Unauthorized Bread: Jailbreaking IoT toasters - <AUTHOR> https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-near-future-tale-of-refugees-and-sinister-iot-appliances/ <comment><USER2> Reminds me of my all-in-one "Ink Advantage" HP printer. The cost of ink cartridge had gone so high that it was reasonable to just not use it anymore. The cartridges can be reliably refilled 3-4 times but they put an artificial #X papers print limit on each of those cartridges and show cartridge needs to be replaced message once those limits are reached. Once there was a firmware update for some vulnerability, and the update somehow erased the previous cartridges used and I was able to refill and reuse all of my previous cartridges twice again so I know cartridges were in perfect condition despite the printer saying otherwise. It remains one of my most regretted purchases till date. Only if someone had the time and motive to jailbreak it :(

<comment><USER3> anyone aware of a printer that isn't robbing you?

I've seen this on buymeonce which is usually pretty good, but I'm having trouble believing epson would have actually designed this

[https://buymeonce.com/products/epson-ecotank-et-2650-all- in-...](https://buymeonce.com/products/epson-ecotank-et-2650-all-in-one- printer-copier-scanner?_pos=2&_sid=645c20bb4&_ss=r)

Edit: still seems these brick themselves once the ink pad is full. Can't find good data on that so please correct me if I'm wrong.

<comment><USER4> I have been using a Brother HL-2130 laser printer which cost less then 100 EUR for nearly 10 years now. Every 1-2 years, I buy a cheap toner (under 20 EUR) online. By far the most reliable printer I have ever owned.

<comment><USER5> Sitting next to a Brother MFC-8600 that is 20 years old and still printing away. Haven't faxed anything in 5 years though ;-)

</comment></comment></comment></comment><comment><USER6> I programmed for a refurbishing company for some time, where I learned about toner cartridge refill kits. Once you've bought an expensive copier for your company you're vendor locked into proprietary toner cartridges, and they charge outrageous prices. "Pirates" started selling bags of toner and syringes on eBay with instructional videos on how to refill the cartridge yourself. The toner company started putting small chips on the cartridge that would count the number of prints, and deactivate the cartridge after a certain amount. "Out of toner" was a lie, it was unauthorized printing. Reading this story is making me sick to my stomach.

<comment><USER7> My favorite one was the K-Cup machine.

The first one allowed you use refillable K-cups so you could make coffee really fast using your own grounds.

The second one had a DRM module that didn't allow you to put in 'Unathorized Coffee'.

Regarding Unathorized Bread, I actually found the story of the cancer patients to be far more realistic and made me realize how people get radicalized easily. The story is something that should be read for yourself but I was on the edge of my seat through it.

<comment><USER6> I edited the word "radicalized" out of my original comment to make it more concise, but that's exactly how I feel. I had medical issue while I was in a foreign country that cost me $35 to see a doctor and get medicine. When I returned to America, in between jobs and in between health care providers, the same medicine cost me $500, and that's only because I was able to have a doctor-friend phone in the prescription so I didn't have to pay for a doctor's visit too. This was the same winter I learned about toner-pirates, and I found my contact lens prescription were held from me unless I paid for another eye exam. I'm tired of protecting myself from this predatory system.

<comment><USER8> The medical system in America is fetishized suffering.

My partner is lucky enough to have "very good" insurance through their employer. They recently had to have a scan done to check for serious problems. We got a bill for $500, half for the hospital and specialist, and half for the scan itself and the people providing it.

I took a look at how the costs broke down. In fact, the "real" cost was $5000, and the insurance company paid 90% of that. I started digging and discovered that they pay just about 90% of all medical treatment across the board (for a _very_ small set of in-network physicians and hospitals). Even putting aside whether $5000 was a reasonable cost for this 1 hour procedure (probably not), this left me wondering, why 90%? Why pay such an extraordinarily high percentage, but not all of it?

After thinking about this for a while, I've come to the conclusion that it's a combination of two factors. One is that it's absolutely unacceptable to Americans for individuals to ever receive anything for free. You absolutely have to suffer in some way for every good thing you're allowed to have. The other is that I think they want to actively dissuade you from getting the medical care you need unless it's _crucial_ , because someone worked the math out and putting a slight disincentive on medical care works out slightly cheaper for them than just letting people have what they need with the insurance they're already paying for.

The result in human costs is enormous. My partner has cried about this on and off for weeks because $500 is a very consequential amount of money for us, and we didn't have even a ballpark estimate before the procedure of how much it would cost.

So yes, it's radicalizing as hell. Burn this system to the ground.

<comment><USER7> As much as Obamacare is liked, this is one of the issues I didn't like about it.

Law says insurance must cover 80%+ of the costs of healthcare, insurance company conspires with hospital to raise costs, everyone else gets fucked.

</comment></comment></comment></comment></comment><comment><USER9> My price barrier for smart devices is whether I would scream if I dropped it in the toilet and ruined it. $5 smart outlet? Sure I'll put my lamps on those. $25 streaming dongle? All right, that'll last at least five years before Netflix decides it isn't secure enough.

$500 television? Hell no. $1200 in home automation and surveillance linked to a central hub? I wasn't dropped on my head as a child, so no.

<comment><USER10> Presumably you're buying more than one remotely-switched outlet, and their software will fail at the same time. So the actual risk there is much higher than $5.

The way I see it is buy devices that can be controlled with Free software, don't give them Internet connectivity, and plan on never "upgrading" the firmware. The TP-LINK Kasa line works well for me (their protocol is trivially obfuscated), as well as anything that can be flashed with Tasmota.

Also in general you don't want to go too cheap on anything that switches line current. I have to wonder how many of those fly by night "Amazon brands" are getting creepage right.

<comment><USER11> Just in case you're not aware, there is a new and much improved free Kasa library in the works: [https://github.com/python-kasa/python- kasa](https://github.com/python-kasa/python-kasa)

It's already been working perfectly with my HS103 and HS110 plugs for months. The only thing still missing for me is the per-plug energy meter of my HS300 strip, which I hope will be coming very soon.

<comment><USER10> Nice. I've been driving mine directly with Home Assistant, but it has some warts. So I do have the itch to write my own daemon that controls them, and publishes a better interface via MQTT.

</comment></comment></comment></comment><comment><USER12> The irony of the ad box blurb for the book itself fits in:

 _"...currently available in paperback and Kindle formats._"

It's also available in several other ebook formats not authorized for use with the affiliate link. The local library offers Adobe EPUB, Open EPUB, and OverDrive Read as well. All the better for reading on my unauthorized jailbroken ereader.

<comment><USER13> Cory Doctorow makes all of his books available on his website in DRM free formats, as well.

In fact, there's a DRM free audiobook available from his website: [https://craphound.com/unauthorizedbread/](https://craphound.com/unauthorizedbread/)

<comment><USER14> Also, he gets more of a cut if you buy from him and no DRM! win-win

</comment></comment></comment><comment><USER15> [Spoiler]

My favorite line in the whole thing: "and a large warning sticker that threatened electrocution and prosecution, perhaps simultaneously"

He really is a master of the language. Thanks, Cory, wherever you are!

<comment><USER16> [Big Spoiler]

The best line of the book, a big reveal, is hidden in the last line of the story.

<comment><USER17> Could you rot13 what you mean by this? I don't understand what the last line of the story reveals, unless I missed part of it?

<comment><USER16> fur arire gbyq ure gbnfgre pbzcnal sevraq nobhg gur pneqvzhz erpvcr. ure sevraq jnf fclvat ba ure.

<comment><USER17> Uzz, V frr jung lbh'er fnlvat, ohg V qb guvax vg rfgnoyvfurq rneyvre gung Jlbzvat jnf jngpuvat bire ure:

> "Gur iveghny znpuvarf lbh'er hfvat nera'g sbbyvat gurz nalzber. Gurl frag > bhg na hcqngr gung vf qrfvtarq gb oernx ba IZf. V whfg purpxrq lbhe > ohvyqvat. Lbh'er whfg unatvat bhg gurer abj. Gurer'f ab jnl gurl'yy zvff > vg."

Fnyvzn nyfb zragvbarq gung fur znqr gur Pneqnzbz ohaf rirel zbeavat, fb vg'f cbffvoyr gung fur unq gnyxrq nobhg gurz orsber:

> Fnyvzn jnf irel tbbq ng onxvat. Fur unq qvfpbirerq Abeqvp oernqf naq znqr > sbhe yvggyr pneqnzbz ohaf rirel zbeavat, qhfgrq jvgu pvaanzba.

Ohg V guvax lbh'er evtug, vg'f gurer gb fubj gung Jlbzvat vf fgvyy jngpuvat bire Fnyvzn. Ohg Fnyvzn qbrfa'g frrz hcfrg ol gung snpg.

</comment></comment></comment></comment></comment><comment><USER18> Read this as part of Cory Doctorow's "Radicalized" compilation. The whole set of short stories are awesome. If you're enjoying the excerpt, I suggest just buying the book and starting from the beginning.

</comment><comment><USER19> > She could wash dishes in the sink but how the hell was she supposed to make > toast—over a candle?

When I was a kid we just made it in the oven. I don't remember using an electric toaster before I was a teenager.

One of my friends had a special short door at the top of their oven just for this.

(I suppose in the story the oven is licensed too)

<comment><USER20> Yeah it turns out the toaster is actually an oven, but until jailbroken you can only use it as a toaster and only with authorized bread.

</comment></comment><comment><USER21> I recently watched a great video showing a toaster from the 40's.

It's amazing the features and engineering used to make such a little gem: [https://youtu.be/1OfxlSG6q5Y](https://youtu.be/1OfxlSG6q5Y)

All this without IoT, Block chain or Deep Learning ;)

</comment><comment><USER22> Is this... The Conquest of Bread

</comment><comment><USER23> "Ask for your appliance to work. If they don't get your appliance to work, ask for toasted bread. If they do not get your appliance to work or toast your bread, then take their toasted bread."

</comment><comment><USER24> Is there a list somewhere of consumer stuff that has DRM? I knew about printer ink. But, I was surprised to find that some refrigerators have DRM water filters.

</comment><comment><USER25> First page was hilarious. Does anyone know if there's a way to buy a paper copy? I find reading fiction on a screen much less convenient.

<comment><USER14> Radicalized is in paperback on Amazon: [https://www.amazon.com/Radicalized- Cory-Doctorow/dp/12502292...](https://www.amazon.com/Radicalized-Cory- Doctorow/dp/1250229251/ref=tmm_pap_swatch_0?_encoding=UTF8&qid=&sr=)

It has unauthorized bread in it.

</comment></comment><comment><USER26> > _she was able to run the darknet browser she still had kicking around and do > some judicious googling_

</comment><comment><USER27> This story is a lesson on why rent seekers should be sought out and extinguished wherever they arise.

</comment><comment><USER28> Reminds me of The Toaster, a short story by Piers Anthony, included in Anthonology.

</comment><comment><USER29> Hey, maybe I _can_ run NetBSD on my toaster after all!

</comment><comment><USER30> lol.... doubtful on the conquest of the universal baker.

</comment><comment><USER31> I'm a little disappointed that he didn't call it something like "Juicero World", given how on-the-nose he can rarely seem to help himself from being. But hey, he's the successful author, I have to assume he knows what he's doing.

<comment><USER32> That would really date the story.

<comment><USER33> Whereas writing it about this topic won't? (It probably won't, but we can fight to make it so.)

</comment></comment></comment><comment><USER34> I've only read one Doctorow book, _Pirate Cinema_ (plus one long story which I apparently found the premise intriguing and the execution lacking but have otherwise forgotten). I found _Pirate Cinema_ to be annoyingly doctrinaire and not very well written. It was kind of like reading Soviet "proletarian literature" with a different underlying ideology (or the sentimental religious literature popular among some folks). From the brief bit I read and knowing what I know about Doctorow, I would expect this to be more of the same. Ideology never makes for good fiction.

</comment><comment><USER35> Jiminy Crickets, what a diatribe. Maybe that reads like something clever to a layman, but from where I stand its a tired run-on rant. How it got any kind of recognition is a puzzle to me.

<comment><USER27> Rog, is that you?</comment></comment>


Ask HN: Private Cloud for a Small Business? - <AUTHOR> I'm looking for advice. I work for a small business, currently operating a SaaS on a handful of medium EC2 instances. The app is connected to a database in a different country, and to minimize latency, we're contemplating leaving AWS, and getting hosting next to it.
Unfortunately major cloud providers are nowhere near the area, so programmatic infra goes out the window. However, high availability is still expected, and the bosses are very cost-sensitive. Talk about requirements!
For these reasons, we thought of renting 3 entry level physical servers, deploying a virtualization platform (oVirt), and wiring them up for replication, load balancing and automatic failover. This private cloud should vastly exceed the capacity currently bought from Amazon, and should also tolerate one of the machines breaking down (with KVM's live migration).
However, my team has a software development background, so we're not completely sure what we're getting ourselves into in terms of networking setup, hardware health monitoring and virtualization wizardry.
Under what conditions do you think all this is worth learning more about? What are the alternatives apart from getting a bunch of VPSes and dealing with failover on a per instance basis? How would we prepare a sandbox in the office before just doing it live? Am I completely mad even to entertain the idea of a private cloud for a small company?
Thanks! <comment><USER2> Although I don't have any specific recommendations for you since much of the private cloud software stacks out there are generally bad, I do want to say this is entirely justified and you're not mad. I'm hoping to see more companies and people switching away from the large cloud providers in the near future.

<comment><AUTHOR> I too prefer avoiding consolidation of services, but the thing is, it is not the main motivation for this goal.

Self hosting is fine in my spare time, but these are company resources, so I better be well prepared to setup and manage any infra required.

</comment></comment><comment><USER3> Considering cost sensitivity, I highly recommend to consider Proxmox VE (Virtual Environment), which is a high-quality open source virtualization software for hyper-convergent infrastructure with an optional subscription, which is very modestly priced: [https://www.proxmox.com/en/proxmox- ve](https://www.proxmox.com/en/proxmox-ve). Hope this helps.</comment>


Show HN: YoPeopleFinder Find people near you to Yo - <AUTHOR>

Put this together in an hour: Yopeoplefinder.appspot.com<p>Work in progress, comments/features welcome :) <comment><AUTHOR> Clickable: [http://yopeoplefinder.appspot.com](http://yopeoplefinder.appspot.com)</comment>


Intel Xeon D 12 and 16 core parts launched: first benchmarks - <AUTHOR> http://www.servethehome.com/intel-xeon-d-12-and-16-core-parts-launched-first-benchmarks/ <comment><USER3> > If you are using a compute optimized AWS c4.4xlarge instance: you will be > able to purchase the Intel Xeon D-1587 system for about the same price as > the "Partial Upfront" up front AWS fee, then colocate the box saving over > $1500/ year per instance while getting better performance.

I hear this type of argument a lot, but it's so important to include the cost in engineering and talent necessary to keep your datacenter humming.

If you're a small shop with a small future growth expectation then sure, forget Amazon and start racking your own boxes. Just be ready to hire ops staff competent to run your operation. You need to be realistic about both aspects of cost.

<comment><USER4> Having done this computation a number of times, with these machines it would flip over to 'colo' at about 150 machines. The really interesting thing is that amazon costs scale linearly with size while owned infrastructure scale fractionally. So the advantage just keeps growing and growing.

Bottom line, if you can host your app and resources on less than a 150 machines in Amazon you win, more than that and you're leaving money on the table. Once you get to the point where you are deploying new datacenters to support your customers you get a huge boost in operational efficiency.

<comment><USER5> Note: I manage dedicated-server hosting and all web services on Titanfall @ Respawn.

Surely your calculation doesn't / can't include bandwidth charges? And if you have Windows hosts... cloud screws you too.

You're not wrong that it takes a lot more machines than most shops need, and if you can make your scale elastic, 150 machines probably goes a long way! And to your point, developers undervalue their time a lot, and dealing with colocation and sourcing of hardware and backups can be a real drain to save some on CapEx.

<comment><USER4> Our transit costs out of our Colo in Santa Clara are $6K/month for two dedicated gigabit lines. That translates roughly to 518 TB of data transfer a month if we could keep the pipes fully lit 24/7\. Cogent has offered to make one of our gigabit lines burstable to 10G if we would like, same cost if we don't exceed a monthly average use of 1000Mbps.

And we use Linux so no Windows hosts charges.

There are more and more tools that are force multipliers for your Site Reliability Engineer (SRE) equivalents. You can't avoid swapping out dead drives, but with the right systems architecture you can make it pretty painless.

<comment><USER6> Wow, you're getting ripped off.

<comment><USER7> Indeed, I've seen Cogent go for $800 - $1000 for a 1GE over 10GE commit.

<comment><USER8> It's possible to only pay the lower end of that range for a 2Gb 90th percentile commit on a 10Gb connection out of most major markets. Cogent pricing fluctuates wildly depending on your ability to negotiate.

Ignore the whole song and dance when they have to bring in a VP into the call to specially approve the pricing they're trying to pitch to you at. Those are standard transit sales tactics. Or avoid Cogent's sales entirely by working with a reseller.

<comment><USER3> Speaking with the VP to Negotiate for transit prices? Sounds like a pita. AWS knows that you're an engineer who just wants to write code and has made that as frictionless as possible.

This goes back to my first point in that going into the DC requires staff with very different skill sets. It's not that it's not worth it, but there's a lot of costs involved part from the per-hour instance cost.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> "128GB is now starting to become a limitation. With 16 cores that is only 8GB/ core."

This comment gave me pause, I feel like I'm falling out of pace with the evolution of commodity server systems. We've gone from being network (10/40gbe) and disk io (fixed with SSD, PCIe NVRAM and Fiberchannel) bound in the the near past to swing towards memory capacity bound?

<comment><USER10> I think that's more of a reaction to the "fixes" to disk IO still not being fast enough.

The more you can keep in memory, the better off you're going to be, even with the fastest SSDs in the world.

<comment><USER11> Isn't 8 GB per core still reasonable? Especially if you can share indices and buffer caches across cores, for example. There must still be diminishing returns for caching.

<comment><USER12> Depends on your dataset. Systems like Databases perform much, much better the less you have to touch a storage controller. One of the things that's going into Intel's 2017/2018 platform is the support for 6 channels of memory, and not all of that needs to be DRAM. There's a new standard, NVDIMM, that lets you use non-volatile memory as RAM, and take advantage of its much higher densities. So, if you have things like a database, you can map a much larger dataset into actual memory, instead of needing to just have the indexes in there.

</comment></comment></comment></comment><comment><USER13> Every couple of years Intel hardware keeps changing my mind from "I'll just rent everything in the cloud" to "I should build a server from this and keep everything in house!". And vice versa.

</comment><comment><USER14> I can't stress how game-changing this is to anyone in super-computing. (The whole direction Intel's been taking for the last ~5 years has been poised for this.) I went into a bit of detail here[1] (n.b. this was pre-Xeon D, the addition of which will only increase performance) for those who are curious.

Right now we're living in a golden age of financially accessible super- computing. We don't need to deal with MPI anymore, we just use RDMA and have Infiniband speed fetches to any machine joined to the cluster[see: MS Paper]. I was working on RELION as a favor to my father and got deeper and deeper into it because my docket was pretty open and it was fascinating. Long story short, I sketched up a test setup with Phi, RDMA (which admittedly wasn't used that much, as the problem set would be characterized by anyone as "embarrassingly parallel") and 10GBit. This is all commodity stuff, and we effectively _never touch disk_ \-- I cobbled together 18650's in the rack[see: batt] instead of a UPS with a uC which fires off a 'persist state to disk' message on any power interrupt but other than that it's all RAM and blazing fast. (Side-note: anyone who read the _Nature Methods_ special on all the Cryo-EM stuff may be seeing a paper or two with a few new sets of computational methodologies in the near future ;))

Buyer beware though -- sacrificing clock speed for more cores can end up costing you a lot more overall[2]. Licensing policies have a tendency to change around from version to version, so your perfectly licensed Oracle 11g (lets say it was quantified by the physical chip you throw into the socket) might not have a straight forward upgrade path (now by the number of vCPUs). A lot of clients of mine got burned trying to move from Iron to AWS, only to realize that Oracle licensed per _available CPU_. Fines galore. They ended up downgrading to a previous revision Xeon (i.e. 4th gen E5 MSRP $x,xxx instead of 5th gen E5 MSRP $0,xxx with better performance but more cores). Anyone encountering this problem should keep that trick up their sleeve and find some 1 year old off-lease equipment with less cores but a higher clock speed to keep license compliance and still meet your computational demands. Anyways, yeah the latest and greatest might not be the most economic of choices for this reason[licensing].

[1] [https://news.ycombinator.com/item?id=10805087](https://news.ycombinator.com/item?id=10805087) [2] This has so many variables as one can imagine - you can't just go by what people did in 1975 i.e. "this instruction takes x cycles, we can physically count how long our computation will take with a sheet of graph paper" because of pre-fetching, pipelining, cache patterns, the use (or lack of use) of the AVX(2) registers, etc etc. [3][https://software.intel.com/en- us/articles/intelr-xeon-phitm-...](https://software.intel.com/en- us/articles/intelr-xeon-phitm-coprocessor-february-developer-webinar-qa- responses) [MS Paper] [http://sigops.org/sosp/sosp15/current/2015-Monterey/printabl...](http://sigops.org/sosp/sosp15/current/2015-Monterey/printable/227-dragojevic.pdf) [Batt] As you probably have guessed, I have no formal EE training. I did however rigorously read all of the safety datasheets, use very high quality Panasonics, and strictly conform to the CC-CV guidelines so my fathers lab would not catch on fire. This is probably not the best idea, but it's electrically safe and isolated. It'd pass UL certification.... at least I think ;) [licensing] If you're a corporate entity who is moving into any sort of cloud or onto new hardware, my firm has quite a bit of expertise in licensing compliance when either a) shifting to new hardware, or b) shifting to the cloud, as well as getting your best bang for buck with existing licenses.

<comment><USER15> >I cobbled together 18650's in the rack[see: batt] instead of a UPS with a uC which fires off a 'persist state to disk' message on any power interrupt

How did your tests go with this? I'd totally use a system like this - <USER2> packaged up of course. Li-ion and Li-poly make me nervous.

<comment><USER14> I trust it as much as commercial grade APCs I've used in DCs. It definitely cost more in my engineering time than buying an off-the-shelf component, since I spent a lot of time researching it. But I'm a hardware nerd at heart and rarely get to putz around with this kind of stuff, so it didn't really seem like labor to me.

The precautions I took were probably overkill but since it wasn't my lab I chose to go pretty overboard. In addition to conforming to the strict charge- discharge guidelines Panasonic thoroughly delineated in their sheets, were to use 1: use "protected 18650's" (actually designated as 19760) which have internal circuitry to keep, say, cheap chinese eBay charge-units from setting peoples house on fire, 2: sourced the batteries from a vendor I've trusted for ages (since the Panasonic 'greens' have such a popular reputation, and knock- offs make it into all sorts of markets including first-tier shops like Amazon and Digikey, I asked my vendor to source directly from Panasonic JP, which he did and provided me with a packing slip). Fear of Li-* is reasonable, and I figure risking permanent damage to ones body and/or life isn't worth the 7 bucks you save buying no-names - go with the 19760's and live life to the fullest! (Pro-tip, the form factor of the 760s are about a mm or 1.2 mm or something longer than unprotected 850s due to the added circuitry -- which I presume is just a PTC thermistor + kill switch, I haven't looked it up though. I'm sure there's a mass difference too if you have access to lab quality scales or are friendly with your local cannibus vendor.

Thrown in the case I have a live K-type thermocouple in all 8 of the 1u's (a pair in each rack) with conservative failure policies should temperatures exceed parameters I set. I put put some nice fusing (HRC.. why? because I was already going overkilling and since this wasn't an off-the-shelf component, and I'm not an EE with extensive PDU experience I decided to go safe. (I also consulted with a post-doc buddy of mine who's actively in lithium battery research and after a good chuckle told me the precautions I took were satisfactory.) It came in at around 5k USD for all 8 units with everything, including ~115 a piece for the Hammond 1u's. Each unit can sustain a little under 4.5 kVA which gives more than enough buffer time for a graceful shutdown

</comment></comment></comment><comment><USER16> Passmark has some benchmarks, including the E5 v3s , updated today ...

[http://www.cpubenchmark.net/high_end_cpus.html](http://www.cpubenchmark.net/high_end_cpus.html)

"The King of the Hill" is only 2.3 GHz ?

<comment><USER17> The article explains why:

      What one will see, very quickly, is that the new SKUs generally offer
      slightly lower clock speeds to maintain a 45w TDP. Maintaining this
      figure while adding 50% to 100% more cores and cache is no small feat
      and it makes sense that clock speeds suffer. We also see the TDP
      figures rise to 65w in order to accommodate more cores and higher
      clock speeds.

      We introduced the Core * Base GHz and Thread * Base GHz figures just
      to show how much of an improvement this is. The new chips represent
      double the cores but up to about 62% more clock cycles in aggregate
      over what we had as the previous fastest chip, the Intel Xeon D-1541.
      We also now, in the same TDP figure, have 23% more raw compute.

<comment><USER15> With the "23% more raw compute" figure, say I've got a program running on an older system - do I need to recompile that binary (with new optimisations / assembly instructions) to see that improvement or is that an improvement in efficiency for existing instructions?

<comment><USER18> If your program is single-threaded, it will run slower. If it parallelizes well (e.g. ray tracing) then you will see that improvement.

</comment></comment></comment></comment><comment><USER19> Is there some cloud for developers where one can try out new hardware from Intel / Nvidia / AMD? This is turning out to be a great year for hardware and theres too much new stuff coming out for my home lab.

<comment><USER20> I am working on [http://www.peachpy.io](http://www.peachpy.io) (an academic project) which lets performance tuning experts optimize assembly kernels for various x86-64 microarchitectures. We currently have Intel Nehalem, Intel Ivy Bridge, Intel Haswell, Intel Broadwell, Intel Skylake, AMD Piledriver, AMD Steamroller, Intel Bonnell (1st-gen Atom) and AMD Bobcat in the pool.

Source code:

\- [https://github.com/PeachPy](https://github.com/PeachPy)

\- [https://github.com/Maratyszcza/PeachPy](https://github.com/Maratyszcza/PeachPy)

<comment><USER21> On the site, the "About PeachPy" link at top right corner seems to do nothing.

<comment><USER20> Peachpy.io is a work-in-progress...

</comment></comment></comment></comment><comment><USER22> I wonder how much it will cost to have 2 of these in a server running Windows Server 2016.

<comment><USER12> These can only support a single socket per box. Also, Windows Server has charged per physical processor for the past several editions, instead of per core, so the $400 version would do. Now, if you wanna see sticker shock, ask to see what Oracle will charge to run on the box.

<comment><USER22> Server 2016 will be charging per core.

</comment></comment></comment><comment><USER23> We are trying out a few of Intel Xeon D 1520 machines as the primary servers for [https://Clara.io](https://Clara.io). They seem to be working fine at a low cost.

</comment><comment><USER24> >ahead of the Xeon E5 V3 series I'm confused (probably because I don't understand Intel Xeon). Isn't that Haswell, and thus now two generation back?

<comment><USER12> The Server chips are pretty much always a generation back, having a development cycle to try to fix any erratum that may have popped up, as well as to do work to rearrange cores, cache, add a good amount of IO, and ditch things like the onboard graphics.

Intel's supposed to be releasing the E5 v4s in the next few weeks, which will be Broadwell based. edit: These are also Broadwell based, supplanting the Haswells they released last year.

</comment></comment><comment><USER25> I wonder what the 'D' stands for, as the next earlier Intel CPU with 'D' in its model name was the Pentium D, where it meant "dual core".

<comment><USER26> It stands for "full employment for Intel's branding department". Calling it Xeon E4 would have been way too simple.</comment></comment>


Twitter's Dick Costolo Delivers on Change, but the Right Mix Remains Elusive - <AUTHOR> http://www.nytimes.com/2015/04/28/technology/twitters-dick-costolo-delivers-on-change-but-the-right-mix-remains-elusive.html

<comment><USER2> To anyone who has updated their twitter mobile client they recently got rid of discover and activity. Typically you would get to these screens by swiping left on the home screen. Activity was a straightforward summary of what your friends had favorited while discover was an algorithmic garble of mostly high followed accounts. I think removing the activity feed highlights the path that could seriously hurt twitter. Alienating their core users for the sake of either ads or new users. Anyone who uses and loves twitter knows how to use it and why its so powerful.

I'd propose doing something more radical for the onboarding process. Perhaps, they could show an almost random feed of tweets and rapidly update where the tweets are coming from by using a bayesian learning process. The point is you need to build your twitter from the ground up and not the top down.

</comment><comment><USER2> Oh I see my other comment got down-voted before it was even visible. Is this because I didn't sacrifice 2 Amiga 1000's to the Gods of HN. I am 2 minutes from being done with this site forever. Both the submission and the comments have devolved into something that no longer suits my intellect. Thanks for letting me have a chance to talk here.

<comment><USER3> Have some patience. Comments often receive a small flurry of reflexive downvotes right after posting. If it's a good comment it will receive upvotes eventually.

I upvoted your other comment because it was a fine opinion and didn't deserve to get pushed down. On the other hand, I downvoted the above comment because complaining about downvotes doesn't add anything of use to the discussion.

Everyone gets downvoted sometimes; it's not a big deal, just a few fake Internet points.

<comment><USER2> I wouldn't express my frustration like this if I didn't think the comment system on HN is completely broken. I have been on this site for many years. Just because I have never posted a runaway front page story doesn't mean I need to be censored and seek the approval of others.</comment></comment></comment>


Rails 3.2.13 - Performance regressions and major bugs - <AUTHOR> http://blog.bugsnag.com/2013/03/20/rails-3-2-13-performance-regressions-major-bugs/

<comment><USER2> Okay, some of these problems are (unintended) direct side effects of the security fix bugs.

Like I the one about scopes that effected Github -- github quoted [this commit]([https://github.com/rails/rails/commit/f980289fd2c1b9073a94b5...](https://github.com/rails/rails/commit/f980289fd2c1b9073a94b5d49b780a49f5e2933c#L1L23)) as introducing the bug, which is the commit meant to address CVE-2013-1854.

So, okay, bugs happen, even with security fixes, I can forgive bugs.

But others of those performance regressions... " handing that task to Sprockets instead of resolving internally, which seems to be the cause of the performance issues."

This doesn't sound like the unanticipated side effect of a security fix. This _sounds_ like an independent change they threw into the same patch release with four (four!) security patches.

Why is Rails putting security fixes and other non-security-related enhancements together in the same patch, so you can't get the security fixes without also getting the possibly buggy new features/refactors? Does Rails actually do this by policy? Was it a mistake?

Bugs happen, including bugs in security fixes, sure. But it's BECAUSE bugs will happen that you don't throw unrelated new features or refactors into the same patch release as a security patch, so the only way to get the security patch is to risk MORE problems from the other stuff too! Come on!

<comment><USER3> This is a weird comparison, but they should adopt the same release policies as Drupal. Security releases are done separate from maintenance releases, even if they are released at the same time.

That allows you to provide the security releases as a separate patch file so you can apply individually. You can skip maintenance releases that cause problems but still keep things secure.

<comment><USER4> Here's a pointer to the security fixes in the release as a monkeypatch to 3.2.12, without any of the other cruft:

[https://github.com/discourse/discourse/blob/master/lib/freed...](https://github.com/discourse/discourse/blob/master/lib/freedom_patches/rails_security_fixes.rb)

The discourse folks who threw this together have an app (Rails-based forum software) that was hit very hard by the performance regressions.

</comment></comment></comment><comment><USER5> At this point I'm seriously considering dropping Rails as my framework of choice and reverting back to ASP.Net MVC.

Why?

1\. Security fixes are released very quickly (good thing), but more often then not they break existing code (bad thing) - and while you _can_ wait for the next patch to fix those break points, you're left wide open since everybody can see what was broken and how to exploit it.

2\. I'm not nearly smart enough with Ruby to apply 'band-aids' I read people write in Rails source code. I just don't have the time and energy to fix code in the actual framework when I need to be fixing _my_ code.

</comment><comment>

So there you have it; I'm bailing.

It was a fantastic ride, Ruby is a beautiful language, but Rails is just a clusterfuck (_for me_).

I need stability and predictable behavior. If that means releases every 6 month to 1 year, so be it.

So long and thanks for all the gems.

<comment><USER6> I've been running Java and Rails since 2006 in my company (large), we use C# for a small number of desktop applications.

This will come out harsh, but I'm being honest: If you are not willing to fix/adapt/improve the framework you are using, you better not be using ASP.NET also (try a google search on asp.net issues), or any framework at all. In fact, developing larger more complex software might not even be possible without adapting frameworks for your specific problems.

That said, our run so far with Rails and Java (we are still using 2.3!!!):

\- We have 38 patches applied to Spring

\- 4 patches in apache santuario.

\- One security patch on Grizzly (glassfish)

\- Rails: One single pull request <https://github.com/rails/arel/pull/174>

<comment><USER7> It's really nice being able to trace into the guts of hibernate, spring, etc to see what the heck is actually going on and fix it if it's broken. When I used to do Microsoft stuff, I'd run into bugs in the stack that I couldn't fix. This was enormously frustrating and time wasting. The typical advice given out by support was re-install or buy the latest upgrade. There were also a lot of deliberately imposed architectural limitations to prevent you from working around lack of "enterprise" features in the basic versions which were incredibly frustrating and the enterprise version pricing was astronomical.

<comment><USER8> The open-source situation at Microsoft has really improved. Source is available for a lot of their web stack, contributions are accepted, and there are some nice open-source frameworks (like Nancy, MIT-licensed, inspired by Sinatra) that run on IIS or another Owin-compatible server these days.

I generally prefer Ruby-based things myself - this post isn't trying to sway anybody to the MS side; just wanted to give a bit of credit where it's due and perhaps a bit of news to those who haven't looked over onto that side of the fence in a long time.

</comment></comment></comment></comment><comment><USER9> I disagree with the final statement of this, that a "security only" release would have somehow helped the situation. I feel like part of the problem is that things are being merged into 3-2-stable and nobody is using them because they're never put into a release.

3.2.11 and 3.2.12 were both security-only releases, and so fixes and patches that were not security-related have just been piling up for the longest time.

Seems like a "release often" mindset might be better and might ensure that things are actually being used. Sure, I know someone is going to blast me saying that bugs like this shouldn't make it into 3-2-stable at all, and since this is Hacker News so whoever says that knows they're ten times the developer that everyone on the Rails core team is. But the reality is that bugs make it into stable branches, and almost nobody is running against the stable branch (Rails core people are probably mostly running against the 4.0 branch, everyone else is running against the latest release).

<comment><USER10> Actually 3.2.12 also added some sort of silly (and broken) patch related to quoting numeric values in ActiveRecord. The primary thing I want out of 3.2.13 is reverting this.

To your more general point, while I don't disagree with your diagnosis of things piling up in stable, I'm also not a big fan of your proposed solution. It looks to me like 3-2-stable is getting filled with a lot of stuff that just should not there; increasing the release frequency is not going to solve this problem.

</comment></comment><comment><USER11> I think the only mistake made with this patch release was merging in 250+ commits, ranging from last year to the present day. Maybe that's standard for such a large project, but it feels like a hell of a lot of tweaks for a minor release.

As for the rest - I think the issues in January has put Rails in the spotlight, and while scrutiny is certainly warranted, I think the extra pressure on the project over the past months to clear this stuff up has had its consequences.

<comment><USER12> I think the problem is that they do too many patch releases and not enough minor releases. This could easily have been a minor.

</comment></comment><comment><USER13> 296 commits for a security patch is silly; What the shit tenderlove.

<comment><USER14> Seriously. Usually Rails feels like riding in an Uber, but this release felt like Crazy Taxi.

</comment></comment><comment><USER15> Not happy? Do something about it: try release candidates, report bugs, and help triage and fix reported bugs.

<comment><USER16> I completely agree with this. We (bugsnag) are running on rails 4 beta right now to help iron out any production issues before that is released.

We didn't, however, realize that "patch" releases also have release candidates. I'd recommend following the rails blog (<http://weblog.rubyonrails.org/>) which announces release candidate builds too.

<comment><USER15> You can also subscribe to the rails-core mailing list, all betas, RC and full releases get announced there.

<comment><USER17> There's quite a bit more discussions on rails-core apart from RC and releases, so subscribing to the blog is a good idea if your time is limited :-)

</comment></comment></comment></comment><comment><USER18> As someone who is relatively new to Rails can someone explain to me why it seems to update more than anything else I've used?

<comment><USER19> Mostly to give people on forums something to bitch about.

Serious answer: a few months ago, some serious vulnerabilities were found in Rails. This apparently had a "blood in the water" effect on security people, who started dissecting the entire thing. Predictably, more vulnerabilities have emerged and rapidly been fixed.

All in all, it means that things are improving because it's getting a ton of attention.

<comment><USER20> This. I think the rapid release cycle of Rails is a good thing, rather than a bad thing. The past few months, some serious vulnerabilities were found in Rails, and I guess this made the Rails core team a little anxious.

One might argue that these performance regressions are unacceptable, and they are. I agree. Still, Rails is relatively young framework and these things happen. I expect any framework that is widely used will see some serious vulnerabilities in the next few months/years.

By the way, a good explanation of what these past Rails security issues mean is explained on patio11's blog ([http://www.kalzumeus.com/2013/01/31/what-the- rails-security-...](http://www.kalzumeus.com/2013/01/31/what-the-rails- security-issue-means-for-your-startup/)).

OT: I'm also writing a book on upgrading your Rails 3 app to Rails 4. With these rapid releases, a lot of things change and it's not always clear what has changed or what is new. Feel free to check it out at <http://upgradetorails4.com/>.

</comment></comment></comment><comment><USER21> You know when you're already having performance issues on Heroku having a performance regression is not fun.

<comment><USER22> How is this

> […] handing that task to Sprockets instead of resolving internally […]

even remotely related to performance issues because of random routing? You're mixing two issues that have nothing in common.

<comment><USER23> 1) Grandparent has performance problems on Heroku.

2) The Rails release has performance regressions (i.e. in at least some scenarios is slower).

In situation (1) you don't want to add further slowdown so (2) is a bad thing.

Grandparent doesn't even blame his Heroku performance problems on the routing issue (although it is a plausible guess). Actually effect of the routing problem can be significantly worsened if even a subset of requests are slowed down.

<comment><USER22> I'm under the impression that the Sprockets regression should not affect you in production, because your assets are precompiled.

Is that not the case?

<comment><USER23> To be honest I don't know and I wouldn't have negatively responded to a comment indicating that or questioning it. However reading the article it sounds like it is an issue resolving asset paths so may affect you even when assets are precompiled.

 _Performance Regressions

There are performance regressions in 3.2.13 for both view loading and asset loading. Rails 3.2.13 changed the way assets paths are resolved, handing that task to Sprockets instead of resolving internally, which seems to be the cause of the performance issues._

<comment><USER24> Actually, the performance degradation to the precompiled assets is minimal - for a typical production environment it only effects your asset compiling time as the assets are served statically from your public directory.

</comment></comment></comment></comment></comment></comment><comment><USER25> There's been a few people suggesting that, if you are bitten by a bug, you fix it and submit a pull request. That's a good idea. I did exactly this to a regression introduced in 3.2.9, complete with a unit test and a pull request against 3-2-stable and one against master. It took two months to get anyone to look at it, and while one of the two pull requests has a thumbs-up, it's still not been merged. Admittedly, this isn't a security issue as far as I can see, but still.

<comment><USER26> I personally read every single issue and comment filed against rails/rails. I often don't comment if it's not a part of the codebase I'm not familiar with, and it's the same with merging.

Can you point me to the specific ones so I can look at them again?

<comment><USER25> Yeah, tvongaza is correct. Admittedly, it's not a _big_ issue, and perhaps I'm going about things the wrong way. If you could tell me a better way of getting this issue fixed, I'd love to hear it. The only other time I tried, it took more than two years. Luckily, it was pretty easy to monkey-patch our own code to deal with this, once it broke our live site.

<comment><USER26> Other than tenderlove and (sort of) myself, nobody is paid to work on Rails. This means that it's an entirely volunteer effort, and people's lives are busy, so sometimes, tickets take a while to merge. I try to stay on top of it actively and thing still sometimes slip through the cracks for me. It's not that you're going about it the wrong way, it's that projects with ~200 open pulls are slow to merge, sometimes. Sorry it's taking so long with this one. :/

I'll bump this up in my personal list; I should really learn AR better anyway.

</comment></comment></comment></comment><comment><USER27> Since when do Rails developers worry about performance?

</comment><comment><USER28> I'm sure that Rails is great and powers many websites and that many devs loves it.

I'm also sure that people are working hard to fix these recent security issues and perfs issues.

But as a non-Rails dev I can tell you one thing: with all the attention that Rails got lately I'm sure I'll _never_ be learning Ruby / Rails.

I'm into Clojure right now. Next target is Go.

Sadly all these Rails exploits _do_ have a negative effect for Rails: I'm not saying this to criticize Rails. I'm saying this because I'm honestly 100% sure I'll never ever be doing anything serious with Rails and I know I'm not the only one in this case.

So, Rails devs, fix this and fix this rather sooner than later because every exploit is missed opportunities.

<comment><USER29> I don't write Ruby either right now, but I would suggest you not discount it as a nice language because of your perceptions of Rails.</comment></comment>


Book Summary: Atomic Habits by James Clear - <AUTHOR> https://durmonski.com/book-summaries/atomic-habits/ <comment><USER2> _Lesson #2: How Habits Work : Cue, craving, response, reward_ Is pretty similar with Charles Duhigg's The Power of Habbit, does this book have connection?

<comment><USER3> That book is referenced directly. Instead of a whole book about it this book spends barely a chapter.</comment></comment>


Disney Research's 3D Coloring Book - <AUTHOR> http://www.fastcodesign.com/3051895/disneys-crazy-new-tech-brings-coloring-books-to-life <comment><USER2> I actually hate for my kids to do ANY coloring books. A blank page is always better. Give them crayons, pencils and markers. Throw in scissors, tape and glue.

It is against Head Start policy to give children coloring pages. There is quit a bit of research for this approach.

PDF Document on why coloring is not best practice with children. [http://elf2.library.ca.gov/training/docs/WhatsWrongwithColor...](http://elf2.library.ca.gov/training/docs/WhatsWrongwithColoringBooks.pdf)

<comment><USER3> Not intending this to sound snarky, but only on HN could I expect to read the phrases "best practice" and "children" in the same sentence.

<comment><USER4> What? Why?

<comment><USER3> Just a humorous image I have in my head of a bunch of programmers with kids running around trying to apply "best practices" to everything in their households. Spouses, kids, not even the pets are safe from an agile methodology and microservices.

<comment><USER5> While I don't immediately associate 'best practices' with 'agile methodology' and 'microservices' (although I can see how recent articles on HN might strengthen that association), I have noticed that the busier I am with programming, and the more 'best practices' and 'optimization' and 'DRY' are on my mind, the more it seems to seep into the rest of my life. I start timing my bicycle commute and optimizing my route to avoid traffic lights or catch green waves, I try to do the dishes at optimal speed, I make sure that every 'trip' to a place in the house is as efficient as possible (take something one way, another thing on the way back, etc.).

I'm not sure it's healthy, but at least it's... odd/funny.

</comment></comment></comment></comment></comment><comment><USER6> This does look really good, but part of me feels a slight tinge of sadness that it's introducing yet more screen time to kids' play time.

<comment><USER7> > yet more screen time to kids' play time

Screen time itself isn't a bad thing, it's what you do with it. If your kid is sitting there watching YouTube or other videos, that's passive, and not that great. But there are some really excellent, interactive, educational apps out there for kids, especially on tablets.

</comment></comment><comment><USER8> Also posted under: [https://news.ycombinator.com/item?id=10339584](https://news.ycombinator.com/item?id=10339584)

Actual publication: [http://www.disneyresearch.com/wp-content/uploads/Live- Textur...](http://www.disneyresearch.com/wp-content/uploads/Live-Texturing-of- Augmented-Reality-Characters-from-Colored-Drawings-Paper.pdf)

The interesting part of the research (and what the paper focuses on) is how to take a generally front facing view as seen in a coloring book and apply the coloring scheme for that view to a 3d model. The examples in the paper really point out the difference between how a human would extend the scheme to the back of the model with how various algorithms will. The presented research does a good job extending the texture to the back of a humanoid model.

<comment><USER9> Imagine an app that allows you to buy a 3D toy painted as the child's drawing. Based on parents I know, it would sell well.

</comment></comment><comment><USER10> Disney has a lot of interesting research projects but none actually get turned into products :(

<comment><USER11> They most likely turn into Disneyland attractions and other gimmicks that are only available there.

</comment></comment><comment><USER2> Can't find anywhere on Google right now BUT HP Sprout Computer does this at Crayola Factory in Easton, PA. You make your drawing and than place it on the matt and the computer makes a 3D image of your drawing. It could easily be done in real time instead.

[https://sprout.hp.com/us/en/](https://sprout.hp.com/us/en/)

</comment><comment><USER12> This is amazing. And not just for kids! :)

</comment><comment><USER13> This looks like the "colAR Mix" app for the iphone, which has been out for at least a year I think. Nifty technology, but my kids didn't find it very engaging.

</comment><comment><USER14> i'll download that for sure -> if it's ever available.

</comment><comment><USER15> That's extremely neat, but I'm not sure it adds much to the experience!</comment>


Fighting for Open Source Sustainability: Introducing Code Sponsor - <AUTHOR> https://medium.com/@codesponsor/fighting-for-open-source-sustainability-introducing-code-sponsor-577e0ccca025 <comment><USER2> The authors are mistaken about the impact of employer-paid open source. It is orders of magnitude bigger than anything else, and it has a decades-long history of success in projects like Linux.

Companies aren't doing it out of charity and don't see it as such. They see (correctly) that it's easier to get what they want by paying some people to work on an open source project than to start from scratch and pay for 100% of the cost.

I'm all in favor of more models, but until you're channeling many tens of millions of dollars per year, your impact is much smaller than employer sponsored open source.

<comment><AUTHOR> This is great feedback. Thank you.

</comment></comment><comment><USER3> Full disclosure: I'm a long time sponsor ([https://rollbar.com/](https://rollbar.com/)) and supporter of Code Sponsor. It's a fantastic resource for the Open Source community, notably the smaller, independent projects. Supporting OS sustainability while generating awareness for Rollbar was a total no-brainer decision. The transparency in the system between sponsor and project owner is exceptional. They've built an interesting, novel solution to help ease any burden felt, maintaining and growing a project. Bravo!

</comment><comment><USER4> Maybe I'm missing something, but I couldn't find a source for their claim that "Two-thirds of the top OSS projects are maintained by one or two people".

How many projects? How are they rated "top"? When you make such a bold claim, you should be able to back it up with verifiable sources IMHO.

Also, being a Red Hatter that has welcomed thousands of people in our New Hire Orientations, I dare say that we actually do employ quite some developers that continue their good work in a lot of communities. Describing that as "the 1% approach" feels a bit wrong.

<comment><AUTHOR> This data comes from a talk given by Nadia Engbhal entitled "Consider the Maintainer". This data originally comes from here: [https://github.com/aserg- ufmg/Truck-Factor/blob/master/READM...](https://github.com/aserg-ufmg/Truck- Factor/blob/master/README.md)

<comment><USER4> Thanks. Found the slides. But they also don't give any link to rating criteria or a list of projects.

[https://www.slideshare.net/NadiaEghbal/consider-the- maintain...](https://www.slideshare.net/NadiaEghbal/consider-the-maintainer)

</comment></comment></comment><comment><USER5> > _"... while part goes to maintaining Code Sponsor itself."_

If their intentions are "pure" and their primary purpose really is to help open-source developers, they should either be a non-profit and/or completely open and honest and publish the sizes of each "part". Preferably, that would look (at minimum) something like:

      October 2017

      Income from sponsors:  $ x
      Paid to developers:    $ y
                             -----
      Kept by CodeSponsor:   $ z

Where z == x - y, of course.

<comment><AUTHOR>
      October 2017

      Income from sponsors:  $ 7,437.20
      Paid to developers:    $ 3,413.20
                             -----
      Kept by CodeSponsor:   $ 4,024.00

This does not take into account the $6,000 we spent to become a sponsor for Github Universe.

<comment><USER6> With those numbers, you kept about 54% of October's income.

So how is that split determined? That is, is it a fairly flat overhead so if the income had been $100,000, you still would have kept ~$4000? Or are you taking a percentage and it would have been ~$54,000?

<comment><AUTHOR> For example, the sponsor pays $1,000 for 1 month of sponsorship. The developers gets 40% of that ($400). The remainder ($600) goes into building Code Sponsor.

Understand that this has been a side project since day one. I have not taken any distributions at all.

The split used to be 50/50, however I could not sustain myself with that split and still keep the CPA low for our sponsors. We are now setting a minimum CPC for all new sponsors to $1.50+. This means that the developer will get $0.60/click.

Finally, part of the 60% goes into the server costs and fraud prevention. We run every click through vigorous fraud detection prior to marking it as "payable". By doing so, we provide much higher quality clicks to the sponsors. This makes them scale their funds. Remember, we are working with marketing funds, not sponsorship funds.

<comment><USER6> Thank you for answering. I think it's perfectly reasonable at the current income level, since if that's a typical month's income it would mean that you're still only taking in about $50k/year, which is difficult to do much with.

However, if you're intending to keep that split as revenue increases, I think it conflicts with the way you're framing the company in places like the linked post and the Code Sponsor homepage. Stating a mission like "fighting for open source sustainability" and remarks like "Why do we do it? Basically, we want to help" don't mesh with the fact that your company alone keeps more of the money than you pass on to _all of the projects combined_.

I recognize that Code Sponsor isn't a charity/nonprofit, but it feels like you're trying to give the impression that it's a similar sort of values/mission-based organization. So it's not a fair comparison, but as a point of reference, Charity Navigator would give a financial score of zero to an organization that only used 40% of their funds for their "purpose", and they'd be solidly in the bottom 10% ([https://www.charitynavigator.org/index.cfm?bay=content.view&...](https://www.charitynavigator.org/index.cfm?bay=content.view&cpid=48#PerformanceMetricOne)).

Overall, your take doesn't seem to be out of the ordinary for advertising. The World Advertising Federation says that 60% of advertising cost is taken by various companies that an ad passes through before it's actually displayed ([https://3.bp.blogspot.com/-AkjTy8a6FJ8/WGqb2nGR0pI/AAAAAAAAF...](https://3.bp.blogspot.com/-AkjTy8a6FJ8/WGqb2nGR0pI/AAAAAAAAFrw/SONAI8rbvxc5RnJPasRzfSIp8_5IpCpOwCLcB/s1600/Chart.png)), but those companies certainly don't try to describe themselves as philanthropic ones.

I hope I don't come off as too negative. I think it's great that you're working on improving the current situation of open-source sustainability, which really is a major issue. But I hope that if your income reaches the point where Code Sponsor is sustainable (which certainly includes paying yourself), you consider adjusting the split so that more funds are given to the projects you want to help, instead of just keeping it as profit.

<comment><AUTHOR> Hi Diemorz,

I'm very glad for your comment. This is something that I can honestly say I have not considered. My biggest fears were 1) making sure that the whole idea isn't rejected by the developer community and 2) making sure I have enough money in place to give to developers.

I started off initially by doing a 50/50 split with developers. I also started by charging $1/click to sponsors. I quickly realized that it would take a very long time before I could get enough sponsors and developers to support myself full time. Because of this, I dropped the distributions to 60/40\. It still is not making much money at all. Code Sponsor may take 60%, but I take 0%.

Now in the future, if it does continue to grow at a healthy rate and if Github will allow us to sustain OSS through README's, then I would definitely consider a more developer-sided split.

All I want is to help sustain OSS and do it as a living.

<comment><USER7> Thanks for your openness about the finances, and thanks for building something to address this issue, whatever the difficulties and drawbacks are.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I've been using Code Sponsor for a month or two now.

The best way to describe it is something between a generic Google Ads network and a invite-only Carbon Ads network. And it's really meant to go in your README.md file.

So this results in a few things:

1\. Broker. Sponsors can select which repos/languages/tech/etc they want to advertise to and developers can select which sponsors are relevant to them.

2\. Transparent. Developers can see which ads a sponsor will display and how much they pay per click (usually $0.40). The ads are usually just text with a couple emoji that fit well into the README.md design and are loaded as an svg.

3\. Limited. Sponsors pay a fixed amount so if a repo is really popular and displaying ads, it may stop displaying after the money is paid out to the developers. This means you may just get a generic ad that recommends using Code Sponsor near the end of the month, like this repo: [https://github.com/styfle/geoslack](https://github.com/styfle/geoslack)

Caveats: it seems the Code Sponsor is not open source :(

</comment><comment><USER9> After reading the article, I _think_ this is an advertising network for oss project owners. Not a bad idea except why aren't existing ad networks meeting this need? And...if most of the pages displaying these ads are served by GitHub, isn't this stealing money GitHub has deliberately left on the table, and won't they be upset by that and hence take action? Perhaps the plan is to succeed so quickly that GitHub buys them?

<comment><USER10> > why aren't existing ad networks meeting this need

Because most ad networks are data-gathering scum, and developers know this, thus avoid them at all costs.

This company is at least _promising_ not to track the ads, and only provide basic and relevant conversion data to advertisers. This is a big difference that would mean at least I would be willing to give them a try.

<comment><AUTHOR> Owner here. I agree 100%. From day one I have been promised to never do any tracking or remarketing. I don't sell data. I have followed the Ethically advertising guidelines established by Read the Docs. If you are a developer on the platform, you know to the second what your payout is. If you are a sponsor, you know to the second how much you owe.

</comment></comment></comment><comment><USER11> I'm a big fan of Code Sponsor! Eric who created Code Sponsor is passionate about his project and surely at your disposal for any query.

If you have a project with more than 100 stars, try it, you'll really appreciate the transparency and the personalization of the ads you can have. Long life to Code Sponsor!

</comment><comment><USER12> Does anybody know what the click / view ratio is like on small projects? I know it depends on a lot of things but I really have no idea at all... Would it be below one percent or more around five, or something different?

<comment><AUTHOR> Depending on the project, we have seen between 0.4 - 1.2% click rate on average.

<comment><USER12> Thank you both for your replies!

</comment></comment></comment><comment><USER13> Another upvote for Code Sponsor! Been using it for almost a month or so, and it's pretty awesome.

Styfle already describes it very well, so I'm just gonna add that although I'm seeing a very shaky impression/click rate, and my clicks are below what I expected to receive, the payout is quite big for an ad/sponsor network like this. Also, it's much better than ad networks - no detailed tracking and more (listed below by cavneb)!

</comment><comment><USER14> Unfortunately, it's limited to projects with 100+ stars. Cool idea though.

<comment><USER13> It didn't used to be limited, but I believe it's because of frauds and scams. Maybe if you contact cavneb he can work something out?

</comment></comment><comment><USER15> I totally love code sponsor

<comment><AUTHOR> Thank you, Kent! Your OSS efforts deserve to be funded!</comment></comment>


EasyLambda – parallel data processing with modern C++ - <AUTHOR> https://github.com/haptork/easylambda <comment><USER2> Using line breaks between member function calls is an interesting syntax style I haven't seen before:

ezl::rise(readFile<string> (argv[1]).rowSeparator('s').colSeparator(""))

        .reduce<1>(ezl::count(), 0).dump()

        .run();

<comment><USER3> It's very common when chaining lots of operations, each of which transforms the result of the previous one (functional style). I've seen tons of Scala code do it. Writing it all in one line would be quite the unreadable mess.

<comment><USER4> Yeah, it's pretty common with code that uses the builder pattern as well. I also like to use it with rust combinators e.g. [https://github.com/skeuomorf/conshash/blob/master/src/lib.rs...](https://github.com/skeuomorf/conshash/blob/master/src/lib.rs#L90)

</comment></comment></comment><comment><USER5> How does this differ from Threading Building Blocks ? [https://www.threadingbuildingblocks.org/](https://www.threadingbuildingblocks.org/)

<comment><USER6> One can still use TBB inside the functions to make use of it alongside getting MPI parallelism from easyLambda.

Moreover, easyLambda has data flows, map, reduce which in a way improves the way programs are written and composed. There are no classes to be declared for anything. It has many syntactic sugars, for column selection, control over parallelism, i/o etc. I personally like the style of coding in it for various problems, keeping parallelism aside.

<comment><USER7> Since it supports distributed computation does it have any abstraction for dealing with failures, for example, network problems etc. Support for checkpointing or some other abstraction that deals with these kinds of errors would be very useful. In fact absolutely essential for anything of non-trivial scale.

BTW not complaining, far, far from it, just a useful feature addition you may consider in case you have the bandwidth to invest.

<comment><USER6> Yeah, you are right, fault tolerance is a needed feature. Although, I'm not pretty sure if that needs to be added to easyLambda itself. Since, MPI 3.0 is expected to support fault tolerance by default. But instead of waiting for MPI 3.0 fault tolerance support, I'm thinking of running it on top of HPX or some other system that provides good runtime support on top of MPI. Also, since most of parallelism scheme is confined to MPIBridge which is just a unit in the flow, these different implementations can coexist.

</comment></comment></comment></comment><comment><USER8> So this is a bunch of constructs for creating function-pointers and the like which then would be sent to mpi or other parallel libraries to do the actual interfacing with the parallel mechanism.

Any idea how this would work with (random stuff I'm thinking about) Cuda or Tensorflow?

<comment><USER6> Thanks for your interest. There are indeed no function pointers, no void pointers, no preprocessor hacks, no wild type-casting involved anywhere in the library. This is completely compile time type-safe. Still, the kind of things you can do would be a far cry for all the hacks with those shoddy pointers. There are a lot of features like column manipulation, passing vector of a values for multiple rows and just a value for a single row etc. that make composability and ease of use way better. All of these features are implemented using template meta programming and traits available in modern C++. The language has become quite impressive from what we used to think of. You must check it out.

A map/reduce/rise take a template parameter which can be of any class type and library has nothing to do what a function object or function does in the function body. The function just need to take in the arguments that the prior unit passes it and return something. I don't think there will be any problem if one uses any other library to perform computation inside a function, even if some library does not work out of the box, I'm pretty positive it can be done with little tinkering. I hope this makes things clear.

<comment><USER8> Thanks for the reply!

I'm probably not as up on the most modern c++ approaches as I should be but I'm quite interested. I have downloaded the code and I'm looking through it.

Basically, it uses template metaprogramming to go from the higher-level map/reduce/rise semantics to lower level for-loops and calls.

Beyond the particulars, the question/challenge I'd have would be - "how would you use this dynamically generate map/reduce/rise calls?"

<comment><USER6> If you can give some idea of the client code / API that you are expecting, I might be able to give some view on that.</comment></comment></comment></comment>


Startups, it's Time to Stop Calling Yourselves That - <AUTHOR> http://mashable.com/2008/10/10/startups-crisis/

<comment><USER2> This is nonsense. In any economy, most companies don't make money when they're first starting. Even pizza places. That doesn't make them "projects" rather than companies.

</comment><comment><USER3> Here's the message I take from this: get serious or go home.

After reading the first couple of lines I didn't want to like this article (I'm getting a little tired of everyone whining about how hard it will be -- it was always going to be hard), but a little later in I grooved on it.

Starting a startup isn't just about putting up a website; you've got to kick ass 8 days a week building a business, and yeah, it's going to be harder now so it's a good time to start taking what you're doing seriously or realize that you're just playing around.

</comment><comment><USER4> Don't worry yourself with the semantics; this is extremely sound advice. VCs are starting to say roughly the same thing nowadays too, albeit in a way with somewhat less finality. It's a shame it took a huge economic hoo-ha for people to start using common sense again, though.

<comment><USER5> I thought most VCs refer to start-ups/companies as "deals" ;)

I'd much rather be called a "deal" than a "project" -- the former implies that someone's investing in your start-up; the latter is just demeaning.

<comment><USER4> I don't really agree that a "project" is demeaning, if the person creating that project properly recognizes it as such. Some things are businesses, some aren't. I've worked on tons of "projects" in the past which had no real business potential yet were still very fun and rewarding.

</comment></comment></comment><comment><USER6> Uhm.. What? Someone can't call themselves a startup when they take all the risk of actually, err you know, starting something up? Taking the risk, forgoing income and pursuing their passion?

<comment><USER7> I think the point is more that starting up a traditional business involves much higher costs, effort and risks versus setting up some website or web- service, which pretty much any Joe Schmuck can do these days.

And I completely agree with him. I realize I might be pissing against the wind, with the "startup"-focus on hacker news and all, but lots of these so- called startups I see here, I would consider spare-time hobby _projects_ , and even if they find a way to capitalize on them, I still wouldn't call it a full business.

If your business can be summarized as a server, located in some data-center somewhere, working out the stuff on its own, calling it a full fledged _business_ is a bit over the top no matter how much time you spent writing the initial code.

<comment><USER6> OH MY GOD. Are you really gonna have to force me to list some of the largest cap NASDAQ companies that "can be summarized as a server, located in some data-center somewhere, working out the stuff on its own"

Really? I mean christ, I'm trying to boost my chances of getting YC funding here and you're forcing me to sound like a petulant teenager. Let's all get on the same page here.</comment></comment></comment>


Ex-Canadian Diplomat Michael Kovrig Detained in China - <AUTHOR> https://www.cbc.ca/news/politics/kovrig-detained-china-tuesday-1.4940725 <comment><USER2> And so it begins. I guess this is what they meant when they said that Canada would "pay a heavy price" [0].

[0]: [https://www.theglobeandmail.com/canada/article-canada- will-p...](https://www.theglobeandmail.com/canada/article-canada-will-pay-a- heavy-price-china-warns-in-new-stance-over-huawei/)

<comment><USER3> This is a small price, just a warning shot. Think of Canadian NGOs, businesses in China, multi-billion $$ contracts etc etc.

Huawei is China's line in the sand and we are living in interesting times. (This is just business, USA would also send the equivalent of aircraft carriers for AAPL, Intel etc.)

</comment></comment><comment><USER4> > The exact reason for the detention was not immediately clear

Without that information, this story is meaningless. He could have done something very bad that justifies his detention. If China refused to explain why he is detained, that's another story.

<comment><USER5> I think that China doesn't really deserve the benefit of the doubt anymore. They'll probably make up some bullshit excuse and why they detained the man, but it'll be clear to everyone it's retaliation for the Huawei thing.

<comment><USER6> It's not like the US or other Western countries arrested someone and then found a reason to make it stick. Nations are very much alike here. I think the core problem that was tried to address is the mentality of "China did it, so it must be with bad intent".

<comment><USER5> > China did it, so it must be with bad intent

Yes, this is called 'pattern recognition'.

<comment><USER7> And inference by pattern recognition is fallacious, as any Poisson distribution will demonstrate.

</comment></comment></comment></comment></comment><comment><USER8> Trade war is taking prisoners now.</comment>


The Acid3 Test (2008) - <AUTHOR> http://acid3.acidtests.org/ <comment><USER2> "Acid3, in particular, contains some controversial tests and no longer reflects the consensus of the Web standards it purports to test, especially when it comes to issues affecting mobile browsers. The tests remain available for historical purposes and for use by browser vendors. It would be inappropriate, however, to use them as part of a certification process, especially for mobile browsers."

[http://www.acidtests.org/](http://www.acidtests.org/)

</comment><comment><USER3> For people who don't follow modern web standards, a modern web browser getting 100/100 is actually failing tests. You should get 97/100, failing tests 23, 25, and 35.

The site itself is no longer maintained and updated to reflect changes to standards.

<comment><USER4> care to explain why?

<comment><USER3> If you're asking specifically why the test isn't being maintained, I can somewhat speak to that.

The first Acid test was a relatively simple test that could visually demonstrate if browsers implemented CSS. When IE became the dominant browser, Microsoft essentially stopped all development on IE. At the time, IE had a very broken implementation of CSS (although, it should be noted, IE6 was the best implementation of CSS _when it came out_ , as everybody else was just as bad). The Acid2 test was created in large measure specifically to goad IE into improving its standard compliance (mostly on CSS). As a result of the publicity of the Acid2 test, the other browsers fixed their engines to pass Acid2, which put pressure on IE to fix their engine.

Since it had been effective in pushing browsers to implement the CSS2 standard correctly, the author turned to creating Acid3 to push browsers to implement more technologies. Whereas Acid1 and Acid2 were largely about CSS layout, Acid3 focuses more on testing JS API implementations. Acid3 was heavily criticized for letting browsers score well just by having a very thin, minimal surface implementation of the feature instead of testing thorough correctness, as well as for being very opinionated in pushing browsers to implement specific technologies (SVG fonts being the big one).

By the time Acid3 came out, there was already a change in the development of web browsers. Microsoft was once again participating in the standards compliance process and trying to drive their browser to modern compliance, so all of the major browser vendors were very active in discussion about implementation. Also, the W3C changed its specification process to rely more heavily on having a thorough compliance testsuite that had two passing independent implementations before a standard could be considered finalized. The CSS2.1 testsuite wasn't complete at the time these tests were developed, but has now come out, with almost 10,000 individual tests in them, far more thorough than any of the Acid tests could claim to be.

Since the Acid tests no longer had value in being the most comprehensive tests of their underlying functionality, nor in compelling browser developers to be competitive in standards support, their developer stopped working on the project. Indeed, since Acid3 fails at even being a comprehensive test for what it tests, its author publicly stated that he isn't interested in updating it when specifications update.

<comment><USER5> Do you know what changed regarding 23, 25, and 35, and why it was at the time considered correct to pass them, but now considered correct to fail them?

<comment><USER6> You can see details by loading the test page and then clicking on the 'A' of 'Acid3'.

<comment><USER7> That's not super helpful, for example 25 just says "wrong exception". The original commenter seemed to know exactly why these 3 specific tests were failing, I'm also curious what specific specs changed that are no longer true.

</comment></comment></comment></comment></comment></comment><comment><USER8> On my machine:

Chromium 71: 97%, blocks 2&3 silver, pauses at 24, 64.

Firefox Quantum 64: 97%, blocks 2&3 silver, pauses at 24, 64, 65.

From Wikipedia:

Bucket 2: DOM2 Core and DOM Events

Bucket 3: DOM2 Views, DOM 2 Style, CSS3 selectors and Media Queries

By April 2017, the updated specifications had diverged from the test such that the latest versions of Google Chrome and Mozilla Firefox no longer pass the test as written. Hickson acknowledges that some aspects of the test were controversial and has written that the test "no longer reflects the consensus of the Web standards it purports to test, especially when it comes to issues affecting mobile browsers."

<comment><USER9> As I recall, the Firefox of the time didn't pass Acid3, either, and there was a minor controversy over the fact they changed the test in a way that made it friendlier to Firefox:

[https://en.wikipedia.org/wiki/Acid3](https://en.wikipedia.org/wiki/Acid3)

> Initially, Firefox 4 scored 97/100, because it did not support SVG fonts. > Later, Firefox 4 scored 100/100, because the SVG font tests were removed > from Acid3.

> According to Mozilla employee Robert O'Callahan, Firefox did not support SVG > fonts because Mozilla considered WOFF a superior alternative to SVG > fonts.[29] Another Mozilla engineer, Boris Zbarsky, claimed that the subset > of the specification implemented in Webkit and Opera gives no benefits to > web authors or users over WOFF, and he asserted that implementing SVG Fonts > fully in a web browser is hard because it was "not designed with integration > with HTML in mind".[30]

</comment></comment><comment><USER10> Sounds like it is time for Acid4. After all, those test did a great job at showing browser incompatibilities.

<comment><USER11> There's html5test.com and css3test.com

<comment><USER12> The google bot scored 45% on css2test.com.

</comment></comment></comment><comment><USER13> Acid2 is currently not passing either in Chrome (71.0.3578.98). I'm surprised these never got turned into automated unit tests.

<comment><USER14> From Wikipedia: "The test fails when browsers become compliant with current CSS collapse and margin standards."

</comment></comment><comment><USER15> > Modern web browsers don't 71 pass the Acid3 test anymore

What does it mean by "71 pass"?

<comment><USER16> The test is scored out of 100, so presumably it means getting a 71+ score

<comment><USER17> My understanding with these kinds of tests is that the only passing grade is 100/100

</comment></comment></comment><comment><USER18> [http://acid3.acidtests.org/support-a.png](http://acid3.acidtests.org/support-a.png) is a resource that page attempts to load that 404's now. I'm guessing that's part of the reason it doesn't score 100%. Not the browser's fault.

<comment><USER19> It loads fine for me. Looks like this [https://imgur.com/a/lrTMBmE](https://imgur.com/a/lrTMBmE)

<comment><USER20> If you wget the file you'll see this:

\--2019-01-18 13:46:40-- [http://acid3.acidtests.org/support-a.png](http://acid3.acidtests.org/support-a.png)

Resolving acid3.acidtests.org (acid3.acidtests.org)... 22.214.171.124

Connecting to acid3.acidtests.org (acid3.acidtests.org)|188.8.131.52|:80... connected.

HTTP request sent, awaiting response... 404 Not Found

2019-01-18 13:46:40 ERROR 404: Not Found.

<comment><USER8> This is by design. By the specs, browsers should not display a favicon if the file 404s. But that file contains a valid favicon, so rendering it is a failure. [source: Wikipedia]

</comment></comment></comment></comment><comment><AUTHOR> I bumped into the acid3 test, and I noticed it didn't pass in Chrome anymore. Would anyone have any context as to why this is? It's a little bit odd to me that backwards compatibility was broken in at least 3 ways here.

<comment><USER3> Acid3 was not updated when people decided to change the specifications. There are 3 things that are known to fail. Two of them are related to one change (see [https://github.com/whatwg/dom/issues/319#issuecomment-296345...](https://github.com/whatwg/dom/issues/319#issuecomment-296345763) for details on that change). The third test is one where Acid3 mandates something that every browser did but was wrong per the specification, and it took several years for people to notice (see [https://bugzilla.mozilla.org/show_bug.cgi?id=1311329](https://bugzilla.mozilla.org/show_bug.cgi?id=1311329) for some more details).

The Acid3 test on that website is officially unmaintained: [https://lists.w3.org/Archives/Public/www- archive/2017Jul/000...](https://lists.w3.org/Archives/Public/www- archive/2017Jul/0003.html)

</comment></comment><comment><USER21> 98/100 in Safari for me.

</comment><comment><USER22> Fails the back button test.

</comment><comment><USER23> Chrome is still 97/100, but honestly that's a pretty old test and things have changed.

Someone remembers XHTML..?

<comment><USER17> Also getting 97 with Firefox.

<comment><AUTHOR> Safari is at 98, which I guess now means slightly worse.

</comment></comment></comment><comment><USER24> Has it really been 10+ years since the "acid" tests debuted? I can remember when these things were the height of the browser wars. I guess I should be glad that we don't really need them anymore.

</comment><comment><USER25> Latest Chrome: 97% IE 11: 100%

Acid3: FAIL

</comment><comment><USER26> Internet Explorer 11 .... 100/100 !!

<comment><USER27> Quirks or strict mode?

</comment></comment><comment><USER28> Current Safari Mobile gets 98/100

</comment><comment><USER29> 66/100 on Firefox and after a pause it shoots up to 96/100! 97/100 on Brave.

</comment><comment><USER30> Safari Version 12.0.2 (14606.3.4) 98/100

</comment><comment><USER31> Microsoft Edge gets 100/100</comment>


The surprising decline of entrepreneurship and innovation in the West - <AUTHOR> https://phys.org/news/2019-10-decline-entrepreneurship-west.html <comment><USER2> When I looked at the numbers and the measurements it was not necessary the case at all. For example, the author used the ratio of patents/GDP or number of new enterprises/total number of businesses as indicators for entrepreneurship, but who says there must be more patents when the GDP becomes larger? Or I can not see why the number of new enterprises should increase when the population remains relatively stable and the number of businesses is already big. They are the normal phenomenon of a mature economy and not necessary showing a decline in entrepreneurship and innovation.

</comment><comment><USER3> And of course there is the changing culture of the West - people are becoming more and more risk averse - any type of risk. That seeps into all kinds of activities. Could be affecting appetite for starting business too.

<comment><USER4> I think this is spot on. My parents came from nothing but through entrepreneurship became well-off. That said they would rather me join the military for 20 years then become an entrepreneur. Same with my peers throughout high school and college. Very few if any had ambition to venture into entrepreneurship.

Other possible factors: negative sentiment towards business, less hours available to focus on business because of social media and video games etc, higher barriers to entry(though the argument can be made for the opposite too)

</comment></comment><comment><USER5> Could this graph be relevant here? [https://m.imgur.com/a/UIck2qD](https://m.imgur.com/a/UIck2qD)

<comment><AUTHOR> A lack of entrepreneurship is reducing current generational wealth perhaps?

<comment><USER5> I'd say the opposite, lower generational average savings produces less entrepreneurship, as less people is capable of funding little adventures or have a bed to fall back to. If everyone needs to pitch from the ground to investors, starting a business becomes way more difficult.

It's only a guess, of course.</comment></comment></comment>


Cause of ALS is found, Northwestern team says - <AUTHOR> http://www.chicagotribune.com/news/local/ct-met-northwestern-als-breakthrough-20110822,0,6531848.story

<comment><USER2> My dad also died of ALS last year.

Identifying the cellular mechanisms underlying ALS is crucial. At the same time I'm disheartened by the conclusion of the researchers that this will pave the way to the development of drugs. Why is that always the first solution we turn to?

So ubiquilin2 is unable to repair damaged proteins in people with ALS. The question is, why?

I can't help but believe ALS is an autoimmune disease that is caused by the combination of genes and an environmental trigger. The fact that this possibility isn't even mentioned in the article suggests that we have a long way to go. Drugs, though helpful in some situations, are often merely band- aids. Let's find the trigger!

Still, this is progress. My dad donated his body to Northwestern for research so I can't help but be proud today.

<comment><USER3> > Why is that always the first solution we turn to?

First, I'm sorry for your loss. I did want to point out that there's no reason to believe that this is an either-or situation. Clearly research can progress in all directions now in a more focused manner: further understanding the cause of the mechanism identified, as well as attacking it directly.

<comment><USER2> Yes, I agree. If we can develop a drug, I'm all in favor of it and this certainly gets us closer to that goal. I'm simply arguing that the search for a wonder drug/magic bullet always seems to overshadow so called root causes.

Noticeably absent from the tribune article (have not yet read the Nature article) is any discussion of environmental triggers such as diet or lifestyle.

We often jump from disease to drug without considering the causal factors.

<comment><USER4> Figuring out and treating/resolving causal factors does not generate millions for pharmaceutical companies. Developing drugs does.

In particular, discovering environmental factors and trying to resolve those especially does not produce reliable revenue streams for pharmaceutical firms, and also rankles those with certain political assumptions.

<comment><USER5> Not really. The real problem is that many claimed environmental/diet factors turn out to be statistical noise or complete bullshit when examined further. If environment or diet plays a role then it is possible to discover how this triggers some latent element of the genome or some existing physiological process that gets subverted and from this discovery it is sometimes possible to interrupt the process. If a pharmaceutical company can develop a wonderpill that can be marketed with a basic message of "yes, we both know you are fat and do not have the willpower/desire to stop grazing 24x7 but if you take our pill we can block or delay the onset of type II diabetes" they will have a very reliable revenue stream to look forward to...

<comment><USER2> "Not really. The real problem is that many claimed environmental/diet factors turn out to be statistical noise or complete bullshit when examined further."

No doubt this is true, especially in the case of meat and saturated fat. Usually this is the result of bad science, typically drawing cause and effect conclusions from epidemiological evidence (See Denise Minger's critique of The China Study here: [http://rawfoodsos.com/2010/07/07/the-china-study-fact-or- fal...](http://rawfoodsos.com/2010/07/07/the-china-study-fact-or-fallac/)).

The problem with "interrupting the process" is that we still don't know much about the functioning of many (perhaps most) physiological processes. Disrupting the body's natural processes in one area can cause problems of equal or greater significance in other areas.

Also, studies proving the safety and effectiveness of drugs are, more often than not, highly flawed. Studies frequently exaggerate the improvements seen, fail to show that improvements are due to drugs, or are repeated until the results they are looking for are achieved.

For an excellent review of the flaws of medical research see Lies, Damned Lies, and Medical Science here: [http://www.theatlantic.com/magazine/archive/2010/11/lies- dam...](http://www.theatlantic.com/magazine/archive/2010/11/lies-damned-lies- and-medical-science/8269/?single_page=true)) Here are but a few highlights:

"...much of what biomedical researchers conclude in published studies—conclusions that doctors keep in mind when they prescribe antibiotics or blood-pressure medication, or when they advise us to consume more fiber or less meat, or when they recommend surgery for heart disease or back pain—is misleading, exaggerated, and often flat-out wrong. He charges that as much as 90 percent of the published medical information that doctors rely on is flawed."

"researchers were frequently manipulating data analyses, chasing career- advancing findings rather than good science, and even using the peer-review process—in which journals ask researchers to help decide which studies to publish—to suppress opposing views."

"even if a study managed to highlight a genuine health connection to some nutrient, you're unlikely to benefit much from taking more of it, because we consume thousands of nutrients that act together as a sort of network, and changing intake of just one of them is bound to cause ripples throughout the network that are far too complex for these studies to detect, and that may be as likely to harm you as help you."

"Even if changing that one factor does bring on the claimed improvement, there's still a good chance that it won't do you much good in the long run, because these studies rarely go on long enough to track the decades-long course of disease and ultimately death. Instead, they track easily measurable health "markers" such as cholesterol levels, blood pressure, and blood-sugar levels, and meta-experts have shown that changes in these markers often don't correlate as well with long-term health as we have been led to believe."

"The tests could turn up something, but they're probably irrelevant. Just having a good talk with the patient and getting a close history is much more likely to tell me what's wrong." Of course, the doctors have all been trained to order these tests, she notes, and doing so is a lot quicker than a long bedside chat. They're also trained to ply the patient with whatever drugs might help whack any errant test numbers back into line. What they're not trained to do is to go back and look at the research papers that helped make these drugs the standard of care. "When you look the papers up, you often find the drugs didn't even work better than a placebo."

I suppose I've strayed too far from the original topic, but I think I've made my point.

</comment></comment></comment></comment></comment></comment><comment><USER6> Here's the journal article in Nature: [http://www.nature.com/nature/journal/vaop/ncurrent/full/natu...](http://www.nature.com/nature/journal/vaop/ncurrent/full/nature10353.html)

</comment><comment><USER7> Just finished reading the article from Nature (thanks, warech). So, they're saying this ubiquilin 2 protein has a consistent mutation compared to the wild type, it's found in patients with ALS, it' found in intr-neural tangles, and they're hypothesizing that this protein may be involved in clearing misfolded proteins. Wouldn't it be at least as likely that it is one of the misfolded proteins targeted for clearing? I think the senior author, Seddique, is right: this gives them a good direction to go in. But it's still a long road.

Unfortunately, we don't have many good cures for these sorts of diseases yet. Enzyme replacement has worked to slow the progress of a couple of metabolic diseases (to the tune of tens of thousands of dollars per treatment), but I'm not aware of anything that can meaningfully clean the intracellular environment of built up detrius, especially in the central nervous system. That's a tall order. How would you do that? Intrathecal injections of a virus to splice in a functioning copy of the gene? Viruses are not well tolerated in the CNS, to my knowledge, eg, Herpes simplex encephalitis is lethal.

Best of luck on the quest though.

<comment><USER2> I wonder if intermittent fasting would be an effective deterrent of ALS through autophagy, though I highly doubt this would be of much good after the disease takes hold.

</comment></comment><comment><USER8> This is a link to the full text: [http://extremelongevity.net/wp- content/uploads/als_discovery...](http://extremelongevity.net/wp- content/uploads/als_discovery.pdf)

I'm hesitant to put too much hope in this discovery. I would expect a discovery of this magnitude to be published as a full article in Nature, rather than a Nature Letter. I'm not sure of the difference in the publishing process for the two, but Letters generally come across a bit rushed and are less exhaustive than published articles (citation needed).

<comment><USER9> The difference between letters and full articles is described here [1]. I don't think that one should view the length of the paper or whether it's published as a Letter or an article as a marker for its scientific importance.

For instance, The paper that Watson & Crick published that described the structure of DNA was only slightly longer than a single page [2].

[1] [http://www.nature.com/nature/authors/gta/2a_Manuscript_forma...](http://www.nature.com/nature/authors/gta/2a_Manuscript_formatting.pdf) [2] <http://www.nature.com/nature/dna50/watsoncrick.pdf>

</comment></comment><comment><USER10> If it turns out to be true, this guy deserves a Nobel Prize in medicine.

</comment><comment><USER11> For those who come to the comments before the article, ALS means amyotrophic lateral sclerosisis or Lou Gehrig's disease, and "is a paralytic and usually fatal disorder caused by motor-neuron degeneration in the brain and spinal cord".

</comment><comment><USER12> My mother died of ALS; this is encouraging news. Of course it's not a treatment, yet, but given that nothing else so far has really been effective, it's a promising discovery.

</comment><comment><USER13> As my dad died of familial ALS last year, thus this is fantastic news to me. And of all places, I learn this information from HN first. Thanks HN!

</comment><comment><USER14> There's been lots of good news in medicine lately. Here's to a decade filled with great scientific advances.

<comment><USER15> A decade ago there were promises of huge advances in treating diseases based on knowledge related to the human genome project, but then gene therapy kind of fizzled out. I'm wondering if all the latest medical breakthrough news is just the latest round of similarly overhyped findings, or if this is something else.

Specifically, now that basic gene replacement -- perhaps we could call that a naive application of the new genetic knowledge -- has generally been ruled out, scientists have been looking for more subtle ways of applying what they learned in the last two decades wrt genetics/molecular biology and it is starting to bear fruit. INAD, but if anyone has insight into whether this describes what has been happening lately, I'm curious to hear.

</comment></comment><comment><USER16> Never more proud to be a Northwestern alum. Go Cats!</comment>