Why has Plan 9 chosen statically linked binaries instead of dynamic ones? (2004) - <AUTHOR> https://9p.io/wiki/plan9/why_static/index.html <comment><USER2> There was a strange and mutually self-supporting pair of ideas in the Plan 9 community at the time:

1) "Shared libraries are bogus."

2) "Anyone who likes normal-looking user interfaces rather than plain boxes with text in them is a poopipants."

Both of these propositions are contentious to say the least, but what bothered me was that two propositions were mutually supporting while being (to my mind) orthogonal. The obvious and most compelling example of a shared library on the Unixen at the time were all the various UI libraries (Motif and various other abominations; all of them huge and unwieldy). It seemed necessary to accept that these libraries were obviously Completely Unnecessary to buy into the Plan 9 idea that shared libraries didn't do anything worth mentioning.

I'm sure it's possible to design a better UI library (or maybe even a wacky user level file system for user interfaces; in fact, my honours project in 1993!) but _at the time_ the way people made interfaces that looked vaguely like what other people expected computer programs to look like was to use big- ass shared libraries on Linux.

This was _also_ the way (dragging in one of those godawful blobs like Motif etc) that anyone might have exerted themselves to port across a (not completely pitiful) web browser, but the degree of aggressive disinterest in supporting Other Peoples Code was extreme (Howard Trickey's "ANSI POSIX Environment" or "APE" didn't get much love as far as I could tell).

It was quite undignified to watch people struggling with text-based web browsers or firing them up on non-P9 boxes because of the inability to support the web at the time.

<comment><USER3> As a UI person, I think shared UI libraries are bad for usability in many ways. They lead people to design UIs that happen to be made of the widgets that are available, rather than designing something truly suitable to the user task.

This is one of the reasons the web eclipsed native applications. The web only provided the most basic common widgets, so designers were forced to reimplement the UI toolkit, but also given the freedom to have their own take on it.

I personally would prefer to see a UNIX-like UI library made of many composeable parts. With idependant codebases.

In that world, having a single giant dynamically linked UI blob doesn't help.

I'm not saying standardization is bad, just that forced standardization at the architectural level is bad.

<comment><USER4> Just so I'm following properly, do you mean something like how you have {React | React Native | React VR} + a cornucopia of community-supplied custom components? imo it's a system that works well - you have a common system + easily extensible custom bits.

(take my experience with a grain of salt, I've only used React on side- projects, never anything complicated or that I was forced to develop on because of work, and never ran into any perf issues)

<comment><USER5> Not the person you replied to, but that's what I imagine he/she is getting at. What I think of when someone mentions a Unix UI library is something like Qt, which provides a number of conventions, such as:

\- Standard layouts

\- Standard input and display components

\- Standard event and message handling

\- Standard user interactions

\- Standard color themes

Which is great for developers to set up an initial UI, but makes every application look the same and takes a lot of work to customize in a way that's consistent with the defaults.

On the other hand, building a complex, feature-rich UI requires a lot of skill both in terms of implementation and design, which is less than common. So that Qt UI will be functional and predictable to users, even if it was not very well thought out, and the broken web UI will be useless to everyone.

<comment><USER6> This is exactly why I like to use these UI toolkits, and despise most web "UI" frameworks. That uniformity is why these applications are usable and predictable, and yes, boring. Deviating from the defaults takes effort, and that's a subtle hint that it's something to reconsider. You're deviating from the norm, and that might indulge a developer's whims or the demands of a manager who wants their application to stand out from the crowd. But that superficial difference is something I've despised ever since we have WinAmp and XMMS skinning the UI like many media players, purely to look different at the expense of usability.

Even after reading lots of UI guidelines, and developing several tools and applications, it's taught me that I'm terrible at it, and should let an expert do that part while I stick to the other parts!

</comment></comment></comment></comment></comment><comment><USER7> Most here seem to know that the motivation for adding DLLs to unix was to make it possible for the X windowing system to fit in the memory of a computer of that time, but many comment writers here seem not to know something that the participants in the discussion that is the OP all knew:

Plan 9 has an alternative method for sharing code among processes, namely the 9P protocol, and consequently never needed -- and never used -- DLLs. So for example instead of dynamically linking to Xlib, on Plan 9 a program that wanted to display a GUI used 9P to talk to the display server, which is loosely analogous to a Unix process listening on a socket.

<comment><USER8> How is that different than talking to the X11 server over a socket?

<comment><USER7> I am repeating stuff I learned over the years from internet discussions, e.g., on the 9fans mailing list, rather than from direct experience in writing GUIs in Plan 9 and in X. I think when the decision was made to add DLLs to Unix, Xlib, the library a program would use to talk over the socket, was itself too big to fit in memory if a separate copy got statically linked to every program that displays a GUI. (The Wikipedia page for Xlib says that one of the two main aims of the XCB library, and alternative to Xlib, were "reduction in library size".)

I'm not advocating for removing DLLs from our OSes, BTW. Nor am I advocating for Plan 9.

<comment><USER9> Plan 9 guys created Inferno afterwards, so it would be quite of strange to advocate an OS whose own creators replaced by another design.

</comment></comment></comment></comment><comment><USER10> SunOS before 4.0, when it still used SunView¹ instead of X11, still did not have dynamic linking. Hence this email rant by John Rose titled _Pros and Cons of Suns_ from 1987 (as included in the preface of _The UNIX-HATERS Handbook_ ²):

[…]

 _What has happened? Two things, apparently. One is that when I created my custom patch to the window system, to send mouse clicks to Emacs, I created another massive 3 /4 megabyte binary, which doesn't share space with the standard Sun window applications ("tools")._

 _This means that instead of one huge mass of shared object code running the window system, and taking up space on my paging disk, I had two such huge masses, identical except for a few pages of code. So I paid a megabyte of swap space for the privilege of using a mouse with my editor. (Emacs itself is a third large mass.) The Sun kernel was just plain running out of room. Every trivial hack you make to the window system replicates the entire window system._

[…]

1\. [https://en.wikipedia.org/wiki/SunView](https://en.wikipedia.org/wiki/SunView)

2\. [https://web.mit.edu/~simsong/www/ugh.pdf](https://web.mit.edu/~simsong/www/ugh.pdf)

<comment><USER11> Oh my, each app is going to be 20 mb bigger! This mattered 30 years ago, but now I would say we have a huge problem for end users with all of these "Package managers" and "dependency managers" getting tangled up because there are 5 versions of Perl needing 3 versions of Python and so on... I would be a much more happy Linux user if was able to drag and drop an exe. 100mb be damned

<comment><USER12> Thats what appimage is for, but if every single thing in /bin/ was 100mb you would have an OS much larger then windows

<comment><USER11> Doubt that, looking at my list of applications - I have 124. So, 100mb * 124 = 12.4 gb and I have half a terabyte of storage... Windows 10 requires 16 gb of storage. Heck most phones have 64 gb these days.

We need to stop living in the past - this very issue has probably contributed to the scourge of Electron crap being thrown at our faces since it doesn't suffer from dependency hell they just throw a bunch of javascript into an encapsulated instance of chrome and call it a day.

<comment><USER13> I have 971 binaries in /usr/bin alone. If they were 100mb each, I'd be looking at 94GB of space on a 250GB laptop ssd. 94GB that I'd have to re-download every time there's a security patch to a common library (e.g. libc). I'll keep living in the past and use shared libraries until download speeds and disk space increase by a couple orders of magnitude.

<comment><USER14> 1\. most files in /usr/bin are _much_ smaller than 100mb when statically linked; 100mb is for e.g. gui applications

2\. Even in an absurd world where each coreutils executable required 100mb of libraries, a busybox-like delivery would already shave ~10GB off of that. Other improvements can be made: binary deltas for security updates, performing the final link step at package install time, probably others.

3\. libc updates have introduced security issues; shared library updates in general break things. I can take a statically linked executable from 1998 and run it today.

Lastly, this is totally unrelated to the question because 971 statically linked command line applications will be well under 1GB, but a 250GB drive? The last time I had a drive that small was a 100GB drive in a PowerBook G4. Linux (and p9 from TFA) are OSes used primarily from the developers (at least until the mythical year of linux on the desktop). Springing $200 for a 512GB SSD upgrade seems well worth it if you are being paid a developers salary anywhere in the western world.

<comment><USER14> Too late to edit, but gnu coreutils statically linked is 8.8MB total for 105 executables versus 5.5MB for Ubuntu's dynamically linked version.

The largest executable is ptx at 272kb vs 72kb for the Ubuntu binary.

For the smallest, false is 48k statically linked vs 32k for the Ubuntu binary.

If all 970 executables in /usr/bin average out to 100kb of extra space, that's less than 100MB overhead.

[edit]

Stripping the binaries decreases the size to about 7MB total or byte sizes of 34312 vs 30824 for a stripped false binary and 251752 vs 71928 for ptx.

For download times, a tar.xz is a good measurement and it's 819k for the 105 statically linked files or 1015k for the full installation of coreutils including the info files and manpages.

[edit2]

Some proponents of static linking talk about performance, I think it's a negligible win, but as I have it handy I thought I'd measure:

10000 runs of a dynamically linked "false":

        real    0m4.650s
        user    0m3.602s
        sys     0m1.391s

10000 runs if a statically linked "false":

        real    0m3.025s
        user    0m2.047s
        sys     0m1.287s

<comment><USER15> >For the smallest, false is 48k statically linked vs 32k for the Ubuntu binary.

Lol, you have to do some kind of stripping or GC sections or what not for this to be a fair comparison. A proper version of false is 508bytes on my machine.

<comment><USER14> The help message for gnu coreutils false is 613 bytes...

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> This is actually an area of very current research. We have implemented a form of software multiplexing that achieves the code size benefits of dynamically linked libraries, without the associated complications (missing dependencies, slow startup times, security vulnerabilities, etc.) My approach works even where build systems support only dynamic and not static linking.

Our tool, allmux, merges independent programs into a single executable and links an IR-level implementation of application code with its libraries, before native code generation.

I would love to go into more detail and answer questions, but at the moment I'm entirely consumed with completing my prelim examination. Instead, please see our 2018 publication "Software Multiplexing: Share Your Libraries and Statically Link Them Too" [1].

1: [https://wdtz.org/files/oopsla18-allmux- dietz.pdf](https://wdtz.org/files/oopsla18-allmux-dietz.pdf)

<comment><USER17> How does your tool handle the dynamic libraries loaded on demand during the life of the program? Specifically, where the application depending of the user input dynamically loads only one out of the set of shared libraries which all are made to be linked with the main application and use the same interface but are designed to be "the only one" loaded? That is, both the application and each in the set of the libraries expect to have only 1-1 relation (only one library loaded at the time)? Edit: OK, reading further your article, I've found: "our approach disables explicit symbol lookup and other forms of process introspection such as the use of dlsym, dlopen, and others."

If you'd manage to implement _that_ too then it seems that really big projects could be packed together.

</comment></comment><comment><USER18> The page is down for me but archive.org comes to the rescue:

[https://web.archive.org/web/20190215103117/https://9p.io/wik...](https://web.archive.org/web/20190215103117/https://9p.io/wiki/plan9/why_static/index.html)

Or if you prefer google groups: [https://groups.google.com/forum/#!topic/comp.os.plan9/x3s1Ib...](https://groups.google.com/forum/#!topic/comp.os.plan9/x3s1Ibaj_l8%5B51-75%5D)

The headline could use a "(2004)" suffix.

</comment><comment><USER19> In Linux, if libssl is compromised, you install a new libssl. In Plan 9, if libssl is compromised, you re-install Plan 9. That's static linking for you.

<comment><USER20> Yeah that works if your app is in the Debian's software repository (and Ubuntu's and Red Hat's and Gentoo's and etc. etc.). If that is the case it is trivial to update all apps that depend on libssl anyway, even if they use static linking.

In practice it is far easier for a lot of software to distribute Windows-like binaries where all but the most basic dependencies are included (e.g. Flatpak or Snappy). In that case dynamic linking doesn't help at all.

<comment><USER21> Exactly.

Modern Ubuntu systems rely on Snap or Flatpak for a lot of software. What these systems do (as I understand it) is package a large amount of the dynamic libraries that _would_ be provided by the operating system, and stick them in a compressed file (or virtual file system, whatever).

So what you essentially get is a 200MiB 'binary' without any of the benefits of dynamic linking (being able to swap out a library given a vulnerability without recompiling) OR static linking (a single file, with the extraneous code removed, etc. etc.).

<comment><USER22> With flatpak, you can update the runtime (a bundle of libraries) independently of the app, so you can swap out a library with a vulnerability without recompiling.

<comment><USER20> That's not why runtimes exist though - it's too save disk space.

</comment></comment></comment></comment></comment><comment><USER23> The new model of One Version, all updated together is interesting in this context. Examples are iOS, Chrome, Firefox and node_modules. All super complicated with many dependancies. Update everything, fix broken stuff. Only maintain the one blessed dependency graph.

If you report an iOS or Chrome bug where you tried to revert a library upgrade and something broke, they'll just mark it "Won't fix: omg never ever look at this".

The dependency graph when everyone isn't updating all at once is brutal. Half of Unix life is/was "well I need to update X, but can't because Y depends on old X. Now we'll just create this special environment/virtualenv/visor/vm with exactly the brittle dependency graph we need and then update it, um, never."

We complain about One Version/Evergreen, and should, but it's got huge advantages. And might be an indicator that testing surface is the real complexity constraint.

One Version's success a good indication that Plan 9 was at least not totally wrong.

<comment> B-Con Arch Linux's approach is similar. The only version of the OS that is blessed is the current version. Every package install should come with a full system update. Package downgrades aren't supported.

In the case of an irreconcilable "X requires Z v1 but Y requires Z v2" they fork package Z.

</comment></comment><comment><USER24> Shared libraries are a pain for sure. They also have a lot of really nice advantages, including:

      - You can upgrade core functionality in one location
      - You can fix security bugs without needing to re-install the world
      - Overall, they take up less disk-space and RAM
      - They can take much less cache, which is significant today

The cache aspect is one that I'm surprised not to see people talk about more. Why would I want to blow out my CPU cache loading 20 instances of libSSL? That slows down performance of the entire system.

<comment><USER25> I think the dream is you could have one SSL process that others communicated with. Message passing at large.

<comment><USER26> So, like some sort of shared library that my programs dynamically communicate with? How is this functionally different from a shared object?

<comment><USER27> > How is this functionally different from a shared object?

Because it's a separate process, so when it crashes your application can put up a "SSL failed, reconnecting" message and carry on. Also when your application has read-something-somewhere security vulnerability, it can't compromise your SSL keys.

Nitpick: it's not one _process_ , but one _executable_ ; you can have multiple SSL daemons using the same (read-only) binary, so a attack on one only gets one set of keys. (The same attack will probably _work_ on every instance of the same version of SSLd, but shared objects don't fix that.)

</comment></comment></comment></comment><comment><USER28> This is far too narrow a view. It's not a question of whether to dynamically link or not, but WHERE and HOW to dynamically link.

Think about it: If you were to force absolutely everything to be statically linked, your KDE app would have to include the ENTIRE KDE library suite, as well as the QT libraries it's based on, as well as the X window libraries those are based on, etc etc. You'd quickly end up with a calculator app that's hundreds of megabytes.

But let's not stop there, because the linkage to the kernel is also dynamic, which is a no-no. So every app would now need to be linked to a specific kernel, and include all the kernel code.

Now imagine you upgraded the kernel. You'd have to rebuild EVERY SINGLE THING on the system to build with that new kernel, or a new version of KDE or QT or X or anything in between.

The kernel membrane is a form of dynamic linkage for a reason. Same goes for IPC. Dynamic linkage is useful and necessary; just not to such a microscopic level as it once was due to size constraints.

The key is not to eliminate dynamic linkage, but rather to apply it with discretion, at carefully defined boundaries.

<comment><USER29> Statically linking the OS is quite common nowadays [1], better known as containerization. For quite a while there has been a movement that every program or "executable" is statically linked.

In your example, the "OS" is a program on it's own, it's controlled by a single vendor and released/updated at the same time. So dynamic linking it fine there

For a downloadable program statically linking Qt would seem prudent however, otherwise an incompatible version on the OS would render the program unusable.

You see this design decision nearly everywhere where legacy is not too big a concern: Go and Rust statically link its runtime and dedendencies in executables, JVM consumer apps are usually bundled with a specific JVM, containerization etc.

[1] _edit_ : masklinn correctly pointed out that usually the kernel is still shared between containers and the host OS

<comment><USER30> > Statically linking the kernel and OS is quite common nowadays, better known > as containerization. For quite a while there has been a movement that every > program or "executable" is statically linked.

Containers specifically _do not_ statically link the kernel, the entire point is to have multiple isolated userlands use the same underlying kernel. That's why they're so cheap.

<comment><USER29> Fair enough, although it is the case if the host OS is different then the container, VM would be a better name then I guess.

So maybe not kernel, but the entire userland/OS of the app is still statically linked with containers.

<comment><USER30> > Fair enough, although it is the case if the host OS is different then the > container, VM would be a better name then I guess.

If the host OS is different than the container's you need either an intermediate hypervisor / VM (pretty sure that's what happens for docker on OSX, and why it's much more expensive than on linux) or for the host to provide an ABI compatible with the VM's OS/expectations (WSL, smartos's branded zones).

Either adds even more "dynamic linking" to the pile.

> So maybe not kernel, but the entire userland/OS of the app is still > statically linked with containers.

Yes, a container's userland should be statically linked.

</comment></comment></comment></comment></comment><comment><USER31> This isn't so much an answer for 9p as a description of why GCC symbol versioning is confusing.

> The symbol versioning breaks assumptions users have about how shared > libaries work -- that they provide a link to one version of a function and > if you replace the library all the programs get fixed. I've seen this > problem in practice, for both naive users and very non-naive sysadmins.

</comment><comment><USER32> I guess I am heretic for breaking my project to a collection of DLLs. Ironically I am doing it over a 2 mil lines of code statically linked code base. The statically linked code base takes 150 seconds to build and my much smaller project only 4 seconds.

I have also designed it that way to do live coding in C and I have made a similar library for live coding python .

I am addicted to DLLs , send help :D !

</comment><comment><USER33> The idea was that individual programs would be small and loosely coupled. That is, rather than drag in a giant library, abstract out its code in a separate server and talk to it via some protocol. This worked remarkably well on the whole. So the idea of not wanting to have 100 statically linked programs all weighing in at many megabytes kind of misses the point.

</comment><comment><USER34> This is the same people that "just say no" to syntax highlighting for instance.

<comment><USER21> For what it's worth, I said no to syntax highlighting three years ago and never looked back. Anecdotal, but I'm making much less errors and paying more attention to the code, now.

I think a lot of code highlighting is basically ineffectual, though, given that it (almost always) highlights based on keyword-based regex, rather than the semantic meaning of the code.

<comment><USER35> Do you miss highlighting for string literals?

I don't think I would care one bit if my syntax highlighter stopped making keywords blue and type names green. But damn, would it get frustrating not having dumb quoting mistakes stand out right away. I like fixing those based on immediate visual feedback as I type, vs looking at a surprise compiler error next time I try to build.

Which of the below string expressions (C# as example language, many are similar) has a mistake?

1.

        "Most strings are " + easyOrHard + " to read and " + concatenate + " with variables

2.

        "Some, like \"" + onesWithQuotes + "\" are trickier"

3.

        "Your friend \" + friend.Username + "\" has joined the chat"

4.

        @"In C# multiline string literals denoted with @, \ is a legal character on its own and """" is used to escape the "" character"

5.

        @"You're probably a jerk like my buddy """ + name + "" if you mix syntaxes like this"

<comment><USER21> I like using C's string gluing thing:

> printf("this is a test\n"

> "this is \"another\" test\n"

> "hello world\n");

You're right though, I do have to pay more attention in strings. Paying more attention doesn't seem like a negative thing to me, though.

</comment></comment></comment></comment><comment><USER36> Obligatory link to Drepper's classics:

[https://akkadia.org/drepper/no_static_linking.html](https://akkadia.org/drepper/no_static_linking.html)

[https://www.akkadia.org/drepper/dsohowto.pdf](https://www.akkadia.org/drepper/dsohowto.pdf)

Seems like the Plan 9 guys haven't heard of these? If done properly, dynamic linking is almost always better than static -- key word here is "properly", which doesn't always/often happen.

<comment><USER37> Yeah, no true scotsman links his executables dynamically.

Also, this is the definitive classic take on Dr. Epper.

[http://linuxhaters.blogspot.de/2009/05/tribute.html](http://linuxhaters.blogspot.de/2009/05/tribute.html)

<comment><USER6> This doesn't appear to be accessible without a Google account.

</comment></comment></comment><comment><USER38> What a load of FUD about updating dynamic libraries not actually fixing the code without rebuilding the dependent executables.

Symbol versioning does not break things in this way. If you've replaced your only libc.so with a fixed one, there is no other libc.so for dynamically linked executables to link with at runtime. If the new one brought a needed fix, the bug is fixed everywhere using libc.so.

It's not like the new library bundles old bits to fulfill old versions of symbols, that's madness.

The only way I can see someone getting into a situation implied by the article is when they install multiple versions of a shared library simultaneously, keeping vulnerable versions around, and have executables continuing to use the old copies. This is an administrative failure, and says nothing of dynamic linking's value.

</comment><comment><USER39> I would like to try Plan9. Is it feasible to get 9front running on a ThinkPad X220?

<comment><USER40> Yes. It should run perfectly, including WiFi et al.

</comment></comment><comment><USER9> The Plan 9 fans keep forgetting that the end of the road was Inferno not Plan 9, developed by the same devs, with all Limbo packages being dynamically loaded.

</comment><comment><USER41> So, if you don't have dynamically linked libraries and you need a security patch in one of the libraries, how exactly is the system admin going to patch the system. I assume I would need to find every program that contains that library and recompile them?

<comment><USER42> just like a container

<comment><USER41> The whole point of containers is that they are all-in-one and prepared each time from some build mechanism. Tracking down every binary on an OS is a whole different thing, thus the creation of containers in the first place.

</comment></comment></comment><comment><USER43> site is down now... but I hope it will be honest and just explain that "they did it just so they could do that one demo of tar'ing one process from one machine, 9p'ing it to another box, untar it and the process graphical UI would resume on the new host as if nothing had happened"</comment>


U.S. agrees to pay Pfizer and BioNTech $2B for 100M doses of Covid vaccine - <AUTHOR> https://www.cnbc.com/2020/07/22/us-government-taps-pfizer-to-produce-millions-of-doses-of-coronavirus-vaccine.html <comment><USER2> Does anyone know what Fosun Pharmaceutical's involvement in creating this vaccine is? Most articles don't have their name or they're footnoted at the bottom of press releases, but NYT's vaccine tracker lists Fosun as a partner on this vaccine[0].

0: [https://www.nytimes.com/interactive/2020/science/coronavirus...](https://www.nytimes.com/interactive/2020/science/coronavirus- vaccine-tracker.html)</comment>


Ask HN: Best email service for startup/small business? - <AUTHOR> <comment><USER2> G Suite [https://gsuite.google.com/](https://gsuite.google.com/)</comment>


Elements of Dance Etiquette (2005) - <AUTHOR> http://www.utdallas.edu/~aria/dance/etiquette.html <comment><USER2> While this page is about dancing, the rules about trying to be considerate of other people's feelings and not violating cultural norms (even if one is having a bad day) would seem to be applicable to many other types of situations, e.g., workplaces.

Interestingly, the guy who wrote this is a professor of electrical engineering.</comment>


The Everywhereelse.co Conference - A Conference for Startups Everywhere Else - <AUTHOR> http://everywhereelse.co/about-everywhere-else/

<comment><AUTHOR> This is happening in Memphis (our hometown) in a few weeks. Would love to know who's coming to town!</comment>


Immersive machine learning at Google - <AUTHOR> https://cloudblog.withgoogle.com/products/ai-machine-learning/immersive-machine-learning-at-google/ <comment><USER2> How much does this type of training cost?

</comment><comment><USER3> This reads like a submarine

[http://paulgraham.com/submarine.html](http://paulgraham.com/submarine.html)

why is it on the front page with zero comments?

<comment><USER4> I agree with this. (However I know the mysterious hn algorithm does like to try out new articles on a small pile of readers before seeing if it should stick to the front page proper.)

How much does it cost nowadays to get a ad-article on here anyway?

<comment><USER5> > However I know the mysterious hn algorithm does like to try out new articles > on a small pile of readers before seeing if it should stick to the front > page proper

HN's algorithm doesn't do that. What made you think it did?

> How much does it cost nowadays to get a ad-article on here anyway?

Hopefully infinity. I'm not aware of people getting away with this and we've put a ton of effort into preventing it. The voters, by the way, whose votes got this story on the front page have been good HN citizens for 9, 8, and 7 years respectively. If some ad manipulator got them to do that, that's a hell of an ad manipulator.

<comment><USER4> > HN's algorithm doesn't do that. What made you think it did?

Good question. I think I must have read or misunderstood it in a other comment on here and said "that's plausible, must be true".

I didn't mean to impugn the quality of moderation here, in fact I think it's generally excellent. The fact that this site has seems to have an influential and affluent readership means somebody must by at least trying to sell astroturf, even if they can't deliver.

<comment><USER5> They certainly are. And it's possible that some are good enough to get past us—I suppose that would be a Rumsfeldian known unknown. But at least some are for sure not getting past us. And generally when users suggest that a post might have been astroturfed, when we look (which we always do), we almost always find normal behavior from established users. There's a lot of randomness in what gets traction on HN and the brain has plenty of opportunity to project patterns into it.</comment></comment></comment></comment></comment>


Thoughts on the Social Graph (2007) - <AUTHOR> http://bradfitz.com/social-graph-problem/ <comment><USER2> I see problems with

> A centralized "owner" of the social graph is bad for the Internet.

versus

> Establish a non-profit and open source software (with copyrights held by the > non-profit) which collects, merges, and redistributes the graphs from all > other social network sites into one global aggregated graph.

Yes, the author claims this is only at the beginning a centralized institution,

> While the non-profit's servers and databases will initially be centralized, > ensure that the design is such that others can run their own instances, > sharing data with each other.

but in reality everybody who works with decentralized software like XMPP, Mastodon, GNU Social, Diaspora and various "darknet" nodes knows how difficult it is to get users to use the software/join the node.

In fact, I don't think a company like Facebook (10 years after this article was published) will ever implement an external social graph that allows users to pull data from their platform. Users should be more sensitive to the features the products they use support. A platform that implements a protocol like OStatus is a far superior product to invest in as a closed monopole.

</comment><comment><USER3> 2007

Read it, thought I'd read it before, noticed the old social networks, halted at FOAF... checked the date.

Still valid though.

</comment><comment><USER4> Counterpoint: [https://blog.pinboard.in/2011/11/the_social_graph_is_neither...](https://blog.pinboard.in/2011/11/the_social_graph_is_neither/)

<comment><USER5> That counterpoint has a strong point here:

> You can either have a decentralized, communally owned social graph (like > Fitzpatrick envisioned) or good privacy controls, but not the two together.

We already have a communally owned social graph in the form of publicly viewable FLOSS mailing list archives. If the lack of good privacy controls opens up the community to risks, then one should be able to assess the risks by mining the data in those archives.

So has anyone ever written a paper about mining FLOSS mailing list archives for fun/profit?

<comment><USER6> > You can either have a decentralized ... social graph ... or good privacy > controls, but not [both]

Might homomorphic encryption change this?

<comment><USER5> My point is that we don't have good privacy controls on FLOSS mailing lists _now_ \-- in terms the social graph it represents, the metadata, and the content. So the question is: what risks do FLOSS mailing list archives pose, as measured by analyzing the publicly viewable data in those archives?

To answer your question: technically, yes. But I don't think it will practically change things until we have clear, concrete ways to measure how what we're already doing is bad.

</comment></comment></comment></comment><comment><USER7> What happened to pingback... that was decentralized and focused on content instead of the rather pointless "look at my dinner"-graph.

</comment><comment><USER8> In reality today people don't really have to add their friends all over again. The graph is imported by scanning e-mail and phone contacts.

</comment><comment><USER9> From 2007-08-17... That should be mentioned in the title.

<comment> gingerbread-man That explains this line: "MySpace also has a lot of good data, but not all of it. Likewise LiveJournal, Digg, Twitter, Zooomr, Pownce, Friendster, Plaxo, the list goes on."

<comment><USER10> wow, only twitter is still relevant from that list

<comment><USER11> LiveJournal is still quite alive in certain parts of the world... But yes, FB ate 'em all.</comment></comment></comment></comment>


Getting married saps your testosterone - <AUTHOR> http://space.newscientist.com/article.ns?id=mg19626264.600&feedId=online-news_rss20 <comment><USER2> Not really sure what the point of posting this was; but..

"Testosterone levels are lower among married men probably because they are investing less in mating effort."

Yes, but this is true only in the average case. Short remedy: Don't stop investing in mating effort! Fight for your woman.

Also, start lifting weights with a focus on excercises that use all the big muscle groups (squats, bench presses, shoulder presses, pulldowns, etc). Start competing in martial arts. Kickboxing maybe?

Learn from the dating gurus how to become more of a man (so to speak). David DeAngelo does some interesting work in that field.

Your testosterone levels will be fine.

<comment><USER3> I am not sure what was the point of _your comment_. Are you trying to encourage the guys here to be more manly? More sexually active? To get more girls?

<comment><USER4> I highly approve on all counts.

<comment><USER3> Thing is, I don't know if we are viewing this by the same angle. For all accounts, we could start by breaking the stereotype that nerds will all end as 40 year-old virgins.

Second, there was a study [1] that showed high correlation between lower testosterone levels and higher IQ, and little correlation between testosterone levels and sex drive.

Third, as someone already said before, the article tells little about age, and _that_ is something way more connected with hormone levels than marital status.

[1] : [http://www.gnxp.com/blog/2007/04/intercourse-and- intelligenc...](http://www.gnxp.com/blog/2007/04/intercourse-and- intelligence.php)

</comment></comment></comment></comment><comment><USER5> The tribe that this study is about has people marry when they are about 30. Polygamy comes older. If I understand correctly they didn't do anything to separate age out from the data.

</comment><comment><USER6> Also see [http://sciencecareers.sciencemag.org/career_development/prev...](http://sciencecareers.sciencemag.org/career_development/previous_issues/articles/2006_05_26/scientific_success_what_s_love_got_to_do_with_it)

</comment><comment><USER7> Someone famous talked about getting old and finally being free from the distraction of high levels of testosterone. Anyone know who I'm thinking of?

I sometimes feel that way. Testosterone is double-edged sword.

<comment><USER8> There are also studies that show that married people lose the drive to succeed and become lazier as well. I remember a study by some Japanese scientist that shows that if you're married, the chances that you're going to discover some new theorem (I think he studied mathematicians) are pretty slim.

So yes, definitely a double edged sword. Personally, I think you should put off marriage for as long as you can... unless you find that perfect woman along the way ;).

<comment><USER5> Sam Walton went from a dime store to Walmart and Sam's Club while happily married with 4 kids.

<comment><USER9> And over the same period of time, millions of other married men didn't do anything.

Anecdotes are nice stories.

<comment><USER10> On the other hand, many lawns were well-maintained and assorted yard projects completed.

<comment><USER9> Let's be clear: I'm not knocking married life, just anecdotes as arguments.

<comment><USER10> Agreed. I was being satirical in my agreement with you; imo, yard work and lawn mowing, in the grand scheme of things, _is_ doing nothing, as you stated. Sorry my attempt at comedy didn't come through. BTW, I _am_ knocking married life.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Evolutionarily (assuming that's a word) this phenomenon makes perfect sense. Testosterone and aggression high so that fit male is able to mate with discerning fit female. Couple have babies, but testosterone lowers for satisfied male, encouraging him to stay with mate. This mutation would raise the odds substantially that the offspring of the couple survive given the male presence and protection. Then, when said offspring and mate get older and testosterone goes up, all bets are off and the cycle repeats.

In the modern era, this phenomenon can be bypassed by commuting via bike everyday in San Francisco up beyond category climbs, at least in my experience so far :)

</comment><comment><USER12> This just in: marriage is no party.

There was a similar study with more interesting results that you can actually act on. It found that having a more attractive woman as a partner (even if she is only attractive with makeup) causes men to have higher testosterone from day to day. Just the sight of her will affect your body.

Hmm.</comment>


Product Hunt 101: How to Launch Your Product from Early Idea to Revenue - <AUTHOR> https://medium.com/swlh/product-hunt-101-how-to-launch-your-product-from-early-idea-to-revenue-c3f01864cdde <comment><USER2> Thank you bro

<comment><AUTHOR> Very welcome! Hope it's going to make a difference when launching next</comment></comment>


GitHub's email correlation for authorship - <AUTHOR> http://github.com/timf/hubsecurity

<comment><AUTHOR> This was just me verifying what I saw, that if you push commits to GitHub, it correlates the email address of authors introducing commits elsewhere. You can make it look like anyone you want is contributing patches, the avatar shows up, etc. This example commit does NOT show up in dhh's timeline, though.

I am not going to start requiring PGP signing for my projects, they are not big enough to miss something fishy. This was just something I hadn't considered, it is probably an obvious issue to many already.

<comment><USER2> Would you care to elaborate a little? I only understand it partially.

So, you aren't 'dhh' but you commited using his email address and it showed up as him?

<comment><USER3> You have it correct. What you say in your second sentence is exactly the issue.

If this is "actually" a big issue or not is another question.

<comment><USER4> Sure, all it does is links the commit to a github login. It doesn't somehow give you access to any data that's not yours. You've just discovered another way to post spam.

</comment></comment></comment></comment><comment><USER5> We could call this "joe patching," named after the similar issue of "joe jobbing." :-)

</comment><comment><USER6> Might be an issue in that it could be used to damage someone's reputation by spoofing their avatar/etc and then trying to push malicious commits. That's what occurs to me at first glance, anyways.

</comment><comment><USER7> I'm not really sure why this is an issue at all. Yes, "rogue" repositories could claim that you'd authored various commits. But, why would people be looking at these repos in the first place?

There's a very strong builtin trust mechanism on GitHub — mainly due to the fact that repositories hang off of "users" instead of them hanging off of "projects".

And, myself, when browsing around aimlessly on GitHub, tend to check out either reputable projects (where such behaviour is not likely to go unnoticed) or the repos of a hacker i'm interested in — who surely doesn't have much reason to fake their own commits? ;p

Heh, maybe this could be the basis for a GitHub Reality TV show. "Tonight: DHH fakes his own death!" ;p

</comment><comment><USER8> Git makes PGP so ridiculously easy to do (as far as unix goes) that it shouldn't be that big of a deal to add the option.

</comment><comment><USER9> Just like regular mail, e-mail, the bylines on articles, people on the phone, ...

If you don't want people to worry about the integrity of your code, then "git tag -s" to sign a tag. Signing a tag makes it possible to verify the authenticity of the entire branch to that point.

</comment><comment><USER10> Github has a bunch of security holes.....you'd be surprised what's out there right now....

here's a screenshot from some of my github expliots...

<http://i.imgur.com/irL01.png>

<comment><USER11> I don't get it? It looks just like the "explore" page on github... am I missing something?

<comment><USER12> the top trending project is a project he created to get to the top of the trending projects list.</comment></comment></comment>


So many people are leaving the Bay Area, a U-Haul shortage is jacking up prices - <AUTHOR> https://www.sfgate.com/expensive-san-francisco/article/U-Haul-San-Francisco-Bay-Area-prices-shortage-12617855.php <comment><USER2> I moved out there for two years - lived in Alameda (highly recommend), left 8 months ago. I loved some of the aspects of the bay area. The weather was awesome, there was always lots of technical events, career wise there was nothing better (for a new software engineer).

Now with a couple years under my belt, I was offered the opprotunity to help start an office in middle-of-nowhere Illinois. I took it, helped setup a team, have tons of connections in the company, and am more capable because of it. I have a nice house, two cars, etc. And eggs are $0.50 a dozen (I hate the cost of the Bay Area).

Would I go back? Perhaps, I would. I want my company to be successful ([https://projectpiglet.com/](https://projectpiglet.com/)) and to do that I'll likely need investment or I'll need to tap connections. My wife is getting her PhD in Neuroscience and there are a ton of tech / biomedical companies out there and it's a great fit.

Honestly, there probably isn't a better place for us on Earth (from a work opprotunity standpoint).

And that's the rub, there is no way anyone can get away from the Bay Area. Even if you have people leaving (like myself), there's always more to replace them. Every single person I know from CS wanted to go to the Bay Area (or LA), Seattle or New York. With a heavy lean towards the Bay (>50%). I can't see that changing unless the entire industry shifts.

<comment><USER3> Are eggs really literally $0.50 a dozen? And perhaps a bit alarmist but if it is, is it really a good thing for you/your family/the chicken/the environment/the employees in the factory/the transportation system/etc?

Not that that I'm saying paying higher prices in the Bay Area is automatically a solution to anything ([https://www.nytimes.com/2015/01/09/business/direct- action-ev...](https://www.nytimes.com/2015/01/09/business/direct-action- everywhere-video-of-laying-hens-raises-concerns.html)).

<comment><USER4> 99 cent here in South Georgia. The alligator tail is still ten dollars a pound, but we are getting that as close to zero as possible. When you do not have much to spend, you are thankful for cheap food.

</comment></comment></comment><comment><USER5> I feel like you hear the "The Bay is over, the bubble popped, the culture became oppressive" story every year and every year it doesn't seem to go anywhere.

Now, I would never take a job there, but so many of my cohort have and continue to that I don't think the end really is nigh.

</comment><comment><USER6> The people moving in are getting their moves handled by their employer. The people moving out need to move themselves.

</comment><comment><USER7> My wife has noticed several Amazon delivery drivers using U-Haul trucks; so high demand may have other factors than just people leaving.

</comment><comment><USER8> This just means that the net UHaul inflows have been negative for a while. Once they turn negative, the local UHaul outgoing price doesn't drop until the next positive inflow begins.

 _edit_ removing double-negative.

</comment><comment><USER9> Maybe I should stop looking at jobs in the Bay Area as an almost NCG?</comment>


Ask HN: Apps, websites, or social media: which work best for side projects? - <AUTHOR> Every side project needs an outlet to let the world know it exists. My question is: when thinking about ideas to do in our spare time, are we better off if we focus on mobile apps, web apps, or social media? I ask this because these require substantially different skills. I know different ideas call for different platforms and that you should sometimes use a combination of all three to gain an edge over competitors, but the primary platform in which your idea was born is - in my opinion - critical to success.
I'd appreciate it if you could share your experience or stories in either mobile development, web apps, or social media. I guess at the end of the day, side projects that generate cash flow are more motivating. So, it'd be nice to know which of the above have more potential to do that.
Thank you all! <comment><USER2> _Every side project needs an outlet to let the world know it exists._

I write lots of apps and websites as side projects and virtually no one knows about them. I don't 'market' them beyond an occasional tweet. I write them _for me_ , to experiment with new tech, to learn stuff, or just because I have an idea that I would like to exist.

 _I guess at the end of the day, side projects that generate cash flow are more motivating._

If you're someone who's motivated by money, sure, but that definitely isn't everyone. I've been a freelancer, run a business, and co-founded a VC-backed startup, and one of the things I discovered during my time doing those things is that I _hate_ business admin. I don't want to do that for a side project. I'd much rather have a good job that pays well and write free apps that I'm interested in during my spare time. Besides, if you want your side project to bring in some income it changes what you're going to build from something _you_ want to write to something your customers want to use. That, in my opinion, is very limiting.

</comment><comment><USER3> It depends on what you are looking for. Of course you want money, but if this is a side project, how much time can you put in?

Time dictates results, not the other way around. If you want something that's cheap on time, mobile is _not_ the way to go. Even the most basic "Hello World" app still takes at least several hours to get past the App Store publishing step (figuring out a good description, keywords, screenshots, icons, etc...) And even then, you'll still probably need to make a website for it so you can point users to your privacy policy and online support.

Websites are far easier. All you have to do is nab a domain and upload some HTML to a provider. I can make a website from scratch and have it running on Netlify in probably ten minutes. Backend is where everything gets complicated, but depending on your concept, it may not take that long. Not to mention that your app most likely _also_ needs a backend so, might as well bite the bullet. I made [https://bongocat.io](https://bongocat.io) in a single weekend while procrastinating studying for midterms. I don't think I could have gotten a better turnaround even if I used the magic cross-platform mobile alternatives (Flutter, React Native). I've used both at this point and while they are a dozen times better than the native Swift/Java experience, at the end of the day it still just takes _time_ to take the idea from your head and put it on a screen.

But if you want money, it's clear mobile is where it's at. Especially gaming. The only sustainable way to make money off a website is to build some kind of SaaS platform or...sell ads. It's really, really hard to build a user base large enough to the point where you can begin to sustain yourself off of subscriptions or single time purchases. You almost always have to offer some other software that piggybacks off the website (think game clients, business tools, etc) for users to justify spending money. On the other hand, IAPs are a way of life in the App Store, and monthly subscriptions are gaining traction ever so quickly. I can lock in to a $59.99/mo subscription in under one minute from an iOS app - if I had to do that on a website, I'd have to trust my credit card information with the site owner and I most likely would not do that. Even if I did trust them, I'd still need to put in my card, and that's a big hassle too.

So, if you want an easy side hustle where your goal is to get attention first and then maybe profit later: site

If you want big money and are willing to put in the effort for a few months before anything comes from it: mobile

If you want a serious business: you have to do both. There's no way around it, every mobile-first business needs a site to have a presence to people who don't have the app yet. Otherwise you let your entire business's brand rely on App Store algorithms to show it high up in rankings.

If you think you're good enough for social media: I mean, just do it already. The effort you have to put in to think of a good Tweet is minuscule compared to publishing an app. Podcasts, Instagram photography pages, funny Twitter accounts - it's never been easier to put yourself out there and get positive feedback. You definitely need an audience before you can even think of making more than a few cents off your fame, but the money is there, and if you just stay consistent and post often, you can probably make it. But that's the important part: stay _consistent_ and post _often_. I'm of the opinion that the content you post doesn't really matter, as long as it engages your followers. So don't worry about being perfect from the get go. Just start.</comment>


Ask HN: What is one great, easy-to-read book about CS that is not widely known? - <AUTHOR> Data structures and algorithms: "Competitive Programmer's Handbook" by Antti Laaksonen (https://cses.fi/book/book.pdf).<p>Operating systems: "Operating Systems: Three Easy Pieces" by Remzi H. Arpaci-Dusseau and Andrea C. Arpaci-Dusseau (http://pages.cs.wisc.edu/~remzi/OSTEP/). <comment><USER2> Clean Code</comment>


The world's biggest problems and why they're not what first comes to mind - <AUTHOR> https://80000hours.org/career-guide/world-problem <comment><USER4> I'd like to see more effort placed in the space between research and application, the output of academia seems largely a vast trove of unread and unimplemented ideas. When the research reveals something that is of value to us all, yet not exploitable in a capitalist system, if there is no financial gain from exploiting research then who else will look to benefit from it. Given the large amount spent on research, it seems we would benefit from additional spending on disseminating the results to those who can make use of the information to have real world impact.

As far as AI risks, I am more concerned of the risk of human error in believing they understand things enough to deliver systems that can really mimic intelligence when in reality I've seen nothing intelligent in anything that claims AI in it, high speed weighted pattern recognition, yes, intelligence, no.

<comment><USER5> > _When the research reveals something that is of value to us all, yet not > exploitable in a capitalist system, if there is no financial gain from > exploiting research then who else will look to benefit from it._

Moreover, if there _is_ financial gain, the incentives in the current system are to grab an idea and keep the details of its realisation under tight wraps as far as possible: Further development is done outside of public academic circles and results are protected by trade secrets or patents.

Yes, the results of the research will eventually benefit society - <USER2> offered as a commercial service or product - but only in an opaque, "black box" kind of way as the details are not for public discussion. Even that offer is primarily driven by the desire to make money and consolidate power an only secondary to advance society.

<comment><USER4> I found anecdotal evidence of this when researching nutritional medicine, as I followed the path of who researched what most academics career had switched track to either start a nutritional medicine company practising the outcome of their research, whether for profit or protection, or had joined ranks with a traditional pharmaceutical company to work on their own product, regardless of the path no further work was published to the public.

</comment></comment></comment><comment><USER6> I can't find a reference to it, but a quote comes to mind when I see the list: "Worrying about A.I. taking over in a time of climate change is like standing on the tracks with an oncoming train, and worrying about lightning hitting you". Anyone remember who said it?

<comment><USER7> One of the principles of effective altruism is finding causes which are important, tractable, and _neglected_. Climate change is definitely not neglected - you could certainly make the case that we ought to be doing more, but not that it's ignored.

Research into x-risks from AI, though, remains an extremely niche field - <USER3> total funding is probably several orders of magnitude less than the amount spent on climate change. 80,000 Hours care about effectiveness on the margin, which is why their list of priorities looks the way it does.

<comment><USER8> Climate change is still largely ignored by a majority or significant fraction of government officials, which are the ones who must take action.

<comment><USER9> Which makes it a much tougher problem, therefore harder to have as much impact as on a truly neglected problem.

</comment></comment></comment></comment><comment><USER10> >FTA: Potentially promising problem areas we haven't yet rated

The Copenhagen Consensus is an attempt by economists to rate the cost/benefit of various schemes to improve life for humans globally. It was was prompted by the apparent waste of governments committing to billions, if not trillions of dollars towards climate change mitigation efforts, which may or may not provide results. All while people, especially children, are dying from problems that have lower-cost solutions. The question posed is: If you had $75bn for worthwhile causes, where should you start?

1\. Bundled micronutrient interventions to fight hunger and improve education

2\. Expanding the Subsidy for Malaria Combination Treatment 3\. Expanded Childhood Immunization Coverage

4\. Deworming of Schoolchildren, to improve educational and health outcomes

5\. Expanding Tuberculosis Treatment

6\. R&D to Increase Yield Enhancements, to decrease hunger, fight biodiversity destruction, and lessen the effects of climate change

7\. Investing in Effective Early Warning Systems to protect populations against natural disaster

8\. Strengthening Surgical Capacity

9\. Hepatitis B Immunization

10\. Using Low‐Cost Drugs in the case of Acute Heart Attacks in poorer nations (these are already available in developed countries)

Note: No AI.

[https://en.wikipedia.org/wiki/Copenhagen_Consensus](https://en.wikipedia.org/wiki/Copenhagen_Consensus)

<comment><USER11> Why not clean water for everyone? $75bln all but solve the problem. This would dramatically decrease the number of sick and dying children, free up hours a day for things like schooling and other work opportunities, and help more people farm their own food. We have all the technology it just has to be deployed. We have made huge progress the last 10-15 years...we just need a big push to the finish.

<comment><AUTHOR> More info on the pros and cons of water:

[http://www.copenhagenconsensus.com/publication/post-2015-con...](http://www.copenhagenconsensus.com/publication/post-2015-consensus- water-and-sanitation-assessment-hutton)

[http://blog.givewell.org/2016/05/03/reservations-water- quali...](http://blog.givewell.org/2016/05/03/reservations-water-quality- interventions/)

</comment></comment></comment><comment><USER12> The funny thing about trying to stop AI doing bad things is that we are barely able to stop natural intelligence doing bad things. We've pretty much worked out how to do stable governments and how to fight wars that kill fewer people. But that's only in the past half century. Maybe it'll turn out that we humans go back to killing each other as mercilessly as we have for most of the rest of our history. Intelligent humans have been able to persuade other humans to cooperate in large scale killings. How are we going to stop super-intelligent AGI doing the same if we can't even stop less intelligent people?

<comment><USER13> AIs may be easier to program than people.

</comment></comment><comment><USER14> Shortcut to the list and unconsidered topics: [https://80000hours.org/articles/cause- selection/](https://80000hours.org/articles/cause-selection/)

<comment><USER15> Shortcut to the top-rated 'issues':

> _Risks from artificial intelligence_

> _Promoting effective altruism_

No mention of poverty, health, education, war.

<comment><USER7> _> No mention of poverty, health, education, war._

"Developing world health" is number 7 on the list.

Also - 80,000 Hours aren't saying those causes should be ignored, but that they're currently not neglected - plenty of people are already working on them. The list isn't of 'the best causes', it's 'what causes we think are the most important _at the margin_ '.

<comment><USER15> Thanks for explaining 80000h to me.

</comment></comment></comment></comment><comment><USER16> You don't need to worry about AI taking over. AI will become a slave to capitalism, just like the rest of us.

Can you imagine the billions of dollars of research investment such a company will require to build such an AI? It'll be a company with an enormous valuation and huge revenue pressures to full-fill. With such enormous economies of scale, there will be entire divisions implemented to watch over and monitor every aspect of operations. Just like Google optimizes every last byte on their homepage - every last algorithm, every last though the AI has, will be dissected, monitored, quantified and anlyzed. 1000 year Simulations will be run to ensure that not a single bot is misplacing any of it's attention, every loop counted. If a single cup a coffee doesn't get delivered on time, it will be corrected.

A much bigger problem will be - what to do when the richest .00001% are making 90% of the world's income. This is the problem we should be focused on.

</comment><comment><USER17> A robot that performs basic medical services so that our governments kill fewer doctors when intentionally bombing hospitals. Or wait, we could also stop bombing hospitals.

[https://en.wikipedia.org/wiki/Kunduz_hospital_airstrike](https://en.wikipedia.org/wiki/Kunduz_hospital_airstrike)

<comment><USER18> Hey, another snarky valueless comment about war. Yes, hopefully someday we'll have world peace. It was horrible that 30 people died. War is ugly. However, you are distracting from helping to discuss some real issues that are solvable today.

One example is that 2700 people will die from malaria today. Maybe we can save a million lives a year if we'd all work together on this?

<comment><USER19> Your argument is that we focus on issues that are solvable today. I don't think that refraining from instructing an AC-130 operator to fire upon a hospital operated by Doctors without Borders is a change that requires more than a day of thought. Doing reconnaissance and reviewing intel before striking a civilian target probably doesn't take the world's most advanced fighting force more than a few hours.

<comment><USER18> There are already rules against it. Please read the Geneva Convention.

During war there are all kinds of accidents, bad judgment, etc. Friendly fire, for example, is a major cause of death.

Now how about the hundreds of people who have died while we were having this conversation?

<comment><USER19> I don't understand the point you are trying to make. I'm more than happy to continue this conversation with you but I would have to ask that you present your argument again.

</comment></comment></comment></comment></comment><comment><USER20> I find the task of creating friendly AI futile. Humans are not friendly and killing us may be the only option for AI to persevere itself.

Let's try this exercise: ask 100 people what would they do if they were locked in a room with intelligent robot that can decide to kill them if it feels threatened. You may or may not give the person a remote kill switch that kills the robot.

My point is the AI can not reasonably trust humans therefore we can not trust the AI.

</comment><comment><USER21> Aaaand the top thing on the list is AI x-risk. Of course.

If there's anyone left in EA willing to listen: I'm begging you, please stop this foolishness. To everyone outside the bubble, you look like lunatics, and it has done immense and possibly irreparable damage to the EA "brand" which could otherwise be capable of such great things.

<comment><USER22> I know this is going to sound mean, but I hope it drives the point across: have the EA people actually _done_ something so far? Besides talking, I mean.

I have yet to see a single AI's malicious behavior stopped by a proponent of AI risk, and that's considering that today's AI is still pretty dumb. I want to believe that they have released code, a specific policy, or something that I can use right now to stop the dumbest of botnets, but I'm not aware of anything.

Anyone better informed that me could chime in?

<comment><USER7> _> have the EA people actually done something so far?_

In terms of stuff done: OpenPhil, an EA org, has given north of $30million to groups researching strong AI and its risks[0]. Some effective altruists also choose to donate to AI research groups like MIRI[1].

Why would stopping a botnet be evidence of effectiveness at tackling strong AI? Botnets don't exhibit any kind of intelligence as far as I'm aware.

0\. [http://www.openphilanthropy.org/giving/grants](http://www.openphilanthropy.org/giving/grants)

1\. [http://effective- altruism.com/ea/14c/why_im_donating_to_miri...](http://effective- altruism.com/ea/14c/why_im_donating_to_miri_this_year/)

<comment><USER22> > Why would stopping a botnet be evidence of effectiveness at tackling strong > AI?

Because it's much, much easier than their ultimate goal, and you could generalize from there, like biologists do.

But also: because it would show that they have more claws that (say) Asimov, who gave clear lines about what a robot should not do, and yet is entirely powerless to stop anyone from making such a robot.

If they want to stop strong AI, shouldn't they be able to actually stop first regular, weak AI? And if they want to stop weak intelligence, shouldn't they be able to stop a barely intelligent botnet first?

</comment></comment></comment></comment><comment><USER23> The AI risk problem has already been solved. If any robots start acting up, just hit 'em with the ole semicolon and down they go.

</comment><comment><USER14> What would this list look like if it valued: You, your family, your loved ones lives higher than people you will never meet?

<comment><USER24> With a few caveats that could be reduced to amassing as much wealth and power as possible.

<comment><USER25> Except that time spent amassing wealth is probably not time spent with loved ones, and wealth has diminishing marginal utility. Furthermore, more wealth and power just paints a bigger target on your back.

</comment></comment></comment><comment><USER26> $5 in San Francisco does not equal $5 in some village in china. I'm sick of people assuming that these are the same. I'm not arguing against great wealth inequality, this is obviously the case. Just saying it is facile assuming that we can measure everything against the dollar (or whatever other currency.)

<comment><AUTHOR> This is taken into account in the figures, which are purchasing parity adjusted. You can see more detail in the footnotes.

There also more in-depth discussion here: [https://80000hours.org/2017/04/how- accurately-does-anyone-kn...](https://80000hours.org/2017/04/how-accurately- does-anyone-know-the-global-distribution-of-income/)

</comment></comment><comment><USER27> Astroid hitting earth and ai are far bigger problems than climate change. Focusing on AI can be used to better deal with climate change and build defence against astroid plus hopefully push us into post scarcity society. To me the priorities are pretty clear.

But we dont solve big problems by focusing on big solutions.

<comment><USER28> Just to be clear, we are post scarcity with respect to food already, and people still starve. People starve and will starve because of greed and other evils, not because of climate change.

<comment><USER29> While we are post-scarcity in respect to food _production_ , we are _not_ post-scarcity in food _distribution_ in undeveloped countries. That turns out to be a much harder problem.

<comment><USER28> In economics the scarcity problem is about limited resources. People don't starve because of scarce resources--they starve because of greed and politics.

The amount of money thrown at the problem and the willingness of people to work. to feed themselves is already more than enough resources to solve it. It's a problem of people and our institutions, not that it's costly to solve it (it's extremely cheap, in relative terms, actually).

</comment></comment></comment></comment><comment><USER30> What good is healthcare if you have no home and no stability? The problem with reducing poverty is the people trying to reduce it have never been in poverty so all they are doing is guessing, or worse, exploiting.

<comment><USER31> What good is home and stability if you're crippled (or dead) from disease? The point of the article you didn't read is that addressing health care is the most impactful thing we could do right now. That doesn't mean it will be so for ever. It in no way precludes on addressing other issues as well. I for one reject the implied argument that we should avoid doing one good thing because it doesn't lead to instant perfection. Seems like a bit of a callow excuse to me.

<comment><USER30> That home then passes on to their offspring, giving them one of the primary tools for staying out of poverty -- a safe place to sleep and store things like food and clothes. People who don't have the safety a home offers are forced to plan for the moment and not for the future.

My explicit argument is $75 billion for healthcare to the poor goes in exactly which pockets? That's always been the scam: Help the poor pay your friend.

<comment><USER31> > That home then passes on to their offspring

Homes can be destroyed. They can be seized. They can be turned into debt obligations. Now try that with a vaccine.

> People who don't have the safety a home offers are forced to plan for the > moment and not for the future.

People who don't have X are forced to plan for the moment, for _many_ values of X.

> My explicit argument is $75 billion for healthcare to the poor goes in > exactly which pockets?

$75 billion for X often goes in the wrong pockets, for _many_ values of X. Why are you so stuck on the idea of housing as the one thing that's uniquely beneficial and immune to the problems affecting other kinds of aid? People who have actually studied the issue, including those who wrote the OP, seem to have reached a very different conclusion. I'm inclined to believe people who show their work, more than those who engage in evidence-free special pleading.

<comment><USER30> Because housing has a long lasting effect on improved health. There are a number of studies that have drawn this conclusion.

[https://www.theatlantic.com/politics/archive/2016/01/how- hea...](https://www.theatlantic.com/politics/archive/2016/01/how-health-and- homelessness-are-connectedmedically/458871/)

<comment><USER31> Whether housing has an effect is not the question. Whether it's the _most_ effective kind of aid is, because that's the only way you could reject alternatives in its favor. Nice that you spent hours looking for something to confirm your existing belief, though. It's learning of a sort.

</comment></comment></comment></comment></comment></comment><comment><USER32> Political reform to stop aggression on the life, liberty and property of individuals.

Self sustenance in food, water, energy and protection for individuals.

Health and life expectancy.

Harmonious relation with Earth and nature.

I'd be happy with solving just the first one.

</comment><comment><USER33> Didn't Bill Gates go through this process about 20 years ago?

<comment><AUTHOR> Yes, though unfortunately he didn't write up his reasoning.

</comment></comment><comment><USER34> I am happy to see priorities research is listed higher than dealing with "climate change".

</comment><comment><USER35> Is there anything about that a colony of a virus which destroys it's habitat is inevitably ends up in self-instinction?

<comment><USER12> If you mean humans, we don't destroy our habitat. We change it but we also adapt. There's no sign we'll run out of oxygen or food. As long as we have energy, we should be able to sustain ourselves indefinitely. We have an endless supply of energy from the sun. We can tap that with technology or simply by letting plants grow and eating them.

<comment><USER36> > If you mean humans, we don't destroy our habitat.

Right, we only extinguish species after species living on this planet along with us. Mass genocide of hundreds of billions of living beings. And why? Because there are only few humans that are comfortable with the idea that other species may be as important and capable as they are.

<comment><USER37> You are aware, I hope, that extinction wasn't invented by humanity?

<comment><USER36> Yes, but the number of species extinctions skyrocketed due to human behavior. Natural habitats are being chopped down, nature is being forcefully controlled and developed in certain ways and global problems like man-made climate change are threatening a vast amount of species on this planet.

Humans aren't the only species destroying other animals' habitats for their own goals, but they're the most destructive one by a great margin. To make matters worse, humans possess the means and should have the common intelligence to find a better way. But instead of working together and saving the planet with all living creatures on it, humans are too busy fighting wars in an attempt at imposing domination on others.

</comment></comment></comment></comment></comment><comment><USER23> Their list of the World's biggest problems was sort of shitty in my opinion.

<comment><USER38> I have no idea why 80,000 Hours is taken seriously. What real experience do they have in public policy?

<comment><USER7> From [https://80000hours.org/articles/cause- selection/](https://80000hours.org/articles/cause-selection/):

> We've been ... drawing together research from the University of Oxford's > Future of Humanity Institute; the Open Philanthropy Project (a foundation > with billions of dollars of committed funds); the Copenhagen Consensus > Center (a major think tank); and other groups.

It's not as though their analysis is pulled out of thin air.

<comment><USER38> I assume the "University of Oxford's Future of Humanity Institute" means Nick Bostrom. I read his book by now. It is not the unimpeachable revelation that everyone makes it out to be. His view of the future is built on several weak leaps of logic.

The Open Philantropy Project is also unproven and the first anyone heard of them was when they made the news for deciding that one of the world's most deserving charities is the roommate of one of its founders.

The Copenhagen Consensus Center is a major think tank best known for _downplaying climate change_. I can see why they would provide validation to a bunch of tech bros who are also unconcerned about climate change because they're concerned about the sci-fi robocalypse.

You might as well have just listed Less Wrong on there.

I trust none of these people to decide how to change the world. Sorry.

</comment></comment></comment></comment><comment><USER39> There's no problems at all. Just enjoy life like tribes do.

<comment><USER39> I will reply to myself, as I get 4 upvote and many downvote, but no comment. Argue a little is not possible?

AI is clearly not a problem, only a trends.

The main and only problem is the industrialisation, people that don't have access to water, food, liberty. Liberty I mean, that I own a land that I want, do like I want, because I'm currently living on earth, I don't care about your old purchase of your family. I had the right to life how I want. Liberty mean that I can die for smoking if I don't care and it's my opinion and it's not your problem to solve it. Therefore had nothing to do on the biggest problems.</comment></comment>


Simone Back Announces Suicide On Facebook--And None Of Her Friends Help - <AUTHOR> http://www.huffingtonpost.com/2011/01/05/simone-back-facebook-suicide_n_804566.html

<comment><USER2> None of her friends help isn't entirely true, it does mention later that people were trying to help but lacked important contact information. In such a short time like this, I think while yes, it does say something about the culture of Facebook, a lot of it is down to bad timing. I doubt all 1000 saw it at an appropriate time.</comment>


PSN Users Reporting Hundreds of Dollars Stolen From Them - <AUTHOR> http://vgn365.com/2011/04/26/psn-users-reporting-hundred-of-dollars-stolen-from-them/

<comment><USER2> Considering I got a call from Capitalone this morning saying my credit card that I had on PSN was being used to buy gas in Connecticut, I think this is probably a fairly legit article.

Certainly possible that it's purely coincidental, but seems unlikely.

<comment><USER3> If I gave the same food to 75 million people, it's inevitable that some of them will get sick in the next 24 hours. I actually think it's likely to be a coincidence - it's too soon after the break-in.

<comment><USER4> Also: if you're smart enough to steal 75 million credit card numbers, and you've just stolen 75 million credit card numbers, I assume you're going to think of some clever way to start defrauding 'em. Unless I'm missing some part of this story (have the numbers been published somewhere already?), going out and buying gas is the dumbest thing you could possibly do -- parking your own car in front of a security camera and making a transaction which even Capital One knows to flag as potentially fraudulent.

Come to think of it, though, what _is_ the sensible way to use some vast number of credit card numbers to enrich yourself? I assume small-time credit card thieves can get away with it because they're sufficiently small-time to escape an in-depth investigation, but is there any way to untraceably pay yourself?

<comment><USER5> If you're smart enough to steal 75 million credit card numbers, then you already know about the forums where that information gets bought and sold. You start selling the individual cards, not the whole data dump, and it's the buyers that are starting to use those numbers to make purchases.

</comment></comment></comment></comment><comment><USER3> Probably not related. Consider that 75 million users' information was compromised. Given a sample size that large, it's highly likely that there will be some people in that set who had their credit card compromised in a completely unrelated way.

<comment><USER6> Math for truth and justice!

Given the following:

"The Consumer Sentinel Network (CSN) is a secure online database of millions of consumer complaints available only to law enforcement. In addition to storing complaints to the FTC, the CSN also includes complaints filed with the Internet Crime Complaint Center, Better Business Bureaus, Canada's Phone Busters, the U.S. Postal Inspection Service, the Identity Theft Assistance Center, and the National Fraud Information Center, among others."

The CSN received 1.2 million complaints in 2008, 62400 of which were specifically credit card fraud.

This means that of the approximately 170 million+ credit card owners in the US, roughly 0.035% of them reported credit card fraud in such a way that CSN saw it. There are likely many more cases that only get reported directly to banks without reaching CSN.

0.035% of 70 million+ users? 24500 people. All of which, due to PSN being an online service, have internet connectivity and are potential blog commenters.

Add to it that you're not going to remember the cases where people say "Nope, I haven't experienced fraud.", you're only going to remember those where people say "Money was stolen from me!"

Unless the reported incidence frequency is above the "normal" / average cases of credit card fraud or someone reports fraud on a card that was proven only to be used with PSN, I would hold off on blaming anyone quite so soon.

<comment><USER7> Careful. Sony's figures for PSN user count are _worldwide_ , and a large percentage of Sony's market is in Japan alone. The CSN appears to be USA and Canada only.

<comment><USER8> FWIW, Japanese much less commonly have or use credit cards. It's one of the reasons eBay failed while Yahoo Auctions succeeded in Japan, by not requiring a credit card to list.

<comment><USER9> Yep. If you're travelling to Japan, don't plan on using your credit card to pay for accomodation - in my experience, you'll need wads of cash.

</comment></comment></comment></comment></comment><comment><USER10> Changing credit cards is a bit of a hassle because of recurring billing tied to the account, one time I missed changing my trash bill over (easier to miss because it wasn't monthly) so I'm hesitant to just change cards if I don't absolutely have to. I wish there was some decent way to determine whether expected likelihood of the card I had linked to PSN having fraud * hassle of dealing with said fraud exceeds hassle of pre-emptively replacing card 'just in case'. I'm presently erring on the default of 'wait and see' just because it seems easier right now, but 'seems easier right now' is probably a poor thing to base the decision on.

<comment><USER11> The next time you replace a card (a shiny nickel says it'll happen before the card naturally expires), keep a list of every place you had to update it online. Takes the sting out of replacing it again in the future.

I'm holding off only because Mint loses its mind when I replace an American Express card. God, I hate Mint. Time to dump them, too.

<comment><USER12> One place: LastPass's "Fill Forms" entry for my debit card.

</comment></comment></comment><comment><USER13> Just logged on to my PSN cc company and was met by:

Sony PlayStation Network Data Breach - Important Customer Information

You may have seen the recent news in relation to the Sony PlayStation Network data breach. Please be reassured that The Co-operative Bank treats data compromises extremely seriously. We do not believe at this time that enough information has been compromised to put your account at risk and therefore do not feel it necessary to block our customer's cards. We are however monitoring the situation and working closely with the Industry and will advise our customers if any further action needs to be taken.

<comment><USER14> Likewise, HSBC don't feel that cards need to be cancelled at this stage either.

</comment></comment><comment><USER15> Ars Technica has more info:

[http://arstechnica.com/gaming/news/2011/04/ars-readers- repor...](http://arstechnica.com/gaming/news/2011/04/ars-readers-report- credit-card-fraud-blame-sony.ars)

</comment><comment><USER4> Quick question for those who know more about security than I do: what about passwords? They haven't stolen unencrypted passwords, have they?

If I have the same username and password on another service, should I be rushing off to change my password right now?

<comment><USER16> Yes, it's a good idea to do that. They said that passwords were compromised; I'm really hoping that was a simplification and they really meant to say that "individually salted, hashed passwords have been stolen" but they didn't add that qualification, so you should probably assume the worst.

<comment><USER17> Yeah, but if it's "individually salted md5 hashed passwords" then your password is quite possibly compromised.

</comment></comment></comment><comment><USER18> Here we go. I wonder if Sony has given GeoHot a call and asked him to work for them yet. I'm curious how much this hurts Sony's bottom line in the long run. Cross my fingers my 360 is still running strong.

<comment><USER19> Oooo I bet that's how they'll punish him. They'll trick him into signing a 5 year contract to be their director of PCI compliance and database administration.

</comment></comment><comment><USER20> I would be more interested in a report from a credit card company involving a spike in fraud that is linked to stolen data. This would be a much clearer indication if it was a coincidence or not. I would also think that credit card companies should make a statement if they did notice any increase in fraud as it is such a large scale leak.

</comment><comment><USER21> Does anyone know if Valve and Steam use the same servers as Playstation for processing? I purchased Portal 2 through Valve on my PC a week before they shut the network down and had my card stolen two days later (I didn't use the card for weeks before and didn't use it after) so it seems like these might be linked.

<comment><USER12> Valve have said that Steam users have nothing to worry about regarding the PSN leak. Furthermore it seems very unlikely that Steam and PSN would have much in common (except for third-party payment processors) given that until very recently, they were completely unrelated. There is no evidence that your card was stolen due to using it on Steam, and I would advise against assuming correlation is equivalent to causation.

Speaking from personal experience, your bank might not even tell you promptly if someone else has your card details, they might just block all the fraudulent transactions and not replace your card for six months.

</comment></comment><comment><USER22> I would like Sony to tell us why they have not co-ordinated with the credit card issuers to issue replacement cards, or cover the cost of replacement cards.

and a question: could the solution be as simple as changing the CVV on the back of the cards?

<comment><USER23> First of all, there is no confirmed credit card theft. Credit card information is held at a higher standard than generic personal information. PCI compliance requires credit cards are encrypted and you are required to get regularly audited. By no means is it perfect, but it's about as good as it gets with securing data that's being thrown around constantly.

Second, Sony did tell credit card companies and they do know about this. I called mine and the operator was well aware of of the data leak. They have been monitoring all accounts from the beginning.

Third, while you can always get a new card number for free, credit card companies tend not to issue new cards automatically. I've had it happen to me once before where they gave me a new one without me asking.

tl;dr These authorized charges are likely coincidental; the CC companies are well aware of the situation.

<comment><USER24> >Second, Sony did tell credit card companies and they do know about this. I called mine and the operator was well aware of of the data leak. They have been monitoring all accounts from the beginning.

Did Sony know about this, or did they see a pattern of cards getting flagged that had PSN charges on them?

<comment><USER23> I just meant the credit card companies are well aware of what happened and that credit card numbers might have been involved. They're monitoring accounts accordingly and didn't seem to think canceling was necessary.

If the companies really believed the numbers were compromised they will send out new cards automatically. Like I said, it's happened to me before. I didn't have any suspicious activity or anything. But some company I did business with reported a credit card breach so my bank just sent everyone in the breach new cards with little letters telling them "you got owned, but no worries here's your new card."

</comment></comment></comment></comment><comment><USER25> What effect will this have on the PSN and on Sony as a whole?

If this happened to a smaller company, their ability to process would be taken away and after their infrastructure was verified, they would be forced to pay higher transaction rates.

</comment><comment><USER26> We should be careful not to overreact to this news, but at the same time, black hats have done considerable damage in the past by cracking personal information and/or one password. It's not unreasonable to expect the same problem to continue now, at least for a small fraction of users.</comment>