TP-Link firmware sends six DNS requests and one NTP query every 5 seconds - <AUTHOR> https://www.ctrl.blog/entry/tplink-aggressive-ntp <comment><USER3>
      firmware sends six DNS requests and
      one NTP query every 5 seconds
      (...snip...)
      TP-Link has hardcoded the following non-configurable
      NTP servers and server pools in their firmware:
      (...snip...)
      au.pool.ntp.org, nz.pool.ntp.org

Wait... so TP-Link is effectively DDoSing NTP pool?

Also, as pointed out in another thread here, vendor using country prefix instead of applying for their own prefix is a violation of:

[http://www.pool.ntp.org/en/vendors.html](http://www.pool.ntp.org/en/vendors.html)

..which was put in place as a reaction to incidents just like this one:

[https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#No...](https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Notable_cases)

<comment><USER4> Would it be possible for the NTP server to detect what type of device/OS is sending the request and block it (ie: could au/nz.pool.ntp.org servers block all TP-Link requests to teach them a lesson)?

If they can't do that maybe they can just detect IPs that are making requests every 5 seconds as the TP-Link products are doing and block those since they're in violation of the once-every-10-minutes-maximum rule for the NTP servers)?

<comment><USER5> Out-of-the-loop: what products are using TP-Link?

Aside: maybe there should be a governing body for comm protocol behavior? (Semi sarcastic)

<comment><USER6> TP-link is a manufacturer of multiple devices and an OEM for others. I would imagine, if consistent across firmwares, there are a lot of requests being made. [https://en.wikipedia.org/wiki/TP- Link](https://en.wikipedia.org/wiki/TP-Link)

</comment></comment></comment></comment><comment><USER7> PSA

Anyone with commodity routers, repeaters, etc. please check out LEDE project [https://lede-project.org](https://lede-project.org). Check if your device has support here - [https://lede-project.org/toh/start](https://lede- project.org/toh/start)

LEDE firmware is amazing. You will be able to do a lot more with your router and they have quick security fixes. The recent krack vulnerability was fixed within 2 days after the announcement.

<comment><USER8> Anyone care to explain the pro/cons of DD-WRT vs Tomato vs OpenWRT vs LEDE vs etc?

<comment><USER9> LEDE is basically an OpenWRT fork which is being actively developed. The biggest draw is that it's actively developed, and managed in a Linux-style package manager setup, rather than monolithic baked firmwares that you have to flash wholesale. Patching against things like KRACK was as simple as just invoking the package manager.

DD-WRT and Tomato are both old tried-and-true alternatives to vendor firmwares, and they require less tinkering to get into the state that you want, but they both tend to have weird crufty edge cases that never get properly fixed and don't seem to have any clear direction or leadership - <USER2> are both a hodgepodge of forks that you have to spend time digging through hundred-page forum threads to find information about. Development schedules are sporadic, and you often end up with dozens of potential builds in varying states of beta and testing which fix this or that but break this or that other thing. When they work, they're great, but my experience with LEDE has been consistently superior than my experience with DD-WRT or Tomato.

<comment><USER10> Just to be clear, OpenWRT isn't 100% abandoned, but it's basically just a handful of sporadic package version bumps and backported bug fixes, which might not ever make it into an official numbered release. If the counts on GitHub are accurate/comparable, LEDE has almost 2000 more commits than OpenWRT. The OpenWRT website also seems to be semi-abandoned (the front page has had a spam post on it for over a month; it looks like it was moved there accidentally by a moderator intending to move it to a "trash" subforum).

<comment><USER11> I naively bought the Linksys WRT 1900AC about when it released because it claimed dd-wrt support at release.

Then the dd-wrt folks mentioned that Linksys never actually gave them hardware ... and if I recall, hadn't really been included in the plans to support it at all.

So then I waited and found whenever I looked for the dd-wrt firmware, it always had lots of caveats and known issues.

I gave up. Shelved it and bought a pfsense box for the internet and use a Ubiquity wifi AP.

<comment><USER12> I ran openwrt and then lede on a wrt1900ac v2 for about 1.5 years until last week. Initially, stability was spotty, but the latest Lede images worked generally well. However, while vlans with Lede worked perfectly with my two TP-Link WDR3600s, the Lede ultimately had issues with it. I tried one last thing, probably bricked it, and that was the last straw...ordered three Unifi aps and couldn't be happier.

OpenWRT/LEDE is great assuming your device is well-supported and well-tested. Unfortunately, the wrt1900ac line was never as open as Linksys claimed it was, the LEDE devs didn't get the support they needed from Linksys when they needed it, and so certain things still don't seem to work.

</comment></comment></comment></comment></comment></comment><comment><USER13> My most recent frustration with TP-LINK was they they DO NOT provide their firmware updates over HTTPS. They do not provide checksums for their firmware files either. (When I asked for these things, their support weren't helpful on Twitter.)

So you're expected to download some unsigned binary over an untrusted connection and trust that with all your traffic.

Definitely not buying TP-LINK next time. Good to know this there's a bandwidth problem like this!

<comment><USER14> TP-Link does a pretty good job on basic Layer 3 Lite switches and desktop wireless cards, but the junky software on their routers and repeaters is enough to make me not use them. Unfortunately they do the same thing worth firmware upgrades for their switches as well, no signatures, no hashes, no TLS.

<comment><USER15> Good to know. While I've liked their dumb switches, if they can't be bothered to secure their firmware downloads, there's no way I'm buying one of their "smart" products.

</comment></comment></comment><comment><USER16> Update: According to ktta ([https://news.ycombinator.com/item?id=15912467](https://news.ycombinator.com/item?id=15912467)), there is mistake in my calculation too.

"138KB * 24 * 3600 / 5" should be 2.3287GB per day. And it's 2.3287GB * 30 per month.

Update 2: "For comparison, a 5-minute check would be considered a pretty aggressive checking interval, and would only consume 1,37 MB per month. Instead, TP-Link goes through the same amount of data in just 82 minutes."

This assertion from the article has multiple errors too.

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-----

The whole argument of the author is built on a flawed calculation by the author and the author exaggerated the number by a factor of 10.

715MB/month in the title and the article should be 71.5MB/month according to other information provided by the author.

According to the author, "TP-Link product is using about 138 KB every 5 seconds — or 23,85 MBs per day — on timekeeping."

23,85 MBs per day is not right, because 138KB * 24*3600/5 is about 2.328 MBs not 23,85 MBs.

<comment><USER7> Also I think it is 138 B, not kilobytes since that would be 2.3GB/day.

Whoops. Made it to the front page of HN with so many mistakes.

EDIT:

Since there seems to be interest in this let's do the test:

5 DNS requests + 1 NTP update according to the article (seems weird that it would resolve all the the NTP servers, but lets roll with it)

DNS: dig <domain> (mean for request is 43.8 B and reply is 84.6 B)

NTP: busybox_NTPD -n -q -p time.nist.gov

\</comment></comment><comment></comment><comment></comment><comment>---

Egress:

Single DNS request : 20 (IP) + 8 (UDP) + 44 (DNS) = 72 B

NTP request (2 packets): 20 (IP) + 8 (UDP) + 48 (NTP client) = 76 B

Total egress: 72x6 + 76x2 = 584 B

\</comment><comment></comment><comment></comment><comment>----

Ingress:

Single DNS reply: 20 (IP) + 8 (UDP) + 85 (DNS) = 113 B

NTP reply (2 packets): 20 (IP) + 8 (UDP) + 48 (NTP server) = 76 B

Total Ingress: 113x6 + 76x2 = 830 B

\</comment><comment></comment><comment></comment><comment>----

The total bandwidth used according to my calc is 1414 B. So their number of 138 KB is actually 1.38 KB (which is 1380 B, and that's closer to my number. I rounded up if you look at my numbers)

So their number of 715 MB is actually right. Just an error with 138 KB -> 1.38 KB

</comment><comment><USER17> Don't bother with repeaters. Get normal access points, and install several of them if you need to disperse the range around a large area/building/complex. If the SSID and security passphrases match, clients will roam seamlessly between the different APs. I suspect the reason people buy repeaters is that they don't realise that this is possible, or they don't want additional cabling.

Repeaters add latency and I can't imagine any network engineer would ever recommend one.

<comment><USER18> _> > Don't bother with repeaters. Get normal access points, and install several of them if you need to disperse the range around a large area/building/complex._

Or better yet, buy a bunch of Ubiqity UniFi's, which were specifically made for this purpose and should provide the most seamless and efficient way to blanket your house in Wifi (provided you already have cabling to the access points). They are not cheap, but also not extremely expensive compared to a decent router either.

<comment><USER19> >Or better yet, buy a bunch of Ubiqity UniFi's

Warning: do not follow this advice; Ubuiqiti products are like potato chips in that you can never eat just one.

Oh I'll get the AC PRO access point, you think. Five minutes later you've set it via quick QR code scan and the UniFi app. That was painless! No wonder people recommend these things.

Oh wait I need to make some more device tweaks but UniFi won't do it.. better get the cloud key thingy that manages the device. I'll have one of those.

A couple of months go by and you discover your Google Home device or NEST doesn't work with beam steering. Wait, you can manage the advanced AC PRO settings using their own software? Fine I'll build a small PC to run that since if you're going to do it may as well see the stats all the time.

Hmm... KRACK/sploit-du-jour is out, maybe I'll just get a new Edgerouter since it's already fixed there. Oh wait, there's a fringy area in my house I'll bet another AC PRO or maybe an AirMax repeater would be just the thing.

Oh dear, I seem to be running out of ports, better go ahead and get a nice POE switch since that'll declutter things a bit. Etc.

<comment><USER20> I agree. I purchased some Ubiquity gear a few months back after a condo purchase, and ran into few problems:

\- UniFi brand works well for setup, but the cloud controller is necessary for command/control management outside of iOS/Android app.

\- EdgeRouter is not a UniFi product and does not act as a cloud controller.

\- EdgeRouter X does not deliver 48V PoE; upgrade was needed to power the AC- PRO.

\- EdgeRouter UI is horrid and it's much easier to manage over SSH.

\- Cloud Controller is easy to setup, but doesn't work with all product lines.

tl;dr The hardware is really good, but software is lacking, especially because not all hardware is UniFi compatible.

<comment><USER19> My response was tongue in cheek but seriously I recommend budgeting a VM or Raspberry PI to run their controller software which offers the most configuration options.

[https://www.ubnt.com/download/unifi/](https://www.ubnt.com/download/unifi/)

<comment><USER21> The Unifi cloud stick isn't that much more expensive than a PI, and is probably the least amount of work to set up a dedicated controller.

I use an Atom based PC stick that I had lying around to run the controller (on Windows) and it works great.

<comment><USER19> I mistakenly thought the cloud key ran a lesser version of unifi than the distribution found on their website, however googling around implies it's the same version. So I suppose budget for a cloud key or a pi. A raspberry Pi 3 is 64 bit, runs Fedora natively and can serve up other functions beyond the key. So I lean towards the Pi but if they're functionally equivalent I suppose it's down to personal preference.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> I ran a public NTP server for around a decade. I finally stopped, but these sorts of vendor abuse weren't the reason why.

We started running them before the NTP pool (though we eventually did include our servers in the pool). The worst it got was a largish regional ISP had put our servers in their CPE, and one day they had an event where they rebooted all of their CPE at once. That caused a noticeable spike in our network traffic.

The real DDoS that caused us to stop offering public DNS service was: misguided network admins. The week I had the second network admin calling me, asking why my network was attacking their network, and then started yelling at me over the phone and hung up in a huge huff. He had installed some sort of IDS and it was triggering on NTP traffic, and rather than investigate it he just called our emergency hotline and got me out of bed to deal with it.

"Those packets you are receiving are in response to packets you are sending our NTP server asking for the time." was not the answer he was looking for I guess. :-( Honestly, I was already mad from being woken up (the emergency hotline says it is for service outages only), and that it was the second call that week on it. So I take some blame in the call not going well. But this dude never stopped yelling at me.

The problem with running a public service is: The administration doesn't scale with the number of users.

<comment><USER23> NTP uses UDP, so he was probably the victim of a spoofed NTP request amplification attack. He probably didn't have clients that we're actually requesting the time, the requests were just spoofed to look like they came from his IP.

<comment><USER22> My recollection was that the volume coming from this one site was tiny, not like a DDoS. I don't recall if he said as much or if I was reading between the lines, but it sounded like he had just set up some sort of IDS, and it reported this traffic as an attack, and he just took that at face value.

We did have some UDP multiplication attacks at other times, mostly on our authoritative DNS servers. I don't recall that we ever had any against our NTP servers that I noticed. But we did block the broadcast address so the best multiplication vector was via DNS requests, IIRC the NTP responses were fairly short.

</comment></comment></comment><comment><USER24> Somewhat unrelated but if you are looking for a rock-solid router, check out Microtik. I've been through half a dozen routers over the years, with and without custom firmware, and having owned a Mikrotik Routerboard for the last year, it's the first one that just works 100% and never drops connections. Easy to set up if you know what you are doing and customizable if you want to dig in.

<comment><USER25> Yeah, Mikrotik have great devices for reasonable prices, but it is irritating that you can't run own applications on it, there is no publicly available working kernel to run under MetaROUTER, and they want 45$ for GPLed sources

[https://mikrotik.com/downloadterms.html](https://mikrotik.com/downloadterms.html)

</comment></comment><comment><USER26> This kind of stupidity happens to NTP frequently. The ironic thing is NTP is so lightweight that sometimes it's better to just answer the query than try to block the traffic. The DNS traffic is more expensive than the time query!

Note this was reported on the NTP Pool Discourse about 3 weeks ago: [https://community.ntppool.org/t/software-and-devices- without...](https://community.ntppool.org/t/software-and-devices-without-a- vendor-zone/28/26)

</comment><comment><USER27> I discovered PC engines APU boards and now I do all my routers/network thingie with it and OpenBSD. I'm quite sure there are some nice GUI "ala pfSense" too, but I like my configuration files better.

</comment><comment><USER28> I purchased cheap crap TP-Link access points and replaced the firmware on each one with open-wrt[1] and they all works extremely well for many years now. The Stock firmware is total junk and crashes all the time.

[1] [https://openwrt.org/](https://openwrt.org/)

</comment><comment><USER29> One silly thing that I hadn't thought of; the use of NTP for devices like this should mean that the NTP operators can gather pretty accurate statistics about each device's market share.

I guess the same folks who design software that spams things like this don't bother working too much on making it hard to fingerprint their devices, either. On the other hand, I haven't looked at the NTP protocol recently. Perhaps this isn't even possible due to the protocol's simplicity?

<comment><USER30> dns is a better target for this. Google even had rob pikes team do this sinkhole for them. which says its an expensive and worth goal and not some afterthought.

</comment></comment><comment><USER31> Slightly tangential, but I've recently been writing a command line tool to talk to some TP-Link Smart Plugs, and discovered that they regularly talk to 'devs.tplinkcloud.com' even if you don't enable a TP-link Cloud account.

More details here (not my site): [https://www.softscheck.com/en/reverse- engineering-tp-link-hs...](https://www.softscheck.com/en/reverse-engineering- tp-link-hs110/)

<comment><USER32> I changed the server url on mines to "localhost". I control the plugs via a script on a docker container (they pilot water pumps). It works well that way.

</comment></comment><comment><USER33> oh, f--k, every TP-link box on the planet is hitting nz.pool.ntp.org every 5 minutes? you guys know we only have a couple of cables connecting us to the rest of the world right?

Please don't buy TP-link, you're DoSing an entire country

<comment><USER34> 5 times a second !

<comment><USER35> Once every 5 seconds.

</comment></comment></comment><comment><USER36> Reminds me about the D-Link vs phk NTP drama years ago [https://slashdot.org/story/06/04/07/130209/d-link- firmware-a...](https://slashdot.org/story/06/04/07/130209/d-link-firmware- abuses-open-ntp-servers)

</comment><comment><USER37> Wow! 11 years ago Dlink were the ones abusing NTP [https://m.slashdot.org/story/67096](https://m.slashdot.org/story/67096)

Strange how these "mistakes" keep cropping up. Is it laziness, malice, or just ignorance?

<comment><USER38> Laziness and ignorance (probably not even knowing what they were doing other than just using these ntp servers) at the beginning. I bet someone just "copied and pasted".

</comment></comment><comment><USER39> Honest question. How would you begin discovering this kind of leakage? Do you need some sorry of tap that records protocols and Mac addresses? Do these firmware emplacements have this as a built in feature. With so many IOT devices being plugged in seems like this would be handy

<comment><USER40> Lots of enterprise equipment have features where you can mirror traffic off an ethernet port and monitor it, but it is cheap and easy to do if you are poor too. Dig up a 100MB hub, not a switch, and then with another computer plugged into that hub run a program like Wireshark or tcpdump.

This is one reason why I don't run all-in-one router/wireless combos. Most integrated (especially provided by ISP units) devices have no way to tell you what is being sent over the air and then to your ISP.

</comment></comment><comment><USER41> @dang why did you change the title to this (from the article's title)?

</comment><comment><USER42> Didn't TP-Link backdoor one of their routers, additionally in a remotely- exploitable insecure way that they never patched?[0] Am I alone in that putting a company on my eternal shit-list? Looks like a good choice in retrospect if they're still coming up with things like this.

[0] [https://tech.slashdot.org/story/13/03/15/1234217/backdoor- fo...](https://tech.slashdot.org/story/13/03/15/1234217/backdoor-found-in-tp- link-routers)

</comment><comment><USER43> > To put this number in context: an always-on Windows device will use around > 1,6 KB per month.

Windows doesn't do time sync properly so that's hardly a relevant comparison

</comment><comment><USER44> Well I run a TP-link repeater and now thinking of getting something better. Someone know any routers or repeaters with reputation for good firmware?

<comment><USER45> The Ubiquity Unifi stuff looks good and not very expensive.

<comment><USER46> Speaking from experience, it _is_ good. Takes a bit of networking know-how to set it up though, and you still need a router. Their consumer oriented stuff like the AmpliFi is quite excellent too and a bit friendlier.

I use an Edgerouter Lite, a Mikrotik switch and UniFi APs for myself and was so pleased I bought the AmpliFi mesh for my parents.

<comment><USER47> I have a similar setup, without the switch and the Unifi APs are just excellent. Smooth setup, great range.

So, if you can run a cable, I second Unifi.

Op, if you can not run a cable, maybe look into a mesh network. Repeaters "loose" about half of the bandwidth anyway, a mesh might be good alternative.

If you want to set up an open source enviroment, there is libremesh ([http://libremesh.org](http://libremesh.org)).

If you just want to buy something, there are products from Netgear (orbi), Linksys (Velo) or Ubiquiti (Amplifi). If you have a Fritz!Box-setup from AVM, you might be able to use their mesh features (site in German, because if you have a FritzBox, you probably speak German ;) [https://avm.de/mesh/](https://avm.de/mesh/))

<comment><USER48> Ubiquiti also has a line of Unifi mesh gear: [https://unifi- mesh.ubnt.com/](https://unifi-mesh.ubnt.com/)

</comment></comment></comment></comment></comment><comment><USER49> This issue has been fixed by a new firmware release from TP-Link. The updated firmware changes the behavior to use ICMP pings on the local network rather than NTP+DNS requests out on the public internet. [https://www.ctrl.blog/entry/ntplink- fixed](https://www.ctrl.blog/entry/ntplink-fixed)

</comment><comment><USER50> Just replace its firmware and load the router with LEDE/openwrt instead.

LEDE is an Openwrt fork, and it might merge back to Openwrt sometime.

LEDE is under active development and its newest release is 17.01.4 [https://downloads.lede-project.org/releases/](https://downloads.lede- project.org/releases/)

</comment><comment><USER51> I've been seeing an unusual amount of NTP requests in my PiHole logs but never got round to figuring out the cause - nice to have an explanation.

Hope this is fixed in a firmware update, my repeater is quite a nice device otherwise.

</comment><comment><USER52> TP-Link is a major networking equipment manufacturer globally and one of the largest in China, just behind Huawei. They are one of the few who design equipment firmware/software and hardware in-house[1] and certainly have resource (man+money) to get the network protocol implementation right (sometime they don't) for their products and I wonder if the author has proactively reach out to them so that they can fix it for all (rather than public shaming and/or product ban)?

[1]: [https://en.wikipedia.org/wiki/TP-Link](https://en.wikipedia.org/wiki/TP- Link)

</comment><comment> void-star Strongly suspect this device doesn't have a RTC...

</comment><comment><USER53> About every 5 seconds Ubuntu is making DNS lookup for: daisy.ubuntu.com.

</comment><comment><USER54> slightly off topic, can anyone recommend a good router for home use? It seems like every major brand router is just awful.

<comment><USER55> As others have said, check out Mikrotik.

I recently bought [https://mikrotik.com/product/RB952Ui-5ac2nD- TC](https://mikrotik.com/product/RB952Ui-5ac2nD-TC). It was much cheaper than my previous stock Netgear router but it's orders of magnitude better.

This live demo of their web UI at [http://demo.mt.lv/](http://demo.mt.lv/) and [http://demo2.mt.lv/](http://demo2.mt.lv/) should give you a good idea of what you get.

</comment></comment><comment><USER56> I know there's a joke to be made here.

"TP" link firmware is peeing in the pool of ntp servers...

I think I need more coffee first.

</comment><comment><USER57> > an always-on Windows device will use around 1,6 KB per month

How is this possible? Is the author ignoring Windows Update?

<comment><USER58> I'm thinking he's just referring to the traffic relevant to the TP-Link firmware - otherwise there's no way to make any relevant comparison.

</comment></comment><comment><USER59> I use a TP-Link travel router while on the road to get access for all of my devices in hotels that have device caps, and for my Android TV devices which don't gracefully handle hotel login prompts.

I have to say that the convenience, ease of use, and reliability of the product far outweighs any concerns I have over ~715MB over the course of a month. It boots quickly once plugged in, it reliably handles 4-5 devices utilizing it as a bridge for the hotel wifi, and I have never had it crash, give me any sort of wonky behavior, or anything of that nature.

<comment><USER36> Don't forget that those 715mb you take have to be delivered by someone running those servers at the other end, multiplied by the number of devices. Don't be a vandal on the internet. Don't be the reason for why we can't have nice things like community ntp pools.

<comment><USER59> If the NTP pool has an issue with what TP-Link is doing, they should talk to TP-Link. If TP-Link is unresponsive to their concerns, then they should be public about it. It is not the responsibility of random consumers to know about how two other parties interact with each other.

This appears to be entirely a supposition that the NTP pool cares that TP-Link is doing this, without any evidence from the actual people in charge of it are concerned. As best I can tell, this blog is not run by Ask Bjørn Hansen and neither he nor the ISC have voiced any concerns here.

<comment><USER60> Ask Bjørn Hansen encouraged TP-Link to comply with the vendors system and get its own hostname, back in January 2017.

* [https://community.ntppool.org/t/software-and-devices-without...](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/26)</comment></comment></comment></comment>


Older adults and internet use - <AUTHOR> http://www.pewinternet.org/Reports/2012/Older-adults-and-internet-use.aspx

<comment><USER2> Article about older adults and the internet.

Use 13 px font size.

<comment><USER3> It might have been about older adults, but that doesn't mean their target demographic is older adults.

</comment></comment><comment><USER4> I think we can thank Apple (at least to some great extent) for this. It was really hard to get my mom on email and browsing in general before she got an iPad. It's not that she didn't know how to, it was more that the experience of sitting in front of a computer, having been a teacher a ll her life, wasn't something that was natural for her. With her iPad, she's much more on-line and it's kind of like the internet (physically) came to her and not the traditional other way around.

</comment><comment><USER5> The main reason for this? The same people who were using the internet 10 years ago now qualify as "older adults".</comment>


A Vision of Post-Pandemic New York - <AUTHOR> https://www.bloomberg.com/opinion/articles/2020-03-31/post-pandemic-new-york-younger-cheaper-poorer-more-segregated <comment><USER2> I live in NYC, and this is possibly the dumbest article I've read in a long, long time.

Old people who live in NYC do so because they love it. They're not leaving.

Headquarters aren't going away. If you're in NYC it's for a good reason (access to labor/industry).

A "much poorer New York"? Not more so than anywhere else.

Develop the strictest test-and-trace? That would require them to get their act together, so no. This isn't a well-managed Asian city.

Subway ridership lower? People take the subway because they don't have a choice. Somebody explain to me how people are going to get to work instead.

And on and on.

The author teaches at a university in Virginia. Reading this article it's hard to imagine he's spent any time here in the city at all.

<comment><USER3> > Old people who live in NYC do so because they love it. They're not leaving.

They might not leave more than before, but they do leave. NYC is a very expensive place to live if you're not rich or don't have a high-paying job.

</comment></comment><comment><USER4> Seems a bit early for weird dystopian fantasies about populations segregated by covid-19 immunity status. Suggest the author go read Poe's Masque of the Red Death[1].

NYC will change and adapt. But from the perspective of someone living hear stuck in my apartment for the last few weeks, I wouldn't predict a mass exodus of older new yorkers. They are a pretty stubborn lot who live here for a reason. Maybe if we get recurring waves of large scale infections they would leave, but at that point, so would most people who could.

I would predict more wealthy families with school age children who have been considering the suburbs will likely leave, but a percentage of them leave every year.

I think one of the more likely and immediate impacts will be closings (as in going out of business) of many restaurants, delis, and bars and financial hardship for everyone who worked for them.

I got a request from a local restaurant I've been to exactly one time to donate to a GoFundMe to save the restaurant. I'm not sure what to say about that... Doesn't feel like a reasonable 'ask' to me. The place is good, but not sure my current priority for charitable donations should be a 30 seat restaurant with $35 entrees.

[1] [https://www.gutenberg.org/files/1064/1064-h/1064-h.htm](https://www.gutenberg.org/files/1064/1064-h/1064-h.htm)

<comment><USER5> > not sure my current priority for charitable donations should be a 30 seat > restaurant with $35 entrees.

Doesn't this illustrate the issue with market decision making in general?

Rationally wouldn't you want to go on funding the things you wish to happen / enjoy in equal proportion to before the crisis, if the money flows are still the same (e.g. you can still 'virtually' tip the waitress at your fancy restaurant etc?)

<comment><USER6> The money flows can't be the same overall when lots of people aren't working. No matter how you make decisions, someone has to be worse off from the loss of the value their work would have produced.

</comment></comment></comment><comment><USER7> I'm really interested/worried about what the transit situation will be like post-COVID. New York is one of the few cities in the US where public transit use cuts across class lines to a major extent, but it's also the place where we come into close contact with hundreds of strangers on a daily basis. I just don't see us going back to that in a heartbeat.

I'm _really_ hopeful that the city takes this opportunity to build proper infrastructure for people to bike around safely. There just isn't room for everyone to start driving a car.

<comment><USER8> New York is New York if and only if there is dramatically fewer cars. It is simply definitional.

Any retreat from public transportation would be astoundingly stupid. And in fact this whole piece is astoundingly stupid. Asian cities are the prior art of density combined with basic public awareness of epidemiology. None of the weird stuff the author talks about happens there to my knowledge.

<comment><USER9> If it happens, I see it happening not as deliberate policy but as a consequence of consumer preference. The MTA was already on their way to fucked before this happened. Poor policing policies have reduced the social penalties for turnstile jumping. Ridership (and fare intake) has been on the decline. The high cost structure, coupled with lower fare collection means more money has to come from the city/state via taxes, for which there is already stiff competition.

IMO, I don't really see the MTA coming back from this. The unions won't let them decrease costs (construction or operational). They don't have the capital to make the improvements that would increase automation, and even if they did they'd have a hell of a time getting that through the operating unions. Making the stations nicer just means you're going to wind up with more police chasing more homeless people, creating more opportunities for police-on-citizen violence caught on video.

<comment><USER10> It's strange to me to hear people blame turnstile jumping for the decline of the MTA. Its budget for operations has been repeatedly cut or diverted to large capital projects, which do nothing to improve service if operations are poor. Declining ridership and fare intake were a reflection of the poor operational state of the system - in 2017 and 2018, as the number of delays and major incidents skyrocketed, ridership went down. And when operations improved over the latter half of 2018 through 2019, ridership went up again.

Even if a low farebox recovery rate were the problem, the solution isn't increased policing. Many people in NYC simply can't afford to ride the subway, and you're not gonna magically squeeze money out of them.

<comment><USER9> I don't blame turnstile jumping, just see it as a symptom of the broader issues facing the MTA.

</comment></comment></comment></comment></comment><comment><USER5> As a Londoner I find this very difficult to believe and I think the situation is fairly similar across all of the major metropoles.

Basically everyone I know is chomping at the bit to get back to the pub and resume life as normal.

If there's an antibody test and enough people are infected, then I imagine that those that are immune will just act exactly as before and perhaps even find paranoid folk frustrating to be around.

A nonzero and significant fraction of people (I don't condone this FWIW) are still wandering around in the parks, having barbecues etc, because they simply don't want to face the idea of a life in which we are afraid of our common man - it's the essence of metropolitan life. The death of sociality is the death of London.

<comment><USER11> Nothing wrong with going to the park or cooking food outside, as long as you're maintaining social distance with people outside of your household. The virus doesn't spread by magic.

<comment><USER12> I believe the issue in London is the parks can get so busy, you can't maintain social distancing. Or at least, some parks can, when there's no coronavirus, and the weather is good, at weekends.

<comment><USER13> Maybe this shows we need more parks.

</comment></comment></comment></comment><comment><USER14> I've been living in NYC since before 9/11 when there was similar prognostication that this was the beginning of the end for NYC. That didn't happen either.

</comment><comment><USER15> Opinion columns like this are essentially blog posts. While that's fine, having a big name like Bloomberg stamped on it is confusing to many people, as they'll think this is an actual analyst prediction, which it's not.

</comment><comment><USER16> > Most of all, there will be an exodus of elderly residents.

What is this based on? Just because the outbreak is worse in New York now, does that mean it can't be like that somewhere else?

<comment><USER17> It's probably based on the fact that this virus is a coronavirus, and there are 4 other coronaviruses that are endemic, seasonal and to which we do not gain a lasting immunity after infection.

Given that the probable mortality rate for people over 70 is 10% or 15% for this virus, and that any vaccine will not be anywhere near 100% effective for 100% of the population, not living in a densely packed big city is entirely rational.

<comment><USER18> Do the elderly not wish to watch after the younger generations? Because schools are disease labs.

<comment><USER17> If it meant a 1 in 7 chance of dying, then I'd say no.

</comment></comment></comment></comment><comment><USER19> Biggest change will be the loss of small businesses, even more vacant storefronts.

If there is an exodus, it will be of blue collar workers to states like Pennsylvania.

<comment><USER20> Yes, small businesses will be hit hard and many will evaporate. But we'll see lots of regrowth afterwards if landlords lower the rents, which should make sense if they don't want to keep their properties vacant.

<comment><USER21> Landlords will lower their prices if they have lower costs or if the offer is greater than the demand. I don't see any of the two happening in big cities.

<comment><USER20> I am trying to understand what types of lower costs would the landlords need, property taxes? Those won't go down for sure but would it make sense to keep their properties vacant? I'm failing to see how this makes any sense. Still, I don't know much about what landlords have to deal with and how much sense it makes to them.

The offer will intuitively grow as there are more empty places but they may want to game that. It may be part of the problem and why we see lots of empty commercial spaces. If you live in NY it is quite disheartening to see empty storefronts on main streets, it adds to the depressive landscape. I think they may have become more than greedy and charged more than what the places were worth and now in the downturn are in a bind: lower prices and see a lot of the property generate rent (but that would force them to lower their current profitable rentals as well) or keeping it as it is.

<comment><USER22> From what I understand, the situation has become more complicated than the scenario of "landlord owns property, wants to make money on rent". It's now, "landlord simultaneously rents space to tenants and sells interest in the property to investors." Because the landlord is dealing in two markets simultaneously, the optimal decision for the landlord may look inefficient if you look at a single market.

The empty storefronts are bad, for sure. But to the landlord, reducing rent in order to generate additional income may revalue the property and put it underwater, which triggers clauses in the deals with investors and banks. And as far as I can tell, the whole thing is driven by how balance sheets can be presented to investors and banks, as much as it is driven by how properties can be rented to businesses.

My personal take is that this system killed SoHo. I also don't understand anything about real estate ¯\\_(ツ)_/¯

<comment><USER9> It's also possible that Covid-19 provides a reasonable cover for a large case of "big bath accounting". Individual building owners might not want to (or be able to) reduce rents/returns. But if happens across the ecosystem, then everyone resets expectations enough that businesses can return.

</comment></comment></comment></comment></comment></comment><comment><USER23> After all of this passes, what I think NYers will finally take from this is increased personal space, albeit minor increased personal space, and a greater adoption of contact-less methodology. If anything, it will give NYers more appreciation for soap and filtration. People will probably buy more house portable air filtration equipment than ever before. That and the MTA better finish their NFC payment system pronto and pay for a regular cleaning staff.

</comment><comment><USER24> America can barely test everyone who wants a test, I don't see mass anti-body testing with certificates being handed out.

</comment><comment><USER25> Not limited to New York but I think it would be interesting to see if this experience showed companies how much of their staff can work from home. And if it creates a new work from home trend for a whole new class of workers that weren't able to before. It seems it would be cheaper for both employers and employees.

</comment><comment><USER26> Seems a bit far fetched

</comment><comment><USER27> The article doesn't take in account of the possibility of vaccination available in the next year or so. Yes, people will meanwhile die. Yes, there will be short-term segregation. But I highly doubt that, once vaccination is widely available, the city will remain segregated into "safe" zones and poorer "infected" zones. That sounds dystopian at best.

</comment><comment><USER28> I'm not sure the author knows vaccines exist... In 18 months or less there will very likely have a vaccine, of course it will impact NYC, but it's not this mad max scenario.

Legit don't know how some people can get published in big websites such as this with such garbage content.

<comment><USER29> I would not count on it. There are other coronaviruses and we don't have vaccines for them. Of course I'm hopeful, but not ready to count the chicken here.

<comment><USER30> We don't make vaccines just for fun. It's quite expensive to do so and vaccinations, however safe, still have a little risk. You don't have to vaccinate against the other corona viruses because they don't pose a significant risk.

</comment></comment></comment><comment><USER31> probably the same thing it looked like after SARS, h1n1, and ebola, and all of the great pandemics a little further in the past.

which is to say we were already living in that time. its not that people forget, its that no one wants to remember. things are the way they are wanted to be. this is what we want.

coronavirus was dangerous in 2019, and still no one cared. our worldwide risk vs reward function appears to have a time window of about 3 days.

<comment><USER32> Nothing resembles this. We haven't had nationwide lockdown in a century. We haven't had folks hanging on published death count; wearing masks in public.

Being negative for the sake of it, is adding nothing to the discussion.

<comment><USER31> negative I surely am, but if I had to place a bet about sweeping worldwide changes in pandemic mitigations, I know which side id bet on. this is not negativity for its own sake, we have a clearly demonstrated pattern of behavior. hows that climate change mitigation coming?

you say a century like its prehistoric - that's barely more than 1 person ago.

EDIT: to further prove my point, you didn't respond to the part of my post where I said we clearly saw this coming in 2019. it exactly disproves your point - we DID see national lockdowns, we just didn't care.

<comment><USER33> > we clearly saw this coming in 2019

The overwhelming majority of people, the common person on the street, did not see it coming.

A week or two before my state got locked down I was at a meeting and for Other Business I said we need to establish how to hold next week's meeting online. Everyone there looked down at their hands, clearly thinking they were in the presence of a nut. Finally someone said, in the tone you talk to your drunk uncle at Thanksgiving who is a Fox News nut, "Well if a lockdown would ever happen we can email about it then."

<comment><USER34> Have you investigated how you get your news as a result? How was Italy at the time of that meeting?

<comment><USER33> Forgive me, I'm not sure what you mean. I perceive that the difference between them and me is professional training; I am a mathematician, in the Theory of Computation, and their training is in areas without the same consciousness about exponential growth.

The meeting was a Ham Radio club and so draws from a wide range including both white collar and blue. I didn't mean to talk down about the folks there, who are generally intelligent and thoughtful, and I only told that story to illustrate that the typical person was not thinking about hunkering even that close to the lockdown moment.</comment></comment></comment></comment></comment></comment>


Revenue Management for Meth Dealers in Flint (Fiction) - <AUTHOR> http://analyticsmadeskeezy.com/2012/10/08/revenue-management-for-meth-dealers-in-flint/ <comment><USER2> Who said microeconomics was not useful :-)

For those who are not used to that, it's a very simple linear regression, followed by an estimated demand equation, which you then turn into profit by multiplying each side by prices.

To find the local optimal, you look for the spot where the 1st derivate cancels (and the second is negative, unless you have a quadratic equation like that)

It's an example so well though and so simple that it should be in economics textbook, so that students see how to make more money with a simple application of sound principles.

(if the excel spredsheet was turned into an online collection, using say OLS to calculate the estimators, Victor would have had a SAAS pricing software instead of entering the stuff manually on his laptop! ain't that cool ?)

<comment><USER3> You would indeed have a rough draft of price optimization software.

Also, you could use our[0] more refined SAAS Pricing Software that takes more factors like time into consideration.

I know the HN crowd will like to know that the entire price optimization system is exposed through a REST API with code samples on github.

[0]<https://ventata.com>

</comment></comment><comment><USER4> I find the idea of putting together what is nominally dry economic analysis with a colorful story about drug dealers an interesting technique for making it more fun to read.

I'm guessing that guys who run state wide drug businesses do not show spreadsheets of their business to blogging economists :-)

<comment><USER5> I'd think that it would be advantageous for most of them to not keep spreadsheets.

<comment><USER6> I imagine the highest level of drug dealers use not just spreadsheets, but probably things like QuickBooks.

<comment><USER7> They typically use these things called "prestigious accounting firms" and "major international banks."

[http://www.theglobeandmail.com/report-on- business/internatio...](http://www.theglobeandmail.com/report-on- business/international-business/hsbc-to-pay-record-19-billion-fine-in-us- money-laundering-case/article6189108/)

</comment></comment></comment></comment><comment><USER3> _"But it's been confined to enterprises like airlines, car rental companies, and hotels implementing crap like Teradata and Oracle. This field has not been democratized, so it's kindof gone unnoticed in the big data conversation."_

This is precisely what we do.

Please check out, <https://ventata.com/> if you are interested in a price optimization REST API.

Our average customer is a small to medium sized business selling goods through eCommerce.

<comment><USER7> You should partner with <http://spreecommerce.com> and sell an integration into the spree backend. They're good people, hit them up on irc.

</comment></comment><comment><USER8> Site has already been knocked over..

Here is the Google cache: [http://webcache.googleusercontent.com/search?q=cache:rXK- EEu...](http://webcache.googleusercontent.com/search?q=cache:rXK- EEuT_B8J:analyticsmadeskeezy.com/2012/10/08/revenue-management-for-meth- dealers-in-flint/+&cd=1&hl=en&ct=clnk&gl=us)

</comment><comment><USER9> This is ok if costs are fixed, but if costs aren't fixed you should maximize profit, not revenue. Drugs, in particular, don't have fixed costs because they can be bought in greater quantities at lower per-unit cost as demand increases; there are strong economies of scale.

<comment><USER10> With meth, you don't really need to import it. I would think the cost of meth is more fixed than other drugs.

<comment><USER11> It plays out at a slight remove:

<http://www.pbs.org/wgbh/pages/frontline/meth/etc/cron.html>

The part I think is pertinent here is that there is little illicit manufacture of ephedrine and pseudoephedrine (so the availability of meth varies with the availability of them).

<comment><USER12> This is why drug stores are required to alert law enforcement if they notice anyone trying to buy a large amount of Sudafed, or trying to buy a small amount very frequently. So now there are people whose jobs are to drive around to every drugstore in the town, buying small amounts of Sudafed at each one, so as not to raise any suspicion.

</comment></comment></comment></comment><comment><USER13> I saw a documentary, not so long ago from one city in Napoli, where it were the biggest drug dealing in Europe, the drug dealers do it all in the walls, most of them didn't know how to sum properly. They made so much money that kind of errors were normal.

</comment><comment><USER14> There were two parts I didn't understand: One, how was the equation for revenue derived? Is it common knowledge that Revenue, as a function of price, is equivalent to your demand times your price? This wasn't obvious to me. Second, how is R^2 derived?

<comment><USER15> If you're in excel, R^2 values is just a couple check boxes away.

The actual math is: If you have a scatter of data (x, y), then you can get a measure of the variability of your data by taking the sum of squares of (y - avg(y)) for all your data points. Call this V

Further, if your doing say a simple linear regression, then for every x, you can have an f(x) which is suppose to be an 'estimate' of y. So then for all our given data points, we can find an error, which is basically the distance of y from the fitted line (y-f(x) basically). Then we can take the sum of squares of those errors get what is sometimes called our residual sum of squares. Call this W.

The R^2 value is defined as 1 - (R/W). So we can see that for very good fits of data, R^2 will be near 1, and for poor fits of data, R^2 will be near 0.

Edit: I guess to throw another bit at you. Often in microeconomics, you assume that as long as you can meet a demand at a certain price, then you will in fact sell however much is demanded at that price. So as an lemonade stand, if there is a demand for 100 cups of lemonade at 50 cents a cup, and you have 100 cups of lemonade and are also willing to sell at 50 cents a cup, then you WILL sell 100 cups. In which case, the revenue = price * demand kind of falls out by itself.

</comment></comment><comment><USER16> That revenue optimization curve looks almost exactly like the Laffer curve, used to optimize tax revenue: <http://en.wikipedia.org/wiki/Laffer_curve#Justifications>

</comment><comment><USER17> Has someone made a HN bot that automatically caches pages before they reach the front page, and offers the page snapshot if the page goes offline via userscript?

</comment><comment><USER18> Personally I would've paid for the coke in cash instead of making myself accomplice to a federal felony :)

great read anyway.

<comment><USER19> I'm not so sure giving a criminal advice is a felony. I'm no lawyer though. Seems like as long as he doesn't sell coke, he's in the clear.

<comment><USER20> You do realise this story is completely made up, using colourful narratives to illustrate the problems he's talking about?

<http://analyticsmadeskeezy.com/what-the-hell-is-this-blog/>

<comment><USER19> I did, and I was speaking about the character. :)

</comment></comment></comment></comment><comment><USER21> from the sheet: price per g = $100, demand 52kg, revenue $520,000 $100 _52_ 1000 = $5,200,000 Perhaps he's selling 5.2kg/month, not 52kg?</comment>


Successfully lending without creditor rights, collateral, or reputation [pdf] - <AUTHOR> https://helda.helsinki.fi/bof/bitstream/handle/123456789/14908/dp1317.pdf <comment><USER2> The first 7 pages of this was an absolutely fascinating read.

TLDR; In 1800s China, they had "student loans" for aspiring government officials. The caveat was these officials had to hire a "trusted assistant" into their administration, supplied by the bank. This assistant both ran the province and enforced repayment of the loan. These assistants were also seasoned governing pros. Even though the officials were less experienced, these loans ended up paying the banks greater returns.

Moral of the story: I've got the brains, you've got the looks. Let's make lots of money.</comment>


How to get your first 1,000 users - <AUTHOR> http://swombat.com/2011/2/8/how-to-get-your-first-1000-users <comment><USER2> The question from a few days ago which gave me the wrong impression and which did not get, say, an answer giving a link to any of these pieces:

<http://news.ycombinator.com/item?id=3923569>

And I am apparently about to go to dinner.

</comment><comment><USER3> That was a waste of 5 seconds.

<comment><USER2> Maybe you missed the article it linked to:

[http://viniciusvacanti.com/2011/02/08/how-to-get-your- first-...](http://viniciusvacanti.com/2011/02/08/how-to-get-your- first-1000-users/)

I searched and though it is over a year old it does not appear to have been previously posted here. Yeah, the summary is a waste of five seconds but unfortunately it appears that without an HN top dog to espouse it, the actual original article would never see the light of day. I considered bitching about it myself but didn't, wondering in part if my motive is mere jealousy or something since I do plenty of original writing that never sees the light of day either....etc..etc.

Edit: another, similar article posted three years ago on hn: [http://www.vinnie.net/2009/03/10/10_ways_to_get_your_first_1...](http://www.vinnie.net/2009/03/10/10_ways_to_get_your_first_1000_users/)

Of course, that makes swombat far savvier than me since posting that link here does absolutely zero to develop my own following, web presence and so on. Story of my life/ clearly, I will never learn.

<comment><AUTHOR> I often link to swombat's summary rather than the lengthy originals because I find the summary useful to determine if the original will be worth clicking through to. I guess not everyone feels the same.

FWIW, the original was submitted just over three months ago: <http://news.ycombinator.com/item?id=3498473>

Personally, I found it useful to revisit these ideas.

<comment><USER2> I appreciate you posting it as well as letting me know the original posted here. And, looking closer, it appears swombat is not guilty of the thing that annoyed me, which is that someone recently asked "how do you get your first 1000 users" and didn't get much response and then this appears here just a few days later which gave me the erroneous impression he dug up some old article and did a quickie post, inspired by the question. But the date on his summary is also from last year.

I am just personally annoyed by the social pecking order crap generally. My aversion to playing king of the hill has long kept me at the bottom of the heap. It is very much a personal issue. Chalk it up to bad mood, homelessness, fever and general injustice in my life.

Edit: However, I will note there was no discussion on the original. Why? Probably because the author seems to be an hn unknown.

<comment><AUTHOR> With the current popularity of HN in general there is now a huge dependency on timing and luck in any submission. Some people have favorite authors they look out for, and they get more upvotes in the noise, but it's all pot luck.

I'm working on a site that auto-discovers interesting people for you and might avoid the "celebrities get the votes" problem. Email me if you're interested. It won't be ready soon, but you'll go in the project folder.

<comment><USER2> My major malfunction probably boils down to "I don't know how to get discovered." And I have tried an awful lot of the things I have read you are supposed to do and/or which have worked for other people here. None of it ever pays off for me.

And I'm seriously feverish today. I don't think I really understand your last paragraph. But thank you for your gracious response.</comment></comment></comment></comment></comment></comment>


Kyoto Cabinet - <AUTHOR> http://translate.google.com/translate?js=y&prev=_t&hl=en&ie=UTF-8&layout=1&eotf=1&u=http://alpha.mixi.co.jp/blog/%3Fp%3D1795&sl=ja&tl=en

<comment><AUTHOR> The translation isn't great.. the author Mikio also wrote TokyoCabinet. KyotoCabinet is a sibling of TC written in C++ with support for STL maps and some other goodies. It also has a snapshot capable store called 'CacheDB'.

EDIT: Here are slides in English: [http://www.slideshare.net/estraier/introduction-to-kyoto- pro...](http://www.slideshare.net/estraier/introduction-to-kyoto- products?from=ss_embed)

Site: <http://1978th.net/kyotocabinet/>

<comment><USER2> lleb, do you have contact info?

</comment></comment><comment><USER2> This looks like a fantastic sequel to Tokyo Cabinet.

The first sentence translates to "Mikio is to live quietly." It should read, "Mikio is nothing less than a Greek God."</comment>


Covid-19 Test kits exports by country in 2018 - <AUTHOR> https://wits.worldbank.org/trade/comtrade/en/country/ALL/year/2018/tradeflow/Exports/partner/WLD/nomen/h5/product/300215 <comment><USER2> 2018??

<comment><AUTHOR> Yeah seemed interesting to me considering. That was why i posted it. You'd expect them not to exist at all prior to 2019.

<comment><USER3> You can probably swap out the test strip or whatever from the kit. The secondary text lends to this interpretation</comment></comment></comment>


The Language Integrated Quantum Operations Simulator - <AUTHOR> http://stationq.github.io/Liquid/ <comment><AUTHOR> Some samples can be seen with any .fsx file under [https://github.com/StationQ/Liquid/tree/master/Samples](https://github.com/StationQ/Liquid/tree/master/Samples)</comment>


Parallel programming is hard. Right? - <AUTHOR> http://lbrandy.com/blog/2010/02/parallel-programming-is-hard-right/ <comment><USER2> Good article but I think it falls into the same trap that all 'smart people' (read: experts) do. I write multi-threaded embedded code in C for a living. It's hard - But it's not that hard... But that's because I do it for a living ALL THE TIME. If someone has a passing need for this kind of thing I don't think the arguments in the article hold water.

For people who don't do "This thing I'm an expert at and claim is not so hard" as often as the expert in question it really _is_ that hard. Things get easier, and people better, with practice. Now, if this is something you plan on using a lot in your job / particular programming field then you shouldn't be afraid of multi-threaded programming but if this is going to be a small passing item that you work with rarely if ever you should probably use existing libraries / abstractions for this type of thing.

<comment><USER3> Has the author _really_ written lots of multithreaded code?

Lots of people think they understand multithreading because they understand the synchronization primitives. "I'll just share this synchronized HashMap among my threads and everything will be fine". Not so. Because your code makes implicit assumptions about that HashMap all the time, e.g. that you can check if an element is in the map and if not, add it (but another thread added it after you checked); that the map won't change and throw an exception while you iterate over it because my loop doesn't change it, etc.

I don't think granularity is the hardest thing about multithreaded programming, it's these implicit assumptions. In an imperative language we just tend to think about our code as if it is single threaded and nothing changes until you change it. Then you get rare and irreproducible bugs in your program.

<comment><USER4> I think I agree with both. The impression I got from the article was that even after you've carefully identified all shared datastructures, and made sure they are as few as possible and locked properly, you still have to decide how to structure the parallelization. This will have effects on how it scales to higher # of cores and larger problems and is, in some sense, a less constrained problem because you don't know where to look. At least wrt synchronization, you can make a list of shared data and go through it.

<comment><USER3> The article says: "You can almost always use a simple locked data-structure for synchronization fairly painlessly (and with a bit of practice, you can usually write one fairly painlessly, too)."

If we focus on the first part, in my experience it is wrong: you can't rely on the data structure to do synchronization for you, because these structures only guarantee that internally they will work consistently, not that using them you can forget about synchronization and threading. Quite often you need to do your own synchronization on top of them, and it is easy to miss some cases. That's what my examples are about.

</comment></comment></comment></comment><comment><USER5> > (note: this post is mostly about data-parallel programming, or other > parallel optimizations for computational performance purposes. There are > other reasons to use concurrency, but I'm not sure my argument will hold in > most of those cases.)

Respectfully, I think the usual claim is that _concurrent_ programming is hard, not that parallel programming is hard. So, while the article is interesting in its discussions of the performance trade-offs involved in implementing data-parallel algorithms, it's arguing against a strawman, I think.

</comment><comment><USER6> Using high-level, no-brainer parallel constructs is kosher (like a pre-built, concurrent data structures lib built by odd people like Doug Lea), similar to the advice about cryptography. Playing with the atoms yourself is dangerous. You can understand the concepts well, be contentious in your coding and build something the right person can drive a truck through.

How do you verify correctness? How do you test? A bug might only present one in ten billion loops, perhaps when you push the cores really hard. Or fail on the new processors with the slightly different barrier/cache/coherency semantics. Or fail in ways that send you down a million heisenbug gullies. Without any proper tools or diagnostics (yet).

</comment><comment><USER7> This article covers mostly how _performant_ (as in fast/resource savvy) parallel programming is hard. Though robust parallel programming can be tricky too, and the way you "[Avoid] race conditions" will have an impact on performance. So the trade-off evocated in the article between speed, maintenance, memory could also take into account robustness.

<comment><USER4> But isn't the very reason you bother with parallelism that you need higher performance? What possible other reason could there be?

<comment><USER8> The _raw_ increase performance increase that you can get from parallel processing is _at the absolute maximum_ proportionate to the number of processors you can add to your program. Usually it is much less.

A raw performance increase is not the most common good reason for concurrency, for multiple threads or processes in an application though it's a common bad reason. Achieving a decrease in _latency_ is one common good reason to for concurrency on a single machine.

<comment> a-priori Being able to do processing and I/O in parallel is another source of speedup from concurrency on a single processor.

</comment></comment></comment></comment><comment><USER9> It seems like the author has very muddled notions of the separation between task parallelism and data parallelism. He talks about examples that could be data parallelism but then uses terminology like it's task parallelism. His section on race conditions is likewise muddied at best.

His basic argument at the top seems correct if you limit it to data parallelism. But if you read the rest of the article the author doesn't seem to follow the thread of his own argument.

At its core the notion that data parallelism is easier to debug than control parallelism is obvious. It is, and its often hardware supported. But unfortunately data parallelism is harder to write and often requires skill in math, so it's not used nearly so much.

</comment><comment><USER10> I'm not sure I understand this. Even if you buy the idea that "[y]ou can almost always use a simple locked data-structure for synchronization fairly painlessly," how is the choice of granularity anything more than the choice of what and where to lock? The choice of granularity is a response to the nature of the synchronization problem.

<comment><USER11> I think that he is correct in general, but his argument can be better constructed. A simpler way to illustrate the issue is: any shared memory model can be mapped to a message-passing model (in parallel computing) with equal efficiency. Since message-passing model is fairly easy and intuitive, the concern all boils down to find an optimal parallel solution to a certain problem. That step is really hard.

<comment><USER12> Message passing is easier than using shared-memory correctly, but ensuring that a non-trivial message passing implementation doesn't have any deadlocks is not what I would consider "fairly easy".

</comment></comment></comment><comment><USER13> I haven't yet seen a case where parallelism made the program easier to understand, write, or prove properties about; hence, if programming in general is hard, then parallelism makes a given program as hard or harder. So, yes.

<comment><USER14> Have you tried dataflow languages?

</comment></comment><comment><USER15> Check the 13 dwarves of parallel computing - [http://www.eecs.berkeley.edu/Pubs/TechRpts/2006/EECS-2006-18...](http://www.eecs.berkeley.edu/Pubs/TechRpts/2006/EECS-2006-183.pdf)

Just look on google for: "13 dwarves" parallel or "13 dwarves" berkeley

</comment><comment><USER16> Why don't articles like this ever discuss the need for education on patterns and abstractions around threading such as messaging (via actors), the use of immutability, etc.?

</comment><comment><USER17> the word "state" appears just once in that article. which surprised me.

<comment><AUTHOR> Heh. How many times should I have used it?

<comment><USER18> If you were talking about general currency i would expect to see it a lot. If you were talking about the subset of data parallel concurrency, I would expect to not see it very much at all.

<comment><USER17> yes; i missed the note part and didn't understand it was meant to be restricted in that way. sorry. (it makes more sense under that restricted view)

</comment></comment></comment></comment><comment><USER19> Absolute trash!! In one breath he goes from locking, synchronization to fine grained/coarse grained locking. Incomprehensible at best.

<comment><USER9> I am not sure why people downmodded you; perhaps your tone pissed them off. You're right though, the guy basically muddies up all his concepts.

<comment><USER20> The tone is rude, yes. It's OK to say that point X was hard to follow for reason Y, but calling the article incomprehensible thrash brings little to the discussion.

</comment></comment></comment><comment><USER21> The list of things in the article that are 'actually hard' are all difficult problems, but I think the article glosses over the most important part: expected behavior.

If you're just trying to do some number crunching across sixteen cores, it might be pretty easy to figure out what the expected result is, since you can compare it with a single-core version of the algorithm in question to make sure your results are right. But what if you look at some real-world applications that are highly parallel?

For example, both World of Warcraft and Aion have suffered from multiple highly visible race conditions in their game mechanics. This might sound simple, but in practice players are able to actually identify those races and find ways to exploit them - sometimes it is possible to exploit them in such a way that the player is able to earn gold or other in-game rewards more rapidly than other players. Since you can often convert in-game rewards into real- world ones, I think you can see where that goes...

The most likely explanation in the above cases is that the people involved in writing the code just didn't have a good understanding of concurrency, but that can't be all there is to it, because if you watch closely, the same concurrency related issues crop up in games and related software all the time.

A significant issue here is that in complex systems, it can be impossible to distinguish between a race condition and expected behavior. If your game has a button labelled 'win match', and two players press the button, which one should win the match? Do you compare the timestamps on the TCP packets that say they pressed the button, ignoring the impact of network latency? Do you try and compare local time data from their machines, ignoring the impact of clock drift? What if, by some fluke of nature, they both send in a request with the exact same timestamp? In a simple case, you'd never see this, but when you have 11+ million customers playing on a daily/weekly basis, such things can happen.</comment>


Ask HN: Does doing Yoga improve your work? - <AUTHOR> Am I hallucinating or is this a thing? Any CEOs, founders, execs who saw a visible difference, I would love to know! <comment><USER2> This is a thing. Yoga and meditation work -- and they work quite well. The science is young, but the research shows definitive results.

Some of these results include: 1\. Increased size and activity in the areas of the brain responsible for attention and emotion regulation, higher order cognition, interoception, and memory extinction 2\. Decreased activity in areas of the brain areas responsible for mind-wandering, memory retrieval, and emotional reactivity 3\. Increased telomere size and a younger looking brain. One researcher from UCLA (Dr. Luders) used an AI program to guess the age based on MRIs of different brains. Meditators were significantly younger. 4\. People who meditate regularly require less sleep.

This is just a small slice of example research. Most of the research is based on meditation. In my opinion, meditation is a tremendous part of Yoga, although not necessarily what we see in the Western World. Also, its important to note that there are many different ways to meditate and branches of Yoga. Each of these require different studies to understand the impact.

</comment><comment><USER3> You are not hallucinating. Get on with it :)</comment>


Buckyballs release electron-positron pairs in forward directions - <AUTHOR> https://link.springer.com/article/10.1140%2Fepjd%2Fe2019-100552-2 <comment><USER2> This makes no sense to me, but I don't know the lingo. Anybody care to explain?

<comment><AUTHOR> [https://phys.org/news/2019-12-buckyballs-electron- positron-p...](https://phys.org/news/2019-12-buckyballs-electron-positron- pairs.html)</comment></comment>


Conspire Analyses Email to Be Your Next Networking Tool - <AUTHOR> http://techcrunch.com/2014/10/10/forget-linkedin-conspire-taps-email-to-be-your-next-online-networking-tool/

<comment><USER2> I am amazed at how stupid these applications are. I just signed into Conspire again (tried it a year or more ago) and it sent me an update email like this: "You are losing touch with [X] and [Y]! Email them now". You mean my mother and my father-in-law? Both of which I have specifically linked as such in my Google Contacts? Thanks for that advice.

Same goes with these other services: Rapportive, Nimble, Mingly, Xobni, etc. They apply superficial statistics and send a daily alert that some person I exchanged one email with last year should be contacted. How about reminding me to keep in touch with colleagues from my previous job? Or a colleague leaves my company...therefore in 2 months send an email saying hello. Those would be useful reminders.

I predicted everything Conspire was going to send me today: stats on how quickly I respond to emails, % responded to, message volume. Who cares?? It's just comfort stats: feels interesting but actually isn't.

I am desperate for a semi-intelligent personal contact management system. Or at least a dumb one with a really great editing interface. The level of intelligence in these app is so slow I actually wish it were zero so they would stay out of my way!

<comment><USER3> The notification email with the stats isn't the product, it's just a feature. Conspire's real product is their search engine that can find the best person for introducing you to a contact or organization.

</comment></comment><comment><USER4> Isn't this inherently unprivate? There's a big gap between "I have emailed (or received email from) this person at least once" and "I speak to this person regularly".

Such a relationship is revealed by this software where you might not want it to be.

Consider you are speaking to a recruiter who just happens to be your most reliable connection between one of your contact and the contacts of that recruiter. In this case, it looks like your relationship will be revealed.

Then again, it seems like LinkedIn has never shied away from being sleazy and careless with your data so anyone using this will be expecting a lack of care anyway.

</comment><comment><USER5> 1\. Privacy-oriented people like myself will never connect to this service so they can, ahem, responsibly handle my email.

2\. The recruiters/founders who know me will (because it looks like it will really help them).

3\. I'm in the system now.

4\. go func() { for { Repeat 2 } } // concurrency so we can continue...

5\. My network is in the system (and tied to me)

</comment><comment><USER6> Is it really necessary for this service to have the ability to:

"View, manage, and permanently delete your mail in Gmail Create, update, and delete labels Compose and send new email"

I'm sincerely asking - it's not a rhetorical question. Does Gmail not offer more granular permissions than this?

Also: the other commenter's point re unexpected privacy leaks is a good one. I don't think I have any secrets that would be revealed through my correspondence habits, but I do so much email, I could be wrong. Do I have the ability to delete my info after I've registered if I don't like the service?

It's an interesting idea, and I'd like to give it a try, but without a little more assurance that I can trust them with access to my email, it's not worth the risk.

<comment><USER7> I'm a founder.

Re permissions: We use IMAP to access email data, so there is no granularity. It's all or nothing. We never move or delete messages and only send messages with your express permission. (Google offers a Gmail API that has slightly more granular permissions, but it is not peformant for our use case.)

Re deleting an account: Yes! You can delete your account and all of your data from our system with a couple of clicks. You can do that from your account page.

Please ping me with questions. firstname.lastname@example.com.

</comment></comment><comment><USER3> Conspire has become my go-to networking tool. It uses your real working relationships, so it's much more accurate and useful than LinkedIn. I've used it to make introductions, and to seek introductions, and it's incredibly powerful.

<comment><USER8> +1. I too have been using Conspire lately, and quite successfully. Great product.</comment></comment>


WikiHow's art is made by a network of freelancers, mostly in the Philippines - <AUTHOR> https://onezero.medium.com/we-finally-figured-out-who-makes-wikihows-bizarre-art-6c5d69b71347 <comment><USER3> > wikiHow instructed these freelancers on how "to create the most instructive > visuals for every step of every article."

Hopefully written and illustrated in genuine wikihow style

<comment><USER4> Talk about dogfooding!

</comment></comment><comment><USER5> Wikihow is gold mine of often hilariously bizarre tracings of stock or staged photos.

What surprises me is that there is no Wikihow filter for photoshop and instagram. So consider this my free gift to any enterprising HN reader who wants to make a small fortune with a wikihowification mobile app.

</comment><comment><USER6> [https://outline.com/wMXGZf](https://outline.com/wMXGZf)

</comment><comment><USER7> On a tangential note, there is r/disneyvacation/ that pokes fun aty the bad drawings on wikihow and recaptions them.

<comment><USER8> Not tangential: it is mentioned and linked in the article.

</comment></comment><comment><USER9> I have noticed this long ago when they put frozen tongue instructions[0], yet still i find instructions quite informative

[0][https://m.wikihow.com/Remove-a-Stuck-Tongue-from-a-Frozen- Su...](https://m.wikihow.com/Remove-a-Stuck-Tongue-from-a-Frozen-Surface)

</comment><comment><USER10> Lot's of images, similar style, creative commons license.

This sounds like an interesting dataset for fun project to generate images based on descriptions.

</comment><comment><USER11> Thank you very much OP for the clear title that save me a lot of time not wasted figuring out the reply to the clickbait title of the original article. If only the guys that are posting New York times articles and co could do the same...

</comment><comment><USER12> _Getting to the bottom of one of the internet's most ridiculously drawn mysteries_

Seems like quite a snotty article tbh.

WikiHow's art has always reminded me of "How it Works" style children's books, it seems functional and clearly has made an impression in some quarters.

By all means shed some light on it if that's interesting; I don't see the need for the condescending attitude though.

<comment><USER13> Devoid of context of the parent WikiHow article, the images are often surrealist and bizarre, which is why they've become something of a subcategory of memes.

Please look at the images in the article, if you haven't already. I made more than one audible guffaw just scrolling through them.

</comment></comment><comment><USER14> That illustration for "how to protect yourself from dogs while walking" doesn't appear on the current WikiHow entry. Did someone edit the entry and remove it or add different art?

</comment><comment><USER15> Man, what is that headline font?

<comment><USER16> It's hilarious. I've just learned a bit of Cyrillic during holidays, and even I can hardly stop reading it as "OpeZego" and so on. It must be almost unreadable for people from the many countries with a Cyrillic alphabet.

<comment> orbital-decay You can't imagine how often it happens when someone is trying to appear "Russian" or just trying to be fancy. As a native speaker, you can't help but keep reading it in Cyrillic, and the result is completely garbled.

<comment><USER17> The hall of fame includes "Tetyais" and "Boyadt".

</comment></comment></comment></comment><comment><USER4> This is the perfect opportunity for a new wikiHow article!

</comment><comment><USER18> [http://archive.md/Aqd4f](http://archive.md/Aqd4f)

<comment> blep-arsh Huh, does Medium just respond 404 when you try to visit it in incognito mode?

</comment></comment><comment><USER19> wikihow is a cancer on the internet, clogging google and google image results with inane how-to guides .for the purpose of generating ad revenue. It is not just that the guides are bad but they are engaging in keyword spamming by creating guides for things that don't even make sense

<comment><USER20> > wikihow is a cancer on the internet, clogging google and google image > results with inane how-to guides .for the purpose of generating ad revenue. > It is not just that the guides are bad but they are engaging in keyword > spamming by creating guides for things that don't even make sense

[citation needed]

But, seriously - you're alleging that they're a content farm. Can you substantiate that at all? Because from where I sit - as a former employee - <USER2> can attest that people working there genuinely believe in their mission to "teach anyone how to do anything." Moreover: it's a wiki! You can edit it! They have a thriving community of editors (not paid editors: community editors!) who work on the site, and frankly I don't think that describes content farms.

Calling wikiHow a cancer on the internet is just a huge overreach - there are actual content farms out there doing what you allege. wikiHow isn't one of them. It's absolutely fair to criticize the quality of the articles if you wish - but again; it's a wiki. Feel free to get involved if you don't like the quality.

<comment><USER21> > wikihow is a cancer on the internet, clogging google and google image > results with inane how-to guides

This 100x over. I've been trying to find a convenient way to block the domain from all my devices. It's all just utterly content-free cyber squatting.

<comment><USER22> Does the content on wikihow not deliver on what it promises to do? And if so, have you considered editing it - given that it's a wiki?

Of the things destroying the internet (Google AMP, and Pinterest, in that order), I wouldn't include wikihow.

<comment><USER23> No, the content on wikiHow does not deliver. It promises to help you learn how to do something, and I have _never_ successfully used a wikiHow article to learn how to do anything. The content is so low-quality as to be useless.

And "it's a wiki" isn't a defense. What is my motivation to improve it? Nobody trusts wikiHow anyways, so contributing would just be creating more content that nobody should trust.

<comment><USER20> "What is my motivation to improve it" is an excellent question in my opinion, and worthy of discussion. I don't know if I have an answer to it, but I do know that there isn't really another Wikihow-like place out there that's better. So at least my default answer would be "improve it because it's better than starting from scratch."

I do overall disagree with the thrust of your comment, though: your anecdote and mine cancel each other out. You haven't been helped; I have! On balance I think they are helpful. I don't have access to the statistics anymore but from what I remember, more people interacting with the website rated articles positively than not.

<comment><USER23> the wikihow-like place that's better is the entire internet. It contains more useful information than wikihow does (by definition, because it contains wikihow).

wikihow could be valuable if the content it contained had some generally assumed level of authority that was better than the internet at large, so you could assume that a wikihow article was more trustworthy than any other random result from google. as long as wikihow articles can't be assumed to be more helpful than any other google search result, google is a superior alternative to wikihow.

<comment><USER24> I feel that this a somewhat circular argument. The wikipedia-like place that's better is also the entire internet, no?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Please don't editorialize titles, four out of five times the editorialized title is strictly worse, and often it's straight up _wrong_ , like in this case. If you don't like the original title due to omission of info, you can at least use the HTML title:

> wikiHow's art is made by a _global_ network of freelancers, _primarily_ in > the Philippines.

(Emphasis mine.)

<comment><USER26> OP's headline saves you a click, versus the original title: "We Finally Figured Out Who Makes wikiHow's Bizarre Art"

<comment><USER27> Saving a click is probably an anti-goal of HN article titles.

<comment><USER28> I honestly prefer a headline that tells me a bit of the main point over one that doesn't.

</comment></comment></comment></comment><comment><USER29> Blocked reading the article because medium wants me to sign in.

Is Medium now forcing people to create accounts to read posts or is it just a setting that this subdomain turned on?

<comment><USER30> Medium is quickly going down the Quora path for me. The content quality is becoming poorer as more and more people use it as a place to dump their zero- traffic blog posts.

The aggressive content gating and pop-ups are another Quora-esque introduction.

Just a case of being blinded by metrics. Adding an aggressive sign-up form might get you more emails and sign-ups, but it will also annoy away better quality users.

<comment><USER31> It is worse than Quora now because Medium not only requires sign-ins bit asks for subscription to read.

<comment><USER32> It is also worse than quora because quora can be blocked easily in search results since it is one domain. People use medium with their own domains too, which makes it hard to block entirely.

</comment></comment></comment></comment><comment><USER33> _" To keep reading this story, create a free account."_

This is actually great. I won't create an account, so I've spent a lot less time reading empty posts on Medium and more time just going about my day.

<comment><USER34> ctrl+shift+n

<comment><USER17> ctrl+shift+p on firefox

</comment></comment></comment><comment><USER35> is "army" the correct term here? It isn't used in the article.

</comment><comment><USER36> I've never heard of the WikiHow site. It's one of a near-infinite number of engrish permutations that is never ranked in any of my searches or my parents' or my wife's. For a moment, I suspected I was missing out on something...nope.</comment>


Soviet Officer Stanislav Petrov, 'The Man Who Saved the World' (2017) - <AUTHOR> https://www.npr.org/sections/thetwo-way/2017/09/18/551792129/stanislav-petrov-the-man-who-saved-the-world-dies-at-77 <comment><USER2> Very inspiring, I am embarrassed not to have known of his story before today.

It's worth also referencing Vasili Arkhipov, who also showed us the importance of individual action:

[https://www.theguardian.com/science/2017/oct/27/vasili- arkhi...](https://www.theguardian.com/science/2017/oct/27/vasili-arkhipov- soviet-submarine-captain-who-averted-nuclear-war-awarded-future-of-life-prize)

</comment><comment><USER3> Not everyone can say they saved the world (and it be true).

RIP Mr. Petrov.

<comment><USER4> I wouldn't call it saving. It's more like not destroying.

You would hope that for a world ending event they would need verification from multiple stations reporting at the same time though...

<comment><USER5> I would call it saving it.

He specifically acted against bad information and what he was supposed to do, which required bravery and critical thinking to avoid catastrophe. It was also potentially risking very bad consequences for himself, as his superiors easily could have put him in prison, disappeared him, or otherwise punished his life - even just out of spite - for what he did. He says it was a good thing that he was working that shift and he is right. The odds are extremely high that anybody else would make that phone call up the chain of command, and from there the odds of a nuclear response escalate rapidly.

</comment></comment></comment><comment><USER6> Petrov day is going to be celebrated on the 26th, just a few days away. Whatever your nationality, whatever your profession please ask yourself: "Am I contributing to the destruction of the world? Is there something I could be doing to destroy the world less?" And then please act on that.

<comment><USER7> Or perhaps mainly consider your nationality.

There's a relatively small minority of the world population who live in one of the two countries with arms sufficient to "destroy the world" (although some of the runners up could certainly make life worldwide more miserable).

In practice people living in those countries have pretty much all the say in whether the world will get destroyed or not by choosing to vote for some nutcase in the next election. By comparison someone in <name pretty much any other country> has next to zero chance of moving the needle on potential world destruction.

<comment><USER8> The circle of people in those two countries who actually control the arsenal is very small in relation to the population. Diplomats from other countries probably have better access to them than any citizen of their own country.

Nationality plays a role in who has the actual power but anyone can promote peace and have a real impact. Influential words and good ideas can come from anywhere.

<comment><USER7> You don't need to directly control these systems to have a big influence. People in these countries (a tiny minority of humanity) opt to stay and pay the taxes that maintain these systems.

But the main moral culpability is just not caring. Nuclear safety isn't even on the mind of the average voter in the US or Russia. If it were an issue as important as major wedge issues as say guns or religion are in the US even a small fraction of the population could have a major impact.

</comment></comment></comment></comment><comment><USER9> A hero of the Soviet Union, if not officially.

Please add the publish date (September 18, 2017) to the title; it's called Hacker News not Hacker Archives.

<comment><USER10> To be fair, HN isn't strictly related to current events.

<comment><USER11> Yes it is. That's what the word news means.

</comment></comment></comment><comment><USER12> And who programmed the system that detected the missiles? Was there ever a post-morten of this incident?

</comment><comment><USER13> Stuff like this makes me wonder about quantum immortality. Maybe we just happen to be in the timeline where we didn't nuke ourselves.

</comment><comment><USER14> Needs "(2017)" in the title.</comment>


Punchgirls Job Board - <AUTHOR> https://jobs.punchgirls.com/about

<comment><USER2> > punchgirls

That's an odd name.

<comment><AUTHOR> Hi! The name was inspired by this article:

[https://medium.com/everything-old-is-new- again/8c5883a005c3](https://medium.com/everything-old-is-new- again/8c5883a005c3)

:-)</comment></comment>


CentOS Project Administrator Goes AWOL - <AUTHOR> http://linux.slashdot.org/story/09/07/30/130249/CentOS-Project-Administrator-Goes-AWOL

<comment><USER2> Damn, what if he's lying dead in a ditch somewhere and all anyone cares about is his AdSense account!

<comment><USER3> That's what I thought as well, but after reading more about it, it sounds like this has been a gradual disappearance. He would show up intermittently at meetings and never commit to actually getting anything done. His answers were always "I'll look into that later" and later never came.

I still hope that he's just burnt out and sick of the project versus being unwell or worse.

<comment><USER4> Open source projects are harsh mistresses, lots of flack and fairly little return for it. You have to have a thick skin to be active at a high level in open source.

</comment></comment></comment><comment><USER5> This reminds me.. I got to update the old.. "if a bus hits Tim" documents here at work.

<comment><USER6> It's nuts how many people and businesses just never consider this. I'd have thought that they'd be especially more careful since there's no binding contract or whatever between the developers.

As a separate sidenote (don't know if this is the case with centos), this might be one issue with the benevolent dictator for life method of running things, as efficient as it may be.

<comment><USER3> We actually refer to the "Train Number" on any of our given projects here. The train number is the number of people that could get hit by a train before the project fails. If the number is 1 (meaning there is a single critical point for the project), then we know that cross training has to occur.

<comment><USER7> I've heard it called Bus Factor (<http://en.wikipedia.org/wiki/Bus_factor>) or Truck Number (<http://c2.com/cgi/wiki/wikibase?TruckNumber>).

<comment><USER3> Yeah, we use Train number because the new light rail system is right outside our office and it looks like someone damn near gets hit from walking in front of the train about 3 times a day.

</comment></comment></comment></comment></comment><comment><USER8> I really hope his disappearance is the end of this story. The CentOS folks need to be double checking every bit this guy has touched and fully explore the other security ramifications. It is a bit concerning how much (PR) damage one person could do. I can't even grasp the level of crisis this would inflict on the Linux community (OSS in general) if the story turns worse. (sabotage, backdoors, etc)

<comment><USER4> not sure why you got modded down, this is a factor with the resignation of any key person in any major enterprise. Surely CentOS is no exception to the rule.

</comment></comment><comment><USER4> There is an open letter up at <http://www.centos.org/>

<comment><USER9> _Please do not kill CentOS through your fear of shared management of the project._

This.

<comment><USER10> CentOS itself may hit the skids but the thing that CentOS represents to the community will probably never die. Before CentOS had critical mass White Box Enterprise Linux was another distribution doing the same thing.

It may well be time for everybody else (signers on the open letter, for example) to found a replacement project and suggest everyone migrate over. Then the guy who's losing interest can decide whether he wants to play ball or go home.

<comment><USER4> several months of absence of a decision is also a decision.

It is funny that incidents like this highlight a fundamental difference between bazaar style foss on the one side 'closed' source and corporate style foss on the other (for instance redhat), the issues surrounding individuals would never shine through as bright in a corporate setting. The corporate identity shields to some extent the fact that it too is made up out of individuals.

</comment></comment></comment></comment><comment><USER11> There is more information at <http://planet.centos.org> Apparently he's been AWOL for some months now.

</comment><comment><USER12> Hopefully he is well.

I used centos for a bit with my cluster, but now use <http://www.caoslinux.org> for use with Perceus. Not that I had problems with centos, but the integration of the latter two couldn't be better.

</comment><comment><USER13> First Alan Cox, and now this? I think something fishy is going on...

<comment><USER14> I know this is supposed to be funny, but this is the FIRST thing that came to my mind today.

I operate many CentOS, Ubuntu AND Red Hat servers. Seeing key developers drop from the Linux community (which is the way it sounds) and then to see the lead project manager of CentOS VANISH is absolutely terrifying.

Here was my SECOND thought. Should I just be using MS servers for everything?

THIRD thought, maybe Red Hat at the very least.

Stuff like this puts a huge scar on open source for the nervous folks like me. I want to rely on a huge company no more than I do an open source project run by random people around the world, but I just don't have much of a choice, and situations like these make me feel totally out of control, and when this happens, I have to consider paying more so I know the company that manages my OS will be around tomorrow.

I don't have a "what if a bus hits my OS" document, and I didn't think I needed one, but all of a sudden... I think that maybe I do.

<comment><USER15> Well, yes when you put it like that - however, that CentOS guy apparently was not in any active role in the project for quite some time now and his disappearance does nothing to CentOS.

When other people, who actively participate in the project, quit - like Alan Cox did, most of them - if not all - responsibly manage the transition.

</comment></comment></comment><comment><USER16> Holy crap! There goes 25 of my ESX host machines. Might have to buy RHEL now.

</comment><comment><USER17> We've been using CentOS in-house but shipping on Redhat RHEL. I imagine that is fairly common. I wonder if Redhat asked the guy to kill the project (for a small compensation of course), so the only available RHEL binaries are produced and sold by Redhat. We would essentially be forced to get licenses for all our testing and dev machine, which is not cheap.

This is definetly troublesome and suspicious.

<comment><USER18> Please, there's no need for such FUD.

I work at Red Hat, and the general feeling I see internally is very positive towards CentOS. Sure, there are a few who would like to be more aggressive about converting CentOS users to RHEL subscriptions, but I definitely don't see any conspiracy to kill CentOS.

Besides, the problems now at CentOS are administrative. If that open letter doesn't accomplish anything, the project could still go on at a new domain under new, broader leadership.

<comment><USER17> > Besides, the problems now at CentOS are administrative.

When the lead developer disappears for a month, without saying anything. Another developer leaves, disgruntled. Nobody knows what happens with the money from donations. Those are very serious problems. The kind of problems that kills a project.

I am sorry for overreacting in respect to Redhat. I know you guys are great. We use your product. (Although we do like CentOS more for us dev people and for testing, because it saves us tens of thousands dollars ;-)

<comment><USER18> I agree that those are nasty problems, but with the passion that went into the open letter, I believe that the project will survive.

I'm glad that you're not actually soured on Red Hat. And if the best way for you to support your products on RHEL is to use CentOS, that's still a win for us. :)</comment></comment></comment></comment>


Ask HN: Get over math anxiety in CS degree - <AUTHOR> Bit of back-story: I have always been a little slower at maths, and have always wanted to get better. I struggled my way through discrete mathematics but already forget a lot of the notation. I'm doing a university course which is proof-heavy and uses a lot of mathematical notation which scares the shit out of me. My question is; was anyone here in a similar situation? How did you get better? Books, practice, tutoring, videos? I feel extremely stupid when I can't get the simplest proofs down. <comment><USER2> I was in a similar situation years back and made a huge mistake: giving up and switching majors due to the amount of math in CS (and the very poor instruction I was receiving was part of it too, so YMMV).

Now, 8+ years later, I wish I had stuck with it or found better instructors or a better school or something.

To throw that opportunity away in exchange for a much less interesting or useful degree is something I still regret but am trying to move on from... can't change the past.

The times I _was_ successful in tough math classes was when I asked for help, so my experience mirrors what others are saying here. The problem was having instructors that sometimes couldn't help much when asked.

</comment><comment><USER3> Practice and actually asking for help when I was stuck worked for me.

I remember having a complete block over lambda calculus - I pretty much locked myself in my room over an Easter break and worked through loads of examples - eventually it clicked and I ended up being really interested in all things functional.

<comment><USER4> > actually asking for help when I was stuck worked for me.

This is larger than math. Successful people ask for help.

<comment><USER3> One of my first jobs was for a Professor of Control Engineering - fantastically bright chap. He was also the first person to admit "sorry, I didn't understand that, could you explain that again" and do it in a way that made it clear he thought it has his problem not the person providing the explanation.

[NB The fact I ended up doing research with a bunch of control engineers rather demonstrates that I did manage to get over my fear of maths!].</comment></comment></comment>