How did software get so reliable without proof? (1996) [pdf] - <AUTHOR> http://www.gwern.net/docs/math/1996-hoare.pdf <comment><USER2> Thanks for this! Hoare (partially) answers a question I asked in the comments on "The Little Typer" (a good treatment of programming with dependent types).

That approach to dependent types brings our code closer to being verifiable. Unfortunately as a number of commenters testified it also makes software (currently) impossible to scale to complex algorithms, dependence on loosely coupled libraries, and so forth.

Since Hoare wrote 22 years ago, I'm now wondering if there's a fundamentally intractable problem with improving formal validation of complex software. Dependent types _seem_ like a natural way of embedding the programmer's assumptions and reasoning into software, but clearly current technology in that area is still very very far short of helping with software at current scale.

Meanwhile our practical means of building complex software have improved considerably and we can develop systems that are reliable "enough", even at enormously greater scale than Hoare anticipated. The gap between viable software complexity and formal methods of describing software semantics has grown much wider since Hoare, rather than shrinking.

I wonder if we could step back from this style of formal methods, and look for an alternative approach. We need ways to capture the actual reasoning and methods that work for programmers building complex systems -- rather than trying to pretend they are mathematical objects.

<comment><USER3> For me, notation is everything. A computer program is a model of a problem. There is more than one representation of that problem: in the static code and in the running code. If you go to a kind of naive way of writing programs (that we all went through when we were first starting out), you write the code and then you step through it (either on paper, or with a debugger), viewing how the code is running.

There are many techniques available for helping you reason about your code. However, it's important to understand that software code is a notation for modelling the problem. Often formal methods introduce _another_ notation that proves that the encoding of the problem in the first notation is "correct" according to some definition of "correct". The more we move into modelling the correctness in the second notation, the more we move the burden of reasoning about the issue to the "code" in the second notation.

It's often very useful to model the problem more than once. For example, I'm quite a big fan of unit tests. "Give the code in the system, I expect X to be true/false in this situation". I'm just as likely to make mistakes in my unit tests as I am with the production code. However, it's the comparison of the two that allows you to reason effectively about the code. They are two sides of the same coin (intentionally coupled -- which, as an aside, is why you should avoid trying to decouple your tests from your production code!!!).

Even though it is useful to model twice, I'm not really sold on the idea of doing it in general (and I have a very specific idea of how to write unit tests that's heavily coloured by this point of view). Everything that you add to the code should make reasoning about something _easier_ and _more convenient_ than not doing it. Otherwise you are better off with just writing the production code. You will have less complexity to deal with overall.

In my opinion, a good example of a tool that helps incredibly well are strongly typed languages _with_ type inference systems. For a small penalty of type notation, the system can tell me, without a doubt, when I've made a mistake with the types of my variables. Not only that, but the notation itself allows me to reason about why I've gotten myself into a problem. It can even help me reason about what the function does, without having to even look at the implementation. This is incredibly helpful.

I think as we go forward, we need to be looking for this kind of tool. Dependent types seem like a perfect example of this. However, there is always going to be a small price to pay. Writing code in a statically typed language is harder than writing code in a dynamically typed language -- precisely because the dynamically typed language allows you to write code without having to think up front about the consequences. Of course, you may leave bugs in your code because of it, but the initial cognitive load is smaller. Similarly, it's much better to write code where you can reason about the run time behaviour without it running, but that is much harder than writing some code and walking through it, playing "computer".

We need to balance these kinds of factors because a tool that is not used is a useless tool. I'd be perfectly happy to work in a pure functional, statically typed language because it is _much_ easier to reason about my code. Many of my colleagues simply are not willing (or possibly even able) to pay the upfront cost of working in that kind of ecosystem. Hence, I'm not able to work in it either.

<comment><USER4> This was a great comment.

The fact that new notations/representations (be that tests, simulations, formal methods, etc.) must justify their additional cognitive overhead is a great point.

Aside from unit and integration tests, I think that substantial new notation/infrastructure is most justifiable when the second notation/setting allows you to model parts of the problem that can't be modeled in the original notation.

Embedded software is a good example. Although there are some tools that allow you to model the physical system alongside the control software, typically the code is written in C and so there's no way of expressing very important aspects of the problem in the implementation language. So a second notation can help. For example, simulators and HiL setups for testing or things like [https://github.com/LS-Lab/KeYmaeraX-release](https://github.com/LS- Lab/KeYmaeraX-release) for formal methods.

Security is another good example. Typically code does not include an explicit threat model or explicit security properties, and these aspects of the problem are often scattered across the code and difficult to reason about. So being able to capture those things directly in a second notation can add a lot. For example, automatic vulnerbaility scaners for testing or [https://tamarin- prover.github.io/](https://tamarin-prover.github.io/) for formal methods.

Distributed/fault-tolerant systems are yet another example where it's very hard to state the thing you want to state in the implementation language. Netflix's chaos monkey comes to mind.

</comment></comment></comment><comment><USER5> We've gotten to where we are using slow incremental improvements. Better tools, better compilers, vastly better linters, unit testing, CI, etc. Now and then we manage to take some academic research and turn it into practible stuff e.g. the current generation of linters like FindBugs, Coverity, etc.

And that is pretty much as it has always been, a slow drip of practical improvements fed by theoretical research.

</comment><comment><USER6> was 1996 really that different than today? because reliable is the last word i would use to describe software today.

<comment><USER7> It surely is different. We at least managed to contain some of the issues in normal operation. Back in the day, crashing whole OS in BSOD/panic style was more common, drivers unstable, things written in not-so-safe languages more popular.

So ultimately it depends what do you mean by reliable - by itself, functionality might not be so much better, but yes, sometimes you don't mind as much as you would do back then.

</comment></comment><comment><USER8> As a small data point I'd say that Leslie Lamport claims that Amazon has used TLA+ on a good number of big projects; many people think of formal proving as an activity that is separately layered on top of programming, as opposed to a proving-language. Also, when people use Rust, are they using proving techniques?

<comment><USER9> Not yet; we're still working on the semantics of the language, and proofs for it; you need that before you can prove things about the code in the language. Or at least, the stuff we're most interested in.

The EU is funding some of this work.

<comment><USER10> For people interested in looking deeper, this work is called RustBelt. Useful web pages are the project's homepage ([https://plv.mpi- sws.org/rustbelt/](https://plv.mpi-sws.org/rustbelt/)) and the research paper describing the project ([https://dl.acm.org/citation.cfm?doid=3177123.3158154&preflay...](https://dl.acm.org/citation.cfm?doid=3177123.3158154&preflayout=flat))

</comment></comment></comment><comment><USER11> 1996 being the pre Windows 98 Era

</comment><comment><USER12> Hmm. The paper argues that a predicted software crisis caused by unreliability didn't materialise, and software became tremendously more reliable, despite industry essentially ignoring decades of research into formal methods and proof systems.

With this I agree. I'd also contribute another couple of factors that came into play perhaps too late for a paper written in 1996: successfully bringing garbage collection and managed memory languages to widespread usage, starting with Java and JavaScript and the growth of the web that allowed much more software to be written in server side scripting languages like Perl and Python. And the deployment of crash reporters and online update tools, which massively tightened the feedback loop between crashes occurring in the wild and fixes being deployed.

Intuitively at least, I feel these two things made a huge difference to the reliability and scalability of software. It's typical for large Java or JavaScript programs to now incorporate so many libraries that dependency version management is a significant pain point that is bottlenecking the growth in software complexity. In the 1990s the closest you got to this was DLL hell and that was more of a Windows deployment issue - the software worked fine on the developer's box, it just didn't work when deployed to OS installs that had different bits on the. Now we face issues where dependency graphs can pull in two or even three different incompatible versions of the same library _on the developer 's machine_. This is a testament to the new scales we are exploring in software complexity.

However, the paper then goes on to make some possibly very dubious arguments, I suppose because the author is a famous academic and maybe doesn't want to contemplate the obvious conclusion. He says:

 _The conclusion of the enquiry will be that in spite of appearances, modern software engineering practice owes a great deal to the theoretical concepts and ideals of early research in the subject; and that techniques of formalisation and proof have played an essential role in validating and progressing the research._

 _However, technology transfer is extremely slow in software, as it should be in any serious branch of engineering. Because of the backlog of research results not yet used, there is an immediate and continuing role for education, both of newcomers to the profession and of experienced practitioners. The final recommendation is that we must aim our future theoretical research on goals which are as far ahead of the current state of the art as the current state of industrial practice lags behind the research we did in the past. Twenty years perhaps?_

This is a very problematic set of conclusions which speaks to more general concerns growing in my mind in recent times about the value of much academic research.

Because of course, it's now more than 20 years since C.A.R. Hoare wrote this, and yet formal methods are no more used now than they were in 1996. It's not that there's a backlog of research that isn't used. It's that academia has gone down this rabbit hole for decades and _it has never been widely used_. 40 years and hardly any success! Why would anything be significantly different given another 20?

The paper does an admirable job of trying to congratulate everyone, whilst putting a brave face on lack of adoption - saying that a 20 year lag time between research and adoption is perfectly reasonable and a sign of maturity in the software industry. With another 20 years of hindsight, we can perhaps see now that industrial practice isn't lagging behind academic research, when it comes to formal methods and proofs. It's written it off and ignored it for good. The closest industrial practice gets to this is we use slightly stronger type systems now, but nothing a programmer teleported from 1996 wouldn't recognise.

<comment><USER13> At least one aspect would be that stricter guarantees don't really matter, except when they do. If ease of use, learning, compile time, efficiency, etc was equivalent to a non-strict language, then presumably industry would naturally make the leap (ignoring the inherit inertia of established norms and actual code). It would be dumb not too, if you could get fewer bugs for free.

But they're obviously not equivalent, and most businesses only care about correctness to a certain limit (at which point its superceded by other factors; diminishing returns and all that), then formal certains will naturally only appear in common use until they reach that limit.

To truly claim futility of formal systems, you should be looking at the guys who prioritize it over basically anything else: if say even space companies couldn't give a shit about advancements in formal systems, then its clearly divorced itself from practicality. If NASA prefers javascript over whatever formal system, then clearly the academics have gone down a dark road.

But at the same time, is it the academic's job to build practical systems, to advance industry? Isnt that the role of the industrial researcher? As I understood it, academia's ideal role is to simply advance human understanding in interesting ways: whether it has immediate practical consequence _should not_ be in their domain. ie research ML decades before it has any real hope of being useable. It's industry itself who takes the role of poring over the academic's work, and figuring out if they can use it for anything. And if its cost-effective.

And if industry specifically wants academia to look into things of immediate interest, they shouldn't be waiting on universities for it; they should be hiring an academic to specifically research it.

<comment><USER12> Resource allocation is a zero sum game. If taxes are being levied to pay for a vast intellectual class living in ivory towers, that's less funding available to pay for industrial research.

Academia love to claim that practical application should not be any concern of theirs. But why should this be so? After all, they eat practical food and live in practical houses. Someone has to pay for it all. And the idea, espoused in this essay, that _eventually_ , on a _long enough_ timescale, their research will all be adopted and it's just that industry is super slow to recognise the awesomeness of their research and productize it - well, this claim seems to be getting weaker all the time. We now have many areas of computer science that have spent decades going down very expensive rabbit holes with no serious adoption and none on the horizon.

Not just formal methods, but pure FP languages like Haskell remain rarely adopted despite huge hype and massive academic investment. There was a few days ago, a post asking what happened to the semantic web with many commenters positing that the semantic web became an academic money pit that absorbed huge quantities of grant money and delivered nothing whatsoever. I'm sure there are many other examples lurking if you scratch the surface.

If academic funding was cut significantly and returned to companies in the form of lower corporation taxes, perhaps connected to research incentives, would it be so bad? There'd probably be less research done overall but if lots of current research goes nowhere and is never adopted that'd be a net win.

<comment><USER14> What do you make of corporations subsidizing seemingly pure academic research, then? Take the aforementioned Haskell, for example - you speak of "massive academic investment", but Simon Peyton Jones is still a Microsoft [Research] employee, and Simon Marlow is a Facebook employee (and former MSR as well)! And yes, you don't see Microsoft use Haskell in its products - but the ongoing funding clearly indicates that there's substantial perceived value in that investment. Given the amount of time this has been going on, surely that's more than can be explained away by "hype"?

<comment><USER12> I think the corporate world is still learning how to do effective research. Too many companies think that doing research means replicating a tiny university within their own walls.

I'm not saying industry always gets it more right than academia, but I think even the orgs like Microsoft Research that are basically just clones of academia, are still on a slightly better path. For instance MSR has done a lot of cutting edge research into operating system design. Still, the money was in the end wasted - nothing of Midori ever surfaced in real products.

The gold standard for me is Google. They're one of the few firms that managed to completely fuse research and industrialisation into a totally cohesive whole. Whilst they technically speaking have a research department, the research they're known for is largely not done there and Google has managed in the past to routinely create new innovations from all over the company.

It's worth realising that a lot of industrial and corporate research isn't labelled as such. It's just "innovative product development".

Example: If we look at JetBrains, they developed a new programming language from scratch (Kotlin) that has several innovative and cutting edge features. Do we think of JetBrains as a sponsor of research or Kotlin as the product of research, probably not, yet it solves many problems that were previously unresolved, like how to make a new language that has seamless interop with Java, and how to improve the usability of features like generics and nullity checking. The work involved in creating it explored new frontiers that academia has ignored, simply because usability improvements and practical topics like interop with existing code is not considered 'smart' enough to be worth the title of research.

You see this pattern crop up repeatedly. Academia, left to its own devices, researches ever more exotic extensions to Haskell, knowing full well most programmers don't use Haskell. The _corporate funded_ academic research done by JKU Linz and Oracle has focused on how to make existing languages like Ruby and Python super fast to execute, super debuggable, cheap to develop runtimes for, how to solve the language interop problem once and for all and so on. They've produced something real - Graal - which looks on track to actually let Ruby call into C++ call into Java call into JavaScript call back into Ruby again, in a seamless and fully optimised manner.

Now _that_ is cutting edge but incredibly practical research that could have industry-shaking impact within the next 10 years. It isn't primarily funded by the NSF or EU though. It's funded by a corporation.

<comment><USER15> It's just lame to play off practical against theoretical research and academic vs corporate research. Each of them has its advantages and disadvantages.</comment></comment></comment></comment></comment></comment>


Show HN: Yet Another Mobile Hacker News - <AUTHOR> http://hnmob.org/

<comment><USER2> Your about page is giving error.

       Fatal error: Call to undefined function page_open_html() in /var/www/hnmob.org/webroot/about.php on line 10

</comment><comment><USER3> Clicking usernames doesn't seem to work.</comment>


Secondary indexing with Redis - <AUTHOR> http://redis.io/topics/indexes <comment><USER2> Redis is great but I think this is a bit too complex for that specific use case.

Forgive this shameless plug but have been working on a distributed transactional key value store that has native secondary indexes. Feedback welcomed: www.quasardb.net

<comment><USER3> For what it's worth, I think your website headlines need a lot of work. In the first few seconds of visiting your site I should know exactly what quasardb is and why I should care (i.e., whether or not the solution/service/product/whatever relates to me and my problems). Your current headlines tell me nothing.

I have some suggestions for a better marketing message, so shoot me an email (address in profile) if you want to discuss further.

<comment><USER2> Thanks a lot we know we have a lot of work ahead of us marketing wise.

</comment></comment></comment><comment><USER4> If you start doing this, think long and hard about your architecture choices.

<comment><USER5> This is such a banal and not-constructive comment. Of course he would think about architectural choices. Your comment suggests one of the following:

1\. The proposed feature is harder than other proposed features (which ones and why? edit: it turns out there isn't even a proposed feature here...)

2\. You see pitfalls or good choices and bad choices (which ones and why?)

Either way, your comment as it stands isn't helpful in the slightest, and I'm calling shenanigans. If you are in either camp 1 or camp 2, why not actually say something useful instead of speaking from this glass pedestal of falsified authority.

edit: formatting.</comment></comment>


Plaid.com API flaw and major security concern - <AUTHOR> https://github.com/plaid/link/issues/68 <comment><USER2> I understand the concerns expressed here but how about someone actually suggested a solution to this issue?

The oauth thing is not going to work. No bank will implement it or even if a few do, it will not provide the coverage Plaid offers.

The banks are not onboard - plaid is basically providing api access without their consent.

Right now, the only real answer to this issue is that you ultimately need to trust the 4th party who is asking for your banking credentials - Whether it be Venmo or some other party.

I develop systems for a finance product where we need 24/7 access to all banking activity in our client's business bank accounts. Our entire business model depends on this. Our clients use a wide variety of banks. Plaid offers the only solution and we offer the only solution out there for our clients. As a result, our clients just has to trust us.

Any suggestions on a practical solution?

</comment><comment><USER3> This is a horrific idea.

I thought I am immune to this kind of exploit thanks to my technical knowledge. Not so, nearly. I once found a good price on skyscanner.com that directed me a site called BookingHouse, that in turn used a "man-in-the-middle as a service" company called mistertango.com that proceeded to ask me for ... my e-banking credentials. I had to slam the mental brakes hard to avoid typing out my credentials on this page, and realised how vulnerable you are when you are conditioned to following instructions as fast as you can (don't want to lose those sweet-priced tickets!).

This mistertango.com service even goes as far as "interactively" asking for your 2nd factor code! I thought it was surreal.

Notified BookingHouse, SkyScanner. No reaction.

</comment><comment><USER4> While I've admired what Plaid is trying to do, this has exactly been my concern from day one. Why would I enter my credentials in just any third party website? I'd rather do the 2 cent test deposit dance, than enter my business banking details to a third party (exceptions being aggregators like Mint, personal capital, E _TRADE, etc).

The solution would have to be something like Oauth that directs me to the bank.

Update: _I* trust Plaid as the third party but in this case it would be a "fourth party" website that uses Plaid.

</comment><comment><USER5> Maybe someone should inform the banks because they will not be happy when their customers credentials get stolen.

</comment><comment><USER6> The post is from 3 years ago and as per GitHub the issue has been resolved. Not sure why it's been posted

<comment><AUTHOR> It is marked as closed but the issue was not resolved. Did you actually read the thread? Last post was 2 weeks ago.</comment></comment>


What Languages Fix (2002) - <AUTHOR> http://www.paulgraham.com/fix.html

<comment><USER2> Here are some graphs I knocked up a while ago:

[http://www.solipsys.co.uk/new/EveryLanguageFixesSomething.ht...](http://www.solipsys.co.uk/new/EveryLanguageFixesSomething.html?HN1)

There was some discussion a while ago:

<http://news.ycombinator.com/item?id=2816526>

 _Added in edit: That's a shame - someone has flagged this item so it's no longer on the front page._ 8-(

<comment><USER3> Javascript came from Java? Or was that just to make sure we were paying attention?

<comment><USER2> Look at the original version of the essay from the wayback machine:

[http://web.archive.org/web/20020210063149/http://paulgraham....](http://web.archive.org/web/20020210063149/http://paulgraham.com/fix.html)

That link is in the original version of the essay, and that's why it's in the diagram that's described as a graph of the dependencies that PG gave.

The version on the WayBack machine has:

        Javascript: Java is scary.

It does not have:

        Python: Perl is a kludge.

<comment><USER4> So, Graham's essays are mutable. ;-)

</comment></comment></comment></comment><comment><USER5> We can keep on adding...

JavaScript, "We want a scripting language in our web pages."

TCL, "It should be easy to extend your scripting language in C."

SQL, "We need a standard way to talk to our databases."

PL/SQL, "We want to push complex logic into our databases."

BASIC, "We need an easy language for absolute beginners."

And so on.

But one historical comment. The _ACTUAL_ problem that Ruby was created to fix was that Matz needed a scripting language that could handle Japanese text. People may adopt it now for different reasons, but that is not the historical inspiration.

<comment><USER6> Perl can handle Japanese just fine nowadays. Back in 1995, though, Unicode support was... iffy at best.

Now, Ruby must be differentiated by other things.

<comment><USER5> The issue was much worse than Unicode support.

Ruby natively supports multipleincompatible Japanese encodings, including Unicode and shift-JIS. This is a lot harder than just marking off a Unicode checkbox.

</comment></comment></comment><comment><USER7> Haskell: other languages make making mistakes too easy.

<comment><USER8> Haskell: My proofs are correct but my code is wrong. I just want to execute my induction proofs.

<comment><USER9> That's probably more Coq.

</comment></comment></comment><comment><USER10> Ruby: _Perl has crap OO_ , and Lisp syntax is scary.

Perl did a lot of things right, e.g. regex literals, wide range of terseness possible (one-liners vs. large modular programs), CPAN, but I could never get over its ugly, hacked-in implementation of objects that kinda-sorta behaved like hashes and didn't do information hiding well.

<comment><USER11> Yes, but Perl has better libraries for that now (e.g. Moose)

<comment> guard-of-terra You can't have good OO "outside" your language. You can't duct tape some OO to a language and consider it done.

That's classic: PHP guy say, "we have objects in PHP5 so now it is Object Oriented". It's not. To say that language is Object Oriented because it has classes is like to say that language is Functional because it has functions.

So, Moose is a clever thing, but does it make every hash an object (I genuinely wonder)? Does it provide OO API for I/O? With exceptions? Does it make everything behave consistently? Because consistency seems to be the main reason that Perl did not become the final stop.

<comment><USER12> CLOS did a stellar job of adding OO to a non-OO language.

<comment> guard-of-terra There are all kinds of opinions about this: [http://steve- yegge.blogspot.ru/2006/04/lisp-is-not-acceptabl...](http://steve- yegge.blogspot.ru/2006/04/lisp-is-not-acceptable-lisp.html) Yes, it's wonderful that you have the band-aid — or maybe duct tape is a better analogy — certainly you miss them dearly when you're working in other languages. But you don't want to have to build your entire object system with duct tape.

</comment></comment></comment></comment></comment><comment><USER13> I don't quite think the Smalltalk one is fair. Smalltalk-80 definitely went to the extreme with everything-is-an-object, but PG is glossing over the history of Smalltalk-76 and Smalltalk-72, which betray the actual purpose: "Programming accessible by the everyman should be just as powerful as a 'real' language, not like BASIC."

</comment><comment><USER14> VB: Programmers are too expensive. Business Process people are more necessary.

MUMPS: All other languages weren't written for/by medical doctors/professionals.

Lua: Python and Ruby are each too big to embed.

<comment><USER15> Lua is as old as Python and Ruby. The alternative was Tcl, and the problem with it wasn't embeddability:

 _In 1993, the only real contender was Tcl, which had been explicitly designed to be embedded into applications. However, Tcl had unfamiliar syntax, did not offer good support for data description, and ran only on Unix platforms._

<http://www.lua.org/doc/hopl.pdf>

<comment><USER14> Crap, you caught me on that one. I thought it was a 2000's era language.

</comment></comment></comment><comment><USER16> C# 1 --- _Java is controlled by Sun_

C# [n] (where n > 1) --- _C# [n - 1] would be more awesome if it had..._

</comment><comment><USER17> PHP: I wanna create a goddamn webpage, like right fucking now.

</comment><comment><USER18> Javascript: the "java" name is very cool. PHP: let's pretend it doesn't exist by not adding it to our cool list.

<comment><USER19> PHP: Your language is trying too hard.

</comment></comment><comment><USER20> Common Lisp: There are N dialects of Lisp, and N is too many. Now there are N+1 dialects of Lisp.

</comment><comment><USER21> Erlang: Concurrency should be easier

</comment><comment><USER22> Brainfuck: Assembly provides too much, and obfuscated C is still readable

<comment><USER23> Malbolge: Other languages can be used to write programs by a human being.

<http://en.wikipedia.org/wiki/Malbolge>

</comment></comment><comment><USER24> I'd say, Ruby: Smalltalk is scary and Perl is a kludge

<comment><USER25> Anyone who thinks Smalltalk is scary has never used it, and I doubt that is what Matz thought of it.

<comment><USER24> Well, I don't think that's what anyone has ever said about any of these languages. :D

I was just trying to stick with the form of the essay.

</comment></comment></comment><comment> mark-r Not sure when this came out, because none of these essays are dated - this one is near the bottom of the list. But I like it!

<comment><USER21> web.archive.org has its first snapshot of it from Feb 2002, so it's at least 10 years old.

[http://web.archive.org/web/20020210063149/http://paulgraham....](http://web.archive.org/web/20020210063149/http://paulgraham.com/fix.html)

</comment></comment><comment><USER26> Go: concurrent programming is too hard

<comment><USER17> Or rather: C++ & friends suck, Python & friends are too slow. Quoting from the Go FAQ:

>Go was born out of frustration with existing languages and environments for systems programming. Programming had become too difficult and the choice of languages was partly to blame. One had to choose either efficient compilation, efficient execution, or ease of programming [...]

>Go is an attempt to combine the ease of programming of an interpreted, dynamically typed language with the efficiency and safety of a statically typed, compiled language. It also aims to be modern, with support for networked and multicore computing.

</comment></comment><comment><USER27> Groovy: Java is not Python enough

<comment><USER28> Groovy: We don't control Rails.

</comment></comment><comment><USER29> Missing my couple of my favorite languages: PHP, Objective C, Scala and JavaScript

</comment><comment><USER30> JavaScript: UI code should be asynchronous and throw as few errors as possible.

<comment> guard-of-terra JavaScript: Web pages aren't interactive enough.

</comment></comment><comment> mark-r Assembly: binary is too low-level.

<comment><USER30> Binary: Ternary is one thing too many.

</comment></comment><comment> guard-of-terra [:|||||||||||||:]</comment>


Why You Can't Build a Smartphone (2013) - <AUTHOR> http://www.joshondesign.com/2013/12/02/nosmartphone

<comment><USER2> [https://hn.algolia.com/?q=why+you+can%27t+build+a+smartphone...](https://hn.algolia.com/?q=why+you+can%27t+build+a+smartphone#!/story/forever/0/why%20you%20can't%20build%20a%20smartphone)

</comment><comment><USER3> He forgot to mention patents. All the big smartphone companies are in mutually assured destruction with their patent portfolios. If you enter in you have no ammo and will get squashed.

</comment><comment><USER4> Is ZTE not making money on the Firefox Phone? I know Mozilla is non-profit but I figured the manufacturer would be getting something out of it.</comment>


Why Do Anonymous Twitter Trolls Use Anime Avatars? - <AUTHOR> https://theringer.com/anonymous-twitter-trolls-anime-avatars-harassment-4chan-8578d36b2920-8578d36b2920#.cn9pcmmbt <comment><USER2> This was a fairly interesting read but I don't really like the opening line.

> In the eyes of her persecutors, the author Maris Kreizman was guilty of the > following counts: being a woman, being Jewish, criticizing Donald Trump, and > tweeting at all.

Internet trolls aren't persecutors -- they're kids that say mean things on public forums.

They don't care in the slightest that she's a woman or Jewish -- those are just easily identifiable characteristics that can be used for insults and slurs.

Not that these trolls need any defense but 'and tweeting at all' is honestly insulting to the trolls. Most of them probably don't even know or care who this woman is outside of a screencap of her tweet appearing on some image board. The entire culture is based around anonymity and shunning identity in favor of ideas.

<comment><USER3> The reason they don't pick on men for being men is because they're male themselves. So they _do_ care that she's female because it's something they aren't, and they can pick on her without picking on themselves.

This is true for all bullies and the people they bully, though, and not just women.

There are certainly women who look down on men and bully them for being men as well, but it doesn't seem to ever rise to this level of cruelty.

<comment><USER4> No they'll pick on men for being virgins, for being gay, for being cucked on, for being effeminate and weak, and so on. That's how you target masculinity, because masculinity is something men have to earn via proxy traits, whereas femininity is something to be lost.

It's equally vicious, but it's not seen as equally cruel. And the idea that all trolls are male doesn't hold. Women are far more cruel to each other than men are to them. Somehow the Mean Girls of the internet never get considered.

<comment><USER5> Wasn't there a large research project just done on twitter abuse that showed 1/2 of online harassers are women?

</comment></comment></comment></comment><comment><USER6> My Cousin's son is borderline-autistic and antisocial. He loves Anime and I see him and his friends regularly posting sexist, bullying, and other horrible comments on Facebook (including many 4chan Memes).

Many people use this as proof that the tech industry and men are sexist. In reality, it's mostly the work of teenagers with too much time on their hand and mentally ill individuals.

I wish we could stop lumping in an entire industry and gender for the actions of a few that may not even be in the industry at all.

<comment><USER5> Yeah, it's always felt weird to me that there's so much hand-wringing about this stuff when it's clearly the work, in large part, of children being edge- lords. Maybe it's just my perspective from playing WoW a lot back in the day (an amazing number of children played that game), but I just can't bring myself to take this stuff seriously. I think there's a tendency to make basic assumption that the anonymous person you're talking to is roughly your age or older and sane. I can't imagine anything further from the truth.

</comment></comment><comment><USER7> Interestingly the example of the most offensive tweet (and the only specific tweet as far as I can tell) featured an avatar from a western cartoon. Could some sort of cognitive bias be at work here?

</comment><comment><USER8> Isn't this missing the most obvious possibility, which is that anime images are just generally popular with the population that contains trolls generally? Say, 12-30 year old males?

<comment><USER9> Anime images are not "generally popular" with 12-30 year old males.

<comment><USER8> Odd then that the internet seems utterly jam packed with English language anime content?

</comment></comment></comment><comment><USER10> I don't think the author pursued the passivity angle far enough. Internet trolls get off on the idea of their victims being helpless to retaliate. What image could be more appealing to them than of cartoon characters whose properties of childlike innocence, pliancy, and weakness are taken to an extreme? If they could use hentai avatars they would, but that would be too obvious so they settle for moe instead.

</comment><comment><USER11> It's nice to have an article that puts the answer right up front.</comment>


Show HN: Launched my first Beta Android app MoveIt - <AUTHOR> https://play.google.com/store/apps/details?id=moveit.movetosdcard.cleaner <comment><AUTHOR> Hey guys! I have finally launched my Android app MoveIt in beta version. I have been working on this app for five and half months now. MoveIt is a app that helps you to transfer your Images, Videos and audios altogether to SD Card and vice versa. The idea of this app struck me when one day I was trying to figure out a easy and effective way to transfer my media to SD Card to free up some space. So I decided to make an app that helps me manage SD Card effectively and then i stated working on MoveIt.

Through MoveIt you guys can easily transfer your media to SD Card and vice versa. I have also made a inbuilt cleaner which helps in cleaning up Junk.(All these feature in less than 4MB).

I have launched my app in Beta version. So would greatly appreciate if you guys could download my app and comment and share it with your friends so that i can improve it. Here is the link: [https://play.google.com/store/apps/details?id=moveit.movetos...](https://play.google.com/store/apps/details?id=moveit.movetosdcard.cleaner)

Would really appreciate if you comment on my app and help me improve it.

You can also join our G+ MoveIt beta testers community [https://plus.google.com/communities/107109337900327115264](https://plus.google.com/communities/107109337900327115264)</comment>


Ask HN: 8 figure parents - <AUTHOR> I'm an only child with 8 figure net worth aging parents.  Even if they die, I'm tied to trusts that give me money slowly.  What can I do to make my life interesting?  I'm very technical and interested in AI, but don't have the drive to be an entrepreneur myself. <comment><USER2> Why not just ignore the money and work like anyone else (not being sarcastic, being serious). You'll have resources if it all causes problems, or to modulate around the edges (pay cash for your home, take slightly nicer vacations than you and your spouse might otherwise have done, have a full time nanny when the kids are small).

I've sold some companies here in the Valley and I've noticed that the most fun people to hang out with do the same old stuff as everyone else (scout troops, poker, skiing, writing code, etc). If you're biking with your buddies does it matter how much money any of you have? If you have kids they'll be easier to raise and will themselves have more fun if they're just like their classmates. Even at Paly (Palo Alto High School) there's a mix of kids whose families have little (yes, even some getting food stamps) and kids whose parents have private jets. Don't you want your kids to have the maximum set of possible friends? If you live it, they will too.

I sent my kid to private school (for certain specific reasons) and the worse part of selecting a school was finding one without the snotty factor.

<comment><USER3> Take this chance, take some risks that others cannot. You'll make great friends in the process and equally formidable enemies. There are a lot of real problems to be solved like housing, food, transportation, fighting exploitation, building things cheaper, etc. These don't need a lot of innovation that isn't there already. They need slightly deeper pockets ( that you have ) and a lot of courage that is derived from purpose (which you will find as you get out). As long as money isn't your sole and immediate purpose, there's a lot that you can do.

</comment></comment><comment><USER4> I'm having trouble seeing how your parents' net worth is relevant here. If you're interested in AI, you get a job with an AI company or you study AI in school, same as anybody else.

I'm guessing that none of that sounds appealing, though, or you'd already be doing it / wouldn't be asking this question. My guess is you're kind of like me - because you're in a good place economically, you don't have a lot of tolerance for the hard and boring grunt work that goes into intensive study or challenging jobs, and because of _that_ you're not going to be able to achieve something awesome.

The solution is to find the thing you love to do so much, it makes the hard and boring grunt work pleasurable. That thing probably isn't AI, since you've got a MSc in Computer Science - if your thing really was AI, you'd just be off doing it. So if I were you, I'd free up as much time as possible and then use that time to experiment widely. Get an easy job or some unstructured academic thing to keep your parents happy and then explore whatever catches your eye. When you find the right thing, I suspect you'll know it.

</comment><comment><USER5> I know lots of people in this situation, including more than a few with "10 figure" parents, and the happiest ones are those who choose to ignore the money and live a normal life. They might live in nicer apartments, but for the most part they get the same jobs as their peers and go down the same career path. If they didn't do that I imagine it could become quite isolating.

If that doesn't interest you, you could start a company or go to school. You don't have the same pressure to make money that many recent grads do, because you have a big safety net if you fail. So the risk/reward ratio is higher for you in startup land.

I don't see why rich parents should change your behavior. Don't you want to be successful on your own? Or do you just want to wait for an inheritance (read: wait for both of your parents to die)?

What would your parents think if they read this post?

<comment><AUTHOR> Well I know a mid 8 figure only-child family, but don't know or lie about knowing "10 figure parents".

I'm working and getting a $28k bonus for evading the gift tax--that's fine for now. My parents would know about that part. I have the pressure to present any business ideas to my parents, or even the trustee. Video games frankly seem tempting.

<comment><USER6> There is a wide gap between making games, and enjoying them.

Once they're reduced to nuts and bolts and hard work, they become much less interesting.

<comment><AUTHOR> Likely true, although I was referring to playing them.

</comment></comment></comment></comment><comment><USER7> It sounds like you're pretty young, so I definitely don't think you should consider retiring, or even travelling the world, just yet. Let me tell you why.

I grew up in a very affluent area in Stockholm, and although my parents were far from 8 figures, we had it very comfortable. My parents were extremely strict about not spoiling us, so we got nothing for free. When I was around 15 or so however, my grandmother gave us a tiny inheritance so she could spend the rest of her money backpacking with a good conscience. Anyway, that very small amount of money meant that I could take long breaks from university to travel the world, live in Shaolin, China etc, and I definitely didn't have any financial motivation to work hard and finish university quickly.

I did have some great experiences, but I ended up never finishing my degree, despite also being very technical and finding university extremely easy. It hasn't been a problem for my career, but it has stopped me from pursuing other goals, such as getting a PhD.

What I'm trying to say is, very few people can handle being even slightly free from economic constraints without becoming idle, and as nice as idleness may sound, it's really harmful in the long run. If you're anything like me, you'll regret it.

I think the best thing you can do is to get a degree, not because you need it but because learning is interesting. If you're past that stage in your life, join a startup (such as ours, kitex.tech), your financial freedom means you don't have to get a second job, you'll be a great addition to any team.

If you really feel the urge, take a year to travel, but be disciplined about it. But in my experience, travelling, like anything, is much more rewarding when there's a goal. Better work with something that involves travelling to exotic locations, than bum around as a directionless backbacker.

</comment><comment><USER8> Imagine how good it would feel to be able to say to your parents:

"It's been really nice to know I'd be taken care of if things didn't work out, but as it turns out I don't think I'm going to end up needing anything from you guys. Is it too late to restructure things so that any inheritance skips me and goes straight into a trust for the grandchildren?"

That's a realistic position that you can get yourself into (it just happens that the rest of us _need_ to get there). Having the inheritance as a safety net will actually make it a bit easier, since you'll be able to take a few more risks, career-wise, or even do some of that entrepreneuring that you don't seem interested in.

But I think you'll be surprised what it does to your feeling of self worth to know that you actually accomplished something on your own, rather than just waiting for a trust to mature.

</comment><comment><USER9> Buy the Winchester Mystery House and start extending it. The haunted house space is ripe for disruption. Eventually, sell the whole thing to Google as their newest campus. Then join the board of YC and spend the rest of your days funding apps that let people send the word "yo" to each other.

</comment><comment><USER10> Graduate school is wonderful, and AI departments are looking for students. Grad school made for some of the best years of my life. Eventually you have to crank out a thesis, but the journey is very rewarding.

<comment><AUTHOR> Already have MS computer engineering.

<comment><USER11> So get a doctorate. You could even afford to avoid TAing classes, since you don't need the money.

<comment><AUTHOR> will consider.

</comment></comment></comment></comment><comment><USER12> I'd recommend taking a look at projects such as 80,000 hours - from their site "Make the right career choices, and you can help solve the world's most pressing problems, as well as have a more rewarding, interesting life."

[https://80000hours.org/](https://80000hours.org/)

<comment><USER12> Somewhere there's the intersection of: (a) what you want to do - i.e. your interests & 'passions', (b) your skillset, or potential to learn a skillset (c) worthwhile problem to work on (d) something that will financially support you; but this is not a concern in your case (e) something that provides you with dignity, purpose and meaning in life

I like the idea that it's an optimisation problem, to seek something which achieves these criteria and maximises beneficial impact to society.

</comment></comment><comment><USER6> Down the track, I'd buy a place on [http://aboardtheworld.com/](http://aboardtheworld.com/) and just network with others of your ilk. They'll have faced the same challenges and could offer some good advice I'd suspect.

Otherwise, what are you interested in beyond AI? I see AI as interesting, but a means to an end. Gardening, for instance, interests me. I would look at ways of improving crop yield, rehab'ing land etc (perhaps naively), or anything with a quantifiable goal. The current wealth imbalance of the world interests me, I'd research ways of coming to terms with that or fixing it :p

<comment><AUTHOR> neat link.

</comment></comment><comment><USER13> If you don't have to worry about finances and you have the ability to take time off for yourself, you could always travel the world and meet new people, explore new cultures. You might end up inadvertently being exposed to something that you become passionate about. In the worst case scenario, you'll probably get to experience some incredibly beautiful places.

How do you feel about charitable work? Is it something that would give you satisfaction? And do you enjoy working with people? I always imagine how great it would be to have money and be able to make small loans/donations to entrepreneurs just starting out. I think I would find it equally satisfying to providing funding for small businesses as much as the next world changing startup.

Do you have some hobby you really enjoy? Maybe you could start a small business involved in that as a sort of side job, without the pressure or drive needed to launch a full time business.

Slightly off topic, but I couldn't even imagine what I would do with that amount of money. I remember when I first started making $35k-$40k here in LA, not exactly a low COL area, and I had more money than I knew what to do with.

<comment><AUTHOR> In my case, I'd need to convince my parents or trustee to start loaning out the money. I suppose that makes it a loan or angel arrangement over a donation. True about small businesses. My dad's mainly into apartments, commercial real estate, and housing on long term (rented) basis. Myself I work as a programmer in a small business. More to life than the BIG FOUR or whoever wants to become the fifth.

</comment></comment><comment><USER14> Go around the world in 160 days, spending as less as possible, always using the cheapest way of transport. You'll figure it out before you get home. Meet people, talk to them, take some risks, live in the moment.

ps. Don't try to be an entrepreneur, to be yourself, just figure what _you_ want now what _is_ cool. You're the one that gives purpose to a cause/item/person.

</comment><comment><USER15> > _aging parents. Even if they die_

When they die. May I suggest you make the most out of the time they have left and enjoy them while they're still alive. The pursuit of income is one of the main reasons separating families and you don't have that problem. You can learn whatever you want to because you don't have the constraints 99% of people have. You are alive and they are _now_. Cherish these moments for they are never coming back. Ever.

I'm not being patronizing and I'm doing a whole lot of projecting here. I wish I knew my parents better. They are still alive, but I wish I had spent more time with them. Something I am trying to correct.

 _" The bitterest tears shed over graves are for words left unsaid and deeds left undone."_

<comment><AUTHOR> _sniff_

</comment></comment><comment><USER16> We would love to have you look into joining our project.

We work from Oregon and Maryland. Currently we are a team of 2.

[https://smartmadre.com/stats](https://smartmadre.com/stats)

<comment><AUTHOR> Interesting. I'm aware of angel investing, and appreciate that low investments can single-handedly push a concept forward.

<comment><USER16> Project does not need funding, but could use another motivated technical person. Work on whatever you enjoy. Email is in my profile and on website.

</comment></comment></comment><comment><USER17> What are you passionate about? Do that.

The advantage the money gives you is an ability to fail. You can follow your passion, fall flat on your face, and yet still have stability in your life. So shoot for the moon.

If you follow this route you will meet fellow travelers who are passionate about the same thing. Help them out. Encourage them. Find a way to extend that stability into their lives.

</comment><comment><USER18> Join our startup and work in the AI team! (Assuming you would be able to pass our interview process)

We won't pay you as you don't need the cash but your life would definitely be interesting and you would do exciting work.

</comment><comment><USER19> Like everyone else in the same boat (having both the awareness to ask and enough money to do something about it)... you spend the rest of your life trying to answer this question.

Good luck.

</comment><comment><USER20> Do volunteer charity software development work for some worthy cause.

<comment><AUTHOR> Might be something to do if they die.

</comment></comment><comment><USER21> I'd say forget about the money just live a normal low-stress comfortable life doing what you enjoy.

</comment><comment><AUTHOR> Thanks--everyone. I don't vote here, but appreciate the thoughts.

</comment><comment><USER22> ^ Neal Khosla.</comment>


Senators are shocked that Equifax was just awarded a federal contract - <AUTHOR> http://money.cnn.com/2017/10/04/news/equifax-irs-contract-senate-response/index.html <comment><USER2> And the contract was awarded in a no-bid win.

[http://www.latimes.com/business/la-fi-equifax- senate-2017100...](http://www.latimes.com/business/la-fi-equifax- senate-20171004-story.html)

</comment><comment><USER3> I've long said that the FAR [1] is the biggest threat to national security. Things like this are exemplary of how broken the acquisitions system is in the USG.

[1][https://www.acquisition.gov/browsefar](https://www.acquisition.gov/browsefar)</comment>


NordVPN sued by Torguard for blackmail [pdf] - <AUTHOR> https://torguard.net/downloads/docs/Dkt.%206%20Amended%20Complaint.pdf <comment><USER2> Had a quick skim; it seems at a glance like someone from TorGuard badmouthed NordVPN on a youtube comment ( _sigh_ ), so NordVPN apparently in response threatened to disclose "trade secret information obtained by NordVPN regarding TorGuard's systems" it obtained via a hosting provider TorGuard used which is owned by the NordVPN people. This apparently involved some pretty sketchy stuff like sending people to the house of a TG employee to intimidate them.

Whoops.

What kind of 'trade secret information' could a vpn provider be blackmailed with though? What kind of information could you gleam as the owner of a 'service provider' for such a use? I'm suffering from an apparent lack of imagination here.

Either way, this looks pretty messy and as a NordVPN user, I'm surprised how amateurish this all seems.

<comment><USER2> Reading the parent pdf vs Nord's response [0] I'm slightly more inclined to believe Nords version of events here...

0: [https://nordvpn.com/blog/torguard- lawsuit/](https://nordvpn.com/blog/torguard-lawsuit/)

<comment><USER3> I'm not sure, their response could be fabricated too. I'm interested in if Torguard has any evidence of them physically approaching their employee.

> Within an hour of this in-person and unannounced visit, the same TorGuard > contractor received unsolicited correspondence from an employee at NordVPN. > This correspondence stated that NordVPN had received certain of TorGuard's > confidential and trade secret information and requested to set up an instant > message chat to discuss this with TorGuard.

Also, according to both parties they communicated with each other with evidence. So all either party has to do to claim their innocence is submit the emails/communications they claimed to have.

\---

The DDOS part I'm very weary about. What evidence does torguard have that NordVPN was the one carrying out the DDOS attacks? I'll admit I haven't thoroughly examined the entire document, but they don't really seem to state how they know NordVPN was behind the attacks, they just list the dates they were attacked. Given the nature of DDOS attacks, they could be from anyone.

<comment><USER4> What if I told you that a lot of these "VPN providers" were shell companies built to explicitly facilitate access and tools for crime / espionage with the premise of having _users_ there as cover.

<comment><USER3> Oh trust me, I'm well aware of "VPN providers". Just checkout luminati.io . See how they offer an SDK so "You can offer the user a choice between advertisements or a bit of background data usage"? I asked, and they are only interested in partners with 100k active users a month. Right, like a legitimate company with that many users is going to use luminati.

Or oxylabs.io who I think owns luminati?

I'm also aware that many of the VPNs are owned by the same parent companies.

And also that VPNs are ridiculously over marketed. They don't "add security" for most people, they just move who you're trusting from your ISP to the VPN company. Right, like I want to trust a company registered in Panama with no other existence outside of this year not to sell my data.

\---

tl;dr - I don't trust any of them. If I want a "VPN" I just ssh-tunnel into a VPS from an established company that I purchase with a different account. Could the VPS provider do fishy stuff? Sure, but I trust them a lot more then these "VPN" providers.

<comment><USER5> More on how luminati and other "residential ip" providers work here: [https://medium.com/@xianghangmi/resident-evil- understanding-...](https://medium.com/@xianghangmi/resident-evil- understanding-residential-ip-proxy-as-a-dark-service-dea9010a0e29)

<comment><USER6> Looks like Luminati is also explicitly getting developers to put a luminati proxy client into their apps and have users opt into using that instead of getting fed advertisements.

[https://luminati.io/faq](https://luminati.io/faq)

Between your link, and the luminati faq's, I definitely have more questions then when I started looking at these articles.

<comment><USER3> Luminati didn't start off like that. They started by burying what they were doing in a "free" vpn.

I asked, and they are only interested in partners with 100k active users a month. They REALLY REALLY wanted to talk to me over skype. Right, like a legitimate company with that many users is going to use luminati.

The use case of luminati is almost entirely grey/black hat. Their history is laughably sketchy. Unless anybody knows of any apps that use the SDK and ask for permission, I suspect that FAQ page is just for show. Again you have to be a big player to even use it, it's not a stretch to believe they don't "enforce" the consent rule.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Hey guys, Tom Spark here. I'm the video content creator that caused this whole thing. NordVPN hates my channel since I critique and criticize them a lot. They want to censor my channel to remove the bad reviews and so forth (ironic from a VPN company that is suppose to prevent censorship no?). To date, NordVPN is one of the lowest rated VPNs on my VPN tier list at [http://vpntierlist.com/](http://vpntierlist.com/).

They are also in the news a lot for various things and I make sure to cover it whereas other VPN affiliates don't (most VPN affiliates are aligned with 100% based comission VPNs like Nord).

I summarized the entire story with 3 videos if anyone wants the full story. Or the latest take on Nord's blog post here (which I believe to be complete bull) :[https://www.youtube.com/watch?v=icD3Bva7xtY](https://www.youtube.com/watch?v=icD3Bva7xtY)

<comment><USER8> I'm not directly accusing you of anything, but you sort of come across as a shill or extreme fanboy of TorGuard. How can you give them 5s across the board?

-Speed: During my testing with PIA and TorGuard, PIA was consistently 50% faster.

-App: The TorGuard app is lacking in features and poorly designed.

-Price: It's substantially more expensive than most providers.

-Reputation: They've had not too great a reputation for a while now

I do not believe that you are an objective party here.

<comment><USER9> Yeah, to still give them 5 stars for reputation after this whole lawsuit fiasco, is absurd. The apps are mediocre at best, rated just 3.1/5: [https://itunes.apple.com/us/app/torguard-anonymous-vpn- servi...](https://itunes.apple.com/us/app/torguard-anonymous-vpn- service/id988743799), so if nothing else his app score is clear evidence of him being impartial.

According to comments on his review they've also added Google trackers/capchas to their login page, something you wouldn't see on a reputable provider.

<comment><USER7> ?

<comment><USER9> Yeah, everyone who disputes your dubious paid endorsement of TorGuard as perfect/"GOD-tier", despite undisputable evidence to the contrary like having mediocrely rated apps, is obviously shilling for their competitors.

Give me a break...

<comment><USER10> FACT: Tom Spark is a TorGuard shill. Affiliate #4374.

<comment><USER7> [https://youtu.be/ppbZ3tFQ1ts](https://youtu.be/ppbZ3tFQ1ts)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> NordVPN is by far the shittiest VPN service I have ever used. They billed me twice, two months in a row, and getting them to fix it was like pulling teeth. This is not to mention the hard time I had actually using the service, between random inability to connect and outages.

They have ISP-level arrogance, without the lock-in. I have no idea how they're still in business.

So I'd be very inclined towards believing this story.

<comment><USER12> Can anyone recommend another VPN provider, than Nord or Torguard? Main use case is for using public WiFi when travelling.

<comment><USER13> > _Main use case is for using public WiFi when travelling_

Your own VPN is the correct answer. If you have a fast enough symmetric link at home then just run a small machine there (or your router/sec appliance may support it) or else get a ~$5 VPS from OVH/DigitalOcean/Scaleway/Amazon/Google/MS or whomever you like and run WireGuard on it. Or if you want something more turnkey with IKEv2 support (if you have devices that can't use WG) then check out Algo [1].

But there is likely no need for or reason to use a "VPN provider" if all you're looking to do is shift your virtual entry point to the internet from the edge, and lots of good reasons not to. The only real exception would be if latency is a major concern, you travel very widely and don't want to deal with any extra hassle setting up a solution to move between regions. In that case might be worth keeping an eye on CloudFlare's "Warp" solution [2], which will probably be about as good as it gets in that regard since they've got infrastructure worldwide and will be able to route well.

But I'd definitely suggest checking out running WG (alone of via Algo) yourself. It really is straight forward.

\----

1: [https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

2: [https://blog.cloudflare.com/1111-warp-better- vpn/](https://blog.cloudflare.com/1111-warp-better-vpn/)

<comment><USER8> One of my main use cases for a VPN is appearing from different countries. I also anonymize my traffic. If I own the VPS, that traffic can be tracked to my quite easily. I use a VPN for these things a couple times a week. I can (and do) use my own VPN just to secure my traffic on untrusted networks, but there's more to it that just that.

</comment></comment></comment></comment><comment><USER14> > Collective 7 is a Canadian hosting company [...] now owned or controlled by > NordVPN. [...]

> NordVPN threatened to release TorGuard's confidential and trade secret > information that was obtained by NordVPN from Collective 7— who, in turn, > obtained this information during the time TorGuard utilized Collective 7 as > a service provider. NordVPN threatened to release this information unless > TorGuard forced or coerced a third party into silence, as this third party > was publishing legitimate criticisms of issues associated with NordVPN's > business practices.

If true this reflects very poorly on NordVPN. How much criticism did they manage to suppress successfully until someone sued for blackmail?

<comment><AUTHOR> NordVPN has been known to suppress a lot of information about themselves - even the country in which they operate.

Given C7 is involved as well I'm very confident it's true.

<comment><USER4> And they are closely aligned with other vpn providers that all leveraged micfo (as is stated in this complaint).

<comment><AUTHOR> C7's owner is involved with quite a few VPN companies.

</comment></comment></comment></comment><comment><USER15> NordVPN response

[https://nordvpn.com/blog/torguard- lawsuit/](https://nordvpn.com/blog/torguard-lawsuit/)

<comment><USER16> "It all started when we received information that led us to finding a TorGuard server configuration file lying in the open on the internet... We hoped that after providing this vital assistance towards securing TorGuard's infrastructure, they would also cease with their illegal defamation campaign."

So nord is shitty for digging up dirt on torguard because they were mean to them online and torguard is shitty for having these vulnerabilities in the first place. Are there any vpn services run by a company that is neither slimy nor incompetent?

<comment><USER17> Try mullvad.net.

A bunch of hackers in Sweden. You can pay without exposing any information about yourself and they support wireguard (even help pay for and doing their own development on it).

I meet some of them personally on hacker conferences as well and they knew what they were talking about.

<comment><USER18> I would second for Mullvad too.

It's been the only VPN provider that has ticked all my boxes.

</comment></comment></comment></comment><comment><USER19> This whole drama (not of the highest quality) should be a big warning for all those naive people (trying hard not to call names) who seem to not completely understand the HUGE trust threats that _all_ VPN services entail. VPN services are black boxes. You have absolutely no idea what they doing in their black boxes despite all their claims. A nice post that sums everything up: [https://schub.io/blog/2019/04/08/very-precarious- narrative.h...](https://schub.io/blog/2019/04/08/very-precarious- narrative.html)

<comment><USER20> 100% concur to your opinion.

Anecdata, but from couple stories from people who worked/interviewed at VPN providers - I believe that in couple years we'll start see same horror stories of private data issues, like we are having with social network and internet ad businesses today.

EDIT: apparently my anecdata is not anecdotal [0]. When it's race to the bottom for consumer pricing - your bandwith is resold (or at least there's capability to do that) for botnet purposes.

[0] [https://restoreprivacy.com/lawsuit-names-nordvpn- tesonet/](https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/)

<comment><USER19> I'm sure we will, there have already been cases where claims about not keeping logs turned to be plain lies, sure why some wouldn't share their user's habits for further "analysis" for extra profit upon subscriptions.

The plain fact is that you don't know what they are doing, it's impossible to know.

If they ever find a way for an introspective verification/validation of configurations coupled with the connection itself (or whatever mumbo jumbo), then we can talk again about middle-men's trust.

</comment></comment></comment><comment><USER21> With these VPN services having become a race to the bottom, it's not all that unsurprising that stuff like this happens.

<comment><USER22> I think the race to the bottom already has many providers in fistfights at the finish line.

For example, when I tried Kodi (as a non-piracy living room media box starting point) a couple years ago, one of the reasons I gave up on it was that it seemed almost every Web search for technical questions would be filled with hits for VPN affiliate pitches. I also found forums, such as on reddit, filled with shilling, drama, and intrigue about VPNs, including some prominent ones. Then there was the related scandal of Facebook targeting children with a "VPN" surveillance channel, and there's really no assurance that many VPN providers aren't doing a similar thing.

I suspect there are some legitimate VPNs, but I decided I actually trust free Tor more than any random VPN, for some casual degree of protection against snooping open WiFi and ISP.

</comment></comment><comment> safeplanet-fesa I used to be one using and praising ProtonMail, but after the Tesonet scandal turned me around. The worst evidence for me was their responses, how they were constantly calling it a "smear campaign by PIA", often not providing any plausible explanations. Duh, PIA published it and put work into raising public awareness. They are competitors, they found your dirty laundry and published it, duuuuh. Whoever discovered it, doesn't matter, they couldn't respond to the actual facts, only repeating the annoying combination of words "smear campaign". I don't trust a single VPN provider and would rather trust my exit point to my ISP which is regulated by local laws, rather then trusting it to god know whom god knows where. I would be happy to see the issues of Tesonet and their links to NordVPN and ProtonMail/VPN raised again!

<comment><USER23> Not sure if you saw it, but Proton published a response here: [https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...](https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/)

The fact that hundreds of Twitter bots were used to spread the allegations is rather strong evidence that there was indeed a smear campaign. Details about this here: [https://protonvpn.com/blog/is-protonvpn- trustworthy/](https://protonvpn.com/blog/is-protonvpn-trustworthy/)

</comment></comment><comment><USER24> From NordVPN response:

> It all started when we received information that led us to finding a > TorGuard server configuration file lying in the open on the internet.

It's highly doubtful that's some random person will send some security vulnerabilities about a company to another unrelated company. It's more probable that NordVPN had its own team trying to hack or at least test Torguard defenses. That makes the DDoS allegations more believable.

<comment><USER25> > It's highly doubtful that's some random person will send some security > vulnerabilities about a company to another unrelated company.

When I had a small web-crawling/automation business we'd get quite few emails like that oferring all sorts of datasets and security holes for sale. We never responded (people already have a hate boner for web-crawlers lol).

Maybe someone with more gray/black hat infosec knowledge could comment on plausability on this but honestly I wouldn't underestimate black hat sales skills :)

</comment></comment><comment> safeplanet-fesa NordVPN is one of the ugliest in the on its own shady VPN business. They did their best to slowly make the Tesonet scandal slide away. Here on HN some users provided extensive insights about their connections with the Lithuanian data mining company and convincingly demonstrated that NordVPN must be the most evil VPN honeypot and deceiver.

<comment><USER20> Can you tell more about what is the "Tesonet scandal"?

I've heard such shady stuff about NordVPN that I would never trust them with their data, also would never trust any other VPN provider.

EDIT: I thing I've found it:

[https://restoreprivacy.com/lawsuit-names-nordvpn- tesonet/](https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/)

[https://news.ycombinator.com/item?id=17258203](https://news.ycombinator.com/item?id=17258203)

I was informed before not to use NordVPN for their (anecdotal) shady practices, but the fact that ProtonMail is in this crap too - I do not know who to trust anymore when I am buying "privacy" online.

<comment><USER23> ProtonMail is not involved and the story is really bogus. Proton happens to have an office in Lithuania (one of 6 globally) and was dragged in as a result, but otherwise there is no real connection as explained here: [https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...](https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn_and_tesonet/)

ProtonVPN in particular has been vetted by third parties such as Mozilla, and is operated very transparently as outlined here: [https://protonvpn.com/blog/is-protonvpn- trustworthy/](https://protonvpn.com/blog/is-protonvpn-trustworthy/)

The location of Proton offices for example, has always been publicly disclosed, the directors of the Swiss parent company Proton Technologies AG, and the company's CERN roots, etc, are all in public record.

</comment></comment></comment><comment><USER26> Just a friendly reminder to the world that NordVPN is also the one that lies about being based in Panama :).

<comment><USER27> Where are they based?

<comment> safeplanet-fesa Likely, in Lithuania, where they are subject to data retention laws, which means they are obliged to keep data for 6 month. I can suggest to search for "NordVPN Tesonet", the scandal that happened a year ago or so. The data mining possibility is horrible on its own, but Reddit and Hacker News users have discovered much more on the way. Everything is already said and exposed, hard to believe how much influence in general media they have that they could bury the whole story.

</comment></comment></comment><comment><USER28> Maybe off topic, but if anyone from NordVPN is reading this: for the love of god fix your iOS and OS X clients, so they don't log out randomly. I can't even begin to describe how frustrating that is.

</comment><comment><USER29> I'm getting a TLS error from this link. Is it for everyone or just me?

<comment><USER30> I get that same issue.

<comment><USER31> Can you explain what exactly the issue is? Where is the certificate chain breaking?

</comment></comment></comment><comment><USER32> So pretty much NordVPN pokes TorGuard into suing and now... NordVPN gets to put TorGuard in a body bag and call it a day as they've always wanted. Mission Accomplished.

</comment><comment><USER33> >$75,000

Wouldn't this only just barely cover court/lawyer costs?

<comment><USER34> That's the minimum to make it a Federal lawsuit. The damages, if any, would be determined later.

</comment></comment><comment><USER35> Why even use NordVPN when you can have AirVPN. Better in all ways...

</comment><comment><USER36> PIA has been caught orchestrating smearing campaign against nord in the past. It's funny to see how pias employee is all over this thread again, trying to undermine a competitor. Are you a messenger now for torguard now also?

</comment><comment><USER37> What exactly is the "confidential and trade secret information" about?

<comment><USER38> Seems that there were some massive security vulnerabilities that NordVPN found. [1] I'm very interested in seeing how this court case works out, as at this point I don't know who to believe.

[1] [https://nordvpn.com/blog/torguard- lawsuit/](https://nordvpn.com/blog/torguard-lawsuit/)

</comment></comment><comment><USER39> You can clearly see that TG include stuff about Nord that aint related to the lawsuit, nor to the court itself, and thats clearly why - to make Nord look bad guys in this scenario, while all the claims sounds like bs. Torguard hasn't even filled in the correct company name when they filed the suit first, which speaks for itself on how professional they are. Anyhow, how is that Nord the bad guy now and everyone forgets the fact that they just wanted to let torguard know about their own vulnerability to fix?

<comment><USER40> And how do you know the Micfo IP fraud is not related to NordVPN? They were using them extensively.

Collective Seven (C7) is related to a very long list of VPNs, including Nord, yet NordVPN has denied knowing them.

> Anyhow, how is that Nord the bad guy now and everyone forgets the fact that > they just wanted to let torguard know about their own vulnerability to fix?

It looks bad because they tried to force censorship in exchange for a non vulnerability. Torguard has a bounty program but instead Nord sent someone to the Torguard employee's house and tried to intimidate them into silencing a Youtuber.

It appears Nord knew what they had was not a vulnerability but still wanted use it as leverage for taking down the Youtuber's videos. This is censorship at it's worst.</comment></comment>


Whether to delegate - <AUTHOR> http://www.johndcook.com/blog/2013/12/30/whether-to-delegate/ <comment><USER2> I really like this model and framework - most people underestimate the impact of transaction costs, and I think it's partially why many companies overestimate the value they'll get from outsourcing.

But in the real world, I've worked with dozens of leaders and professionals, and I don't think I've ever seen someone with an over-delegation problem, where they had handed off too many tasks that they should have been doing themselves. Most have the opposite problem: mistakenly believing that delegation will take longer, or will result in lower quality work.

Delegation doesn't just help the person delegating, it helps the person receiving the work as well. It gives other people the opportunity to handle new challenges, feel ownership over their work, learn new skills, and apply what they're good at.

<comment><USER3> "But in the real world, I've worked with dozens of leaders and professionals, and I don't think I've ever seen someone with an over-delegation problem"

Couldn't agree more. I actually think our brains tend to over inflate the transaction costs, not ignore them completely.

<comment><USER4> I've seen leaders who don't delegate but abdicate. They hand over a project completely, refusing to make decisions that only they are authorized to make. It's as if they're saying "Guess! And if it turns out poorly, I can say I never told you to do whichever course you take."

</comment></comment></comment><comment><USER5> Another important factor that took me a while to learn and be comfortable with: successful delegation is not the same as defect free delegation.

People will make mistakes. They will do so even if they are competent and you were well justified in delegating a task to them. Nevertheless, screwups are going to happen, and sometimes it'll be something that is beyond the capabilities of the person you delegated the task to deal with.

But it's a mistake to think of these things as failures of delegation, or to use them as an excuse to curtail responsibilities. Delegating properly requires a holistic view. One of the fundamental problems of people who micro- manage or are incapable of delegating is that there will always be fuckups, thus there will always be excuses to do it yourself instead of delegating. But this is because we're comparatively blind to our own fuckups, which we see as recoverable and due to things beyond our control whereas the temptation is to see other people's fuckups as due solely to incompetence.

If nothing ever seems to be going wrong that may actually be a sign that you're not delegating enough. The trick is finding the right balance.

<comment><USER6> Seconded. I had to delegate the production of cover art for my recent novel, as I could not even pretend to overestimate my art skills. Even then, I managed to let a major error (likely a failure of instruction) get through, which will require one more editorial task for me.

<comment><USER5> I suppose the corollary of this is that you have to make sure you put in place quality control checkpoints so you can make sure delegated work is done correctly. This sort of thing tends to be ignored when you do something yourself because you'll usually do simple double-checks to verify the work you've done as a matter of course.

<comment><USER6> Makes sense. I look forward to figuring out how to apply TDD- and BDD-like methodologies to non-software processes.

</comment></comment></comment></comment><comment><USER7> This distantly reminds me of [http://xkcd.com/1205/](http://xkcd.com/1205/) , the saving time comic. When I looked at it, I noticed that the time durations surprised me, in that spending time automating (which can be compared to finding someone to delegate to) is often more worth the time than I would have intuitively felt.

I'm not sure if that's just a personality thing, or if people in general are more liable to not-delegate-when-they-should, than delegate-when-they- shouldn't.

<comment><USER6> Agreed. I might have spent the better part of three or four full work-days refactoring some code at work, but that was only after we spent a _week_ of QA time and my own error-fixing time, all because I had not insisted on such refactoring in the first place. Never mind the time we will save going forward replacing in-browser tests with controller-level unit tests.

</comment></comment><comment><USER8> Good post. I like the ideas of managing energy, in addition to time. In a similar vein, one has to manage their focus too. This means delegating things so that one can focus on other things. (Or more correctly, delegate and monitor if that takes less attention than doing or actively managing)

</comment><comment><USER9> I think corporations are similar to supercomputers. For instance delegation makes a lot of sense in embarrassingly parallel tasks, but can sometimes be for the worse if it means excessive io.

<comment><USER8> If you mean communication by io, then yes, this holds. Similar to parallel computing design, there are organization design principles to minimize handoffs. For instance designing work and organization so that larger tasks can still be handled by individual organizational units.

</comment></comment><comment><USER10> I'd like to start delegating more. Any suggestions of things to try? What have you found most useful?</comment>


Apple: Advancements in Game Controllers - <AUTHOR> https://developer.apple.com/wwdc20/10614 <comment><USER2> Reading gamedev subs on reddit, I got a very strong impression that Macs are generally being looked down upon and not considered worthy of porting to.

In part due to a significantly weaker hardware compared to Windows machines, in part due to constantly changing API surface and breaking backwards compatibility, and in part due to historical game-hostile stance of the company stemming from Jobs' personal dislike towards having games on Mac.

Is this off or did I get the sentiments right?

<comment><USER3> It is spot on. Macs are less than 5% of the Steam audience, software now needs notarization, developer tools cost money in the form of hardware, GPU drivers are buggy (unless you use Metal and buy into Apple ecosystem), modern OpenGL was abandoned years ago, etc. So developers only target macOS if the game gets big enough.

From the point of view of gamers, it is annoying. The recent 32-bit support drop killed a huge amount of macOS games. Now I have to bootcamp to play some of my favorite games. The GPU performance is also quite bad due their fight with NVIDIA.

<comment><USER4> > Macs are less than 5% of the Steam audience

Isn't this one a bit of a chicken/egg situation?

<comment><USER5> As a developer, you don't have much incentive to fix it yourself.

<comment><USER6> In fact, one could argue that you're actually penalized for trying to fix it yourself.

</comment></comment></comment></comment></comment><comment><USER7> Why isn't the ipad a portable console for TVs?

Why can't you plug the iPad into an HDMI slot and use near-by iphones as controllers?

<comment><USER8> I think this is exactly what Nintendo was thinking when it came up with the Switch and it's pretty brilliant.

<comment><USER9> I have this daydream that there are some Apple engineers that looked at the Switch and said, "Dammit. We could have done this."

</comment></comment></comment><comment><USER10> The GameControllers API on macOS is completely useless. They forget to say it in the documentation, but only a tiny fraction of game controllers are supported, so you have to use a lower level API to have any level of compatibility.

On iOS it's a different story. Only a tiny fraction of game controllers are allowed to connect to iPhones in the first place, and this API supports them all (1).

(1) They have deprecated support for game controllers that don't have joysticks, so even made-for-iOS game controllers may stop working.

<comment><USER11> XBox One and PS4 controllers have been supported on Mac and iOS since last year. The situation was pretty grim before then, but things are much better now.

<comment><USER12> Wow I didn't realise this and I just tested my XBox Controller with Evoland and Limbo and it just worked! Thank you! Now I can finally continue playing these, as controlling them with touch was horrible

</comment></comment></comment><comment><USER13> So apple reinvented SDL and made it less portable?

<comment><USER14> SDL2 is a layer over Metal, or Vulkan, OpenGL, D3D and others.

<comment><USER13> It also abstracts out a ton of third party controllers

</comment></comment></comment><comment><USER15> As outsider I'm amazed how much work it is just to detect a button or to vibrate the controller. That haptic diagram at 7:55 looks like satire. Compare it with LOVE API which is as simple as it can be. [https://love2d.org/wiki/love.joystick](https://love2d.org/wiki/love.joystick)

</comment><comment><USER16> Apple is wasting its energy. All they know is they seem to make some decent money from the crappy mobile gaming world, so they blindly think they'll be able to leverage this.

</comment><comment><USER17> Why do we still use game pads anyway? Why not just put some sensors on the fingers and the body itself and capture the motions?

<comment><USER18> For VR, that is pretty much what we do! For some higher-end stuff like the Valve Index knuckles, you don't even need to hold the controllers - they strap to your palm and track the position of each individual finger

<comment><USER17> Why not do this for everything? Perhaps it could even replace ordinary keyboards.

By the way I once tried playing a first-person shooter or a PS3 using its gamepad - it felt like controlling an excavator (which is quite hard do fast and agile enough to evade and shoot an enemy). I believe a VR-like sensor could be as convenient as a mouse is.

<comment><USER19> "once tried playing a first-person shooter or a PS3 using its gamepad"

Is this because you aren't used to using a gamepad? I know people who exclusively use console gamepads and struggle to use a keyboard and mouse to the same accuracy.

<comment><USER17> AFAIK it's a well-known problem players using mice have a significant edge in competition with game-pad users.

<comment><USER19> You're absolutely correct, but that doesn't mean that playing on a gamepad is difficult.

Just that it perhaps doesn't provide you with the accuracy of a mouse, that is why they add in mitigating features such as aim assist.

In some areas its been a problem with PC players playing on a gamepad, to take advantage of high refresh rates and FPS in conjunction with aim assist.

My point being that I have friends that have tried playing FPS games on a PC and have seriously struggled. Not because it's difficult but because it was new to them.

</comment></comment></comment></comment></comment></comment><comment><USER20> Weird studio over-production. The first speaker looked like old CGI _after_ cutting away from the cartoon.</comment>


The Unofficial Hacker News FAQ (2011) - <AUTHOR> http://www.jacquesmattheij.com/The+Unofficial+HN+FAQ?Repost

<comment><AUTHOR> Official FAQ: [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

Official guidelines: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

The unofficial FAQ has been posted many times before, and some discussions have been useful, but most of the important comments have been incorporated into the document. However, here are some of the previous submissions:

[https://news.ycombinator.com/item?id=9238539](https://news.ycombinator.com/item?id=9238539)

[https://news.ycombinator.com/item?id=6574763](https://news.ycombinator.com/item?id=6574763)

[https://news.ycombinator.com/item?id=3084467](https://news.ycombinator.com/item?id=3084467)

[https://news.ycombinator.com/item?id=2390712](https://news.ycombinator.com/item?id=2390712)

[https://news.ycombinator.com/item?id=1755533](https://news.ycombinator.com/item?id=1755533) (92 comments)</comment>


Incident Management at Spotify - <AUTHOR> http://labs.spotify.com/2013/06/04/incident-management-at-spotify/

<comment><USER2> I recently canceled Spotify, I had it for almost a year. They still have problems and don't seem to care quite enough. Playback has become erratic, you never know when a song will just stop playing.</comment>


Attorney General Barr Accuses Hollywood, Big Tech of Collaborating with China - <AUTHOR> https://mobile.reuters.com/article/idUSKCN24H2JT <comment><AUTHOR> > Barr suggested that Apple iPhones "wouldn't be sold (in China) if they were > impervious to penetration by Chinese authorities."

Are iPhones in China different from those sold in the US, from a security or privacy perspective?</comment>