This November I'm Voting for Tech - <AUTHOR> http://nyuentrepreneur.org/2012/10/this-november-im-voting-for-tech/

<comment><USER2> "For example, Romney feels that one of the best ways to inspire entrepreneurs is through tax reform. I've been to at least a hundred tech related events in NY over the last couple of years. Not one of them had tax management as the central topic of discussion. Clearly taxes are not the main obstacle that stands in the way of any aspiring entrepreneur executing an idea. Besides, most startups incur net losses for their first several years. What is the corporate tax rate on negative $500,000?"

Where the hell do you think most seed money comes from?

"Romney's entire "best thing we can do is get out of your way" type of approach is not helpful to your average tech entrepreneur. "

The average tech entrepreneur needs to get over themselves.

<comment><USER3> > Where the hell do you think most seed money comes from?

Romney just needs to write out a big fat check to every wealthy person in America and soon technology will be booming. It's so obvious!

<comment><USER4> You seem to be conflating giving people money, and letting people keep their own money.

<comment><USER5> I've always found this concept somewhat amusing. What is "my money?" If I bill $X for my employer, I see maybe 1/3 of that between salary, benefits, and overhead. Is the employer taking 2/3 of "my money?" No, because if the partners weren't bringing in the clients I wouldn't be in a position to bill for that work. The same is true for every employee whose employer profits from their labor. I think the same is true for employers and employees with respect to the government. Is the government taking 1/3 of "my money?" I wouldn't be making that money without the vast array of services the government provides. Now it's not an argument for whether I'm taxed too much or too little, but I feel like the government has a legitimate right to some of the income it helped me earn. I don't think the concept of "my income" makes much sense in an interdependent society with fine-grained division of labor. We act together in large economic units, and there is no naturally right answer to how we divide up the proceeds of that work.

I could move back to my parents home country of Bangladesh if I didn't like the taxes. It's tax burden is 8% of GDP versus 26% of GDP here. I don't for the same reason I don't leave my firm--I make more money even after other people getting their cut than I would on my own.

<comment><USER6> _I wouldn't be making that money without the vast array of services the government provides._

What services? Please be specific.

Before you cite services like roads, fire protection, etc, please go look at what your taxes are actually spent on: <http://www.usgovernmentspending.com/piechart_2010_US_total>

<comment><USER5> The single thing I benefit from the most is the government's suppression of the physically strong. In the state of nature, people like me would not be at the top of the economic hierarchy. Those gangs on the south side of Chicago, lording over their impoverished little domains, would instead lord over me.

We, through the government, impose rules that favor the smart over the strong, that favor creation over acquisition. These rules enable the wealth of our society. But they are not cost-less, nor are they the natural order of things. There is a large class of losers in this system, and I consider government spending that redistributes some of the fruits of societal production to be part of the cost of imposing these rules.

Moreover, many of these expenditures benefit businesses directly. Public education is an enormous subsidy to the business world. My firm's clients are all large companies that collectively employee millions of people educated on the public dime. Since our economy is built on mental activity, rather than manual labor, it is of enormous benefit to companies to have readily available educated employees. Moreover, many items of spending, such as food aid, primarily go to children. It is a tremendous benefit to the business world to have a next-generation workforce that doesn't suffer from the cognitive issues that can result from malnutrition.

The expenditures that are the hardest to justify are the ones that are generationally redistributive, like Social Security and Medicare. On the other hand, these require the least justification--they are benefits mostly paid for by separately-marked taxes, that every taxpayer can benefit from personally.

And I'm not even going to get started on how tremendously economically valuable agencies like the EPA are.

So before you talk about what our taxes are spent on, try to cultivate some perspective about what exactly enables the incredible wealth we have in our society. As I said, my parents are from a country with far less government than we have. It's hellish. You don't want to live like that, trust me.

<comment><USER6> _Those gangs on the south side of Chicago, lording over their impoverished little domains, would instead lord over me._

4.4% of government spending protects you from peaceful people who wish to enjoy drugs in the privacy of their own home, as well as the gangs you seem to fear. Another 14.3% protects you from Iraq and the Soviet Union.

As I said, please go look at what the government actually spends your money on before replying.

<comment><USER5> I'm not making the simplistic argument that I'm glad that the government protects me from gangs. The gang example is illustrative of a deeper point.

The government's institution of property rights, which are protected by the police, army, courts, etc, makes everything around us possible. Without that basic order, there is no wealth creation. In the state of nature, a skinny nerd like Mark Zuckerberg is not king. In the state of nature, the kings are the people in the gangs: young, strong, capable of using and organizing force. I don't believe in a god that says "thou shalt not steal" or "thou shalt not kill." I have to depend on a utilitarian justification for the existence of property rights: that they allow the existence of the kind of complex society necessary to create wealth.

The imposition of this wealth-creating order is not free, and the cost is not just what we spend enforcing order. The cost is enormous: taking away the only natural ability common to all people: taking what you need. When we create property rights that allow a landowner to own vastly more land than he could personally defend, we take away the ability of people to hunt and fish and subsist on that land as they would in nature.

I believe that programs like welfare, food stamps, etc, are the moral obligation concomitant with the imposition of this highly artificial order. The order exists because it results in the greatest good for the greatest number, but in the process it creates a class of losers. I believe we have an obligation to take care of, as we can, the losers created by our order. I consider such expenditures to be a cost of creating that order that ultimately makes my income possible.

You don't have to agree with me. I think it's immoral to impose an order that prevents people from fending for themselves outside that order, and then to not provide for them. You may disagree with that.

Beyond that, even if you disagree with that premise, line item thinking is still nonsensical. For example, take the spending on Medicare and social security. You can disagree with whether national insurance is the most economically efficient way to take care of the elderly, but the cost wouldn't disappear if we got rid of those systems. Instead, the elderly would move back in with their kids, as they have done through human history. The cost to you is not the cost of the program, but the cost of the program minus the cost of taking care of your parents yourself. This is generally true for every line item--you have to engage in an alternatives analysis instead of chalking up the whole dollar value as not benefitting you.

Moreover, in many situations the cost to provide a service would be much higher without the government. For example, consider the 15% of all spending that goes to education. Our modern society would not be possible without this education, and employers benefit from it tremendously (what is the incremental benefit to an employer of someone who can't read versus someone with a public education?) People act like education is something that benefits individuals, but at the end of the day, an individual only benefits from his own education. An employer benefits from the education of each of his employees. And due to the public good nature of education, it's unlikely employers could provide it more cheaply than the government.

In general, I find the approach of "look how much we spend on X" to be intellectually lazy. Nearly every $1 you spend on taxes benefits you in some way. The debate is not about whether it does, but how much it does relative to that $1 and whether there are alternatives that cost less than $1.

<comment><USER6> _The cost is enormous...we take away the ability of people to hunt and fish and subsist on that land as they would in nature._

This cost is negligible as well. The cost is merely the cost of providing hunting/fishing levels of food, and it is only owed to the small subset of people who would be better off as hunters. We're talking about $1-5/day here. A few $B in a $12T economy.

In addition to your wildly incorrect accounting, you seem confused as to what a public good is. Education is a private good, being rivalrous and excludible. You again cite a tiny fraction of what is provided (literacy + numeracy) while ignoring the vast majority of spending (most of high school and college).

<comment><USER5> > This cost is negligible as well. The cost is merely the cost of providing > hunting/fishing levels of food, and it is only owed to the small subset of > people who would be better off as hunters. We're talking about $1-5/day > here.

Only if you use an artificially narrow definition of "better off." Would you rather be a hunter/gatherer in a world of hunter/gatherers, or a hunter/gatherer in the modern world? If you consider only the value of food, the two are fungible. But if you consider the whole range of things people attach value to (social interaction, etc), the former is far preferable. This is a false objectivity that is common with approaches like yours. Just because certain sources of value are "fuzzy" does not mean they are objectively valued at zero. Also, you're ignoring all the modern findings of behavioral economics that notes that people perceive value relatively. Acknowledging that fact, simply paying for hunting/fishing levels of food does not put people in the same position as they would be otherwise.

> In addition to your wildly incorrect accounting, you seem confused as to > what a public good is. Education is a private good, being rivalrous and > excludible.

Sorry, I was imprecise. I meant to say that education generates large positive externalities. Though I should point out in my defense that it is not uncommon to use "public good" to refer to something that generates large positive externalities but does not meet the technical definition of public good...

> You again cite a tiny fraction of what is provided (literacy + numeracy) > while ignoring the vast majority of spending (most of high school and > college).

The point is that when someone gets an education, they are not the only nor even the primary beneficiaries of that education. When I buy and eat a cookie, only I enjoy that cookie. When I get an education, the marginal increase in my economic value is split between me and my employer. In many companies, the employer benefits more from the education than you do. One need only look to see how employers flock to areas with top-tier engineering schools (the Bay Area, the Research Triangle, Atlanta, Austin, etc) to see how much employers benefit from public education.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I'm a techie too. But unlike the author of this piece, I have a little bit of perspective.

For tech, Romney is probably marginally better than Obama. But I'm not even going to bother justifying this statement - it's irrelevant. Neither politician will have any significant effect on the tech community, and even if they did, it's a minor issue.

Lets focus on a major issue: >500k people just like me (drug users) are _sitting in jail right now_ for no good reason. For those who are unfamiliar, sitting in jail is far worse than being unemployed or having marginally fewer pinterest clones.

Another major issue is the fact that millions of people from the poorest places on earth (I'm not talking about wealthy nations like Mexico here) could be lifted from poverty. The vast majority (i.e., >95%) of India lives in what would be considered dire poverty in the US. Upper class individuals in the poshest suburbs of Mumbai suffer living conditions comparable to the poorest housing projects in the US. All we need to do to lift them from poverty is allow them to enter the US and provide us cheap medical services, clean our houses and the like.

So yeah, one of the politicians is marginally better than the other on an issue that neither of them have much control over. Why do we even care?

<comment><USER7> So politicians have no control over domestic tech policy but can affect change in India by allowing their poor into the US to provide us cheap medical services? What sense does that make? You, sir, are clearly on drugs.

<comment><USER6> I don't expect US politicians to affect change in India at all. I expect them to change the lives of the individuals they allow into the US.

The Indian upper class (doctors, nurses, developers) are poor by US standards. They can become wealthy simply by allowing them to change location. This would benefit us too, as would allowing the poor to come over and sell us cheap house cleaning or dosa preparation services.

Another example: there are about 90k Somalians in the US, mostly refugees from Somalia's earlier troubles. Assuming they have a GDP per capita _half_ the US average, Somalian Americans have a GDP of about $2B. That's about 1/3 the GDP of all of Somalia (approx $6B, pop 10M).

Do you really believe the JOBS Act (the only concrete action the OP attributes to Obama) even comes remotely close to having such an effect?

</comment></comment></comment><comment><USER8> I see net neutrality as the single most important issue in my tech bubble. Giving entrenched tech companies even more of an advantage would be disastrous. The piracy issue is also woven into the thread of the net neutrality issue.

I am getting mixed signals from both major parties though: [http://www.dailytech.com/Democratic+Senators+Block+Republica...](http://www.dailytech.com/Democratic+Senators+Block+Republicanled+Net+Neutrality+Repeal/article23249.htm)

[http://www.businessinsider.com/conservative-legislators- are-...](http://www.businessinsider.com/conservative-legislators-are-really- outdoing-liberals-in-opposing-sopa-2012-1)

<comment><AUTHOR> Thanks Seth for pointing out both of these articles. Read the SOPA one, about to read the others. Would you mind adding that to the comments on the original post as well? Would like to show some other valuable points to consider.

</comment></comment><comment><USER9> How about, instead, you act morally, refuse to vote, and focus on making your startup successful via non-coercive means.

</comment><comment><USER10> Surely at least people working in tech should know that there are more than 2 parties to vote for?

<comment><USER11> A vote for a third party candidate ultimately goes to the "worst of the two" because otherwise, the vote would have been for the "not as bad of the two".

Of course, that ignores the fact that the electoral college vote (NOT the popular vote) decides the results.

<comment><USER12> If you live in a "safe" state (CA, WA, ...), where one of the two big candidates is effectively certain to win, you can vote for your first choice third-party candidate in a way which might help in the long run -- once e.g. the Libertarian Party gets 5% of the vote in an election, it gets federal matching funds, and will be a lot harder to exclude from the process.

In the long run, I think I'd take the worst of the D/R candidates over a string of 8 consecutive elections if the consequence is ending the two party stranglehold.

The way the system works, without proportional representation, you probably will ultimately end up with two parties, but I'd rather replace both current parties with new competent-but-ideologically-distinct parties (like, say, a Green/Socialist/Union/Interventionist/etc. party vs. a Libertarian/Free- Market/Business/Isolationist party).

<comment><USER13> There are a lot of us that want a third party, but IMO it's just not going to happen without changing the voting system.

<comment><USER14> If you don't vote for them, it's guaranteed they won't get traction.

If you're reading this and live in California, you should strongly consider the 3rd parties on the ballot. Obama's got the state locked up by 15-20 points, so there's no risk in third party voting. Obama will win, Romney will lose. This will happen however you vote.

So take a look at the 3rd parties, and if one of them more closely matches your views, support them. Don't waste your vote on parties you don't believe in.

</comment></comment></comment></comment></comment><comment><USER15> Disclaimer: I'm not a US citizen so I can't vote at all.

If your primary concern is the tech sector and entrepreneurs then the choices are pretty woeful.

The Obama administration is without doubt the most hostile to the tech sector through and the Internet its strong pro-IP stance between:

\- staffing the DoJ with RIAA lawyers [1]

\- appointing RIAA lobbyists as federal judges [2]

\- having an anaemic stance on software patents ("don't blame us") [3] since the White House is by far the largest bully pulpit in the country they could act if they wanted to. It is within the power of Congress and the White House to reform the American Appeals Court for the Federal Circuit, which is responsible for a lot of software patent nonsense and, at this point, is arguably an example of regulatory capture

\- only came out against SOPA/PIPA when public backlash had already basically killed them [4] [5]

\- tried to negotiate and pass the original ACTA treaty in secret, which would have largely equated piracy with terrorism [6]

\- used diplomatic pressure on foreign governments to tow the same hardline IP stance eg the AFACT downloading case against iiNet in Australia (which was ultimately lost) [7]

\- enacted the America Invents Act, which gives patents to the first-to-file [8]

Romney has been essentially silent on the issue of software patents and, let's face it, he's the off-cycle dud candidate of this election. By this I mean look at the candidates that went up against the incumbent seeking reelection:

2004: John Kerry

1996: Bob Dole

1992: Clinton obviously won against Bush Sr but this was in large part to Ross Perot more than anything else (IMHO)

1984: Walter Mondale

Anyway, if the tech sector concerns you--and since you're reading HN it probably does--the choices are terrible this time around. Software patents threaten the entire tech sector [1]: <http://www.wired.com/threatlevel/2009/04/obama-taps-fift/>

[2]: [http://arstechnica.com/tech-policy/2011/03/riaa-lobbyist- bec...](http://arstechnica.com/tech-policy/2011/03/riaa-lobbyist-becomes- federal-judge-rules-on-file-sharing-cases/)

[3]: [http://arstechnica.com/tech-policy/2011/11/white-house- blame...](http://arstechnica.com/tech-policy/2011/11/white-house-blame-the- courts-not-us-for-software-patents/)

[4]: [http://www.huffingtonpost.com/2012/01/18/sopa-obama- donors-h...](http://www.huffingtonpost.com/2012/01/18/sopa-obama-donors- hollywood-silicon-valley_n_1213159.html)

[5]: [http://www.forbes.com/sites/johngaudiosi/2012/01/16/obama- sa...](http://www.forbes.com/sites/johngaudiosi/2012/01/16/obama-says-so-long- sopa-killing-controversial-internet-piracy-legislation/)

[6]: <http://boingboing.net/2009/11/03/secret-copyright-tre.html>

[7]: [http://www.theregister.co.uk/2011/08/31/afact_subcontractor_...](http://www.theregister.co.uk/2011/08/31/afact_subcontractor_to_mpaa/)

[8]: [http://macdailynews.com/2011/09/16/obama-signs-first-to- file...](http://macdailynews.com/2011/09/16/obama-signs-first-to-file-u-s- patent-reform-bill-into-law/)

<comment><USER16> > enacted the America Invents Act, which gives patents to the first-to-file

That was not hostile to the tech sector. First to file vs. first to invent is neither favorable to nor unfavorable to the tech sector, and the AIA contains some strong anti-troll provisions which are quite favorable to the tech sector.

<comment><USER17> In particular, as 'tzs has been at pains to point out on HN for years now: AIA first-to-file means that two competing claims to the same patent --- two people rushing to file the same patent on essentially the same idea at the same time --- can now be adjudicated a simple, predictable measure rather than by "first to constructive invention". It is probably not much of an exaggeration to suggest that the previous standard was, in effect, "the party with the best lawyer wins".

First-to-file only matters when you have two parties eligible for the same conflicting patentable idea. It does not create some new gold rush of patentability; it applies only in the tiny minority of cases where two people are filing conflicting patents simultaneously. It's possible that there hasn't been a single widely-known trolled patent that was obtained under these kinds of circumstances.

MEANWHILE: AIA also includes provisions that prevent trolls from joining together defendants in suits into a single case in the troll's jurisdiction. Since that was a major part of the litigation M.O. for patent trolls, it's hard to look at AIA as a win for trolls.

</comment></comment></comment><comment><USER18> As a "tech startup" (wtf does that even mean?) I'll take lower health insurance premiums for employees over any tax cuts proposed by either party.

I don't know what other people are paying, but it costs us up to $1500/m if an employee has a family to provide decent insurance in CA.

But... I don't really see that ever happening without a complete overhaul of the healthcare system.

</comment><comment><USER19> Single-issue voting is bad for democracy.</comment>


Show HN: BillBuddy – Automated Invoice Processing - <AUTHOR> https://billbuddy.io <comment><USER2> Amazing that a) this deals with something very commonly encountered in all businesses and b) someone took considerable time to make the web page BUT...

I have no clue what this service does. None!

Are these invoices that the user's business _sends_ ? ( hence this is some form of AR management application) or are these invoices received by the user's business ? (hence an AP management application)

In either case, surely the business is already using some sort of accounting software and therefore what does this service do that regular Quickbooks doesn't do?

And finally: who sends or receives thousands of invoices per month and doesn't already have some decent management and reporting systems in place?

fwiw I worked on a startup that (I think, because we were solving the problem alluded to on the site of making sense of arbitrarily formatted business transaction documents) was trying to do the same thing about 15 years ago. We were targeting big corporations dealing with high-value invoices with a broken AR/AP process. It didn't end well, I think in part because there isn't a good value proposition here. It has to be "you'll get paid much sooner" or "fewer invoices will end up unpaid". Just being "nicer" or "easier" doesn't cut it.

<comment><AUTHOR> Hi dboreham, thanks for the feedback.

BillBuddy started as a project for myself, where I found that it was a big hassle to keep track of all invoices I received without manually processing them and filling in the amounts in my own bookkeeping software.

Instead of now having to open every invoice, I simply forward the invoices an let BillBuddy do the reading. Once per month when I do my taxes, I log in, run an export of the parsed data and see all the data I need at a glance.

This way I know what I spent and my quarterly tax-forms are filled in much more easily.

That's the backstory and how BillBuddy turned out to what it is today, where I feel it mostly supports small companies of which the bookkeeping is not too complex but a small hand comes in useful.

<comment><USER3> You'd do well to have that above the fold. Your screenshot takes up a ton of space, but looks like a generic admin screen, and it's not really information dense. The trendy backspace and type thing helps a little, but aside from that, the only thing I see on a 1920x1080 that convinces me to go further is one line "All your invoices in one place by simply forwarding your emails". I'd recommend pushing the UI candy down and pulling more of the FAQ etc up.

<comment><AUTHOR> Thanks a lot, will work on that.

</comment></comment></comment></comment><comment><USER4> Your pricing is way too cheap, and makes it hard to take seriously. As a business, there is no difference between $5 and $15 per month (and if someone tells you differently, you don't want their business).

<comment><USER5> Though I second this, "hacker pricing" could encourage a few small early adopters who may provide critical feedback in the early days of the product.

</comment></comment><comment><USER6> Looks like a good service!

Obviously early stage (guess there are things to be polished) but I think it would be useful. I've looked for a simple SaaS AP solution without all the complexity of some of the advanced solutions.

(semi-related; anyone has tips on other good SaaS AP services?)

Some suggestions:

\- Make it clear on the website that this is AP, not AR (if that's the case).

\- Offer the first ~100 invoices for free (regardless of the plan)

\- I'd look at a stripe integration for automatic payment (if possible, not sure that it is). Otherwise look at exporting 'bank files' that banks in most countries can import (basically a pre-generated of transactions, uploaded then verified and signed on the bank website).

\- Most companies will probably want an approval chain for invoices based on the company hierarchy, invoice amount, etc.

<comment><AUTHOR> Thank you, those are four great bullet points I have written down and will look into.

</comment></comment><comment><USER7> Interesting! What's the key difference between this and other "auto invoice management" tools like ReceiptBank ( [https://www.receipt- bank.com/](https://www.receipt-bank.com/) )?

</comment><comment><USER8> Hmm... initial data scanning seems limited. Only amount, vendor and invoice number. PO number strikes me as a key missing field but was hoping for full Invoice scanning.

<comment><AUTHOR> Missing fields can be added, so PO number I have written down. It's less common data here in the Netherlands, so thanks for mentioning it!

</comment></comment><comment><USER9> Does anyone know of an open source tool that reliable extracts data from PDF invoices? Preferably using OCR because some of my invoices are scanned.

</comment><comment><USER8> It looks like it's email only. Is there a way to bulk upload invoices?

<comment><AUTHOR> Email is indeed the way to go for the moment. You can however attach multiple files at once, so composing an email with your PDF collection does the trick.

</comment></comment><comment><USER10> Great idea! Do you plan to integrate with xero?

<comment><AUTHOR> Integration with bookkeeping software is definitely on my list of to-do's, but the details of that have yet to be determined. In the mean time, the excel/csv export can be used to import processed invoices in bulk.

</comment></comment><comment><USER11> Nice clean and short landingpage! Well done!</comment>


Skype v7 supports regexp - <AUTHOR> Once you written a text to someone you are able to edit it. This can now be performed with regular expressions such as: Send: hello world Send: s/world/friend/g
Text is then changed from "hello world" to "hello friend" automatically.
Not sure if this is completely new or documented. But really nice feature!
(Work on Skype 7.26 on OSX) <comment><USER2> Appears to have been around a while.[http://blog.nyaruka.com/skypes-crazy- regex-easter-egg](http://blog.nyaruka.com/skypes-crazy-regex-easter-egg)

Still very cool.</comment>


A Programmer's Dilemma - <AUTHOR> http://softwareindustrialization.com/AProgrammersDilemmaProductivityLost.aspx

<comment><USER2> Big surprise. They guy's sick of programming because he never liked coding in the first place. This is his ideal development model:

"I used to do storyboards right in the VB6 IDE asking the business guys what they wanted, 'so you need a form, with a list box and what should be in the list box, and when you clicked ok, now what...' And on it went. In a couple of days to a week, we basically had the front end of the application prototyped. Since it was back in the 'two tier' days all we had to do was hook it up to the database. And if we got really 'fancy', (or had the luxury), we added a third tier of business logic written out as VB6 classes, not in the stored procs, and after a bunch of testing, report writing, etc., boom! off it goes into production."

I hate Dreamweaver's design mode. Sure, only writing straight HTML/CSS/JavaScript over the many years has arguably taken more effort. I had to learn the "complexities" of my environment, that the author bemoans, such as browser bugs (found a new one that's IE7-exclusive the other day), but now I can recognize and solve browser bugs almost instantly and can build pages blind. As a result, the finished product is always of the highest quality and very robust.

<comment><USER3> "I had to learn the "complexities" of my environment, that the author bemoans, such as browser bugs"

And you're happy with it?

<comment><USER2> Knowing what I'm doing, understanding all factors in my envoironment? Yep.

The existence of browser bugs? It's a necessary evil derived from consumer choice in browsers. No different from different desktop platforms. Unless all browsers standardize over one rendering engine (rather than a list of standards), we'll be dealing with cross-browser compatibility for a long time.

</comment></comment></comment><comment><USER4> The article is interesting, but I can't help but think that large part of the guy's problem is that he's not using Unix.

<comment><USER5> I thought he was being quite unfair towards systems today - I certainly don't think a Rails app is any harder to get up and running than a VB6 app. The only downside is that making forms/reports isn't as simple - but honestly, is learning html really so hard?

He does have a point about the size of frameworks - I decided about 6 months back that I wanted to get onto the iPhone bandwagon, so I decided to write a Mac app to get my feet wet - I could use the RubyCocoa envrionment to continue using Ruby, whilst learning the Cocoa API. Like Windows, MacOSX has a huge API, and each time you want to do a different task - networking, multilanguage support, undo/redo, working with bitmaps, scrolling, file support, etc etc etc, you have to stop programming, and look it all up. Sometimes you may even be sucked into having to read a 300 page document, although that is thankfully quite rare once you are no longer a beginner on the system. But then, each time that I do one of these things, I'm always thankful for the framework's existance, because I can't help but be aware of the fact that it is saving me probably months of work to create my own system.

Maybe his problem is that he is underestimating the size of the problems that the different systems are solving under the hood. Like, he talks about VB6 apps, from memory those don't scale so well if you have more than a handful of users using the app at the same time (I may be wrong about this, it's just what I seem to remember from that time - I wasn't actively working on those types of app at the time). Much of the complexity of today's systems is designed to permit you to handle scaling to hundreds/thousands/millions of users, with correspondingly huge amounts of data being handled.

<comment><AUTHOR> VB6 didn't _have_ to scale, you ran one instance of your app per user, and worried about scalability on the back end (i.e. the database). People talk about Rails scaling, that's the difference, notions of scalability have been shifted a tier up.

<comment><USER5> As I said, I wasn't sure about the details :-) But as you seem to know a bit about it, what was the standard database that was being used as the backend? SQLServer? And were the db requests being generated by the app efficient? And most importantly, considering the thrust of the article, was efficiency easy to achieve? I'm thinking about this in terms of the skills needed by a single programmer to be able to do anything useful - if you needed to be a full on DB wonk to produce an effective VB6 app, then it wasn't really as simple as the author was making out.

<comment><USER6> SQLServer or FoxPro or Oracle, you wrote the db requests yourself (probably just hooking up to stored procs, as he says) and you're totally missing the point here.

Efficiency in a small business app _just doesn't matter_. What bugs him, AFAICT, is that it's harder to throw together an app for a few users that solves some pain they have. VB6 is possibly the best environment for doing this ever, so I see where he's coming from.

So rails is more efficient, written in a vastly superior language, more conveniently hooked to the DB, and more scalable than VB6. But! Designing a UI is still basically manual labor with it, labor he used to be able to toss off with ease in VB6.

(Also, you don't need to be a "full-on db wonk" to write a simple stored procedure.)

<comment><USER7> Can't you write Rails templates with DreamWeaver? Is it a lot harder than assembling dialog boxes in VB? I've basically never used DreamWeaver and I haven't used VB since 1997, so I don't really know.

<comment><USER6> heck if I know. MS also has a DnD-style form assembler for ASP.Net, I don't know why he didn't/couldn't use that.

I was just trying to show where he was coming from.

<comment><USER7> Oh, sure. I thought he was complaining more about the excessive complexity of modern computing environments, though, the way that mainframe people used to do around 1970, and the way minicomputer people used to do around 1980. Maybe he should try programming an 8-bit AVR.

<comment><USER6> > I thought he was complaining more about the excessive complexity of modern > computing environments

There was definitely that, too, but I'm much less sympathetic to that point. The .net libraries, like java before them, are gratuitously baroque.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This is my experience as a consultant.

We started to have all the customers requesting web applications. It was our specialty but in many cases the web applications were not justified. But the customers insisted. Writing web applications was way more complex than writing regular client server applications.

<comment><USER9> How so?

<comment><USER10> 1\. In simple applications, you can merge the view and controller on the client and use the database and stored applications on the server side. Have two people who know two languages, and you're done.

In web applications, you have HTML + CSS + Javascript for the view. While AJAX can talk to databases, it's slow for parsing out data that would be better handled in a faster interpreter. Thus, you have the "controller," or at least what is called a controller in webland, as a code generator for HTML and sometimes even javascript. Then, you have to interface with the database already, so you have to make the decision whether to have a database specialist, or just to treat it like a dumb store and do all of your business logic next to your controller. This is where we see the wonderful JDO, EJB, Hibernate, Activerecord, etc.

Rails makes it less painful, so long as you don't have a legacy database.

For large applications, the overhead is negligible. however, small and medium business-hosted web applications are still more difficult than the old client- server model.

And Access is easier yet. We still haven't come close to that with web apps.

<comment><USER8> Furthermore, keeping the state in a web application is harder. For example in a desktop application you can open a dialog box and when you are finished you get back to where you were. You can call the dialog box from several places and you always get back to your previous state. It is like calling a subroutine and then return vs doing a "goto" and then another "goto" to get back. You end up with a lot of spaghetti code.

<comment><AUTHOR> PG writes that having a good mechanism for state management was a significant advantage for Viaweb over it's competition.

</comment></comment></comment></comment></comment><comment><USER11> The article's main point is just that languages have started including much larger standard libraries. Larger libraries save time, but they make the programmer's job more "searching for the right function" rather than "writing functions."

I suppose he laments the old days when he used to reinvent the wheel ...

<comment><USER12> > _Larger libraries save time, but they make the programmer's job more > "searching for the right function" rather than "writing functions."_

Yes, and: trying to figure out what the documentation means, etc.

Libary documentation tends to be not very good, and libraries themselves are not designed to be easy to learn. I'll illustrate this using Python's SimpleXMLRPCServer, not because it's particularly bad, but because I've been using it recently (It's at <http://docs.python.org/library/simplexmlrpcserver.html> )

1\. Naming conventions.

The name of the module is SimpleXMLRPCServer not simplexmlrpcserver; most Python modules use the convention of the module name being in a lowercase, but this one differs -- Python should standardise.

Similarly the name of the class is SimpleXMLRPCServer, beginning with a capital -- but some python classes don't begin with a capital.

Similarly the naming conventions of methods and parameters should be standardised -- either use underline_separated or camelCase but choose one and stick to it. It's just irritating if there's a parameter called logRequests, and another called allow_none.

2\. Documentation not complete

To quote the documentation: "If logRequests is true (the default), requests will be logged; setting this parameter to false will turn off logging."

Er, where are they logged? It doesn't say. Sure, I could read the fucking code and work it out but I SHOULDN'T HAVE TO. It probably puts it in a file somewhere, but for all the doumcnetation says it could build a factory of nanomachines on the surface of the moon and write the log file there in big 6 meter high letters.

3\. interface of library too complicated

A library should be a black box that can be potentially big, exposing a small interface to the outside world. That way, by learning a small, simple interface, you get access to lots of functionality.

It's quite simple to register a function with the xmlrpc server:

       def myFunction(aString):
          return "x" + aString = "x"

       server = SimpleXMLRPCServer(("localhost", 8000))
       server.register_function(myFunction, "myFunction")

This is fine, and you can omit the 2nd argument to register_function() if you wish; also fine.

But there also a way of registering as functions all (or some) of the methods of an instance of a class, using the call register_instance(). This is more compex than it needs to be and figurung out how to use this function is impossible (for me at least) without extensive examples. However, this function is superfluous -- if I want to expose all the methods of an object as remotely-callable procedures, I can do it myself by making iterated calls to register_function().

</comment></comment><comment><USER13> This is a dichotomy. Complexity is really many choices and detailed control. The real barrier to simplicity is reaching a firm decision. You either have flexibility or simplicity.

Once the larger community decides what it wants, and how to do it, all the complexity disappears inside the machinery. Writing web-apps doesn't require low-level network wrangling, because the choice of TCP/IP etc. has been made: you simply use it as it is given. The higher levels of web-apps still present more complexity than they ought, though -- so we still haven't made enough limiting choices.

Overall though, the prognosis would seem bad: It is the essence of software to be parameterisable, to be changable. So it will always be able to produce choices at a greater rate than they can be well-chosen.

</comment><comment><USER3> "Simple things should be simple and complex things should be possible"

"Simple things should be simple" is the author's point. I agree.</comment>


Noteflight: start-up that lets you compose music within your browser - <AUTHOR> http://www.noteflight.com/info/learn_more

<comment><USER3> A really nice idea (though music composition is pretty niche, that might be a good thing). The score looks beautiful.

But too hard to start using. It took me 10-15mins to discover how to enter a note: you have to click where the cursor is. And not just where the cursor is, but _slightly to the right_... I had to read the help, and it wasn't even the first thing!

Entering a note is the very first thing a user wants to do. For user adoption (which is the what you need when starting), you have to make that first thing incredibly easy: click somewhere, get a note. All the additional sophistication should be additional to that. (IMO)

I think they are aiming at existing users of existing tools. But I think that's too hard - they can't beat desktop applications on their own turf. There's a lot of sophistication in the tool - so it's like they are aiming at what the professional applications do. These tools have competed and evolved to meet the needs of professional composers. However, I think a web tool is really in a different market, with a different proposition. They should first focus on where they strong. It's Writely vs. Word.

Music layout is hard, and their's gets messy when it's more complex (looking at Moonlight Sonata).

The fact that you can't publish to the web, or share (except with people who are already members) makes it harder to get started. Maybe not allow the whole score to be viewed without an account, but a tempter, to entice get people to sign up for the rest. As it is, there's little evidence that it's worth signing up. But maybe focusing on dedicated users (not casual) will work? As I said, it's pretty niche.

<comment><USER4> It is a bigger niche than many may realize though.

<comment><USER5> It's not a niche - it's a large market customers in the millions - <USER2> customers who are used to paying for such stuff, and will pay for such stuff.

<comment><USER4> A niche market can have millions of customers.

</comment></comment></comment></comment><comment><USER6> Get an account? You know the drill...

[Insert standard HN remark for sites that require users to sign up before they can try the app.]

Regardless, pretty cool to have something like this on the web.

<comment><USER7> Agree.

Why not make it so that if you want to save your composition you need to sign up?

Application like this, you don't need a video. Just let people use it immediately.

</comment></comment><comment><USER8> I really like the idea, but your design when loaded in my browser made me think this was a blog post and not a web service.

I would suggest centering the site and having a slightly more pronounced logo at the top; maybe adding more color too - less black. Also the window where you have sheet music make it larger, while on the side keeping text there. Though change the text on side of sheet music to be 3 bullet points that say the what, how and value proposition. Describe it quickly and briefly. Also as some1 mentioned above get rid of sign up or offer portion of svc no sign up required.

hth

<comment><AUTHOR> Heh, not my site. I just came across it and thought it was neat.

It says it's from Cambridge, though, so maybe other people know more about it than I do?

</comment></comment><comment><USER9> I really like it. It's basic but it'll do the job for a quick composing gig. This app comes right on time for me because I have to write a song for a film and my current soundcard doesn't support MIDI. I wanted nothing fancy, just a way to have a global idea.

To be able to share the project is awesome. And the revision too. It's like GoogleDocs for composing music.

</comment><comment><USER3> I take it back - you can publish scores after all:

[http://www.noteflight.com/scores/view/2177201ae448ab894682b1...](http://www.noteflight.com/scores/view/2177201ae448ab894682b16d557f5544fb678e7b)

But I think you have to leave yourself logged in to do it.

</comment><comment><USER10> "We'll copy and paste that into the second half which are almost the same, to save some time. Now we can use the mouse to adjust some of the notes that are different in the second half."

I've been transcribing some music recently, and this is one of my big gripes with "western" musical notation: the control flow is really weak. You can't encode something as simple as "same as before, but replace the last measure with __" (much less something like simple macro substitution!). You get "repeat a section once", "repeat the last measure", and a weak form of GOTO. Even a simple score is not at all DRY, which I've found makes it harder both to transcribe and to learn.

Are there any alternative music notation systems that have more powerful features?

</comment><comment><USER11> There are a couple things I would change about the interface (easy insertion), but I am generally extremely impressed. In my case, I knew the score, wrote out several measures and realized I missed a note. They don't seem to have any simple way to reconcile this problem.

</comment><comment><USER12> Really enjoyed it, but when I created my first score it took me forever to figure out how to put in notes (press C for a c, etc)

</comment><comment><USER4> This is actually pretty cool. The interface is a bit confusing but that is pretty much par for the course for music composition apps/progs unfortunately.

</comment><comment><USER13> It would be great to have the possibility to import scores from other popular software (cubase etc) so you can collaborate on projects</comment>


ScanTailor book scan processing tool gets a new maintainer - <AUTHOR> http://scantailor.org/

<comment><USER2> loved this program when i was working with book-scans!

it saved me _so_ much time and hassle! my best wishes!

-bowerbird</comment>


Robotic arm made of DNA moves at dizzying speed - <AUTHOR> https://www.sciencenews.org/blog/science-ticker/robotic-arm-made-dna-moves-dizzying-speed <comment><USER2> I'm not sure that nano-device research is best served by imitating human-scale devices. Better to produce a filter fabric that sorts atoms for example, than a 'robot arm' to carry imaginary parcels?</comment>


Facts About Entrepreneurs That Will Likely Surprise You - <AUTHOR> http://onstartups.com/home/tabid/3339/bid/10561/12-Facts-About-Entrepreneurs-That-Will-Likely-Surprise-You.aspx

<comment><USER2> As I was clicking on the link, I was thinking "I wonder if it's just another one of those bogus stories about the Kauffman Foundation statistics." Yep.

(Bogus because the surprisingness comes not from the numbers themselves, but from confusing the concepts of entrepreneur and startup founder. The first paragraph is a prime example.)

<comment><USER3> _It's based on a survey of 549 company founders across a variety of industries (that's my first mistake, as it turns out entrepreneurs start companies other than Internet software companies — who knew?)_

Paul the only people confused between the concepts of entrepreneur and starup founder though are people that think all entrepreneurs are startup founders. :)

I'd say that's a "Valley" focused viewpoint, and it shows a lot about how insular "Valley" thinking can be. I don't think it's a bad thing to be reminded that "Start Ups" are a small sub-segment of the entrepreneurial path.

<comment><USER2> You seem to be under the misapprehension that I wrote that post. Onstartups is Dharmesh Shah's site. He's the one who says he was confused about the distinction between startup founders and entrepreneurs generally. And incidentally, he's in Boston.

<comment><USER3> Um, no why would I think that?

You're calling out the results on the basis of "confusion", when Dharmesh clearly addresses this within the post itself. The article doesn't even contain the word startup at all.

<comment><USER4> OnStartups.com

<comment><USER3> And?

I still fail to see how his very clearly labelled examination of how the average entrepreneur is very different from the average Valley start-up is causing so much confusion.

</comment></comment></comment></comment></comment></comment><comment><USER5> What amazes me is that in relatively short lists of things on internet I often see duplicates. May this be lists of jokes, arguments even photos. Copies are usually close to each other, often on the same mid sized page. Is there something in creators psyche that causes having a blind spot on such duplicates?

Example from this article:

4\. More than half (51.9 percent) of respondents were the first in their families to launch a business.

11\. Entrepreneurship doesn't always run in the family. More than half (51.9 percent) of respondents were the first in their families to launch a business.

<comment><USER6> This is now fixed (was not paying enough attention and it was too early on a Monday).

<comment><USER5> Surely this can't be sole reason for all occurences of this effect on the interenet (and even in books). ;-)

<comment><USER6> You're right. That's not the sole reason. The primary reason is that originality is a relatively high bar -- particularly for the Internet.

Just look at Twitter. So many tweets are retweets of what someone else said.

<comment><USER5> That's not the point. I am not talking about lack of originality. I am talking about failure to notice duplication in short list of supposedly interesting content published by oneself.

<comment><USER7> The reason is plain and simple: when you build a list for an audience, it needs to have many bullet points. So you are tempted to use the same fact twice with a slightly different take.

"2 things you didn't know about entrepreneurs" sounds less interesting/professional/worth reading that "10 things".

</comment></comment></comment></comment></comment></comment><comment><USER8> The only thing on this list that surprised me is that someone would actually think the common entrepreneur is "pretty young, living the red beans and rice lifestyle and working 80+ hours a week and sleeping under their desk".

Up where I'm from, entrepreneurs are typically middle aged, financially stable, and breaking ground on their new business because they've been working toward it their whole lives.

I work with entrepreneurs daily in my consulting business, and it's extremely rare, outside of real estate agents, for me to work with someone under 30 to 40 years of age, with a family, who just started their business.

Why do all these blogs constantly think that all "entrepreneurs" == "startup". Get out of your box!

</comment><comment><USER9> >Entrepreneurship doesn't always run in the family. More than half (51.9 percent) of respondents were the first in their families to launch a business.

the converse of this is more surprising. The ball-park null hypothesis is that only 0.29% (290 for every 100,000 individuals) should come from family with history of entrepreneurs - but observed figure is ~50%. From this one should conclude that entrepreneurship does run in families.

<comment><USER10> I also found this interesting. My father has run his own business full time for 20 years, and did it part time before that. I think that's a big reason I started my own business ~2000, though it certainly was not a startup as we think of the term. A lot of the reluctance to do a startup is simply fear of the unknown, or thinking there's some "secret sauce" that one doesn't know. Like most things in life that don't have a prospect of being immediately fatal, often the best advice is "Just do it"

<comment><USER9> "Fear of the unknown" - very well said. In fact, there are some communities (sindhis, marwaris, parsis in India for example) where the culture of entrepreneurship has been handed down through generations. Like getting a job is a way of life and not "unknown" in common families, entrepreneurship is not an "unknown" in families of these communities.

<comment><USER9> Would also like to point out that culture driven entrepreneurship may be slightly of a different kind than we are acquainted with (startups/VCs/business plans etc.). These people may have for example started with being a taxi driver and grown to be the owner of travel company.

</comment></comment></comment></comment><comment><USER11> Some of the things the commenters find surprising really aren't. For instance that starting a business when married is risky. If anything I think its exactly the opposite. My wife started her first (non-tech!) business about a year after we were married and a large part of the reason is that if she had done it while single, she would not have had health insurance. She's now on her second business venture.

A single data point to be sure, but it does lend credence to the idea that losing health insurance is a significant factor in people not quitting their jobs to go out on their own.

</comment><comment><USER12> So, the 20-something founder/revolutionary is an _anecdote_ and not a trend! I get it now!

All this verifies is the existence of the silent majority of older, more experienced founders.

</comment><comment><USER13> 11\. Entrepreneurship doesn't always run in the family. More than half (51.9 percent) of respondents were the first in their families to launch a business.

This may be partly due to the fact that if your parents own a business, you're much more likely to work for them or inherit the business (than if they don't). Your parents or some other family member owning a company just gives you an extra option that might make starting your own business seem less attractive.

</comment><comment><USER9> Another dimension that would have been interesting to consider in this study is immigrant entrepreneurship. [http://www.forbes.com/2007/07/02/immigration- india-china-ent...](http://www.forbes.com/2007/07/02/immigration-india-china- ent-law-cx_kw_0703whartonimmigration.html)

</comment><comment><USER14> > based on a survey of 549 company founders across a _variety of industries_

<comment><USER15> Entrepreneurs don't count unless they build web sites?

<comment><USER16> It's the author's own fault. He/she starts off with "(think Facebook, Twitter, Google, etc.)", then proceeds directly to show the survey reflects a _variety of industries._ There are vastly different considerations for real world business versus Internet based ones, and that affects the profiles of founders for them. (e.g. PlaySpan.com founder was age 10!)</comment></comment></comment>


Will Chirp become the next Twitter? - <AUTHOR> http://www.bbc.co.uk/news/technology-18927928 Chirp app sends smartphone [ed. link] data via 'digital birdsong'<p>http://chirp.io/ <comment><USER2> No, Chirp will not become the next Twitter (if the title of the post here changes, this sentence will make little sense.)

Chirp seems to be more "network of things" than "social media network." They have what appears to be nigh-unto nothing in common. It aspires to completely different goals.

What is the point in raising our fluff with article titles like "Will X become the next Y?"?

</comment><comment><USER3> This seems very similar to QR codes. Users basically share a link to a file on Chirp's servers. It would be great to see this in an open format, so it could be used by anyone, without relying on a third party. I can imagine this being useful in emergency situations.

</comment><comment><USER3> I skipped over this on HN due to the link-baity headline, then saw it on the BBC site. Actual title is "Chirp app sends smartphone data via 'digital birdsong'". Mods, please update title here.

<comment><USER4> FWIW, I think "Will Chirp become 'next Twitter'?" was the short version of the title, based on the most read links on the BBC site.

</comment></comment><comment><USER5> The coolest app I have seen in the last 1 year ! Transmit data across iPhones using sound !</comment>


Adobe launches Carousel - <AUTHOR> http://www.photoshop.com/products/mobile/carousel

<comment><USER2> With your iOS photostream showing up automatically in iPhoto and Aperture, Adobe needed to fast follow. Adding the group sharing feature is a nice plus.

</comment><comment><USER3> We need an opensource server component to this workflow. I want to share photos between devices but I want my library to be private and in my control.</comment>


Ask HN: Imagine a world where your conscience is the core of the legal system - <AUTHOR>

Basically in that world,
- If your conscience think what you are doing is right then you are allowed to do it. - If you knowingly know something is bad and you still do it, then your conscience will of course know you're doing a bad thing, then somehow automatically you will get punished.
In that world, your own conscience is your own judge.
Think about what this would do to the politicians, the legal system, the patent system, thieves, rapers...
I think that would solve most of the world problems ?
What do you guys think ? What are the flaws of that world ?
Thanks for the feedback :) <comment><USER2> Anyone who can rationalise their behaviour as not really being theft, or not really being rape, or not really being whatever, they will go free.

And anyone who wishes they could change the last words they said to a friend or relative before they unexpectedly died, they will be jailed.</comment>


Startup Founders, Take It Easy - <AUTHOR> http://www.tawheedkader.com/2011/12/take-it-easy/

<comment><USER2> I really suggest trying out the Pomodoro Technique(<http://www.pomodorotechnique.com/>). It might actually be a bit tricky to really do it right, but you must take all breaks and actually step away from the computer, stretch, walk around, and drink water. I work in bursts of 25 minutes working on one single task, none of that multitasking crap. After 4 Pomodoros you must take a longer break. The hard part for many people is to actually drop what they're doing and take the damn breaks, but once you get used to it, you'll be golden. Working with the Pomodoro Technique lets you get tons of work done without working and straining yourself so hard.

</comment><comment><USER3> Balance is something I've never really understood. Ive been working on the present startup full-time for 3 months. Took me a good two months to figure out I shoukd only be doing one startup at a time. Lol... Sigh ... Old habits I guess die hard.

Anyway can't say I'm not happy though. I bounce out of bed everyday and I feel blessed that I can focus on one project for once in my life. Feels very selfish of me though for whatever reason.

I think it helped me that something really bad happened to me exactly at the start of my startup journey. It's made the startup life seem easy by comparison. I actually feel like I'm not pushing myself enough ...

</comment><comment><USER4> Hey Tawheed, I'm about to be in exactly the same situation. I've been dreaming of being able to have only my startup to focus on for so long, having just graduated I thought after Christmas it would be here. Everyone keeps telling me time away is important, but I haven't really learned to take it. I worry about burning my team out as well. Thanks for sharing. We'll see if I come to the same conclusions.

</comment><comment><USER5> I learned this the hard way, and went through burnout before I understood that I needed to take it easy. Exercising regularly, eating well, proper sleeping habits, friends and family time, all of these make me more productive, effective and happier. I still work long hours and finding this balance is hard. It's something you do every day and some discipline is needed, just like diet or quit smoking.

</comment><comment><USER6> When founding a startup it's important to avoid "burnouts". It's all about the balance between efficiency and long hours. Taking some time off is good to take a broader look at your business and being more creative. I always try to take 1 day off a week. So I can start the week with a fresh mind for critical problems.</comment>


Building a Recommendation Engine with NumPy - <AUTHOR> http://software-carpentry.org/4_0/matrix/recommend/ <comment><USER2> I spent a great deal of time writing a recommendation engine for a major web property, so I'll just offer some brief pointers for anyone interested in this stuff:

\- If you know nothing about how recommenders might work, a good introductory book is Programming Collective Intelligence.

\- To do recommendations at scale, your best bet is to write them in java and run them on Hadoop using map/reduce. You can write them in python too I suppose and use Hadoop Streaming.

\- NumPy is awesome. Its a great way to prototype your ideas and if you come from a Matlab background (as I did), its very similar. I have not yet run anything in production using NumPy though.

\- If you want a recommender that works out of the box, check out Apache Mahout (used with Hadoop) or the Weka project.

<comment><USER3> Is ruby appropriate for writing recommendation engines? Or is there far more support for writing them in python?

<comment><USER4> As far as I am aware Ruby has no real equivalent to Numpy and Scipy for Python. This is why I swapped to Python from Ruby; the Ruby community gets extremely thin indeed as soon as you stray from web-related things.

</comment></comment></comment><comment><USER5> Others in these comments have discussed or questioned if Python/NumPy is the best language for recommendations, due to scaling/speed. What if there was a project to translate Python libraries to run on LuaJIT? I suspect a lot of work could be done using sytax-directed automated translations, and there's also Lunatic Python as a fallback, in case a needed Python library hasn't been translated yet.

Does this seem to be a worthwhile project?

</comment><comment><USER6> Is NumPy the best way to do recommendation engines in Python? Has anyone done a recommendation library?

<comment><USER7> NumPy is used in rec engines because it has an extremely fast matrix library.

If you're doing non-matrix (or representing a matrix without a 2d array) recommendation engines then NumPy could be completely useless.

I'm doing research on this exact problem at Carnegie Mellon and we are using a graph to do things instead. We aren't using basic techniques like kNN however, so that may have something to do with it. Instead, we have someone who has done heavy research in submodularity and we're using an approximation algorithm to the submodular function optimization problem.

<comment><USER8> Sounds very interesting. Can you point to a paper in the area?

<comment><USER7> I help Khalid and Carlos with their research (I'm an undergrad). Here's Khalid's thesis proposal. The paper recommendation problem is section 2.2 (Beyond Keyword Search).

<http://www.cs.cmu.edu/~kbe/proposal.pdf>

</comment></comment></comment></comment><comment><USER9> please indicate a video post

<comment><AUTHOR> This is their new layout, which I like very much, because you don't have to watch the video and can just scroll down for each screenshot of code on the left and the transcript on the right. I hope more sites adopt this style.</comment></comment>


Dope Books – Netflix for Books(ish) - <AUTHOR> http://www.dopebooks.com/ <comment><USER2> What is the ranking based on?

<comment><AUTHOR> It's users books in last month, shuffled. When I get more data, I will implement more meaningful things.</comment></comment>


Astonishing picture of scientist just metres from boiling hot lava cauldron - <AUTHOR> http://www.dailymail.co.uk/news/article-2209757/More-Jules-Burned-Jules-Verne-Astonishing-picture-scientist-exploring-inside-depths-volcano.html

<comment><USER2> Astonishing. But notice that he is not wearing any gloves while going down ?? I thought its supposed to be too hot !!!</comment>


Ground leakage used as a Keylogger - <AUTHOR> http://news.bbc.co.uk/1/hi/technology/8147534.stm

<comment><USER2> The most interesting part of this article is that the talk got accepted to Blackhat. I'm sad to be missing the HN members' talks there, but I certainly don't mind missing a talk about a vulnerability dating back at least to the 1960's (in regards to key-presses, further for emissions security in general) : <http://cryptome.org/tempest-old.htm></comment>


TrueCrypt Security Assessment [pdf] - <AUTHOR> https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_Audit_Project_TrueCrypt_Security_Assessment.pdf <comment><USER2> _The iteration count used by TrueCrypt [in its PBKDF2 key derivation] is either 1000 or 2000, depending on the hash function and use case. In both cases, this iteration count is too small to prevent password guessing attacks for even moderately complex passwords._

Until TrueCrypt gets patched to use scrypt for key derivation, roughly how long should a volume password be to put it out of reach?

Edit: There's a table in the scrypt paper from 2002 [1] that estimates the cost of various brute force attacks. Back then, a PBKDF2 iteration count of 86,000 and a password of length 40 would cost $200K to crack. TrueCrypt's choice of 1000-2000 iterations look staggeringly low in comparison. And that's not even accounting for hardware advances in the last 12 years.

[1] page 14, [http://www.tarsnap.com/scrypt/scrypt.pdf](http://www.tarsnap.com/scrypt/scrypt.pdf)

<comment><USER3> > a password of length 40 would cost $200K to crack

I'd love to see someone try. Here, an md5, those are super vulnerable right? This is a 9 character password. Piece of cake if I should believe the news.

        f1f107c27cae21b5b5b01002e9c9ead8

<comment><USER4> Some numbers for you.

Using non-optimized, managed code on my laptop, I just went through 250 million iterations of plain text in ten minutes. You didn't specify what counts as a character, but let's assume it's a printable ASCII character. 95^9 = 630249409724609375 possibilities.

Divide by 250 million, and we get about 2520997639 times ten minutes for the time it would take me to enumerate all possible plain text passwords. That's a long time, about 47000 years. Not going to happen today on my laptop. But if I were a government, maybe I'd get a few thousand laptops together and set about calculating this over the next five years or so. In 1997.

But if I were to throw some purpose built hardware at this problem or use the video card to speed this up and not just laptops with general purpose CPU's, it's very likely I could decrease this time by thousands of times.

At the end I's have all MD5's for all passwords, and now the problem becomes a rainbow table lookup. And I only have to do this once and I forever gain the capability to break any 9 character (and below) password with just a lookup.

And that's assuming that MD5 is a perfectly secure hash with no shortcuts allowing you to narrow down the input set.

<comment><USER5> Did some more calculations just for the fun of it. It looks like you'd need nearly 16 exabytes of storage to hold the MD5 table for every 9-character hash [1]. Not accounting for any database overhead. In high density, you can fit a petabyte in what now a days? Half a rack? So around 8,500 racks. Certainly in the realm of possibility for a government but it would be a lot for storing just one type of hash list.

[1] [https://www.wolframalpha.com/input/?i=%28630249409724609375+...](https://www.wolframalpha.com/input/?i=%28630249409724609375+*+25+bytes%29)

<comment><USER6> I feel like there should be a more efficient way to store these things. You have a complete enumeration of possible inputs (passwords), but unfortunately we need to go in the opposite direction, so we couldn't just index into a n*9 bytes array. Depending on how well distributed the md5 hash space is, it's possible a prefix tree might save you a bit of storage (you'd only have to save a couple of bytes per entry to cancel out the overhead) but I couldn't tell you the numbers there. Otherwise I think you're right, and we'd just have to store a map of md5 -> password.

(Edit: Also being limited to alphanumeric for hashes and printable ascii for input gives you pretty good compression potential.)

<comment><USER7> They are actually much more complicated than just a big table of 'password | hash'. Check out [https://www.freerainbowtables.com/en/articles/](https://www.freerainbowtables.com/en/articles/) for in-depth explanations.

</comment></comment></comment></comment></comment></comment><comment><USER8> I wish someone would also audit tcplay [1], the BSD-license system with full TrueCrypt compatibility. I would much rather use that, if at least for the license concerns repeated many times in the comments here.

[1] [https://github.com/bwalex/tc-play](https://github.com/bwalex/tc-play)

<comment><USER9> License review is listed as #1 among goals on [http://istruecryptauditedyet.com/](http://istruecryptauditedyet.com/) .

</comment></comment><comment><USER10> "The assessment explicitly excluded the following areas... Cryptographic Analysis, including, RNG analysis, Algorithm implementation, Security tokens, Keyfile derivation"

</comment><comment><USER11> A feature I'd like to see on both our laptops and mobile devices to protect their privacy from random and abusive border searches: being able to hide the fact that you have an encrypted account.

Use case: Say you pass the UK border, and they can willy nilly decide to check your laptop or mobile phone. But you have an account that is password protected and encrypted, and they see that, and ask you for your password. You say no - and you get arrested for it. If they couldn't see you have that password protected account, and all they could see is a "normal" (clean of sensitive stuff) account, then they'd just check that and move on. Or you could even password protect that, too, and give them the password to it, and they'd be none the wiser.

All you'd need is to be able to hide that account from the main screen when you turn on the laptop or mobile device, and you should only be able to re- enable it from a menu prior to booting into the OS. It shouldn't be easily accessible either, otherwise it defeats the point.

I don't see Microsoft doing something like this - ever. Apple might if enough people asked for it, but I'd incline to say they wouldn't for now. Google probably won't do it either for Android or Chrome OS, since they probably see no benefit to it. But it would be nice if that feature at least came to Linux and some custom Android ROMs like Cyanogen.

<comment><USER12> It's called deniable encryption[1]. TrueCrypt supports it[2]. Bruce S is not a fan of their implementation, however[3].

[1] [http://en.wikipedia.org/wiki/Deniable_encryption](http://en.wikipedia.org/wiki/Deniable_encryption)

[2] [http://www.truecrypt.org/docs/plausible- deniability](http://www.truecrypt.org/docs/plausible-deniability)

[3] [https://www.schneier.com/blog/archives/2008/07/truecrypts_de...](https://www.schneier.com/blog/archives/2008/07/truecrypts_deni.html)

<comment><USER13> Huh. I hadn't thought about multiple-image attacks.

Could that be mitigated by having TC occasionally randomly write random data to unused blocks?

<comment><USER14> The table of unused blocks would violate your deniability. Indeed, any such mutating of ostensibly free space by TrueCrypt would give it up.

You have to consider the adversary. Are you a non-targeted individual who want to keep some things private from a spurious search by law enforcement or border agents, then simply the ability to boot up and not have sensitive stuff and not have an obvious encrypted partition lying around will do the trick.

If, on the other hand, you're targeted by someone with a strong reason to believe that you are hiding stuff on your computer, maybe even someone who will break into your apartment every day to image your computer, you're gonna have a bad time (and a keylogger on your computer, but that's a different kettle of fish). Basically, evidence of the existence of your hidden partition can leak out into the real world, not because of bad cryptography, but because you're human.

</comment></comment></comment></comment><comment><USER15> Did anybody give this a thorough read and can give a cliff notes on the results? How did Truecrypt do - good/bad/indifferent?

<comment><USER13> All things considered, pretty good.

No massive exploits; the worst problem was using too small a number of iterations of a keygen.

There were a bunch of other minor problems, but most of them were information disclosure only trigger-able by malicious software running in the encrypted environment (ex: finding out if a file you don't own exists) or things that could only be triggered by someone with raw access to the hard drive (at which point they could just overwrite your bootloader)

Although this explicitly doesn't cover a large chunk of TC.

</comment></comment><comment><USER16> > Issue 4: Windows kernel driver uses memset() to clear sensitive data

> Calls to memset() run the risk of being optimized out by the compiler.

I would be curious to know which compilers or which options actually still do these ill-fated _optimizations_?

<comment><USER17> They should do it only in situations where it doesn't change the program behavior. I use memset frequently in C just to be safe, but if it's written to later on before it's ever read from, the compiler can optimize that away. I'm guessing their recommendation here is if you did something like

        char* plain_text = malloc(size);
        ///do stuff with plain_text
        memset(plain_text, 0, size);
        free(plain_text);

For most programs that last memset is unnecessary (and may even be unnecessary according to the standard, but it's probably implementation defined, not undefined behavior) and it makes sense for the compiler to optimize it away. But for crypto purposes you have to be afraid of someone being able to read plain_text later, so the memset is important

<comment><USER18> I checked 3 compilers: icc 14, gcc 4.8, and clang 3.3. Clang is the only one which optimized the memset away.

<comment><USER19> Did you enable optimization? I know first hand that GCC will optimize something similar out in many cases.

[http://gcc.gnu.org/bugzilla/show_bug.cgi?id=8537](http://gcc.gnu.org/bugzilla/show_bug.cgi?id=8537)

<comment><USER18> Yes, I compiled with -O3.

</comment></comment></comment></comment></comment><comment><USER20> Does anyone know if Tomb [1] or ecryptfs [2] is a safe choice for encrypting a local directory?

Everyone always talks about Truecrypt which is clearly most popular but both of the above are fully open-source. The latter is even part of the kernel. I'm curious what the appeal of Truecrypt is besides maybe portability (which is a pretty strong selling point).

[1] [http://www.dyne.org/software/tomb/](http://www.dyne.org/software/tomb/)

[2] [http://ecryptfs.org/](http://ecryptfs.org/)

<comment><USER21> The appeal of Truecrypt is that it works on Windows. As you've suggested, there are better encryption programs and schemes for users of GNU/Linux operating systems.

The questionable license, and obscure nature of the project should be significant reasons not to use Truecrypt. That doesn't even begin to consider the actual security of the program.

<comment><USER22> Too bad Windows 8 isn't supported, so Truecrypt loses much of its appeal to Windows users.

<comment><USER19> I replied to this comment using a TrueCrypted Windows 8 machine.

</comment></comment></comment></comment><comment><USER23> Actual PDF [https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_A...](https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_Audit_Project_TrueCrypt_Security_Assessment.pdf)

Die slideshare, die scribed.

</comment><comment><USER24> Encrypted 32gb microSD card containing all sensitive information removed from phone prior to flight/border checkpoint thus rendering what is on the phone itself to be unimportant and maybe even substitute another password-protected microSD card with interesting but non-sensitive info (maybe a risqué photo or two of the wife and some saucy conversations)?

Anyone know if something as small as a single microSD card positioned in the densest part of the suitcase will show up on an X-ray?

<comment><USER25> In America, you are better off putting it in your sock under your foot. No TSA search includes the bottom of the foot, and you'd have to really arouse CBP suspicion to get them checking out your feet.

But, to answer your question, no, airport security screeners are not x-raying for objects of that size. If visible at all, it would be ignored.

</comment></comment><comment><USER26> I have been waiting for the security audit report since the first time it was mentioned. Now that it is out i feel a little disappointed that there are no real intentional risks

<comment><USER27> Why would you be disappointed that there's nothing wrong with it? Why would you be hoping that the program millions use to protect their sensitive information was broken?

<comment><USER28> I'm not disappointed by a fairly uneventful report, but quite honestly, I'm always a little bit worried when nothing horrible is discovered in the course of testing.

It's not that I want there to be bugs, but that in a large enough codebase, there's always a game-over bug -- major information leakage, arbitrary code exec, whatever. As a security consultant, I'm always more confident in a test when I find a horrendous bug than when I don't; I know that bug will be fixed, and it makes me feel like the test is more complete, even if I know full well that I did the test to the absolute best of my abilities regardless.

I've heard similar sentiments from most testers I know.

<comment><USER19> Heh, a clean bill of health always has that elephant in the room attached.

</comment></comment></comment></comment><comment><USER29> I recall seeing something about reviewing the TC license. Does anyone know if this is something that will be part of Phase II or am I misremembering the details?

</comment><comment><USER30> I would really, really like to see an effort like this for OpenSSL ... or better yet, for one of the OpenSSL alternatives that are not a spaghetti mess.

<comment><USER3> Hindsight bias? We should audit libnss and all the other cryptography libraries too then. And don't forget how much of the world relies on closed- source solutions like Microsoft's Bitlocker. Better shun those because they had no public audits and for all we know they're even more spaghetti code.

<comment><USER30> No, it's not hindsight bias. I have posted (and so have others) on many public forums for _years_ about the need for an audit of OpenSSL and OpenSSH and there have been many discussions about the sad state of the codebase in OpenSSL.

I can think of a particular discussion on the cryptography mailing list at randombit from ... two years ago ?

</comment></comment></comment><comment><USER11> Would Threefish be a better cipher than AES for TrueCrypt/disk encryption, considering it can have 1024-bit blocks?

<comment><USER31> For security, somewhat. The current de-facto standard mode of operation for disk encryption utilities is XTS, which effectively encrypts each block on the disk with a different key, where the blocks are of the same size as the cipher block.

Whether this is of any significance depends on your adversary model. If the adversary controls your storage medium (imaging putting an encrypted container on Dropbox or Google Drive), they can mix-and-match (e.g. copy-paste) different versions of blocks from your history. Imagine your disk to be in a version control system; the adversary could pick the value of the block 1 from version 50, the value of the block 2 from the version 42, the value of the block 3 from the version 100 and so on. They could also potentially discover usage patterns (seeing e.g. that the value of block 3 remained constant between versions 20 and 200, while block 5 remained the same). Additionally, they could corrupt any of the blocks, by turning the corresponding plaintext into random bits.

Having a smaller block size means that they can perform any of these with finer granularity. Increasing the block size thus increases your security; ideally, your entire disk would be just one block (the only thing the adversary could do in that case is to completely restore an old version of the disk); but this is hugely impractical, since the performance would be abysmal (you'd have to re-encrypt the whole disk to change just one byte). So you have a spectrum of performance/security tradeoffs. Where on this spectrum the 1024-bit blocks lie, I'm not sure, but I suspect that they are better than 128-bit ones.

Note that we do have schemes which can do sector-level encryption (the EME mode), but they're not used since they're 2x slower than the schemes with smaller sizes.

Edit: in conclusion, for pretty much every scenario, other security concerns are much more significant than the block size :)

<comment><USER32> > Additionally, they could corrupt any of the blocks, by turning the > corresponding plaintext into random bits.

Given that the premise is that the adversary controls the storage medium, this point doesn't seem terribly interesting. I feel like I'm missing something.

<comment><USER31> The theoretical attack there is that one could selectively garble the (decrypted) parts of your storage, and thus destroy the contents of e.g. your configuration files. E.g. they could corrupt your firewall configuration file and thus leave your computer open to outside network connections. I don't think this has been done in practice, and it's probably not very feasible.

Such an attack could not be detected, because the encryption modes commonly used do not provide integrity protection. This is due to the desire to have equal sizes for both the encrypted and plaintext sectors (as far as I understand, that's an efficiency/ease of implementation concern). Incidentally, you can easily see that such a scheme can never provide integrity, since the encryption operation has to be a permutation, and you have to be able to decrypt any ciphertext.

</comment></comment></comment></comment><comment><USER33> I read this whole thing, but they left out a description of the NSA planted back doors. As everyone knows, the NSA has compromised all crypto systems. Since the audit did not reveal the NSA back door or doors, what else is missing?

More likely iSECPartner's is the NSA's new RSA 2.0

</comment><comment><USER34> Build tools from 1993? What kind of nonsense is this?

> Page 8

<comment><USER35> To offer full disk encryption, boot code for the MBR must be produced, and it has to be 16-bit. Current compilers just produce 32 and 64-bit binaries. So you have to use an old compiler...

<comment><USER34> Thanks for detailing that (I didn't know)

</comment></comment></comment><comment><USER36> tl; dr

"1.3 Findings Summary

During this engagement, the iSEC team identified eleven (11) issues in the assessed areas. Most issues were of severity Medium (four (4) found) or Low (four (4) found), with an additional three (3) issues having severity Informational (pertaining to Defense in Depth).

Overall, the source code for both the bootloader and the Windows kernel driver did not meet expected standards for secure code. This includes issues such as lack of comments, use of insecure or deprecated functions, inconsistent variable types, and so forth. A more in-depth discussion on the quality issues identified can be found in Appendix B....

The team also found a potential weakness in the Volume Header integrity checks. Currently, integrity is provided using a string ("TRUE") and two (2) CRC32s. The current version of TrueCrypt utilizes XTS 2 as the block cipher mode of operation, which lacks protection against modification; however, it is insufficiently malleable to be reliably attacked. The integrity protection can be bypassed, but XTS prevents a reliable attack, so it does not currently appear to be an issue. Nonetheless, it is not clear why a cryptographic hash or HMAC was not used instead.

Finally, iSEC found no evidence of backdoors or otherwise intentionally malicious code in the assessed areas. The vulnerabilities described later in this document all appear to be uninte ntional, introduced as the result of bugs rather than malice."</comment>