How to redirect Nginx 400 Bad Request – No SSL certificate was sent [video] - <AUTHOR> https://www.youtube.com/watch?v=uo67pnAFSeQ <comment><AUTHOR> Anyone know why nginx error_page redirects don't work for this specific "400 Bad Request - No required SSL certificate was sent" error?</comment>


Gorilla: A Fast, Scalable, In-Memory Time Series Database [pdf] - <AUTHOR> http://www.vldb.org/pvldb/vol8/p1816-teller.pdf <comment><USER2> A few things here:

1) What/where exactly are they using GlusterFS for? Has Gluster fixed their scaling problems yet? Specifically the issue where new storage spaces/nodes were only available to new directories and files, but not existing directories? Granted, the last time I looked at this was 2009 or so, but it was a flaw due to their "no master node" topology.

2) FB has an entire team to manage Hadoop/HBase. This shows just how much of a beast that stack is. Anyone who has run Hadoop on "Internet time" knows what I'm talking about. It's great at running time insensitive, deferred compute jobs in an academic or scientific setting. It's really hard to keep it all 100% running in an on-demand setting. Aside, I couldn't imagine just working on 1 product in an operations setting as my full-time job. Boredom/fatigue must be a problem on that team.

3) I'd like to see more information on the networking side. What transport protocol? How large are the average updates in frame size? Etc etc.

We've built something similar to Gorilla in-house, so I'm happy to see that we've come to some of the same conclusions.

<comment><USER3> For #2, show me any system that holds over 2PB of data on a large set of machines that does not need a team to be managed.

<comment><USER2> I meant dedicated team. Most places run shared ops teams. Every place I've seen that runs a "big Hadoop" deployment also has a dedicated "Hadoop team" to go with it.

It's pretty easy to build a 2PB storage system on Ceph that the average group of sysadmins can run.

</comment></comment></comment><comment><USER4> I really wish this included a comparison with KDB. It's not cheap to get a license, and they certainly wouldn't give a testing license in order to publish benchmarks against it, but in finance it is the standard for TSDBs. There hasn't ever been anything open source that has come close.

<comment><USER5> They can download a 32-bit version of kdb+ for evaluation purposes, not sure if they could publish any benchmarks, and it would obviously not properly represent the speed (and capacity) of the 64-bit version.

But I suspect that even the 32-bit kdb+ is going to be significantly faster than this gorilla.

<comment><USER6> I briefly worked with K and Q while doing research on high-level numerical computing. I found their claimed efficiency to be severely exaggerated. K is a very naively implemented array-oriented language and I found it to be slower than Matlab or NumPy for many tasks.

<comment><USER7> You should consider writing up something with examples. Given how it's implemented (unboxed directly typed mmap'd arrays) it's hard to see how much slack there could be in it. I and many others are beginning to experiment with Q and Kdb and your learnings might spark valuable debate - and perhaps saved time. :)

<comment><USER6> I wouldn't voluntarily touch K/Q ever again, but if someone else is interested in doing a blog post: try implementing any iterative machine learning algorithms. The separate compilation of primitive operators requires creating many array temporaries that on the one hand, Matlab's JIT can fuse and, on the other hand, NumPy provides a richer set of compiled functions to work with. K/Q lets you (tersely) express complex array computations using just its core operators, but all those array constructions add up to comparatively bad performance.

<comment><USER5> Do you remember which versions and wordlength you use of each software, in case I get a chance to do comparisons?

<comment><USER6> It was ~4 years ago on a quad core xeon with ~8GB of memory, using whatever was the most recent version of Q, Python/Numpy and Matlab at the time.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Why pointers, why not just do a mirror mmap if you have constant offsets and if time points change and querying based on time points need be constant maybe a table that holds an offset w/ the difference? Also why not atomics instead of spinning?

<comment><USER2> I also saw spinlock and immediately thought, why?

</comment></comment><comment><USER9> > Further, many data sources only store integers into ODS

If the underlying data type is 64 bit double, aren't they losing precision for integers greater than 2^53?

</comment><comment><USER10> So this isn't managing news feed data or anything like that, it's helping them aggregate server performance and error data for quick look up?

</comment><comment><USER9> Has anyone attended a VLDB conference recently? How is it different from Strata, for example?

P.S. Their choice of venues is nice.

</comment><comment><USER11> Few folks from Fb started this company called Interana, and they seem to be doing the same thing.

</comment><comment><USER12> The compression is very neat.</comment>


Pirate Bay Power Usage Equivalent to a Vacuum Cleaner - <AUTHOR> http://torrentfreak.com/pirate-bay-power-usage-equivalent-to-a-vacuum-cleaner-121021/ <comment><USER2> One part that really makes The Pirate Bay very efficient is their torrent tracker software. Unlike Python and PHP implementations, theirs is written in C, with very little dependencies. It's called OpenTracker — <http://erdgeist.org/arts/software/opentracker/>. It's intended to run on a WLAN router; it's _that_ efficient. Especially see the "Philosophy" section :)

Of course, other projects can also use this for very legal purposes. E.g. my <http://driverpacks.net> project uses torrents for distributing (legal!) downloads to avoid expensive server bills. The infrastructure is simple: a central OpenTracker instance, plus a few seedboxes (±$15/month) that get new files via rsync (to guarantee each file always has seeders), and voila: terabytes per day of traffic at ±$1/day. Live stats at <http://driverpacks.net/stats> — powered by <http://drupal.org/project/opentracker>.

Hopefully this is useful for somebody :)

<comment><USER3> I thought they no longer ran a tracker. Does this piece of software fulfill other roles, or am I just mistaken?

<comment><USER4> Are you perhaps thinking of their change from .torrent files to magnet links? My understanding is that the tracker is something of a necessity.

<comment><USER3> I thought that they switched to only serving torrent files and having people rely on other trackers, and then later moved to replace all the torrent files with magnet links.

</comment></comment></comment></comment><comment><USER5> My calculations might be wrong, but 2.5 kW * 24 hours * 31 days is 1860 kWh, and the utility bill sitting on my desk says I'm paying about $0.10 per kWh. That's $186 a month, which pays for an awful lot of vacuuming.

I'm sure that they're quite efficient compared to other high-traffic websites, but this is a pretty silly way to show it.

</comment><comment><USER6> Why in the article they are comparing megaupload with TPB? Megaupload needed those servers because they were hosting the files. TPB only has torrents to download and they were using P2P to distribute the files.

<comment><USER7> Perhaps a site called TorrentFreak believes that BitTorrent is more efficient than cyberlockers.

<comment><USER8> Technically you'd have to factor in all the computers which are part of the BitTorrent network, wouldn't you?

</comment></comment></comment><comment><USER9> And the power of all the PCs idling to be available to serve up chunks of torrents? Seems like making a comparison to eg Megaupload and leaving that part of the equation out is disingenuous at best.

<comment><USER7> The original point of P2P was that those costs are both sunk and not your problem.

<comment><USER4> The hardware cost is sunk, but the additional electricity you use by serving things out over bittorrent instead of idling isn't.

</comment></comment></comment><comment><USER3> A large vacuum cleaner... running 24/7.

Impressive nevertheless.

</comment><comment><USER10> Not in the US it isn't -- a wall socket is typically only rated to provide about 15 A * 120 V = 1800 W peak usage (* 80% = 1440 W long-term), which is less than their 2.5 kW vacuum cleaner. <http://michaelbluejay.com/electricity/maxload.html>

15 A at 240 V could power it, though, if there's a vacuum cleaner that needs that much power.

<comment><USER3> I think you might find industrial vacuums that draw that much power. Those floor buffer things do at least I think.

<comment><USER11> Not if they plug into a traditional wall outlet. There are rules and laws about these things.

If the outlet has a T-slot on one side, it can take 125V 20A plugs (125*20 = 2.5kW) as well as the traditional 125V 15A plugs. They're different plugs. You can't pull 20A across 15A wires. That's how you get electrical fires (or, ideally, blow fuses/trip circuit breakers).

See also: <http://en.wikipedia.org/wiki/NEMA_connector>

<comment><USER12> It's amazing what a wall socket will do under duress. I was drilling a hole in an exterior wall and accidentally draped the power cord into a puddle at the exact point where the drill cord met the extension. I got a big shock (I had contact with the puddle) with some effort dropped the drill that I was sort of force clenching, and ran/stumbled inside and turned off the mains. I couldn't work out why the fuse didn't blow until I pulled it out. Someone had stuck a paper clip across it, presumably after running out of fuse wire. The extension lead had welded its contacts to the drill lead as well. A lucky/unlucky combo that has taught me a lesson in electrical safety.</comment></comment></comment></comment>


All the Clouds Around Block my View... - <AUTHOR> http://hpc-opinion.blogspot.com/2011/09/all-clouds-around-block-my-view.html

<comment><USER2> As a network programmer, we've been talking about the cloud for a long time ... it was a generic mechanism describing how systems were interconnected. With Cloud computing, we're actually combining two different ideas that already existed ... the resiliency of a network with many redundant links, and the creation of computing clusters that provide redundancy and fail-over.

I guess I don't have a problem with this particular buzz-word. What I do have a problem with is people that claim to be using cloud computing but clearly just relabeled a product/service that is not.</comment>


Social at Google - <AUTHOR> I'd like to have another crack at doing Social for Google. It's really sad to see Google+ languish and I'd love to try something in a very different direction.<p>Does anybody know if there are any reseach programs or labs or something I could apply to at Google for some money to prepare prototypes, ideas, tests? <comment><USER2> Google's initial instinct was to disrupt Facebook with an open source play called Opensocial.

Then someone at Google decided it would be better to compete with Facebook, and now we have G+, and Google has gained a major competitor.

I wonder what would have happened if Google had kept iterating on an open stack. What are the leading open social stacks these days?

<comment><AUTHOR> I think social is all about presentation and user interface. I think the G+ stuff is a little weak.

</comment></comment><comment><USER3> Why not build it yourself? If it's because you don't have money, just get a job somewhere and work on it on the side, why build something for someone else if you think it's actually different?

<comment><AUTHOR> Absolutely, I might take a month off to mock it up, but actually what I want to do is leverage all the existing google technologies. I could make it look like it would work, but it would need some co-operation for it to actually work.

I think part of the success of facebook is that it has so many tools and utilities built into it. It's not just a place where you share links about stuff you found on the internet and comment.

I'm looking at Google+ right now, and I cannot work out how to message one of my friends. Thats got to be the most fundamental features of a social network.

I had to dig to even find my friends list.</comment></comment>


Creating a ReasonML App: step-by-step - <AUTHOR> http://zteo.com/posts/reason-native-app/ <comment><AUTHOR> I think ReasonML has a lot going for itself. However, there is so much focus on React and web rendering that it seems that folks do not realize that it can be used as a powerful modern syntax for OCaml. Hence these blogs posts.

Feedback, questions very much welcome!</comment>


Rebecca Black - a fine example of viral marketing - <AUTHOR> http://bozzie123.blogspot.com/2011/04/impact-of-viral-marketing.html

<comment><USER2> Unsure if the author made a typo or is misinformed, but the YouTube video (right now) stands at 78 _million_ views, rather than the authors claim of 73,000. Quite a magnitude of difference!</comment>


Show HN: HelloDigest – Digest newsletters and receive them a single email - <AUTHOR> https://chrome.google.com/webstore/detail/hellodigest/ickcolhndemmghdlafiapfnohmjoilbl?ref=producthunt <comment><AUTHOR> I created this tool because I get a lot of newsletters (& drip emails) every day and it is very time consuming to go through each and every email. Moreover, these emails come in at ad-hoc timings and distract my daily workflow. However, I would still like to glance over these emails so that I don't miss any important update (product updates, offers etc.).

With HelloDigest, I simply digest the emails once directly from Gmail and then it sends me a single email every morning at 9am (my timezone) with all new emails in the last 24 hours.

Do try it out and let me know your feedback. I hope you find it as useful as I do.</comment>


No, you can't join my wifi network - <AUTHOR> http://www.troyhunt.com/2015/12/no-you-cant-join-my-wifi-network.html <comment><USER2> This is kind of a dick move. Just make a guest network and be done with it.</comment>


Ask HN: How to be a great sysadmin? - <AUTHOR> <comment><USER2> [https://github.com/kahun/awesome-sysadmin](https://github.com/kahun/awesome- sysadmin) ?

</comment><comment><USER3> I'd start by learning how to search - [https://news.ycombinator.com/item?id=9419877](https://news.ycombinator.com/item?id=9419877).

</comment><comment><USER4> Sysadmins have to learn about more abortive technologies and know about them sooner than most programmers. They have to have knowledge of stuff that should have been deprecated a long time ago and they have to know why to say yes, no, or maybe when they're asked to do something new.

Reading, assessing, and learning are massively important skills.

</comment><comment><USER5> [http://www.opsschool.org/en/latest/](http://www.opsschool.org/en/latest/)

</comment><comment><USER6> Apparently[1] by running a firewall or configuring servers to accept connections only from where they should, gets instantly to the top 30%.

<comment><USER7> I think you forgot your [1].

<comment><USER6> hehe, I did: [https://news.ycombinator.com/item?id=10684866](https://news.ycombinator.com/item?id=10684866)</comment></comment></comment>


Distelli brings Amazon-caliber code deployment to all companies - <AUTHOR> http://pando.com/2015/01/20/andreessen-horowitz-backed-distelli-brings-amazon-caliber-code-deployment-to-all-companies/ <comment><USER2> [https://aws.amazon.com/blogs/aws/code-management-and- deploym...](https://aws.amazon.com/blogs/aws/code-management-and-deployment/)

Amazon has already begun making Apollo, Brazil, and Pipelines technology part of their AWS portfolio. If there is "Amazon Caliber" then this is probably the bar. It sounds like Distelli is a similar product, so its good to get some validation on the idea.

</comment><comment><USER3> Amazon CodeDeploy, CodePipeline, and CodeCommit offer much more than what Distelli does. It looks like a nice tool though, but expectations should be set right.</comment>


HTTPS Deployment Growing by Leaps and Bounds - <AUTHOR> https://www.eff.org/deeplinks/2016/12/https-deployment-growing-leaps-and-bounds-2016-review <comment><USER2> How will this work with hotspot capture portals? I have a dwindling list of sites I can use to check and see if my internet connection is down or just interrupted. And Apple/Microsoft don't always register the wifi is in captured so either I wait or I can open a browser to an unencrypted site and renew the session.

<comment><USER3> That's what [http://neverssl.com/](http://neverssl.com/) is for.

<comment><USER2> Now that is a handy link to have! Wish I knew of it sooner.

<comment><USER4> I use example.com, which has all the scenarios without redirects.

[http://example.com](http://example.com)

[https://example.com](https://example.com)

[http://www.example.com](http://www.example.com)

[https://www.example.com](https://www.example.com)

</comment></comment></comment></comment><comment><USER5> I think it would be interesting to measure how well sites _maintain_ their HTTPS too. I occasionally see improperly-configured certificate warnings (on corporate and even government web sites!). It may be that anyone who set up HTTPS once last month is going to have problems in 3 months or 6 months, and may not be set up properly for the long term.

In this "modern" world, it seems past time for governments to start supplying digital IDs. Why for instance can't every single person have a government- backed certificate of identity once they have done all the usual things that it would take to obtain a driver's license or passport? And if you can count on a passport being valid for 10 years, why can't you count on a government CA (say) to continue to validate your certificate for 10 years?

<comment><USER6> > In this "modern" world, it seems past time for governments to start > supplying digital IDs.

Good graces just stop. While this may seem like a step in the right direction and offer a great amount of convenience, one can only imagine how this would be abused by authoritarian powers.

<comment><USER7> Not just that, but the government has leaked millions of database records on everything from top-secret clearance holders to medical records to you name it. Their security posture is insulting.

</comment></comment></comment><comment><USER8> It is enforced by the browsers that implement HTTP2, it would be nice to see their adoption correlation.

</comment><comment><USER9> Am I the only one not all-in about moving everything to HTTPS? It's great for sites that track personal information and sensitive data that you wouldn't want snooped. But for a lot of sites (like phrasegenerator.com, one of mine) I'm not sure it makes sense - if someone in a coffee shop finds out what random phrase generator categories you've visited it's of pretty much no consequence. It's just an extra configuration hassle on the server, and a CPU burden on both ends. Admittedly minor, but why add a layer of complexity when it's not needed?

I don't know. I use Let's Encrypt for the sites where it matters, and I'm all for it with search engines, email clients, anything with a password, etc. But as an engineer who likes to keep things simple, this seems like another layer of complexity borne out of one of those dogmatic 'best practice' rules that makes modern software slower, buggier and harder to maintain than it needs to be, despite our amazing modern hardware.

<comment><USER10> But it's not just for personal information.

HTTPS keeps your ISP, your wifi hotspot, a dodgy router, or anything else from injecting ads and tracking information into your pages

HTTPS ensures that the server and information the user is requesting actually comes from you (and not a shady middleman who might give out bad information or just annoy the user with a slightly broken setup)

HTTPS ensures that content isn't being blocked by a bad government actor based on it's content

HTTPS keeps bad actors from injecting malware into your javascript, your images, even downloaded executables (there is "one click" software out there to inject malware into any .exe download it can find on the network in real time)

HTTPS helps protect against "dragnet surveillance". That doesn't just include bad governments, but also an ISP which might build a profile on you based on your browsing habits.

HTTPS treats information as "secure by default". You won't always know what is and isn't "private" to each person. "phrasegenerator.com" might just be a fun game to you, but to someone else it might generate a phrase that could get someone fired, or worse, based on the content of that phrase.

And using HTTPS everywhere means that it's harder to identify "secure" information from "insecure" information. Breaking one HTTPS connection one time for one person and one server isn't "easy", but it's not impossible. Breaking HTTPS for all connections to everyone every time for every server becomes practically impossible.

The overhead is next to nothing, the complexity mostly abstracted away, and with stuff like Let's Encrypt the "maintenance factor" is quickly getting reduced to "fire and forget".

There's no excuse to not use HTTPS any more in my opinion.

<comment><USER11> >HTTPS keeps your ISP, your wifi hotspot, a dodgy router, or anything else from injecting ads and tracking information into your pages

I suspect this is the main reason Google is so gung-ho about "https everywhere". Because of the popularity of GA, adsense, Double Click, and Google local caches at every ISP...they already have near global tracking. Closing the ISP MITM hole ensures that nobody else does.

Of course, "https everywhere" is good for other reasons, so not complaining...

<comment><USER12> i agree, though i'm worried about the security it actually offers and what protocols and ciphers are still considered secure.

Next PCI DSS will require most services to be using (and not honoring lower then) TLSv1.2; i'm not sure about what to do when (not matter of if, but when) that is considering no longer secure, TLSv1.3 isnt ready yet from what i understand.

Now that i write this i wonder, are there btw server/client solutions that utilize PGP? E.g. send requests via encryption with public pgp key server and response back to client with public key of client?</comment></comment></comment></comment>


Woven – "interactive fiction engine. . .clean syntax somewhat inspired by LaTeX" - <AUTHOR> https://github.com/zoenb/woven-story-engine <comment><USER2> That syntax looks painful. It reminds me of when I took John Shipman's course in TeX and got docked a point on my homework for writing a self-modifying macro.</comment>


10 Most Destructive Computer Worms and Viruses Ever - <AUTHOR> http://wildammo.com/2010/10/12/10-most-destructive-computer-worms-and-viruses-ever/

<comment><USER2> Uncredited verbatim copypasta from Wikipedia and another website's article from 2008[1] among other sources.

[1] <http://crunkish.com/top-ten-worst-computer-viruses/></comment>


Ask HN: PHP, interfaces, typehinting subtype and LSP? - <AUTHOR>

interface I
{
function foo(stdClass $arg);
}
class Test extends stdClass
{
}
class Implementation implements I
{
function foo(Test $arg)
{
}
}
Result:
Fatal error: Declaration of InterfaceImplementation::foo() must be compatible with I::foo(stdClass $arg) in test.php on line XY
How come that I can't type hint a subtype in the implementation? <comment><USER2> It has to work with all subtypes of stdClass, since in order for the interface to hold its word, I need to be able to get an object thats implements I, and pass it any stdClass, regardless of what they do with it.

<comment><AUTHOR> Based on the research I've made it is legal by the OO principles and SHOULD work but it got omitted somehow in the trade-off during the implementation.

Also NOT available in java.lang.

<comment><USER2> Say I have a function that accepts I as argument:

      function my_func(I $x)
      {
         $x->foo(new stdClass);
      }

That wouldn't be allowed, since your code requires an instance of Test, not stdClass

</comment></comment></comment><comment><USER3> This is a question that would be better suited to asking on stackoverflow.com

<comment><AUTHOR> wow. you too might think of allocating unnecessary memory, wasting people's bandwidth and occupying cognitive resources of others for nothing. TIA.

<comment><USER2> It's true though, stack overflow gets you more programmer eyeballs</comment></comment></comment>


Ask HN: Is there a HN-like site for Foreign Policy and International Relations? - <AUTHOR>

<comment><USER2> Here's a subreddit I found, though it seems to be only moderately active: <http://www.reddit.com/r/IRstudies>

I'd be interested to know of any other destinations people know if.

</comment><comment><USER3> Man, those were the days on Usenet spent plotting the Balkan disaster. It would be nice to know that something similar exists, as I'm getting bored of political blogs in search of eyeballs.</comment>


Is exploit-free software possible? - <AUTHOR> https://security.stackexchange.com/questions/219872/is-exploit-free-software-possible <comment><USER2> Over the years I've read that it is possible to proof code similar to the way you can prove a math theorem. I suspect that it can't be done easily for other than the simplest program but at some point in the future automation will be able to do it for a large codebase. It is a bit scary we are heading into a future where software will dominate most of our life yet software is very easy to break and breach.</comment>


Show HN: Reinformed – an aggregator for real estate news - <AUTHOR> http://www.reinformed.com

<comment><USER2> This is awesome. I'm in the real estate tech space. I would be great if this were commerical specific. That's where all the money is.

<comment><AUTHOR> Thanks and good idea! I'll work on adding sub-section for commercial real estate news.</comment></comment>


A robust shell manager for fish - <AUTHOR> Long time Oh My Fish! contributor and the person responsible for the Wahoo/OMF merge. If you see Oh My Fish! history for August 27, 2015, you can figure it out.
Here is another take at the let me manage your shell goods, Fisherman.
> https://github.com/fisherman/fisherman
This project was built from the ground up using an entirely different and more ambitious design, forged over 4 months of semi-private development. This is my most valuable contribution to the fish-shell community.
I think the best features of Fisherman are: strong UNIX ties and familiarity, minimalistic design, flat tree structure, unified plugin system, external self-managed database, cache mechanism, dependency manifest file, compatibility with Oh My Fish! and Wahoo, extensive documentation and examples and quick shell start.
Fisherman ameliorates the slow shell start problem using a flat dependency tree instead of loading a directory hierarchy per plugin. This also means that Fisherman performance does not decline depending on the number of plugins installed.
Thanks if you read this far and happy new year! <comment><USER2> Direct link: [https://github.com/fisherman/fisherman](https://github.com/fisherman/fisherman)

</comment><comment><USER3> Posts without URLs get penalized, so you'd be better off posting this with a link, then adding your text as a first comment in the new thread. Good luck!</comment>


Ask HN: How can I learn to secure my application infrastructure against attacks? - <AUTHOR> I created an app a year ago, web app. Store lots of customer information. Traditional front end in React, Express middle, and a database server type of layout. I am not a security person but believe I generally follow best practices with regard to things like MFA/password policies/etc.
However, I am worried that there are things I am missing that will subject me to data breach and loss of customer data. How do I learn to secure my app? Is there a checklist of best practices? Not really sure where to start outside of making sure everything is always patched and updated and following sane password/authentication schemes.
Maybe there's a good book on the subject? <comment><USER2> > Maybe there's a good book on the subject?

Shameless plug: I wrote a book exactly on this topic, and you're my target audience, so hopefully it answers a bunch of your questions. [https://www.manning.com/books/securing- devops](https://www.manning.com/books/securing-devops)

And I'm genuinely interested to know if you find it useful. Feel free to reach out!

</comment><comment><USER3> Some will argue about usefulness of CISSP certificate but I'd say the prep guides are definitely good source of solid foundations in terms of recognised good practices.

</comment><comment><USER4> For express.js have a look at [https://www.npmjs.com/package/helmet](https://www.npmjs.com/package/helmet)

</comment><comment><USER5> It's a tricky question, and I've spent years of my life trying to answer it. Hey, I am a security person and a developer and I don't always trust myself to do the right thing. No matter how much time I spend educating myself, there's _always_ something I still need to learn.

At the operating system level, the bare minimum is run only the services you need, have a firewall that refuses unwanted traffic, and to patch regularly. If you can, automatically apply security patches.

In terms of application security, in the ideal case you will have a budget that allows you to hire professionals to take a look at your systems, both from the inside and the outside. Simplifying, internal reviews usually try to answer the question "is this correctly built", whereas external reviews usually focus on "can we get in".

If you don't have a budget (as many small operations don't), I'd recommend the following approach:

1) Make sure you fully understand XSS and SQL injection vulnerabilities. These two are usually responsible for the majority of security issues in applications. The latter can easily lead to full data loss. Understanding them is not easy, but it's manageable. Once you know enough, make sure your applications are not vulnerable. CSRF is something that you should look into, also.

2) Security is not something developers can ignore, so allocate some time every week to learn something new. Even though this is a never-ending task, after a couple of months (and years) you will be much better off.

3) Continuously run entry-level scans against your application, for example using OWASP ZAP [https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Proje...](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) This should help you avoid the obvious problems. They have a Docker image and something they call a "passive scan", which addresses low-hanging fruit.

4) Harden your application, applying all modern security standards that make sense. I've decided that this is where people should focus their efforts first. An application that utilises a good number of standards is robust and can resist exploitation even when vulnerable. (Anecdote: the number of vulnerability reports dropped dramatically after Mozilla deployed CSP.) This step can be tricky, too, because there are so many standards and many ways to misconfigure them. My earlier work (SSL Labs, [https://www.ssllabs.com](https://www.ssllabs.com)) focused on encryption and certificates. My current project (Hardenize, [https://www.hardenize.com](https://www.hardenize.com)) focuses on a wide range of security standards, starting from DNS (and DNSSEC/DANE/CAA, etc), over email, TLS, and to application security (e.g., CSP, cookies, mixed content, SRI, etc). The idea with Hardenize is especially to help people who don't have the budget but nevertheless want to stay informed and do as best as they can, security-wise.</comment>


Hey HN, where do you go for good ideas? - <AUTHOR>

I'll admit this is sort of a vague question, but I think it will make for more interesting conversation. Where do you find interesting ideas for things to work on? Universities? Friends? Internet? The shower?<p>I'm finding myself in something of a creative slump, and I'm eager to find out what's happening on the frontiers of computer science and entrepreneurship. <comment><USER2> Although I'm not much of an entrepreneur (yep, here more for the hacking than the startup'ing), I spend a lot of my time working on "ideas" — I am a musician, a programmer, a tinkerer, a writer, a designer, etc., and find myself daily in need of ideas.

But recently I've been feeling an information overload. I spend too much time reading online, consuming information, taking in everything I can get. I read books all day long, I am constantly pushing myself to learn new things (languages, computer & human, and ancient history has been a recent focus). And I love it, I really do enjoy learning this way.

But some things, like good ideas, have to come slowly. Some of my best programming-related ideas have come while immersed in nature, like on a camping trip or while hiking a glacier, removed from the internet for days.

My advice is to leave town, disconnect. Go camping for a week. You'll learn a lot more there than you ever could online.

Alternatively, dramatically change your daily routine. Become nocturnal. Live with a friend in a different city for the weekend. These don't have to be permanent changes, but they do have to be dramatic.

My theory — backed by zero empirical evidence — is that when we our brains are forced to react to new situations, they have to improvise. This makes us instantly more creative.

</comment><comment><USER3> I find I have my best ideas when I'm not trying to come up with an idea at all. That doesn't mean you shouldn't look for inspiration, but I think a large part of forming an idea is to let your brain be disengaged. Here's something I shared on HN the other day that touches on this concept, but with better evidence:

[http://fairobserver.com/article/self-referential-thought- neu...](http://fairobserver.com/article/self-referential-thought-neuro- scientific-perspective)

<comment><USER3> A quote from the article might be helpful:

"Scientists suggest that the Default Network may be required for generating spontaneous thoughts during mind-wandering, and that it may be an essential component for creativity. More specifically, it becomes active when individuals focus on internal tasks, such as daydreaming or envisioning the future."

</comment></comment><comment><USER4> My interesting ideas almost always come to me when I'm trying to sleep or when I'm in class. However, the _subject_ of my idea is almost always unrelated to sleep or to the subject of the class at hand.

I think the meat of an interesting idea comes from exposure to the widest possible variety of environments, and the intersection between them. An obvious pattern for programmers which fits this criteria is an app idea arising from the intersection of knowledge about software and knowledge about something entirely unrelated, eg. patio11's Bingo Card Creator. (Yes I know, "interesting" is subjective.)

The ideal "idea generating formula" for me has therefore become seeking exposure to interesting (no, actually just _different_ ) objects/places/people/ideas/pastimes/jobs/[insert noun here] and then waiting for my brain to make connections out of it while it should be focused on a lecture or sleeping.

</comment><comment><USER5> Rather than looking for good ideas, look for problems that need to be solved, or market opportunities. Find out what is selling like crazy, and see if there's a subniche you can fill in that market. Read around in forums and see what people are complaining about. Talk to them and delve into their problems. Start with niches you're interested in.

</comment><comment><USER6> My wife or mom. They both spend a lot of time traversing the internet, to places I would NEVER visit, and they've been known to open their pocketbooks while doing so, especially when they have a problem that needs a rapid solution.

</comment><comment><USER7> Saw this interesting link on the Entrepreneur blog. Might help you with your inspiration!

<http://www.entrepreneur.com/blog/220790>

</comment><comment><USER8> For some completely crazy ideas have a look at <http://www.halfbakery.com>

<comment><USER9> That is a great site, I really like this idea [http://www.halfbakery.com/idea/Advertisement_20casino#108429...](http://www.halfbakery.com/idea/Advertisement_20casino#1084294800) I think it could be a good company if it where done right, an iPhone app would be great for just killing time.

</comment></comment><comment><USER10> Try my idea generator at: <http://www.ideaoverload.com/>

</comment><comment><USER11> I get most of my good ideas while writing about and actually coding up ideas I already have.</comment>


SAP reportedly buying Sybase for $6 billion - <AUTHOR> http://www.itworld.com/software/107543/sap-reportedly-buying-sybase-6-billion <comment><USER2> Databases used to be so stodgy. But now it is seen as a lead-gen for an enterprise sale.

</comment><comment><USER3> Does anyone else feel that SAP has a monopoly on enterprise software?</comment>


Dietary prebiotics improve sleep, buffer stress - <AUTHOR> http://sciencebulletin.org/archives/10764.html <comment><USER2> For those like me that don't know the difference between probiotic and prebiotic:

Probiotics are "good" bacteria that help keep your digestive system healthy by controlling growth of harmful bacteria. Prebiotics are carbohydrates that cannot be digested by the human body. They are food for probiotics. ... It has good bacteria like lactobacillus or bifidobacteria.

TLDR: mice that ate prebiotics had better REM sleep.</comment>


How-To-Prevent-Scraping: The ultimate guide on preventing Website Scraping - <AUTHOR> https://github.com/JonasCz/How-To-Prevent-Scraping <comment><AUTHOR> Originally posted as an answer[1] at StackOverflow, which was too long[2] and become a blog post.

[1]: [http://stackoverflow.com/a/34828465/2751621](http://stackoverflow.com/a/34828465/2751621)

[2]: [http://meta.stackoverflow.com/q/316012/2751621](http://meta.stackoverflow.com/q/316012/2751621)

</comment><comment><USER2> Ridiculous. If you don't want other people do read or use your stuff don't put it on the web.

<comment><USER3> What about paywalls?</comment></comment>


Ask HN: Elegant C# Code - <AUTHOR> I'm looking for examples of elegant C# code in projects. I see so much object oriented boiler plate, but I want to be inspired by something terse and functional. Please share some C# code bases that you find pleasant to read, modify, maintain... <comment><USER2> There was an HN entry on building a C# bittorrent client from scratch that was very nice to read: [https://news.ycombinator.com/item?id=12035568](https://news.ycombinator.com/item?id=12035568)

</comment><comment><USER3> look at [https://github.com/eventstore/eventstore](https://github.com/eventstore/eventstore)</comment>


OpenSolaris Governing Board Threatens to Shoot Itself In The Head - <AUTHOR> http://www.cuddletech.com/blog/pivot/entry.php?id=1134

<comment><USER2> I like OpenSolaris too much to be comfortable with the Oracle takeover. It's a very nice OS, with very cool technologies (ZFS, Crossbow) and it would be a shame if it became too... Oraclized.</comment>


Buddhist monk's brain produces highest reported level of gamma waves - <AUTHOR> http://india.nydailynews.com/newsarticle/7b470adb0a9b6c32e19e16a08df13f3d/buddhist-monk-is-the-worlds-happiest-man

<comment><USER2> If I'm not mistaken, this is a very thin veneer of science applied to a thick spread of dogma.

1\. Test shows that smart subject is smart (capacity to learn, etc).

2\. Subject of the test says meditation makes you happy.

3\. The author then tries to make science say meditation makes you happy: 'It is not difficult to see why scientists declared Matthieu Ricard the happiest man they had ever tested.'

<comment><USER3> He was the happiest man tested, but they haven't tested very many people. "Matthieu Ricard... has been the subject of intensive clinical tests at the University of Wisconsin, as a result of which he is frequently described as the happiest man in the world. It's a somewhat flattering title, he says, given the tiny percentage of the global population who have had their brain patterns monitored by the same state-of-the-art technology.... The fact remains that, out of hundreds of volunteers whose scores ranged from +0.3 (what you might call the Morrissey zone) to -0.3 (beatific) the Frenchman scored -0.45."

[http://www.independent.co.uk/news/people/profiles/matthieu-r...](http://www.independent.co.uk/news/people/profiles/matthieu- ricard-meet-mr-happy-436652.html)

<comment><USER4> He's probably quite happy that he gets so much attention and has to do so little except sit around and smile.

<comment><USER5> Yes, he spent 26 years studying Buddhism so he could get media attention.

What's with this dismissive attitude?

<comment><USER6> It's not dismissive, it's skeptic, and rightfully so - there are many flaws in this article (as outlined above) that might not come from the scientists, but from dodgy reporting. Who describes that guy as "the happiest man"? Is it the scientists (doubtful) or is it journalists looking for a "sexy" headline?

</comment></comment></comment></comment></comment><comment><USER7> You can actually use these electrical signatures to make meditation a trackable, quantifiable "exercise activity". Just like you log running miles with, say, RunKeeper. Really cool to see more people getting excited about it the science! Disclaimer: cofounder at a startup doing this.

<comment><USER8> Sorry if others don't like this but can you elaborate either by pointing me at your startup, with more science or both? I'm going to go on a Google spree but I'm curious about your take.

This is completely foreign to me, it fails my bs test but to hear not just the words scientific, but quantifiable, piques my interest.

<comment><USER9> There's a book called Buddha's Brain that documents several studies of people meditating while being scanned by an fMRI machine. It's quite fascinating. Regular meditation alters connections in the brain, similar to how working out a muscle changes the muscle.

I was on the fence on whether claimed effects of meditation were real, and reading this book clinched it for me. It anchored the claims I'd read elsewhere in something I actually believe - fMRI scans of brain activity.

<comment><USER7> Rick Hanson's stuff is great. Here's a lecture he did at Google several years ago: <http://www.youtube.com/user/BuddhasBrain>

</comment></comment></comment></comment><comment><USER10> I first misread the HN link's title as "gamma rays" and thought a radioactive monk sounded awesome! Then I read the actual article, I am disappoint...

<comment><USER11> I thought for a minute they had unlocked the reason all that meditation never truly helped Bruce Banner...

<comment><USER12> Very good grasshopper.

</comment></comment></comment><comment><USER13> I find it poetically ironic the way Western media/attention on Matthieu Ricard always focuses on him being "the happiest" - a completely inwardly-focused, selfish goal. The exact opposite of the type of worldview buddhism advocates

<comment><USER14> Being happy isn't a selfish goal, in fact buddhism looks at this as a non- selfish goal. Buddhism totally advocates for happiness[1], it is only your perception that happiness is selfish that is in error.

[1][http://thinkexist.com/quotation/i_believe_that_the_very_purp...](http://thinkexist.com/quotation/i_believe_that_the_very_purpose_of_our_life_is_to/145372.html) ""I believe that the very purpose of our life is to seek happiness." -Dali Lama

<comment><USER15> The quest of being happy is a selfish quest. Selfishness is a good thing to me.

Helping other (altruism) is also a good thing - since it serves your own selfishness (makes you more happy to see people happy - especially if you made them happy). The only limit is the damage it may cause them (ex: encouraging sloth)

The only bad thing is sacrifice - sacrificing the others or even worse, yourself, is very rarely a good thing - a good rule of thumb is thus to avoid sacrifices.

(words from a libertarian who finds many interesting things in buddhism)

<comment><USER14> From what I have read, and what I would also argue, buddhism makes the point that increasing your own happiness it is not a selfish thing because when you are happy those around you are more prone to also become happy. Like if you are happy and smile at someone and then it makes them happy.

So while maybe it could be argued becoming happy is selfish, actually being happy is not selfish. But then again becoming anything is selfish, I think the point is what happens after the point of becoming that thing. There is a lot of this logic in buddhism, which is why more importance is usually given to your volition for doing something than what it actually is your doing (think karma).

<comment><USER16> guylhem and blissofbeing both make very good points here. We can take into consideration the motivation behind the wish to be happy. It reminds me of a story I read while studying. I'm going to paraphrase here so please forgive any mistakes.

There was a man traveling down a road while it was raining. He came across a statue of Lord Buddha. He thought to himself, "The Buddha is getting all wet, that is not right. I shall cover his head so he doesn't get wet". He took off his shoe and put it over the Buddha's head.

Now, in those days (and even today in many parts of Asia) the act of putting something from your feet onto a Buddha's head is very disgraceful. In Thailand people don't even let their toes point at a statue of Buddha. Many people would think that man did something very wrong. However, his motivation was to protect Buddha and that single act was the eventual cause for himself to become a Buddha.

I am no expert and am just repeating what I have read elsewhere. Hopefully I did not mess the story up to bad and someone will still benefit.

<comment><USER17> Here's the story you're referring to: <http://www.bodhitales.org/the-buddha- statue.php>

</comment></comment></comment></comment></comment></comment><comment><USER18> That's all fine and dandy, but what about his Midi-chlorians levels? Shouldn't they focus on what's important?

<comment><USER19> Happy do the midi-chlorians make?

</comment></comment><comment><USER20> Good article, but it leads you to believe that meditation is the key to his happiness.

I'm not here to discount the potential benefits of meditation but I think it's important to keep in mind how much effort the monks put into living an altruistic life.

Meditation may help bring to the surface subconscious thoughts and feelings, but the responsibility of taking action and improving negative circumstances that are realized through meditation is the real chance for improvement. Meditation without action I would argue is meaningless.

I guess my point is, there is so much much that plays a role in the overall happiness other than meditation. I read "The Art of Happiness" recently where an American psychologist interviews the Dalai Lama and juxtaposes western and eastern schools of thought on the pursuit of happiness. I highly recommend it if you haven't checked it out before.

<comment><USER21> Meditation that causes an action to not otherwise occur should be counted as action, or certainly not meaningless.

</comment></comment><comment><USER22> If we some how view a "3D Spectrogram of Gamma waves" of people across the globe, then it will have peaks (like Himalayas) in and around Tibet. Everywhere else, there will be Troughs/Valleys.

<comment><USER23> peaks at bhutan too. they have a Happiness Index too

</comment></comment><comment><USER24> "All men's miseries derive from not being able to sit in a quiet room alone." - Blaise Pascal

</comment><comment><USER25> I really would have liked to read more than those few lines about said gamma waves.

<comment><USER26> Wish granted: <http://en.wikipedia.org/wiki/Gamma_wave>

</comment></comment><comment><USER27> They should test the Dalai Lama too, and unmask the truth.

<comment><USER28> They should test starving African war orphans to see if meditation helps with their happiness too, or if it's only rich entitled assholes who really really don't know what the fuck unhappiness is if the best they can come up with is being "disillusioned" by a bunch of bourgeoisie painters.

Oops sorry, my cynicism slipped out a bit there. Let me just tuck that back in!

<comment><USER29> Because these guys: [http://en.wikipedia.org/wiki/Buddhist_monasticism#Monastic_l...](http://en.wikipedia.org/wiki/Buddhist_monasticism#Monastic_life) are "rich entitled assholes", right? Nice.

<comment><USER28> They're not testing those guys though.</comment></comment></comment></comment>


Paul Allen: The Singularity Isn't Near (2011) - <AUTHOR> http://www.technologyreview.com/view/425733/paul-allen-the-singularity-isnt-near/ <comment><USER2> When "The Singularity Is Near" was first published, I asked Bill Gates what he thought of the book. He said "I don't know how near the singularity is, but I haven't heard any convincing argument why it won't happen". That seems like a more sensible position than the one offered by Allen in this piece. There is indeed a lot of uncertainty in the rate of progress. But Allen contorts that fact to say that the singularity _isn't_ near. He offers three basic critiques:

First, he points out that Kurzweil is extrapolating, and extrapolations can be wrong. This seems obvious. And it doesn't do much towards Paul's "isn't".

Second, he says that software and hardware will have to keep improving, and that might not happen. Again, this seems intellectually equivalent to saying "you might be wrong". No evidence is provided that progress will slow.

Third, he says that the singularity will require either a bottom-up biologically inspired model, or a non-biologically inspired "AI" system.

The complexity of the former will take a long time to overcome. Since Allen concedes that sufficient computational power is already here, he seems to be arguing that it will take over a hundred years for us to have a detailed model of the human brain. Looking at the progress of science, this seems terribly conservative, yet little justification is offered. Allen's posited "complexity brake" seems positioned tendentiously — why are we going to start hitting it now, instead of fifty years ago?

As for the AI route, he writes: "But when we step back, we can see that overall AI-based capabilities haven't been exponentially increasing either, at least when measured against the creation of a fully general human intelligence." What does it even mean to be exponential relative to a binary variable? He is right to say that current methods are limited, and don't achieve generalized intelligence, but offers no reason why that won't happen. His argument seems equivalent to simply saying it hasn't happened yet.

This piece offers little intellectual contribution, and the only reason we're reading it piece is because of the author. It reads like he started from the conclusion he wanted, and threw some paragraphs in that direction. His argument, essentially, is that he's betting _against_ continued progress in science, software, and hardware. That just seems crazy.

<comment><USER3> ( I don't believe Allen ever actually conceded the point you seem to wish to attribute to him, even after multiple readings. )

There's every reason to believe that things aren't going to get faster or better--CPU development seems to be petering out compared to the gains of yesteryear. Worse, the products that drive those sales, and the markets that drive those products, seem utterly uninterested in anything beyond simple apps and hardware-as-appliance.

The thing a lot of people seem to forget is that the market is what drives this stuff, and that in the absence of market forces not very much happens. This is the world we live in.

<comment><USER4> _CPU development seems to be petering out compared to the gains of yesteryear_

This is arguably true if your primary metric is single-threaded performance on branchy-integer-type code. Admittedly this is what normal users see most of the time, which is why consumer desktops and laptops haven't been very exciting the last few years. But the cost to build a petaflop supercomputer keeps dropping.

<comment><USER5> Sure, but the cost to solve a petaflop problem is not. We hit a point where the bottleneck is no longer flops but being able to organize systems that can use them effectively.

Doesn't matter how fast you think we will overcome this problem, it illustrates to many people that the intersection between the world that is not increasing exponentially and chip speeds starts to matter a great deal when you want to actually solve a problem by moving floating point numbers about.

</comment></comment></comment></comment><comment><USER6> Thank you, Paul, for speaking out against this cult.

It's very hard for me, as a programmer, to take this idea of a singularity seriously. I know how all of the technologies that Kurzweil is banking on work at a very low level and I call bullshit that this is ever going to happen. It would require a type of software that simply does not exist yet, something akin to a self-programming software, and we are so far away from that that it might as well be cold fusion.

I think it's much more valid to call the "singularity" the point in time when technological expansion started occurring at an exponential rate. Thus I would put the singularity at about 200 years in the past, right around the time the spinning jenny was invented, and right before the industrial revolution. Now there's a point in time that I can point to and say "something meaningful happened". This is complete pie in the sky stuff, and I'm extremely cynical that it's not just something that Kurzweil talks about to sell books and conference tickets.

<comment><USER7> Just a point that should be made in any discussion about the "Singularity": Kurzweil's isn't the only model/definition[1] of the Singularity, and some high-profile Singularitarians don't have a high opinion of Kurzweil[2] ("I've come to the conclusion that Kurzweil's worldview prohibits Kurzweil from arriving at any real understanding of the basic nature of the Singularity").

 _> I think it's much more valid to call the "singularity" the point in time [...]_

Isn't this just redefining the word "singularity", and so making the discussion about something entirely different? So it might be better to qualify that with "industrial singularity" and the one under consideration here is the "technological singularity".

[1]: <http://yudkowsky.net/singularity/schools>

[2]: <http://www.sl4.org/archive/0206/4015.html>

<comment><USER8> I've really got nearly zero respect for Kurzweil as a theorist. He made a bunch of predictions for 2010 in his 1999 book The Age of Spiritual Machines. When 2010 came around he graded his predictions and gave himself very high marks, but when I found a copy of the book and read what he'd actually written I found that he'd had to re-write his predictions substantially in order to count them as succeeding.

As far as I can tell the only way to become popular as a futurist is to lay out predictions for the future in far more detail and with far more certainty than could every be justified.

</comment></comment></comment><comment><USER9> Be sure to read Kurzweil's well-argued response too: [http://www.technologyreview.com/view/425818/kurzweil- respond...](http://www.technologyreview.com/view/425818/kurzweil-responds- dont-underestimate-the-singularity/)

(imho, more convincing than Allen's).

<comment><USER10> One of Kurzweil's arguments in his response is "...the design of the brain (like the rest of the body) is contained in the genome. And while the translation of the genome into a brain is not straightforward, the brain cannot have more design information than the genome"

However the brain's design information is the genome, the laws of physics _and a universe_.

You only have to look at protein folding, and the complexity of the resulting molecule and how that interacts with the rest of the world, so see how much complexity is there outside of the genome - and it's that complex end result that you have to simulate or replicate.

He goes onto say that "..the amount of design information in the genome is about 50 million bytes, roughly half of which pertains to the brain. That's not simple, but it is a level of complexity we can deal with and represents less complexity than many software systems in the modern world."

As above, this is greatly simplifying the end result that you're trying to replicate - the genome is just the software that's running on the OS/hardware of the universe. To replicate that virtually we'd also need a virtual universe.

<comment><USER11> The main complication of protein folding is how the amino acid chain interacts with itself, not its interactions with an external environment.

<comment><USER12> That proves the point. To be able to fold a simple protein, you have to be capable of simulating the very challenging simulation of "real world physics at an atomic scale".

To simulate a brain, you get to do that for a few hundred trillion proteins that make up a brain...and all their interactions with all the other trillion proteins.

The complexity doesn't come from the proteins so much as the physics that govern the proteins.

</comment></comment></comment></comment><comment><USER13> My first thought when I saw the title was that Paul Allen has some patent and obtained an injunction against the singularity.

Somehow I cannot bring myself to think about the whole idea (of singularity, economics of emulated minds, etc) seriously. Whenever Robin Hanson (of Overcoming Bias[1]) writes about it, I usually skip the page, even though his ideas are new and insightful. I also read some stuff from Eliezer Yudkowsky (of Less Wrong[2]) and again it's a great concept, he even wrote some cool stories about it[3], but despite all the emphasis on correcting own biases and other follies of the mind, feels way too much like some sort of techno, cyberpunk religion from the 80s.

[1] <http://www.overcomingbias.com/tag/future>

[2] <http://lesswrong.com/about/>

[3] <http://lesswrong.com/lw/qk/that_alien_message/>

<comment><USER14> I fear that one of the worst things religion did to people is to make them think that every hope of doing something amazing and making the world a better place is insane. People are afraid of great dreams, because they think it's religion. They think low of singularity-related stuff just because they pattern-match long life (and/or immortality) and superhuman intelligence with what religions promise and talk about. They shouldn't. Living longer, better, improving ourselves and extending our capabilities beyond what is currently possible is not faith-stuff; it is the dream of mankind at large, and we're building our technology to achieve that.

<comment><USER5> The best thing that religion did is show modern man the dangers of choosing faith over evidence. People don't call the singularity a religion because they want the world to be better or want to live forever or know more. Everyone wants that. They call it a religion because people believe this will happen in their lifetimes because they really want it to. They have faith and have shown no evidence. It's not about the belief in improvement, it's about the belief in prediction of a specific kind of improvement and a prediction of a timeline.

</comment></comment></comment><comment><USER15> I would upvote this a million times if I could. The whole concept of the "Singularity" confuses hardware with software.

Yes, _hardware_ technology has followed an exponential rate of improvement, and there's no obvious reason to believe that will stop.

But _software_ certainly hasn't. Programmers today still deal with the same issues they dealt with 30 years ago. Separately, we've figured out some cool pattern-recognition techniques, but there's absolutely nothing indicating "exponential" growth in how smart our programs are.

Yet the "Singularity" depends primarily on software, not hardware. And all this talk about getting around it by just "scanning in" actual brains and simulating them on hardware... well that still doesn't show how those simulated brains are suddenly going to get smarter than our own.

(And then you've got a whole lot of human-rights and personhood issues when you start dealing with actual seemingly conscious brains running on silicon, with real childhood memories, real emotional desires and whatnot -- I mean, they would basically be actual people, not some kind of abstract AWS brainpower cluster...)

<comment><USER16> I'm not sure that the software/hardware break is as clear cut as that:

[http://bits.blogs.nytimes.com/2011/03/07/software- progress-b...](http://bits.blogs.nytimes.com/2011/03/07/software-progress- beats-moores-law/)

<comment><USER15> Kurzweil makes the same point in his rebuttal.

But all he (and the article) is talking about is speed improvements to algorithms. Singularity-type AI is not about the speed, and it's not about complexity in terms of number of moving parts either (a million-line code base might be larger than a 10,000-line one, and more complicated, but not necessarily any more conceptually complex).

What matters for the "Singularity" is _conceptual_ improvements. We're still writing brittle computer code that crashes a compiler upon a single slightly misspelled constant name or missing comma, where the intention would still be crystal-clear to any human programmer. I don't see any kind of "exponential" progress whatsoever relating to the fundamental building blocks of artificial thought, which is what the entire "Singularity" premise is based on.

</comment></comment></comment><comment><USER17> [http://www.fightaging.org/archives/2005/09/reading-the- sin.p...](http://www.fightaging.org/archives/2005/09/reading-the-sin.php)

I am prepared to go out on a limb here, as I have done before, and say that business and research cycles that involve standard-issue humans are incompressible beneath a certain duration - they cannot be made to happen much faster than is possible today.

Kurzweil's Singularity is a Vingean slow burn across a decade, driven by recursively self-improving AI, enhanced human intelligence and the merger of the two. Interestingly, Kurzweil employs much the same arguments against a hard takeoff scenario - in which these processes of self-improvement in AI occur in a matter of hours or days - as I am employing against his proposed timescale: complexity must be managed and there are limits as to how fast this can happen. But artificial intelligence, or improved human intelligence, most likely through machine enhancement, is at the heart of the process. Intelligence can be thought of as the capacity for dealing with complexity; if we improve this capacity, then all the old limits we worked within can be pushed outwards. We don't need to search for keys to complexity if we can manage the complexity directly. Once the process of intelligence enhancement begins in earnest, then we can start to talk about compressing business cycles that existed due to the limits of present day human workers, individually and collectively.

Until we start pushing these limits, we're still stuck with the slow human organizational friction, limits on complexity management, and a limit on exponential growth. Couple this with slow progress towards both organizational efficiency and the development of general artificial intelligence, and this is why I believe that Kurzweil is optimistic by at least a decade or two.

</comment><comment><USER18> Is there any food that makes a substitute for bread on sandwiches?

I've always wondered that. I think I could substantially reduce my carbs but I love sandwiches.

Any ideas?

<comment><USER18> Ok, I'm really curious why my post in the wrong thread has 6 upvotes?

</comment></comment><comment><USER19> Extrapolating future-history is extremely difficult. You get into this mode where you extend the current set of capabilities and limitations until you hit an edge, and to get past it you invoke magic.

But it is so enjoyable and useful to creatively extrapolate or generate history, if only to encourage us to sink our time and energy into pushing that edge.

</comment><comment><USER20> If you assume that a breakthrough is possible, and desire its occurrence, then you've got a subjective bias to find a way to logically predict it will happen within the bounds of your lifetime.

<comment><USER21> Actually, some of the singularity people regard the singularity both inevitably happening soon(ish), and their worst nightmare. Not desirable at all.

The superintelligent machines will take over the world and probably destroy humankind as a side effect. Consequently, they think that we urgently need philosophical musings over possible ways to ensure that the inevitably created superintelligent AI overlords would be build using principles that make them friendly to humankind. This is (according to them) the only hope to save humankind from extinction in near future.

<comment><USER20> I don't equate desire and positive outcome. Sometimes the waiting is worse than the thing itself. especially if you know it's coming.

</comment></comment></comment><comment><USER22> The quotes on their website are a hoot. First, there's a modal you have to manually dismiss: "Singularity University is acquiring the Singularity Summit from Singularity Institute."

Then, such gems like "The Singularity Summit is the premier conference on the Singularity. As we get closer to the Singularity, each year's conference is better than the last."

They seem kinda obsessed with "thought leaders" and not so much "thought doers."

<comment><USER7> "Their website" and "they". Who are you referring to?

Edit: I guess Singularity Institute <http://singularity.org/> since the banners and text seem to match up, maybe?

In any case, the news of the transfer of the summit is evidence against your last point. It means (I hope) that Singularity Institute is trying to free up their researchers to be able to concentrate on actual work, rather than organising a conference every year.

</comment></comment><comment><USER23> Here's a probably important proposition that Peter Thiel and Garry Kasparov have been putting forward, and I have yet to see engaged with and answered:

If we are truly accelerating technologically, why have the exponential gains in wages and PPP in the developed world largely stopped? They have hardly kept up with inflation.

Compare 1891 - 1931, 1931 - 1971, and 1971 - 2011.

People point to improvements in computer technology -- why have they not yielded significant improvements in the world of stuff? There has not been the expected productivity increase at all.

<comment><USER24> The way I think about this, you have to correct for 'technological deflation.' What I mean by this is, if you only think about monetary loss of purchase power, then you will probably conclude that an iPhone costs something like $500 ( 2000 dollars). However to actually buy an iPhone in 2000 you would need to spend several billions and delivery would take something like ten years. ( Most of this is developing processors and displays that can power an iPhone.) Another example would be flat screens, there were some in 2000 (about as expensive as a car). So you don't see this increase in wages, simply because you are comparing against a moving target.

<comment><USER23> If that were the case, and computing technology were part of the PPP goods bundle, wages would be seen as going UP.

The question is, if you subtract computers, why do you not see any improvement? Is this not evidence of a technological slowdown, at least in the world of stuff?

<comment><USER24> My impression is, that the world of stuff moves slower but is moving. ( But I do not have some nice data to back this up, but cars are more fuel efficent, airline tickets decrease in price etc.) And atop of this you get a lot of 'add a computer' inventions. For example (non mobile) phones which store addresses.

</comment></comment></comment></comment><comment><USER25> This whole thing (futurism, the (+-Not)singularity, what may one day come) is fascinating to me and clearly pretty much everyone.

Getting aside from the pseudo-religious arguments which are often raised in objection (and, personally I believe legitimately), I think we are left with 2 options:

1) the Singularity is a real thing which will happen at some point in the future

2) Consciousness is not able to be crafted by man and the logistics of downloadable consciousnesses and infinately extendable lifespans are forever beyond us, and life will continue pretty much as it has since pre-history, with better technology making a 'richer' life a possibility for a greater and greater proportion of humanity.

As much as I would hope for option 1) the question I feel needs to be asked is why have not other conscious beings (which logically must exist elsewhere in the universe regardless of the numbers you plug into the Drake equation) come to us in their flying robot suits?

The complex interplay of neurology and computing is only in it's infancy, and I wait with bated breath at the advances we are making in our understanding..

<comment><USER9> Concerning your question, you're probably familiar with these arguments, but here goes.

Assuming it's true, the main conclusion from Fermi's paradox (which is really an observation more than a Paradox) is that there is some kind of "cliff" that vastly reduces the number of civilisations that achieve the technology required to come visit us with their robot suits.

The interesting question is, where is this cliff: before where we are now, or after?

If it is before, then that's great for us. What it means is, for example, that perhaps the evolution of life, or multi-cellular life, or animal life, or intelligent life, etc - is so unlikely that even though there are trillions of trillions of attempts, those that succeed are so far apart that they will never meet (perhaps thanks to the expansion of the universe, or through the difficulty of travelling across interstellar distances, etc). That's the lucky scenario.

The unlucky scenario is that this cliff is after where we are now. Perhaps there are millions of intelligent species even in just the Milky Way, but perhaps intelligent life is doomed to self-destroy eventually (for example by reaching a Singularity, building a Dyson sphere, and then basically disappearing up its own arse; or perhaps by ending in some kind of nuclear war, or biological wipeout after someone's biology experiment goes horribly wrong, etc).

That latter scenario would mean that we're likely to kill ourselves before _we_ get to the stars.

I hope for the first scenario.

Edit: Of course, as pixl97 points out, perhaps Fermi's paradox is an incorrect observation, and the aliens are already here, they're just being really cautious about being observed.

<comment><USER21> _"perhaps the evolution of life, or multi-cellular life, or animal life, or intelligent life, etc - is so unlikely ..."_

Bacterial life appeared on Earth pretty much as soon as the planet had cooled down.

An argument could be that some extremely unlikely chemical coincidence was needed to create life, but I think the observation gives more support for the theory that if you have a planet with prebiotic soup, the biotic part is going to kick in pretty soon.

But then it took 4 billion years -- or 30% of the whole universe's lifetime -- for life to invent multicellularity (with some important steps, like the invention of nucleus and thus eukaryotic cells, still unicellular life, half- way in between).

I don't have a problem believing that bacterial life is abundant in the universe. But life on Earth, inventing multicellularity only in 4 billion years, and then sentience only in 0.6 billion more (multicellularity obviously being the harder part), is among the fast ones.

Wait another 4 billion years to give the slower ones a fair chance to discover multicellularity, too.

</comment></comment></comment><comment><USER26> I can't say that I ever bought into the singularity by 2045. Things always take longer than expected. When I was a kid, I always thought that technology in 2001 would be incredible. As it stands now, the US doesn't even have a manned space vehicle.

Anyway, the one good thing that could come out of the Singularity discussion is maybe we can have a concerted effort to make it happen. A lot more research money into big science, for example. Hypersonic flight, maglev trains, the Texas supercollider, space exploration, medical research, clean energy, etc. Imagine if the the first flight happen 100 years before the Wright Brothers, or the telephone had been invented even 50 years earlier. We might not have a Singularity by 2045, but we can actively accelerate our quest for knowledge.

<comment><USER27> The technology in (real world) 2001 _was_ incredible. But all the progress was in computers and communication, not travel.

Back in the 20th century, every looked at the incredible advances in travel technology from 1850-1950 and assumed the growth curve would just keep on going. But it didn't; it peaked out somewhere in the 1970s. Since then it's gotten cheaper, but not faster.

I think the Singularity is the exact same sort of projection. Progress in computer technology was incredibly fast from 1970 to 2000. My phone has a processor thousands of times faster than my first computer, back in 1982. And if progress continued at that rate, the Singularity probably would be inevitable. But it hasn't. My desktop computer today is not significantly more powerful than the machine I had in 2007. My laptop is much better than my laptop then, but it's only on par with my 2007 desktop. My phone is insanely better than my 2007 phone. The current trend is for computing power to get smaller and cheaper, rather than getting more computing power. That's great, but I don't see it getting us to the Singularity anytime soon.

<comment><USER28> > The current trend is for computing power to get smaller and cheaper, rather > than getting more computing power.

I think it's a mistake to compare specific devices from different eras, like a 2007 desktop and a 2012 desktop. In order to find total computing power, you need to add your phone, tablet, desktop, laptop, and cloud services together. When you do that, you see that we all have far more computing power than we did in the past, but we've chosen to spread that power over a variety of different devices.

</comment></comment></comment><comment><USER29> I agree that there is no convincing evidence the Singularity is so near, but I don't agree with his central argument concerning the necessity of software engineering breakthrough requiring accurate models of human cognition. The AI and ML learning successes we've had the last decade aren't based on developing some kind of imperative algorithm for evaluating a specific problem domain. We don't need one for cognition either; we just need a machine that can learn how to learn better. That is really all the singularity is; unbounded recursive self-improvement.

</comment><comment><USER30> Hmm, Kurzweil joins Google -> Allen says Singularity is bunk. Looks like there has been an ongoing exchange, but funny that both items make the front page of HN on the same day...

<comment><USER31> This is from 2011, so it had absolutely nothing to do with Kurtzweil joining Google.

</comment></comment><comment><USER32> I would suppose that by 2045 we might technologically be capable of "the singularity" but i'm not convinced we'd be socially accepting of a singularity. The old saying, the future is today its just not evenly distributed will still apply 30 years from now.

If you could quantify social progress, I would theorize that it would be a linear growth. Which means, our capability, and how it fits in our society are becoming decoupled from each other at an increasing amount every year.

</comment><comment><USER33> Thesis: The singularity must be prevented at all costs.

Evidence: The increasing uselessness of human beings to economic activity.

Evidence: The callousness to economic externalities with biological consequences of existing suprahuman organisms. i.e. Monsanto, Dupont, Keystone XL, the US Government

Conclusion: The singularity would most likely result in the complete extinction of biological human beings.

Nota Bene: Structured like a High School debate contrapositive because that's what the singularity always sounds like.

</comment><comment><USER34> It's only 32 years until 2045. 32 years ago was 1980.

Emacs was first released in 1976.

Lisa with its mouse and GUI was first developed in 1978.

The first handheld mobile phone was demonstrated in 1973.

The TCP/IP protocol was first standardized in 1982.

Thirty years on we're still relying on the same core technologies, though more mature.

What new technologies have appeared in recent years that will become more mature in 5, 10, 20, 30 years?

</comment><comment><USER35> Can anyone point me to information about this question: "What have we done to discover and understand the differences between human and animal brains, to see what accounts for the vast difference in intelligence?"

I'm sure I could find a lot by Googling, but asking this group seems to be a more efficient way to benefit from some curation.

<comment><USER36> I know there is a lot of on-going research in learning the 'operating system' of the brain across quite a few animal models. In rats, mice, and monkeys, a lab where I work looks at the neuron level while these animals learn behavioral tasks. Classic behavioral tasks are merging with basic neuroscience and advanced imaging, with the help of computing.

At the neuron level, we are still at very immature levels of understanding, but the path and direction being taken looks very promising.

</comment></comment><comment><USER37> I thought the singularity just meant that technological change was so rapid that it ceased to have meaning.

I feel like we might be there today. I'm not sure what could be engineered tomorrow that would surprise me meaningfully.

If someone says that they have a working fusion reactor, I'd just be like, "Geez, finally. What the hell took so long?"

</comment><comment><USER38> This is discussion about intelligence. But do we have clear definition of intelligence?

Without clear definition one can say that the Singularity already happened.

Chess masters definitely are considered intelligent. So why computer programs which beat them aren't called super intelligent? Because they use brute force algorithms?

<comment><USER7> Because the chess engines aren't sufficiently general purpose.

[http://lesswrong.com/lw/vb/efficient_crossdomain_optimizatio...](http://lesswrong.com/lw/vb/efficient_crossdomain_optimization/) tries to address questions like the ones you ask. (Obviously the definition proposed there of "efficient cross-domain optimisation" isn't _the_ definition of the word "intelligence", because no such thing can exist, but it is a definition that seems to match with our intuitions well.)

</comment></comment><comment><USER39> Note: The linked article was published in October 2011. It's not exactly news, but does make for stimulating reading!

</comment><comment><USER40> "The singularity isn't near". Only became obvious when Kurzweil signed with Google???

</comment><comment><USER41> I'm fairly skeptical of a near-term singularity, but he provided no evidence that technical growth _isn't_ exponential. Exponential doesn't mean "fast". He established that problems that were once impossible are still very difficult.

Economic growth _is_ faster than exponential. We see increasingly rapid growth at any point in time: pre-Cambrian vs. post-Cambrian evolutionary, pre- mammalian vs. mammalian, evolutionary vs. paleolithic, pre-agrarian vs. agrarian, agrarian vs. industrial.

I don't think we're going to see a "Singularity" in 2045. We might see 10-50% annual economic growth by then. That wouldn't surprise me. At this point, we're probably making serious in-roads on a wide variety of health problems, and life expectancy at birth will probably be over 85 and may be undefined. I think it's a good bet that someone born in 2045 will see 3000, not because of a Singularity, but because such a person won't even begin to experience old age until the 22nd century.

<comment><USER42> Student of Applied Mathematics - Economics here. I took a class with Oded Galor, the primary proponent of Unified growth theory [1], a single model that describes the transition from the Maltusian trap [2] to an era of rapid growth, and finally a transition to a sustained growth regime. According to this economic growth model, the United States has already reached the sustained growth regime - meaning that we can expect continued growth of, say, 1-2% for eternity.

Economic growth is NOT faster than exponential in a sustained growth steady- state. Do some googling for long-term economic forecasts, and you will find much research that supports low single-percent growth for the 21st century [3]

[1] <http://en.wikipedia.org/wiki/Unified_growth_theory>

[2] <http://en.wikipedia.org/wiki/Malthusian_trap>

[3] [http://www.economist.com/blogs/buttonwood/2012/11/economic-o...](http://www.economist.com/blogs/buttonwood/2012/11/economic- outlook)</comment></comment>


Show HN: Dockopotamus, a naive honeypot that uses docker - <AUTHOR> https://github.com/esell/dockopotamus <comment><USER2> Putting aside this repositories root privilege requirements and lack of documentation on locking down the honeypot, I cannot stress how bad an idea running a honeypot inside a container is.

Containers are an isolation mechanism, not a security mechanism. Honeypots should be run at minimum on a virtual machine, ideally hardware, in a separate network segment.

<comment><USER3> To be fair to it, it does describe itself as "A shitty attempt at a honeypot/sandbox that uses docker" and contains a fairly large & up front "WARNING WARNING WARNING" section :p

<comment><AUTHOR> :)

Think of it as more of a brainstorming exercise than a real-world, production ready app.

 _EDIT_ Also I would note that in the true sense of open source, PRs are always accepted.</comment></comment></comment>


Mr. Chilly – Weather App for San Francisco - <AUTHOR> https://apps.apple.com/us/app/mr-chilly/id933759132 <comment><USER2> Love this app. Most default weather apps don't work well for the Bay Area / SF because of the micro climates. Getting the weather for SFO doesn't mean much if you are living in Outer Richmond. Its also way snappier than most other weather maps that use Google Maps or Mapbox with a bunch of overlays.

Too bad its only for SF. It does look like its just a bespoke map wired to Wunderground stations. The creator could definitely make maps for other metro areas or places where small distances may have drastically different weather.</comment>