Ask HN: Starting a Science-Focused Startup - <AUTHOR> I certainly have my own thoughts on the topic (based on my experience). However, I would like to hear opinions, experiences, best practices and lessons learned from other people, especially those who have gone through starting and/or working at science-focused startups.
Brief background. I've been planning to start a science-focused startup for quite a long time. I think that I've reached the point when it is feasible for me (still need more time to crystallize and clearly formulate important aspects to myself). The eventual product would be delivered a SaaS platform with baked-in secret sauce as unique selling proposition and a core strategy focused on differentiation as a competitive advantage (I know the competition pretty well). Potential customers will include teams or organizations in academia (universities), industry (mostly commercial companies) and government (national labs). The platform's core users would be researchers and engineers in a specific, but very large and diverse, domain (the latter presents both challenges and opportunities).
Please share your thoughts on the following specific areas of interest:
- hiring / team formation;
- funding (I want to go - at least initially - the SBIR/STTR route [I have experience of working on proposals, including for NSF] or, if that fails, bootstrapping; I'm not a fan of rapid/hyper/blitz-scaling and, as a consequence, VC funding, unless it's absolutely necessary);
- co-founder relations, company culture (e.g., full transparency a la Buffer or not);
- advisor relations;
- IP (e.g., trade secrets vs. patents - I'm leaning toward preferring the former);
- technology stacks / cloud / platform architecture (e.g., multi-tenant vs. multi-instance, APIs - REST vs. GraphQL, Kubernetes);
- platform adoption (I want to growth organically, with a minimal sales team);
- strategy (business models, competition, marketing, pricing).
Your feedback will be much appreciated! <comment><USER2> Although not specifically focused on science-based startup, I cover some good stuff here (I know you've seen this already). Beyond this I would like to reach out and discuss this more directly with you. While working at Affectiva where I was the 7th employee I cowrote an SBIR we submitted to the NSF and were awarded the grant. It was the one and only SBIR I've ever wrote. It helped a lot that I had Professor/Dr. Rosalind Picard, PhD from MIT and Rana el Kaliouby, MIT Media Lab researcher and now CEO of Affectiva as coauthors! I'm a serial early stage startup guy typically taking either CTO or chief architect/head of engineering-type roles. I've also managed patent program for both small startups and for Symantec in the 1990s where I was a charter member of the patent committee. Of course they are just one method of intellectual property protection and seem to be falling out of favor in many startups. More comments through a more direct, and perhaps less public channel [https://www.quora.com/What-do-the-companies-that-retain- thei...](https://www.quora.com/What-do-the-companies-that-retain-their- employees-and-keep-them-happy-and-loyal-do-differently-than-other- corporations/answer/Rich- Sadowsky?__nsrc__=4&__snid3__=4039819175&comment_id=88116208&comment_type=2)

perhaps writing to me at my personal email firstname.lastname@example.com is a good way to set up a way to talk more

<comment><AUTHOR> Rich, thank you for taking time to comment. It is somewhat generic (others: feel free to offer more specific insights), however, it is totally understandable. I very much appreciate your interest. Will continue our conversation via e-mail.</comment></comment>


Consciousness is Not a Computation (2012) - <AUTHOR> http://www.novaspivack.com/uncategorized/consciousness-is-not-a-computation-2

<comment><USER2> > The simple act of following instructions – which is all a computer can do – > never results in actually knowing what those instructions mean, or what it > is doing.

The fundamental mistake so many people make is assuming that somehow "real" consciousness is special, and different from this -- that we're not just complex chemical systems blindly following instructions like a computer.

How do you know this? Because your brain has been wired to "feel" like it has agency?</comment>


AMD Ryzen Threadripper 3960X Review 24 Cores of Impressive - <AUTHOR> https://www.servethehome.com/amd-ryzen-threadripper-3960x-review-24-cores-of-impressive/ <comment><USER2> The Ryzen 9 3950X is about half the price and almost as fast (single core). For sheer performance, there's not much marginally faster for a reasonable increase in price. (3970X is 2.5% faster at 50% more expensive, the EPYC 7742 is several times more expensive but not significantly faster.)</comment>


Ask YC: Are all employees with no equity in the company wage slaves? - <AUTHOR>

<comment><USER2> i would gladly be the 2nd employee at facebook even if mark didn't want to give me equity

great experience + great connections > equity in a successful company > a wage > equity in an unsuccessful company

<comment><USER3> I think you're mixing up the timeline in your head a bit. When the opportunity is there to be the second employee you can't know if the company will be successful or not.</comment></comment>


World's most powerful weapon: Mobile launched nuclear missile, top speed Mach 21 - <AUTHOR> http://en.m.wikipedia.org/wiki/RS-24_Yars

<comment><USER2> Great, now the Russians have an anti-anti-missile-missile-missile.</comment>


Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful - <AUTHOR> https://insomniasec.com/blog/auth0-jwt-validation-bypass <comment><AUTHOR> Tired: {"alg":"none"}

Wired: {"alg":"nonE"}

The JOSE standards (including JWT) are a gift that keeps on giving to attackers.

I designed an alternative format in 2018 called PASETO, which doesn't contain the JOSE foot-guns. (I'm pushing for an IETF RFC this year.)

[https://paseto.io](https://paseto.io)

EDIT: Also, this affected their Authentication API rather than their JWT library.

If you use their JWT library, well, it certainly _allows_ this kind of horrendous misuse... but it is not, per se, vulnerable.

<comment><USER2> Why a new standard than to push for reform to the current standard?

Are they just closely protected by greybeards who won't listen to reason?

Question comes from a true place of ignorance/curiosity, I definitely understand the need to have unambiguous, easy to implement security tokens without the foot-guns.

<comment><USER3> > Why a new standard than to push for reform to the current standard?

Or even just an opinionated library with some basic guardrails to prevent bad configurations.

<comment><USER4> That's tempting, but as long as a standard has design flaws, there will be libraries out there that _don 't_ prevent bad configurations, and people (through innocent ignorance) will use them and end up in a bad place.

</comment></comment></comment></comment><comment><USER5> Hi all - Shiv from Auth0. I am the CPO and wanted to share some additional context here. On July 31st 2019, at 5:11 am, we received an email from Insomnia reporting a service vulnerability. By 11:00 pm the same day, we had fixed the issue in production. We analyzed the logs and validated that no one exploited the vulnerability. More details from our CSO here: [https://auth0.com/blog/insomnia-security- disclosure/?utm_sou...](https://auth0.com/blog/insomnia-security- disclosure/?utm_source=twitter&utm_medium=sc&utm_campaign=insomnia_disclosure). Thanks to Insomnia for reporting the vulnerability and their partnership in coordinated disclosure. We appreciate the continued feedback from the security community-at-large to ensure we are providing the most secure platform for our global customers.

<comment><USER6> Why did your implementation have a case-sensitive check for a fixed list of algorithms, and why are you blacklisting vs. whitelisting acceptable algorithms? 'Old, stable' codebase or not... this is production code for a security product and seems like something that would be picked up during an audit.

<comment><USER7> Not the OP but, the sad truth is that code audits aren't that good at eradicating bugs.

</comment></comment></comment><comment><USER8> I've encountered issues like this in various systems using JWT at this point. The real problem is that developers blacklist the algorithms they don't want. Instead, the verification code should explicitly whitelist which algorithms you support.

More specifically, you can't even rely on using the 'alg' parameter before successful signature verification with any level of authority: after all, it is protected by the signature it declares the algorithm for itself. So even with a whitelist, there is the potential of downgrade attacks.

In other words, don't even use a whitelist, use a single specific expected algorithm.

<comment><USER9> > Instead, the verification code should explicitly whitelist which algorithms > you support.

What libraries are you using? I just looked through the auth code for a project I'm working on (which uses `jsonwebtoken`) and it has an option to whitelist algorithms in the `jwt.verify` method.

Edit: removed repeated info

<comment><USER8> Various, been a while since I wrote code using them myself.

Often JWT tokens come from sources other than our own and they will have passed through user agent or client land. Don't trust anything in them unless you verified them.

edit: good on that library! That's what it should do. Clearly auth0's code did not do that though, it should never have accepted any variant of 'none' in the first place.

<comment><USER9> Just wanted to point out the supreme irony: Auth0 wrote that library.

<comment><USER8> Hah. They could still improve it by only accepting a single algorithm, rather than a list.

edit: though there could be some internal use cases where you want a list, but it's a tradeoff between flexibility and making it easy for people to shoot themselves in the foot.

<comment><USER10> If you don't set it it's set to a reasonable list of algorithms [0], which doesn't include "none"

[https://github.com/auth0/node- jsonwebtoken/blob/master/verif...](https://github.com/auth0/node- jsonwebtoken/blob/master/verify.js#L113)

</comment></comment></comment></comment></comment></comment><comment><USER11> It's fascinating how Auth0 actually had a blog post about finding and fixing a handful of JWT vulnerabilities years ago (one of them is more advanced to exploit than this). Just another example of why you always have to be vigilant and that properly implementing encryption/security is hard

[https://auth0.com/blog/critical-vulnerabilities-in-json- web-...](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token- libraries/)

</comment><comment><USER12> At some point, that alg parameter gets resolved to an algorithm - an object or enum constant or something. This bug implies that the filtering was done on the string value of the parameter, and not the resolved value. That seems like a schoolboy error.

<comment><USER13> It's much worse than that. There are like 5 options for the algorithm value, none, RS256, HS256, etc...

The vulnerabilities implies that they don't verify the value against the very limited list of possible values, which is incredibly stupid.

</comment></comment><comment><USER14> The gist of this Auth0 authentication API bypass is detailed as follows:

> The Authentication API prevented the use of alg: none with a case sensitive > filter. This means that simply capitalising any letter e.g. alg: nonE, > allowed tokens to be forged.

I really don't know what to think of why you need a case-sensitive filter for alg:'none'. The question is that why use and support 'alg:none' in the standard in the first place? As I previously commented, the option to have 'alg: none' should never be used as it is still the biggest footgun in the JOSE specification. Even giving the user a choice of ciphers to use is a recipe for disaster. Thus, JWT is still a cryptographically weak standard and its use is discouraged by many cryptographers.

PASETO [0] or Branca [1] are cryptographically stronger alternatives to use over JWT here.

[0] [https://paseto.io](https://paseto.io)

[1] [https://branca.io](https://branca.io)

<comment><USER9> > the option to have 'alg: none' should never be used

I doubt anyone uses this deliberately (edit: except maybe for internal server to server communications?). I agree that having it as an option is a footgun. I still think this is a non-issue on the client/backend, most libraries explicitly make you whitelist token signing algorithms and will throw errors if the token isn't signed with the right algorithm.

> Even giving the user a choice of ciphers to use is a recipe for disaster.

How so? I'm still learning this stuff, so I'm genuinely curious.

<comment><AUTHOR> > > Even giving the user a choice of ciphers to use is a recipe for disaster.

> How so? I'm still learning this stuff, so I'm genuinely curious.

[https://paragonie.com/blog/2019/10/against-agility-in- crypto...](https://paragonie.com/blog/2019/10/against-agility-in-cryptography- protocols) :)

<comment><USER13> I really hope you're planning some agility in PASETO otherwise it's de-facto s* protocol that will have to be thrown away within a few years upon the first cryptographic weakness, breaking all applications that dared to adopt it.

Fact is, ciphers and protocols evolve over time. In the real world of client- servers (often many clients and many servers), it's not possible to magically upgrade all systems at once to exclusively accept a single same cipher. There's got to be a way to phase-in ciphers gradually across systems and phase-off. Agility is simply a real world constraint to be able to operate software in the real world.

<comment><AUTHOR> > I really hope you're planning some agility in PASETO otherwise it's de-facto > s* protocol that will have to be thrown away within a few years upon the > first cryptographic weakness, breaking all applications that dared to adopt > it.

Instead of cipher agility, PASETO uses versioned protocols.

My DEFCON Crypto & Privacy Village talk (slides and YouTube video at [https://paseto.io](https://paseto.io) for the curious) covered this distinction in detail.

</comment></comment></comment></comment></comment><comment><USER13> Most JWT libraries require to hardcode the expected algorithm when verifying a token, so if your applications are verifying the token provided by Auth0 with a JWT library, they're most likely not vulnerable to this mistake.

</comment><comment><USER15> I think what's _more_ harmful is the fact that something is case-insensitive.

Case insensitive may have some benefits for human-facing stuff, but otherwise the byte-exact comparison you get with case-sensitive semantics is superior.

</comment><comment><USER16> There's actually _three_ lessons to be drawn from this incident:

1\. Don't use JWT, it's too easy to mess up.

2\. If you're trying to fence off some sort of format or API, _whitelist_ things, don't blacklist them.

3\. This narrative that "you should use a third-party authentication provider because they're security experts and are much less likely to get it wrong"... well... I think you can see where I'm going with this.

</comment><comment><USER17> What if someone used the correct case but weird Unicode characters? I mean, if "none" = "nonE", is "none" = "none"

<comment><USER18> The answer to that is we should not be using _any_ case-insensitive strings in protocols.

They are fine for human-visible names, but field names and internal enum values should use byte-by-byte comparison. It just makes entire class of vulnerabilities go away.

<comment><USER19> They _are_ case-sensitive.

> _The "alg" value is a case-sensitive ASCII string containing a StringOrURI > value. This Header Parameter MUST be present and MUST be understood and > processed by implementations._

<comment><USER20> _But the protocol says that they are case-insensitive!_ is not a good response to the assertion that _machine-to-machine protocols should not be case- insensitive_ , which is what theamk said.

</comment></comment></comment></comment><comment><USER21> I think this points out that the semantics of trusting the header (which is still a part of the message) at all is flawed and leads to implementations getting it wrong and leaving gaps for attackers to exploit.

</comment><comment><USER22> Blacklisting while you should have been whitelisting is harmful. Choose what you allow instead of trying to list what you don't.

</comment><comment><USER23> Without reading the article: any kind of blacklisting is considered harmful in security.

</comment><comment><USER24> Always normalize your input?

<comment><USER20> Try:

Don't encode your machine-to-machine protocol as human-readable strings, leading to things like declaring machine-readable identifiers to be case- insensitive when only the humans need this, not the machines.

<comment><USER24> eh, arbitrary protocols, sure.

But the web has always been human-readable and I don't want to change that. Therefore, you're gunna get serialized strings.</comment></comment></comment>


Lessons I've Learned as a Patient Building a Vision Most Said Was Crazy - <AUTHOR> http://crohnology.com/blog/12-believing-in-the-patient-revolution <comment><USER2> I admire what you are doing, I really do.

That said, just putting my business hat on.. you haven't really proved your vision isn't crazy. The question is: how do you intend to generate traction + revenue? Just having an unique model, and a centralized community isn't going to be enough. As they say: build it and they won't necessarily come. In my eyes, you will need to rely on SEO a lot. The good news is that your site/model is unique in a field filled with a lot of spam. So it shouldn't be too tough to get high quality links.

The other good thing is you don't need a gazillion users since people (drug companies) will pay a lot for a very focused set of users with a specific disease.

But 50 pages indexed in Google right now isn't going to cut it. Not suggesting you go pull off a Demand Media, but you're gonna need some content.

<comment><AUTHOR> Yup, working with limited resources initially to test the concept and get where we want to as a team, but you've got the right idea!

</comment></comment><comment><USER3> Great job.

Just curious, I have had similar ideas, but saw this NYT article about sites like CureTogether.com and PatientsLikeMe.com, & decided it was a _met need_.

[http://www.nytimes.com/2010/05/30/business/30stream.html?pag...](http://www.nytimes.com/2010/05/30/business/30stream.html?pagewanted=all)

I am passionate about using tech to improve healthcare & would love to talk over email/IM about your idea in detail

All the best & keep up the great work

<comment><AUTHOR> Tuxguy, thanks a bunch for the comment. Yeah CureTogether and PatientsLikeMe exist, but they didn't seem to fill the specific vision for a complete product I had -- which was THE location for people with a specific chronic condition to go. In order to do that, you kind of have to make a place more than a product. And my hypothesis is that making a _place_ for this purpose requires the perfect balance of social elements, health tracking, and knowledge sharing (q&a). I can dig into it more, but the basic essence that as hard as some of the other players have tried, they still have yet to capture any Facebook- esque stickiness to their services. I believe that there is room for health software that does have this property. That patients really identify with, and will come back and use.

</comment></comment><comment><USER4> "Patients experiment with alternative treatments like diets, supplements, or activities, and learn whether they work or not."

No, they learn whether they experience pareidolia or not, and that's how shit like homeopathy, cupping, rebalancing the humours, and, oh, every other non- scientific "modality" of "treatment" which doesn't work gets started.

"patient-to-patient healthcare is "crazy", "dangerous", or blasphemous"

"Blasphemous" - uh, WTF? "Crazy" - maybe, although I'd have gone with "foolishly optimistic disregarding the brain's ability to fool itself". "Dangerous" - definitely.

"Oftentimes I'm finding that hearing "no" means you're doing something right."

"They laughed at Columbus, they laughed at Fulton, they laughed at the Wright brothers. But they also laughed at Bozo the Clown." -- Carl Sagan.

Oftentimes when you hear "no", it actually means you're just fucking wrong. Not always, it's true. But mostly.

<comment><USER5> "they learn how every non-scientific "modality" of "treatment" which doesn't work gets started."

You do realize this process is the foundation of the scientific method, right? It's not like new drug ideas come from the science fairy.

And also you are wrong on your history. E.g. homeopathy was derived from a theory, not from patient experimentation.

<comment><USER6> Well, from a hypothesis. Not a theory, really, because it didn't really have a body of evidence supporting it.

Also worth pointing out, to anyone who might wonder if the ideas behind homeopathy might actually make sense -- that this was pre-germ-theory. I.e., he didn't know microorganisms existed, or that they might have something to do with illness.

<comment><USER4> OTOH, people have been debunking homoeopathy for over 160 years, also arguably pre-germ-theory:

[http://www.sciencebasedmedicine.org/index.php/lessons- from-h...](http://www.sciencebasedmedicine.org/index.php/lessons-from-history- of-medical-delusions/)

<comment><USER6> Good point, and neat link.

So let's go with "easily-invalidated hypothesis even at the time."

</comment></comment></comment></comment></comment><comment><USER7> This looks like PatientsLikeMe (<http://www.patientslikeme.com/>), but specialized in Crohn's disease. I wonder how this site differentiates itself, and what aspects of it are unique to Crohn's vs. what could be generalized for other health conditions.

<comment><AUTHOR> You know, that is the number one comparison people make. I should probably work on incorporating into these blog posts a little sentence or two to address the question more when it comes up. PatientsLikeMe has done a great job at building comprehensive tools for symptom and lab value tracking. Where they fall short however is providing a real palatable and compelling reason why people should do this.

And that compelling reason--it is our hypothesis--comes from community, and knowing that what you do on the site can very directly help others. And PLM is a quantitative system, not a community place. It is our belief that instead of feeling like a hospital's electronic health record system, successful software would feel more like a Facebook -- where it is the real relationships, your real ability to help others, that compel you to share your knowledge and what treatments have worked for you.

And yes, while Crohn's & Colitis are our first network, you are on the right track knowing that our heads are churning on ways to make software that helps people with one or more of many other chronic conditions.

I hope that is helpful!

</comment></comment><comment><USER8> Hey Sean, a certain mutual friend of ours led me to your site a few months back and I've been checking up on it every once in awhile because I think it's a pretty amazing idea (and I'm a little jealous.)

I wish you all the best of luck in your endeavor and keep up the good work!

</comment><comment><USER9> It's easy to guess why there has been a lot of skepticism towards this approach to doing the science, i.e. gathering data from a bunch of people in different situations doing different things... it's just so unlike the standard approach of doing double-blind studies with placebos and lots of participants.

That said, if you gather enough data... maybe some sound conclusions or inferences can be drawn. Such is the hope of all "big data" projects. I sincerely hope this project has some folks who know how to analyze all the data (i.e. rigorously).

Edit: "Big data" may be a buzzword right now, but it's not a new approach. Astronomers can't experiment with planets, stars or galaxies; they "just" make boatloads of observations --- and they've been able to draw many conclusions.

</comment><comment><USER10> Good luck. I was thinking of something very similar when I was reading this Forbes article on why medical drugs and college textbooks are expensive, called "Spending Other People's Money: What Professors And Doctors Have In Common" ([http://www.forbes.com/sites/davidwhelan/2012/01/27/spending-...](http://www.forbes.com/sites/davidwhelan/2012/01/27/spending- other-peoples-money-what-professors-and-doctors-have-in-common/)). I remember that article got me pondering all kinds of things, including the role of experts in the networked world and von Mises' economic calculation problem. Good to see someone working on this.

</comment><comment><USER11> Sean - love the new video and love the work that you're putting so much of your story into this. i have no doubt you will realize you're "crazy" dream.</comment>


Please review my Bugzilla iPhone app. - <AUTHOR> http://blog.getbugbox.com/?page_id=2 The app is named Bugbox, and it allows you to access your Bugzilla bugs from your iPhone, on-line & off-line. It supports almost the entire range of functionality that Bugzilla's web interface offers. You can find more details on the app store page.
HN readers who use Bugzilla for bug tracking can get free promo codes by sending an email to email@example.com, and mentioning HN.
I would greatly appreciate any positive or negative feedback. Thanks. <comment><USER2> It looks like you put a lot of work and thought and iterations into your app. An app that is a better way to use Bugzilla (which does not look to have good UX). Fast interface, offline mode! Unfortunately, the iTunes AppStore landing page can't tell the customer that (yet).

A $20 app isn't an impulse try purchase. Perhaps a free or cheaper Bugzilla lite that only allows reading, not updating. Or better, a 17+ mature rated Free app that is hardcoded to connect (IP+ user/pw) to a demo public Bugzilla db instance that is refreshed to a pristine state daily - this would allow more evaluators easily. I'm not totally sure Apple allows this. Or if not demo, a Bugzilla for only major open source projects (pay for access to your own).

The limited space and screenshots Apple gives you to promote your app does not seem to be enough to click the Buy button. (I don't use Bugzilla but if this were for Jira, I'd evaluate it). Videos could nicely showcase the sexiness and speed of the UI. And testimonials (from your rockstar users)!

I'd put more of a benefits page on your main website. The offline mode is tremendous - that deserves to be treated with spotlights and tasteful CSS.

How am I going to do my daily workflow? Perhaps you can go through mini use cases of how a mobile Bugzilla client will help. And try to give away licenses to more, less rockstar Bugzilla community members.

The satellite bugs in your screenshots are cute but you might consider something more serious, as a manager might check out the iTunes link themselves prior to ok'ing an expense for the app.

<comment><AUTHOR> Thanks a lot for some very thoughtful feedback. I will make an effort to incorporate all of this.

What do you think about a lite version that limits you in terms of the # of bugs downloaded to the app, but otherwise offers the full range of functionality?

<comment><USER2> If n is too high, you risk giving away your app. Check out <http://exitstrategynyc.com> for an example of a decent (IMHO) app landing page. You're welcome and realize that some of the feedback you get will annoy you - don't take it personally, especially if it's from a non rockstar (hints of elitism in your copy).

Now a tangent: Bugzilla seems to not be very corporate / because it is _free_. We had a Wiki at the department-level but only until someone powerful saw the value of that (knowledge sharing, freeing information usually buried in a thousand inboxes) and brought in Atlassian's Confluence did it take off, such that it is now literally enterprise-wide. Corporations don't want free software, especially if it looks free, like Bugzilla's PHP UI implies. Corporations want polish. They want license agreements. They want evaluation versions that can be locally hosted and maintained by IT (e.g. you'd sell a server + mobile client package). They want to pay you money to make their daily tasks a bit less tedious. They want to pay you lots of money to make them look good (for proposing your product). Yes, this might not be the direction you want to head in but corporations are looking for your product.

If you can make a version for Atlassian's $$$ Jira - that is a serious corporate market -you might want to just out of the blue contact Mr. Peldi of Balsamiq and ask how he developed his Confluence plug-in (e.g. did he initiate a relationship). Please consider Jira - if nothing else to see if they are open enough (web services or plug-ins) to make it feasible.

I would try a full version that is limited to a public demo database (with permission, ideally a clone in the past of a major project or at least one that enough bugs to demonstrate your performance - neutered, of course, in that assigning a bug does not send real notifaction emails).

Or, as doublec has suggested, a special version to demonstrate linking to the databases at bugzilla.mozilla.org.

Or, use the ad-hoc (UDID) feature to distribute time-limited, domain locked evaluation versions for corporate evaluation.

Either way, the cost is so high you need to let users try it hands on so they can see the value for their own Bugzilla instances.

</comment></comment></comment><comment><AUTHOR> I forgot to add this in the original posting.

Any HN readers who use Bugzilla can get free promo codes by sending an email to email@example.com, and mentioning HN. The promo codes only work in the US app store.

</comment><comment><USER3> Add screenshots to your web page.

</comment><comment><USER4> I would consider adding more description blurbs for this app. $19.99 is definitely too expensive. It is a niche app and I'm guessing it took you a couple months to build but that kind of pricing may not work on the app store for such an app.I'd drop the price to at most $9.99 or even $5.99. Marketing, marketing. Getting noticed after a few weeks in the app store is always a problem. I hope Apple can come up with better ways for developers to market their apps.

I've published 2 apps in the store and it's been a fun experiment : <http://dearcloud.com/mobile/>

Sales do spike up the first few weeks while your app is on the first or second page of its respective category. Good pricing will get you more downloads. Good luck

</comment><comment><USER5> I stumbled across this in the app store today searching for a bugzilla iphone app. It looked good but I didn't buy it for two reasons:

1) The cost. Too much for a 'just buy to try'. 2) I had no idea if it would work with the bugzilla systems I use (Mostly bugzilla.mozilla.org) and it cost too much for me to risk it not working.

<comment><AUTHOR> FYI: It's verified to work with Mozilla's Bugzilla installation.</comment></comment>


Show HN: Fawn – A Library for Multi-Document Transactions in MongoDB (Node.js) - <AUTHOR> https://github.com/e-oj/Fawn <comment><USER2> How does it work? Are locks involved in the process?

<comment><AUTHOR> There are no locks involved. It uses two phase commits to simulate transactions. You can read more about two phase commits in the MongoDB docs([https://docs.mongodb.com/manual/tutorial/perform-two- phase-c...](https://docs.mongodb.com/manual/tutorial/perform-two-phase- commits/))

</comment></comment><comment><USER3> I've been looking for this. Thanks</comment>


Ask HN: What are some popular hacker hangouts around the Bay Area? - <AUTHOR>

Hello HN,
I recently moved to the SF area and keep hearing about how awesome it is to go to work on your ideas among other hackers in coffee shops and shared workspaces.
I'm not familiar with any such places and would love to know where I can find them so I can see what it's all about. I hear Redrock in MV gets a good crowd, and there's a 24/7 Starbucks on California in SF that's also pretty popular.
Thanks! <comment><USER2> While I love the space... the people can be a little... odd:

<https://www.noisebridge.net/wiki/Noisebridge>

I have not been to the MV hacker dojo, but noisebridge is pretty damn cool and welcoming.</comment>


9 Best Practices for DevOps - <AUTHOR> http://www.datamation.com/applications/9-best-practices-for-devops-1.html <comment><USER2> just a note, I can only see the first 5. The second page link does not seem to be working

<comment><AUTHOR> Works for me (final last words). Here's the direct link: [http://www.datamation.com/applications/9-best-practices- for-...](http://www.datamation.com/applications/9-best-practices-for- devops-2.html)</comment></comment>


The damaging effects of unplanned work - <AUTHOR> https://hackernoon.com/the-damaging-effects-of-unplanned-work-e28623e06657 <comment><USER2> The worst aspect of unplanned work is that often it only serves to make the person requesting it look good in the eyes of the person they report to. Often serving no benefit to anyone else and almost always doing damage to the company's productive output.

If you're interviewing around it really pays to ask a lot of questions of a company's management structure and whether their EMs have substantive engineering backgrounds. It won't eliminate this kind of work entirely but it can make enough of a difference.

<comment><USER3> Just a single data point but when my org went from an engineering VP who worked his way up to a manager suit type the amount of "Do X to satisfy Y" went from almost nothing to a majority. About half of the senior engineers have left in 2 years since this management change. This is a major section of a multi-billion dollar company so it has been really interesting to see it happen first hand. They gave me a big stack of cash upfront to stay for a certain period then I'm following my colleagues that left.</comment></comment>


Z-Berry: Z-80 computer - <AUTHOR> https://sites.google.com/site/zberrysbc/home <comment><USER2> "Z-Berry is the smallest Z80 based computer ever built."

Not to be pedantic, but the Timex Sinclair 1000 of 1981 had a lower chip count than this computer.

Take a look at the board: [http://oldcomputers.net/pics/ZX81-mb.jpg](http://oldcomputers.net/pics/ZX81-mb.jpg)

And it even includes the RF modulator.

Of course, the Z-berry is a _far_ more powerful Z80 computer.

Ready to run again all your CP/M 80 programs?

PS: What would have RULED would be to include in the Z-Berry a socket for the SID* sound chip or at the very least two POKEY* chips.

* SID: Commodore 64 sound chip. POKEY: Atari 8-bit (800/400/800XL/etc) sound chip.

<comment><USER3> Maybe he meant the literal smallest?

<comment><USER4> If we extend the definition of "Z80 computer" to include those which aren't using the original Zilog Z80 DIP40 CPU, e.g. SoCs, then these may be the smallest:

[https://en.wikipedia.org/wiki/S1_MP3_player](https://en.wikipedia.org/wiki/S1_MP3_player)

[https://www.bunniestudios.com/blog/?p=138](https://www.bunniestudios.com/blog/?p=138)

[https://www.bunniestudios.com/blog/?p=139](https://www.bunniestudios.com/blog/?p=139)

</comment></comment></comment><comment><USER5> The obvious way to solve the 'will crash when switching banks because next instruction is from different bank' is to replicate the bank switching code to all banks.

<comment><USER6> Of course, in order to copy the bank switching code to the other banks you need to switch to them first. Which means that this copying can only be done by the ROM.

<comment><USER5> No, you'd do that with a little bit of PIC running in one of the other parts of RAM.

<comment><USER6> Only one bank can be active at a time, so the only RAM you can run the code from is the same bank that you're trying to load code into. Slight chicken- and-egg problem.

<comment><USER5> No, that's not how these systems work. The bank switched RAM is switched in banks of 16K, so you can keep 48K 'constant' while the other 16K is switched as a window in the 256K.

</comment></comment></comment></comment></comment><comment><USER7> I think of all the modernish Z80 computers FAP80[1] is my favorite. Of course it is also massively more complex project than this, but that complexity enables FAP80 to function as a proper standalone computer that you could actually use if you were so inclined.

[1] [https://news.ycombinator.com/item?id=13438610](https://news.ycombinator.com/item?id=13438610)

<comment><USER8> I really enjoyed reading the blog posts about the build of this. Gave me so much insight into the inner workings of those machines.

</comment></comment><comment><USER9> I like it. Compact, supports keyboard and SD card and display. I'd like to read up more on it but the pages are a bit sparse (and I can't view the youtube videos where I am, so I'll have to check those later).

</comment><comment><USER8> Off the specific topic, but on topic of retro machines, but I feel that the new BBC micro:bit project should actually have been a rebuild of the actual BBC micro, but with an HDMI display/USB/network.

<comment><USER10> That would have been awesome.

The econet system too, this time with email and web access but still the hackable LAN that was so much fun to navigate and spoof.

?&D22=100 to change my station number to the IT teachers station when he'd left for the day. Thus all logs were from his machine, seemingly.

He _hated_ me and my mate. To the point where he had spooled all system privileged activity to actually print out (not to a text file, he wasn't the smartest even to us 14 year olds) to paper.

It was his genius plan to narrow down which room we were logging into from!

The next day we see a locksmith changing the locks to his private computer room.

He never did catch us. Someone snitched in the end. We told a friend who boasted unbeknownst to us to others and the jig was up.

Banned from computers for the rest of school.

A really cool science teacher got us involved with the weather station (it recorded data from NOAA sats to the BBC micro!!) so got the ban amended to 'no computers with network access' so we could use the computer in his lab.

Of course we then learned how to splice cables and made a reeeeeally long econet cable and had a system of lookouts.

Good times.

Thanks Mr. Bush you were a good guy who nurtured our interest. AS for you Mr. Pollard, as an adult I get why you hated us but still, if you'd have asked us to help with the network or the lab or something we could have avoided our war.

Sorry guys, big barely relevant anecdote but hopefully someone else will smile at the fun days of the BBC Micro and remember the econet hacks.

</comment></comment><comment><USER11> That looks really cool. I built the cpuville kit a few years ago but its I/O decoding was borked, it didn't expose enough control signals through its extension mechanism, and its pin headers were at an odd spacing so you couldn't just plug a prototyping board onto it.

I designed a and built new I/O extender to fix all those problems but PCB design is not fun for me so I never made a PCB for it.

This one looks to have none of those problems.

</comment><comment><USER12> There's this too: [http://sowerbutts.com/socz80/](http://sowerbutts.com/socz80/) (100+Mhz)

</comment><comment><USER13> But does it run Linux?

If not then good luck writing code to page out to that 512k of RAM. I do wonder what the 1980 computer scene would have been like if 512k was there because that was the smallest amount available, instead of the normal 16k. It was only when the PC came along that this amount of memory was available. PC programs took a while to be as concisely optimised as home computer code had to be. So maybe the scarcity of RAM was a good thing.

<comment><USER14> Not sure if you're being sarcastic or not. But the Z80 is a 8 bit CPU. Linux was never ported to any 8 or 16 bit architectures - for rather obvious reasons.

<comment><USER15> Well, the ELKS[1][2] project has been working on a 16bit port on and off since the late 90s. At one point Alan Cox[3] was an active contributor.

[1] [http://elks.sourceforge.net/](http://elks.sourceforge.net/)

[2] [https://github.com/jbruchon/elks](https://github.com/jbruchon/elks)

[3] [https://en.wikipedia.org/wiki/Alan_Cox](https://en.wikipedia.org/wiki/Alan_Cox)

<comment><USER16> ELKS is an excellent example as well as uClinux[1], which has made its way to a few 16-bit platforms[2].

[1] [http://www.uclinux.org/](http://www.uclinux.org/)

[2] [http://elinux.org/images/6/68/Porting_uClinux_CELF2008_Griff...](http://elinux.org/images/6/68/Porting_uClinux_CELF2008_Griffin.pdf)

</comment></comment></comment></comment><comment><USER17> [http://www.sunrise-ev.com/z80.htm](http://www.sunrise-ev.com/z80.htm)

</comment><comment><USER18> Not the smallest, not even close.

[http://noplabs.com/cpm50/cpm50.html](http://noplabs.com/cpm50/cpm50.html)

</comment><comment><USER19> Why not simply run a Z80 emulator on a raspberry pi?

<comment><USER20> Why not simply make guacamole in a cement mixer?

</comment></comment><comment><USER21> This is really cool! I've recently been playing around with z80 emulators, but it must be neat to try it on an actual device.

</comment><comment><USER22> I would love for some one to make something like this but with 286/386 CPUs. Would be great for the retro PC crowd.

<comment><USER23> Something like this already exists: [https://www.linux.com/news/here- come-x86-hacker-boards](https://www.linux.com/news/here-come-x86-hacker- boards) . I _think_ these should be able to run DOS.

If you want to go full retro, x86 is relatively difficult due to the support circuitry needed. Full ISA, ram, ports, etc. PCs were fairly complex machines back in the day.

</comment></comment><comment><USER24> The real question is: If you could run CPM on this, what CPM software would you want to use?

<comment><USER2> Visicalc?

I recall using a PROLOG interpreter on a Kaypro II under CP/M. Worked neat.

Also i used an ALGOL-60 compiler. In fact, just a subset of ALGOL-60. So, in some ways, a limited subset of a subset of Pascal.

</comment></comment><comment><USER25> you should definitely take a look at Fuzix,

[https://github.com/EtchedPixels/FUZIX](https://github.com/EtchedPixels/FUZIX)</comment>


When debugging, attitude matters - <AUTHOR> https://jvns.ca/blog/debugging-attitude-matters/ <comment><USER2> I agree that debugging is about attitude. Above all debugging is about acknowledging your understanding and/or assumptions are wrong and revisiting then. I would also say debugging is the punishment for your mistakes,and oh boy it can be extremely punishing. I associate debugging with pain and resilience. From me debugging is taking some problem and testing assumptions and models until you zero in on the only possible place where the issue can be. This zeroing in can be of different orders. Impossible conditions being met does not mean they were met, just that somehow your program reached a state where they are considered met. PS: coming from an embedded and systems programing i was going to dismiss css debugging as a joke but then I realized I have been wasting huge amounts of time getting ridiculously simple things like centering a logo on my web site....again debugging teaches humbleness and punishes self centered bullshit.

<comment><USER3> > I would also say debugging is the punishment for your mistakes,and oh boy it > can be extremely punishing.

Well…not always. I actually like debugging, especially when the bug isn't mine and I'm not in too much of a rush. Diving into a completely new codebase, trying to make sense of the behavior and come up with ways to infer things through the lens the tooling gives you, and finally zeroing in on the problematic code and sending a patch can be quite satisfying. It's even better when you learn something new and have a good war story to tell about it. (The message was being forwarded through _what?!_ You can do that?!)

<comment><USER4> > especially when the bug isn't mine and I'm not in too much of a rush.

Worry-free debugging. That's the life. Also, it's always great to be the one handing out the dunce cap rather than the one wearing it.

<comment><USER3> There's no need to pull out a dunce cap every time you debug; many times the bug is complicated enough that you feel great finding it but can't fault the person who wrote the code.

</comment></comment></comment></comment><comment><USER5> When I teach coding, I teach the following. When debugging you must clear your mind of any desire to fix the problem. You are most effective if you work only to find and identify the problem.

<comment><USER6> 1\. Reliably and consistently reproduce the problem.

2\. Understand the problem.

3\. Test your hypothesis by changing something and getting (or not) your expected behavior.

4\. Fix the problem.

</comment></comment><comment><USER7> I agree with this article, and further, there's too much googling and random coding these days. The joke about Google was meant to be that developers refused to memorize data structures or something, not that we have no idea how to understand anything and should randomly use code from the internet.

I use my share of code from the internet, don't get me wrong, but I try to figure out how it works first, as intended. Otherwise I'm just some monkey bashing two functions together to make sparks.

<comment><USER8> Whenever I visit /r/programmerhumor I get kind of sad.

I feel like 10 years ago there was a sense of pride and camaraderie among programmers. Programmers strove to understand both their code and the underlying system.

Now that programming has "gone mainstream" there's a constant meme that programmers don't understand their own code and that it's a grand mystery why it works. Furthermore, programmers get 100% of their code from stack overflow or Google or Indian YouTubers. Or that programmers just randomly mash the keyboard until the errors go away.

I get that it's just CS students commiserating with each other, but I just hate how self-deprecating it is.

<comment><USER9> I realized recently that we're all working on top of abstractions created from the people below us.

You're working on assembly stuff? Cool, you're just using a tool that people created for you by designing the x86 instruction set.

You're working on a compiler? Cool, you're just using a tool that people created for you by designing machine code.

You're working on a system language? Cool, you're just using a tool that people created for you to translate some baby language into machine code.

You're working on a high-level language?

You're working with a web framework?

You're working with ...

...

In the end you realize that the people you're talking about are just the people in the layer above you, or sitting in the middle, and you're a noob to the people sitting below you.

<comment><USER7> It blows my mind how many layers there are between us and the actual chip physics (the gates and other transistors). There's like 20 hardware layers of abstraction and another 20 software layers, probably, maybe more!

<comment><USER10> One of my favorite classic articles is this post from 2003 by Eric Sink, "The .NET Abstraction Pile", which lists 46 separate abstractions that are involved from clicking the "Check In" button in a networked version control system:

[https://ericsink.com/Abstraction_Pile.html](https://ericsink.com/Abstraction_Pile.html)

</comment></comment></comment></comment></comment><comment><USER11> Some bugs are caused by a moment of inattention or carelessness. Those aren't the interesting ones. The more interesting bugs are the ones where the programmer _misunderstood_ something - how an API works, what a structure represents, etc. Those are the ones where attitude matters.

If the programmer is someone else, it's necessary to "get in their head" a bit, to understand what they were trying to achieve and how, so that you can fix the bug without breaking the code in a different way. If the programmer is you, it's necessary to accept that you were _wrong_ about something. The job is to figure out what, and learn the right piece of information to replace the wrong one that was in your head.

This is where attitude comes in. What these two cases have in common is _humility_. If you come in to the first case assuming that you know better than the original programmer what needs to be done, you fail. If you come in to the second case assuming that your original code was perfect and the bug must be somewhere else, you also fail. To debug well, you have to come in with the attitude that your knowledge is incomplete and you need to _learn_ something to make progress. This is why junior programmers often become worse at debugging as they become more senior. It takes _effort_ to stay in that mindset even when you do know more than others about the domain in general.

</comment><comment><USER12> So much to relate to in this article. If I'm cycling through stackoverflow for answers, it's because I've convinced myself I'm in over my head. Depending on the day this is either laziness or imposter syndrome. There's always a better resource out there, and better to find out what that is now because very rarely am I just one answer away from completing anything.

</comment><comment><USER13> I think one key here is "documentation that you can trust makes a big difference". I would add to that documentation you can navigate.

It took me a long time in perl to learn how to read the docs. Specifically, what is this squiggly thing. How do I Google for that? Then I was pointed to [https://perldoc.perl.org/perlop.html](https://perldoc.perl.org/perlop.html).

I'm also sometimes guilty of Googling for the answer because I don't want to have to learn how to use tool X. I just want to move on to the interesting work. That's a bad idea. It's always worth understanding what you're doing.

</comment><comment><USER14> _So I changed the z-index of Div A to be 5 or something. But it didn't work! In Firefox, div A was on top, but in Chrome, Div B was on top. Argh! Why?_

... why indeed? I can't think of any (presumably fairly simple) scenario where that would happen.

<comment><USER15> I got a bit nerdsniped by this so here's a simple reproduction of the original issue (which I still don't fully understand tbh) [https://codepen.io/jvns-css- fun/pen/zYGVLXj](https://codepen.io/jvns-css-fun/pen/zYGVLXj)

<comment><USER16> So this is a bit of a spec oddity. It seems like the transform is forcing a stacking context here, but for some reason in Chrome the z-index of this stacking context is not getting assigned -- the z-index is left at 0. You can see this by running this in DevTools console:

>>> getComputedStyle(document.getElementById('prev')).zIndex

"0"

I think this is a bug in Chrome, where it's short-circuiting the new stacking context when a transform is specified, and not propagating the z-index to the new stacking context. The CSS spec says ( [https://www.w3.org/TR/css- transforms-1/](https://www.w3.org/TR/css-transforms-1/) ):

> If an element with a transform is positioned, the z-index property applies > as described in [CSS2], except that auto is treated as 0 since a new > stacking context is always created.

This element is positioned, so z-index should be affecting it.

You can fix it by moving the transform to the child here, but it requires a bit of finagling. Nice catch!

<comment><USER17> Perfect example of how Chrome is the new IE. When something behaves differently in FF and Chrome, I presume Chrome is wrong until I can prove it otherwise.</comment></comment></comment></comment>


Goldman-Sachs Posts $1.8 Billion 1Q Profit, Looks to Sell Stock, Repay TARP - <AUTHOR> http://money.cnn.com/2009/04/13/news/goldman.earnings.report.fortune/index.htm

<comment><USER2> Accounting regulations were changed last week [1] so that banks do not have to "mark to market" in "inactive markets" anymore. Since Goldman Sachs is now a bank holding company, they don't have to do this either. What is now a ~2B profit would probably have been a far greater loss by the old rules.

[1] [http://www.reuters.com/article/governmentFilingsNews/idUSN09...](http://www.reuters.com/article/governmentFilingsNews/idUSN0931201320090409)

<comment><USER3> Interestingly, they're sitting on over $100B cash and cash equiv.

[http://finance.yahoo.com/q/bs?s=GS&annual](http://finance.yahoo.com/q/bs?s=GS&annual)

<comment><USER2> With accounts payable of $257B, so the cash doesn't really mean that much and a net ~64B assets-liabilities and all those numbers are from Nov '08

<comment><USER3> Fair points.

</comment></comment></comment></comment><comment><USER4> As you watch democracy die to thunderous applause, remember to subtract the $10 billion of government funding and the $13 billion looted from the taxpayers through AIG face-value swap repayments.

<comment><USER5> At least the first sum you mentioned does not add to profit.

<comment><USER4> You are correct, sorry. That's tier capital, right?

<comment><USER5> I never had bank risk-adjusted capital regulations memorized, and it is much too complicated for me to care to relearn now.

However, the addition of a new liquidity source on the balance sheet in general has no direct effect on the income statement. Borrowing money is not income. Indirectly, it will have an effect through the interest expense owed to the owner of the liability and the interest income earned from the additional cash. However, the net interest income or expense is likely to be much less than the $10 billion face value of the liability.

A caveat: I didn't read through their financial statements, and I refuse to do so unless someone will pay me.

<comment><USER6> > Borrowing money is not income.

No, but paying for their losses does mean that whatever income they do have isn't offset by said losses, and that produces profit.

Goldman's counter-party risk was subsidized by taxpayers via AIG. If doing so really was a good idea, it should have been done directly and in public.

<comment><USER5> Yes, if AIG were to go bankrupt, Goldman and others would have had to take a one-time charge to net income to account for the reduction in the value of the assets owed to them by AIG based on what they expected to be able to recover through bankruptcy court. In this, Goldman is not special, though.

<comment><USER6> > In this, Goldman is not special, though.

We don't know how the AIG flow-through worked.

There have been rumors that some firms (Goldman Sachs is usually named) are getting 100% while other folks are taking a haircut.

<comment><USER7> I really don't understand this continued suspicion of the AIG/Goldman flowthrough.

What they did was a textbook case of how to protect yourself against a counterparty going bankrupt. It will be used as a case study one day of how to exercise prudence.

Direct from the conference call that explained their exposure:

"When AIG was rescued, Goldman Sachs had $10 billion of exposure to the insurance company that was offset with $7.5 billion of collateral as well as credit-default swaps that would have paid off in the event of an AIG bankruptcy, Viniar said on the March 20 call."

So Goldman had $10 billion of insurance with AIG. As the insurance started going in their favor, as is common banking practice, they demanded collateral be pledged (treasury securities) that they could seize in the event of bankrupty. This was 7.5 billion worth of collateral in extremely safe treasury bonds. So in the event of default, Goldman would have kept the securities in lieu of getting the cash settlement. Because they did not default, AIG had the securities returned to them and they paid out cash instead (this is the 10 billion number that "went from tax payers to goldman" that everyone keeps saying). The remainder 2.5 billion was the disagreement between the parties as to where the insurance should actually be marked. So to be prudent, they bought CDS protection that would pay 2.5 billion in the event of default.

What is the problem here?

<comment><USER6> > This was 7.5 billion worth of collateral in extremely safe treasury bonds.

> this is the 10 billion number that "went from tax payers to goldman" that > everyone keeps saying

Goldman Sachs was owed $10B. 7.5B was available in pledged securities. Goldman got $10B in cash because of govt flow-through via AIG.

> So to be prudent, they bought CDS protection that would pay 2.5 billion in > the event of default.

Shouldn't the insurer be paying off, if solvent, and not the US govt? And, if the insurer is not solvent, why shouldn't Goldman take the hit?

> What is the problem here?

The claim is that Goldman is not taking a hit from their transactions with AIG while other parties are. The above documents that Goldman is, in fact, not taking a hit from their transactions with AIG.

The only remaining question is whether other parties are taking a hit for their transactions with AIG. If they are, the question is Goldman Sachs is being treated differently.

<comment><USER7> > Goldman Sachs was owed $10B. 7.5B was available in pledged securities. > Goldman got $10B in cash because of govt flow-through via AIG.

If someone has pledged the majority of what is owed to me in collateral, it is wrong for people to imply that the 10 billion flowing through the government was just some windfall flowthrough. They got what they were owed, and the taxpayers got their 7.5 billion in collateral back. If the taxpayers did not pay the 10 billion, then they wouldn't have gotten 7.5 billion worth in treasuries returned to them--Goldman would have had the right to keep it, and this is the whole point of having collateral pledged to them in the first place.

> Shouldn't the insurer be paying off, if solvent, and not the US govt? And, > if the insurer is not solvent, why shouldn't Goldman take the hit?

Are you talking about the CDS insurer? The insurance only needs to be paid if AIG defaults. If AIG defaults then the US govt doesn't have to pay anything, the insurer does. Since AIG was bailed out, no credit event was triggered and the CDS insurance becomes worthless. The upside is of course they actually get their money. In either case, whether AIG was allowed to fail or not, they would have been made whole.

Goldman was not treated differently in this case. Many other banks were treated the exact same way. Yes, Goldman was paid out in their insurance. So is any individual who took out insurance with AIG--they will actually get paid what is owed to them as well now.

<comment><USER6> > If someone has pledged the majority of what is owed to me in collateral, it > is wrong for people to imply that the 10 billion flowing through the > government was just some windfall flowthrough.

I didn't say that it was a windfall. I said that Goldman was made whole by the US govt via AIG. If other folks are losing money in similar circumstances, it's fair to ask why Goldman is being treated differently.

And, even if everyone is being made whole, the question remains - why should the US make them whole? Why shouldn't they lose money for taking bad counter- party risks? They were planning to keep the money that they made for assuming said risks, so why shouldn't they take the hit when things work out badly?

If I buy something that turns out to be worth less than I expected, I take the loss. Why not Goldman and other banks?

> They got what they were owed, and the taxpayers got their 7.5 billion in > collateral back. If the taxpayers did not pay the 10 billion

I'll pay $7.5B for $10B.

> In either case, whether AIG was allowed to fail or not, they would have been > made whole.

Maybe, maybe not, but in any event, not by the US govt.

<comment><USER7> > Why shouldn't they lose money for taking bad counter-party risks?

I don't really know how else to explain this. They shouldn't lose money for taking counter party risk...because they were willing to pay the price to insure themselves on the counter party risk. Why do you keep insisting that they need to lose money? They had 7.5 in collateral, and they insured themselves for the other 2.5 in the event they defaulted. This is the definition of protecting yourself from bad counter-party risks.

> They were planning to keep the money that they made for assuming said risks, > so why shouldn't they take the hit when things work out badly?

...because they insured themselves. Imagine someone who bought a share of Google stock and then also bought a put option on it to protect themselves. Then the stock goes down. It's like asking why that person shouldn't take the hit because they were going to keep the money if Google had gone up. Goldman doesn't take the hit because 1) they were prudently collateralized and 2) they PAID for CDS protection on the rest that was owed to them that was not collateralized. CDS is not free, of course.

If they were willing to pay the insurance and demand collateral, why should they have to take a hit at all?

> I'll pay $7.5B for $10B.

So would I, but this is obviously a mischaracterization. It's like a homeowner who defaults on their mortgage and gives a house worth 250k to the bank who lent them 500k to buy it. They are not "paying 250 for 500".

> Maybe, maybe not, but in any event, not by the US govt.

This is not really a maybe, maybe not situation. Clearly with the collateral and insurance arranagements, Goldman would not have lost money as a counterparty to AIG. If you have an explanation otherwise I would be interested to hear it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm surprised GS wants to pay back the TARP $10billion so quickly. They are paying $500Million/yr to keep that $10Billion.

GS also "borrowed" $5Billion from Berkshire Hathaway, giving BH preferred shares for its $5Billion. The preferred shares pay 10%. So GS is paying $500Million/yr to keep that $5Billion from BH.

The BH preferred does have a 10% premium that GS must pay to retire it. But this means GS has the choice: 1) Retire $500Million/year of interest payments by giving $10Billion cash to TARP 2) Retire $500Million/year of interest payments by giving $5.5Billion cash to Berkshire Hathaway.

It makes you wonder just what is so bad about holding TARP money that it is worth $4.5Billion to buy your way out from under.

<comment><USER8> I have discovered the reason. TARP requires that until it is paid back, all sorts of other optional uses of cash are ruled out, such as pre-paying off other debt.

R:

</comment></comment><comment><USER9> this is fantastic news, though i guess it makes sense. goldman attracts the most talented folks just by winking at them.

<comment><USER2> Goldman's secret to "success" in this instance is the freshly changed accounting rules (see my comment elsewhere) and in the recent past has been the patronage of ex-Goldman Sachs CEO and now treasury secretary Paulson.

<comment><USER10> Actually, Paulson is no longer the Treasury Secretary. Timothy Geitner holds that post.

</comment></comment></comment><comment><USER11> Goldman Sachs is one of not many who had been behaving prudently. Next news would probably be "Chase is doing good.." or some other obvious thing brought as revelation.</comment>


Ask HN: What side hustles are you doing to extend your runway? - <AUTHOR> <comment><USER2> If you own a runway you probably don't need a side hustle to make money.</comment>


TensorFlow: Mutating variables and control flow - <AUTHOR> https://blog.metaflow.fr/tensorflow-mutating-variables-and-control-flow-2181dd238e62#.ckv2po6rx <comment><AUTHOR> TL,DR:

\- I explore the different ways to manually mutate Variables in TF (content and shape)

\- I explore how to construct control flow like an "if statement"

\- I end up and showing a weird TF behaviour when you mix those

\- Bonus: a first try at animated GIF :D</comment>


Meet The Double (YC S12), A Teleconferencing Robot With An iPad For A Face - <AUTHOR> http://techcrunch.com/2012/08/13/meet-the-double-a-teleconferencing-robot-with-an-ipad-for-a-face/

<comment><USER2> That's a pretty impressive price point and I'd love to know more about the in house manufacturing.

The one company that has really succeeded in this area is Giraff. They've done so by intensely focusing on in-home care and the user experience for the person interacting with the robot. Things like end user controls to approve/reject someone who wants to start driving the robot.

Anybots, on the other hand, focused more on the driving experience. Their rendered, in-browser, drive window helps overcome the awful user experience of trying to turn under lag. They also did a lot of hard work to solve wifi roaming and seamless handoff.

I wish Double the best of luck with my advice being that you need months of uptime and recorded daily use in a target vertical before you're ready to release.

<comment><USER3> Thanks! We're out in Mountain View now, but we built out our own shop a year ago in Miami, FL. About 90% of the manufacturing on Double is still done there today by our contract workers. We have a Haas VF-2SS mill and have made custom fixtures for most of the parts on the robot. We purchased a Stratasys FDM printer and brought it with us out to CA with us to do rapid prototyping during YC. All of the prototype electronics were hand-soldered under a microscope and tested in house, but we will soon be handing that off to a PCB Assembly house now that the boards are finalized.

As far as driving goes, we have 3 or 4 different methods we want to experiment with once things settle down, but so far the joystick-style is most intuitive. OpenTok's new iOS to iOS video has cut down on the lag a bunch.

Thanks for the comments!

-marc @ double

<comment><USER2> Very cool, I hope you have a Dimension series, those are sweet.

</comment></comment></comment><comment><USER4> We used a pair of VGo telepresence robots at our NYC and Philadelphia offices last year. Here's some video from the demo, just before we got them: <http://www.youtube.com/watch?v=L3tLLzOqKs4>

I found the VGo to be a huge help when it came to being present in an office that I couldn't physically go to at the time. I was the head of a department that had groups in different cities, and it was a lot easier for me to feel I had a cohesive team when I was able to actually "be" there instead of just on Skype. It's hard to overstate the value of being able to go join a quick work session at the couches, or go looking for someone in an office where people are always busy and wandering around.

Of course, in a large company where not everyone is an early adopter, to put it politely, there's also an annoying side to having a telepresence robot. Some people spend more time focusing on the novelty than getting to work, and it can be a distraction. A lot of people weren't comfortable using the VGo themselves, even though it was available for anyone. There are definite social hurdles to overcome with some people.

I'd probably like the Double even more than the VGo, because it looks less intrusive, has a larger screen thanks to the iPad, and the adjustable height is a very big deal. I'm looking forward to having one in the future. Love the price, too.

<comment><USER5> Interesting perspective as the remote user, but I wonder how your employees felt about that setup. It was easier for _you_ to feel you had a cohesive team, but did _they_ feel more cohesive for having a robotic you floating around?

</comment></comment><comment><USER6> So their biggest competitor is Anybots, but they're funded (through YC) by Anybot's founder and going through YC in the same physical space as Anybots?

It strikes me that the main axis of competition is simply price. Otherwise it just seems like co-opetition.

<comment><USER7> I'm no longer running Anybots, which has moved to new premises. I like both products for different applications.

<comment><USER8> Do you have another startup in the works, or are you concentrating on YC full- time?

</comment></comment></comment><comment><USER9> For the reason that this is real technology and not just another consumer/social/we'll figure out the business model later idea, I hope this grows and becomes huge, or at the very least spawns some other applications.

In a week that NASA lands a robot on Mars, I'm glad to see real technology being created, that perhaps looks crazy or inapplicable at first. Great stuff guys.

</comment><comment><AUTHOR> Direct link to our site: <http://www.doublerobotics.com>

<comment><USER10> The site says it charges with a wall adapter. This may be a silly question, but can someone driving the Double manoeuvre it into "charging position", or do you need fingers to plug it in?

</comment></comment><comment><USER11> The hardest part for telepresence robots is finding a market/use case to grow in. Being cheaper is a great first step, but who are you selling to?

<comment><USER12> I work remotely for CloudFlare. I wish we had one of these so that I could attend meetings at the company or hang out at someone's desk.

<comment><USER11> Right, but how will this be better than screensharing and teleconferencing? I'm not trashing the technology - it is an extremely well done version of a telepresence robot, combined with a spectacular price point. I'm worried that they're not competing with who they think they are competing with.

<comment><USER12> It means I can go into a meeting and 'sit' at a table with people and turn and see what's being written on the whiteboard.

It's much better for me (because I can attend) and it's better than screensharing and teleconferencing because the participants in SF do not have to use some program to accommodate me.

<comment><USER13> > and it's better than screensharing and teleconferencing because the > participants in SF do not have to use some program to accommodate me.

This is huge. There's nothing worse than holding up an entire meeting while someone struggles to connect to you via video chat while IT is in there sweating bullets because a new driver/update is trying to install itself.

Removing this burden from others would be worth it to me.

<comment><USER11> This isn't an argument for a telepresence robot - it is an argument for a Cisco teleoffice installation. Having a robot adds a whole new layer of complexity and issues.

<comment><USER14> Then after the official meeting, when attendees go out to the food table in another room and the tele-attending people can't digitally follow them, I'm sure the attendees will all just not discuss anything important, right?

Or "hey, Bob, I'm glad you could use the teleoffice installation to join us today. Gosh, I wish I could have you with me tomorrow when I go across town to check out a small factory. You know so much more about that stuff than me, but unfortunately the tele-office is huge and all."

<comment><USER11> First, I think you're overestimating how easily people will adapt to having these robots around. I hope there's no stairs or elevators in between the official meeting and the food table.

Second, does this small factory have high speed wifi? In my experience, that's very rare.

You know what does work in these situations? Flying out to the meeting.

As a technologist and possible early adopter, it is really easy to see how YOU'D use something. It is far harder to put yourself in the shoes of another and judge it from their perspective.

That said, once telepresence robots are in place, they seem to be very sticky - most people don't want to give them up. [1]

A key quote from [1]: "the greatest barrier keeping telerobotics from conquering the office probably isn't hardware or software, it's red tape"

[1]: [http://singularityhub.com/2010/08/23/exclusive-head-of- robod...](http://singularityhub.com/2010/08/23/exclusive-head-of-robodynamics- reveals-the-hard-truth-about-telepresence-robots/)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> According to the article, they want to do it "the lean startup way".

So... why does it have to be self-balancing? Just add a third wheel and it's always stable - no need for gyros and complicated electronics. And as a by- product, you have immediately lowered the price massively: it's just a few motors then instead of that balancing magic. My price lowering guess would be between 50% and 80% lower. That would be really "the lean startup way" in my book.

(Idea courtesy of [http://maddox.xmission.com/c.cgi?u=segway_more_complicated_t...](http://maddox.xmission.com/c.cgi?u=segway_more_complicated_than_it_needs_to_be%20))

<comment><AUTHOR> Thanks for your thoughts, but the third wheel theory isn't actually true. We investigated this, of course, and a third wheel without balancing provides a pretty crummy and bumpy user experience. The key is reaching the magic human height while keeping the base no larger than a human's foot prints. Look at the VGo, they opted to limit their height to about 3' and add a third wheel, but the driver is always looking up at people's stomachs and up people's noses. It's awkward in a standing conversation and, even at that height, it's a bit shaky riding around - not to mention the extra counterweight they need to put in the base to weigh it down. Two wheeled, self balancing is simply a more elegant solution all around.

Also the extra cost of the accelerometer and gyro is almost negligible these days, thanks to smartphones requiring them to be made in such high volume. For both together, it's maybe $20 or less in volume.

<comment><USER15> Interesting, that clears up my reservations, thanks!

I feel like the biggest issues might be missing ambient spatial awareness for the user - with that non-wideangle lens and mono microphone you can't see the whole environment at once, you have no idea where somebody is talking from, and you cannot turn quickly enough to always track what's happening in a room, if people are leaving/entering etc.. How do you plan to make the user feel more "there"?

Also, micro-managing the movement of the bot would take up a lot of time that I don't have to spend when I'm present locally. E.g. when I'm present myself, I just look somewhere, then think "I want to go there" and it all happens automatically. With the bot, I have to manually navigate around plants and desks. It would be great if we could do the same thing with the bot: just touch on the screen where you want to go, and the bot figures out the rest. Or show a floor plan, touch where I want to go and the bot does it. Do you have plans in this direction?

<comment><AUTHOR> Ah, I'm glad you see the potential of where this technology can go! Those are all great ideas. "We have nothing to announce at this time."

<comment><USER15> Yep. Bring it down to $500 and I'll buy one!

</comment></comment></comment></comment></comment><comment><USER16> I'd find this difficult to tolerate at work. I can't imagine anybody addressing me with one of these. Not only that I am certain no work place I have worked at would ever buy something like this. And they're all happy to spend thousands of dollars on things which would improve our productivity.

I was ready to dismiss the idea until I saw the end of the video. I think outside of business/work it could be quite useful (as demonstrated by the art gallery).

<comment><USER17> The art gallery idea struck me as interesting at first.

On second thought, however, why would you want to look at art through a low quality iPad camera when you could browse a website with high-res images of the same stuff?

I'm not sure that usage would pass the gimmick test after the novelty wore off.

<comment><USER18> Another complication is navigating through the museum without violating the personal space of the visitors. I guess they could only be allowed in the after hours but then how do you prevent the experience from deteriorating into high-tech bunch bumper cars.

</comment></comment></comment><comment><USER19> That's really neat, I think this has a number of uses and not just at work.

How does it stand up though? Is there an acceleramoter or similar powering a balancing act?

<comment><USER20> Yeah, probably a few gyroscopes/accelerometers.

I would guess that it is a beefed up version of something like this: [http://blog.makezine.com/2012/03/28/an-inexpensive-self- bala...](http://blog.makezine.com/2012/03/28/an-inexpensive-self-balancing- robot/)

I like their tiny kickstand as a solution for keeping the thing upright without draining the battery. I wonder if that deploys only when the bot is in sleep mode, or if it can come out when someone is using it but "standing" in a single spot for a prolonged period of time.

<comment><AUTHOR> Yes, that's right! Our very first prototype was using a 5 degree of freedom IMU board from SparkFun.

Yes, the kickstands can be deployed manually during a call or automatically, if the robot is sitting in one place for a long time. When the user attempts to drive again, the kickstands instantly lift off the ground and the robot can drive again.

</comment></comment></comment><comment><USER21> I had a related idea recently: Just hire a tall actress to carry around an iPad running Facetime. (Perhaps with a custom shoulder-strap?) It's going to be a bit longer before robots get up to the level of humans in terms of versatility, social awareness, and attractiveness. Until then, using a human would have certain advantages for a high-end solution.

</comment><comment><USER20> I'm excited to see some hardware concepts coming out of YC in the past couple of years. I think that the lean startup model is starting to be much more viable (vs 5 years ago) in the hardware space thanks to low cost prototyping electronics, 3D printing, and small batch size manufacturing.

<comment><USER22> There are a bunch of hardware startups in this batch. I'm not sure why. Could be just random variation. But for whatever reason it's kind of the hardware batch.

<comment><USER20> That's great! Looking forward to hearing more about the others after demo day rolls around.

</comment></comment></comment><comment><USER23> Impressive design, both mechanical and graphic. Does anyone know who produced the video?

<comment><USER3> Thanks! It was a collaboration between missioncm.com and cc-prod.com.

</comment></comment><comment><USER24> I built something like this 2 years ago at iOSDevCamp out of legos. <http://zbowling.github.com/NXTRover/>

I love that of this was taped at TokBox :-)

<comment><AUTHOR> Nice, I love it. We started out super simple and just kept improving it and making it taller.

</comment></comment><comment><USER25> For those who are interested, Suitable Technologies (from Willow Garage) will be making an announcement next month:

<http://suitabletech.com>

</comment><comment><USER26> Check out the prototype, made public at WWDC over a year ago: <http://www.youtube.com/watch?v=2BXM9PYaXY0>

<comment><AUTHOR> Haha, yes, we've come a long way since then!

</comment></comment><comment><USER27> Here's another competitor... looks like the home telepresense market might be ripe and ready! <http://9thsense.com/>

<comment><USER28> Another competitor designed for industrial settings: <http://collaborate.io>

Disclaimer: I'm the founder

<comment><AUTHOR> That looks pretty cool. It looks like you nailed the precise zoom feature, which is key for your use-case.

</comment></comment></comment><comment><USER29> _> > It uses OpenTalk to essentially let you video chat with those people._

What is "OpenTalk"? I've never heard of that protocol/API/software before. And Googling turns up nothing except some abandonware from 2009. <http://download.cnet.com/OpenTalk/3000-2150_4-10568159.html>

<comment><USER30> It's actually OpenTok. Check it out here: <http://tokbox.com/opentok/api/documentation>

</comment></comment><comment><USER31> Cool concept, hope it does well.

Seems ironic that "They were actually developing a product that required partnerships with Chinese manufacturers, and they found themselves increasingly frustrated by the fact that they couldn't keep an eye on the project".

</comment><comment><USER32> Does the iPad need to be charged seperately, or can it recharge when the robot is plugged in?

<comment><AUTHOR> Yes, to keep things simple, the iPad and robot communicate wirelessly, so the iPad is currently charged separately.

<comment><USER13> They should be integrated. You need to be able to 'park' this thing on a charging pad and know that it will be there, fully charged when you need it. Otherwise you're creating more work for someone at your remote site (assuming there is someone there to create work for, these could probably be used at unmanned sites with great success).

<comment><AUTHOR> Agreed and noted. "We have nothing to announce at this time" is our standard response in a situation like this.

</comment></comment></comment></comment><comment><USER33> This is pretty darn cool and pretty darn freaky at the same time. It may want to use both front and back cameras to see if someone is coming at it from the back since it won't be able to get back up on its own. :o)

</comment><comment><USER34> So, it's a Segway with FaceTime? The main question is why? Even the video can't seem to find a decent use case. The art gallery idea is ridiculous, why would you physically control a robot that wanders an art gallery when the gallery has a website? Also have you ever tried actually wandering around a gallery? The robot wouldn't stand a chance. What happens when someone knocks it over?

In the workplace this would just be embarrassing. Not to mention a security threat, there's no way any serious corporation would allow roaming cameras in their offices.

If I put my idealist hat on and try to imagine the future with these, I keep coming back to those Segway videos of the hype of a new kind of city, a new kind of transportation.

This really is a technology in search of a use case, that isn't already being addressed. I read comments that say they would use these to attend meetings, how does this robot compare to Cisco's video conferencing, or FaceTime or even just calling in from the car/home. At work we use screen sharing and audio/visual conferencing which seems to work just fine, and where it doesn't it will evolve.

I'm wondering how this robot would push the elevator button to get to a meeting on another floor? There are just so many problems with this idea, not the least of which is who would actually buy one.

<comment><USER22> It's been useful already. One of the founders was out of town at the last YC dinner and but he participated in a conversation in the lobby with me and his cofounder through a Double. He wouldn't have been able to if he'd been using a standard teleconferencing setup, because it wasn't a pre-arranged meeting.

In my experience, many if not most of the most important conversations are not pre-arranged meetings. If you use existing teleconferencing technology you miss them all, and if you use a Double you don't. That's a qualitative change.

<comment><USER28> Pre-arranged meetings are the first thing that jumps into people's minds, but do telecommuters really want to replicate the experience of being in meetings? For me, one of the nicer aspects of telecommuting is I can call into meetings and during portions of the meeting that don't apply to me (or are boring) I can work (or surf the web).

On the other hand, people do have a love/hate relationship with meetings: <http://online.wsj.com/article/SB120519462810425677.html>

I can buy into the importance of impromptu meetings. I wonder if the Double team can figure out a way to market around impromptu vs pre-arranged meetings and love/hate meetings without alienating too many people.</comment></comment></comment>