Grub2 security update renders system unbootable - <AUTHOR> https://bugzilla.redhat.com/show_bug.cgi?id=1861977 <comment><USER2> I assume this is related to this from yesterday [https://news.ycombinator.com/item?id=23990075](https://news.ycombinator.com/item?id=23990075) Which is about revoking secure boot keys

</comment><comment><USER3> There was a story on HN last night from Debian where they laid out this issue, and basically stated "Yes, this security update is going to render some systems unbootable, here is why we're doing it anyway."

[https://www.debian.org/security/2020-GRUB-UEFI- SecureBoot/](https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot/)

Stability is important, especially when it comes to unbootable machines—but I don't quite know what anyone was supposed to do here. If a user has secure boot enabled, the OS has to assume that the user wants/needs security at that level of the chain—and it is therefor responsible for ensuring the chain's integrity. In this case, there was no way to do that without some machines (temporarily) failing to boot.

What would have been a better way to handle this?

<comment><USER4> Is there proof that secure boot actually prevented an attack?

<comment><USER5> Secure boot has, for the most part, prevented the underlying system from being compromised by malware that can run before boot (and therefore hide itself from the OS). I don't think we can really prove a negative here, but it means no more "boot sector" viruses, either on the HDD itself, or on external bootable media. That certainly is a good first step to preventing foot canon incidents, and giving the OS a decent chance at preventing malware running before the OS has control of the system.

Couple in, as another post said, a tpm which only releases the decryption key if the system is in a valid state with secure boot running, it helps a lot with basic cold boot protection. TPM is far from perfect, but it is arguably better than a user not encrypting their disk at all, and this prevents attacks like replacing the utilman.exe with cmd.exe etc.

</comment></comment></comment><comment><USER6> I will state the same comment as last time.

Can distros maybe consider moving to systemd-boot at some point? Systemd is already built in and can handle things like mounting pretty easily and simply.

It is a hell of a lot leaner than grub, doesn't use a billion superfluous modules. That and it is a lot easier to prevent tampering compared with the cumbersome nonsense that is grub passwords.

Oh and it enables distros to gather accurate boot times and enables booting into UEFI direct from the desktop.

It works with secureboot/shim/Hashtool. Also each distro has it's bootloader entries in separate folders to avoid accidental conflicts.

<comment><USER7> systemd-boot (AKA, gummiboot) is leaner, for sure- much in the same way a bicycle is leaner than a truck.

It might surprise you to know this but systemd-boot does not support, among other things: "BIOS"/MBR boot, EXT4, XFS, mdraid, LUKS (hidden boot), OPAL (aka hardware FDE, self-encrypting drives) or even btrfs!

mdraid being pretty critical to a lot of server work.

Then there's the topic of altering bootloaders for distro's which value stability, it wouldn't happen in a point release.

<comment><USER8> I feel like you're making this sound worse than it actually is

* systemd-boot doesn't support those filesystems as the /boot partition, all of those things for your / are totally fine. For most people having your /boot partition be XFS vs FAT32 is firmly in the "who cares?" realm.

* Nobody really supports OPAL, even grub. The only reliable solution is using [https://github.com/sedutil/sedutil](https://github.com/sedutil/sedutil) to unlock the disk and then soft reboot into any normal bootloader.

* You can do mdraid, you just have to stick the metadata at the end of the drive rather than the beginning. The utilities that set up your raid even warn you about this because this setup is so standard.

<comment><USER7> > systemd-boot doesn't support those filesystems as the /boot partition, all > of those things for your / are totally fine. For most people having your > /boot partition be XFS vs FAT32 is firmly in the "who cares?" realm.

XFS is also not supported. But yes, your /boot can be fat32, but saying "nobody cares" is just needlessly dismissive, I can think of many reasons to care at least a little. Primary of which is lack of encryption and ability to mirror easily, another can be the possible corruption of /boot (FAT is not typically used for it's data consistency properties)

> Nobody really supports OPAL, even grub. The only reliable solution is using > [https://github.com/sedutil/sedutil](https://github.com/sedutil/sedutil) to > unlock the disk and then soft reboot into any normal bootloader.

I guess this is a fair statement, if you ignore that the "PBA" is actually using grub itself, but yes, the PBA is non-encrypted and usually lives as a separate partition, making it functionally equivalent between systemd-boot and grub2.

> You can do mdraid, you just have to stick the metadata at the end of the > drive rather than the beginning. The utilities that set up your raid even > warn you about this because this setup is so standard.

You can't boot to an mdraid device with systemd-boot, you can only have a separate (non mirrored or raid'd) partition on a drive, and point to that drive to boot.

<comment><USER8> > You can't boot to an mdraid device with systemd-boot, you can only have a > separate (non mirrored or raid'd) partition on a drive, and point to that > drive to boot.

Sorta kinda true in theory but not in practice. Yes systemd-boot isn't raid aware but if you configure mdraid to store its metadata at the end of the drive then you wind up with a, say, mirrored disk that to the firmware doesn't look like it's mirrored at all. And since the firmware just reads the partition it's safe and works.

So yes, you have to configure your firmware to look at both drives in a mirrored setup as a fallback but you can boot.

> but saying "nobody cares" is just needlessly dismissive

Fair, I'm more saying that having firmware that only supports a small set of simple filesystems is the usually the more normal situation, the fact that GRUB comes with all the drivers makes it the weird one.

</comment></comment></comment></comment></comment><comment><USER9> If you are wondering why many people _hate_ updating working systems, no matter what the security implications, look no further than this.

Time and again it is an innocent security update that would end up in a reinstall, finding a bunch of bloat ware on a system, losing critical functionality, data loss and time lost.

Updates should be restricted to the absolute minimum and tested to the point that deploying them does not put customer data at risk.

<comment><USER10> What can you recommend as a balanced linux distro between the constant updates of arch on one hand and mostly very outdated package versions of debian/centos on the other?

<comment><USER11> There is of course Fedora. The latest is quite cutting edge, but you can choose when to upgrade to the next release. And there are security updates for older releases, so you don't have to immediately upgrade. Still, keeps you in the Red Hat universe.

<comment><USER12> This is exactly why I settled on Fedora after a few years on Arch, a few on Ubuntu/Debian/etc. Fedora is the best blend I've found. New releases about twice a year but you can skip a release if you want and upgrade every other release (or always stay on release n-1 which some people I know do).

Arch and Fedora follow the same conventions so everything on Fedora is where you expect it from Arch (this also makes much of the great Arch wiki applicable directly).

There will always be a soft spot in my heart for Arch, but Fedora is the perfect balance for me. I can't have my work machine getting broken and forcing me to read forums and mailing lists, etc.

</comment></comment></comment></comment><comment><USER13> The stablest systems I had the pleasure to manage were two identical rhel6 clusters into different geographical locations for higher availability and fault tolerance. Such systems were installed, turned on and never touched again. Kernel 2.6.32 that managed about six-seven years of uptime up to mid-2019. We operated a lot onto such systems, mounting and unmounting iscsi devices, starting and stopping stuff, turning on and off network interfaces and clustered filesystem (thanks to Veritas cluster manager).

The key move was never updating.

Such systems were literally mission critical, without that cluster the whole company was unable to produce its main products.

Considering how much stuff they ran and how many simultaneous users were connected, I was humbled by their stability (and by rhel's stability).

If you're getting angry at this post: the customer was not in the it field and was completely okay with buying new hardware and doing a full reinstall every X years.

<comment><USER14> Usually security is one of the top reasons to update software systems. Would a security flaw in these clusters have been an issue? Were they aggressively firewalled?

<comment><USER13> Yes, there were multiple firewall layers. Also, services were not accessed from outside the corporate network.

</comment></comment></comment><comment><USER15> The link is to a redhat bug report, but the issue is also affecting other distros: [https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1889509](https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1889509)

</comment><comment><USER16> This is why I dislike grub. It's really, really bloated. A bootloader just needs to pick the partition to boot, and little else. I switched to gummiboot ages ago, and it's so simple. There's far less to go wrong (gummiboot got absorbed by systemd, so it's now called systemd-boot)

</comment><comment><USER17> Am I reading this correctly that "yum update" is all I have to do to screw up an 8.2 minimal install?

<comment><USER18> sudo yum update

</comment></comment><comment><USER19> "This update enhances security by making the system unbootable, which is the most secure a computer can be."

</comment><comment><USER20> After reading this I decided to downgrade my Ubuntu machine for now until it's figured out. There are instructions here: [https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2Secu...](https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass) under the heading "DOWNGRADE `GRUB2`/`GRUB2-SIGNED` TO THE PREVIOUS VERSION FOR RECOVERY"

Under the heading is a small shell script that will download the old debs for you. Note that for it to work and not have wget spam 404:s, you have to update the entire GRUB2_LP_URL and GRUB2_SIGNED_LP_URL to the links in the little table. At first glance it looks like you only have to change GRUB2_VERSION and GRUB2_SIGNED_VERSION.

</comment><comment><USER4> Grub2 is not a bootloader. I'm not even really sure what it is. In Grub 1 you had a configuration file with the operating systems you wanted to boot. Simple, effective. With grub2 all I'm seeing is a bunch of sh scripts that are impossible to write by hand.

</comment><comment><USER21> Again? I remember when zfs didn't init in time so grub found no root. It was fun panic when it's on a virtualization server..

</comment><comment><USER22> On this subject, a few months ago I had Ubuntu servers suddenly failing due to a bizarre automatic snap update that basically took most of our Docker containers down. Did anyone experience this with production systems?

</comment><comment><USER23> Any word on whether the equivalent update on Debian has similar issues?

<comment><USER15> Yes, there are reports of failures on Debian: [https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1889509...](https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1889509/comments/6)

</comment></comment><comment><USER24> Well, a system that can't be booted is totally secure against many kinds of remote & local attacks. So, "mission accomplished", I guess?</comment>


Ask HN: Building a game for AI Research - <AUTHOR> I'm working on a PC game as a personal project. I am primarily a game designer and developer, but I'm interested in working towards making my game friendly towards AI research. I tried reading TF/PyTorch docs but couldn't find a guide on how to make my game a friendly environment that exposes the necessary surface area for AI research.<p>I would love advice from anyone who has experience building API layers for video games for AI (BWAPI, OpenAI's DOTA team, deepmind SC2 AI, etc) for pointers. <comment><USER2> From my viewpoint, as both a researcher and someone who has built frameworks around environments/games:

\- Each step within the game has to be extremely fast. I.e the game should be able to be run as fast as the machine allows while keeping physics etc. consistent.

\- Runnable via library import such that there is no drawing to the screen.

\- Should be easy to reset the environment to an initial state.

\- RNG state should be seedable.

\- I highly recommend supporting an identical interface found in OpenAI's gym. Check their docs out. Even better would be to have your game importable as an environment in gym.

\- Configurable screen resolution would be great (eg. output 120x100)

\- The environment is "hackable" eg. the maps or levels can be modified or loaded say via some ascii map.

\- Should support multiple copies of the game running at once.

\- A nice to have would be if the current environment state could be exported and loaded later.

\- Expose some information/signals such that a reward signal can be created. Or better yet you define one as the game creator.

<comment><USER3> May I ask what do you mean by "RNG state should be seedable"?

<comment><USER4> If the game depends on random events (eg an attack does random damage between 3-8) it would be useful to make sure it's always the same randomness, if you want it at least.

<comment><USER3> Same randomness? I can't get gist of the term.

<comment><USER5> In addition to the other explanation, check out today's NYT article on how one guy cracked the lottery because of pseudo-random behaviour in the lottery code.

[https://www.nytimes.com/interactive/2018/05/03/magazine/mone...](https://www.nytimes.com/interactive/2018/05/03/magazine/money- issue-iowa-lottery-fraud-mystery.html)

</comment></comment></comment></comment></comment><comment><USER6> It has to be fast. Reinforcement learning takes 1000s of hours of game play for each experiment, and you want to do multiple experiments per day on a small cluster. The Atari games in OpenAI Gym run about 200x real-time per core, and the SNES games maybe 20x. Aim for something in that range. 1x is useless for research.

OpenAI Gym has a stable API for several video games. If you copy the API, researchers will be able to compare algorithms directly across games which is valuable.

<comment><USER7> What does Dota 2 get? That's probably the metric to aim for, since OpenAI uses it themselves, and it's a modern 3D game.

They had to do a few hacks to get it working: [https://blog.openai.com/more- on-dota-2/?](https://blog.openai.com/more-on-dota-2/?)!

 _The first step in the project was figuring out how to run Dota 2 in the cloud on a physical GPU. The game gave an obscure error message on GPU cloud instances. But when starting it on Greg's personal GPU desktop (which is the desktop brought onstage during the show), we noticed that Dota booted when the monitor was plugged in, but gave the same error message when unplugged. So we configured our cloud GPU instances to pretend there was a physical monitor attached.

Dota didn't support custom dedicated servers at the time, meaning that running scalably and without a GPU was possible only with very slow software rendering. We then created a shim to stub out most OpenGL calls, except the ones needed to boot._

Still, Dota uses simplified collision detection. It would be interesting to know how fast an actual physics simulation could run in headless mode.

</comment></comment><comment><USER8> I wish more people would use (or expose) 0AD engine (an open source Age of Empires-like game) in AI research, even though I know Starcraft2 is where most of the focus is these days).

[https://github.com/0ad/0ad/tree/master/binaries/data/mods/pu...](https://github.com/0ad/0ad/tree/master/binaries/data/mods/public/simulation/ai/petra)

[https://github.com/agentx-cgn/Hannibal](https://github.com/agentx- cgn/Hannibal)

Nearly everything bullet pointed in that list is there.

Edit: Should also mention there is the Halite AI challenge, [https://halite.io](https://halite.io)

</comment><comment><USER9> I have been working on a simple project for evolving 5v5 ship battles similar to asteroids. My advice is make it easy to serialize the game state. 99% of the simulations will do the same thing or waste 1000s of frame getting to the "important part" of the match, and the ability to save the game state and re- play it from a specific position can be beneficial.

However, from what I understand, this limits your game to a simple Markov Process, which not all games likely expressed like that. (In my case I can only use this approach if I don't allow neural networks to have memory between frames)

Another benefit is being able to debug in real-time how decisions are being calculated via the model, like a neural network.

<comment><USER10> Sounds like Netrek (which is 8vs8) and in space (but 2d).

</comment></comment><comment><USER11> Lots of great suggestions in here!

The General Video Game AI (GVGAI) environment has also just released their own Gym for training. With the competition set to run through CIG'18 in July 2018

[https://github.com/rubenrtorrado/GVGAI_GYM/](https://github.com/rubenrtorrado/GVGAI_GYM/)

IEEE Conference on Computational Intelligence and Games Competitions

[https://project.dke.maastrichtuniversity.nl/cig2018/?page_id...](https://project.dke.maastrichtuniversity.nl/cig2018/?page_id=255)

It's okay to start out small. It's not necessary to clone StarCraft to investigate high dimensional game state spaces. Remember it was a simple 2D board game like Go that was until recently considered unbeatable ;)

Take a look at games like Generals or Tron Light Cycles. Best of Luck!

[http://dev.generals.io/](http://dev.generals.io/)

[https://web.stanford.edu/~jbboin/doc/ai_lightcycle.pdf](https://web.stanford.edu/~jbboin/doc/ai_lightcycle.pdf)

</comment><comment><USER12> >"I tried reading TF/PyTorch docs but couldn't find a guide on how to make my game a friendly environment"

Are you aware of 'Elf' and 'TorchCraft' by Facebook (creators of Pytorch)?

From [https://facebook.ai/developers/tools/elf](https://facebook.ai/developers/tools/elf) :

"ELF provides an end-to-end solution for game research. It includes miniature real-time strategy game environments, concurrent simulation, distributed training over thousands of machines, intuitive APIs, web-based visualizations, and a reinforcement learning framework powered by PyTorch."

From [https://facebook.ai/developers/tools/torchcraft](https://facebook.ai/developers/tools/torchcraft) :

"TorchCraft is a Brood War API (BWAPI) module that sends StarCraft data out over a ZMQ connection, allowing researchers to parse StarCraft data and interact with BWAPI from C++, Python (PyTorch-friendly), and Lua (Torch- friendly)."

<comment><AUTHOR> Thanks for mentioning these!

I started exploring this after seeing TorchCraft on HN yesterday ([https://news.ycombinator.com/item?id=16979136](https://news.ycombinator.com/item?id=16979136)) and I worked on a BWAPI AI back in college myself (2009).

I took a look at ELF hoping it was a library or module I could integrate into my project to make it applicable with PyTorch, but it was its own gym complete with full game examples.

</comment></comment><comment><USER13> Something perfect here is OpenAI's Universe [1] enabling you to strap on a uniform AI interface to your project. Here [2] is there systems page for further information/support.

[1] [https://github.com/openai/universe](https://github.com/openai/universe)

[2] [https://openai.com/systems/](https://openai.com/systems/)

<comment><AUTHOR> Nice, I didn't know about Universe, I was only familiar with the gym and their DOTA 2 scaffolding (which was a gigantic engineering process, as I learned from [https://blog.ycombinator.com/building-dota-bots-that-beat- pr...](https://blog.ycombinator.com/building-dota-bots-that-beat-pros-openais- greg-brockman-szymon-sidor-and-sam-altman/) )

</comment></comment><comment><USER14> If you're using Unity, I would recommend that you check out Unity Machine- Learning Agents!

[https://github.com/Unity-Technologies/ml-agents](https://github.com/Unity- Technologies/ml-agents)

It makes it really easy to make games for reinforcement learning. I worked on it a bit over summer, so if you have any questions, feel free to reach out to me.

<comment><AUTHOR> We do indeed use Unity! Somehow I was aware of ml-agents, but didn't realize it was a "gymification" library. I thought it was a framework for running stuff within the Unity editor, but seeing that it allows things to be run from a normal python environment, that's awesome. Thanks for making me look at the README and documentation closer.

And here I was thinking I would need to write a native dll wrapper or wait till my next game project to include necessary bits from the outside.

</comment></comment><comment><USER15> -complete game state should be compactly represented, ultimately it will need to be in a form that can be inputted to an NN

\- player actions should be enumerable (if there are discrete actions)

\- score is reward, it should be easy to access directly

\- game will be much easier to learn of there are shorter goals with more score feedback. long puzzles with very sparse reward is still challenging for RL

<comment><AUTHOR> Funnily enough, our game has these properties as part of its core game design, independent of the AI-friendly aspirations. It's a puzzle-based anti-grav racing game where you try to complete N laps in the fastest time possible. When I was playtesting it I realized "huh there are only 2 buttons involved, the game state exists as a 2D bitmap + a few vectors we can serialize to disk, there are predefined deterministic victory parameters (times for medal) and the randomness is 0 outside of physics. This should be an ideal game for AI training."

While I'm sure I miss some knowledge on optimizing the design, what I'm more interested in learning about are pointers to technical frameworks/API implementation details needed to be friendly to tools like TF/PyTorch for developers to train with the game.

<comment><USER15> Im working on a game RL framework for turn-based games, my aim was to learn about self-play and RL.

I found if you structure the human controller in the exact same way as the AI controllers, you can swap them easily. So I have Agent (abstract), HumanAgent (takes keyboard input), and DqnAgent (DQN learning agent) as the different controllers, the rest of the code is agnostic to the controller. With this setup you can also do things like record your own gameplay.

If your goal is running the track in minimal time, you could reward it at the end (reward = -1* elapsed_time), or as you go (reward=current_speed), or once each lap, etc. These sound similar but may have different training properties. So maybe plan to explore your reward shaping space a bit.

</comment></comment></comment><comment><USER16> There are plenty of great answers here already, but what I think would help improve the state of the art would be configurable reward sparsity and configurable priors.

\- Reward sparsity means that an easier version of the game gives a score after very few moves, but a more difficult version might take many many moves. It would be useful to see how agents compare against humans as the rewards get sparser.

\- Configurable priors are vaguer and are to make it easier to have the game match expectations from prior experience in other games. E.g. researchers could overlay a custom texture on enemies that look like enemies from other games to test and develop better transfer learning algorithms.

</comment><comment><USER17> As an alternative to OpenAI, Facebook has open sourced their AI game play interface just days ago.

[https://code.facebook.com/posts/132985767285406/introducing-...](https://code.facebook.com/posts/132985767285406/introducing- elf-an-extensive-lightweight-and-flexible-platform-for-game-research/)

</comment><comment><USER18> I would love to see a game that needs cooperation between x agents to wins.

I feel like play as a team in a imperfect information environnement is one of the most interesting AI challenge out there.

Imagine a 2d csgo with no need of manual skill, no aim or reflex, just player placement, crosshair(view) placement and teamplay.

If you know some game like this let me know please, if there is not i will build it one day.

<comment><USER10> Do you know the game netrek? It's a 8vs8 game that heavily relies on teamplay. It was one of the first real-time games to be played over the internet. It also has this imperfect information aspect (fog of war, inaccurate display of cloaked ships, need to scout planets). Free and open source. [http://netrek.org](http://netrek.org)

</comment></comment><comment><USER19> Could this Civilization clone have useful ideas for you?

[https://en.wikipedia.org/wiki/C-evo](https://en.wikipedia.org/wiki/C-evo)

</comment><comment><USER20> Look at Unity ML agents if you haven't already.

</comment><comment><USER21> not exactly what you asked for, but if youre looking for a gentle academic introduction to the intersection of ai and games, i recommend [ AI Researchers, Video Games Are Your Friends!]([https://arxiv.org/abs/1612.01608](https://arxiv.org/abs/1612.01608))

</comment><comment><USER22> By fun coincidence one of my personal projects has been the opposite; trying to build AIs that can experiment with generalized games.

The needs of a project like mine are going to deviate from other suggestions on here because I'm explicitly not working with neural networks or genetic algorithms. The lists other people have put up (esp nrmm) are really good for those, which is not to say mine won't have any overlap.

Given the choice between supporting something on my list or someone else's, you should definitely prioritize someone else's. If you want a lot of people to do research with your game, optimize for ML.

That being said, because I'm greedy, _stuff that matters specifically to me_ , in order of importance:

\- Encapsulated State: I want to be able to get raw access to the game's internal memory, esp through an API. Byte array is fine, labeled is also good. Basically any variables or memory that are used in game logic should be exposed. If possible, this state should be separated from any state information you're using for graphics, sound, etc...

Note that this does not mean you should encapsulate your entire game into 20 or 30 basic variables and just expose that. That's cheating. Classification of a game state is as important as building a strategy, so the point is to provide your state at a (relatively) low level with only a few abstractions, or at least abstractions that can easily be stripped out for training.

\- Headless Mode: I want to be able to run the game on a server or in a low resource environment by disabling as much of the graphics stack as possible. Linux support is also obviously useful since the majority of the server world is using it.

\- API-driven input: I want to be able to control the game without mocking button presses on a keyboard. Extra plus if your game is controllable via a scripting language like Javascript, it's trivial for someone to build their own adapter if they have something to call into.

\- Serializing/loading state: Emulators are great for AI research because you can export out the entire state of the game and reload it later for testing/comparing results. This isn't essential, just really really useful.

\- Easily recordable output: This is a tiny thing that just makes life way easier. If you can pipe your game's output to a video stream without recording it off a desktop (ie, can I stream your game from a headless server), then it just makes it a lot more attractive for building demos or toys.

Loads of bonus points if your graphical display can be run as a separate process from your game logic. More bonus points if they can communicate over a network. All of the bonus points if your graphics engine is embeddable in a web-browser or is similarly scriptable to your game logic.

And some _stuff I don 't really care about:_

\- Synchronous game logic: Most games try to keep their logic divided into synchronous chunks that are executed every frame. This is not particularly important for the types of research that I'm doing, async code is fine. Your game will probably be running on a remote server anyway, so someone in my position is hardly ever going to be looking at every single frame in series.

\- Seedable RNG: It's nice. I guess. But unless someone is running your game locally and interacting with it via synchronous steps, they're going to be dropping random frames anyway. So it doesn't really matter.

\- Extreme optimizations: I'm overstating this a bit - obviously your game needs to be optimized. If your game requires a GPU to run at a decent clip, that's a problem. BUT, if your game is fast enough to run reasonably well on limited hardware (especially in a streaming/headless mode), that's good enough. Aim to support single-core hardware and small dedicated devices like the Raspberry Pi.

This is terrible advice if you want to support reinforcement learning. In all likelihood you should optimize the crap out of your game for that. But, for the type of research I'm doing, I will practically never be running a game at more than 1-2x speed.

Portability and elegance > raw speed, unless you care about training a genetic algorithm or something.

\- A fitness function: Honestly, probably not even the traditional ML crowd needs one. If you expose your game's state in a way that they can consume, then anyone can write their own fitness function on top of it. You don't hurt anything by adding one though, I guess.

<comment><AUTHOR> Your project sounds exactly like what I envisioned myself dedicating my life to if I went to grad school (ah, another life) instead of starting a company after college. These are all the requirements I try to set for my game designs and _gameplay_ implementations, although I appreciate the details from someone in the weeds and building the project.

What I'm trying to gain more information on though right now are the technical details on how to go about modifying an existing game project to provide this, without building a game from scratch entirely inside of a proprietary AI game- gym framework.

A note on recordable output: It actually runs slower than playing a game because usually you have to do video encoding and file io in realtime which is slower than the RAM -> graphics card -> display pipe.

</comment></comment><comment><USER23> You should look at Halite by Two Sigma</comment>


Do you use or know someone who uses OpenCL? - api-dayz

Hi,
I'm curious about the size of the population of OpenCL developpers. Can you comment if you use or know someone who has ever used the OpenCL API ?
Thanks ! <comment> T-A I used OpenCL several years ago, to integrate large systems of coupled partial differential equations on an AMD GPU (at the time rated as the world's fastest). Using the hardware efficiently required significant effort, and in the end, the result was no better than what I got from Intel's optimizing compiler and an overclocked Core i7 CPU, which had the additional (and for that application decisive) advantage of proper double precision support. Don't know how the latest hardware would stack up though.

</comment><comment><AUTHOR> We're a company in the Netherlands specialised in OpenCL-consultancy. Check [http://streamcomputing.eu](http://streamcomputing.eu)

<comment> api-dayz Nice! Have you been recruiting ? If yes did you find it easy to hire developpers with the right skill-set ? Did you find it easy to put together a ready-to-go development environment for them ?

<comment><AUTHOR> I find it hard to find good ones, but luckily the good ones find us.</comment></comment></comment>


Why did Steve Jobs start tablets business? - <AUTHOR> http://deepdive-masa.blogspot.com/2011/03/why-did-steve-jobs-release-ipad.html <comment><AUTHOR> This post is my view point for iPad. Let's discuss.</comment>


WaitressTip Pro Calculator Android App - <AUTHOR> Kindly, check the new app which i developed to calculate tip in pro way! .....

  So you're in doubt, waitress stand in front of you and you don't know how much tip he or she deserves, don't worry!
 WaitressTip Pro Calculator will help you, The Pro way to calculate any waitress tip fee. Your time Matter!.
Real-time Tip and Final Bill Calculation. Fast seek-bar to add a tip percent quickly, no clutter, Professional yet simple straight forward app.
Small size 1.7 mega.
Decide the waitress Tip By :

    Time Waiting for service to be ready!!
    Introduction Level (Friendly, Special, Opinion)
    Availability (Bad, OK, Good )
    Problem Solving: suggestions - (Bad, OK, Good )

 Dark Theme For Night View Settings Section:  Set default values. Request app in your language
Get The App Now From Play Store:
[https://play.google.com/store/apps/details?id=excitingfuturelabs.com.waitresstipprocalculator]
Developed by: Exciting Future labs © <comment><USER2> Round the bill up or down to the nearest $1, $5 or $10, depending on your mood. Say $40.

Minimum acceptable service = 10%, shift the decimal point. Done. $4.

Average service, 15%, add half. $6.

Above average, 20%, double. $8.

If the final answer is not an even $, round up or down.

I'm sure it's a great app, I hope it does well, but the above is the upper limit of how much I want to think about a tip, particularly since I minimize the number of apps I put on my phone.

<comment><AUTHOR> Thanks, Thanks a lot for your kind review and suggestions i will consider those notes with next updates (In Shaa Allah).

About tip percentage and another behavior measurements all can be configured as you prefer in setting menu ..

and you can always enter the tip percent directly from its respective field.

already published a new free version, would you like to take a look at:)

[https://play.google.com/store/apps/details?id=excitingfuture...](https://play.google.com/store/apps/details?id=excitingfuturelabs.com.waitresstipprocalculatorfree)</comment></comment>


That's why I will never invest any money in your company - <AUTHOR> http://fseek.me/2010/03/thats-why-i-will-not-invest-any-money-in-you/

<comment><USER2> "Even if you have 100,000 users and 1,000 pay for your paid account. If you charge $10 per month, you are still making only 10k per month, barely making the salary of one person. No one will invest in a company like that."

If I have a side project pulling in 10K a month, I don't really care if nobody wants to invest. I've already succeeded.

<comment><USER3> Barely making the salary of a really, really highly-paid person.

<comment><USER4> "highly paid" is relative. $10k/month in San Francisco is an average programmer's salary .. Once you deal with the realities of a business (unemployment insurance, health insurance, payroll taxes, franchise taxes, income taxes, cell phones, internet, hosting) it's not really a single FTE's salary in say SF, Seattle, or NYC.

<comment><USER5> It simply isn't true that $120k/year is the average programmer's salary in SF. That's near the high end of programmer salaries, especially if you're young (programmers in their 20s rarely get >$90k).

<comment><USER6> There are plenty of programmers right out of college making low six figures. Of course, there are plenty of programmers in SF and SV; these are just the good ones.

</comment></comment></comment></comment></comment><comment> Asa-Nisse While I agree that most of the "review my <whatever>" here are pretty Lame I must say that this post entirely misses the point.

So what if the authors of these project chooses to call them startups. Nobody has a right or the power to decide what is a startup or not.

Especially not some guy with a whiny attitude.

<comment><USER7> So if the little website that takes text you type in and gives you a URL that has that text shown REALLY BIG is now defined as a Startup, what should the rest of us with real businesses call ourselves?

<comment><USER8> I don't know, but I'd like to know how I can invest in your URL embiggener startup

<comment><USER9> <http://newsyndicated.com/embiggen.cgi>

Do you think I could get a tech crunch article out of this?

edit: (I misread the joke, nevermind)

re-edit: (Added support for saving messages..I wonder if twitter would buy this from me for a million dollars?)

</comment></comment></comment></comment><comment><USER10> The tone of your post smells of too much hate. You sound like someone who could write a cool-headed post explaining when you think startups should try to raise money and when they should just enjoy the passive income from a weekend project.

Also, don't forget the biggest hit of this decade(facebook) was a college kid's side project just some years ago. As was twitter. And many others.

<comment><USER11> "Also, don't forget the biggest hit of this decade(facebook) was a college kid's side project just some years ago. As was twitter. And many others."

Facebook was a weekend project long before it went to raise money. It wasn't merely a weekend project trying to raise money.

Twitter wasn't a college kid's side project. It was developed by Odeo.

Indeed, the "biggest hits of this decade" seem more to be weekend projects that evolve from that, and then seek funding, rather than weekend projects that remain that, and seek funding.

And while his tone does come off somewhat harsh, I think the message is still a good one.

<comment><USER10> If he is arguing that many or most weekend projects are seeking funding, he is setting up a strawman. I don't think most or many weekend projects seek funding, especially ones posted here.

</comment></comment></comment><comment><USER12> Are the people who are making "weekend startups" asking for investment money? Post seems more against weekend projects as "startups" than investments.

</comment><comment><USER13> So you've got this little website you run from your dorm room at college. Something to let all your little friends chat back and forth.

I not only don't want to invest in your little 'startup' but don't ever call me again young mister Zuckerberg.

</comment><comment><USER14> That's ok, I probably don't want any money from you if you can't even keep your own website online ;)

</comment><comment><USER15> Facebook was a dorm room project, which you could argue originally fell into the 'non-startup' category. There are many, many examples of how your vision at start may be entirely different than where you end up, and its often difficult to see how that path looks when you are standing at the starting line. "Stuff happens" when you execute.

Also, the quality of a start-up should not be measured against scale potential. How a VC sees the world is deeply influenced by their own goals of 10x returns. A cynic might say that VC's promoting this view do so to produce more fuel for their business model.

</comment><comment><USER16> This raises an interesting question actually. What works better, scratching your own itch (hobby project) and then putting a business idea around it (e.g. <http://www.couch.io/>) or putting business first? I think some VCs might prefer putting business first.

I suspect the prior works better but may need some patience. I have a bunch of projects in various stages of completion and now I am working on (enjoying!) something new and hoping to make it useful.

IMO make-something-useful and then bother about business should work better, but then I haven't made much using this approach yet.

</comment><comment><USER17> *A company to make money based on advertising has to be able to reach a very large audience. Do you think that your application that your geek friends like is going to be like that? If not, forget the "ads" model.8

Is this actually true? It would seem to me that ads could work for a small, but focused web site, because the ads could be targeted really well.

</comment><comment><USER18> The weekend project is a good way to find out what it takes to work a project from start to finish. Then when you get a group together you have already been-there-done-that once before, just on a smaller scale.

</comment><comment><USER19> > Real startups (companies) are in business to make money!

What about twitter and youtube?

</comment><comment><USER20> mirror?

<comment><USER21> That's why i will never run my webpage on your server :)

In all seriousness, does anyone have a cache or mirror?</comment></comment>


Why pollsters were completely and utterly wrong - <AUTHOR> https://hbr.org/2016/11/why-pollsters-were-completely-and-utterly-wrong <comment><USER2> <For instance, while Census numbers can tell us how many Asian-Americans live in a particular state, they can't reliably tell us how many Republicans, or liberals, or evangelicals are in that state.>

The first claim is a crock. They _know_ the number of registrants for each party right down to the precinct level; it's public data.

The other two will vary greatly depending on how you define the terms.</comment>


Twitter Still Headed To The Moon With 17 Million U.S. Visitors In April - <AUTHOR> http://www.techcrunch.com/2009/05/12/twitter-still-headed-to-the-moon-with-17-million-us-visitors-in-april/ <comment><USER2> I've given up on fighting the Twitter hypsters. They think it'll change society as we know it and they'll latch on to any good news as proof of that. But needless to say a bunch of people checking out Twitter the month Oprah dedicates a show to it doesn't necessarily mean it will take hold with those people.

I recall a time, not to long ago, when everyone was talking about Friendster. I even remember it being mentioned on Fox's "The O.C." which, at the time, had more viewers than Oprah averages in a week.

<comment><USER3> It's text messaging, email and Instant message before it.

I guess Im a hypster but see endless possibilities and uses for this new form of Internet communication!

<comment><USER4> Its not really new its just different, myspace/facebook+blog+phone = twitter to me.

The only new thing is search and the phone making things quicker but less substantial.</comment></comment></comment>


IBM Patents Optimization... Sigh. - <AUTHOR> http://www.google.com/patents/about?id=vYLJAAAAEBAJ&dq=refactoring+software <comment><USER2> IBM is so funny. There are large incentives to get patents there as an employee. Prior to when I left and went to another company, there were even expectations that senior level engineers would regularly generate patents and patentable work as part of their normal work.

I remember one funny year when they pushed the patent expectation down to the lower banded employees (of which I was one at the time). We all dutifully submitted (internally) a number of patent "inventions" to meet the requirement and get the magic bonus $$ if you actually got one awarded. At the time, it didn't feel like an honest effort to generate innovation, but rather just another out-of-normal-process to heap on employees who were mostly trying not to get laid off.

</comment><comment><USER3> I'm usually skeptical about complaints of seemingly over-broad patents. Most people don't realize that the abstract isn't the patent, the claims are. And the claims tend not to be overly broad because the examiners aren't _that_ bad.

But in this case, it _really is_ as bad as the title declares. Claim 1 covers the process of any attempt at optimization.

The only things close to redeeming specificity are in the description and background. The first claim still covers _everything_.

One small caveat: IBM is _attempting to_ patent optimization. They filed an application and that application has been published.

But, as of yet, it hasn't been granted. Fingers-crossed, let's hope this doesn't go through.

<comment><USER4> Claims typically start out broad, and then refine further to get at the core of what exactly it is they are patenting. Since many patents are extensions or improvements on existing things this seems to be a common theme in the patents I've skimmed over. This patent application just keeps everything vague and broad, which I suspect is common in many software patents.

<comment><USER3> That's incorrect. An invention is infringing an issued patent if it includes all the elements of any independent claim.

Dependent claims, in this case 2 - 5 (the ones that refer to another claim), add specificity, but do not narrow the scope of the original independent claim. They exist as a legal tactic; helping to ensure that a more specific variant of the invention is covered, in the event that the parent claim is later invalidated (ruled too broad, revoked upon discovery of prior art, struck after re-examination, etc).

<comment><USER5> But in case of a legal dispute, it may be that only certain contested claims are ruled illegitimate. So it makes sense to have many claims ranging from less to more specific, instead of having a few specific claims, so that maybe a somewhat wider claim will make it through a legal dispute.

<comment><USER3> There's absolutely a lot of legal strategy in developing claims. There are very good reasons that top firms hire specialized IP lawyers. All that is, however, an aside.

The original point stands: If this patent issues, any competing invention that merely contains all the elements of that broad independent claim, would be infringing.

Those more-specific dependent claims are only a concern if you plan on prevailing in court against the broad one. As setting foot in a courtroom is a net loss for most innovators, the very existence of those dependent claims is essentially irrelevant.

</comment></comment></comment></comment></comment><comment><USER6> "Sigh" is right. This isn't a patent. It's an application that hasn't been examined yet. Come on people, try to learn a little bit about the subject before trolling.

<comment><USER7> Hope they get it. And they can defend it. In fact I am hoping for a patent on computing (damn can't do that). We need to prove by extreme example that the patent system is broken.

</comment></comment><comment><USER8> If their war chest of patents is to discourage me from writing competitive software, then they win. Since I don't want to write enterprise software, I think I win.</comment>


Opus Magnum – Automated Puzzle Solver [video] - <AUTHOR> https://www.youtube.com/watch?v=egrs04Ko864 <comment><AUTHOR> Additionally, the author has also posted some _astonishingly impressive_ Infinifactory projects, like building and delivering 10 "Anti-Javelin Point Defense" units in 48 cycles[1] (yes, that's assembly and a long-ish transportation averaging <5 cycles/unit), and an _implementation of TIS-100_ [2] (including emulation of the CPUs and a 9-bit BCD display).

[1] [https://www.youtube.com/watch?v=exaLS7Synkg](https://www.youtube.com/watch?v=exaLS7Synkg)

[2] [https://www.youtube.com/watch?v=yMnOEgbm2fE](https://www.youtube.com/watch?v=yMnOEgbm2fE)

<comment><USER2> I really hope this guy is solving real life problems with his intelligence. He's probably one of those dudes that doesn't get past those stupid white boarding exercises, so never gets into the workforce.

</comment></comment><comment><USER3> Oh, this game looked quite similar to Shenzen I/O. Turns out it's by the same author.

For those interested in building your own CPU from logic gates I recommend a game called MHRD, though the interface is suuuuuper basic.</comment>


AntiPolygraph.org appears to have been "de-listed" from Google on key searches - <AUTHOR> https://antipolygraph.org/blog/2018/06/28/google-de-lists-antipolygraph-org-on-key-search-terms/ <comment><USER2> Well, to be fair the website looks like it does the most it can possibly do to avoid good SEO and search engine visibility.

It uses `<meta keywords` and other techniques that apparently search engines like Google do not take into account.

On the other hand the HTML of the page (view- source:[https://antipolygraph.org/](https://antipolygraph.org/) ) does not contain any guidance as to what's the page's focus. No header tags are present, everything is `<table>` based and contains deprecated markup and almost all of the links it contains are internal. The markup is HTML4 which might be an indication to Google the page has not been updated in a while.

The website can easily be found in Google ([https://www.google.com/search?q=site%3Aantipolygraph.org&oq=...](https://www.google.com/search?q=site%3Aantipolygraph.org&oq=site%3Aantipolygraph.org&aqs=chrome..69i57j69i58.4647j0j4&sourceid=chrome&ie=UTF-8)) - it just appears to not be ranked very high as it aged.

Don't forget Google tends to favour newer and updated content to older content. The website also doesn't have a sitemap as far as I know which doesn't help with the problematic markup.

<comment><USER3> Unfortunately all these changes mean that it's now tougher to find old websites with specific information that you're looking for on Google nowadays, in general. It feels like Google used to be much more useful for that ten years ago than it is now.

<comment><USER4> Google's purpose seems to have changed from helping people find the most useful information, to funelling people to information that Google wants them to find on a particular topic, whether its the most useful or not.

Are we really still pretending like Goog/FB/etc. aren't effectively mass information control mechanisms first and foremost?

<comment><USER5> We have a blog on agrifood tech associated with our site and we've published over 1,000 articles often interviewing some of the most successful entrepreneurs, VCs, and senior execs at food and ag companies. We're by far the most authoritative thought leader in the industry and if you go to any industry you'd hear our name a few dozen times but we get massively outranked by Forbes articles, TechCrunch, CB Insights (which is a poor authority in our space). It's quite sad just how bad Google can still be.

<comment><USER6> That sounds to me like Google is optimizing retrieval for deeper searches within a narrower set of "authoritative" websites. The ideal solution would involve putting in the logistical and theoretical engineering work to classify and validate a huge number of websites good for fewer, specialized answers.

But for whatever reason, the reality seems to be a relative few websites are selected to provide "good enough" answers on shallow queries for a huge number of topics or objects, Wolfram Alpha style.

Maybe this is due to developer laziness, gradual dilution of cutting edge engineering, explicit desire for simpler solutions or real practical limitations, even at Google's scale. In any case, the result appears to be that sites like yours are poorly surfaced because they're not very generalizable. Whereas CB Insights claims it knows about your query already, there's an internal API setup for exposing CB Insights already, and CB Insights passes a basic sanity check on the answers.

This is really unforunate and I sympathize with you. I think there is a lot of opportunity for a search engine that can optimize for very specialized queries across many domains, including arbitrarily historical resources. But I think such a search engine would have very different goals and incentives than Google from the outset.

<comment><USER5> People still seem to find us depending on the exact search terms you're using but it's Google's user experience that really suffers. If someone randomly publishes "the top 25 Agtech companies" on Forbes it'll jump to the top of the list when searching for Agtech and stay there for half a year. Google is embarrassing itself with these kind of shallow and superficial results.

</comment></comment></comment></comment></comment></comment><comment><USER7> When I do a search for Polygraph I get the results from Wikipedia, Vox, APA ([http://www.apa.org/research/action/polygraph.aspx](http://www.apa.org/research/action/polygraph.aspx)), NYTimes on the first page. They are mostly critical articles about lie detectors and they all look more like something I'd want to read than AntiPolygraph.org that looks more like a conspiracy blog than well-researched information. I'd say the problem lies somewhere else, not by google censoring your content intentionally.

<comment><AUTHOR> I appreciate how the present blog post may strike some as conspiracy-minded. Especially those not familiar with the history of Operation Lie Busters, a U.S. criminal investigation that targeted the proprietors of websites that provided information to the public about how to pass or beat a polygraph test.

As you'll see in this recent post announcing the leak of the U.S. government's polygraph school's documentation about polygraph countermeasures, the federal polygraph community considers AntiPolygraph.org to be a major threat, and it features front and center in their training:

[https://antipolygraph.org/blog/2018/06/09/ncca-polygraph- cou...](https://antipolygraph.org/blog/2018/06/09/ncca-polygraph- countermeasure-course-files-leaked/)

None of this necessarily entails any state influence in Google's action to delist AntiPolygraph.org on certain key search terms.

It is true that our web design is dated. But this doesn't seem to account for the site being completely delisted from Google on such searches as "polygraph" and "lie detector."

I am not familiar with any other instances of such partial delisting by Google. Are you? If so, what were the causes for that?

<comment><USER7> > But this doesn't seem to account for the site being completely delisted from > Google on such searches as "polygraph" and "lie detector."

It's not delisted, it's just not on the first page as other users also reported and I just verified myself.

With every change of the ranking algorithm there's a bunch of sites going up or down and nobody can tell you the exact reason why - it's easy to just call it censorship but in reality it's probably something else. Like the top comment already explained that your site markup has a bunch of missing information that makes it hard for search engines to properly scrape you.

<comment><AUTHOR> What search term(s) did you use, and on what page of results did AntiPolygraph.org appear?

<comment><USER8> The google search "beat a polygraph" gives antipolygraph.org as result number 10.

The google search "pass a polygraph" gives antipolygraph.org as result number 11.

The google search "polygraph" give antipolygraph.org as result number 188.

</comment></comment></comment></comment></comment><comment><USER9> Google has had terrible search quality as of late. I'm finding myself using DuckDuckGo more and more just to find very basic things that used to be easy with Google. This is just in the last couple months or so.

Not sure if that's the case here, but if it is I wouldn't be surprised.

<comment><USER10> Once upon a time I could find blog posts of people reviewing things, travel, software, equipment etc. Now I just find pages and pages of review aggregators. The advantage of finding a blog was didn't take more than a few clicks to figure out if the blogger and me shared thinking, lifestyles, financial means etc. Now all that is gone. We just have ridiculous aggregation.

<comment><USER11> The problem is exacerbated by search quality guidelines that need to be followed if you're going to rank for any competitive search term, especially when there are clear incentives for doing so - such as site speed and deploying ssl.

Coming next is the 'insecure site' warning that's likely going to cull many more hobby sites.

<comment><USER12> > Coming next is the 'insecure site' warning that's likely going to cull many > more hobby sites.

Good. Setting up https shouldn't take more than an hour now with LetsEncrypt even if you have no clue about the process.

I can totally understand outdated webdesign, can't understand not having https.

<comment><USER13> I can, because I just converted a site to https, which had a combination of relative and absolute href and src parameters on it in a confused manner. This was combined with html embedded in table records.

It wasn't a simple search and replace task since several admin functionalities were also included in the site.

Think about all of the sites that have relevant information that aren't selling anything that would love to get things like this fixed, but just can't throw money at the problem.

Before you say oh it shouldn't cost that much. Think about where some of these sites are hosted and for how little. Some people don't even have the means to pay for such a fix, but they have important information to share.

This probably should have been a rule applied to sites that sell things and not sites that just have information.

I am all for making money, but I also feel like doing some charity work for this problem as well. I heard the deadline is the 24th. Anyone else interested in doing this collectively for a couple sites?

<comment><USER12> > I can, because I just converted a site to https, which had a combination of > relative and absolute href and src parameters on it in a confused manner. > This was combined with html embedded in table records.

Just add an upgrade-insecure-requests header to your webserver config, boom. No search and replacing needed.

[https://www.w3.org/TR/upgrade-insecure- requests/](https://www.w3.org/TR/upgrade-insecure-requests/)

It's been added for _exactly_ your usecase:

> Most notably, mixed content checking [MIX] has the potential to cause real > headache for administrators tasked with moving substantial amounts of legacy > content onto HTTPS. In particular, going through old content and rewriting > resource URLs manually is a huge undertaking.

I mean, uh sure, I'll volunteer to move your sites to https, but I don't think giving a random dude on the internet root access to fix the webserver config is a good idea ;-)

<comment><USER13> This site also had mixed content due to it using a forward proxy with ARR in IIS. Since ARR doesn't forward https requests it is truly turning into a mess. There isn't an option to just move it to another webserver as that would be it's own undertaking with the dynamic part of the site being ColdFusion.

> I mean, uh sure, I'll volunteer to move your sites to https, but I don't > think giving a random dude on the internet root access to fix the webserver > config is a good idea ;-)

In this point yeah I agree you don't want to let just random dudes have root access to a site. On the other hand I run my own legitimate consulting business and if you think about it. Every time I am winning over a new client for all intents and purposes I am just a random dude. :)

<comment><USER12> You can always just put an nginx in front of it to terminate TLS there. Sounds like a legacy mess nobody intends to maintain anymore anyways. Or hell, cloudflare them. Kinda pointless since you won't have TLS to the backend server, but the easiest "solution". I maintain that's it's possible to inject a header and terminate TLS however messy the system is within an hour.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> I vouched for this story when it was flagged dead and I wanted to note why I did.

I think it's more likely than not that the "innocent" explanation is correct here. But even if that's the case it still says something important about how google works and those things are being discussed in the comments.

Further even if the article is wrong, I don't see how it violates any of the guidelines. I think there's a tendency at HN to be very protective of google. I'm not sure if that's external fans or employees or what. There's nothing wrong with that per se, but I think it should be primarily expressed in comments rather than flagging or downvotes.

<comment><USER15> >I think there's a tendency at HN to be very protective of google

There's a tendency to be very protective of a wretched business model more than there is of google in itself. It may seem people come to google's defense a little too much on HN but that's only because google is the largest, most important corporation at the front of the business model that matters most to hners: advertisement and abusing user data. How else could any of the funded startups that provide free online services survive if they didn't get their money back through some other means?

There is a vested interest on HN and other similar places on the web to show solidarity toward any individual or corporation whose livelihood depends on this because the second you start questioning companies like Google and Facebook, you start questioning the very livelihood of everyone involved here.

<comment><USER16> One of the first lessons activists (should) learn is the shortsightedness of judging the content of an individual according to what they do for a living; the means of survival they have trained and adjusted for. In an action, strategy will often overrule this but as a conscious exercised and ideally organized process. This along with overlooking petty symbolic straw mans like using cell phones to organize against cell phone companies is like learning to potty train; critical first steps toward maturity.

In other words, evaluate components in proper and sufficient contexts. Software engineers might benefit from a similar conversation, to open more room for discussion around actual problem solving.

</comment></comment></comment><comment><USER17> I saw the site on page 3 after googling for "polygraph"

Although searching for "the lie behind the lie detector" gives the first result as the correct one from anitpolygraph.

Is it possible google didn't really do anything shady?

</comment><comment><USER18> This is a complete falsehood. There is no mention of "Operation Lie Busters" or any kind of program to suppress information about lie detection circumvention in the linked document. No other sources were given.

The site has plenty of reasons to not rank well in search, and secret government control over search rankings is at the bottom of that list in my view.

</comment><comment><USER11> Yet when I search for 'anti polygraph' [in uk] guess which site ranks top? Like I would expect.

The site title is 'Learn How to Pass a Polygraph Test' yet the term doesn't appear anywhere on the homepage?

I'd agree with the general sentiment that Google search is getting worse but this isn't a great example.

<comment><USER19> Adding to this:

\- search for [anti inflammatory] shows the site as first result and it's on page two for [polygraph controversy]. At the least, the blog post is misleading.

\- as per other comments, the site isn't mobile friendly, which has a huge impact on mobile ranking.

\- searching for [polygraph] the first page includes several listings discussing the controversy around polygraph results. The results are reasonably high quality stuff, i.e. valid choice.

\- a more valid test search might be [polygraph accuracy] or [polygraph controversy] to focus on the debate and less on testing centers and basic information.

Disclosure: former Google engineer and worked at 3 search engine companies on various search products. I've done SEO professionally outside of Google, with success. I've also seen smart people botch SEO, myself included.

</comment></comment><comment><USER20> I would never have heard about this website if it hadn't been "censored" by Google.

We can be proud to live in democracies, now I know why they envy us in the non free world! /s

<comment><USER21> [https://en.wikipedia.org/wiki/Streisand_effect](https://en.wikipedia.org/wiki/Streisand_effect) ;-)

</comment></comment><comment><USER22> The Streisand Effect is real and hopefully for AntiPolygraph this just gives them a wider audience.

<comment><USER23> Maybe Google is not trying to censor them, but just changed their algorithms to not show antipolygraph when searching for polygraph as said by someone in the google forum. Their site #1 result when searching "antipolygraph".

</comment></comment><comment><USER24> Is it appropriate to rank extremely high for something you're directly opposed to? Consider other polarized topics like abortion - should sites enlightening the user on why it is murder, instead of providing useful information, be presented front and center? I'm fairly sure this has come up as a controversy recently, but can't think of the exact topic.

Certainly Google could decide whether it is appropriate on a case-by-case basis, but at that point it starts to be very explicitly political. Once you've stripped away the fig leaf of neutrality, their monopoly would look outrageous to a significant portion of the population.

<comment><USER25> > Is it appropriate to rank extremely high for something you're directly > opposed to?

I'd say that's an important question, which I would answer with "yes", so long as it's understood that "rank extremely high" doesn't imply "at the exclusion of all others".

> should sites enlightening the user on why it is murder, instead of providing > useful information, be presented front and center

Possibly. Though, I fear you may have presented a strawman (while betraying which way you, personally, are "polarized" on abortion).

The question of what is _useful_ information depends entirely on the keywords the user entered. Just the single word "abortion" could easily, reasonably, be understood to mean a request for information of general interest on the topic, including moral implications. On the other hand, it would be a stretch to expect that someone would want, say, instructions on how better to administer sedation during the procedure, absent additional keywords.

Of course, there are going to be searches like "get an abortion" that are far more ambiguous than "get an abortion in my area", but I think it's better for something like a search engine (or government or society for that matter) to err on the side of inclusion than suppression.

> Certainly Google could decide whether it is appropriate on a case-by-case > basis, but at that point it starts to be very explicitly political

Indeed, and that's a can of worms they likely don't want or need to open.

<comment><USER24> > while betraying which way you, personally, are "polarized" on abortion

I'm curious what side you think I fall on, seems to me it could be argued either way. I have no strong opinion on it and picked it purely because it's an evocative example. Perhaps too evocative!

Some other examples might be terrorism, animal rights activism, transgender- as-mental-illness. Including both sides can be legitimately and understandably very upsetting for some people; in other cases we demand equal representation.

Are situations like OP's an inevitable product of the tyranny of an algorithm, one that errs to the safer side of excluding results?

<comment><USER25> > I'm curious what side you think I fall on

That abortion is not murder, as you made the example of the presentation of such an argument in opposition to the presentation of something "useful". I realize, of course, that the word could have been meant more narrowly (such as "strictly pragmatic"), but that tends be less likely, even on here.

> legitimately and understandably very upsetting for some people; in other > cases we demand equal representation. [...] > errs to the safer side of > excluding results?

That's the the thing, though, I don't believe in a "right not to be offended" or a "right not to be upset" (legitimately, understandably, or otherwise). As such, I don't believe that these divisive cases ought to be treated any differently than the other cases you mention.

None of this is to say that controversial topics don't attract a distinct problem. They do: trolls (for various definitions of the term). However, I believe that's more an issue with the quality of the content rather than the content itself, since a troll could (sometimes just as easily) take either side.

<comment><USER24> I do agree with this, but think there's enough societal pressure these days that it's very hard for a for-profit company to do.

<comment><USER25> I'm not sure being for-profit has that much to do with societal pressure as being ad-revenue-driven.

However, this profit (or revenue) above all else model is something Google's unusual stock voting structure was supposed to address.

</comment></comment></comment></comment></comment></comment><comment><USER26> 1) There's no such thing as "the first page of results on Google." Your results depend on your location, previous searches, etc.

2) This site seems to think this is some mass conspiracy to remove sites critical of polygraphs, yet when I Google "polygraph" the vast majority of results I get are critical pieces. Maybe those sites are just as relevant or better? A lot are stories in major publications, so that doesn't surprise me they rank high.

</comment><comment><AUTHOR> On 29 June 2018, we posted an question about this on Google's Webmaster Central Help Forum:

[https://productforums.google.com/forum/?hl=en#!topic/webmast...](https://productforums.google.com/forum/?hl=en#!topic/webmasters/YO0jYLfb- VM;context-place=forum/webmasters)

<comment><USER27> Are you aware that your website cannot be accessed from many Tor exit nodes without solving a google captcha?

<comment><AUTHOR> Yes, and we very much regret that. We're on a shared server, and our webhosting company recently added security software called Imunify360 that does this.

</comment></comment></comment><comment><USER28> I cant load the site at all?</comment>


Ask HN: How do you measure a Developer Experience / Engineering Platform team? - <AUTHOR> I'm trying to set up OKRs for my team, which has the mission of making our hundreds of software engineers work better and faster.
To achive this, we develop internal tools, maintain web services for engineers, hold workshops, advise people on software architecture, and so on.
Sadly, any metric we'd examine, such as 'duration
of CI pipelines that end with a production deploy' ends up being subpar. This one specifically has too many external factors influencing it, covers less than 10% of all the stuff we work on, and the metric just has too much random variance anyway.
How are other similar teams setting objectives, key results, KPIs, or any other measure of success? <comment><USER2> Not an easy question. I don't think the answer is a single value but rather a holistic experience. Some inputs I think you should consider are:

\- customer satisfaction

\- change in revenues

\- change in customer loyalty (subscriptions, upgrades etc)

\- change in employee retention</comment>


Equifax CEO pushed out after data hack getting nearly $20M in bonuses - <AUTHOR> https://www.cbsnews.com/news/equifax-data-breach-settlement-disgraced-former-ceo-getting-nearly-20-million-in-bonuses-after-the-hack/ <comment><USER2> This is the guy who said to Sen. Katie Porter that his SSN is privileged information leaking of which result in identity fraud and significant damages while his lawyers were arguing that their own leak didn't cause any harm? Few people rarely gets caught in their own lie so blatantly. And he even claimed he has no idea what his lawyers were arguing in court about the biggest debacle under his oversight. What a competent CEO.

<comment><USER3> Here's the exchange with Rep. Porter (she's in the House, not Senate): [https://www.youtube.com/watch?v=aUo2ujb0Adc](https://www.youtube.com/watch?v=aUo2ujb0Adc)

<comment><USER2> I'm not an American and get confused with the specifics. But thanks for sharing the link itself. I myself saw the same video and some of first timers in House and their to the point questions a lot.

</comment></comment></comment><comment><USER4> > On top of the stock awards, Equifax has agreed to cover Smith's medical > bills for life, a benefit the company estimates is worth another $103,500, > according to a company filing.

I guess Equifax assumes death will come swiftly for this man.

<comment><USER5> I always like it when CEOs get the benefits they claim are too expensive to keep for regular employees. Things like pension and health insurance. At this income level they should get a paycheck and no other benefits. They have enough money to buy other things.

<comment><USER6> It's a brilliant subversion of the Protestant Work Ethic.

Work is inherently good (I don't agree with this proposition but it's popular even among atheists) and so therefore we must reward workers.

It therefore stands to reason we should reward people more the harder they work

And your income is an adequate proxy for how hard you work

And your wealth is an adequate proxy for income

And so we should reward people for being wealthy

And this ends up with the situation where being an heiress sat on her ass doing nothing but owning an investment portfolio means you deserve tax breaks and above inflation raises, whereas if you put 60 hours per week in as an "independent contractor" for unprofitable new "sharing economy" businesses owned by that portfolio you don't even deserve a living wage.

<comment><USER7> work is meaningless without productivity, I could work really hard carrying rocks around my yard all day with nothing to show but a sore back

<comment><USER6> The Protestant Work Ethic says that's fine, you were working and that's what God cares about. Of course your labour is not producing anything, since God is omnipotent all the stuff you might think of as being produced by your labour is actually gifts from God anyway, your work is not valuable for what it produces since God could make everything effortlessly.

And indeed historically this was the actual rationale for a variety of punishments that really were carried out on huge numbers of convicts, including carrying heavy objects from one place to another and back or being forced to raise and lower weights that serve no purpose. "Arbeit Macht Frei" doesn't appear from nowhere as a unique evil idea.

<comment><USER5> "Arbeit Macht Frei" was just a cynical use of language by the nazis. It shouldn't be mentioned in this context.

</comment></comment></comment></comment></comment></comment><comment><USER8> "The directors of such [joint-stock] companies, however, being the managers rather of other people's money than of their own, it cannot well be expected, that they should watch over it with the same anxious vigilance with which the partners in a private copartnery frequently watch over their own.... Negligence and profusion, therefore, must always prevail, more or less, in the management of the affairs of such a company." \- Adam Smith

</comment><comment><USER9> What ever happened to that one IT guy everything got blamed on?

<comment><USER10> Later reporting seemed to move away from that claim. The official government report didn't mention the "lone IT guy" at all that I could see.

</comment></comment><comment><USER11> I mean, I'm not taking the blame away from him and this is a terrible look to be getting paid so much after a colossal screwup, but, in a company that size does the CEO really have any idea of the day to day or inner workings of the company? I worked at a much smaller company and it was pretty clear that they didn't.

<comment><USER12> Of course not. They're there just for the paycheck...

But on a more serious note his approach on dealing with the fallout was borderline illegal (saying this since he's not in prison). When you take the lion's share of the payouts (between salary and bonuses) you should have to take the lion's share of responsibility.

Every commentary I have read about the situation says it was entirely preventable. This starts at the top, with picking the right people and setting a strategy that creates the perfect conditions for that prevention. Obviously he failed. And once he failed he tried to hide it. We shouldn't read about how much money he's taking home but how much he's paying back and how many years of prison he gets.

</comment></comment><comment><USER7> calculated golden parachute, it's worth it to cut ties quickly for a big company compared to the risks of getting tied up in court, and compared to the potential losses of keeping them around, pretty typical, no financier would spend money they didn't think they had to spend

</comment><comment><USER13> Not enough, but at least some palpable penalty that might resonate with others.

<comment><USER14> He _earned_ $20M in bonus, it was not $20M in fines.

</comment></comment><comment><USER15> A Japanese client of ours ran into some trouble with the Japanese government due to some financial irregularities, and there was a huge shakeup.. the entire top management was sacked by the owners of the company. Not saying Japan is perfect, there is a lot of crony capitalism there too, but I found it amusing to observe nonetheless. Maybe we need a bit more of that here..

<comment><USER16> "Survival of the fittest" capitalism only applies to us mortals.

</comment></comment><comment><USER17> Crime pays well.</comment>


When Teamwork Doesn't Work for Women - <AUTHOR> http://www.nytimes.com/2016/01/10/upshot/when-teamwork-doesnt-work-for-women.html <comment><USER2> From last year's epic "emotional labour" thread on metafilter [1], `barchan` made this comment that seemed to resonate with a few people:

      > Another terrible thing about emotional labor at work is that
      > women "stepping up" to get things done is not just expected and
      > unappreciated, it's called "teamwork"; but when guys do it, it's
      > called "leadership".

[1] -- [http://www.metafilter.com/151267/Wheres-My-Cut-On-Unpaid- Emo...](http://www.metafilter.com/151267/Wheres-My-Cut-On-Unpaid-Emotional- Labor)

</comment><comment><USER3> This article is excellent, both in the way it's written and in the underlying genius of using tenure as an indicator for credit for each paper.

One interesting point is that a women-only or woman-solo paper gets more credit (9%) than a mixed-gender paper (8%).

I'm wondering why they rounded single-digit number, it's 15% imprecision (8.4% and 8.5% aren't significantly different, whereas 7.5% and 9.4% would be a great gap).

<comment><USER4> It's too bad indeed that the labels are rounded to one digit, but at least the plot bars are from unrounded data (as the second figure with 6%, 7% and 8% bars makes it clear), so I think readers still likely get the right impression of the effect size.

</comment></comment><comment><USER5> "The bias that Ms. Sarsons documents is so large that it may account on its own for another statistic: Female economists are twice as likely to be denied tenure as their male colleagues."

Aren't they using earned tenure as the metric to determine whether someone did or did not get credit? Seems like that's really just one point then rather than two. Unless I'm missing something.

</comment><comment><USER6> I'm curious about the data for women who published papers with other women. That will tell us whether the issue is that men tend to get most of the credit for collaborative work done with women, or something else.

<comment><USER7> The article seems to address that in the second chart. When a woman publishes with only women they get the 9% bump they're supposed to. When they publish with a mixed-gender group they get only 4%, and when they publish with only men they get almost no benefit. Is this what you were asking?

<comment><USER8> I wonder if they controlled for age in this study. Women in the sciences are younger than men (on average), so a dual-female paper is more likely to be from two contemporaries, while a dual-male paper could more easily be from an old prof and a young one. From what I've seen, the more established author tends to get more of the credit/prestige, even though the less-established one tends to do more of the work.

<comment> barry-cotter Age doesn't appear to be in the pdf. A surprising omission.

[http://scholar.harvard.edu/files/sarsons/files/gender_groupw...](http://scholar.harvard.edu/files/sarsons/files/gender_groupwork.pdf?m=1449178759)

<comment><USER9> That does seem very flawed. If there's a strong correlation between gender and age in the field then why would that be not accounted for? I can definitely see people assuming the older person was the brains/leader of a project.

</comment></comment></comment></comment></comment><comment><USER10> > _This leaves a sample of 552 economists ... between 1975 and 2014_

Soon there will be studies about a few dozens people and latter about individuals. I just wish other issues would receive similar attention and dedication.

</comment><comment><USER11> Lies, damn lies and statistics ... I have yet to find a person that does not do its best to find a data presentation that suits the agenda.

<comment><USER12> What about when someone does statistics to make a decision for themselves which they do not reveal?

<comment><USER13> Then pretty much by definition we wouldn't hear about it, would we?</comment></comment></comment>


Stewart/Colbert Rally Washington, D.C. - 10/30/10  - <AUTHOR> http://www.rallytorestoresanity.com/

<comment><AUTHOR> Colbert's faux opposing rally <http://www.keepfearalive.com/> .

I also thought it was odd in the source of both pages is a commented out link that solicited donations.</comment>