Sim City adopts a tilt-shift style look and feel - <AUTHOR> http://www.wired.com/gamelife/2012/10/wireduk-sim-city/ <comment><USER2> A picture's worth a thousand words . . .

[http://www.gametrailers.com/videos/fch4fp/simcity- gameplay-d...](http://www.gametrailers.com/videos/fch4fp/simcity-gameplay- debut)

Surprising that Wired actually wrote close to 1,500 words with a headline about the graphical style of the game, but included one scant screenshot. . .

<comment><USER3> Interesting. I hope that this doesn't become Sim Suburbia. The lack of "subway"/"rapid transit" (just "rail" and "streetcar") is worrying. Hopefully larger buildings won't be surrounded by parking lots - streets in the city (besides 14th, 34th, etc.) are narrower than those in suburbs.

I also don't like how the trains just instantly turn around and how T intersections on rails are possible - these are things that were okay in the 90s, but that I would have hoped to be fixed by now.

<comment><USER4> Ha, that's exactly what I was thinking. It seems you can only ever build the same kind of boring city in Sim City, one fundamentally built around streets and cars. It seems even worse with this newest incarnation: Streets form the backbone through which everything runs. You can only build along streets, they are (or at least seem to be) the only thing that carries water and energy. It seems you cannot deemphasize the role streets play even if you wanted to.

I want pedestrian only streets and avenues, bike lanes, subways, different kinds of trains, etc.

I can see why they didn't (making only streets the fundamental building block simplifies the game), but the cities you can apparently build with this Sim City are not very appealing to me.

<comment><USER5> So, "SimCity Planner"? I like it.

Personally, I'd love a "SimCity Manager" that was ran from a local government perspective, rather than a "God Hand" one. You change zoning, woo potential investors/business, decide if kids can skateboard downtown, build a skate park, or just arrest them, etc.

<comment><USER6> Master of Orion 3 tried to "SimCity Manager" approach: the result was one of the least enjoyable games of all time.

<comment><USER5> That's... Unfortunate. But hey, I'll give it a shot. Maybe I was the person they made it for; thanks!

</comment></comment></comment></comment></comment></comment><comment><USER7> All I've read about the new SimCity so far makes me sad.

The gameplay video [1] makes it look like a nice game but I just can't countenance this trend towards making all games online, social and/or persistent. Why do I need to be online to play this?

I played, precisely once, Civ V and it was (IMHO) a terrible game. Civ IV OTOH was an amazing game... not for the game itself but for an amazing mod called Fall From Heaven II [2], which volunteers spent years on. I can't tell you how much time I spent playing that mod and playing out the different races and winning strategies.

The beauty of Civ IV is that it Just Works. You don't need to be online. You don't need to sign in to one publisher's bullshit social platform (one advantage of consoles like the Xbox 360 is at least the bullshit social layer is standarrdized as Xbox Live).

Sadly this doesn't work on a Mac as it adds a number of DLLs. I believe the guys who did that are developing their own game.

Civ has been one of the (now) very few turn-based strategy games, which is what I like to play. Not everything needs to be an FPS/RTS. I've seen reviews of Civ and Heroes of Might and Magic and the like being knocked for "not being an RTS" even though they never weer and hopefully never will be.

Seriously, I'd like something I can put on my laptop and just play on and off as I please without having an Internet connection (eg on a long-haul international flight). I was hoping that SimCity would be at least that but apparently not.

Screw Origin and the rest of the mainstream PC games industry. I can't be the only one. Where are the Kickstarter campaigns for kind of game? If I saw one, it'd be "just shut up and take my money".

[1] [http://www.gametrailers.com/videos/fch4fp/simcity- gameplay-d...](http://www.gametrailers.com/videos/fch4fp/simcity-gameplay- debut)

[2]: <http://forums.civfanatics.com/showthread.php?t=171398>

<comment><USER8> I really do understand your dissatisfaction, as I've felt the same way before about Blizzard games, but I actually feel like this is a game where always- online makes sense.

I've played SimCity since the last time there were no numbers on the box, and the best changes have always been the ones that fundamentally alter the gameplay, rather than add asked-for features like diagonal roads. SC 2012 may add plenty of those (curved roads!), but its real change is making multiplayer integral – playing in a live economy with other players. If it's executed right, opening it up to play solo on a plane should be as desirable as doing the same with Team Fortress 2.

As long as the multiplayer remains in service of gameplay (and not the quagmire of wall-posting "social gaming"), I'm really looking forward to this game.

<comment><USER9> > If it's executed right, opening it up to play solo on a plane should be as > desirable as doing the same with Team Fortress 2.

More accurate to say "as desirable as doing the same with Diablo 3" Team based FPSs don't work for solo gamers, ARPGs and building Sims do.

There will be benefits to the online community model which for some people will be wonderful, but for others the benefits are not wanted so it's just a pile of drawbacks.

<comment><USER8> I don't think you're quite using enough imagination here. I'm not talking about ARPGs and building sims in general - I'm talking about a very specific sim game that's structured entirely around multiplayer. If SimCity 2013 isn't that game, then yes, Diablo 3 is an appropriate comparison, but if it is, I think the Team Fortress analogy is apt.

</comment></comment></comment></comment><comment><USER10> I've been craving a new SimCity since SimCity 4 left me wanting. I've played Cities XL, and while it has it's own unique deal going on, it just grinds on me a bit. I don't like that your townsfolk will demand things that you can't provide, for example. You need to constantly juggle multiple cities, developing each in order to build a world rather than build a city. I need to ship oil from this town to that town I get water from, etc. This is all possible and advisable in SimCity, but far, far from required.

Even in Cities XL, I still spend most of my time micromanaging road traffic. I sit waiting on population levels to grow so I can unlock the rest of the tools (I hate having to sprawl my city out so far before I can unlock apartment buildings, then have to consolidate things back downtown).

I want a Sim City that I can play as my own, not how the game demands I play it. Sim City 2000 really was the last game like that I played.

</comment><comment><USER11> I've long been a SimCity fan, but every edition of the game has suffered from performance problems. It's fine when your city is small, but once it gets large enough to be interesting, it's unbearably slow. I've learned that the real minimum requirements on these games are a computer released 2-3 years after the game is.

Given the amount of marketing around the new game's excessive simulation of unimportant details, I expect it to be at least as bad as its predecessors.

<comment><USER8> I read somewhere that the tilt-shift effect is actually a performance booster as well as stylistic choice – it creates an LOD cutoff that enables lower-poly models to be rendered in the background to offset extra-high detail in the foreground.

<comment><USER11> If true, that is a really awesome hack. I've always assumed the performance problems were more about O(n^2) simulations, such as every Sim evaluating every route for driving to work, etc. If it's mostly graphics bound this could be a big help.

<comment><USER12> The whole application sounds like an optimizer's dream. Improving performance (especially startup) has always one of the most fun aspects of programing for me and to take one something like sim city where there are probably tons of opportunities and many different things to consider would be a real fun job.

</comment></comment></comment></comment><comment><USER13> _sigh_ I'll need to create an Origin account and always be online to play this, right? I miss the days when we could simply install a game. The only validation being a product key.

<comment><USER14> > I miss the days when we could simply install a game.

When was that? A decade ago my games required me to put the CD in the drive to play. And two decades ago my games required me to find random words in the user manual to make sure I wasn't a pirate.

I hate the game needing me to stay online. And it's a stupid strategy to hurt legitimate users to try to stop pirates. But to be honest, that's much less bad than what came before it :P

<comment><USER15> No, it's worse; in 5 or 10 years, you may no longer be able to play these games. With CDs / manuals, it's not a problem.

I'm currently playing (or rather, trying to play) Assassin's Creed. It's a series I never got into, so I bought the first two on Steam. Guess what? The servers at Ubisoft have been turned off. This leads to multi-second pauses every 60 seconds, and after various game events - [http://forums.steampowered.com/forums/showthread.php?p=33046...](http://forums.steampowered.com/forums/showthread.php?p=33046228) . At least the game still sort-of works, but if they "improve" the DRM any further, they'll be completely broken in the future.

<comment><USER16> You lose a CD or Manual (with install code) and you're SOL when it comes time to play the game again.

I hate DRM as much as the next guy but installing from server accounts is amazing.

<comment><USER15> In principle, I agree. But I haven't lost any CDs or manuals; if anything, they've become collectible items. Importantly, I have control over them; and no-cd cracks aren't exactly rare.

But with servers, there is no control. And it seems an obvious further development of DRM is to host some of the application code remotely, so that no simple workaround will be available to your children, should they want to see what games were like in your youth.

<comment><USER17> Luckily, the games of our youth will still be playable 10 years from now, and they are better than the current crop of games.

</comment></comment></comment></comment></comment></comment><comment><USER18> Somehow this looks a lot uglier than other tilt-shift photos I've seen. I wonder why that is. Bad blurring algorithm?

In the trailer, they mention "experimenting" as being a big part of the game. As a programmer, I would love to have a tree of save points, like in git. So I try out something, change a second thing, revert the second thing, try a third thing, revert it as well, revert everything back to the start. Wouldn't that be fun for ordinary people as well?

<comment><USER12> Hmmm I wonder if you could make a game built around this core idea, not just of save points, but taking different branches and even merging choices.

<comment><USER19> Read up on the recent re-release of Tactics Ogre for the PSP, and Radiant Historia for the DS.

</comment></comment></comment><comment><USER20> I'm quite excited about a new SimCity game. One thing I do wonder about is whether there will be an 'In-App-Purchase' type marketplace in the game. EA, on mobile at least, seems to have fully embraced the freemium model, and has been quite successful at it monetarily speaking.

I hope any IAP aspects don't get too out of hand.

</comment><comment><USER21> I hope this is optional, as I've always had this powerful irrational hatred of tilt-shift.

<comment><USER17> It's totally rational to hate fake tilt-shift, which is actually just fake tilt, as "shift" isn't involved in the process at all; it's just thrown in there by people who have no clue what they are doing, and just at blur indiscriminately to make their pictures "artsy".

</comment></comment><comment><USER22> Looks beautiful, but I admit I am not a fan of removing the pipes/subway/electrical grids

</comment><comment><USER23> I can't get hyped about this game. It will become the always only failure that Diablo III became.</comment>


Ask HN: Aaaargh? - <AUTHOR> I've heard rumors of a website possibly dating back to the late 90's where academic texts where shared and discussed, but that were invite only. The name was something like aaaarg.org, aaaargh.org, aarg.org, etc. Possibly related to Sweden.<p>Has anyone heard of this site? Or know were it might be located now? Or maybe a similar site? <comment><USER2> Currently at [http://aaaaarg.fail](http://aaaaarg.fail), Twitter at @aaaarg, gofundme for the lawsuit against them at [https://www.gofundme.com/aaaaarg](https://www.gofundme.com/aaaaarg)

Related sites might include [http://ubu.com](http://ubu.com) and [http://monoskop.org/Monoskop](http://monoskop.org/Monoskop)

<comment><AUTHOR> This is the one! Thanks a bunch, will fund. Haven't seen ubu before, but am already a big fan of monoskop! Great reads lay before me.

</comment></comment><comment><USER3> You are probably referring to: [http://arxiv.org/](http://arxiv.org/)</comment>


Silicon Valley: A Reality Check - <AUTHOR> http://slatestarcodex.com/2017/05/11/silicon-valley-a-reality-check/ <comment><USER2> This is a good article for pointing out the some of the great work going on in SV and why it's an engine for innovation.

That said, the Juicero was ultimately panned because it was a bag squeezing machine (and not a very good one), but it is also the sort of cynical ploy that requires a wifi-connection to "check the expiration date" when we all know it was to enforce their DRMed juice packets. The investors weren't upset that it was a ridiculous product, they were upset that it was suddenly not a Keurig-style landfill-stuffing nightmare that they could charge ridiculous sums to people for DRMed juice.

To paint SV with the Juicero brush is unfair, but let's not pretend there aren't tons of people (and VCs) in SV that would kill to get funding (or fund) just that sort of product.

<comment><USER3> That's precisely what SV has become - an engine for innovation, rather than a set geographic area. About 6-7 years ago people started referring to San Fransisco as, "Silicon Valley," which, geographically is not true, but it has become accepted because people know that both areas follow a particular brand of innovation. The culture and ways of creating certain types of business models which may have originated largely in Silicon Valley have spread to other areas, much as the London-based capitalist thinking of the 1600s-1700s has now spread across the globe, or the Dongguan-based capitalist legal structure has spread across China since the 1980s.

The term, "Silicon Valley," doesn't even make sense anymore as there are no longer any silicon fabs left in Silicon Valley. When you have all sorts of cities and places around the US saying, "We'll we're the silicon valley of X," or "We're Silicon Prairie." What they are literally saying is, "we're going to start up a bunch of silicon fabs in this region," but what they are actually saying is, "we aspire to be super innovative and follow this particular brand of ethos and culture."

Technological capability tends to be spread out over the world, and teams tend to work remotely. The author of this article is not even based in Silicon Valley, he claims to be based in the midwest. I am not based in Silicon Valley but I work with people from there all the time. I also work with people in Denver, Idaho, Montana, Minnesota, Chicago, etc., who are interested in this innovative industry. Wrapping ones identity up in a particular city-based geographic region to an excessive degree is almost as bad as being an outright nationalist. This city-nationalist way thinking prevents the free flow of ideas.

When people attack Silicon Valley in the news or blogs, they are creating a thesis against the idea of software and internet-based business models as a whole, rather than a geographic region.

<comment> rm_-rf_slash I disagree. Silicon Valley represents a distinct form of tech capitalism, characterized by the 10x firms and sky-high valuations of products that have yet to make a cent in profit.

Tech capitalism has a different tone in other places. A friend of mine works remotely for a company based in the Midwest, and the corporate/VC culture is worlds apart from Silicon Valley/San Francisco.

<comment><USER4> While this comment is perhaps a little more cynical that I would've gone with, the fact is that a whole lot of the most valuable SV companies have never turned one bit of actual profit. When regulations finally come about that put the lid on a lot of the personal information market, a whole lot of these companies are going to have to find a way to make money that doesn't involve scraping user's information, and I think that will be a red letter day for a lot of these companies.

</comment></comment></comment></comment><comment><USER5> I think that Juicero articles have nearly nothing to do with Juicero and a lot to do with the growing sentiment against SV.

While there are many good examples in OP's blogpost, most people are familiar only with the past and present unicorns and how they operate.

So there is the story of Uber that is going on: an immoral company with abusive management, avoiding taxes, exploiting employees and killing local business. It may be the biggest factor in this.

Another factor may be that people are becoming more and more aware and wary of the main modus operandi of the SV internet companies: data hoarding.

My point is that Juicero story happened, because people are looking for reasons to dismiss SV, not because Juicero did something exceptional. Unless the reasons for the sentiment are addressed, it probably won't go away.

<comment><USER6> Another factor is backslash against "change the world" bs where every company framed itself as a bunch of saviors saving us all. You was anti-tech outcast if you disagreed, so it stayed bottled up and once someone breaks it, everyone wants to add his piece.

</comment></comment><comment><USER7> The part about the rockets is off. SpaceX is based in Hawthorne, CA, which is in the Los Angeles area. LA has a high density of aerospace engineers, which is one of the reasons Musk based SpaceX there.

Source: Worked there.

<comment><USER8> The spirit of the article was to praise the fruits of SV culture, in which Elon Musk is a revered leader. But yeah, if you want to be pedantic, yes space x is in Southern california.

<comment><USER9> If you include companies who aren't in SV in an article about SV. What's the point? I guess any startup that is SV funded is assumed to be a SV startup?

<comment><USER10> Maybe it's a stretch but anything Elon could be seen as an off shoot of the successes of SV. He started and sold Zip2 and PayPal there. He used the money from those ventures to start SpaceX and invest in Tesla. Also iirc much of the capital for these ventures comes from SV players.

</comment></comment></comment></comment><comment><USER11> "When Silicon Valley screws up, people who want a pointless Wi-Fi enabled juicer get a pointless Wi-Fi enabled juicer. Which by all accounts makes pretty good juice."

Nope. Silicon Valley screwing up has real world consequences. All the "wifi juicer" startups are taking up resources - money, people, time, materials - that would be better spent elsewhere. One of the biggest problems the valley has is that it wants to keep it's 'hey, we're just insanely great guys having some inconsequential fun' image while ignoring it's real world impact.

<comment><USER12> Yeah, it was weird reading that argument from Scott, who long ago proposed using dead children as a unit of currency: [https://web.archive.org/web/20160318104428/http://www.raikot...](https://web.archive.org/web/20160318104428/http://www.raikoth.net/deadchild.html)

<comment><USER13> Scott Alexander is the kind of writer that found his niche reassuring wealthy liberal people that, yes, they actually are living in the best of all possible worlds.

He's now in the same bucket as Steven Pinker, David Brooks, Doctor Pangloss, etc.

<comment><USER14> > _Scott Alexander is the kind of writer that found his niche reassuring > wealthy liberal people that, yes, they actually are living in the best of > all possible worlds._

Huh?! You must have him confused with someone else. This assessment of his writing is so completely wrong that I don't even know where to start correcting it.

<comment><USER15> He's probably talking about the conclusions your average SSC readers ends up drawing - a literate, wordy reinforcement of the status quo and "problems are hard". Whether this is Alexander's intended effect is another story.

<comment><USER16> Compared to typical stories everywhere else, with simple and obvious solutions that are totally wrong, I'll take SSC any day. Scott is one of the rare breed of writers who seem to actually think things through.

</comment></comment></comment></comment></comment></comment><comment><USER17> I'm not sure I agree with the conclusion of the article: "When Wall Street screws up, the country is plunged into recession and poor families lose their homes. When Silicon Valley screws up, people who want a pointless Wi-Fi enabled juicer get a pointless Wi-Fi enabled juicer."

Silicon valley tech is funded by VC money. A substantial portion of that VC money comes from institutional investors (i.e. pension funds). The investors need to see a return at some point. If they don't, the taxpayer will eventually pick up the bill via pension fund bailouts. The chain of causality isn't as clear as with the financial crisis, but all that money has to come from somewhere. If it's squandered, there will be a reckoning eventually.

<comment><USER18> > institutional investors (i.e. pension funds)

I don't pensions funds would invest in Start-UPs since they have a low risk threshold.

<comment><USER19> >I don't pensions funds would invest in Start-UPs since they have a low risk threshold.

You seem to be mistaken. Here's a 2014 article titled "Behind the Venture Capital Boom: Public Pensions" from Bloomberg. Specifically, the article claims (sourcing a Dow Jones report) that "In 2014, they contributed 20 percent of the sector's overall haul, down slightly from a 25 percent contribution in 2013." It's not that a massive fraction of each pension fund is in venture capital, but a sizable chunk of the money in venture capital is from pensions.

[https://www.bloomberg.com/news/articles/2014-09-23/are- publi...](https://www.bloomberg.com/news/articles/2014-09-23/are-public- pensions-inflating-a-venture-capital-bubble)

</comment></comment></comment><comment><USER20> There's another thing that I think is worth bringing up: sometimes the things that we think are useless are, in fact, useful to the people who buy them. See [http://theunitofcaring.tumblr.com/post/160054980296/so-of- co...](http://theunitofcaring.tumblr.com/post/160054980296/so-of-course-the- news-that-juicero-is-selling-a) and [http://theunitofcaring.tumblr.com/post/160099648056/unverifi...](http://theunitofcaring.tumblr.com/post/160099648056/unverified- claim-i-coincidentally-heard-today)

> that genre of thinkpiece spawned another genre of thinkpiece, which drops > the 'marvelling at how poorly-conceived or scammy products get hundreds of > millions in investor funding' to just settle on 'sneering at the fact things > are sold which I, an enlightened consumer who sees past the horrors of late- > stage capitalism, would never buy'.

...

> yes, there exist people for whom getting a package regularly is way less > stress and way more convenient than running out to the nearest convenience > store. Not everyone lives in cities where the nearest toothbrush is 'down > stairs to the bodega', not everyone has access to a means of transportation, > not everyone can leave their house or pick things up at the store. The > store's hours might be hours you are working. You might be a single parent > who can't nip out for a shopping trip without packing up the kids. You might > be disabled. Literally all of those things at once might be true, and are > true for many people!

...

> unless you're a big established company for who [$2300+ is] nothing and the > cost of the lawyers is no big deal, it's way safer not to admit that your > product is for disabled people or to advertise in a way that suggests it is > a solution to a specific condition. And so we get generically incompetent > infomercial people

I wonder if that's what the EZ-Crunch bowl does. I'm not sure what disability it might help with, but I'm hardly an expert on all the disabilities that exist in the world.

<comment><USER21> I don't understand why the quoted author took issue with Quip in the first place. Modern life is increasingly complicated, and full of small burdens on memory and willpower that add up to a huge background stress load. If I can pay a small amount of money to alleviate just one thing to remember (refreshing my toothbrush every couple of months) and could do that for every other annoying little inconvenience of modern life (car maintenance/insurance/tax, renewing and comparing financial services, buying in food and finding new recipes, tracking my dietary composition and fitness, backing up my computer, expensing mileage, and so many hundreds of little things) then life would be a lot more enjoyable. I have nothing but praise for the companies who focus on the little things and do them well. We could all do with not having to think about and remember so many things.

<comment><USER22> Yeah. I have no particular problem with the quip. It's an expensive electric toothbrush but not ridiculously so. For me, it ultimately wasn't great as an electric toothbrush for travel which is what I bought it for. But, in general, I take advantage of subscriptions and automated billpaying etc. when I really do want things to be on autopilot as much as possible.

</comment></comment></comment><comment><USER23> That's fine, this is how innovation works: for every big hit which changes the world, there are 9 scams and 90 plain failures. This is the way it should be. It was same in the age when the car was invented, or a plane - a ton of people got funded with scam projects, and even more tried to bootstrap obvious nonsense. We just didn't have the Internet back then so it received a lot less coverage.

<comment><USER24> I don't get this logic.

Imagine if doctors had 99 failures for every successful operation. "Well that's just the way it has to be for that success".

Sure, maybe Juicero could make money, but maybe $120 million could have been invested into some slightly more useful things?

Who gets to decide? Obviously the investors and VCs, and it's their money.

VCs simultaenously say that their 1:100 hit rate is part of their big strategies and that everything is luck. You can either be gambling your money or you can be using skill, but you can't do both!

(modulo probabilities a bit higher than lottery ticket odds)

<comment><USER23> This is an absolutely wrong comparison. Building startups is R&D, it is not the production, so acceptability of failure is much higher. Better compare it this way: what if 99% of all potential new drugs fail clinical trials and never make it to the pharmacy shelves, of which 9% would be deliberate scams devised by con artists to extract funding? That will be just fine, and in fact, that's what it is in the drug world! We are still, as humanity, making great progress in treating diseases.

</comment></comment></comment><comment><USER25> Related (yesterday in The Guardian): "America has become so anti-innovation – it's economic suicide"

[https://www.theguardian.com/technology/2017/may/11/tech- inno...](https://www.theguardian.com/technology/2017/may/11/tech-innovation- silicon-valley-juicero)

</comment><comment><USER26>
        When Silicon Valley screws up,
        people who want a pointless Wi-Fi enabled juicer
        get a pointless Wi-Fi enabled juicer.
        Which by all accounts makes pretty good juice.

No. When SV screws up we get a 1.5 billion person social network that shows indifference towards "fake news"

<comment><USER27> Is that really different than the fellow who only watches FOX News or the fellow who only watches MSNBC?

<comment><USER3> I don't know if your question is genuine or whether you were more asking out of anger...it's different from the standpoint of editorial involvement. Fox News and MSNBC have editors who filter the majority of their content, while the users (readers) contribute, "feedback" in terms of what stories are, "hot/trending" as well as comments. In Twitter/Facebook these roles are reversed, with the users filtering the majority of the content, barring outright obscene content.

Fox News and MSNBC do have the option of pushing stories which change the conversation, thereby controlling how things are delivered on a story-by-story basis, like an art form whereas Facebook has dials and levers to tweak particular aspects of how sharing is done. I would say news content on Facebook is 90% sharing, 10% curation while news content on MSNBC and Fox are 80% curation and 20% sharing.

</comment></comment></comment><comment><USER28> "there's not a lot of evidence for silly Juicero-style startups being much of the Silicon Valley business community at all."

"Origin ("Keurig for smoothies"), MoveButter, which compares itself to three different companies I've never heard of in its first sentence but seems to be grocery-related in some way; Mere Coffee, a better-tasting coffee machine for small businesses"

All of those businesses just sound like Juicero. A "Keurig for smoothies" is just Jucero with a small pivot.

<comment><USER29> Given that there are thousands of startups that YC alone has funded, and probably hundreds of thousands in the Bay Area, naming three doesn't really contradict the author's point.

</comment></comment><comment><USER30> > some sort of enterprise data solution software application package analytics > targeting management something something something "the cloud"

that's just flat out hilarious

</comment><comment><USER31> The biggest problems now, aren't technical, they're more political. For the biggest problems (housing, healthcare and transportation), the biggest barriers to entry are legal/political in nature. I think we'll need venture funds that reflect that, otherwise consumer product innovation will become increasingly meaningless.

</comment><comment><USER32> Interesting bit- Latest YC batch has 1/4th each of altruistic, cutting-edge, meat-and-potatoes-for-cloud and Uber-for-tacos companies

</comment><comment><USER33> Most of the counter-examples given as being examples of interesting companies sound terrible to me:

>> ... Neema, an app to help poor people without access to banks gain financial services...

Neema sounds even more useless than Juicero. Poor people have no money so they don't need financial services.

>> ... Kangpe, online health services for people in Africa without access to doctors.

So they don't have access to doctors but they have an iPhone with internet. Totally realistic.

>> Dost Education, helping to teach literacy skills in India via a $1/month course

Does the $1 per month include the cost of the computer/iphone, electricity and internet? It's probably cheaper to just pay a private tutor for one hour a day. Teachers aren't that expensive in India.

>> ... CBAS, which describes itself as "human bionics plug-and-play"

Nice buzzwords but what is the actual point of this? Does it actually improve lives? Is this what people really want or is it what silicon valley wants them to want?

<comment><USER34> 225M people in Africa have a smartphone today (I think that's like 20%?): [https://qz.com/748354/smartphone-use-has-more-than- doubled-i...](https://qz.com/748354/smartphone-use-has-more-than-doubled-in- africa-in-two-years/)

Meanwhile in some places there's only 1 doctor per 100,000 people: [http://mgafrica.com/article/2015-02-05-hullo-where-have- all-...](http://mgafrica.com/article/2015-02-05-hullo-where-have-all-of- africas-doctors-gone)

So yeah, I do think there are probably a lot of people in Africa with a smartphone but not a doctor.

<comment><USER10> You can get a smartphone in the US for 20USD I can only imagine that number is lower in Africa.

In support of your point.

</comment></comment></comment><comment><USER35> For every Silicon Valley hit, there's a fluff piece (or five). And for every genuinely innovative or helpful product, there's a gimmick product or distracting app.

Useful piece though even if just for it highlighting these valuable startups.

</comment><comment> norea-armozel I don't know if the writer understands the fundamental problem in the discussion of Silicon Valley centers on the fact that it's the peak of capitalism gone awry. So for every little research project he listed there's ten or more silly "ventures" into DRM'd juicing machines or spying social media apps.

</comment><comment><USER36> #NotAllStartups

</comment><comment><USER37> I can't recommend this article enough.

<comment><USER38> "Enterprise data solution software application package analytics targeting management something something something 'the cloud'" is my phrase of the week.

</comment></comment><comment><USER13> "The unwritten story of the Juicero debacle is that high income inequality causes capital to be misallocated towards luxury production."

\- Matt Bruenig, with a better take. That, if you look a little closer, also applies to Uber/etc's "sharing servant economy", and even Tesla's "trickle- down environmentalism".

<comment><USER22> But is this really anything new. The scale of investment may be different (although I'm not sure by how much if you take into account high-end real estate). But walk down Fifth Avenue in Midtown or the typical Las Vegas mall (or even--especially--the high-end shopping streets in Beijing) and there's plenty of money allocated toward making and selling things for the 1% plus that have nothing to do with tech.</comment></comment>


Ask HN: How do I set up a HIPAA-compliant server? - <AUTHOR> <comment><USER2> It's not just the server - it's the storage, accessibility (compartmentalization), and transmission of sensitive data (PHI and PII) at all levels. There is a lot more to HIPAA/HITECH than just server configuration - there are legal agreements you have to enter into as well (BAA's), insurance requirements, and potentially a lot more.

I'd suggest you work with a company that has a lot of experience in this area before you inadvertently find yourself fined (or sued) into bankruptcy.

<comment><USER3> A lot of HIPAA complience also has to do with due dilegence. My organization recently when through a long period of training that covered everything from building access logs to the way we do employee password resets. Unfortunately there aren't hard, static rules that define it.

On the positive side- I've learned to love the compliance. Most of it is common sense things (like not giving out info over the phone to any random person) and has made our organization more efficient.

<comment><USER4> +1 do these things because they are actually good engineering practices. be a good custodian of any user's trust.

i think some companies try for the quick buck and in the name of cost savings run a shoddy operation. ymmv.

ps - do not try making said quick buck in health care. contrary to VC bets otherwise, it doesnt exist. plan for a very very long haul.

</comment></comment></comment><comment><USER5> There are a few options if you want HIPAA compliance. Note that "HIPAA compliance" is somewhat of a loaded term in that there aren't many super- technical benchmarks to meet, but a general "do-good" attitude including (but not limited to) some of the following points:

\- Physical server isolation: you cannot have other instances sniffing around in your deallocated garbage memory.

\- Encrypted data stores: physical theft of the server should not provide access to your data.

\- Server providers who can sign a Business Associate Agreement: many hospitals and firms with medical data require this in their stipulations.

\- Audit trails for database modifications, access, etc. Basically, log everything, and this has to be encrypted too if it contains protected health information (PHI).

\- All PHI over HTTPS if you have a webapp. NO PHI OVER EMAIL OR HTTP.

\- "Soft" guidelines such as password complexity measures, auto session expiration, disallowed multi-sessions.

Again, this is not an exhaustive list. You really need to check with a lawyer who knows this stuff. The fines are enormous (read: business-ending) if you break the rules.

How do you work to implement these? Well, find a host who is willing to sign a BAA. Here are the two major contenders I'm aware of:

\- Use Amazon AWS; they're willing to sign a BAA with you and provide you the physical server isolation you need. However, this doesn't come cheap. Expect >$2,000/mo in costs to keep this configuration. Also, you'd better be a network pro or willing to learn how to manage VPCs correctly to provide proper network-level isolation for the databases.

\- Use aptible.com (they happen to be a YC company, and I don't know of anyone else doing this). Frank & Chas (the founders) are very responsive and aim to provide a comprehensive package, including backups, audit trails, and even employee training. The Docker-based and heroku-like interface is very appealing:

[https://support.aptible.com/hc/en- us/articles/202638630-Depl...](https://support.aptible.com/hc/en- us/articles/202638630-Deploying-your-first-app)

This option is still expensive. They host on AWS as well, so you're paying for the server costs + premium. However, this will still be a lot cheaper than hiring a competent sysadmin to make sure the execution is flawless.

<comment><USER6> Does HIPAA really require "physical server isolation"? I wasn't able to find anything specifying that in my reading. (Encrypting data at rest is definitely required. I suspect the S3 functionality was built to address the requirement.)

AFAICT the whole "can't do HIPAA in the cloud" meme arose from the reluctance of cloud services to sign BAAs, Google only got on board with that earlier this year.

<comment><USER7> I'm a lawyer, but not _your_ lawyer. This is not legal advice. :)

The HIPAA Security Rule requires that you take "reasonable and appropriate" measures to safeguard the confidentiality, integrity, and availability of electronic regulated health data.

Physical server isolation is not prima facie required, meaning there is no requirement that literally states you must isolate servers down to bare metal. Your customers' judgments about what constitutes "reasonable and appropriate" safeguards may vary, though. That decision should be driven by your risk assessment.

Encryption is also not prima facie required, actually.[0] I can't imagine a case in which it would be reasonable for a cloud SaaS provider not implement it, so I'd say it is de facto required. MFA may be moving to the same category, for most web services.

[0]: [http://www.law.cornell.edu/cfr/text/45/164.312](http://www.law.cornell.edu/cfr/text/45/164.312)

</comment></comment></comment><comment><USER8> It's a big task on its own and it seems a bit in-transparent to me.

However, you may want to have a look at TrueVault[0] which has been featured on HN[1].

[0]: [https://www.truevault.com/](https://www.truevault.com/)

[1]: [https://news.ycombinator.com/item?id=7033188](https://news.ycombinator.com/item?id=7033188)

</comment><comment><USER9> As some people have mentioned here, there are other issues to think of besides the IT aspect. There is employee training, risk assessment, policy development, and the business account agreements. Accountable is a company that focuses on these type of issues to make them easier by providing things like employee training, ready to use policies and procedures, and business association agreements. I found them while learning about HIPPA compliance, and I have not actually tried the product but it looks like it could be useful for you, so I thought I would mention it here. [http://accountablehq.com/index.html](http://accountablehq.com/index.html)

</comment><comment><AUTHOR> Surprised no one has posted this. From the folks at TrueVault. [https://github.com/truevault/hipaa-compliance-developers- gui...](https://github.com/truevault/hipaa-compliance-developers-guide)

</comment><comment><AUTHOR> @USNetizen -- You're right...I should have clarified that I want to know how to get an entire stack up and running, although I don't trust myself to do this unassisted.

I'm just surprised at how few resources there are that explain what it takes, and I hope that someday soon, healthcare startup CTO's will be referred to clearly documented open source solutions that are fairly fool-proof, rather than paid-for services (@sebst). Amazon's compliance page is unfortunately uninformative (@byoung2).

<comment><USER7> I'm the co-founder of Aptible, a HIPAA-compliant PaaS that just went through YC. I'd be really happy to talk to you and help figure out what kinds of resources we could publish, for free, that would help CTOs in your position figure this out. Email is in my profile.

</comment></comment><comment><USER10> If you want a HIPAA-compliant server setup for you: [https://www.aptible.com/](https://www.aptible.com/) (S14)

</comment><comment><USER7> (Disclosure: I'm a co-founder of Aptible.)

As noted in other comments, most of HIPAA is not technical. Most of the requirements relate to risk assessment, policies, training, incident response, etc.

With that in mind, I'm going to quickly run down all of the major moving parts and then cover some of the technical considerations for setting up a server.

HIPAA has three main rules you need to comply with:

1\. The Privacy Rule - Governs the use and disclosure of PHI (protected health information). Applies to all forms of PHI (verbal, written, electronic, etc.).

2\. The Security Rule - Governs safeguards for electronic PHI

3\. The Breach Notification Rule - Governs your responsibilities during a security or privacy incident

 __ __ __ __ __ __ __ __

The Security Rule has a general security standard, some documentation /retention rules, and three sections of safeguards. They are:

1\. Administrative Safeguards

2\. Physical Safeguards

3\. Technical Safeguards

Some of the safeguards are mandatory. Some are "addressable," meaning if you don't implement them you must document why you chose not to and what other safeguards you applied instead.

 __ __ __ __ __ __ __ __

Most likely, you 're going to start with something like the following for your servers:

1\. Sign a BAA with any service provider who is going to touch PHI for you.

2\. Restrict physical and logical server access to authorized individuals. Document how you restrict access and why the methods chosen are reasonable and appropriate given the risk posture of your organization. (There's a LOT packed into this step.)

3\. Log all access and data modification events. If you use a logging service that isn't HIPAA-compliant, make sure you're not including PHI data you send them.

4\. Encrypt data at rest and in transit, including inside the network perimeter. Document your network topology and access points.

5\. Implement backups according to your organization's HIPAA contingency/disaster recovery plan. Document the backup scheme.

A few caveats:

\- I haven't addressed application-level security. The same requirements apply, but the implementation differs.

\- Your customers will demand additional safeguards that aren't in HIPAA.

At Aptible, we help with all of this, plus all of the other requirements (risk assessment, policies, training, etc.), so you can get a complete handle on your compliance status.

<comment><USER11> > $3500/month.

> $0.10/Hour Additional App/Database Containers $0.40/GB/Month Additional > Storage.

¡Ay, caramba!

Thanks for at least giving me a source to cite in grant applications!

<comment><USER12> Where I work at Catalyze, we offer a starting package beginning at $500/mo that includes one database container and one server. Or, if your application only required a secure backend, prices start as cheap as $100/month. We have a calculator here to compare prices: [https://catalyze.io/platform-as-a- service/](https://catalyze.io/platform-as-a-service/)

We've been building applications with both startups and large healthcare organizations like the VA. I'd love to talk with you more to see what your needs are. Feel free to hit me with an email (email@example.com) with any questions.

Good luck!

<comment><USER13> Hmmm... 8GB max? That doesn't cut it for the amount of claims data I generally deal with. Any rationale behind that limit?

<comment><USER12> That's the most that we have on the calculator, but we can help you with whatever your need. Email me (firstname.lastname@example.com) and we can work with you to meet your infrastructure needs.

</comment></comment></comment></comment></comment><comment><AUTHOR> Thanks for all of your comments so far. Synopsis is...it's complicated. There are basically no straightforward guides and no reliable, tried-and-true open source solutions that can be deployed with minimal security expertise, at least with respect to the technical setup.

Options are to go with a service company like Aptible or TrueVault, or fumble through vast amounts of obtuse technical and legal documentation, then hire a security expert to audit your homemade system and hope that everything goes OK. Both options, as they currently exist, require a fair amount of $$$.

<comment><USER14> Isn't "no solutions that can be deployed with minimal security expertise" just about the whole point of this compliance?

If you have minimal security expertise, then you're supposed to be treated as noncompliant. There are two valid options: _have_ the security expertise (and be prepared to legally vouch for it that you have, and get insurance for cases if it turns out that your expertise wan't enough), or _get_ the security expertise from someone else. Oh, and the third option is to stop handling any sensitive data at all if you aren't equipped to handle it.

The reason why HIPAA (and similar compliance issues in other domains) exist is to try to eliminate what you're proposing. Random companies with minimal security expertise shouldn't be handling such data themselves, period.

<comment><USER15> This, +1000: 'Isn't "no solutions that can be deployed with minimal security expertise" just about the whole point of this compliance?'

If you aren't a trained, competent security analyst/engineer (or working with one) then don't accept sensitive information. PHI, credit card numbers, even contact lists: all of these are considered "sensitive" for a reason, and you are being reckless in the extreme if you accept them from your customers without the proper protections in place.

I have seen and even been responsible for (many years ago) the implementation of some horrifyingly bad "security controls" by people who simply didn't understand the field.

It's not just crypto, or disabling root logins via SSH, or preventing XSS on your web forms; you need to plan for a multitude of possible attack vectors, internal and external. Many of those aren't likely to be intuitive without some real training and exposure to best practices.

</comment></comment></comment><comment><USER16> I'd just have someone else do it for me. There are many "enterprise" level hosting companies that can help you with that.

I believe that rackspace has a pretty program around compliance.

</comment><comment><USER17> Hi,

training-hipaa.net provides Server Disaster Recovery Plan Template which is the part of HIPAA Compliance.

This Server Recovery Plan documents the strategies, personnel, procedures and resources necessary to recover the server following any type of short or long term disruption. You can find more information about this over here [http://www.training- hipaa.net/template_suite/Server_recovery...](http://www.training- hipaa.net/template_suite/Server_recovery_plan_template.htm)

</comment><comment><USER18> If you are trying to set up a service for processing or storing PHI, you may be interested in DNAnexus ([https://dnanexus.com/](https://dnanexus.com/)), which focuses on compliant high throughput data analysis and storage for genome information, but can be used to store other types of PHI data. (Full disclosure, I work at DNAnexus). Email in profile if you want to go into specifics.

<comment><USER12> Cool! I had not heard of dnanexus before. Looking forward to checking it out.

</comment></comment><comment><USER19> You may want to check out BladeLogic Server Automation: [http://www.bmc.com/it-solutions/bladelogic-server- automation...](http://www.bmc.com/it-solutions/bladelogic-server- automation.html)

Datasheet:

[http://documents.bmc.com/products/documents/27/36/242736/242...](http://documents.bmc.com/products/documents/27/36/242736/242736.pdf)

</comment><comment><USER20> Here is some info about doing it on AWS

[http://aws.amazon.com/compliance/](http://aws.amazon.com/compliance/)

</comment><comment><USER21> We have been very pleased with the True Vault solution and the responsiveness of the team when needed, worth looking into for your needs.

</comment><comment><USER22> One missing point in this thread: there is no such thing as HIPAA compliant. There is no government organization that will sanction your set up as "compliant". The HIPAA legislation imposes fines if you leak data, but does not prescribe how you prevent that.

That said, the thread does have some great safe guards and industry best practices you should look at.

</comment><comment><USER23> (Disclosure: I work at FireHost, not in sales!)

We sell cloud but focused on security, compliance, and performance. Check us out.

[http://www.firehost.com/secure- cloud/compliant/hipaa](http://www.firehost.com/secure-cloud/compliant/hipaa)

</comment><comment><AUTHOR> @voska "Starting at $3499/month with an annual contract" \-- Seems like security experience comes at a price... That said, it's worth taking every precaution to protect patient data.

</comment><comment><USER24> We have audited HIPAA compliant hosting, at a reasonable price:

[https://www.atlantic.net/hipaa-compliant- hosting/](https://www.atlantic.net/hipaa-compliant-hosting/)

<comment><USER25> I hope you point out to your customers that compliance is a lot more than just a hosting account. Everything from specifications of the design of your office network to policies for employees talking while on smoke breaks.

<comment><USER12> Agreed. Anyone that you choose for HIPAA-compliant hosting should be able to outline their policies. Where I work at Catalyze, ours are here:

[https://catalyze.io/hipaa/](https://catalyze.io/hipaa/) [https://catalyze.io/policy/](https://catalyze.io/policy/)

And we've gone through a HITRUST audit to validate these claims:

[https://catalyze.io/compliance/](https://catalyze.io/compliance/)

</comment></comment></comment><comment><USER26> We used to use a hosting company Layered Tech that had a HIPPA compliant offering. If you need HIPPA compoanxe I suggest getting it as a managed service.

</comment><comment><USER27> If one big customer is demanding you be HIPAA compliant then they probably want to see a certification, and depending on size of customer they may be willing to provide funding for that certification. It takes months but the certifying service will provide consulting and training. Essentially it all about tight access controls, encrypting data at rest, and documenting everything and everyone who has access to the internals.

<comment><USER28> There is no such thing as a HIPAA certification.

<comment><USER4> correct but hospitals and other buyers dont seem to know that and some _do_ insist on "certification"....you can try to convince them but in my first hand experience the (uninformed, misinformed) customer is always right so you do have to provide something that claims to be a "certified" solition...typically by providing an outside audit report

</comment></comment></comment><comment><USER29> Microsoft biztalk server has strong HIPAA connector/accelerator, just have a look overthere.

</comment><comment><USER30> It's not an easy process .

Check out TrueVault - HIPAA-compliant data store that is a YC grad.</comment>


Ask YC: I want to become a filmmaker. - <AUTHOR>

I'm a good programmer. But I'm also a creative person and interested in filmmaking. Any good suggestions on becoming one ? I know this a hacker news..but I would like all of yours an unbiased opinion of following one's passion ? If there is already anyone like me who is into movies...I would appreciate for any suggestions. <comment><USER2> It's hard to make a decent living in film making, especially in a way where you're creative. So, if you're asking, my suggestion is keep your day job and stay a programmer -- at least for a while.

Filmmaking is a lot of fun and it's a hobby of mine as well. With digital cameras you're infinitely liberated. It's dirt cheap: you just need a good boom mic and your good-to-go, for the most part (especially if you go Dogma 95). So shoot. I mean it. Just go shoot. You'll most likely have to wear most of the hats: producer/screenwriter/director/editor/sound/etc. But that's great training. You'll see what you enjoy most.

And each time you shoot something, throw it up anywhere you can: YouTube, etc. If you're good, people will notice. Robert Rodriguez shot a short 16mm called 'Bedhead' for a local competition, and that took him to film school. After school he shot El Mariachi for $7,000, and went on from there. If you're talented, it will show. To get talented, watch great films with the sound off and shoot, shoot, shoot.

</comment><comment><USER3> I can believe you (by your userid)! And I have been there and tried to do that - but got back to hacking, as it is way easier than filmmaking. Filmmaking is freaking difficult - its good to be creative, but making films (real films, not the youtube ones) is not for the faint of the art! I decided to use my (art, music, film) inclination and combine my CS background to create a venture. Whether I succeed or not, is yet to be seen... Contact me (from my profile) if you want to learn more...</comment>


Ask HN: Free email with custom domain support? - <AUTHOR>

What are some good free webmail providers with custom domain support? <comment><USER2> Zoho Mail will do up to 10 users for free on one domain. They're my (less favorable) go-to after Google and Outlook dropped their free custom domain support.

<comment><USER3> I also use Zoho. I create my email addresses, configure them to forward emails to an @gmail account and then configure gmail to send emails from my @customdomain.com account. I get free custom domain emails and I get to use gmail for email management. Zoho is basically just the middleman.

</comment></comment><comment><USER4> Try Banckle Email. They offer a free plan with custom domain support, IMAP/POP3 and web client - plus APIs if you fancy using their service in your app.

</comment><comment><USER5> I've been using Google for years. Love it. (with several domains)

EDIT: added comment about multiple domains</comment>