equivalents for each project that has wrappers or handling functions).

Any large state actor with any decent team running such a project would have discovered heartbleed within days of it being committed. They also would have discovered a lot of other bugs that we either don't know about yet or have fixed.

With heartbleed the state actors are kicking themselves either way: either because they didn't know about the bug and missed it, or they did know about the bug and now can no longer use it as effectively.

"They" (and you can include black hat groups that don't disclose in this as well) combined likely have more resources dedicated to uncovering these bugs than what the open community does, and it might be an order of magnitude larger.

When you think about this further, you realize that the state actors having discovered heartbleed or not doesn't matter - what _does matter_ is that they _do_ have a lot of exploits that we don't know about and it has been confirmed that they are not only looking for these bugs and have a lot of people working on it, but are actively discovering them, using them and purchasing them on the market.

The response to this shouldn't be heartbleed specific - it should be what do "we" do to stop "them" from discovering and using exploits from open source and projects. There needs to be a heck of a lot more effort or a whole new approach to defeat the level resources that are out there dedicated to uncovering and not disclosing these exploits.

The best thing that could have happen did happen: heartbleed was discovered and it was disclosed, and a hell of a lot of people are now more aware of just how frail some of this infrastructure is and what the risks are.

<comment><USER8> Excellent response Nik. I write from Laos, where one of the TPB guys apparently lives in exile, next door to where another was extradited, and next door to where lots of exploits apparently get sold (according to certain media reports and personal interactions). This whole thing is invisible to normal people. The bigger question is how can we educate the masses without reliance upon government. I think a global network of free wifi with knowledge libraries people can access on their cellphones would be a good start. Off the internet.

</comment></comment><comment><USER9> I would take anyone for a fool who thought the NSA hasn't been using heartbleed.

<comment><USER10> I take anyone as a fool who thinks the NSA is the only spy agency that does such things.

<comment><USER11> It's not an exclusive statement. The safe bet is that _both_ the NSA and other spy agencies around the world have been using the openSSL hole.

If the NSA has not, they're incompetent.

</comment></comment></comment><comment><USER12> Would the NSA be interested in knowing the security flaws of popular opensource programs that could be used for attacks?

Has the NSA ever used a 0day to access a machine they were interested in?

Are the people that work for the NSA likely to be smart enough to realise the NSA's upside in finding security flaws and not telling people about them?

Will the NSA have ever done a security review of popular opensource libraries?

I'm not begging the question. What we know is incomplete. However, answer those questions yourself and then imagine how you might answer those questions if you were rich, liked playing dirty, full of smart people, and in a position of power. That's as good a bet as any on what might have been going on.

 _My two cents: all that is needed is a small crack in security. I wouldn 't bet on the internet being secure, because men and women are fallible and security is complex._

</comment><comment><USER13> > _And even on sites that were vulnerable, using the Heartbleed bug to find > and grab the private keys stored on a server's memory isn't without > problems._

Yeah, having to collect and process all that random data... I'm sure they gave up after a couple weeks.

</comment><comment><USER14> No, I'm pretty sure they would do the only good thing and stored all that lost encrypted, traffic to return to the sender.

Can you imagine those guys doing anything remotely evil, like extracting metadata and data of anything they could get their hands on?

</comment><comment><USER15> A rare example of Betteridge being wrong because in this case - <USER2> certainly yes.

</comment><comment><USER16> They're usually a few years ahead of what gets published, so I'd assume yes.

</comment><comment><USER17> I would think that the NSA would be opening themselves up to quite a firestorm if they were found to be exploiting this bug without saying a word about it. I very much doubt they were making use of this for the simple fact that, by not disclosing, they'd be allowing this gaping hole to potentially be used by "enemy" governments, which is the exact opposite of what they want.

<comment><USER4> If they knew about this, they used it, and they told or by other means deactivated heartbeat for sensitive systems of USA, and using honeypots to see if the Russians and Chinese have figured it out too.

Then when their honeypots attract alot of bees, is time to tell Google to seal the hole, to protect all the medium sensitivity networks and info.

<comment><USER17> Good thought, though I would think that the reason behind a ton of government offices suddenly dropping SSL would've been leaked by one of the many hands involved.

</comment></comment></comment><comment><USER18> Why bother? There are a million different ways to own servers available to the security services that require little to no expertise, from compromising the engineers, the physical servers, the CAs, or plain legal intimidation. Even if the NSA had heartbleed they wouldn't have needed to use it.

</comment><comment><USER19> What we need to know is when a given system was patched, that would tell you who knew what when. Is the Google fork of OpenSSL publicly maintained? Has anyone identified the commit that introduced the "bug"?

</comment><comment><USER20> The answer is, they are still using it. The spoil is not over. Even old keys are good. They can be used with the data they have already there in the basement.

Disclaimer: _All characters and events appearing in my comment are fictitious. Any resemblance to real events or persons, living or dead, is purely coincidental._</comment>


The exFAT filesystem is coming to Linux - <AUTHOR> https://arstechnica.com/information-technology/2020/03/the-exfat-filesystem-is-coming-to-linux-paragon-softwares-not-happy-about-it/?hn <comment><USER2> LWN has some good coverage of the licensing and technical aspects: [https://lwn.net/Articles/797963/](https://lwn.net/Articles/797963/)

<comment><USER3> I tried to put the license and patent info into the Wikipedia page on exFAT a few years ago and it was reverted a few minutes later as "not germane". Hmm...I decided not to try again.

</comment></comment><comment><USER4> How does this square with Microsoft removing or deprecating exFAT support from Windows [0]? Isn't the whole point to have a file system with cross-platform support? I mean, is Microsoft being nefarious by allowing exFAT to come to Linux while at the same time beginning to drop support in Windows? Or am I reading too much into this?

[0]: I came across the comment below yesterday and was able to verify that any mention of exFAT has been removed from the official "diskpart" documentation.

> _Well it appears that Windows 10 support for exFAT has been dropped in a > recent update. The option no longer appears in the drive format dialog, nor > does it appear in the diskpart utility. Any mention of exFAT has been > expunged from the official diskpart documentation making me believe that > Microsoft has officially terminated support for it, even so I cannot find > any official announcements or confirmations of that._ source - > [https://superuser.com/a/1420186](https://superuser.com/a/1420186)

<comment><USER5> A comment on that response explains it; some partitions marked for NTFS filesystems will not allow it to be formatted as exFAT, it's still present on the latest version AFAICT.

</comment></comment><comment><USER6> By far the worst part of using Linux, Windows, and Mac is trying to find a compatible filesystem for them. Every time I have a file on my Mac that I need to transfer to Windows or from Windows to Linux, trying to write to a filesystem that is supported by all three platforms is just an exercise in frustration.

<comment><USER7> Sadly (or not sadly depending on your perspective), most people today will use a remote host via Google Drive or DropBox (or even email) and not have this problem.

<comment><USER8> It's absolutely insane that this is the most painless workaround in 2020

</comment></comment></comment><comment><USER9> The article quotes Paragon's blog post without linking to it. Here's the original:

[https://www.embedded-computing.com/guest-blogs/three- cases-w...](https://www.embedded-computing.com/guest-blogs/three-cases-where- the-open-source-model-didnt-work)

</comment><comment><USER10> Fourth time this has popped up. Here is the previous discussion [https://news.ycombinator.com/item?id=22688058](https://news.ycombinator.com/item?id=22688058)

<comment><USER11> It's no coincidence that his is being pushed so aggressively. This change is about to break tons of userland & competition, just not at Microsoft.

<comment><USER12> Break userland? Sorry.. explanation?

<comment><USER11> Differences in implementations already cause problems. Adding one will not mitigate this problem, only worsen it. A bit like this [https://xkcd.com/927/](https://xkcd.com/927/) Furthermore, anything contemporary should steer away from this heavily outdated technology unless they desire to accumulate even more technical debt.

<comment><USER12> I hate DOS as much as the next UNIX person but in filesystems it pays to be nuanced. We need to be able to swap data across OS and read/write enabled FS support for >4GB partitions with sensible names not 8.3 and with ACLS and even being able to boot from them would be nice. I wouldn't choose to live in exVFAT but I would welcome integration of support.

<comment><USER11> All those arguments are valid and where already somewhere around 2k. Today, many more matter. Prominently the FS being aware of it being at flash storage or magnetic etc. We surely should oppose artificially prolonging the *fat shelf life.

Edit: @Guy claiming exFAT was developed for flash drives. Not sure if your clever spindoktering is astroturfing or trolling. >_<

<comment><USER13> > Prominently the FS being aware of it being at flash storage or magnetic etc. > We surely should oppose artificially prolonging the _fat shelf life.

All of those are good things in isolation. However, the reality is, Linux/BSD/etc. doesn't have the marketshare to push any filesystem cross platform.

Any filesystem with the characteristics you want that goes cross platform will start on MacOS (unlikely) or Windows (much, much more likely)_.

Until then, people need a way to accomplish tasks and exFat is the best we've got today for cross platform flash storage.

* I suppose it's possible it could come from Android or iOS, although iOS is pretty unlikely since it's so hostile to the idea of filesystems. For this to happen, though, it would have to be a regular task to plug flash drives into phones. That is currently not the case and won't be the case in the near future.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Perhaps so that when WSL2 is available, they'll be able to mount all Windows filesystems easier?

</comment><comment><USER15> I believe, Its just part of Microsoft's plan for world domination and to neutralize Linux and other competitors. They are fully in the embrace phase at present. I'd question if it will have ALL the features on Linux that it does on Windows...

<comment><USER16> The first paragraph of the article states the code is "Microsoft-approved, largely Samsung-authored". The code is open source and missing features, if any, could be added. Microsoft has explicitly endorsed its usage in the kernel [0] and its architecture is fully documented [1]. What more do you want?

[0] [https://cloudblogs.microsoft.com/opensource/2019/08/28/exfat...](https://cloudblogs.microsoft.com/opensource/2019/08/28/exfat- linux-kernel/)

[1] [https://docs.microsoft.com/en- us/windows/win32/fileio/exfat-...](https://docs.microsoft.com/en- us/windows/win32/fileio/exfat-specification)</comment></comment>


How to get your first 100k active users - <AUTHOR> https://blog.winnie.com/how-to-get-your-first-100k-active-users-909fa4292a27 <comment><USER3> Not that you need my vote, but I agree with all of this. In particular:

\- Go true native, not hybrid

\- Use ads for testing ideas

\- Don't forget about email!

I'm also intrigued by your approach of not going market-by-market like a lot of local-focused marketplaces do. Your approach seems to make sense, and obviously worked for you. I particularly like that you had a different onboarding flow for users in new markets, that's smart.

But still, I'm not sure that this approach would make sense for a lot of local-focused apps? I think the fear would be that it would be relatively easy to get 100k users but they'd be spread out so thin that they'd find little utility in the app and stop using it. So you'd have 100k users in your database, but a tiny fraction of that in terms of actual active users. But maybe that doesn't even matter, since you wouldn't have had all those inactive users anyway?

Could you speak to that? I'd love to hear how many of those 100k users are DAU or MAU, but understand if you can't share that :)

Congrats!

<comment><USER4> _Go true native, not hybrid_

Users don't care. Most of them can't tell.

<comment><USER5> And you're the reason I don't use very many phone apps.

Developer apathy becomes user apathy. If you make great apps, your customers will be enthusiastic about using them. If you make mediocre apps, you will attract mediocre users, or no users at all.

<comment><USER6> You are most likely using some hybrid apps and you don't even know it. When done right, you pretty much can't tell.

<comment><USER7> And when done _wrong_...

<comment><USER8> Which can be said of native apps as well

</comment></comment></comment></comment></comment></comment><comment><USER9> "Grow even before you launch" and "Go big or go home" really resonate with me.

We were able to sign up a few thousand people to our new product waitlist through two main channels: exhibiting at conferences and answering questions on Quora. In the past, I would have just done a small beta with friends, but I guess I'm getting a little wiser over the years :)

Going big from the beginning is really a tough one. I already got burned at a previous startup by not narrowing the focus enough, but it really depends on the market and the type of product you are building. We're building a product for college students, which is a big group, so it's a toss-up whether to go after a certain category of students or go after them all. We're casting a wide net for now with the idea that our product will resonate with certain subgroups which we can focus later.

<comment><USER10> > "Grow even before you launch" and "Go big or go home" really resonate with > me.

What is wrong with building the functionality first, get paying customers, and from there scale? At least that way, you'll have the money to scale.

<comment><USER11> You may simply build a product that nobody wants.

<comment><USER10> As opposed to building a product that lots of people want, but can't use because it didn't scale? (Scaling costs money)

</comment></comment></comment></comment><comment><USER12> This evening we got our 171st user for our wishlist-service. When we launched it 1 year ago we tried to get it out on different channels like Reddit and HN without much success, while we _did_ see success in just talking about it to friends and family, and had just over 100 users in January this year.

Since then, we've done close to zero marketing, and it's been amazing to see new signups, wishlists and items being created - seemingly out of the blue. I made a simple Slack-bot to post those events to a channel with their ID, and these are the stats from it was added late March until now: 53 new users, 74 new wishlists, and 482 new items.

As we do no sort of analytics, we have no clue who these people are, but boy does it make me happy to see those "A new user was just created!"-messages nonetheless!

<comment><USER13> In case anyone is wondering (like I was), I think this is the site:

[https://wishy.gift](https://wishy.gift)

<comment><USER12> That's the one! Any feedback and suggestions are appreciated!

<comment><USER14> Usually landing pages for early stage products tend to be iffy but you've killed it honestly! I got what your product was in 10 secs.

What would be awesome is a link to a demo wishlist!

<comment><USER15> Agree with this, your landing page is _so good_ I'm going to use the format to replace my own garbage landing page. Thank you for the inspiration, this is awesome. You're starting a movement!

By the way, congrats on 171 users :)

<comment><USER12> Wow, thank you! Good luck with your own project too!

</comment></comment></comment></comment></comment></comment><comment><USER16> Best takeaways from the article (no particular order):

      - Retool ads as a way to test for and identify demand.
      - Bait people with truly useful content where they're already looking, and then direct them to your app.
      - Simple changes in wording or flow of UX can increase shares dramatically.
      - Get featured in app stores. How?
        - Integrate with latest device features being pushed
        - Adhere to vendor design standards
      - Email is still very effective, so use it.
      - Have 10 enthusiastic users that will spread their enthusiasm before you start.

That last point is good to know, and perhaps the most important, but it's way easier said than done. Especially if you aren't a social butterfly.

Also, the "don't use cross platform" preached in the article isn't very convincing. You can get excellent performance with well-coded cross-platform build tools, and in far less time.

<comment><USER17> > Especially if you aren't a social butterfly.

The best way to get those 10 enthusiastic users, without being a social butterfly (in a traditional sense), is to manufacture them through inclusion. For example, find a subreddit that is relevant to what you're doing, and sell a batch of users on being early adopters (a certain type of people love that). Then give those people credit, attention, and make them feel like their input matters and that their contribution to the thing matters. Basically, make it personal for them, cultivate that experience. For a lot of people those last few concepts can be very rewarding, they'll become your first cheerleaders (and just one of those on eg Reddit can spark something). I've observed that people who are not traditional social butterflies, can still often function at a decent social level on sites like Reddit (at least enough to do what I've described).

<comment><AUTHOR> ^ This is good advice.

</comment></comment></comment><comment><USER18> "Get featured by apple/google"

Honestly, its like giving financial advice and saying "Ok, win the lottery or marry someone rich"

<comment><USER19> It's not really like winning the lottery. There's a lot of different kinds of promotional features they can give you, with different levels of publicity. You just have to make a high quality app that does something useful or new (or a good game), and ask their editorial team if they can promote your app. They'll usually give you _some_ kind of promotion on the store.

It's "editor's choice" and the other front/center features that you might equate to "winning the lottery". And yeah, you can't expect that unless you've already made something huge.

<comment><USER20> and how do you actually contact the editorial team?

<comment><USER21> If you look around there are ways to reach them. The author of A Dark Room made a thorough post on this on Reddit but he's since taken it down; maybe there's an archive.

</comment></comment></comment></comment><comment><AUTHOR> BTW, I'm the OP and am happy to answer questions here. My expertise is obviously in consumer internet products but I spend a lot of time thinking about growth. It's my superpower!

<comment><USER22> Regarding the part about native apps, would you go as far as even restraining from publishing any app, if native app developers are not available (or not in the budget) in the beginning?

<comment><USER23> That sounds absurd to me, go hybrid first then go native once it takes off, you can write your app in JavaScript and have an app that runs in all major mobile devices and a website, I'm not sure how can be beat unless money isn't a problem, such as massive initial funding.

<comment><AUTHOR> Or you can write a native app and get 10-20k installs for free from a feature on the app store. ¯\\_(ツ)_/¯

<comment><USER24> Most native apps are not featured. Polish isn't cheap.

</comment></comment></comment></comment></comment><comment><USER25> "Relying on push notifications alone"

Yeah no. Apps using push notification for marketing/dark purposes is super irritating and for that reason I block notifications by default from all apps.

<comment><USER26> You say that, but you are in a minority. Most users just mindlessly click Allow. Its an amazing power - being able to appear on someones home screen instantly at anytime with any message - but a privilege. So having each notification be useful and actionable is key. In addition to not flooding them with too much frequency.

</comment></comment><comment><USER27> Sorry if it's already mentioned, but I found it frustrating that I could not get to the winnie homepage ([http://www.winnie.com](http://www.winnie.com)) from the blog. Even the "Home" nav link at the top of the blog just points to the blog's homepage.

</comment><comment><USER28> > Do the work to get featured by Apple & Google

Sigh...this is one of the last things to worry about. It's like hoping your roulette number hits. Doing a lot of work is like getting a second roulette wheel number towards getting featured, but a lot of work might improve your chances of success any how. Every year that goes by, this hope becomes less and less likely as the competition grows.

Also, the advice on how to get featured on Google Play is not great advice. If I wanted a higher chance of being featured in Play, I would read this web page - [https://developer.android.com/about/versions/oreo/android-8....](https://developer.android.com/about/versions/oreo/android-8.0.html) . New features of the latest Android. Then I would make an app showcasing one of the new features that Android wants to highlight. If you look at featured apps, these are what get featured a lot. Think of it from Google's POV. Actually, Oreo has been out for a bit, so someone trying for Oreo is already behind the ball. There are videos of the Google people telling you what they look for when featuring, watch those.

<comment><USER29> I also think it's a bit ridiculous to start advising people to "go native" because of the possibility of being featured in the app store.

The cost of doing two native apps is not small at all, and I imagine (not being a mobile dev) that being featured in the App store is a LOT easier for a family friendly app like OP's than the average. I'd also assume the vast majority of native apps don't get featured.

It's well-intentioned advice, but the cost-benefit analysis is nowhere near that simple.

</comment></comment><comment><USER30> Great tips for an aspiring startup founder. I agree completely.

In particular the "mobile-only" resonates with me well. I have seen a number of products only provides a homepage to send me to their appstore/google play. In some cases I was trying to see what job openings were available. I was suprised to see no "career" page. Hmm Did they hide that in the webconsole / developer console? Nope!

So please do not do that to both your users and your potential hires. Your modern website should be mobile friendly, and if you are mobile-focus like instant messenger, that makes sense - but I recommend adding a desktop version later. I have facebook messenger, WhatsApp and Telegram installed on my Macs so (1) I don't need to switch gears constantly, and (2) there are times I need to transfer stuff over from desktop...

Partnering with people in the same pace is a great idea. For example. Reaching out to Youtubers who are parents early on, brainstorm with them, and invite them to your paid sponsorship could help in your case.

At last, I am surprised you are able to register winnie.com. I would have expected it taken and if so I wonder how much it cost to buy it.

<comment><USER31> Indeed, any startup founders that are not aspirating will fail almost instantly!

<comment><USER30> Nice catch! Thanks noticing the misspelling.

</comment></comment></comment><comment><USER32> I love this kind of posts, by sharing the anecdotes of what worked and what didn't, they provide a glimpse into the inner workings and strategies for one of the biggest challenges for any startup, plus most likely will generate a considerable influx of new users from the post itself. Everybody wins.

</comment><comment><USER33> Kudos - 100k MAU is an extremely impressive feat. This is an excellent post, very succinct and punchy advice. Especially interesting to hear about the role of web and email in growth, advice around using ads to develop company positioning is great.

</comment><comment><USER34> You could just use fake users like Reddit did.

[https://venturebeat.com/2012/06/22/reddit-fake- users/](https://venturebeat.com/2012/06/22/reddit-fake-users/)

</comment><comment><USER35> Thanks for admitting the failures you picked on the way. Since you said Mobile-only was a terrible thing to do, how did you decide Winnie has to be a mobile app and not a simple mobile responsive website in the first place?

I'm really curious how product folks decide to go mobile-first, especially in many cases where the user interacts with the app once a week or less frequently. Would love to know how you decided on this with the assumptions you made.

</comment><comment><USER36> This is very interesting strategy. Thanks for the good article.

Could you elaborate on the content-growth strategy? I'm really curious since in some business ideas I'm usually stuck with "chicken and egg" kind of problem. I believe there is no universal strategy here, but what worked for you except this special onboarding flow for users in new markets?

<comment><AUTHOR> It's in the article. Provide the supply yourself (content) while you build demand (users). Do things that don't scale.

One specific example is that we saw a lot of demand for information on child care, so we researched over 5000 local daycares & preschools and created very comprehensive pages for all of them. This sounds like a lot of work but it actually wasn't that bad. Once we had done that we were instantly the best place in the SF Bay Area to research daycares and find open spaces. Word spread like wildfire and we climbed the Google rankings quickly as well. Now, we no longer have to collect data manually, because the daycare providers come to us to reach their audience of customers. So it delivered growth on both sides of the network in a sustainable, ongoing fashion, and only required a one-time upfront investment in content creation.

<comment><USER37> Cool, when do you expect to gather daycare data outside the Bay Area? I see one total daycare listed in my ZIP code (in the Boston area) and the search results page doesn't say anything like "we know this is a tiny number of listings, sign up here to be notified when we reach your area" (at [https://winnie.com/search?category=childcare&near=[zip]](https://winnie.com/search?category=childcare&near=\[zip\]) ).

<comment><AUTHOR> Childcare data in 50 states is coming early in 2018.

<comment><USER37> Very cool, thanks!

</comment></comment></comment></comment></comment><comment><USER38> What if your product doesn't really have any inherent network effects? How do you incentivise your paying customers to share the platform that's giving them a competitive edge (my SaaS is B2B)?

<comment><AUTHOR> You could do an ambassador program of some kind (check out The Skimm, they have a great one). But I wouldn't expect people to eagerly spread the word about solutions. For B2B you should be investing in content marketing and SEO above all else. Other clever ideas are like what Slack did; make it friendly enough for a consumer to use, and then that consumer ends up advocating for the product to their organization.

</comment></comment><comment><USER39> The advice to not only rely on push and native mobile hits home hard - <USER2> it being cool - email, text, and the web still work really well to bring the customers in!

<comment><USER40> But mobile app stores could be easier way for users to find your product using search, am I wrong?

</comment></comment><comment><USER41> Very interesting perspective w.r.t going native. Does that mean you would advise to use Swift/Obj-C & Java/Kotlin as opposed to React Native?

<comment><AUTHOR> If you have the choice, yes. You'll regret React for many reasons but you are so, so much less likely to be featured with a React app, even a great one. Suck it up and learn Swift/Kotlin (not that hard) and if you can get your app featured that's a cool 10-20k installs for free.

<comment><USER42> Sorry, but this is bad advice.

</comment></comment></comment><comment><USER43> Great post. We at Rave Analytics just got out of stealth.We enable retail investors to discover market structure in real time. This is good advice for us to keep up our growth. We are already working on a native experience and email.The part about the network effects is quite interesting too. Its really hard to get network effect

</comment><comment><USER44> How about getting 100 active users paying you $500/month each?

<comment><USER45> Only possible with SaaS and a few exceptions.

</comment></comment><comment><USER46> Interesting use of the word "users".

</comment><comment><USER43> Great post. We just got out of stealth - [https://raveanalytics.com](https://raveanalytics.com) .We enable retail investors to discover market structure in real time. This is good advice for us to keep up our growth. We are already working on a native experience and email.The part about the network effects is quite interesting too. Its really hard to get network effects going.Makes sense to focus on the demand side first.

</comment><comment><USER43> Great post. We just got out of stealth and have launched a site that makes it easy for retail investors to discover market structure in real time - [https://raveanalytics.com](https://raveanalytics.com) .We could definitely use some of the advice here to fuel our growth.

Going native on the mobile and email is something we are already working on. The advice about focusing on the demand side first is really interesting too.Network effect is great but its easier said than done and really hard to get it going.</comment>


Better Disagreement - loup-vaillant http://lesswrong.com/lw/85h/better_disagreement/

<comment><AUTHOR> I'm reminded of something I studied in a Communication Theory course in college, but can't remember the title of, and so am having a difficult time find on Google. Some psych researcher / professor proposed that there were four strategies used to deal with cognitive dissonance. The most effective of them was taking what the opposition states as a negative and turning it into a positive. For example:

Opposition: X presidential candidate wants to cut Y from the budget. That's terrible since it will hurt the poor the most. You: Actually, it's great. If you look at Z statistic, you'll see that removing Y helps the rich AND the poor. Opposition: Huh, so it does.

This is obviously way simplified, but does anyone know the name of that theory?</comment>


On lists, cache, algorithms, and microarchitecture - <AUTHOR> https://pdziepak.github.io/2019/05/02/on-lists-cache-algorithms-and-microarchitecture/ <comment><USER2> I wonder if it is worth it to create a hybrid data structure: A linked list of arrays. Say you'd tune it so each array fits in the L1 cache. You don't need a huge chunk of contiguous memory, but still gain most of the performance gains of arrays. Iteration gets a lot more complicated, of course.

<comment><USER3> It's called unrolled linked list. ([https://en.m.wikipedia.org/wiki/Unrolled_linked_list](https://en.m.wikipedia.org/wiki/Unrolled_linked_list)). Note that if you can make sure each chuck contains sqrt(N) elements, then you can achieve insertion/deletion/lookup in O(sqrt(N)) time

</comment></comment><comment><USER4> I wonder if there is any good resources on hardware details for someone with a backgroud in applied math. Whenever I find an article talking about cache/branch prediction, I find it hard to follow.

<comment><USER5> Your #1 tool is simply a stopwatch. Write programs, time them, and then learn. See why some programs are faster or slower than others.

Your #2 tool is hardware performance counters. Its much easier to understand the cache and branch prediction when you use the hardware to count how many times the cache is hit, and when branches are taken.

[http://www.brendangregg.com/perf.html#Events](http://www.brendangregg.com/perf.html#Events)

Section 5 of Linux "perf" accesses these hardware performance counters for you.

Write a program, see how many cache-misses it has. Write a slightly different program, the cache-misses will be different. How did it change your #1 measurement (time to complete the program) ??

Now do that a thousand times, with a thousand different programs trying to solve the same thing. Bam, now you're an expert.

Its not really hard. Its just an issue of experience. You'll get there if you work at it, and use the right tools to "see" what is going on.

\</comment></comment><comment>

Why do people talk about cache hits and branch prediction? Because in __THEIR __experience, counting cache hits and looking at branch predictions results in performance gains.

Their experience won't necessarily match yours, but you can still learn from them in general.

<comment><USER6> While "perf" is great (especially for something like optimizing a shared library loaded into Python) I had a hard time using any other counter than the instruction retirement for anything meaningful.

"perf list" list 1300 things, and it seems those counters come and go between architectures.

Intel's tools are free now, and give you a very nice graphical analysis tool. You don't need to buy/use the Intel compiler, just have a 1-2 gigs of free disk space.

Here's a page describing analysis if you want to go beyond why some section of your code spends 40% CPU: [https://software.intel.com/en-us/vtune-amplifier- cookbook-to...](https://software.intel.com/en-us/vtune-amplifier-cookbook-top- down-microarchitecture-analysis-method)

<comment><USER5> That's true, but "perf" is more portable between platforms.

For example, I can't use vTune at all, because I run Threadripper 1950x. Personally speaking, I use AMD uProf instead.

Without knowing the guy's setup, "perf" is the most portable option. The processor-specific tools will be more accurate, but also more complicated. Its the Linux tool that tries to work across platforms: AMD, Intel, and even ARM platforms.

\</comment></comment></comment><comment>---

"Perf" will give you L1 / L2 cache hits, and accurate counts at that. The main issue is "branch prediction", which requires very complicated circuitry to really predict. You need to use Intel's trace analyzer for accurate branch prediction statistics.

For AMD, you need to use instruction-based sampling in uProf for good branch prediction statistics.

L1 / L2 cache stuff is the beginner level though, so Perf should be a good starting point in this whole mess.

</comment><comment><USER7> This is excellent, and opportune timing for me too! I just finished courses on microarchitecture and compiler optimization.

Can anyone recommend any similar articles about low level optimization?

<comment><USER8> Michael Abrash's Black Book is a classic.

[http://www.jagregory.com/abrash-black-book/](http://www.jagregory.com/abrash- black-book/)

<comment><USER9> It is a classic book and a great reference if you are optimizing for the 80386. But almost totally irrelevant for modern hardware. Its probably still a fun read for reminiscence purposes - Michael Abrash was a great writer.

<comment><USER10> It goes into pentium architectural points as well which is far more modern than 386. Built-in math coprocessors, Glorious! Though your point remains.

I am guilty of having a fair bit of nostalgia for this book. Memories of sitting in the back seat of my parents car in middle school. Pouring through this book. Fascinated by these inner secrets of machines I knew so little about at the time. Presented in a way even a 12 year old could mostly understand.</comment></comment></comment></comment>


Why the no-fun 'FarmVille' is so popular - <AUTHOR> http://www.cnn.com/2010/TECH/social.media/09/28/farmville.popularity/index.html?hpt=Sbin

<comment><USER2> FarmVille is a good barometer for telling you which of your friends on Facebook don't make good use of their free time.

</comment><comment><USER3> It's as fun as a slot machine, except you don't lose as much money. I think it's a perfect game!

</comment><comment><USER4> Very unimpressive for an article published on CNN, zero substance.

<comment><USER5> I learned a lot about Farmville from this article, having had minimal prior knowledge. It was informative for me.

</comment></comment><comment><USER6> As soon as I see a game like this, mafia wars, plant hero, etc. start gaining traction amongst my friends, I immediately block the application. Presto! All references to the game are gone!

<comment><USER7> I wish there was an option to auto-block all applications...

</comment></comment><comment><USER8> I'm aware of people assuming that it must "become fun" after reaching certain milestones because surely their friends wouldn't all be playing it if it didn't...</comment>


Smoke alarm monitoring via audio - <AUTHOR> https://www.leeo.com/

<comment><USER2> At first blush, this is a device that should not have to exist. The alarms should have their own built in notifications.

But in real life, almost nobody is going to replace everything in their house with connected versions overnight. So this fills a gap in the meantime.

I just hope the team is thinking beyond just smoke and CO2 detectors... there's a LOT more potential here.

And I wish they would have the notification go to a webhook instead of (or in addition to) the mobile device. I'd like to control what happens with notifications myself, thank you.

<comment><AUTHOR> Agreed. My first reaction to seeing this site was, "why on earth would I want this over something like Nest Protect?".

Then I realized it's a stopgap provision for people who don't want to replace all their smoke detectors with new devices.

An optional webhook is a great idea. All notification mechanisms should support it.</comment></comment>


Ask HN: Improving my typing? - <AUTHOR>

Can anyone recommend a resource for people with decades of typing experience looking to reform how they type? There are a lot of "learn to type" resources but they tend to focus on "beginner touch typing" skills.<p>Specifically I'm keen to see if I can adopt a more ergonomic typing method and make use of more digits. <comment><USER2> We specialize in teaching typing skills to children as young as 7 with our software and methodology but works equally well with adults who would like to learn correct touch typing skills. We have successfully taught Dr's, Lawers, Medical secretaries and Emergency call centre personal type correctly, with high accuracy and speed in just 10 hours. The special secret is not to look at your hands. Our program provides you with all the things you will need to type effectively. With a few weeks of dedication and correct practice skills some of our adult students typing over 60 wpm. Adults love learning to type with our program and have lots of fun.

Try a free trial at www.qwertynomics.ca or contact me if you have any questions.

Zoe Clements - Founder of Qwertynomics.

</comment><comment><USER3> If you want to get radical about it, you can reconfigure your keyboard to a known-efficient configuration such as the Dvorak layout. As you probably know, the QWERTY layout was specifically designed to be un-ergonomic and inefficient (so as to keep typists from jamming the mechanical keys of early typewriters). Dvorak and other layouts are known to be conducive to rapid typing, but your skills would not be transferable across multiple machines.

So it's really a question, first, of whether you intend to stay with QWERTY. If so, I recommend [http://www.keybr.com](http://www.keybr.com)

<comment><USER4> > As you probably know, the QWERTY layout was specifically designed to be un- > ergonomic and inefficient (so as to keep typists from jamming the mechanical > keys of early typewriters)

This is false. Please stop repeating it. Dvorak is also not well-proven to be better.

[http://www.economist.com/node/196071](http://www.economist.com/node/196071)</comment></comment>


Show HN: Pigeon Maps – ReactJS Maps without external dependencies - <AUTHOR> https://github.com/mariusandra/pigeon-maps <comment><USER2> Looks good. The performance, as it can be expected for such a small footprint, is really worth considering it too.

</comment><comment><USER3> Well done! Really the react way btw!</comment>


Building a More Secure World with the RISC-V ISA - <AUTHOR> https://riscv.org/2018/01/more-secure-world-risc-v-isa/ <comment><USER2> Okay, I'm all for RISC-V, but this makes no sense, RISC-V isn't magically immune to spectre for no reason.

<comment><USER3> Neither the article nor the title imply that. They are saying open is better, colaborative is better, and that RISCV is a chance to start over with security at the forefront.

<comment><USER4> Seems more like jumping on the bandwagon to me...

I thought this was all down to an implementation detail and has nothing to do with ISAs.

<comment><USER5> If you read the very short article:

> the open RISC-V ISA makes it possible for many different groups to > experiment with alternative mitigation techniques and share results.

<comment><USER6> Alternative short article if RISC-V community is target audience:

> [you/we have] an historic opportunity to "do security right" from the get-go > with the benefit of up-to-date knowledge [so please let's do this]

</comment></comment></comment></comment></comment><comment><USER7> > No announced RISC-V silicon is susceptible, and the popular open-source > RISC-V Rocket processor is unaffected as it does not perform memory accesses > speculatively.

True but misleading. Rocket is an in-order chip. Not only it does not perform memory accesses speculatively, it does not speculate at all.

<comment><USER8> Rocket has a branch predictor; if you're not going to do any kind of speculation, why have it in the first place?

<comment><USER9> a pipeline flush and unprefetched instruction fetch on each branch (20-25% of insns) would dramatically slow down the CPU. With branch prediction you can potentially have correctly predicted branches take zero cycles, even without speculative execution.

<comment><USER10> Using a branch predictor to start execution of a branch _is_ speculative execution.

<comment><USER9> In established computer architecture terminology, speculative execution is reserved for speculating past branches. (Speculation meaning something that may not pan out...)

</comment></comment></comment></comment></comment><comment><USER11> > No announced RISC-V silicon is susceptible

Wasn't the BOOM CPU ([https://github.com/ucb-bar/riscv- boom](https://github.com/ucb-bar/riscv-boom)) fabricated? It definitely seems vulnerable to Spectre.

<comment><USER12> >> Wasn't the BOOM CPU fabricated?

No one has fabricated a BOOM processor. It's a synthesizable core that runs on FPGA.

>> It definitely seems vulnerable to Spectre.

The question has been asked but there is no answer yet; it depends on the details of BOOM branch prediction and no one has made any claims yet about BOOM one way or the other.

<comment><USER13> >"It's a synthesizable core that runs on FPGA."

What does "synthesizable core" mean here? Does it simply mean that someone has written the Verilog that could actually produce a working core and made it available?

<comment><USER14> _> synthesizable core_

That means two things. One, that the design description ("RTL code") can be pushed through synthesis and place-and-route tools and turned into gates. This is useful for putting the design onto an FPGA or getting a piece of silicon (ASIC chip).

But it also means "not custom", as in, the gates are not auto-generated from "synthesizable RTL" but rather than laid out by hand. Full custom can eke out some improvements over synthesizable logic, but it's also more expensive and can preclude testing out designs on FPGAs before manufacture.

Most modern chips are mostly synthesized with some of the more critical components (and more "regular" structures) handled using custom or semi-custom methodologies.

</comment></comment></comment></comment><comment><USER15> This is a piece without substance since it basically says "Oh hey, competing chips actually selling to customers have some issues. We promise we'll be better when our lab designs finally end up in your hands. Trust and fund us now!" We'll see.

Anyone interested in what a better hardware/software-security architecture for RISC-V might look like should check out these exemplary projects:

[http://www.crash-safe.org/papers.html](http://www.crash-safe.org/papers.html)

[http://www.cl.cam.ac.uk/research/security/ctsrd/cheri/](http://www.cl.cam.ac.uk/research/security/ctsrd/cheri/)

[https://vtechworks.lib.vt.edu/bitstream/handle/10919/29244/e...](https://vtechworks.lib.vt.edu/bitstream/handle/10919/29244/edmison_joshua_dissertation.pdf?sequence=1&isAllowed=y)

CHERI already runs FreeBSD on a FPGA machine. I previously suggested merging Rocket with a version of CHERI as a start for that reason. Then, Draper is modifying or has modified RISC-V to use SAFE architecture. They're creating a brand around it as below.

[http://www.draper.com/solution/inherently-secure- processor](http://www.draper.com/solution/inherently-secure-processor)

So, that's what I've seen so far that addresses piles of vulnerabilities with a whole-system style of protection.

<comment><USER16> > _This is a piece without substance since it basically says "Oh hey, > competing chips actually selling to customers have some issues. We promise > we'll be better when our lab designs finally end up in your hands. Trust and > fund us now!" We'll see._

I think they're fairly clearly stating that the licensing and community arrangements around RISC-V make it an excellent testbed for high performance mitigations to these problems.

</comment></comment><comment><USER17> I'm wondering if the Mill would evade Spectre 1 and 2, have they said enough yet to speculate about that?

<comment><USER18> Are you concerned with spectre 1+2 across protection domains or in the context of running untrusted code within the same process (e.g. a like a JS VM)?

<comment><USER17> Untrusted code within the same process seems like it'd be harder for the CPU do something about, since it can't know what portions of the address space are trusted and not.

</comment></comment></comment><comment><USER19> Is RISC-V vaporware? It's on HN all the time but I never see where it is available for purchase.

<comment><USER20> HiFive1 is a dev kit based on RISC-V you can buy: [https://www.sifive.com/products/hifive1/](https://www.sifive.com/products/hifive1/)

</comment></comment><comment><USER21> They do have a point.

The more the complexity, the harder it is to keep software (or hardware, which for CPUs is defined as software) bug-free.

CISC simply has no place in the networked world, and RISC-V is the best RISC architecture.

<comment><USER22> Nineties probably wants its CISC vs RISC fight back.

Nowadays it just doesn't matter, because CPUs translate ISA into whatever they please.

Cache and out of order buffers (speculation) is what is behind latest security issues.

<comment><USER21> >Nowadays it just doesn't matter, because CPUs translate ISA to whatever they please.

Doing that comes at a cost, which compounds the complexity already added by merit of being CISC in the first place.

<comment><USER22> Larger code size is not for free either.

Besides, this translation layer is not a major source of complexity anymore. Even instruction decoding in x86 is not a big deal anymore.

<comment><USER21> >Larger code size is not for free either.

What larger code size?

RISC-V is no worse than x86-64.

Refer to: [https://riscv.org/wp-content/uploads/2016/07/Tue1130celio- fu...](https://riscv.org/wp-content/uploads/2016/07/Tue1130celio-fusion- finalV2.pdf)

<comment><USER22> That's a nice property for sure. Typically RISC ISAs have had larger code size.

Being a new ISA, RISC-V does have an advantage of being able to learn from past mistakes.

<comment><USER21> Simple vs Complex, but same code size. An easy win for simple.

It's very nice, indeed. Unlike the established RISC ISAs, this one's created with decades of RISC (and CISC) experience to draw from.

I'd of course still have my doubts whether this is going to draw any traction, if it wasn't for the list of RISC-V Foundation members.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> Yeah. RISC-V is good.</comment>


The Official Apple Computers Apparel Collection From 1986 is Pretty Fantastic  - <AUTHOR> http://www.geekosystem.com/the-official-apple-computers-apparel-collection-from-1986-is-pretty-fantastic/ <comment><USER2> Jobs was not a tech person, he was a fashion maven. Apple has not always been a good solution, but it has always been a statement.

<comment><AUTHOR> _Jobs was not a tech person, he was a fashion maven._

Um, _maybe_ Jobs valued aesthetics (or even fashion) over tech, but to say he was not a tech person is pretty far-fetched.</comment></comment>


Making the Internet Archive's full text search faster - <AUTHOR> http://gio.blog.archive.org/2017/05/31/making-the-internet-archive-full-text-search-faster/ <comment><USER2> This is pretty cool. I just wish these recent "improvements" to the archive.org site weren't also associated with a massive decrease in accessibility and usability.

The switch to a javascript-rendered site frontend has made using the wayback machine pretty much inaccessible to all but the most modern and bloated of browsers. Emails to support about keeping the old site going at an alternate URL or fixing fall-back rendering/operation for no-JS have been met with silence.

I guess I'm just not in the demographic archive.org is targeting now despite being a heavy user for more than a decade. It's not the backend guy's fault but it does mean lots of us won't benefit from any backend improvements.

</comment><comment><USER3> 15-25TB to provide search for the entire internet archive. This is a pretty small number if you think about it. Your avg undergrad class room would be able match it if they pooled all their devices together. So why do we need Google and Bing ladies and gents? If we can get a 100 devs in every city in every corner of the planet to donate a hardrive/cpuand some time, distributed open search could well do to Google what Linux did to Microsoft. I think its going to happen. There is lot of duplication of the above work going on in little silos like Wikipedia, Khan academy, Stackoverflow, Zealdocs etc it just has get hooked up

<comment><USER4> You know Google is free right? No need to donate resources. And latency will be so horrible if you get 100 devs in every city to donate resources.

<comment><USER5> The main point about search is valid. Centralized search might have been required as the internet exploded. Not anymore. I work on Wall St and there is lot of curated distributed search index sharing going on.

<comment><USER4> Any links to what's being shared?

How are the content crawled?

</comment></comment></comment></comment><comment><USER6> hi, I am the author of the article.

@devhead: To import the data into ES we used a custom application to extract the text from the OCR'd documents. This is required to support our bookreader software. A complete ingestion takes a few days; we rate-limit indexing in order not to overload the cluster, and maintain reasonable search performance.

<comment><USER7> Hey, I'm wondering why you didn't consider using stopwords to prevent bloated inverted index entries fir words like 'the'?

<comment><USER6> We don't use stopwords because we want to find all the best and complete matches. We don't want to ignore any of the words part of the search query.

<comment><USER8> You do use stopwords. Your most common unigrams are not in the index, by design. You just use your own stopwords.

</comment></comment></comment></comment><comment><USER6> If you are having problems loading the page, try this url: [https://medium.com/@giovannidamiola/making-the-internet- arch...](https://medium.com/@giovannidamiola/making-the-internet-archives- full-text-search-faster-30fb11574ea9)

<comment><USER9> Making the Internet Archive's blog faster

</comment></comment><comment><USER10> awesome job IA, glad to see you were able to push through it and get your performance to an acceptable rate!

It'd be awesome if you could share how you imported the data into ES and how long it took to fully go through that large dataset?

</comment><comment><USER11> i think you didn't hear before riak with solr backend. you can have all of your goals with a very few effort. pm me if you like to get some help for installation and setup. i'd be glad to help web archive guys.

</comment><comment><USER12> A nice article, and very good final result. (I love the cow pictures :))</comment>


Chrome 14 consumes more memory than Firefox 7 - <AUTHOR> http://techpp.com/2011/09/28/chrome-14-vs-firefox-7-memory-footprint-comparison/ <comment><USER2> Chrome uses a process-per-tab model, so each tab you have open is its own running rendering engine/browser instance.

That is why you can have tabs crash and be closed without taking down the entire browser.

Firefox shares more state internally between tabs and as a result, a misbehaving tab can take the entire browser down.

All that being said, the Firefox team has been _super_ aggressive as stomping out memory usage in the 6.0 and 7.0 releases and the work shows, they are doing a great job tuning Firefox.

Net-net, we all win.

</comment><comment><USER3> "Then I opened Windows Task Manager and noted down the Memory consumption of all chrome.exe processes"

This approach won't yield an accurate result because of memory being shared between processes. As an example, 12 chrome processes might appear to be using 50mb each, but if half of that is from shared libraries, then the actual total is 325mb, not 600.

</comment><comment><USER4> Is this surprising since chrome uses a sandbox model, It is firefox's apparent memory leaking that's the worry.</comment>


Ask HN: What to do if client ghosts and won't pay? - <AUTHOR> I operate as a US based, LLC and have a UK based client. We have a pretty robust master services agreement in place with clear term and termination terms. The client stopped talking to me or replying in anyway with a large bill (1 FTW, ~2 months). What should I do? <comment><USER2> Never loan a client more than 1 or 2 weeks pay. My current client has gave me a large retainer up front but usually I try to work for more than one client so no single client owes me more than 40 hours pay.

Technical competence is only 1 of the 3 things you need to be good at to make it in this business; the other two are (a) getting paid (b) finding new work

<comment><USER3> I would say that technical competence is not one of the 2 things you need to make it in the business.

You only need to find work and get paid.

Technical competence is just a bonus that may improve longevity, sometimes.

<comment><USER2> You could be right. I jokingly tell my friends that I get contract because people know my reputation - and yet they hire me anyway. :-)

</comment></comment></comment><comment><USER4> Random advice from the internet:

The most useful thing you can do is a "mission debrief".

\+ Identify what were the warning signs of non-payment. Sometimes they will be there from the start and the client never intended to pay. In longer relationships, non-payment is part of changing behaviors and often due to other financial stresses (this is how it tends to play out in economic downturns).

\+ Identify the reasons you accepted this particular job/client. It is one thing if this job/client looked like other previous jobs/clients. It is another if the job/client was accepted due to ambition (expanding internationally) or desperation (just need the work) or greed (terms more lucrative than normal).

\+ Identify why the client chose you. Maybe you have a rare special expertise (though by definition, this is rarely applicable). But if your services are somewhat fungible (much more common), it is worth examining why you and not another similar service...or to put it another way, a web developer might think about "what happened to this potential client's last developer?" Was the lead outbound or inbound? Was it a warm introduction or a cold call?

In the end, the best likely outcome is a better intuition about potential clients and which one's should be avoided and a greater willingness to stop work quickly over payment and eventually a better process for assessing the financial wherewithal of people and their projects. It is unlikely you will be paid.

For what it is worth, contracts/terms are somewhat useful for defining project scope and describing the processes of work delivery and payment. Unless you are big enough to have attorneys on retainer, they are pretty useless as something to point at when things go off a reasonably happy path. Client and project selection are much more valuable.

Good luck.

<comment><USER5> +1 on identifying all the warning signs. I've done a lot of contracts, many unpaid. All have the same signs.

A major symptom is that many of my worst clients are both impressive and repulsive. We have decades of experience with people (yes, even us needs) and whatever your instincts are about someone, it's probably right.

</comment></comment><comment><USER6> UK small claims courts.

[https://www.gov.uk/make-court-claim-for-money](https://www.gov.uk/make-court- claim-for-money)

You can file your claim online if it's under GBP$100k (~USD$130k). There is a faster/simpler claims process if the amount is under GBP$10k (~USD$13k).

Usually this is enough, however if it gets to the point where they have a court hearing and your presence is required (unlikely), then give someone right of attorney to represent you (eg. friend, lawyer, etc.).

<comment><USER7> This might be hard if OP is outside the UK. If the client responds to the claim disagreeing (i.e. saying they don't owe money), then the next step will be a court hearing. The amount in questions is likely less than the time+money it would cost OP to go to the UK to attend such a hearing.

"You might have to go to a court hearing if the other person or business (the 'defendant') denies owing the money and you disagree with their response."

<comment><AUTHOR> I ended up filing with a debt collection agency in the UK. As an international client I lose 35% of whatever they collect but it still is worth it to me. The nice thing is that there are no other fees.

Funnily enough the client became very responsive after they found out we had legal representation in the UK. Still have not seen any money in the door yet.

</comment></comment></comment><comment><USER8> I had a client ghost on me in this way. My contact at the company left and I had an outstanding invoice for four figures.

I sent them the late invoice every two weeks for four or five months (while I went on with other work). I always was courteous and asked if hey had any questions or concerns about the invoice. I also reminded them it was past due.

I did send them a Christmas gift (box of chocolates) and I think that is what finally pushed them over the edge.

They paid me.

It was a hassle and I wish I'd gotten a deposit upfront.

<comment><USER9> Thats a long time to wait for the payment. Did you ever consider court?

<comment><USER8> I did not. Probably should have at least talked to a lawyer, but I didn't.

</comment></comment></comment><comment><USER10> It's not a direct answer for you, but here's a long (40m), popular, talk that seems relevant. Mike Monteiro: F*ck You, Pay Me (explicit language). If you're interested, I'm pretty sure its been posted here a few times with discussion. It's actually a good video to watch periodically.

[https://creativemornings.com/talks/mike-monteiro-- 2/1](https://creativemornings.com/talks/mike-monteiro--2/1)

If you want a specific answer, skip to 11m20s

<comment><AUTHOR> This is incredible.

</comment></comment><comment><USER11> Just move on. If he ever comes back, insist on paying what he owes before doing any further work. Once he pays apologise and refuse to do any work because you are busy with other clients (real or imagined).

If he doesn't come back it's not worth it to chase.

On your next jobs double your rate and ask for half up front. If client is nice offer small discount at the end to keep your clients happy. People you want to work for rarely care about the price but are as happy about discounts as anyone.

<comment><USER12> I actually have had a client come back and try to arrange further work without settling the last bill. Either the work was so bad it didn't deserve to be paid, or they cheated me, but not both. Its amazing that people think they can 'work the system' and extract free labor.

<comment><USER8> Wow. Did they just ignore the previous invoice, or how did they explain coming back to you? Did they end up paying?

<comment><USER12> they just kind of admitted we had a disagreement that needed to be resolved, but didn't see why that wouldn't preclude me from taking on new work for them

edit: actually, thinking about it again, I'm pretty sure they implied that completion of the new work might cause them to reconsider their stance on paying for the initial work.

<comment><USER13> To me that seems like they were playing you.

</comment></comment></comment></comment></comment><comment><USER14> Not sure how this works with international clients and/or in your country, but in the past on two occasions when I've had a client decide not to pay I've done the following;

1\. Send a final notice letter, indicating that non-payment will result in the debt being referred to a collections agency.

2\. Sell the debt to the highest bidder, ie a debt collector.

In one instance, I got paid after the letter. And in the other, I made back ~60% of my money + got a VERY entertaining call from an ex-client who'd just had a debt collector rock up in his lobby and refuse to leave.

I'm a big believer in "F#ck you, pay me" and when I do freelance work I make sure that my clients share that belief. Generally I also lay out a schedule of payments based on either milestones (ie 'X is implemented') or on a regular timed schedule (normally once a fortnight) - if the client misses a payment, work stops until they pay.

Never let a client threaten you with "bad word of mouth" or any other nonsense like that - at the very worst they'll deter one of their mates from doing business with you, and if they're alike at all there's a good chance they would try and not pay you as well. It's not worth establishing a reputation that clients can just not pay you and get away with it.

</comment><comment><USER15> I've always worked this way: I'll do the work for you because you need it. I send you an invoice. You pay. I have a client who gets busy and I sometimes I have to remind her to pay me. Usually, she'll need more work done, and that's when I remind her that until she pays her invoice, no more work will be done. She has always paid it. Because to turn to anyone else will require finding someone who actually knows what they are doing.

If you have any thing running in which they rely on you, suspend it in order to get their attention until payment is due. If a large bill is due, and they are having trouble paying it, than offer them to pay X by this date, and another X by this date. If no payment is made to you, than inform them that if they don't pay X by a certain date, they will be terminated and any future work for them will not be considered at all.

If you wish, you can throw in some legal jargon in there that you will be getting a lawyer or proceeding to small claims court, if you wish to take it that far.

</comment><comment><USER16> If it was me, I would call and get straight on to their finance / billing team. Just chase it until they realise that paying is the easier option. Not in an angry way, more just stay on the phone until it's sorted, 'let's wrap this up today' kind of attitude.

It's too easy to ignore your e-mails and then there is such friction with replying after they have ignored you several times and think they are getting away with it.

Being based in the UK, I will follow up on your behalf if you want. I like getting this kind of thing sorted.

</comment><comment><USER17> Depends how much money it is and how important that money is to you.

If it hurts but you'd rather not have the time sink, drama, stress and effort of pursuing it, then drop it with lesson learned.

The second option, appoint a lawyer in England and if they say you have a case then let them pursue it for you.

I would warn you not to get too involved. Legal cases are _extremely_ stressful and occupy a huge amount of head space. Try to just hand it to the lawyers and give minimal thought to it.

I've seen many people become totally obsessed with legal cases and who is right and who is wrong, and they can't think of anything else and alienate themselves from everyone around them because they can think of nothing except the legal fight. Don't do this.

Depending on who the company is, some people choose to make their quest to be paid public in an effort to shame the company into paying. It might work I suppose.

It's also worth just calling and calling and calling until you get to speak to the right people.

I've had clients who intended to pay but were under cashflow pressure and thus ignored me. My relentless calling twice a day eventually got them on the phone, at which point I asked to understand what was going on, and having secured a commitment to pay, I then relentlessly called daily from the day they said they would pay (they usually don't pay on that day). Start leaving detailed messages with every single employee of the company that you can get on the phone saying why you are calling. "Could you please get him to call me back ASAP regarding the unpaid bill of $X. I've left 30 messages and he has not called me back." I also explain to them that this is a small company and this money makes a real and tangible difference to my ability to feed myself and my family and could they please do their cashflow management with bigger companies who can absorb the pain.

And, if you want to play hard as a final resort, let them know you'll be very vocal with their client base and employees with personal phone calls until you get your money. Become such a thorn in their side that they pay to stop being annoyed by you.

Public posts on LinkedIn asking them to call you about the unpaid bill are also an extremely crass but possibly effective mechanism for getting them to sort it out.

Finally, don't be whiny or strident cause you'll sound like a crackpot. Always keep the story straight and bring it back to the certainty that you are owed the money. "We've got clear signed terms here, the work was done, the costs incurred, payment now 130 days past due, there's no reason this should not be paid". _Never_ get angry when communicating with them about it because this will give an excuse to disengage and will lose you the high moral ground... keep monotonously consistently factual and emotionless with your message.

Another option you have is to sell the debt to an english debt collector. I know of one debt collector who employed a well-known former world champion boxer on salary and I have no doubt he made some personal debt collection visits - there's a fine line there but if these people have effectively stolen your money then why not spend 50% of it to make it their problem with an aggressive debt collector.

Is it a small company or large company? Maybe they have gone out of business? What do you think is the reason they have not paid?

</comment><comment><USER18> If your agreement is as firm as you say it is, continue what you are doing and /Sell/ the debt. You'll get a guaranteed percentage of the outstanding sum even if the ghost can't be tracked or prosecuted. The best part: No headaches, wasted time or bad PR due to dragging a client into a lawsuit.

<comment><USER19> Who would you sell the debt to?

<comment><USER13> I believe the term is "factoring". There are collection and similar companies that will buy your collectibles. In my experience, they will not buy a single collectible. Instead, you enter into a contract to sell your on-going collectibles. One company that I researched wanted 100% of my collectibles or none at all. It is a good arrangement to help with cash-flow, but in my experience the terms and conditions are such that you will probably need to increase your rates by at least 30% to maintain your present revenue levels.

<comment><USER20> Factoring is a method of financing your business, say to buy raw materials to produce finished goods for sale. They want access to your receivables to make sure they are repaid. What the GP is referring to is a collection agency, where you sell a debt to them for $.10-$.30 on the dollar and they have all the rights to collect.

<comment><AUTHOR> I ended up going with a no fee unless you win agency that keeps 35% of what they collect. Honestly, that seemed pretty fair to me.

I haven't seen results yet.

</comment></comment></comment></comment></comment><comment><USER21> I would suggest finding one of the several online solicitors who will send a payment demand on your behalf - typically threatening the recipient with a winding up order. The fee when I tried this was very small (£5 I think) and the client paid up very swiftly. Don't do this unless you're willing to risk losing the client though.

</comment><comment><USER22> Why aren't they paying?

</comment><comment><USER23> waiting is good advice</comment>


Letter to a Young Songwriter - <AUTHOR> http://www.visakanv.com/blog/2014/08/0152-letter-to-a-young-songwriter/

<comment><USER2> I like this advice, not only for a young songwriter I know well, but also for myself as a budding hacker. Too much of my creative energy I spend on doubting my latest idea, to the point I don't get to implement the code to make it real. I appreciate the ideas and the energy you put into this post.

<comment><AUTHOR> Glad to have been of help! Go forth and create, as much as you possibly can. :-)

</comment></comment><comment><AUTHOR> I wrote this blogpost for my younger self, and for other young creatives who might be going through what I did when I was a confused young songwriter trying to do everything all at once (and tragically doing less than I think I would've been able to with proper guidiance). I'm sharing on HN because I think there are some parallels in all creative work, and that some of you may find some utility in this.

A quick recap/rewrite of this post:

1: _Aim to be prolific_ , rather than "to be great" or "to have fun". We can have much more interesting conversations once you have a body of work.

2: _Screw 'best'._ Avoid trying to write the best possible song. Your definition of 'best' will be a moving target.

3: _Write badly._ Deliberately try to write bad songs, rough songs, strange and awkward songs. They'll teach you more than you'll learn from writing what you think is "okay".

4: _Screw originality._ Forsake the quest for originality, it's a mirage. Learn other people's songs as much as you can. Learn songs from genres you don't really care for.

5: _Think less, write more._ Don't try to be smarter by thinking harder. Be smarter by processing more, recursively. Write new songs. Learn songs you didn't know. Learn new chord progressions. Take long walks through unfamiliar territories.

6: _Play scales._ It's like learning to play with the underlying code of music itself. It'll improve your appreciation of music that you listen to, and it'll improve your ability to navigate the music you play.

7: _Play slow._ Don't rush after music. Immerse yourself in it. Imagine really bad sex, and then imagine really good sex. What's the difference? Good music is like good sex.

8: _Always Be Creating (Or Listening)._ If you're not doing one of the two, you're probably procrastinating. Ask yourself which of the two states you're closer to, and dive into that.</comment>


Discovering the Link Between Effort and Reward: What I've Learned Freelancing - <AUTHOR> http://geeksinboston.com/2009/01/05/discovering-the-link-between-effort-and-reward/

<comment><USER2> This explains why the 'you act like an employee, just easier to fire' in- person contracting gigs usually only pay 25%-50% more than the same gig as a salaried employee, while my experience has been that off-site, work-when-you- can freelance work more often commands two to four times the hourly rate you'd expect as a salaried employee.

<comment><USER3> There are other reasons for the differential.

First, a full-time consultant has to spend time getting work, and he doesn't get to bill that. That's part of why the 2-4 ratio exists. I've heard that you can expect to spend an hour looking for work for every hour that you bill. Also, being a consultant is riskier, not only in the short-term financial sense, but also in the long run: if you're unsuccessful as a freelancer, you've got nothing to show other than the fact that no one wanted to hire you, and you're probably too burned-out/exhausted by searching for work to do any interesting side projects.

<comment><USER2> my experience with the 'hour here and there' consulting that I did a few years back was that the marketing time is more like 1 hour marketing to 30 hours work, or better. But then, I charged closer to 150% what I would expect salary (vs. 200-400%) It would have worked swimmingly if I didn't have a capital- intensive side-project. It was a pretty easy way to support myself while working two days a week or so, leaving lots of time for self-improvement.

I dono... maybe I would have gotten rejected more if I charged more, but I usually enjoy the technical stuff more than the marketing, so it makes sense to work two hours on technical work rather than one hour marketing and one hour technical work, if that is indeed the choice.

I have had the occasional client willing to pay me 4x what I would expect from a salaried gig, but I mostly lucked into those. Some clients offered me more than I was asking, so maybe I would have done OK insisting on the higher rates.

</comment></comment></comment><comment><USER4> Install RescueTime and you might be surprised how much it changes your attitude. They have this nice productivity score that really makes you want to improve, just to see that little number go up and feel proud of yourself. It's almost like karma! Ooh better stop writing or that score will go down.

<comment><USER5> Agreed, I love RescueTime

You just have to be careful that you tag things correctly and are honest about it. The default tags and categories are pretty good, but you have to decide for yourself if hacker news is really that productive ;)

</comment></comment><comment><USER6> I've also noticed this, when I'm at work some days I will just pound out work and 6 hours can fly by. Other days 6 minutes feels like 6 hours and anything going on distracts me.

I realize how little work I end up getting done, its one of my new years resolutions to be more productive.

And no I'm not organized enough for GTD or what not. Best thing for me has been the joesgoals.com website.

</comment><comment><USER3> I'm not sure that I buy the billable/not-billable distinction as a useful measurement of productivity and progress. I spend a lot of time reading up on new concepts and programming languages, and it gives me a lot of new ideas. It's probably not "billable", but it's work because it makes me better at my job.

I'd say that I average 45 hours of actual work per week, discounting the time I'm "at work" but goofing off, while including the time I spend working at home, even if that "work" is studying or discussing programming languages with other hackers to trade ideas.

<comment><AUTHOR> The billable/non-billable distinction isn't the only one, nor always the best. But it is useful: being able to crank out a lot of them is immensely useful at crunch time. On the other hand, an organization entirely filled with people who primarily value billable hours could well be pathologically unimaginative.

</comment></comment><comment><USER7> Thought it was just me.</comment>


Introducing: Free Access to Rdio - <AUTHOR>

http://blog.rdio.com/us/2011/10/introducing-free-access-to-rdio.html <comment><USER2> Care to tell us a bit more about the project? For example what makes it different from other music services etc?

<comment><USER3> This is not a "project". Rdio is one of the biggest music subscription services out there. They're similar to Spotify but they're web-based (no software), have a slightly smaller catalog, and have been in the US for longer. Up until recently you had to have a subscription to access it at all. Now they have this free version.</comment></comment>


You can root your Google Wifi router, but you'll need a screwdriver - <AUTHOR> https://www.theverge.com/circuitbreaker/2017/7/17/15986156/galeforce-open-source-google-wifi-router-hack <comment><USER2> Direct link to GitHub project with more information. [https://github.com/marcosscriven/galeforce](https://github.com/marcosscriven/galeforce)

</comment><comment><USER3> This seems to work the same way as the chromebook. I also had to open that up and remove a small screw to be able to flush it.</comment>


Show HN: Fastlane – a simple redis and docker based queueing service - <AUTHOR> https://github.com/fastlane-queue/fastlane <comment><USER2> The name should probably be changed, Fastlane is a popular app automation service.

<comment><AUTHOR> I found about it after naming. It was named EasyQ first, but there's already another project named like that. :( Maybe we'll change the name later on.</comment></comment>


Ask HN: How does your company recognize yearly employee anniversaries? - <AUTHOR> At Huge, Inc. they get an axe (an axe!) at 5 years. At twitter design they get cool wooden blocks. Some places it's just acknowledgement, which is great. What does your company do for it's employees when an employee hits another year or milestone? <comment><USER2> I think one guy got a bonus for 20 years other than that nothing</comment>


Ask HN: How to get US H1B visa when located abroad? - <AUTHOR> I currently work in Software Industry in Product Management role. I completed my MBA from a Top 5 Bschool in US and was working in US for a few years on H1B. After my H1B visa expired, I returned back to my home country. I'm now thinking about returning back to US, possibly on H1B. How can I get a H1B sponsorship from a US company/startup when I'm currently located abroad? Should I work with some US consultancy which can apply for my H1B visa? Once I get my H1B visa I can have conversation with the US company/startup that I want to work with and transfer my H1B visa to them? I'm confused, please help! <comment><USER2> We're trying to arrange for YC's immigration lawyer to do an AMA on HN. I recommend that you watch for that thread and post your question there. He's excellent at explaining this stuff.

We'll announce the upcoming thread on HN earlier that week.

</comment><comment> chirag- [http://www.jobsintech.io/#q=&page=0&refinements=%5B%5D](http://www.jobsintech.io/#q=&page=0&refinements=%5B%5D)

</comment><comment><AUTHOR> Also, as I did my Masters/MBA in US, can I get any exemption (STEM?) from the H1B visa lottery process?

</comment><comment><AUTHOR> Good to see a service like TripleByte. But is useful only if I already have the H1B visa :(</comment>


Deis – An open source PaaS - <AUTHOR> http://deis.io/overview/

<comment><USER2> Can someone explain how this is different from Docker? As someone who hasn't used either, I'd really appreciate an explanation of the nuanced differences/how they relate.

<comment><USER3> docker is the brains, by talking to the operating system it makes easy to use OS containers (which are analogous to VMs but much cheaper since they are one process rather than a whole "machine").

Deis is for orchestration. He's the conductor of the orchestra. It's the next level up, for managing how multiple containers get set up and talk to one another.

</comment></comment><comment><USER4> This is an awesome example of the kinds of things Docker is making possible. It seems like these PaaS solutions are just sprouting up left and right now, and it's exciting! It wasn't so long ago that "deploying" meant dragging folders into an FTP window and hoping things worked just fine.

<comment><USER5> It surely is _exciting_ , but I do wish more people would throw in with the Docker-based PaaSes that already have some momentum (Dokku, Flynn, etc.), rather than making their own. I mean, I guess the required glue left over is about on the level of a static site generator, which explains why everyone thinks doing one as a weekend project will be great fun--but just like a static site generator, one weekend (or even one fulltime developer) isn't gonna make something I'm willing to build projects for clients on top of. Which is something I really, really want to do.

So let's pick a project to be "the Rails of PaaSes" soon, okay? I _neeeed_ one. :)

<comment><USER6> I started to use Dokku, got it installed and my app deployed, then realized that it only supported one app. Such a strange design decision for a virtualization platform. It really drove home to me how unfinished these new PaaS solutions are. We're still another five years or so from "the Rails of PaaSes".

I'm going to double down on 12 factor. The kind of encapsulation involved, storing the app in code, config in the environment, data in persisted resources, is ten times better than virtualization.

<comment><USER7> Allow me to apologize if I sound blunt, but I think you missed the point of Dokku. It is a, what, 100 lines shell script? It supports a single app, but you can run it multiple times. The same way that Heroku supports a single app _per git repository_. It's a kind of design decision, and not a limitation per se.

Dokku is a demonstration of what you can achieve with Docker + a very little shell script. In my humble opinion, it's very promising that you can achieve so much (something that lets you deploy applications in a Heroku-compatible way) with so little.

Also, 12-factor is totally orthogonal: you (not you specifically, but the general developer) should use 12-factor as much as possible (because most of it can be considered as "best practice", I think), then you can deploy on IAAS, PAAS, your own machines, etc.; and using 12-factor just makes the whole process easier.

<comment><USER6> I did miss the point of Dokku. Unfortunately, I didn't realize that until after I'd already burned 3 hours on it.

</comment></comment></comment></comment></comment><comment><USER8> Previous discussion

[http://news.ycombinator.com/item?id=6167712](http://news.ycombinator.com/item?id=6167712)

</comment><comment><USER9> Anyone with hands on experience to compare Deis to something like salt cloud (from saltstack) ?

I know one is using chef and the other is using saltstack, but i'm talking configuration, ease of deployment and reliability.

</comment><comment><USER10> "Deis is designed to work with any cloud provider, although only EC2 is currently supported."

Any idea when out of the box Azure support is coming?

<comment><USER11> We started the Azure integration and got hung up with their Python SDK. We're actively working with the Microsoft guys on it, but I wouldn't expect anything usable for a few months.

</comment></comment><comment><USER12> So the perceived value of Flynn vs. Deis will be that it's:

1\. implemented in Go vs. Python+Ruby which means no dependencies, easier install, etc.

2\. Modular architecture: in addition to Docker will also use CoreOS and etcd.

<comment><USER11> I would say Deis's perceived value is:

1\. Built using DevOps tools widely in use (i.e. Chef) so it integrates easily into most environments and is an easier sell to conservative Ops teams

2\. Implemented with Django, Celery and other components that may not be as sexy as writing from scratch in Go, but are battle tested -- which is a big plus for application platforms.

In my opinion, there's room for both approaches in the Docker PaaS world.</comment></comment>


Capitalism: Hollywood's Miscast Villain - <AUTHOR> http://online.wsj.com/article/SB10001424052748704025304575284722645443124.html <comment><USER2> One exception, noted by the Journal's editorial page, was the first Ghostbusters movie.

</comment><comment><USER3> I don't think most people have an issue with profit, it is just the "profit at the expense of others" (people, environment, justice, etc.) and the "never enough" mentalities that raises hackles.</comment>


When the Unix load average was added to Unix - <AUTHOR> https://utcc.utoronto.ca/~cks/space/blog/unix/LoadAverageOrigin

<comment><USER2> If memory serves, the load average calculation was the only use of floating point in the BSD 4.2 kernel. Reworking the algorithm to get 4.2 running on the National 32016 before the floating point co-processor was available was my first time inside the kernel. Fun times.

</comment><comment><USER3> I'm one week older than the Unix load average!

Or perhaps: my reported uptime is guaranteed to be longer than any Unix system's. :-)

<comment><USER4> Really, you have never been rebooted?

<comment><USER5> no. he just sleeps :)

</comment></comment></comment><comment><AUTHOR> Also of interest is "Understanding the (original) meaning of Unix load average"

[https://utcc.utoronto.ca/~cks/space/blog/unix/LoadAverageMea...](https://utcc.utoronto.ca/~cks/space/blog/unix/LoadAverageMeaning)

</comment><comment><USER6> Given how hard it is to determine what is actually causing high load sometimes I'm surprised we haven't evolved more easily actionable metrics.

<comment><USER7> You mean like per process time spent active on a CPU?

You could poll that ever so often and log the results to a database if you actually cared; but the act of measuring changes the results...

<comment><USER6> I mean finding the actual cause of a high load number. There's no way to break it down by process, or even find out if it's because of IO or network, etc. without using other tools.

<comment><USER8> Fellow poor soul, over the last 10 years whenever a server has high load I've got angry about the fact that load avg is not actionable, and exactly that "or even find out if it's because of IO or network"

</comment></comment></comment></comment><comment><USER9> And don't forget that load average means something different between each OS</comment>