LulzSec brought down by own leader - <AUTHOR> http://www.foxnews.com/scitech/2012/03/06/hacking-group-lulzsec-swept-up-by-law-enforcement/ <comment><USER2> Funny tht right around the time he was arrested, Lulzsec declared they were done and sailing off in their Lulzboat. Then they reappeared a few months later, probably started back up after Sabu went to the narcs. Luckily this was only after Anonymous put together their new decentralized teams that do the footwork now. Lulzsec is just a name now, very little work is done by their namesake anymore.

The writer is a bit confused. Topiary was caught way before this round of arrests.

Also, there has been a significant belief for months now that the "Real Sabu" disappeared and was (maybe) arrested, or that he was never an individual but only a name the group used for PR. Finally, there is significant doubt that Kayla is a single individual as well.

<comment><USER3> "Luckily this was only after Anonymous put together their new decentralized teams that do the footwork now."

"Luckily" ?

<comment><USER2> Luckily for them and, in my opinion, you and me as well.

Edit: Feel free to downvote, please tell me why my opinion is not a valid contribution to the discussion.

<comment><USER4> > Luckily for them and, in my opinion, you and me as well.

Elaborate, please?

<comment><USER2> In short, Anonymous targets and humiliates authoritarians and those who service them. This is at the core of my morality.

Their hacks illustrate the glaring weaknesses of our technology and that the incompetence in infosec so often spawns from negligence at the highest of levels in the industry. Despite this, powers that be (nation-states, militaries, and regional law enforcement) invest nearly nothing in securing their (public) assets. They demonstrate that organizations like Sony, the State Department, and the Pentagon can go months without even knowing of full- root breaches, only to wait yet more months to inform the public.

Luckily, Anonymous does all this for the sake of Teh Lulz (public humiliation), rather than corporate or state espionage.

<comment><USER5> > Luckily, Anonymous does all this for the sake of Teh Lulz (public > humiliation), rather than corporate or state espionage.

Or so they say. There seems to be an awful lot of blind trust that Anonymous (or people claiming to be Anonymous) really do have the goals that they've stated. If Anonymous, or a splinter group, goes after some random company, ostensibly to humiliate them, what's to say they're not being paid by the company's rivals?

<comment><USER6> I tend to agree with you. They have been going up against publicly unpopular targets, so few have questioned them thus far, but there's no reason that can't be a ruse.

<comment><USER5> Part of the problem here is the fact that they really are anonymous, so if Anonymous goes after two different targets on two different days, there's no way to know that it's actually the same group both times. So even if you could prove beyond a shadow of a doubt what their goals were for one particular attack, that would have zero bearing on the motivations and goals behind any subsequent attack.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I reckon a huge proportion of blackhats in the scene are working for the feds.

Some kid with no record gets thrown in a van by men with guns, and the full force of police psychological manipulation is brought to bear on them. They get told they're irrevocably destined for a lifetime of being brutally raped in the showers.

Is it any surprise that these young men with no experience of foul-play or maliciousness outside of the virtual world fold and turn informer with such regularity?

If I were an active blackhat, I wouldn't talk to anyone, ever. I wouldn't even invent a pseudonym, that's the first step to ending up on fox news.

EDIT: Eric Corley, publisher of 2600, thinks it's one in four: [http://www.guardian.co.uk/technology/2011/jun/06/us- hackers-...](http://www.guardian.co.uk/technology/2011/jun/06/us-hackers-fbi- informer)

<comment><USER8> Groups allow information trading. It is basically essential if you want to cash for your hacking activities, such as carding and 0-day selling. I am not totally familiar with "the scene", but I'm pretty sure there are plenty of incentives for hackers to regroup

<comment><USER9> Grouping to trade 0-days is totally different than grouping to DDOS a website. I'm pretty sure the former won't end you up in jail, either.

But, I think the OP is right. The only successful (for lack of a better word) black hat is going to be a loner.

<comment><USER10> Actually, criminal copyright infringement is a $250k fine, 5 year felony, in the US. Pretty amazing. You are vastly more likely to be prosecuted criminally if you're part of a group, and especially if you focus on 0-days. Even more likely if you sell things, charge for advertising on your site, etc.

The DrinkOrDie people got a lot of 3-5 year sentences. <http://en.wikipedia.org/wiki/Operation_Buccaneer>

<comment><USER11> Parent posts are probably talking about 0-day exploits rather than 0-day warez.

<comment><USER10> Doh, of course.

DMCA still makes some 0-day exploit research not totally safe, either. <https://www.eff.org/wp/unintended-consequences-under-dmca> I don't know if anyone has been successfully convicted, but a lot of prosecutions have come up, and that's enough to deter many people.

</comment></comment></comment></comment></comment></comment><comment><USER12> Oh Fox News. Even when reporting on something legitimately interesting and out of the ordinary, they have to use very un-journalistic phrases like "...allegedly commanded a loosely organized, international team of __perhaps thousands of hackers __..."

"Perhaps thousands"? Perhaps millions! Perhaps five. Ugh.

<comment><USER13> There's a slightly less breathless and more coherent report here: [http://www.guardian.co.uk/technology/2012/mar/06/lulzsec- sab...](http://www.guardian.co.uk/technology/2012/mar/06/lulzsec-sabu-working- for-us-fbi?newsfeed=true)

<comment><USER14> Give credit where its due: Fox News broke this story. The Guardian report appears to be based solely on the earlier Fox story and public documents.

<comment><USER15> It has nothing to do with giving credits. I (and I'm sure many others would also) like to read less tabloid-y and factual reporting anytime and so would prefer to read the story on Guardian than on Fox.

<comment><USER14> But the quotes are literally lifted from the Fox piece. The Guardian does not add much new reporting, it just lays out the existing facts in a way you find more agreeable.

<comment><USER13> Which is what I thought I made clear when I linked to it i.e. same report, less hyperbole. Perhaps you would have preferred it if I had used the word "version" rather than "report"?

</comment></comment></comment></comment></comment></comment><comment><USER16> As a former blackhat and ID thief who used to spend a lot of time in "underground" chatrooms and forums this doesn't surprise me at all. This is a standard pattern LE follows. Start with small arrests, work your way up, get someone at the top level to be an informant, take everyone down. Works for any type of group.

This always works because people are foolish and too trusting. The best rule is to assume _everyone_ is LE trying to catch you. That means never revealing info that can lead back to you, never telling anyone personal info, your general location (eg the weather), always using 7 proxies, etc.

People who don't break the law would probably be surprised how much personal info crackers give to their online "friends". Less so on fraud forums but it still happens.

As some other people mentioned read "Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground" for more info on how LE works. The FBI took over a few carding forums and Secret Service also had high level CIs.

<comment><USER17> > The best rule is to assume everyone is LE trying to catch you.

This sounds wise. But I'd argue that it's wiser to not be engaging in activities where you even have to worry about that. If your rule is the best rule, my rule is even better. :P

<comment><USER16> Non sequitur. If you don't do something, negative consequences won't happen. You can say that about _anything_. Don't have sex if you don't want STDs, don't drive a car if you don't want to get into an accident, don't walk down the street at night if you don't want to get mugged.

<comment><USER17> you missed the point

</comment></comment></comment></comment><comment><USER18> This article claims billions of dollars in damage. If this is what the FBI is saying, they are wrong. Lulzsec damages don't even approach a million dollars, most likely. Billions of dollars is how much money it costs to do things like provide universal health care for a small state. The FBI should investigate real cases and not treat a bunch of merry pranksters like they're a bunch of super terrorists.

<comment><USER19> Costs in hacking cases are mostly measured by time spent investigating & repairing * fully loaded employee costs. If you have to dump a bunch of servers and reload everything and audit your backups the costs rise very quickly.

<comment><USER20> True, but companies on the receiving end often end up also including the cost of things that they would need to do even in a responsible-disclosure scenario. For example, if you discover a major flaw in a company's system that allows high levels of access, and disclose it to them, they'll typically incur considerable costs patching it, rolling out the updates, doing a security audit to make sure it wasn't already quietly discovered earlier by a blackhat who might've backdoored something, etc.

When they do all those same things upon an actual intrusion, they often attribute the expenses to the hacker, but imo they're really attributable to the security flaw, since they'd be incurred even in the whitehat case. I'd only attribute to the hacker the delta between what blackhat disclosure and whitehat disclosure would cost.

<comment><USER19> You're absolutely correct - there are a lot of things that get rolled into damage cost estimates that aren't legitimate. I was just trying to explain how it's pretty easy for the actual & legitimate costs to be quite high as well.

</comment></comment></comment></comment><comment><USER21> We are still in the stage of these groups being very amateurish. It will take few rounds of purges until really committed+careful+smart organizations emerge.

<comment><USER22> How do you know they haven't already? Committed+careful+smart probably wouldn't issue press releases.

<comment><USER23> Sure they would, they'd just be smarter about it. The point of hacktivism is publicity. If no one knows what you're doing, you're not being particularly effective.

<comment><USER24> I want to refute your point with the mention of Stuxnet. Please correct me if I'm wrong but up until now there are no groups that have owned up to the virus. There's evidence and much speculation to point it towards Israel gov't but no definitive proof.

A lot of the content that surrounded Stuxnet also hints to further organizations existing behind the veil. There were at a minimum 3 0-day exploits present in the virus that would have to have been operated from behind the scenes. It is extremely unlikely that a single group was able to create such a virus without external resources.

In the end you don't need to issue press releases and the like. You need to get in, do your damage and get out. Let the damage reveal itself in time and its considered massively successful. Those fighting the Iran nuclear program did more while keeping their mouths shut than any loud group ever has.

<comment><USER23> Stuxnet was cyberwarfare, not hacktivism. The point of Stuxnet was to disable infrastructure, whereas the point of much of what Anon does is to get attention. Now, granted, that doesn't require the ego-driven hacks and braggery that we've seen from them, it simply requires getting in, getting out, and posting the data anonymously then promoting and publicizing the _data_ , not the hackers. I suspect you may start to see more of the hacker cells aligned with anonymous take this approach in the future to minimize the heat that they feel personally.

<comment><USER25> Great distinction of cyberwarfare and hacktivism ... its unfortunate that both get shown in the same light while they clearly have different motive behind them.

</comment></comment></comment></comment></comment></comment><comment><USER26> This is a pretty impressive rollup by the Feds.

Seems like an inverted flipping maneuver. Rather than starting with the small fish and cutting deals up to the top, they hit the ostensible mouthpiece/leader and wraps up all of the other folks in the org so that it doesn't splinter off and create successor orgs.

</comment><comment><USER27> So these dox were accurate after all?

<http://news.ycombinator.com/item?id=2697398>

<comment><USER28> accurate for sabu but not the rest it seems

<comment><USER29> Sabu was doxed repeatedly, and his family was even the subject of a NYTimes story. [http://th3j35t3r.wordpress.com/2011/11/19/if-i-am-wrong- ill-...](http://th3j35t3r.wordpress.com/2011/11/19/if-i-am-wrong-ill-say-im- wrong-heres-my-apology/) <http://ceaxx.wordpress.com/uncovered/> [http://techie-buzz.com/tech-news/fbi-lulzsec-anonymous- sabu....](http://techie-buzz.com/tech-news/fbi-lulzsec-anonymous-sabu.html)

</comment></comment></comment><comment><USER30> From the rt story:

> Monsegur pled guilty to several charges of computer hacking conspiracy, for > which he could receive a maximum of 124 years behind bars.

That's what a serial killer would get. US law is ridiculously tilt to corporations.

<comment><USER31> Note that he hasn't actually been _sentenced_ to 124 years. We're talking about multiple stacking charges here. You could get multiple charges of parking too far from the curb and it could add up to thousands of dollars, but that doesn't mean the parking fine is too much.

More than likely, it'll be reduced to a sane amount when the compile the charges. 5 years, maybe 10 (maybe more). The actual sentence (minimum sentences notwithstanding) is almost always up to the judge.

<comment><USER6> Yup, maximum sentences are actually generally there for the protection of the defendant; they put a ceiling on sentencing. Without them sentencing would be _entirely_ up to a judge's discretion.

</comment></comment></comment><comment><USER32> No surprise here considering that 25% of hackers cooperate with law enforcement[1]. These people aren't hardened members of violent crime organisations like Gangs or various mobs and are probably very easy to "break". On the other side hackers tend to trust each other way to much and share personal details inside their group which makes infiltration very easy. Sure you can be behind 7 proxies when you hack something but that doesn't matter as soon as you start talking to your hacker buddies about your personal life without using OTR or even bothering to sign into chat services with a proxy. As soon you start sharing details about how you're in love with a girl or that you feel depressed or you are about to order pizza at place X it's pretty much over for you.

These hacker groups are like a clique a social circle of friends but most "hackers" don't think that their "friends" will rat them out in a second. Most of them probably have never been interrogated or even any contact with law enforcement and therefor very easy to intimidate.

[1][http://www.guardian.co.uk/technology/2011/jun/06/us- hackers-...](http://www.guardian.co.uk/technology/2011/jun/06/us-hackers-fbi- informer)

</comment><comment><USER33> > the unemployed, 28-year-old father of two allegedly commanded a loosely > organized, international team of perhaps thousands of hackers

Sounds like he was pretty busy.

<comment><USER3> When you're unemployed all you have is time. I think he only had partial custody for his kids.

It lets you fit railing against governmental entities and directing 20-somethings--who also don't have full time jobs--seamlessly into your schedule, all with convenience from your government subsidized housing.

</comment></comment><comment><USER34> Working with the FBI for the lulz?

<comment><USER35> for the lulz indeed.

What a dick, though..

<comment><USER36> How can anyone with a tiny bit of intelligence claim that he did any wrongdoing by helping the FBI?

This does not imply that helping law enforcement is always ethical. In this case, helping law enforcement take down these criminals is not a "dick move".

<comment><USER37> You seem to be implying that assisting law enforcement is _always_ ethical. It's not, just like breaking the law is not necessarily unethical.

</comment></comment></comment></comment><comment><USER38> Having read Kevin Poulsen's 'Kingpin', one could not expect a different result.

</comment><comment><USER39> shocker... but like anonymous/lulzsec continuously said, you cant kill an idea. another group doing it for the lulz perhaps soon or later will come up

<comment> lzh-ng Of course you can't kill an idea. Wait, what was the idea again?

<comment><USER40> The 21st century equivalent of setting a poop-filled bag on fire on someone's porch, or something along those lines. But without actually requiring anything so taxing as getting up from the computer, going outside, and running.

<comment><USER41> The only difference is that instead of people thinking that it is a harmless prank they will send in homeland security/swat team/etc with loaded weapons.

</comment></comment></comment></comment><comment><USER42> "The offshoot of the loose network of hackers, Anonymous, believed to have caused billions of dollars in damage to governments, international banks and corporations..."

Wait .. what ... !?

We are talking about those guys with The Love Boat theme right?

</comment><comment><USER43> The Fox News reporting can be supplemented by the official FBI press release on the arrests:

[http://www.fbi.gov/newyork/press-releases/2012/six- hackers-i...](http://www.fbi.gov/newyork/press-releases/2012/six-hackers-in- the-united-states-and-abroad-charged-for-crimes-affecting-over-one-million- victims)

</comment><comment><USER44> No honor among hackers?

</comment><comment><USER3> One question: If the FBI knew of additional hacks that could expose things such as customer credit card numbers, should they have intervened? Did they intervene?

<comment><USER2> If they were involved an operation to export thousands of guns to Mexican drug gangs[1], surely killing hundreds in the process, then yes. If they knew, they probably wouldn't intervene. Even still, few (any?) Lulzsec attacks actually leaked unencrypted credit card data. Even then, the damage done by exposing credit cards is pretty negligible anyway.

[1] <http://en.wikipedia.org/wiki/ATF_gunwalking_scandal>

<comment><USER3> Forgive me if this information is not correct, but wasn't their latest attack of Stratfor exactly such a hack?

I recall that Stratfor kept a lot of customer information in plaintext, including CC's.

</comment></comment></comment><comment><USER45> I wonder what will happen to Sabu after this?

<comment><USER46> Probably lots of phone calls, some random unsolicited pizza appearing on his doorstep, and all kinds of slander on every chan board ever made.

Oh, you mean IRL? Dunno. You'd think they'd have cut him a deal for helping them out.

<comment><USER47> They will have cut a deal with him already, however that deal usually means reduced jail time in an easy prison, he still has to be charged with the offences. His "good behaviour" is then taken into account by the prosecuting authorities when sentencing him.

They arrest him and publicise his arrest as psyops, any other hackers out there see that the #1 from lulzsec was caught and turned therefore who knows how many lower level hackers have also been turned, thus it increase the paranoia within hacker circles.

Of course this works 2 ways, first off it scares people off from hacking or being involved in it and makes them more likelyo to turn tail and rat out anyone they know who is undertaking nefarious online activity in an effort to protect themselves. The second response is the one they dont like, these groups become more security concious, go deeper underground, become less likely to admit new members, etc. This is counter productinve for the FBi as it makes it more difficult to catch them later down the line.

<comment><USER3> It's not just the assistance to authorities, but the fact that he brought actionable intelligence that brought arrests towards others. His getting other LulzSec members arrested and prosecuted is key to diminishing his own sentences.

Other hackers have offered help and not proven useful, only to find themselves up a creek with little to no lightening of their sentences.

</comment></comment></comment></comment><comment><USER48> It will be a while before we have a real sense of how "crippling" this rollup really was.

</comment><comment><USER49> It's strange that it was revealed at all whether he works with the FBI. Is that normal? Why not keep it secret for somewhat longer to catch even more hackers? Exposing him as informant could also bring his life in danger.

This makes me doubt the truth of the story a bit.

<comment><USER50> There is propaganda value in revealing it. I'm guessing they're hoping that members of other groups are going to start asking themselves "if lulzSec was infiltrated by the FBI without anybody noticing, then how can I be sure that they haven't infiltrated my group as well". At the end of the day scaring people into not committing crimes is better for everybody than catching them after the fact.

<comment><USER49> Yes, the propaganda angle is clear, and exactly what makes me doubt the story (especially as this is fox news we're talking about).

</comment></comment></comment><comment><USER51> So did someone from 4chan actually phone the FBI as threatened last June?

See <http://i.imgur.com/HlHnJ.png> if you don't mind coarse language...

</comment><comment><USER52> What an ass.

<comment><USER36> You're joking right? Sure, he WAS an ass but at least he did some good by helping the FBI take down these criminals - enjoy jail.

</comment></comment><comment><USER53> Is this the ultimate troll move?

</comment><comment><USER54> Well, you can pretty much imagine how it went down. FBI caught up to him with threats like "eh..you are unemployed, and you still have two kids. You want to see them in foster care system?" ... well, no surprise there. too many buttons that FBI can push on this guy

<comment><USER55> Vapid speculation based on TV plots doesn't really help the level of discourse at HN. Given the list of hacks and the outrageous hacking laws in the US, the default penalty could easily be life in prison. I wouldn't think the Feds would need to push much harder than that.

<comment><USER54> Vapid or not, everyone is entitled to their opinions. If you can't accept that, you are not welcome on HN discussion either. End of story.

Simply stated, if HN is heading towards Reddit-like behavior where comments must gear towards "singular" minded thinking, that's the also the day I stop visiting this site.

<comment><USER56> I think it's a bit naive to think that's what's been dubbed 'hivemind' behavior is absent on HN. I think it appears on every site, differing just by degrees. The threads on the recent GitHub hack were quite telling.

</comment></comment></comment></comment><comment><USER57> They defaced a few websites and stole plaintext/unsalted databases, and Fox makes them sound like terrorists. How surprising.

</comment><comment><USER58> Any idea why they don't mention the nationality of Hector Xavier Monsegur? His name sounds like Spanish or French but it could be otherwise. In the end, it's confusing and I can't really get a geographical idea of the Lulzsec thing.

<comment><USER19> US national - NY.

<comment><USER13> Apparently he's Puerto Rican but lives in NY (at least according to: [http://www.guardian.co.uk/technology/2012/mar/06/lulzsec- sab...](http://www.guardian.co.uk/technology/2012/mar/06/lulzsec-sabu-working- for-us-fbi?newsfeed=true)).

</comment></comment></comment><comment><USER59> Can someone image link so I dont have to go to fox news?

</comment><comment><USER60> So a guy hacks github, he's a hero. A guy hacks a bunch of media organizations, and he's a villain. I really don't understand the groupthink these days.

How is one of these okay, and the other not?

<comment><USER61> [http://en.wikipedia.org/wiki/Hacker_(computer_security)#Clas...](http://en.wikipedia.org/wiki/Hacker_\(computer_security\)#Classifications)</comment></comment>


IBM's 2018 Rollout Plan for Power9 Systems - <AUTHOR> https://www.nextplatform.com/2018/02/06/ibms-2018-rollout-plan-power9-systems/ <comment><USER2> I'd love to see at least one affordable developer-focused workstation available from someone. Power9 will be cool.

EDIT: And by cool, I mean have interesting performance characteristics, not be Intel arch, and seems to be one of the more plausibly not-backdoored CPUs in this performance class.

<comment><USER3> > affordable developer-focused workstation

[https://www.raptorcs.com/TALOSII/](https://www.raptorcs.com/TALOSII/)

Pre-order prices seem to be $4.2k+ USD. That's pretty "affordable" for Power.

<comment><USER4> Looks like $5k is the minimum for a system that could actually boot (has HDD and memory). Affordable by enterprise computing standards, but you could buy a really kicking Intel based desktop for that money. I'm guessing a 90W 4 Core Power9 is not going to knock it out of the park compared to an i7-8700k.

It is hard to justify spending a lot more for a slower machine that most software won't run on without a recompile. You have to place a whole lot of value on the secure boot features.

<comment><USER3> From a performance perspective... the minimum-spec'd version doesn't make much sense at all. Especially since the 18-core Power is only $1290: [https://secure.raptorcs.com/content/CP9M06/purchase.html](https://secure.raptorcs.com/content/CP9M06/purchase.html)

It is a dual-socket motherboard though. So fully-decked out with 2x 18cores gets you to $9k or so.

But really, the point of a developer machine is to be an accessory to a Power9 server. You develop on the "cheap" $5k developer machine, and then run things on the production $10k+ machine. So you basically want to build a test environment that would emulate your bigger machine: dual socket (match the NUMA with the bigger box), even if the CPUs are a lot smaller.</comment></comment></comment></comment>


Zopfli Optimization: Literally Free Bandwidth - <AUTHOR> http://blog.codinghorror.com/zopfli-optimization-literally-free-bandwidth/ <comment><USER2> Somewhat OT; As a swiss, the omitted ö is _really_ beginning to bug me.

It's Zöpfli. Gopferteckel.

(The second word is a somewhat soft cuss word - But don't try to use it as a non-native).

Also, you can't "zopfli" something - it's a noun! You "zöpf" \- or, since we're in the alemannic german space; "zöpfle".

/rant /vent

<comment><USER3> Same thing with Löve 2D, or is it Love 2D?

The problem here is that the naming isn't consistent. Sometimes it's Love and sometime Löve. I never know what to call it, but I think the whole idea of naming a software package with diacritics is just asking for trouble. If they would have transcribed it to Loeve it would at least be obvious what's going on.

This is perhaps exacerbated by my native tongue treating ö not as an o with umlaut, but as a completely different character distinct from o and at another place in the alphabet. To me it's like naming a package Blam but half the time referring to it as Blym instead.

<comment><USER4> Löve is not a German or Swiss German word, so the umlaut is simply gratuitious.

(Other languages such as Dutch or French use diacritics to mark a vowel as not-dipthongised, but that doesn't apply here either.)

<comment><USER3> If it's not German it's gratuitious?

I'll try not to take that as an insult to speakers of Swedish, Finnish, Icelandic, Estonian, Hungarian, Turkish, and any of the other dozen languages which make use of the character.

</comment></comment></comment></comment><comment><USER5> Regarding the avatar images:

Why not a <div> with a border-radius & background color? Seems you could achieve the same thing without another HTTP request (1 for each unique avatar), no need to zopfli 45,000 unique files.

<comment><USER6> Also font and alignment issues cross browser can be brutal. There is a lot to be said for a tiny image that works everywhere, on any device.

<comment><USER7> What about an svg?

<comment><USER8> That wont work in email... I'm generating a usage graph (svg) that is emailed and the graph will not display in the client.. Must be opened in a browser

<comment><USER9> Seems like you could use an SVG avatar for clients that can handle it and fallback to PNG for email.

</comment></comment></comment></comment></comment><comment><USER10> > It's a smaller file to send over the wire, and the smaller the file, the > faster the decompression.

Can someone elaborate on this? Why do smaller files decompress faster?

> However, remember that decompression is still the same speed, and totally > safe

Wait, what? Didn't we just establish that it's faster to decompress?

<comment><USER11> > Why do smaller files decompress faster?

The same reason why "no code" is faster than optimized code. ;)

<comment><USER10> The trivial identity "compressor" is fastest to decompress, since it requires no work. Likewise PNG has literal blocks, which are longer but faster to decompress. So is it actually true that Zopfli-compressed files decompress faster?

</comment></comment></comment><comment><USER12> The original PNG of that PBF comic is 671,012 bytes. ZopfliPNG crunches it down to 585,117 bytes.

Not bad, but if you use newer image formats, you can do better.

Lossless WebP brings it down to 429,696 bytes (using -lossless -m 6 -q 100)

FLIF with default options (which means interlaced for progressive decoding) takes it down to 322,858 bytes. Non-interlaced FLIF reduces it further to 302,551 bytes.

</comment><comment><USER13> If anyone is interested in PNG optimization in general, a wrote an article about it a while back. The deflate step is only one part of it!

[http://heyimalex.com/journal/png- optimization](http://heyimalex.com/journal/png-optimization)

</comment><comment><USER14> You could probably have a worker system that eventually produces a Zopfli compressed file.

User uploads a provided PNG, you perform the quickest compression compression but then queue up a Zopfli compression. Up front you're only returning the less compressed file but after time you begin serving up the lesser bandwidth file.

If the uploaded file or associated post is deleted then you can wipe it from the queue.

<comment><USER15> Or maybe don't even Zopfli it until it gets 100 some hits. Cost some amount of cents of CPU time to do the compress... unless maybe you made the uploaded so it.

<comment><USER6> Yeah the smart thing to do is schedule "important" user submitted images for heavier recompression, but even then you might get in trouble for very large PNGs, and need to gate based on dimensions. For huge PNGs I am not sure the 80x - 160x time penalty is tenable, you might be talking 30 minutes in some cases.

</comment></comment></comment><comment><USER16> Are the reported Zopfli numbers for PNGs achieved by recompressing the original, or by recompressing the output of PNGout? The wikipedia page for PNGout says

> _PNGOUT also performs automatic bit depth, color, and palette reduction > where appropriate._

Assuming the Zopfli numbers were created by recompressing the original, I wonder if there's any further savings to be had by recompressing the output of PNGout?

Alternatively, PNGcrush can also do the same sort of lossless bit depth and palette reduction, so I'd be curious about the combination of PNGcrush + Zopfli as well.

<comment><USER17> That doesn't matter - both systems decompress the losses PNGs before recompressing them.

<comment><USER13> It does kind of matter, because compression isn't the only form of optimization that can be done. Consider a 32 bit png that is actually bilevel with no transparency. If zopfli just recompresses, PNGOut will still make smaller output because it does bit depth reductions.

<comment><USER17> The zopfliPNG program does do bit depth reduction if that's possible. It even tests to see if a given small image that would be possible to bit depth reduce would actually be smaller by it keeping 32 bit, since the added pallet overhead may cost more than the gain of a smaller pixel storage cost.

</comment></comment></comment></comment><comment><USER18> And you could save even more bandwidth if you changed the PNG standard to also allow Brotli compression. Even more probably if you created a better file format.

That's not free anymore, but it's technologically easily possible to drastically reduce the amount of resources we use. What holds us back is that it's hard to get other people to do stuff like supporting new file formats or even have a better output in their image manipulation program.

<comment><USER16> If you change the PNG standard, it's no longer PNG. If existing PNG decoders can't decode it, then all you've done is invented a new format that looks very similar to PNG.

<comment><USER18> Something similar was made with WOFF. Version 1 used deflate, version 2 uses brotli. You could now argue semantics wether WOFF2 still is WOFF, but that doesn't matter at all. The point I wanted to get across here is that it's a relatively easy change

<comment><USER16> > _You could now argue semantics wether WOFF2 still is WOFF_

No arguing needed. It's a different format. It uses a different extension ("woff2" instead of "woff"), a different magic number, a different Universal Type Identifier string, and a different @font-face format.

> _it 's a relatively easy change_

But it's not. Even WOFF2 isn't supported everywhere (according to [http://caniuse.com/#feat=woff2](http://caniuse.com/#feat=woff2)). And that's a format that's fairly recent (the W3C Recommendation doc for WOFF 1.0 is dated December 2012) and only has a handful of implementations to begin with.

PNG is a format that's a lot older and is decodable by practically everyone. Even if there's only a handful of distinct implementations (and I don't actually know how many implementations there are), and even if every single implementation updated immediately, it would still take an incredibly long time for it to get deployed widely-enough to actually use as a general-purpose format.

It's also worth pointing out that web fonts have built-in fallback behavior (e.g. if a browser can't handle a WOFF2 font, you can provide a WOFF font as a backup), and they're also things that are typically set up once (so generating multiple font formats is reasonable). Images don't really have fallback behavior. On the web, the WHATWG HTML Living Standard defines a <picture> element that provides fallback but it's not supported everywhere. Outside of the web there's typically no way to do fallback either (if your browser can render an image but nothing else can, saving that image to disk isn't very useful, and sending it to someone else isn't very useful either). Also, while font files are created very rarely, images are created very frequently, and most people aren't going to want to create "PNG2" images if they also have to create PNGs and deal with fallback (just look at WebP, which was released 5 years ago and still AFAIK is not used by very many people outside of Google).

<comment><USER18> Technologically it's relatively easy: just link the brotli library and call its decoding functions instead of zlibs when you encounter a file with brotli compression. It's getting everyone to implement that which is hard. This is already what I wrote in my first post.

<comment><USER16> The "getting everyone to implement that" part is the part which actually makes it a format.

</comment></comment></comment></comment></comment></comment><comment><USER19> It's not even just about bandwidth. You're reducing page load time, and therefore increasing revenue. [http://www.fastcompany.com/1825005/how-one- second-could-cost...](http://www.fastcompany.com/1825005/how-one-second-could- cost-amazon-16-billion-sales)

If you're a designer/developer on Mac I would strongly recommend ImageOptim ([https://imageoptim.com/](https://imageoptim.com/)). It supports Zopfli and has a simple drag-n-drop user interface.

<comment><USER20> On Linux there is Trimage:

[http://trimage.org/](http://trimage.org/)

</comment></comment><comment><USER21> Batch files which go though all the tools and find the smallest sizes for various images and .gz files

[http://css-ig.net/tools/](http://css-ig.net/tools/)

Personally I've found this tool is faster and does a better job than most others and it's free:

[http://psydk.org/pngoptimizer](http://psydk.org/pngoptimizer)

</comment><comment><USER22> I don't think tools like pngquant should be so easily dismissed. With the pixel density of todays monitors, the lossy changes they introduce can be very hard to see (which may be surprising for those of us who remember the pixelated horrors of Floyd-Steinberg from a couple of decades ago).

For some image types, lossy png has the huge advantage over jpg at the same file size that they have no jpg artifacts.

        671.012 original
        584.677 zopflipng -m
        580.180 zopflipng -m --lossy_transparent
        576.637 pngwolf --max-stagnate-time=0 --max-time=300 --normalize-alpha --strip-optional
        190.598 pngquant --speed 1
        179.638 pngquant + pngwolf

</comment><comment><USER23> His example use case seems a little contrived. We have a similar default avatar at Quay.io, but we handle it all client-side with CSS. There's some more free bandwidth!

<comment><USER24> a little, but images are important if you want to ensure consistency across different platforms.

</comment></comment><comment><USER25> > ~250 color schemes

Theoretically one could use one of the indexed PNG formats and only change the palette. I don't think that those avatar images use too much number of colors (even with anti-aliasing) so 8 bit indexed PNG should be more than enough.

</comment><comment><USER26> This is interesting - but really don't we have better things like FLIF that should be gaining developer momentum first?

That would solve basically everything wrong with today's decades old formats.

</comment><comment><USER27> Just checked; on my MacBook it installs with a quick

$ brew install zopfli

That's assuming you have Homebrew installed, if not: [http://brew.sh](http://brew.sh)

</comment><comment><USER28> the lions share of image creation these days happens on the mobile. and I cant seem to find a Zopfli library for android. I wonder why - is it too heavy duty for a mobile CPU ?

<comment><USER29> Photos maybe, but who makes images that would suit PNG on mobile?

</comment></comment><comment><USER30> Sounds like there should be a system to JIT images with this.

</comment><comment><USER31> > it's about as close as it gets to literally free bandwidth in our line of > work.

Listen, I'm all about inventive ways to lighten the yoke of static media on the web today.

But, in two important ways, this is not "literally free bandwidth":

1) The weaker: Despite the tone of obviousness in this article, it acknowledges that the choice of which technology to use is not made for you: there are edge cases where other methodologies are indeed superior. So, far from being free, these sorts of solution do have a time cost.

2) The stronger: We live in a world where, on a great day, the user's realized downstream bandwidth is 20% their LAN connection; their upstream 5% or less.

Connecting to a next-door neighbor via a conventional web application served through a typical corporate ISP probably means pushing packets a thousand miles or more, only for them to come back into our community.

Complicating this issue: our name service and certificate distribution are implemented in a way that is reasonably called "incorrect."

Our ISPs have a "speak when spoken to mentality" about connectivity, and competition is rare.

A solution bragging "literally free bandwidth" needs to service this concern - let me transfer a piece of media to a next door neighbor utilizing the other 95% of my network interface upstream capacity. That I'll call free bandwidth.

<comment><USER32> Both scenarios are free bandwidth.</comment></comment>


3D Printers with GoLang and Raspberry Pi - <AUTHOR> http://www.nanodlp.com/

<comment><AUTHOR> nanoDLP is a Raspberry Pi Based Host Software for DLP based 3D printers.

How it works:

It gets ziped PNG files of layers as input

Output the images on HDMI port of RPi

Control Z-Axis Stepper motor directly through driver

</comment><comment><USER2> Seems nice. Where is more information?

</comment><comment><USER3> Great Job</comment>


Plasma on TV: Presenting Plasma Bigscreen - <AUTHOR> https://dot.kde.org/2020/03/26/plasma-tv-presenting-plasma-bigscreen <comment><USER2> There is also a video showing how it works here: [https://www.youtube.com/watch?v=iOxMuexAPaQ](https://www.youtube.com/watch?v=iOxMuexAPaQ)</comment>


Germany clarifies ethics for self-driving cars: Treat kids and adults as equals - <AUTHOR> http://blog.a9t9.com/2016/09/liability-for-self-driving-car-accidents.html <comment><USER2> >'There must be no classification of people, for example, on the size, age and the like'

That's a bit hand-wavy.

Meanwhile there's actual research going into this problem

[http://moralmachine.mit.edu/](http://moralmachine.mit.edu/)

[http://news.mit.edu/2016/driverless-cars-safety- issues-0623](http://news.mit.edu/2016/driverless-cars-safety-issues-0623)

[https://en.wikipedia.org/wiki/Trolley_problem](https://en.wikipedia.org/wiki/Trolley_problem)

<comment><AUTHOR> Your links describe the problem well. But the article/interview goes beyond this and suggest a possible solution: Treat kids and adults the same, and (maybe, my guess, not in the interview) even ignore the number of people involved when comparing options. The judge Udo Di Fabio that heads this ethics commission is a very outspoken and smart guy, it will be interesting to see how he approaches these questions and "converts" them into actionable law.</comment></comment>


Why is my Scala code running slow? - <AUTHOR> http://stackoverflow.com/questions/6146182/why-is-my-scala-code-running-slow <comment><USER2> Never use in Scala

      for (x <- Y to Z)

if you need performance. It is doing not what you think :) Use while for optimization.

<comment><USER3> This is like a booby trap in a language. Presumably it can be solved with optimization in the compiler at some point (according to the thread, turning on optimizations improved performance somewhat, but replacing for with while made performance identical to Java).

Personally, I don't like languages to have a whole bunch of slightly different iterators for specialized purposes, but having for turn out to be dramatically different from while performance-wise violates the principle of least surprise.</comment></comment>


The Ideology Is Not the Movement - <AUTHOR> http://slatestarcodex.com/2016/04/04/the-ideology-is-not-the-movement/ <comment><USER2> This is moderately useful, but not new.

He may be underestimating the effect of attention. Attention is a scarce resource, because there's only so much time. Part of tribe creation is absorbing a considerable amount of attention. This is seen most strongly in the religions designed to consume attention multiple times per day. Islam and Haredi Judaism are the most obvious examples. We also see this with the types of video games that demand regular attention, from World of Warcraft to Pokémon Go. This is different from popularity; Angry Birds, although popular, did not require constant attention and did not develop a cult-like following.

<comment><USER3> Because 21st century internet-facilitated media has created a seller's market for attention, there have arisen media practices which take advantage of potentially toxic innate instincts. People have long been wary of the use of sex to gain attention. Variable schedules of reward are in-fact addicting, therefore potentially toxic. However, the use of _outrage_ to gain attention in the 21st century attention economy is far more toxic. Why? Because the use of outrage strongly degrades discourse between groups as well as discourse within a group, on both an emotional and intellectual level.

Outrage politics is basically like steroid use. It can aid in quickly bulking up (a group) but it has detrimental long term effects on the body politic.

<comment><USER2> I think you mean " _buyer 's_ market for attention". There are more sellers wanting attention than buyers looking for something to which to attend.

<comment><USER3> Seller's market for attention. Viewers and users are giving their attention. The party you're calling buyers are buying media. Often they are trading their attention for access to media.

Don't confuse media with the consumption of media. (I guess social media blurs this, however.)

<comment><USER4> They makes no sense. Attention is the currency, the sellers provide the product and accept attention as payment.

If I pay you $20 for your skateboard, you are not the _buyer_ of my cash, you're the _seller_ of your skateboard.

<comment><USER3> Seller's market isn't about who is paying currency. It's about who is on the side of the transaction with the most power, and who is providing. Hence, it's a seller's market for attention. Those offering the attention are the supply.

</comment></comment></comment></comment></comment></comment><comment><USER5> That is a fantastic read. I need to take some time and think about how this changes my viewpoint on certain things (esp. politics).

<comment><USER6> It is indeed good, but my concern is that some will take this to mean that they don't need to take other people at there word, and that consequently any attempt to form a common ground philosophically will not even be made (let alone whether such attempts could actually be successful).

More suspect is the notion, not necessarily implied by Scott's piece but but explicitly stated in the post he linked[0], that those with religious beliefs specifically should not be taken at their word.

This is not a defense of religion. Rather, why does a belief in some bearded guy in the sky suddenly invalidate the content of your other, when belief in "The Equality of Humanity" or "The Progress of History" or "The Zeitgeist" or "Free Markets" or other such fluffy abstractions not[1]?

Also, because this notion of tribalism is trending, I fear it risks becoming the new psychoanalysis (i.e. "everything wrong with you can be explained by repressed childhood trauma!"). We don't behave philosophically as often as we like to pretend, but that doesn't mean we don't ever.

I think the realizations about tribalism are primarily useful insofar as we are introspecting to understand our own motivations behind our political/social behaviors, and hopefully allow us to overcome those aspects of our psychology in an attempt to reach that philosophical common ground with our enemy tribes.

The only other application will be those who employ such knowledge in a pursuit of power[2] or money[3].

[0][http://www.meltingasphalt.com/religion-is-not-about- beliefs/](http://www.meltingasphalt.com/religion-is-not-about-beliefs/) [1][https://unqualifiedreservations.wordpress.com/2007/09/26/how...](https://unqualifiedreservations.wordpress.com/2007/09/26/how- dawkins-got-pwned-part-1/) [2][https://www.amazon.com/Rules-Radicals- Practical-Primer-Reali...](https://www.amazon.com/Rules-Radicals-Practical- Primer- Realistic/dp/0679721134/ref=sr_1_1?s=books&ie=UTF8&qid=1469221142&sr=1-1&keywords=rules+for+radicals) [3][https://www.amazon.com/Tribes-We-Need-You- Lead/dp/1491514736](https://www.amazon.com/Tribes-We-Need-You- Lead/dp/1491514736)

<comment><USER7> > that those with religious beliefs specifically should not be taken at their > word

For better or worse, the idea that religious people shouldn't be taken at their word is a core belief of the LessWrong crowd, of which Scott is one of the most notable members. "Belief in Belief" [1] is one of the earliest grounding chapters of the beloved Sequences, and I'm pretty sure that's where the meltingasphalt post got its inspiration.

> Rather, why does a belief in some bearded guy in the sky suddenly invalidate > the content of your other, when belief in "The Equality of Humanity" or "The > Progress of History" or "The Zeitgeist" or "Free Markets" or other such > fluffy abstractions not[1]?

It is, at least for some people. For example, I feel roughly the same way about people who "believe in Free Markets" as I do about people who believe in God; interpret that as you will.

[1] [http://lesswrong.com/lw/i4/belief_in_belief/](http://lesswrong.com/lw/i4/belief_in_belief/)</comment></comment></comment>


How to put a VC in the hot seat - <AUTHOR> http://tumblr.com/xdt2t38t6b

<comment><USER2> You stand a very good chance of looking dumb if you walk into a real VC's office and ask if they're accredited.

<comment><USER3> A "real VC" is unlikely to be a "relatively new investor".

<comment><USER2> If they call themselves a "venture capital firm" then there's no game theoretic win to asking if they're accredited. If they aren't, they can't invest anyways, so hot-seating them is dumb.

</comment></comment></comment><comment><USER4> _An investor invests in the jockey and not the horse. Consider an investor like the saddle. If the saddle sucks, the horse and the jockey's groin will be sore._

This metaphor hurts my head. A saddle invests in a jockey?

<comment><USER5> I think the idea is that the investor is there to support a talented jockey (entrepreneur) against the turbulence of the horse (new business). Maybe this horse got outraced by another horse/jockey, but if the investor should have faith that the jockey can pick up the saddle and learn how to ride a new horse.

Agreed, not the best analogy... especially because as I understand a lot more is invested in horses than jockeys (in actual competitive horse racing). But, I _think_ that's the point.

</comment></comment><comment><USER6> Read the VC's website first to answer as many of these questions as you can, and if you have remaining questions then ask those. But asking "When where you founded?" to a VC may only show you didn't do your homework.

</comment><comment><USER7> I strongly disagree with this post on two different levels.

For one thing, starting out on a relationship with a potential future investor by looking for ways to put them in the hot seat doesn't feel like a success path for me. They will always be able to make things a lot hotter for you than the other way around ... so why go there?

Secondly many the specific questions would go better in a post called "how to give a VC an impression that you don't bothered to prepare for meetings". When were they founded? It's on their web site. What's their background? Oh, that's on their web site too. Why haven't you done your homework?

</comment><comment><USER8> If by "hot seat" you mean "position from which to comfortably reject your pitch" then I think you're on to something.

</comment><comment><USER9> @pg: Please include subdomains in the link descriptions with Tumblr-hosted articles.

<comment><USER10> There's no subdomain - OP used a tumblr.com/XXXX shortener

<comment><USER9> Interesting; normally, shortened URLs are converted to their 301 destination on HN, but the same does not apply to Tumblr. Hence my confusion.

Thanks for pointing it out.

</comment></comment></comment><comment> daniel-cussen Half of these are usually publicly available, and therefore homework.

</comment><comment><USER11> ya i don't think any of these questions are going to put a VC in the hot seat...</comment>


Oculus Touch - <AUTHOR> https://www.oculus.com/rift/ <comment><USER2> How is this "touch"? More like "Oculus Hold"</comment>


DataFusion (Rust) vs. Apache Spark – First Benchmarks - <AUTHOR> https://andygrove.io/2018/03/datafusion-0.2.1-benchmark/ <comment><USER2> "The tests ran on a desk(t)op with 16GB RAM" a single node setup doesn't fit the distributed, fault tolerant, use case that Spark was designed for, rending this comparison moot.

<comment><USER3> Exactly. This isn't a benchmark at all.</comment></comment>


Borg – Deduplicated backup with compression and authenticated encryption - <AUTHOR> https://github.com/borgbackup/borg <comment><USER2> Started using Borg after Attic appeared to be abandoned. Love the new life the community has brought to the project and look forward to the future.</comment>


Speculations Concerning the First Ultraintelligent Machine (1965) [pdf] - <AUTHOR> http://webdocs.cs.ualberta.ca/~sutton/Good65ultraintelligent.pdf

<comment><USER2> A slightly easier to read version here: [http://le-cretin-transnational.ch/wp- content/uploads/2014/04...](http://le-cretin-transnational.ch/wp- content/uploads/2014/04/Good-Speculations-Concerning-the-First- Ultraintelligent-Machine.pdf)</comment>


Mozilla debates supporting H.264 - <AUTHOR> http://arstechnica.com/gadgets/news/2012/03/idealism-vs-pragmatism-mozilla-debates-supporting-h264-video-playback.ars

<comment><USER2> Previous discussion on HN:

<http://news.ycombinator.com/item?id=3692771>

Actual discussion on Google Groups:

[http://groups.google.com/group/mozilla.dev.platform/browse_t...](http://groups.google.com/group/mozilla.dev.platform/browse_thread/thread/fb14de8b9ad84e15#)</comment>


Start Engaging with Google+ - <AUTHOR> http://blog.viralheat.com/2012/11/21/start-engaging-with-google-and-youll-thank-me-later/

<comment><USER2> While they have a Google+ sharing option on the bottom, the first thing I noticed is that their SimpleReach sharing sidebar doesn't have a Google+ option.

Apparently users need to email firstname.lastname@example.com and request the Google+ option:

[http://wordpress.org/support/topic/plugin-simplereach- slide-...](http://wordpress.org/support/topic/plugin-simplereach-slide- google-1)

<comment><AUTHOR> It is on the bottom. Also, yes, our startup is on Google+

</comment></comment><comment><USER3> constant use of the word 'chap' in an attempt to sound like an upper class British public school boy is incredibly annoying. if the content is worth reading then it will stand on its own - it doesn't need to be livened up by speaking in the style of Bertie Wooster.</comment>


Late Applications to YC Winter2020 - <AUTHOR> I applicate to the winter 2020 of YC with a late application 5 days ago and i want to know which is the time average in order to get a answer. <comment><USER2> Send an email to email@example.com</comment>


Ask HN: How do you evaluate security of OSS before importing? - <AUTHOR> What tools can I use to evaluate the security posture of an OSS project before I approve its usage with high confidence? <comment><USER2> There are commercial products/services out that that attempt to provide validated OSS packages and monitor when the ones you are using have vulnerabilities.

In the data science world, there is anaconda, For the enterprise, there is black duck software, myget, libraries.io and the commerical variant, and a few others.

My internal checklist: 1) Is the license OSI approved (IP indemnification and IP taint is a risk) 2) What's the community like for it (is it well used, do security incidents get tracked handled quickly) 3) What security assurance have they done (some OSS has funders who have paid for testing, what kind of test suites do they have). 4) Add security alerts for the OSS to my RSS feeds to help monitor 5) Enforce a policy to sync to upstream pretty frequently as many OSS security bugs get silently fixed

If I don't have confidence at this point, I will have some static analysis performed (lots of tools here) as a last measure sanity check. I know lots of bugs won't be uncovered by that, but it's an indicator of development goodness.

Would love to hear what others are doing as we are a small shop and use 1000+ OSS packages.

<comment><AUTHOR> NPM lists known vulnerabilities during installation, but I don't think other package managers work the same way. AFAIK, you have to download the OSS and scan with tools like BlackDuck, Synk. I see you follow a number of steps to confidently import an OSS. Have you tried automating your checklist?

<comment><USER2> For initial import I like it to be a manual process so I can judge risk. I have some really bad python scripts that read/write excel documents that will alert me when licenses change.

My plan is to move to Black Duck or the commercial libraries.io subscription for my automation needs.

For Kubernetes I'm really impressed with Aqua Security as they do OSS license adherence and OSS security vuln alerting if you only deploy into containers. It's not a cheap product, but love how they do OSS assurance as part of build and deployment. It's a nice model that allows a central security team to use technology to enforce policies - good for "research" environments where dev/researchers don't want to do any effort for OSS packages.

</comment></comment></comment><comment><USER3> Oddly, whether a project has at least one CVE reported could be interpreted in favor of the project. [https://www.cvedetails.com](https://www.cvedetails.com)

Do they have a security disclosure policy? A dedicated security mailing list?

Do they pay bounties or participate in e.g Pwn2own?

Do they cryptographically sign releases?

Do they cryptographically sign VCS tags (~releases)? commits? `git tag -s` / `git commit/merge -S` [https://git-scm.com/book/en/v2/Git-Tools-Signing-Your- Work](https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work)

Downstream packagers do sometimes/often apply additional patches and then sign _their_ release with the repo (and thus system global) GPG key.

Whether they require "Signed-off-by" may indicate that the project has mature controls and possibly a formal code review process requirement. (Look for "Signed-off-by:" in the release branch (`git commit/merge -s/\--signoff`)

How have they integrated security review into their [iterative] release workflow?

Is the software formally verified? Are parts of the software implementation or spec formally verified?

Does the system trust the channel? The host? Is it a 'trustless' system?

What are the single points of failure?

How is logging configured? To syslog?

Do they run the app as root in a Docker container? Does it require privileged containers?

If it has to run as root, does it drop privileges at startup?

Does the package have an SELinux or AppArmor policy? (Or does it say e.g. "just set SELinux to permissive mode)

Is there someone you can pay to support the software in an enterprise environment? Open or closed, such contacts basically never accept liability; but if there is an SLA, do you get a pro-rated bill?

As far as indicators of actual software quality:

How much test coverage is there? Line coverage or statement coverage?

Do they run static analysis tools for all pull requests and releases? Dynamic analysis? Fuzzing?

Of course, closed or open source projects may do none or all of these and still be totally secure, insecure, or unsecure.

<comment><AUTHOR> This is a pretty extensive list. Thanks for sharing!</comment></comment>


TV show panel full of experts tells entrepreneur his idea is worthless, he proves them wrong - <AUTHOR> http://www.dailymail.co.uk/pages/live/articles/news/news.html?in_article_id=475095&in_page_id=1770&ito=1490 Never let anyone persuade you your product is useless until you prove its usefulness in the market! <comment><USER2> Yes, professional investors _do_ make mistakes (as the better VCs will admit: <http://www.bvp.com/Portfolio/AntiPortfolio.aspx>), so this is something to keep in mind after meeting with potential investors.

BTW, what is David Beckham doing designing toys?

<comment><USER3> That guy was not rejected because his idea was bad. The prototypes he brought with were of very low build quality. The investors had doubts about his abilities of running the bussiness rather than the idea itself. I don't think they made a mistake.

<comment><USER4> A prototype is just to get an idea across. He easily could've hired a firm to design the product properly with the GBP100k he stood to gain from that contest.

The main motive behind these shows is entertainment. They just need to make a big showy production with drama, excitement, and hurt feelings. They are pretty lame imo. On the other hand, it's a chance for some investment, so I won't fault people for going after it.

</comment></comment></comment><comment><USER5> I've seen a bit of Dragon's Den. My observations, unlike VCs, these guys tend to be absolutely direct and say what they think about the idea and the ability of the founders. I've found that they tend to look for either business experience or real traction like revenue and profits. So the show isn't web 2.0 compliant.

</comment><comment><USER6> "Reality" contest TV shows are anything but objective to begin with. The judges are purposely overblown so the audience will react to the judges. The contestants are selected according to personality, also for audience reaction. It's about making good television, not good inventions.

</comment><comment><AUTHOR> I think I saw two episodes of UK's Dragon's Den from the first season (you can find them on bittorrent sites). It was an interesting show from what I remember. For those that never heard of it, here's what wikipedia says:

"Dragons' Den is a television programme that originated in Japan where the format is owned by Sony. The format, which now airs internationally, consists of entrepreneurs pitching their ideas to secure investment finance from business experts -- the "Dragons"."

Basically, you pitch a bunch of rich people, entrepreneurs and investors and they tell you what you think and they might invest into your idea as well.</comment>


Abandon profitable one man company? - <AUTHOR> Hi. I have since about 5 years been running a self funded B2B SaaS, with around $150k ARR. With marginal costs, it gives an ok income. I have done all the development and sales myself - not because I like to work by myself, it's just that I haven't had a need for assistance so far.
However, I feel the market (quite niche product) is being a bit saturated and I have quite a few competitors as well which are much larger in terms of team size. Still, huge corporations choose my solution because they like it more.
Some Fortune 500 companies run it on a daily basis.
The thing is, I miss colleagues and I have lost a bit of my motivation and drive since I have come to the understanding that it won't grow much more.
That's also why I do not want to take more people on board.
I'm thinking about just quitting and doing something else or maybe joining a corporate instead (basically just to get some colleagues). Also the feeling of working for something together as a team - and the feeling of being needed. I have outside of work a social life with family and friends, but as soon as I am working I feel a bit lonely. Working in a coworking space is nice, but the problems I face now and then at work are still my own so to speak.
I do not expect an answer because I guess only me knows what I want, just wanted to see if others have been in this situation? <comment><USER2> > Also the feeling of working for something together as a team - and the > feeling of being needed.

Consider a joint-venture. Combining forces with another firm to provide additional products & services to your clients.

On this subject, Jay Abraham is masterful > [https://www.goodreads.com/book/show/6515635-the-sticking- poi...](https://www.goodreads.com/book/show/6515635-the-sticking-point- solution)

</comment><comment><USER3> Don't abandon it and don't sell yourself short to a large corporation. If you are needing to be surrounded by a team, then let's chat. I also loathe going solo on a project for similar reasons. Over the past few months, I've been able to manufacture a schedule that has opened up a lot of time for me to explore serendipitous projects.

Hit me up.

</comment><comment><USER4> Figure out what exactly you want to do after you end your solo lifestyle. Once you've done that, then sell the business. It should net you a tidy sum. If your heart's no longer in it, then sell it to someone who will embrace your SaaS with gusto.</comment>


Tesla stock is now back below its IPO price. - <AUTHOR> http://www.google.com/finance?chdnp=1&chdd=1&chds=1&chdv=1&chvs=maximized&chdeh=0&chfdeh=0&chdet=1278446400000&chddm=1954&chls=IntervalBasedLine&q=NASDAQ:TSLA&ntsp=0

<comment><USER2> Pretty much exactly what that guy from Mad Money predicted would happen.

I wouldn't invest in Tesla. Either electric cars take off or they don't, but if they do then the _big_ car companies can easily muscle in and eat Tesla's lunch. Nissan and Chevy both have electric cars coming out soon which will present a much better value proposition than the Tesla Model S.

<comment><USER3> > muscle in and eat Tesla's lunch

This would largely depend on whether Tesla would strive to become a mainstream car maker or would choose to retain its focus on building luxury/exotic cars. Think Aston Martin kind of company.

Though they have already announced an average-priced sedan version that was scheduled for mass production in 2012, so I guess they are going after the behemoths.

<comment><USER2> Luxury and exotic cars is a terrible business to be in. Small-volume supercar manufacturers pop in and out of existence every few years, leaving behind tiny production runs of awesome-looking machines and no spare parts.

The only luxury/exotic car manufacturers which have survived are the ones which managed to pick up enough of a history to be bought out by a much larger mass-market brand as a halo. afaik they mostly operate at a loss. Bentley, Lamborghini and Bugatti belong to VW. Ferrari is Fiat. Lotus is Proton, and Rolls-Royce gets passed around like a cheap hooker. Only Aston Martin is currently owned by someone other than another car company, but that may not last.

<comment><USER4> What about Porsche, BMW and Mercedes?

Any business is good to be in - provided you're good enough. There's no such thing as easy money.

<comment><USER2> Low-end luxury seems to be very profitable, as those three companies demonstrate. They're comfortably away from the cost-cutting at the bottom of the market, but still accessible to a large number of customers.

It was the _really_ high-end cars ($100K+) I was talking about as apparently being unprofitable.

<comment><USER4> Mercedes and BMW manufacture and sell cars in the price range you are talking about.

</comment></comment></comment></comment></comment></comment><comment><USER5> The speculators done gone made a lot of money off the geeks. Tesla was a typical speculator IPO, now the reality of the risk facing the company will set in and the price will go to its standard level till they start to show real potential.

<comment><USER6> Are you talking about the geeks at Tesla or the geeks who bought stock after the price jumped?

If the former, companies often IPO at prices below what they're worth--if the IPO is issued at a fair price, then it's Tesla that benefits, not the speculators. If the latter, buying stock because it's going up is an act of speculation, not necessarily geekishness.

<comment><USER7> Yes, I don't really get why any company would IPO below their fair price. Every time I see a company's stock go up massively on the first day, I ask me "Why did they not charge a higher price for their stock in the first place?".

<comment><USER8> Leaving money on the table during an IPO is often attacked as a form of fraud. I recall it was a big issue during the peak of the Internet boom, 1997-2000. There you had a lot of startups desperate for money to fund their growth, and yet they gave away substantial amounts of money to speculators. There were clear abuses of "Friends and Family" blocks of stock -- these started getting handed out to anyone who could move the deal forward, with the understanding that the stock could be dumped on the opening day of trading. This amounted to a kind of bribe, an additional payment made in excess of all the normal IPO fees.

Wikipedia offers this:

<http://en.wikipedia.org/wiki/Initial_public_offering>

"The underpricing of initial public offerings (IPO) has been well documented in different markets (Ibbotson, 1975; Ritter 1984; Levis, 1990; McGuinness, 1992). While Issuers always try to maximize their issue proceeds, the underpricing of IPOs has constituted a serious anomaly in the literature of financial economics. Many financial economists have developed different models to explain the underpricing of IPOs. Some of the models explained it as a consequences of deliberate underpricing by issuers or their agents. In general, smaller issues are observed to be underpriced more than large issues (Ritter, 1984, Ritter, 1991, Levis, 1990) Historically, IPOs both globally and in the United States have been underpriced. The effect of "initial underpricing" an IPO is to generate additional interest in the stock when it first becomes publicly traded. Through flipping, this can lead to significant gains for investors who have been allocated shares of the IPO at the offering price. However, underpricing an IPO results in "money left on the table"—lost capital that could have been raised for the company had the stock been offered at a higher price. One great example of all these factors at play was seen with theglobe.com IPO which helped fuel the IPO mania of the late 90's internet era. Underwritten by Bear Stearns on November 13, 1998 the stock had been priced at $9 per share, and famously jumped 1000% at the opening of trading all the way up to $97, before deflating and closing at $63 after large sell offs from institutions flipping the stock . Although the company did raise about $30 million from the offering it is estimated that with the level of demand for the offering and the volume of trading that took place the company might have left upwards of $200 million on the table."

All the same, Wikipedia also offers a charitable explanation for the phenomena:

"The danger of overpricing is also an important consideration. If a stock is offered to the public at a higher price than the market will pay, the underwriters may have trouble meeting their commitments to sell shares. Even if they sell all of the issued shares, if the stock falls in value on the first day of trading, it may lose its marketability and hence even more of its value."

<comment><USER9> The term "pop" is sometimes used to describe the immediate post-IPO jump.

A small amount of "Pop" (no more than 10 percent) isn't a bad thing. It is a result of oversubscription, which every underwriter needs in order to assure they aren't left holding the bag. It also makes stabilization (the only legal form of market manipulation) less expensive for the underwriter.

You're going to see more extreme cases of "pop" in a market with a lot of uncertainty (like we have now). This is the underwriter being cautious. Their worst case scenario doesn't appear and the IPO turns out to be underpriced.

What we saw in the late 1990's was heinous. I worked at a startup investment bank (Epoch Partners) that was intended to take some of the pop out of IPOs (and make allocation more available to genuine retail investors).

-r

<comment><USER7> Yes, but why care about underpricing at all? Can't you just have a formal auction, where everybody states (legally binding) how many stocks they want at which price level (e.g. for 3$ I'd buy 10 stocks, for 5$ I'd buy only 8 stock, and so on, basically giving your demand function) and then do a simple optimization that finds the highest price at which all shares sell. (Or alternatively, and perhaps better, the lowest price at which everybody who wants to pay at least this price, can buy.)

Why rely on guess work?

Edit: I saw on the linked Wikipedia article that some people have tried auctions. Google seemed a noteworthy example.

<comment><USER9> Epoch had an auction equivalent process (which we didn't get to implement because we didn't get to the point of being lead underwriter).

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> The real smart geeks road the wave to 40% then shorted them on the way back down.

<comment><USER11> I'd be surprised if there was sufficient liquidity for shorts so soon after the IPO.

</comment></comment><comment><USER12> I will argue that this is a good time to buy Tesla Stocks; this is a time for real geeks to make money.

<comment><USER13> No, not yet. A lot of people are going to panic sell. Then you will have those who will hold on hoping it goes back up at least to what they paid for it. The moment it does they too will sell.

Wait till it stops going down, goes up for a bit, then down again. Only then think about buying.

And for those who are hoping it goes up to at least what you paid for it: Please be aware you ALREADY lost your money. Waiting for it to go back up is poor investment strategy. You don't loose your money when you sell - you loose it instantly. Either you think it's a good buy right now (in which case buy some more, or hold what you have), or you don't think it's a good buy _right_now_, in which case sell and it makes no difference what you paid for it.

Waiting for it to go back to what you paid for it will make you feel better, but in the long run you will loose money that way. Only keep a stock if you think it's a good buy at all times - pay absolutely no attention to what you paid for it. The present, and future is all that matters, the past doesn't.

</comment></comment><comment> joe-mccann Actually, the reason for the insane run-up on it's inital day and second day of trading had very little to do with speculation, but more to do with TSLA being an "extremely hard to borrow" stock on those days. When a stock is hard to borrow, it means it is nearly impossible to short sale the stock. Think AIG when they were melting down. That was a stock that no one wanted loan out for short sales because at the time, their demise was imminent. Not necessarily the same thing with TSLA, but that's what hard to borrow equates to...

So all theories and ideas of why the run up and why the subsequent sell off are essentially wrong. When a stock can only go in one direction, then it can only go in that direction.

</comment><comment><USER14> Maybe a perfect time to buy?

Their brand is now recognized as _the_ electric car manufacturer. As long as this trend continues, they will submerge as the winner.

I've also heard that their technology is somewhat unique and that they've found solutions to many hard problems. Do they have any patents?

<comment><USER15> _...they will submerge..._

Freudian slip?

<comment><USER14> Sorry about that. You're right. <http://www.google.is/search?q=define:submerge>

I'm not a native English speaker, so sometimes it's difficult to find the right word and something pops up in my mind and I think it's correct.

<comment><USER13> The word you were looking for was emerge.

<comment><USER14> Exactly ! Thanks :)

</comment></comment></comment></comment></comment><comment><USER16> Not surprising. The market's collective thinking is normally pretty short- term, and shares of a company that's forecast involves a best case scenario of generating real revenues 2 years from now wouldn't be expected to be in- demand.

<comment><USER17> It's interesting how this has changed since the dot-com boom, where shares of AMZN in 1998 had the same price that they did in 2008, even though it wasn't expected to turn a profit until 2002.

</comment></comment><comment><USER18> Why are there no stock options (calls/puts) offered for TSLA? Will that change in the future?

<comment> joe-mccann Yes. Not enough historical volatility currently to price options contracts accurately.

<comment><USER18> Thanks. I didn't think about that. How much history would they want?</comment></comment></comment>


The MBAs are fleeing, should SF be worried? - <AUTHOR> http://techcrunch.com/2014/11/09/the-mbas-are-fleeing-should-sf-be-worried/ <comment><USER2> Lazy reporting.

The logic underpinning this article is flimsy at best. He is using the following to infer that fewer MBA's are going to SF:

 _About 24% of MBA graduates in the class of 2014 headed to tech jobs, down from 32% in 2013 and equal with the proportion back in 2012. Of course, those profiteering graduates are returning right back to where they belong in finance and consumer products, which each saw notable upticks in employment._

There are several things that are wrong with this. First, he is only looking at Stanford GSB and assuming because it is in the Bay area that it is a reliable representation of MBA's everywhere, because surely it's proximity to SV means it must graduate more students who are likely to be employed there than elsewhere. But Haas is in the Bay area too. He's also assuming that students who graduated in years past aren't now moving to SV in increased numbers which, if true, could more than offset a decline in graduating students. However the most glaring hole in the logic is that "tech jobs" = San Francisco. As a fairly recent MBA grad myself, I can tell you that most of the people in my class who went into tech did not go to SV. Most went to places like Intel, Amazon, and Microsoft, none of which are based in California, let alone SV.

If you don't have a firm understanding of a topic, why write about the topic? It just makes the author sound stupid.

<comment><USER3> Intel is based in SV.

<comment><USER2> You're right that it's headquartered there, but it's largest workforce is in Portland, Oregon, and that is where my classmates went to work post-MBA.

</comment></comment></comment><comment><USER4> From the same report. Finance has median 150k base pay, median 40k signing bonus, median 100k other guaranteed income. Tech has 125k, 20k, and 20k. Sounds less likely that they're making some informed decision on the future of Tech, and more likely that they're going where the money is at the moment. Those numbers are very different.

Actually, that hasn't changed in the last year. A more significant fact is that in 2012 24% of MBAs went to tech, in 2013, 32%, and now in 2014 it's back down. There weren't any huge shifts in the industry in the last two years, so the data seems inherently noisy, determined by the acts of 20 people who go either to one or the other.

Poor article. Looking for a story.

<comment><USER5> Yes, excluding outliers, finance has always paid better. I'd guess the brief migration from finance to tech was simply because finance became very unfashionable for a little while. Meanwhile, headline-grabbing IPOs were making it seem like everyone in Silicon Valley was making easy money.

As an equation it would look like:

finance_pay - judgement_of_society > tech_pay + lottery*Pr[winning_lottery]

where judgement_of_society has rapidly declined, and people are realizing that the true value of Pr[winning_lottery] is smaller than their estimate.

</comment></comment><comment><USER6> So the entire premise of the article is based on the recent Stanford GSB recruitment report:

>That's according to newly released employment data from Stanford's Graduate School of Business, which is a particular bellwether of the state of startups given the school's proximity to Silicon Valley. About 24% of MBA graduates in the class of 2014 headed to tech jobs, down from 32% in 2013 and equal with the proportion back in 2012. Of course, those profiteering graduates are returning right back to where they belong in finance and consumer products, which each saw notable upticks in employment.

Apparently we can now make statements about entire industry sub cycles from the whims of 350 students.

</comment><comment><USER7> A dose of reality + MBA Friends making way more outside of tech = "I've made a mistake"

Startups are hard. Very hard. Startup life is not glamorous. And failure hurts twice as much when you've lived a cultivated, high-achievement life. Building a company may have gotten cheaper, but it hasn't gotten any easier. If you imagine your life being an uninterrupted string of success by following a relatively conservative game plan you may find it difficult to adjust. Leaving is perfectly reasonable.

<comment><USER8> As someone who has been coding for a while, I must say I'm jealous of my MBA friends. Some of them were programmers but their careers just shot up after those 2 years. The older I get, the more it feels like programming is really an entry level job. Sure, you'll have rock star architects/distinguished engineers who get to have great careers (mostly due to right timing) but that's a very small percentage.

<comment><USER9> This is a reality that most do not want to accept. Is it just? Probably not.

I've often viewed this as Thinkers vs. Workers. Society places a high value on Thinkers, those who make decisions, strategize, make connections, build relationships, etc. Those who fall in this camp are doctors, lawyers, consultants, CEOs, etc. The Workers -- programmers, engineers, designers -- are often fungible. They are in a competitive market of manual laborers that has driven down the price of labor to levels that, for many, increase the opportunity cost of learning the tech yourself. Over time, Thinkers accumulate social capital that can be leveraged to gain benefits, both related and unrelated to their profession -- e.g. a doctor being given preferential treatment by a restaurant host. Workers accumulate labor capital; they're more efficient at their work, can develop more creative solutions. But put a 50yr old coder up against a 50yr old lawyer/doctor/banker and the latter will be given more praise, more money, more influence 9 times out of 10.

Even Workers eventually outsource their labor once they're in a position to become a Thinker. Few successful startup CEOs and execs are actually coding themselves. Their roles shift to strategy, operations, so on and and so forth, for that's where they're valued and will be rewarded the most.

And getting a graduate degree is often the ticket to be considered a Thinker, whether MD, MBA, JD, PhD.

That's the game, whether you like it or not, and it certainly won't be changing anytime soon. If money is a priority, becoming a Thinker might be in your best interest.

<comment><USER10> >>>> Their roles shift to strategy, operations, so on and and so forth, for that's where they're valued and will be rewarded the most.

Those are the roles where you can't trust anybody to do them for you without fleecing you. Even MBA's are loath to fully entrust those roles to other MBA's. The top management of our company has an elaborate review process for strategy and operations, and no high level review process for coding.

</comment></comment></comment></comment><comment><USER11> Maybe they're fleeing as a consequence of culture? Virtually every story I've heard about MBAs in SF can be summed up as "we didn't hire them because of their MBA, but rather, in spite of it." I don't know how well-regarded MBAs in SF _actually_ are, but the cultural grapevine suggests there isn't a very high demand for them.

<comment><USER12> There is a culture of groupthink in hiring that mainly benefits people that are doing the hiring. MBA's are bad. Devs that are not social are bad. People with degrees of any kind are bad. Anyone who wouldn't make a good drinking buddy is bad. If you stop and think about who they're optimizing for, it's very dumb yes-man bro friends that don't challenge their decisions or thinking.

<comment><USER10> While I upvoted you, on the flip side, I've noticed that MBAs tend to be hired by other MBAs. This is certainly the pattern at the company where I work. If you highlight the MBAs on the org chart, they will tend to be clustered. Folks also decide to pursue an MBA when they see that the entire ladder above them is populated by MBAs.

It could be that MBAs have something that the rest of us don't know we need, or that we don't know how to hire and manage an MBA.

<comment><USER13> I've always seen MBAs as filling positions that make it possible to grow your organization. A sort of organizational glue. My perspective is by the nature of their roles they aren't meant to play a pivotal role.

So perhaps for the time being fewer MBAs means less growth in the sector. However, I envision a future where the positions MBAs fill will be some of the first ones automated. My perspective is that MBAs are a dying breed, and over time it will only become more evident.

<comment><USER10> I don't want to sound too cynical here, but just the right amount of cynical: I work in a large organization that has layer upon layer of hierarchy. To me, middle management seems like an information processing task: Gathering, organizing, analyzing, and reporting up and down the ladder.

The language of management is a COmmon, Business-Oriented Language. ;-)

</comment></comment></comment></comment></comment><comment><USER14> So literally one school (Stanford, mind you) saw a one year shift for it's ~800 students and conclusion is "MBAs are leaving tech!". If just 8 students decide to do finance over tech, it represents a 1% shift. 80 students means 10%...

<comment><USER15> I believe GSB has 400 students per year.

</comment></comment><comment><USER16> So the "Great MBA Bubble of 2013" was followed with banks offering greater compensation and possibly the opportunity to work with tech companies without the risk of belonging to one. I would imagine VC is a very attractive career for the graduates, and banks can offer a clear path to it.

This is, of course, pure speculation; I'm just trying to illustrate that correlation != causation. I understand everyone is concerned with the tech bubble, but this article is really stretch.

</comment><comment><USER17> I don't understand why MBAs seem to think of developer as lowly worker bees, and developers seem to think of MBAs as overpaid snobs.

But two things I have noticed: 1) many of these opinions come from people who are one or the other, but not both

2) people who have both skills are lethal and awesome people to work with.

</comment><comment><USER13> I wonder what the stats are regarding success stories with MBA founders vs technical founders. Perhaps SF is catching on to some as yet established reality that an MBA doesn't bring to the table what a technical founder can for an early stage startup.

</comment><comment><USER18> So, there were lots of MBAs in 2013, but not so much in 2014? Even if you grant that MBAs are a good indicator of startup success, two data points doesn't make a trend line. And I don't think many people on here would be inclined to grant that.

</comment><comment><USER19> Isn't there a gigantic influx of bankers who want to be close to Asia? Seems to compensate just fine...

</comment><comment><USER20> Maybe the valley understand that the MBAs don't add any really value compared to programmers who can really build. As a result, recent MBA graduate can no longer command high salaries and are now looking for greener pastures

<comment><USER21> What about an MBA who can also program? Do you think they can add value, or is the degree itself some kind of mystical tattoo that forever bestows unworthiness upon the graduate?

HN-ers like to laugh and think the MBA and techie sets are disjoint. A quick google search shows numbers from 25-40% of MBA students have engineering backgrounds (for example [1], [2]).

1\. [http://spectrum.ieee.org/at-work/education/engineers-and- bus...](http://spectrum.ieee.org/at-work/education/engineers-and-business- schoola-match-made-in-heaven) 2\. [http://www.science- engineering.net/engineering/united-kingdo...](http://www.science- engineering.net/engineering/united-kingdom/mba-and-engineering)

<comment><USER22> > _What about an MBA who can also program?_

Then they're mediocre at both, at best.

<comment><USER23> Or excellent at both but you can't deal with that possibility because it could make you question your own capabilities.</comment></comment></comment></comment>


Type-checked matrix operations in Rust - <AUTHOR> https://jadpole.github.io/rust/typechecked-matrix/ <comment><USER2> Lately I've been playing around with static dimensional analysis in Rust. The overall idea is similar: Use PhantomData to add a type parameter and define an empty struct for each unit. So you might end up with, say, Scalar<Newtons> or Vec3<Meters>.

Dividing and multiplying units statically is where I've had trouble so far. I think I've found a way, but it would depend on negative trait bounds, as discussed here:

[https://github.com/rust-lang/rfcs/issues/1053](https://github.com/rust- lang/rfcs/issues/1053)

Ideally, I'd like to be able to do something like this:

        let a: Scalar<Joules> = Scalar::new(2.0);
        let b: Scalar<Seconds> = Scalar::new(3.0);
        let c: Scalar<Watts> = a / b;
        // Watts is a type synonym for Over<Joules, Seconds>.
        // Other derived units would use Times<U, V>. E.g.:
        type Pascals = Times<Newton, Times<Meter, Meter>>.

<comment><USER3> But what makes Times<Times<Newton, Meter>, Meter> the same as Times<Newton, Times<Meter, Meter>>?

<comment><USER4> Canonicalization is tough, and requires you to define some common ordering on your units.

Systems will use an array of unit powers, so that if the array were defined as <Joules, Seconds, Newtons, Meters>, then acceleration would be <0,-2,0,1> and watts would be <1,-1,0,0>. Addition and subtraction require that your arrays are equal, and multiplication and division are pairwise additive/subtractive.

<comment><USER5> Is it tough? There are only seven fundamental units. [https://en.wikipedia.org/wiki/SI_base_unit](https://en.wikipedia.org/wiki/SI_base_unit)

Just represent every unit in terms of them then it's good.

One problem with the array you came up is that the units are not orthogonal, since Joules = Newtons * Meters.

<comment><USER6> Actually, there's more "kinds" of units: radians (versus degrees) and steradians come to mind.

<comment><USER7> These are dimensionless derived units in SI equivalence (respectively m/m and m2/m2)

</comment></comment></comment></comment></comment></comment><comment><USER8> For an example of a similar technique in Nim: [https://github.com/unicredit/linear- algebra/](https://github.com/unicredit/linear-algebra/)

If I understand correctly the author remark about the lack of Rust support for value parameters, it seems that it should be equivalent to the Nim feature (static[int]) that has allowed me to write type-checked matrix operations there

</comment><comment><USER9> Ok this is seriously amazing (coming from a C++ guy). However, one thing I don't like with putting matrix dimensions in templates is that then you can't construct them at runtime. I do understand the obvious - that you can't have both static type checks on all operations and runtime-determined matrix sizes. Though I would kill for a language which would specialise my code at runtime and throw an exception for compilation errors. So you could write, e.g.

        template <int m, int n, int l>
        Matrix<m, l>
        mul(Matrix<m, n> lhs, Matrix <n, l> rhs)
        {...impl...}

And then be able to call it like

        int m, n, k, l = ... read from file or whatever
        Matrix <m, n> m1 = ...;
        Matrix <k, l> m2 = ...;
        try {
            Matrix <int o, int p> m3 = m1 * m2;
            // ^ code compiled dynamically
            // or loaded from cache, based on
            // runtime types of m1 and m2.
            // o and p set to the result
            // of type inference.
            // I could imagine even having
            // specialised versions with inline
            // assembly for specific dimensions.
        } catch (DynamicCompilationException e) {
            print("dimensions not compatible");
        }

Java could be it, if it had reified generics. You'd create an implementation of Num, or load one from cache, then instantiate the template and attempt to call the mul function.

Or you could abuse the invoke dynamic feature - create specialised functions matrixMultiply$m$n$l and classes Matrix$m$n from some other templating language as needed, then do an invoke dynamic based on type. But this would be very cumbersome to use, I think.

<comment><USER10> Julia does this at runtime. You can create an arbitrarily sized and typed array and call a function. If no implementation exists specialized for that type, it will automatically compile one using LLVM.

(The function that creates the array will be slower since it's not type- stable, but it can generate a type-stable function that's fast.)

</comment></comment><comment><USER11> For assorted type system/PhantomData madness, see also:

[http://maniagnosis.crsr.net/2015/07/abstracted-algebra-in- ru...](http://maniagnosis.crsr.net/2015/07/abstracted-algebra-in-rust.html)

[http://maniagnosis.crsr.net/2015/07/more-abstracted- algebra-...](http://maniagnosis.crsr.net/2015/07/more-abstracted-algebra-in- rust.html)</comment>


Why it's so hard to be a startupper (what I concluded after pondering Ev's "choose your game" post) - <AUTHOR> http://toomuchnick.com/post/2748625 <comment><USER2> _'... "Most people," I read, "have spent too much time convincing themselves that life has to be hard, a resignation to 9-to-5 drudgery..." ...'_

Most people probably don't want the prospect of being summoned by a _boss_ and told to sit. Just like a dog! ... (straight out of pg's startup '07' talk on ' ~ <http://www.paulgraham.com/notnot.html> )

' _... I mean, if I'd turned down Gawker Media when they picked me to start Valleywag, I would have graduated, then found a job at a small newspaper ...'_

This isn't a bad idea if you want to learn how to become a real Journalist. Where else are you going to be follow a story, learn how to research it and write it up?

_'... Both want to stay in charge of their games longer instead of playing by someone else's rules ..._ '

And that is probably the best summary thing I've read today. I'd read the original article , "decide what game you're playing" ( <http://tinyurl.com/2t2roe> ) and didn't quite get it.

<comment><AUTHOR> Re: My would-be career in journalism:

I should have clarified. After Valleywag, I was courted (briefly; I wasn't too interested and they didn't push THAT hard) by several newspapers that I would have killed to get into back at college.

</comment></comment><comment><AUTHOR> By the way, am I posting more self-links than is good form? If so, my apologies, and I can cut back.

<comment><USER3> If people don't like them, they won't vote for them. I think the "don't post your own stuff" is lame baggage from reddit. If you're starting a company, I don't think you can or should be ashamed to promote your work, when you've taken the time to create something you're pleased with.</comment></comment>


Canada bans Soylent meal replacement over nutrition claims - <AUTHOR> http://www.bbc.com/news/world-us-canada-41753732 <comment><USER2> Seems awfully hypocritical. At least Soylent doesn't cause diarrhea, unlike Huel[0], which continues to be produced in Canada. [0] [https://huel.com/](https://huel.com/)

</comment><comment><USER3> Good discussion on this from a couple of days ago here: [https://news.ycombinator.com/item?id=15537843](https://news.ycombinator.com/item?id=15537843)</comment>


Constructive reasons to use Django instead of Rails - <AUTHOR> http://jesusphreak.infogami.com/blog/why_django <comment><USER2> Why is a two-year-old article being posted now? EDIT: Sorry, should've added: Especially in a domain that changes so quickly? Both Django and Rails have grown immensely since this was last updated.

<comment><USER3> I had never read this article before, and I was happy to read it today.

What he said about Django applies today - all of it. He really did a good job of summing up the powerful point of Django - the grace of Python, generic views, the admin back-end, inherited templates, etc, etc.

Spot on today, just as yesterday.

<comment><USER4> But in Rails land, there have been significant changes over the last two years in addressing a number of the issues.

Of course, let's not forget that Rails 3.0 (which is where the merge with Merb will be accomplished) will give Rails more of the points he highlighted in that article.

I'd love to see a balanced comparison using more up to date versions and see how it fares...

<comment><USER5> I think you just volunteered.

</comment></comment></comment></comment><comment><USER6> "One such instance that led me to using Python over Ruby was my need of a DBF reader. You can't find this anywhere for Ruby, but I found a very solid implementation in Python that I was able to plug right in."

Oh really ? <http://www.google.com/search?q=ruby+dbf>

This sort of compromises the credibility of the whole article in my opinion.

<comment><USER7> It's an old article (see comments above)

<comment><USER6> It's an even older library, so what's your point ?

<comment><USER7> My point was that it was an old article hence what he said about the DBF library may have been true at the time. Was that not obvious?

</comment></comment></comment></comment><comment><USER8> We're busy porting Pootle (translate.sf.net) to Django and it's painful. Webapps don't seem to be Django's strong point (though I'm sure that it excels in other arenas).

I've only played with Rails before, but I get the impression that it's far more suited to the kind of thing we're doing.</comment>


Journey over Unsecured IoT Devices with Kamerka - <AUTHOR> https://medium.com/@woj_ciech/journey-over-unsecured-iot-devices-with-kamerka-rtsp-and-mqtt-aba98839574 <comment><USER2> Busy looking at IOT for home automation purposes at the moment. Whole ecosystem looks quite shaky in that regard

e.g. IOTs that will happily accept commands from anything on the local net.

Yesterday I was surprised my hass.io could control a tp link power plug...I never gave it any auth...it just scanned the lan for things to control

<comment><USER3> Simple implementation, convienent UX, secure; pick two.

(Its not necessarily true, but tons of engineers assume its true. Hence, when making a low-cost product for home consumers, security is purposefully neglected.)

</comment></comment><comment><USER4> I make IoT devices and everything I do is closed by default. You want to reprogram it? Hard reset the hardware physically by removing the battery and then you need to know the exact GATT UUIDs and acceptable values to do anything.</comment>