Tensorflow v1.2 released - <AUTHOR> https://github.com/tensorflow/tensorflow/blob/r1.2/RELEASE.md <comment><USER2> "RNNCell objects now subclass tf.layers.Layer. The strictness described in the TensorFlow 1.1 release is gone: The first time an RNNCell is used, it caches its scope. All future uses of the RNNCell will reuse variables from that same scope. "

I'm so glad they fixed this, I've been running 1.0 for the last few months because the 1.1 release broke their own RNN tutorials and a lot of seq2seq code that is out there. I really, really love Tensorflow and understand it is a fast moving project but I hope they do more regression testing on their example code in the future. This is an exciting release though!

<comment><USER3> What is exciting about it, do you think?

<comment><USER2> Other than unbreaking the feature I use most often? Haha, I think the new versions of TensorBoard and the SavedModel CLI are great for getting a better sense of what is going on under the hood. But I'm just generally excited by the framework hitting new releases, clearing bugs, and becoming more mature.

</comment></comment></comment><comment><USER4> Did they explain why they decided to stop supporting GPU for Mac OS X? That's going to make a lot of developers think twice before upgrading.

<comment><USER5> > TensorFlow 1.1.0 will be the last time we release a binary with Mac GPU > support. Going forward, we will stop testing on Mac GPU systems. We continue > to welcome patches that maintain Mac GPU support, and we will try to keep > the Mac GPU build working.

Sounds like a lack of external contributors maintaining it to me, are there really that many users? Everyone I know on macOS uses docker (or some other virtualisation) to run linux for small jobs and then connects remotely to linux boxes when they need more computing power.

<comment><USER6> Officially, there shouldn't be very many people for whom it's relevant. The last Macs with Nvidia GPUs were sold around 2011 if I remember correctly.

Unofficially, there may be some people using Hackitoshs with rather beefy GPUs for machine learning.

There's a lot you can do easily on a $500 GPU that should take too long on CPU. And I prefer the shorter write/run/debug loop of working locally. It's the same niche other machine learning workstations fill, only with the preferred desktop OS.

There will also be external GPUs for Macs soon(ish), and those would be perfect for tensorflow. I'm not sure at that point they'll want it running on Macs again, and discontinuing support now may be the wrong decision.

<comment><USER7> My late 2013 MBP has a Nvidia 750M

<comment><USER8> Doing a little binary search on Everymac, it seems that the last new MBP model with Nvidia graphics was mid-2014. Both offerings with discrete graphics from mid-2015 had AMD cards. I'm also fairly sure you could still buy those mid-2014 MBPs well into 2015; I distinctly remember seeing both AMD and Nvidia MBPs available in the online store around that time.

[http://www.everymac.com/systems/apple/macbook_pro/specs/macb...](http://www.everymac.com/systems/apple/macbook_pro/specs/macbook- pro-core-i7-2.8-15-dual-graphics-mid-2014-retina-display-specs.html)

</comment></comment></comment></comment></comment><comment><USER9> Note: As of version 1.2, TensorFlow no longer provides GPU support on Mac OS X.

<comment><USER10> Is there any explanation for why they decided to do this? I would imagine they just don't have the means to test on Mac anymore but I'd like to know why for sure.

<comment><USER11> Macs don't have Nvidia GPUs and tensorflow is only supported on Nvidia.

<comment><USER12> I have an MBP and an iMac, both of which came with nvidia GPU's. The MBP is older, but I doubt either of these are atypical machines out there today.

<comment><USER13> They probably are atypical systems for people using TensorFlow professionally though.

</comment></comment></comment></comment></comment><comment><USER14> Direct link to the list of differences:

[https://github.com/tensorflow/tensorflow/blob/r1.2/RELEASE.m...](https://github.com/tensorflow/tensorflow/blob/r1.2/RELEASE.md)

<comment><USER15> Thanks! We've updated the link from the homepage.

</comment></comment><comment><USER16> Can someone explain why should I pick this over scikit? I don't have any ML exp. I found ML quite magically :/ and totally difficult to start if you don't have a phd in mathematics

<comment><USER6> Scikit doesn't support GPUs, which makes it infeasible to run the sort of deep learning stuff that's currently making waves. The competitors to tensorflow are torch, caffe, and maybe Microsoft's CN(something, but not "Y")K.

To get started, keras is an excellent library that's build on top of tensorflow and has recently become an official part of it.

<comment><USER17> Microsoft CNTK. Originally Computational Network Toolkit. Abbreviation remains but now Microsoft _Cognitive Toolkit_.

</comment></comment></comment><comment><USER18> I wonder when would they start supporting OpenCL :( I want to use my Radeon GPU

<comment> Capt-RogerOver While direct support from the creators of TF would be the beste thing, be sure to check out all the addon options, like [https://github.com/hughperkins/tf- coriander](https://github.com/hughperkins/tf-coriander)

</comment></comment><comment><USER19> Site is desktop only:

"Oops. Since this experiment loads over 14,000 bird sounds, you'll need to view it on a desktop computer."

<comment><USER20> I think you wanted to comment on [https://news.ycombinator.com/item?id=14577014](https://news.ycombinator.com/item?id=14577014)

</comment></comment><comment><USER21> What about Java?

</comment><comment><USER22> Thank you for the release! There is an submitted issue because the Intel MKL support does not work with Mac OS X, only Linux.

There should be some way of doing this manually. Any ideas?

<comment><USER23> I've managed to compile tensorflow with MKL on Mac OS X. The ingredients were roughly:

1\. Download MKL from Intel's website, install to /usr/local/lib/

2\. Change tensorflow's configure script to look for the downloaded library on OS X instead of just aborting.

3\. Possibly change some other bazel build files to look for .dylib instead of .so files.

4\. Build with extra flags to look for the appropriate libraries.

I'm not sure if all these steps are necessary but they were sufficient.

The reason I had install to /usr/local/lib/ instead of Intel's suggestion of /opt/intel/something was that, with the latter, even though I passed the appropriate directory to the linker, I think there was still some intermediate binary that wasn't seeing that path. Putting the dylibs in the default directory solved that.

I can't contribute my patch because I did this on my employer's computer and it'd be an enormous hassle to work out the licensing stuff.</comment></comment>


Evading all web-application firewalls XSS filters [pdf] - <AUTHOR> http://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf <comment><USER2> The title sounds misleading to me; this paper is about evading the set of WAFs which may include the universal set at this point in time, and further only including specific versions and rulesets of those WAFs. I don't know...the title made me think "well, then why bother using a WAF at all?", the paper actually implies that I should use a WAF as one line of defense, but I don't think anyone ever got the warm fuzzies thinking their app was fully protected behind a WAF.

If the game is to survive the bear, I don't have to out-run the bear, I need to out-run you. A WAF is a nice pair of sneakers against your flip flops-- doesn't help me much if my legs are broken.

</comment><comment><USER3> Good thing I never bother installing one.

<comment><USER4> If a dedicated WAF can't protect you, how confident are you that your own application is doing appropriate level of escaping/santization?</comment></comment>


Installing and using Apache Cassandra With Java Part 4 (Thrift Client) - <AUTHOR> http://www.sodeso.nl/?p=251

<comment><USER2> It's somewhat annoying when articles of the format "Part N on this topic" do not begin with links to parts 1 -> N-1.</comment>


VergeML - <AUTHOR> https://github.com/vergeml/vergeml <comment><USER2> for your information, "Verge" means "Penis" in french ;)

<comment><USER3> Thanks for the info. Not sure if this is good or bad :)

</comment></comment><comment><USER4> It's a keras wrapper, but keras is not even mentioned in the readme? Wow...

<comment><USER3> Hi author here. We just pushed the code on github yesterday, I did not expect this to end up on HN so early. I will add the relevant information about which frameworks we are using to the README.

However, it is much more than a Keras wrapper. It supports models based on any framework through a plugin system. We plan to add support for pytorch and others.

<comment><USER4> Ok, cool. Why would I want to use your library, and not, say, Tensorpack, which, in addition to everything you promise, provides dozens of high quality model implementations, and is very fast (i.e. much faster then Keras)?

<comment><USER3> Thanks for mentioning tensorpack, looks very interesting!

VergeML is not a library, it is a (command line) tool which lets you drop images in a directory and type 'ml train' in the most basic case.

You would use VergeML to quickly train with everyday datasets.

VergeML is framework agnostic, there will be model implementations in pure TensorFlow ("closer to the metal") and other libraries. Keras is a very good fit for the classifier based on transfer learning from ImageNet. It provides a lot of functionality and good training performance.

</comment></comment></comment></comment><comment><USER5> cool, will give it a try!</comment>


Which tech.stack to use to minimize js code size - <AUTHOR> TL;DR: I want to reduce resulting JavaScript code size by mangling privates — what technology stack to use?
Infrastructure for building a front-end project consists of a lot of parts, but I'd like to focus on bundling & code size. I'm obsessed with code size optimizations, but I still want to have a nicely organized modular code.
Mainstream tools like WebPack do a great job eliminating dead code, but I want more. Keeping that, I want to reduce the code size further by employing two more techniques. Both of them require an introduction of "packages". JavaScript doesn't have packages^1 at the language level, but the code could be organized into blocks.
1. Mangling private properties and whole "private" classes. 2. Inlining declarations of private modules. With small modules, a percentage of module declarations overhead with all its imports and exports is significant.
The former is at least partially (properties) available in google closure compiler. The latter is possible with prepack.io.
These are just two examples and actually, possibilities are much broader. But not stack is easy to combine. For example, I already had had hard times combining prepack with fuse-box.
I'm actually open to considering almost any compile-to-js language, both mainstream like TypeScript and less so, like Purescript. But they'd better have minimalistic (~10kB) runtimes. So Scala.js and GHCJS are not the best options.
To give a little more perspective here are examples of build-stacks, I'm looking for. Possible options are like - handwritten es6 | google-closure-compiler | prepack - TypeScript | tsicle | google-closure-compiler | prepack - TypeScript -m amd | prepack - ClosureScript
Apart from bare stack descriptions, it'd be nice to hear details as well: main pain points, what was the actual code reduction (even rough and empirical).
^1 — Just to be sure: I'm not talking about npm packages, but rather something like Java packages. <comment><AUTHOR> It seems, that TypeScript with google-closure-compiler is a decent enough approach. [https://github.com/angular/closure- demo](https://github.com/angular/closure-demo)</comment>


Today's rich families in Florence, Italy, were rich 700 years ago - <AUTHOR> http://www.vox.com/2016/5/18/11691818/barone-mocetti-florence?rich <comment><USER2> [2016] and:

[https://news.ycombinator.com/item?id=11731890](https://news.ycombinator.com/item?id=11731890)

and (other article but same topic):

[https://news.ycombinator.com/item?id=13555925](https://news.ycombinator.com/item?id=13555925)</comment>


Step into a time machine: welcome to Amsterdam in 1922, in color and HD - <AUTHOR> https://www.volkskrant.nl/kijkverder/v/2020/stap-in-een-tijdmachine-welkom-in-het-amsterdam-van-1922-in-kleur-en-hd~v380368/ <comment><USER2> Be careful, these are not actual videos of the past.

The original pictures and videos may have been limited in resolution (spatial, temporal, color), but they are an actual sample of the reality that was at that time. They may be missing things, but what's there was there.

The "processed" videos are made up. By an algorithm with limited to no contextual clues, no less. The algorithm was trained to make things _look_ real, it does not know about things making sense for the place and time. Some details, colors, movements may have been counterintuitive in reality, they may even have had a "fake" seeming look by today's standards. The algorithm does not know that.

I am not discounting the value of those interpolations. The processed videos do give you a better idea of what life was like. By making it feel more "real", you can connect much better. It makes the past seem less abstract. They do still convey the fact that a train was there, or that people were wearing hats (as another commenter pointed out).

But they are not historical documents. It is important to the documents as such, essentially as dramatizations of the past. Do not try to draw conclusions from individual elements of what you see, they may lead you to the wrong conclusions.

</comment><comment><USER3> And where is a button if you do not want to accept cookies?

<comment><USER4> Exactly. Not very GDPR compliant...

<comment><USER5> I detest full-page cookie walls like these. Many Dutch news outlets use them. Sometimes combined with paywalls after a few "free" visits.

</comment></comment></comment><comment><USER6> Here's an idea for the next round of reworking these old videos, but it would be a LOT more work... orders of magnitude more work...

Find people from the same region today, ideally descendants of people who were in the video, and deepfake their faces onto the video. Possibly go a step further and find period clothing, and deepfake the clothing in higher resolution onto the video. Or at least get samples of the materials and use that to deepfake improvements to the "resolution" of the video. Could do something similar with the audio.

<comment><USER7> If you're going to that much effort, why not re-film it with the new people?

</comment></comment><comment><USER7> Everyone is wearing hats....

</comment><comment><USER8> How did they delete all the fat prople?

<comment><USER9> Please stop posting flamebait and/or unsubstantive comments to Hacker News. You've done it repeatedly lately, and we eventually ban such accounts.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment>


Building Brains to Understand the World's Data - Jeff Hawkins [video] - <AUTHOR> http://www.youtube.com/watch?v=4y43qwS8fl4

<comment><USER2> Jeff Hawkins is a rock star. This pioneer of mobile computing looks like he is in startup mode. Oh wait, he's been a founder before :-)

My first thought was Google picked the wrong guy (turns out RK had the first question on the use of binary vs scalars/probabilistic, but Numenta is making Grok actionable affording readability (speed) over the theory.

I love the applications of real-world problems from the Grok engine vs all the great PR from how-to-build-a-mind vapors of late.

Just gimme that ol' real-time data...

also interesting is the flight of former CTO, Dr. George to sprout <http://vicarious.com/></comment>


Keep your AWS environments separate with IAM. - <AUTHOR> http://collectiveidea.com/blog/archives/2012/10/03/keep-your-aws-environments-separate-with-iam-users-and-groups/

<comment><USER2> Good idea. Solves a problem I've been dealing with.</comment>


Ask HN:Which social network would you integrate your app with first? - <AUTHOR>

Twitter ? Facebook ? Google+ ?<p>Is there any data on engagement differences between the different social networks? <comment><USER2> None? Why is 'social' stuff so cool this days? I still strongly believe word of mouth is the best way to share what you believe is worth showing. When you browse the internet you are constantly bombarded with things a friend of a friend of a shared that you do not really care, but if someone you trust told you personally to check out a website, the you check the fuck out of that website. Therefore, is a social integration really needed? If so, why?

<comment><AUTHOR> Shallow social integration like "tweet this" or "like that" is crap, I am really not interested in that. What I am really hoping to build is an app that users can connect over their friends with. I guess there are two reasons for social integration: promotion, which involves broadcasting the users participation to his circles (and I care less for that), but the other is engagement (come back to the app because the users friends did something interesting there). Games like Draw Something or Words With Friends for example are fun even when you aren;t tweeting actions to the non-participating audience. But its a lot less fun if its just a game you play with the computer itself.</comment></comment>


The Chinese Communist Party Is Setting Up Cells at Universities Across America - <AUTHOR> http://foreignpolicy.com/2018/04/18/the-chinese-communist-party-is-setting-up-cells-at-universities-across-america-china-students-beijing-surveillance/ <comment><USER2> Every nation has spies in the US, especially in our schools and government institutions. That people think such facts are "conspiracy theories" should be the real news story.

<comment><USER3> This really sounds more like a University club to keep people loyal to the government back-home, rather than an espionage operation.

<comment><USER4> Are they mutually exclusive, though? A 'loyalty club' can lead to some types of espionage, especially in an academic setting where the club members have access to some of the brightest minds in America and the research they're working on.

<comment><USER5> Research whose primary purpose is typically to get published. I have a hard time calling it espionage if you could get the same info from a JSTOR subscription, or emailing the reaserchers to talk about their work.

</comment></comment></comment></comment><comment><USER6> Not that I approve of China's approach here, but the use of the word "cells" in the title is blatant scaremongering.

Consider a hypothetical title like "The Democratic Party Is Setting Up Cells in Alabama" and it becomes more obvious.

<comment><USER7> On one level I agree with you -- it's reminiscent of a recent laughable New Yorker piece calling the presence of a Chick-fil-A in NYC an "infiltration": [https://www.newyorker.com/culture/annals-of- gastronomy/chick...](https://www.newyorker.com/culture/annals-of- gastronomy/chick-fil-as-creepy-infiltration-of-new-york-city)

On the other hand, the presence of a domestic political party is a fundamentally different thing from the presence of a foreign entity working inside a sovereign entity like a state. Both the Republican and Democratic parties at least claim loyalty to the American people and its government and alignment with their interests.

</comment></comment><comment><USER8> The tragedy of losing our own Communist (and Socialist) Party is how they could counterbalance the narrative of China. Imagine Chinese and American Communist students having a debate in public of these universities. How many disaffected Chinese could we swing our way? Regardless of your stance of Marx, ceding the entire argument ground to the CCP doesn't do us any favors.

<comment><USER9> CPUSA was an actual communist party, while CCP's main ideology is Chinese corporate nationalism. I think engaging with CPUSA would most certainly take points off your social credit score back home.

<comment><USER10> This. The CCP is communist in name only (and maybe mechanisms of social control). There isn't much about China that is communist these days. I think China would more accurately be considered authoritarian capitalist and nationalist. China is only socialist in the same ways that Nazi Germany was socialist.

<comment><USER11> They gave it a solid try and only gave up after the inevitable famine, forced labour camps, poverty and imprisonment of political opposition. A solid display of Marxist government.

Then they worked out they could still have most of that without the widespread poverty with fascism!

<comment><USER12> Yeah, almost two decades after the famine. And were the Gang of Four not imprisoned political opposition?

Your comment reminds me of the famous Mao quote "No investigation, no right to speak."

</comment></comment></comment></comment></comment><comment><USER13> Who cares? Conversation is a 2 way street. These groups could just as easily be used to introduce new ideas to the next generation of Chinese leaders.

<comment><USER14> Did you read the article? It is for Chinese only and it is under strict ideological control.

It is also about sending a message. If you do not quack like a duck, you will get into trouble.

<comment><USER13> I did. If they are in the U.S. then they will be exposed to other ideas too. That's a good opportunity to show them the value of different ideas. I doubt they are prohibited from having non Chinese friends or reading on the U.S. internet.

An analogy is - there are plenty of undercover Mormons, Jews, etc who keep up appearances for their family's sake. They've found a different way that works for them, so why wouldn't these people?

tl;dr People are complex and if you are trying to control minds, often your efforts can backfire.

<comment><USER15> > _tl;dr People are complex and if you are trying to control minds, often your > efforts can backfire._

I believe in that, but I also think you're underestimating the effectiveness of social control when done competently, which IMO is what's China's doing.

You don't need to control people's minds, just their social acceptance and livelihood guarantee.</comment></comment></comment></comment>


Ask HN: What kind of personal robotic services would you buy? - <AUTHOR>

If you could pay for robots to complete a personal or small business service, what would it be? Not looking for what's practical today, just ideas. Also, what would you definitely not want or trust a robot helping you with? <comment><AUTHOR> Here the list I was thinking about:

1\. trash can that goes out front to be emptied. 2\. loads dishwasher and puts away dishes. 3\. laundry 4\. person drives truck that drops off lawn mowing robots in a neighborhood. 5\. I think you could automate subway and it would be neat to watch it. 6\. drone that carries a women's purse or a backpack. 7\. set of drones that delivers tapes flyers to people's doors. 8\. something involving paintball/laser tag and drones. 9\. a robot that finds toys on the ground and puts them in a toy box.

</comment><comment><USER2> Just design robots that follow you around or even precede you and carry your stuff (and kids). They will be useful in airports,supermarkets, hotels, malls, warehouses,golf courses etc.

</comment><comment><USER2> Mini-drones that hunt agricultural pests, thus eliminating the need for pesticides.</comment>


Letter from Loretto - A Prison Letter from a CIA Whistleblower - <AUTHOR> https://openwatch.net/i/74/letter-from-loretto-a-prison-letter-from-a-cia-w <comment><USER2> If you're interested in the "other side" of this story (such as it is; this article doesn't really take a side), here's what the USG says happened with Kiriakou:

The USG's position is that Kiriakou left the CIA and, in an effort to drum up consulting business and sell a book, told journalists on several separate occasions about (a) the identity of a covert operative who was still undercover, and (b) the affiliation of another USG employee to a program to a classified program capture Abu Zubaydah. Kiriakou was questioned by the FBI and, the USG claims, lied about his disclosures. Kiriakou himself had, according to the USG, repeatedly claimed he hadn't intended to compromise either operative, the subtext apparently being that he assumed the title of "whistleblower" when it became convenient to his defense.

FAS does a great job tracking all these leak investigations:

<http://www.fas.org/sgp/jud/kiriakou/>

I don't know what to think about this case. It's not the most sympathetic case, but certainly not the least. But I'm also biased, because I think both Guantanamo Bay and the rendition programs were abhorrent.

<comment><USER3> Your use of past tense in referring to Gitmo and extraordinary rendition is, regrettably, unwarranted.

</comment></comment><comment><USER4> I've always wondered what would happen if we enumerated the common events of prison life in sentencing. You are hereby sentenced to:

Segregated eating

Daily verbal abuse

The regular disruption of your personal possessions

Being physically assaulted once for every 5-7 years of confinement

Being seriously injured through assault once for every 10-15 years of confinement

Being raped once for every 15-20 years of confinement

While these are extrapolations from prison statistics, the uncertainty makes the sentence all the more chilling. Prison is, in the US at least, a cruel institution, but this is rarely discussed when we talk about what it means to give someone a 5 year sentence or 10 years. Confinement is terrible, but, for many, it is not the worst part of the punishment.

<comment><USER5> The thing is, I could probably find a pretty substantial percentage of Americans who wouldn't have a problem with any of that, as long as the offender "learns his lesson" or some other similarly-trite authoritarian nonsense.

<comment><USER6> I don't have any sources handy, but I believe their is much evidence that prisoners do learn very good lessons about violence. Unfourtuantly, those lessons are in how to be violent, which (I think) results in prisons being the best way to make a non-violent criminal into a violent one.

<comment><USER7> A childhood friend was sent to juvenile detention on a statutory rape charge (not a rapist, they were both 14). After 2 years he emerged to be a worser human being with a huge, justifiable, chip on his shoulder. By 16, he was dealing in cocaine (not weed, cocaine, he gained the connections for that in JD), prostitution (addicts will do anything for blow) and weapons.

And Scarface, the movie character, became his idol. We used to be backpackers (the rapping kind, check urban dictionary) and he transformed into everything that was wrong with hip-hop. And I blame everything on how all the adults completely snowballed a 14yo.

</comment></comment></comment></comment><comment><USER8> Petraeus, the former director of the CIA, said this in reference to John's conviction:

"This case yielded the first IIPA successful prosecution in 27 years, and it marks an important victory for our Agency, for our Intelligence Community, and for our country. Oaths do matter, and there are indeed consequences for those who believe they are above the laws"

I have to wonder if practitioners of torture will ever have reason to believe otherwise. Somehow, I don't find it to be likely.

<comment><USER2> It is possible for both things to be true simultaneously: that the specific illegal disclosures Kiriakou made were crimes, and that the torture of detainees at Guantanamo and in sites around the middle east were also (grave) crimes.

<comment><USER8> That it might be. However, the state is remarkably adept at not pursuing crimes that its agents commit... Unless those crimes harm the interests of the ruling class.

There's a pretty clear - and abhorrent power imbalance at play, here.

<comment><USER2> Or, the state is adept at making the cases it can actually make, and less adept at making systemic cases whose prosecution would cost tens of millions of dollars and seize up operations at intelligence services that actually do need to function, for instance to curb proliferation of nuclear weapons.

Reasonable people can _OBVIOUSLY_ disagree on this point, but I do not perceive Barack Obama as someone who is sanguine about torture.

<comment><USER9> Is that perception based on his public speech or on his actions?

</comment></comment></comment></comment></comment><comment><USER10> For comparisons sake Scooter Libby was also convicted of revealing the identity of a CIA operative. But his sentence was commuted by then President George W Bush.

Scooter Libby explicitly and intentionally revealed Valerie Plame's name as retaliation for her husband's New York Time's article detailing the lack of evidence that Saddam Hussein could have acquired Uranium from Niger. John Kiriakou admits to providing a name to a journalist as a source of information on torture but the name has never been published.

Scooter Libby was convicted of outing a CIA operative as retribution for her whistle blowing husband. John Kiriakou is a whistle blower who gave a reporter a yet unpublished name. In both cases the actual whistle blowers were punished. One through losing their career as a CIA operative(Valerie Plame) and the other by being sent to prison(John Kiriakou).

<comment><USER11> Libby should be still in jail if not on death row - note that AFASK Manning is accused of releaseing secret information however the real identity of a CIA officer is Top Secret.

</comment></comment><comment><USER12> 1st, I speak from experience.

I can see why he didn't get to go to the camp. Usually if your a flight risk (like you ran when you got your indictment), or if you are violent (which could be the unseen possibility here given his previous profession), BOP won't deem you appropriate for a camp.

I agree strongly with tptacek's comment that when you look at a whistleblower's case it's really hard to see that someone who was apart of the problem will grow a conscience (very possible), remove themself from the problem (possible), without intervention or pressure, disclose information about what you and your other people did (unlikely).

I don't believe this guy deserves the attention he is vying for. Although some of the CO's are assholes, the mailroom checks all incoming and outgoing mail, so if some of the details in the letter was true...it would've been lost on departure (shit, I couldn't even get my wired magazine subscription cause I'm a hacker).

Many people inside that I met (at a camp) have hopes of writing a book, explaining how it is, making a change in their life for the best, and profiting off their experiences. Not me, people on here ask me how it was, and I give that experience and advice for free (feel free to email me).

</comment><comment> brown9-2 _But the more I thought about it, the more this made no sense. Why would the uncle of the Times Square bomber be in a low-security prison? He should be in a maximum._

Why? Should family, rather than crime or danger, dictate what type of prison a sentence is served in?

<comment><USER13> Well...

Just put it this way... phone calls to Pakistan by a known terrorist threat from an American prison SHOULD not happen.

So this guy was just, kind of, connecting the dots.

<comment><USER14> Well, he was an intelligence officer. He should be able to know bullshit when he hears it.

</comment></comment></comment><comment><USER15> Wow, $5.25 per month was what they were paying in 1995 as well. They haven't even increased the minimum wage in federal prison!

</comment><comment><USER16> Google Cache if you are experiencing an error 504 gateway timeout: [http://webcache.googleusercontent.com/search?q=cache%3Ahttps...](http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fopenwatch.net%2Fi%2F74%2Fletter- from-loretto-a-prison-letter-from-a- cia-w&client=ubuntu&channel=cs&aq=f&oq=cache%3Ahttps%3A%2F%2Fopenwatch.net%2Fi%2F74%2Fletter- from-loretto-a-prison-letter-from-a- cia-w&aqs=chrome.0.57j58.1161&sourceid=chrome&ie=UTF-8)

<comment><USER17> Ahhh sorry about the 504s! You should be able to retry if it's giving you issues. We only have 4 gunicorn workers running on a single Linode right now, we'll try to bump it up to 6-8 to see if that helps in the meantime.

edit: Increased the worker count to 8. Hopefully that helps a little bit.

edit2: Turned on memcache.

<comment><USER18> So, i'm pretty disappointed that you took an article posted on FireDogLake ([http://dissenter.firedoglake.com/2013/05/29/imprisoned- cia-t...](http://dissenter.firedoglake.com/2013/05/29/imprisoned-cia-torture- whistleblower-john-kiriakou-pens-letter-from-loretto/) ), simply pulled the PDF and the text which they transcribed by hand, rehosted it yourself, and then posted it to HN.

Especially since you did it without any citation/reference (and since FDL notes that they did the legwork on this).

Edit: I'm going to give the OpenWatch guys the benefit of the doubt, and assume that they never saw the FireDogLake post, and that they were linked directly to the PDF of the letter that is hosted on DocumentCloud's S3 account.

It would be nice if they acknowledged the original source of the letter.

</comment></comment></comment><comment><USER19> This is a true American hero.

<comment> brown9-2 Who may have, and was convicted of, doing something else not that heroic (disclosing covert agent's identities) completely separate from the water- boarding disclosures.

It's convenient for Kiriakou to gloss over the events he was convicted of and insist that it was merely retribution (which of course it might be, but good luck proving that). His statements about persecution have to be taken with some grains of salt.

<comment><USER20> > His statements about persecution have to be taken with some grains of salt.

In the fight between the National Security State and the individual, I always give the individual the benefit of the doubt. Then again, I always back the underdog.

</comment></comment></comment><comment><USER21> Sounds like Shawshank Redemption in parts of this letter. How did this letter even make it out of the prison?

<comment><USER22> perhaps dictated over one or more phone calls?

</comment></comment><comment><USER23> He makes me think a of modern-punk cicero, with a sense of justice for others (tortured people) above his own self. Give this guy a break for his broken oath: he pays a harsh price already.

</comment><comment><USER24> Ah, now I see why weev asked to be sent to the same prison.

<comment><USER12> If letters like this were getting out (and all content is true), then of course I see why weev would want to be there. ESP given the fact that at camps, there are usually cell phones floating around....and weev has a pr campaign to uphold (apparently this guy does too, but at least I like weev).

</comment></comment><comment><USER25> Prisons are long overdue for disruption.

<comment><USER26> They've done a great job "disrupting" the industry through privatization! /s

I fear how powerful that lobby is going to get over the next few decades -- Think about what they'll be able to prevent... any realistic shot at rehabilitating our country's drug laws into something sensible will be completely dismissed.

<comment><USER12> I could not agree with you more!

I went to Taft (the camp) which is privately owned by a company called MTC. When I was there, I hurt my leg extremely bad to the point where something popped (I was only 22 and a jock in HS, so it was bad). I couldn't walk on it at all. The nurse guy came out to the yard and made me get into a wheel chair and he pushed me to the nursing area. He ran my hurt leg into a concrete pillar. Everyone told me don't get hurt inside, because you'll stay longer, your release date will somehow disappear, and it looks bad on the facility so they don't release you until your better. When I got into the nursing area and he checked it, he made me stretch it and I swear I held back tears from the pain and said I'm fine. Other prisoners would tell you that Taft is good, they sell tobacco in the commissary, or they're more laid back.....prison is prison and PRIVATE ones like this make money off of you being there. Don't get hurt, don't piss off the co's, or you'll end up with no release date like 1 person I met, or dead like a healthy person that needed their medication, but didn't get it in time.

</comment></comment></comment><comment><USER27> I don't feel sorry for the guy in Club Fed that tattled on the CIA. If you want some real prison stories read "Papillon":

[http://www.amazon.com/Papillon-P-S-Henri- Charriere/dp/006112...](http://www.amazon.com/Papillon-P-S-Henri- Charriere/dp/0061120669/ref=sr_1_2?ie=UTF8&qid=1369984528&sr=8-2&keywords=papillon)

<comment><USER28> Or see the movie with Hoffman and McQueen. Amazing.

<comment><USER27> Great movie, but the book contained a lot more they didn't show.

</comment></comment></comment><comment><USER29> Took me about 5 minutes of furiously rubbing my phone against my shirt to realize that it's the website background that's dirty looking, not my screen! Grr.</comment>


Show HN: Jolt Alarm – Wake up to a new song every day - <AUTHOR> http://www.jolt.rocks/ <comment><USER2> I like this! just downloaded the app and will give it a whirl tomorrow morning.

Ever considered adding a feature to let strangers wake up other users? So it would work like this... ten minutes before your alarm is set to go off another user is chosen at random from a different time zone, he/she get's a notification to either pass or accept the task of waking you up. When it's time for the alarm to go off a VOIP session is opened and the user will then shout or speak softly, or strum a guitar or use an airhorn, etc... to wake you up. implement a rating system so each "waker" and each "sleeper" would be able to promote feedback to refine the system. fun!

<comment><USER3> I've certainly heard of this already existing as a product, but don't remember what the name was.

<comment><USER4> Wakie: [https://wakie.com/](https://wakie.com/)

<comment><AUTHOR> That's actually pretty cool. I don't think it's an alarm clock though. Maybe they could add that feature.

</comment></comment></comment></comment><comment><AUTHOR> Hey guys I created Jolt Alarm because I was sick of waking up to the same song every day. This is a cool new way to discover new music and to replace your boring ringtone. I'd love to hear what you think.

<comment><USER5> I haven't used it, but here are a few thoughts from looking at your site and the app store...

• Your website doesn't say anything. No information about music genre, settings, etc. You need to say _something_.

• I suggest having a configurable fade-in time for the song. I'm a light sleeper and can startle easy. Without the fade in I'll jump out of bed with my heart racing.

• I suggest either omitting explicit songs by default, or add a setting to filter them out.

• Your privacy policy states that an account may be required for some features (please no, I'd rather pay than register...) with personally identifiable information. AFAIK you have no reason to need that. Also, it references GPS data, a 2 year retention period of data linked to PIA (after closure/deletion of app), etc. Either this is boilerplate that needs to be revised, or you need to rethink what you gather (IMO) because it's overblown for an alarm clock.

• Clicking your logo goes to: [http://www.jolt.rocks/sudo%20apt- get%20install%20ruby-fullsu...](http://www.jolt.rocks/sudo%20apt- get%20install%20ruby-fullsudo%20gem%20install%20jekyll)

I probably won't install the app. But I did want to share my thoughts. Good luck!

<comment><AUTHOR> Hi trebor. Thanks for the really helpful feedback. I created a link to the website to go to IOS and android. I never really thought about having much of a description. I will try to add one in the future. This is a good point.

Regarding the configurable fade-in, the good thing about a lot of the songs that play on Jolt is that they are a lot more pleasant to wake up to than most ringtones.

For the privacy policy it was required for android so most of it is boilerplate. There is no login accounts. But I will update it soon.

Thanks for the feedback on the logo. That's just embarrasing. I will fix that soon.

<comment><USER5> About the fade-in... the click from the alarm clock wakes me up. It's not enjoyability, it's volume and how sudden the music comes on.

Just consider it.

<comment><AUTHOR> I see what you're saying. I will definitely consider it. It could be a nice additional setting to add.

</comment></comment></comment></comment></comment><comment><USER6> Does no one buy alarm clocks that use the radio as an alarm anymore? I hear a different song everyday as it is.

<comment><USER7> My wife wanted one, it wasn't easy to find...

<comment><USER6> Mine is a few years old but they're still around.. Amazon or Best Buy for online, and I'm willing to bet you could find one at a Walgreens, Rite-Aid or CVS or some kind of pharmacy type convenience store.

The one I have even has an AUX feature to hook up an external source for audio and a few other interesting features (dual alarms, etc)

</comment></comment></comment><comment><USER8> I love the Idea, but even spotify needs over 20 attemps to show me one song I don't know and like.

<comment><AUTHOR> My goal is to hopefully cut down on that number. I hope you'll like all the songs. But if you don't like it you can always try tomorrow. That's the fun :)

<comment><USER9> Even if you don't like it, at least you'll get woken up :)

<comment><USER8> How would you have any clue about my taste (if not an even better one than spotify)?

<comment><AUTHOR> I don't. I just pick the songs I like from what the artists submit. Or I reach out to the artist directly to get their permission to feature it. Hopefully, you'll like them too. Everyone listens to the same song for a 24 hour period. Most of the music is EDM.

<comment><USER10> That sounds like it might be difficult to sustain, but this kind of hand curation is the surest and easiest way to consistent quality. Thanks for doing it!

You might want to considering billing this as part of the product's description. My biggest question coming in was how the music was selected because I wanted to know if there was some mechanism to avoid genres that I'm sure to hate. I had to come here to find my answer.

I'm looking forward to trying out Jolt tomorrow.

<comment><AUTHOR> It's my pleasure. That's true. But it's "only" 365 songs a year. I have no issues curating the content as long as people are using and enjoying the app. You have a good point, I need to write a better description of the features of the app. Luckily, a lot of artists are really excited to have the opportunity to get featured, so it's been relatively easy to find new music to play.

I really hope you enjoy using it.

<comment><USER8> make the "undiscovered artists" a selling point. It's certainly "music you never heard before". In any case some example songs might be nice.

<comment><AUTHOR> That's actually a good idea. I will definitely need to update the description to reflect that. Thanks for the feedback :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Finally, it's like have a clock with a radio...

<comment><AUTHOR> Yeah but this is "better" music. And it's on your phone... so there's that.

</comment></comment><comment><USER12> I'm still surprised popular music services don't have this feature. I ended up implementing it using Tasker to start Google Music at my wake up time, with a snooze option.

<comment><AUTHOR> Yeah, it is kind of surprising. I didn't do a ton of research into the competition, but as far as I know there isn't really much like this.

</comment></comment><comment><USER13> Just downloaded the app. Can't wait to try it tomorrow morning.

Some feedback, you should use the AppCompat dialog [https://developer.android.com/reference/android/support/v7/a...](https://developer.android.com/reference/android/support/v7/app/AppCompatDialog.html) so your dialogs implement the material design instead of the holo design you're currently using.

<comment><AUTHOR> Thanks! I hope you like it. Also, thanks for the feedback. I will look into updating that for the next release.

</comment></comment><comment><USER14> I really like the idea but I do see one problem with the premise. I've been programmed to jolt awake from the sound of my alarm. I've been listening to the same alarm for years and my body just knows it has to GET UP NOW when that noise is made. Hell even if I hear it halfway through the day it's like I feel a static shock.

Perhaps it could play a base line noise that's guaranteed to wake you up and fade into the music?

<comment><USER15> That's funny, I think I'm the opposite. If I use the same tone too often my brain begins to ignore it. I've gotten around this in the past by using my ringtone, but I don't like starting the day with a feeling of panic.

<comment><AUTHOR> I'm the same way. That's why I built jolt.

</comment></comment></comment><comment><USER16> Aha, always start hating my alarm clock music, no matter how much I liked it before. Hopefully this will counteract that.

<comment><AUTHOR> I hope you like it.

</comment></comment><comment><USER17> Just check your logo is directing to "[http://www.jolt.rocks/sudo%20apt- get%20install%20ruby-fullsu...](http://www.jolt.rocks/sudo%20apt- get%20install%20ruby-fullsudo%20gem%20install%20jekyll")

Other than that nice twist on boring alarm clocks.

<comment><AUTHOR> That's embarrasing. I just switched over from wordpress to Jekyll because I was worried about getting too much traffic from HN. I think I didn't work out all the kinks. Edit. It should be fixed now.

</comment></comment><comment><USER18> How is the iOS version? I thought it wasn't possible to create an app running in the background that would ring an alarm even when the phone is in silent mode and present a snooze UI, how does this app deal with that?

<comment><AUTHOR> Yeah unfortunately, if the iOS app is in silent mode, the alarm won't sound. (As far as I know silent mode is the orange toggle switch on the side of the phone). That's just an apple thing. But, as long as you're not in silent mode the song will play in the background. The iOS version isn't quite as good as the android version in my opinion because of the apple restrictions, but they're fairly close.

</comment></comment><comment><USER19> Cool app. Mind sharing what language you wrote them in? I'm always interested when app developers release both iOS and Android apps together.

<comment><AUTHOR> Both apps are native. I wrote the first app in Android, and then once I got that hammered out the way I liked, then switched to ios. On IOS it's written in Swift 3.

<comment><USER19> Wow it's rare and also great you know how to write for both platforms. I'm focusing more on React Native because I don't know any Java...

<comment><AUTHOR> Thanks. React Native looks like a great platform. I haven't really done much with that yet, but it looks really interesting. Unfortunately, android and IOS both have pretty big learning curves, but I think knowing both is pretty helpful. I think you can make better apps when you write it natively.

</comment></comment></comment></comment><comment><USER20> Does this app synthesize a new song everytime it alarms you? Not exactly clear how it works from the playstore description.

<comment><AUTHOR> It's actually a new hand-picked song every 24 hours. If you're curious, on how exactly it works. I have a rails server which I host all of my songs, which updates once a day. Then I pull in the song data from the server into the ios and android apps. So everyone who has the app listens to the same song.

<comment><USER20> Do you use it to showcase your music? Do you push/pull the media to everyone at the same time? Does it fallback to the last song if it can't reach the server for whatever reason?

<comment><AUTHOR> It's not my music. Actually, I get artists to submit their songs, and I pick the ones I like. Or I reach out to artists I like and ask for permission to use their songs.

No, all the phones will pull the data at a different time, so it should keep the load down from the server. Plus there is a bit of randomness thrown in for good measure.

It doesn't actually fall back to the last song. It caches the current song, but if for some reason the cache doesn't save for some reason. Or if you are offline. Your phone's default ringtone will play.

</comment></comment></comment></comment><comment><USER21> question: what happens when I'm offline? what happens when I'm offline like for a month and use this app with 3 different alarms per day?

the big questions: do you (kinda) guarantee that the alarm clock will go off, even in these extreme circumstances?

<comment><AUTHOR> If you're online, in wifi, it will play the song. But if you're offline it will play your phone's default ringtone. I did it that way so it wouldn't eat your data. Because downloading a new song everyday can add up if you have a limited data plan. So in theory you could be offline indefinitely and the alarm should just work. And then when you come back online, you'll be able to hear the song again.

<comment><USER22> How about preloading of songs over wifi only. Another way could be to automatically enable wifi a few minutes before the alarm time.

Defaulting to standard ringtone if no song was downloaded.

<comment><AUTHOR> That's a good suggestion. Right now it actually does cache the song when it's on wiFi, so it often works correctly. But, I find when my phone gets low on memory, the cache is sometimes cleared, and if I'm not in WiFi, it will go back to the default ringtone.

Actually automatically enabling wiFi is a good idea. I just assumed most people would try to be in wiFi as much as they could be, so I assumed the user would do their best to make that happen. Maybe I shouldn't have assumed that.

<comment><USER22> It wouldn't be much of a deal to me either, as I'd just use a Wifi-enabling task. Though I'd say many users would appreciate such feature.

<comment><AUTHOR> Yeah I like it. That sounds like a relatively easy thing to implement, which could "fix" having your phone's default alarm sound instead of the song of the day.

</comment></comment></comment></comment></comment></comment><comment><USER23> This is a sweet idea... I can imagine this becoming a staple in the EDM community

</comment><comment><USER24> How 'bout addin' Rusty's Random Rooster feature

<comment><AUTHOR> That will need to be a separate app. There isn't a place for it in jolt, but I do think it could be another fun side project to work on...

</comment></comment><comment><USER25> The "jolt" when opening the app was a nice touch!

<comment><AUTHOR> I'm glad you like it. :)</comment></comment>


Investors - <AUTHOR> http://blog.chriszacharias.com/investors <comment><USER2> "They had been completely priced out!"

This is a fallacy. People use this term "priced out" as if it meant some sort of process, but it means nothing more than that the investor thought the startup's stock was too expensive. And it is very stupid to let valuation decide which startups you invest in, because the variation in outcomes between startups is orders of magnitude greater than the variation in valuations. I.e. there is no value investing in startups.

What we have here is a case of anecdotal evidence. A founder happened to get some investors who hadn't invested in other startups because they felt the valuations were too high, and those investors turned out to be really helpful. But there are other investors who are willing to invest at high valuations who are helpful, and investors who seek out low valuations who aren't.

<comment><USER3> I know this is a generalization, but I think his comments about commitment are spot on. I would expect that high valuations decrease investor commitment and involvement because they reduce ownership in the outcome.

<comment><USER4> That doesn't make much sense to me. I can see passing on something because it is expensive (maybe), but if I buy something which is expensive, I don't value it _less_.

<comment><USER3> Sure you do. You are confusing fur coats with investments. To how many companies in your 401k portfolio have you offered free consulting? With an investment, ownership matters. If you could spend $200k on a company for a 1% share or $100k for a 50% share of a similar company with similar prospects for growth, I would easily bet you would spend more time on the investment on which you could get the cheaper deal. More ownership means a greater return on your time investment.

<comment><USER4> It's more realistically the one where you spent $2mm for a 20% share or where you spent $500k for a 20% share. Most investors seem to target percentage ownership, not amount they're investing.

(I guess you could consider the case where you got one at a huge discount through luck -- getting a $100k product for $10k. Then, I'd basically treat it as a $100k asset for the purposes of how much to help -- the 10x gain on the $10k already happened the moment you made the deal, even if it's unrealized. I'd be happy to buy $100k negotiable assets for $10k, but in general, bargains aren't -- there is a reason you're getting a discount, ranging from the founders being noobs who will equally be likely to get taken advantage of by others later, or the deal has more risk than you thought, etc. There may be some cases where assets are systemically mispriced -- I think Dave McClure thinks non-US startups are one, especially from LatAm and SEA.)

If I were making an investment into a public company (or a really late stage private company, like investing in Facebook the year before the IPO), I wouldn't think I'd have as much to contribute, true, but I'd assume I could help a $2.5mm valuation startup about as much as a $10mm valuation startup.

(Actually, my #1 metric on helping would be "is it fun for me to help" -- I'd probably end up spending all my time helping portfolio companies with security or infrastructure issues, and would avoid helping with design, HR-fiasco, or fundraising issues. And, if I could get Apple, Tesla, etc. to value my advice, I'd almost work for them for free ($50k/yr?) just to make them 10x more secure than they are now. It's just easier to get someone to value your advice when he's paying you $300/hr.)

I don't dispute that some people would behave like you're saying, but I would not, and most of the professional investors (super angels/VCs) probably wouldn't. I think this might be the difference between "professional" investors and angels.

</comment></comment></comment></comment></comment><comment><USER5> This is my first company, but I've found that by having a lower valuation cap on my note two great things have happened. Some of my more powerful investors have felt comfortable introducing me to people who don't give two shits about the latest consumer web fad or investment trends, found my terms very easy to buy in on, and have been enormously helpful. Second, a lot of my friends have found they couldn't recapitalize or raise an A. Having the terms that I do, it was pretty easy for my investors to re-up when I needed it.

</comment><comment><USER6> I think this fits into the larger conversation around what terms to take in a funding round. The anecdote about all the YC companies bragging about valuation post-Demo Day rings true - but what else did they agree to in getting that high valuation? Ensuring that those who have partial control of your company and your future have interests aligned with yours does seem much more valuable than wringing every dollar out of a cap rate.

<comment><USER2> Actually high valuations tend to be correlated with clean terms. Which is not surprising since both reflect founders having power relative to investors.

<comment><USER5> I think this is a fallacy. In my experience of the big firms law firms have already developed very clean convertible notes, and there are many that are public, leading to a larger trend in easy terms. By having an entrepreneur friendly first investor (not necessarily lead) agreeing to "clean terms" (independent of valuation), it seems most other investors in a round come on with little friction, even if it might require a call from one of your existing investors/ commitments.

<comment><USER7> In practice, investors are either pretty upstanding, or kind of dirty. Upstanding investors tend to get the pick of the best because the best companies can choose who they want to do business with. Investors downstream tend to try to overreach on participating preferreds, pro ratas, and lower valuations. It's just how it seems to work.

</comment></comment></comment></comment><comment><USER8> My company wasn't able to raise much money, but the money we did raise was from people who, luckily, have turned out to be amazing. We've gone through some really terrible things (my submissions will point you to some details), but they've stood by us 100%. Even though we had to shut down 3 months ago, these guys are still trying to make connections for us that would allow us to restart. You can't put a price on that, especially with the importance of not dying.

Everything is going to go wrong: optimize for having people around you that are going to help you out of THOSE times, because when it's going well help will chase you down. When it's going bad, you better have backup.

</comment><comment><USER9> Not sure if I believe boot strapping because of my background and location Latvia, but it seems crazy people trying to raise millions of dollars, like their lifes would depend from it!! How could possibly you need money like that to launch a successful project???

I understand in USA all the hires are much more expensive, but why not aim towards bootstrapping if you have some money, hire cheaper Philippinos to help out at starters, and then go all shiny and hustla!!

</comment><comment><USER10> "Think about it. With too high of a cap or valuation, what incentive does an investor have to go to work on your behalf in the short term when the real return on their investment requires several orders of magnitude of growth, which has a very low likelihood of happening ever?"

It seems to me that if the angel investors in question are really able and willing to do productive work, you could get a similar result by simply paying them additional equity as an incentive after allowing the market to set the company valuation in the natural way. In other words, same as you would for any other early stage employee. No need to artificially interfere with the valuation and set it low to attract them.

</comment><comment><USER11> I like the concept of the investors having some skin in the game. One way might be to have them invest a lot -- and have a lot to lose, in addition to having a lot to gain from a smaller valuation. I also wonder if a smaller valuation makes a company more hungry and more driven to innovate and work harder than a company that knows they can throw money at a problem and 'solve it'.

</comment><comment><USER12> Without ever using those terms, this article was a great commentary on the difference between "smart money" and "dumb money." Not to say that the investors snapping up YC companies at big valuations were necessarily dumb; but that the author optimized his fundraising for the smartest of the smart. A good way to position your company for long-term growth.

</comment><comment><USER13> Another post on celebrating "I got some moneys" and yay! this time without YC, even though I was in YC.

Guys, get over it. Can some of you please post some inspirational articles on how you created a bootstrapped company?

<comment><USER14> Robert Grass from Turbobeads gave a _fantastic_ talk at the MRS in Boston about how to bootstrap a company. And his was even a very difficult field that required actual tangible hardware instead of "just" time. The basic point was that they had a technology, and so they didn't bother with patents, patent searching, or anything like that. Instead they just started asking customers what they wanted, worked to make it, and then started selling it everywhere. Five years later, they own their entire company, and sell stuff all over the world using ebay and similar for fulfillment initially, and google ads instead of complicated marketing campaigns.

Unfortunately I can't find an online version of the talk. But if you get the opportunity, consider checking out local trade conferences to see if they have speakers talking about fields outside of CS. If it works outside if CS it will almost definitely work even better inside of CS...

</comment></comment><comment><USER15> Chris, if you are reading this, how did you find your investors? Say, that specific person you met in NY layover.

<comment><USER16> At first, through YC, and then mainly through my existing network, word of mouth, and some serendipity.

</comment></comment><comment><USER17> "No price is too high" is always an incorrect statement, at least in the context of investing.</comment>


Possibly timely items from my reliability list - <AUTHOR> https://rachelbythebay.com/w/2019/08/01/reliability/ <comment><USER2> If you want to go further down the "Alice in Wonderland" rathole, start with this link: [https://infiniteundo.com/post/25326999628/falsehoods- program...](https://infiniteundo.com/post/25326999628/falsehoods-programmers- believe-about-time)</comment>


Tuesdays are the answer to your to-do list backlog - <AUTHOR> http://www.16thletter.com/2008/05/08/stop-scheduling-meetings-on-tuesdays-and-get-to-work/

<comment><USER2> <http://isittuesday.com/> :o

</comment><comment><USER3> Nice gig when you can measure your productivity based on how many feed items you read. I guess.

<comment><USER4> Good point! I thought about that when I was writing the article, but it was late at night so I let it slide. Of course someone at HN would point it out. :)

I tried to make the point (obviously unsuccessfully) that no matter what else I am doing throughout the day, I tend to read feed items at about the same rate - or so I thought. The Google Reader data isn't really scientific, just meant to illustrate that I was reading MORE on Tuesday when I thought I was having the same level of productivity the entire week. I guess I think that it can be extrapolated to reflect on the other things that I'm working on throughout the day? Like I said, it's not scientific.

(And trust me, I'm also doing other things other than reading feed items, like posting here!)</comment></comment>


Why do different people choose the same passwords - <AUTHOR> http://www.in-the-attic.co.uk/2011/06/19/why-do-different-people-choose-the-same-passwords/

<comment><USER2> Great, compile a whole list and use it it dictionary attacks!

<comment><AUTHOR> Essentially you could yes. Even with the top 50 list given there you'd be guaranteed quite a few hits, I'm still shocked people think it's fine to use 1234567890 as a password...</comment></comment>


For life expectancy, money matters - <AUTHOR> http://news.harvard.edu/gazette/story/2016/04/for-life-expectancy-money-matters/ <comment><USER3> My go-to story whenever anyone says "money can't buy happiness" is this:

A good friend of mine was diagnosed with Liver Cancer around the same time as Steve Jobs. Both lived near SF, and both were put on the waiting list for transplants around the same time (+- 2 months). She was young, very sick and otherwise healthy so was a good candidate to be high on the list.

Then I heard about Steve "moving" to Tennessee [1] to get on a different, shorter transplant list - and thus receiving the transplant needed. She died shortly after, never receiving a transplant, while Jobs lived two more years.

This is not a complaint or gripe about fairness, but just a demonstration of how two very different people in a very similar predicament had massively different outcomes based almost entirely on wealth, fame and power. Money buys access, which create options, which enable health, freedom and longevity. It's so simple and obvious I don't know how people can argue otherwise.

[1] [http://www.commercialappeal.com/news/southern-transplants- ho...](http://www.commercialappeal.com/news/southern-transplants-how-apple- ceo-steve-jobs-got-the-liver-he-needed-in-memphis-ep-307208860-329010091.html)

[2] [https://www.youtube.com/watch?v=od6Nq_bN_XY](https://www.youtube.com/watch?v=od6Nq_bN_XY)

<comment><USER4> Money is necessary to have a certain quality of life (quality healthcare, etc), but is certainly _not_ sufficient to achieve happiness.

<comment><USER5> I agree most with this way of thinking. Money is downside protection but the upside benefit happiness wise is minimal. I think relationships, meaningful work, healthy diet and exercise, sleeping well, sense of community, etc. matter more for upside happiness.

<comment><USER6> It is far easier to have a healthy diet if you can afford:

\- fridge space for fresh ingredients that you don't have to split with roommates

\- An apartment a short distance to a grocer

\- pantry space for cooking tools and dry ingredients that you don't have to split with roommates

\- the cooking tools themselves

\- the time and mental energy to teach yourself a new skill

\- money to spend on take-out when you mess up a recipe

<comment><USER7> Add to the above

\- live near where you work

Think of all the people that commute 2+ hours in the Bay Area and the stress that goes along with that.

</comment></comment></comment></comment></comment><comment><USER8> For me, this is the most important aspect of this paper:

"People say, 'Americans are living longer, so we ought to delay the age of retirement,' but … it's a little bit unfair to say to low-income people that they're going to get Social Security and Medicare for fewer years because investment bankers are living longer.""

As the divide between the rich and poor keeps growing [1], we need to start doing something about it in all areas, and this seems like a really important finding for that.

[1][http://www.oecd-ilibrary.org/employment/in-it-together- why-l...](http://www.oecd-ilibrary.org/employment/in-it-together-why-less- inequality-benefits-all_9789264235120-en)

<comment><USER9> I'm not 100% against raising the retirement age, but it would be a lot easier on me to work until I'm 70 than, say, a garbage collector or builder.

<comment><USER4> While office work is less demanding in certain aspects, it _can_ be quite destructive in other ways, if you are not careful:

\- circulatory issues (hypertension, due to lack of exercise),

\- obesity,

\- back issues,

\- repetitive stress injuries, etc.

All of these could keep you from working.

Exercise and proper diet are key, regardless of your social status. The problem is that lower-status people usually don;t have the knowledge or don't care.

<comment><USER10> > The problem is that lower-status people usually don;t have the knowledge or > don't care.

Or, just maybe, don't have the money or the free time.

<comment><USER4> Let's not introduce victim mentality here.

\- gym memberships start from $10/month (optional, there are plenty of body- weight exercises you can do outside of gym).

\- running costs nothing (in recurring fees).

\- all you need is 1 hr/day, 3-4 times a week.

It is all _really_ about knowledge and motivation.

I am not saying it is easy, but it has nothing to do with money.

<comment><USER11> 1 hr/day, 3-4 times a week can be an enormous amount of time, especially when you are juggling children, work, and commuting. Higher income people can manage this more easily--often their work hours are more flexible, and the very high income can staff out their child care.

And lower income people are more likely to have jobs that require physical activity to begin with. Exercising is a lot harder if you've already been on your feet all day.

So it is not all about knowledge and motivation and while it may have little to do with money, it has a lot to do with available time.

<comment><USER4> It really varies. Most people I know in blue collar jobs work 40 hours/week and are free to do what they want after 5pm. They don't take their work home. It is usually the "exempt" professionals - lawyers, doctors, McKinsey consultants who work overtime (because they have to or they _think_ they have to).

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> One can wonder how much comes down to poorer people eating junk food, smoking and alcohol abuse.

I've never been that well of, but at the same time I've never afforded to smoke or drink a lot. In fact nowadays I do neither. Makes you wonder how some can being poor.

<comment><USER13> This. A lot of habits that make people ill, also make them poor. I'm well-off but in relatively poor health and don't see how I could "buy" a significantly better life expectancy at this point. Sure, a shorter organ transplant list helps in some cases (not mine though), but that specific advantage can't explain 15 years on average (while smoking alone counts for 10 years or so).

</comment></comment><comment><USER14> "Low-income residents in wealthy areas, such as New York City and San Francisco, have life expectancies significantly longer than those in poorer regions."

That's somewhat surprising. I wonder if the reverse holds - do rich people in poorer regions have shorter life expectancies than in richer regions?

<comment><USER15> Since two replies to this comment suggest the underlying cause might be " less toxic environments, better ecology (less polluted, less crowded areas - <USER2> infections, less harards, etc)" and " better health care", the answer is no.

According to the original paper, life expectancy in the lowest quartile "were not significantly correlated with access to medical care, physical environmental factors, income inequality, or labor market conditions."

[https://jama.jamanetwork.com/article.aspx?articleid=2513561](https://jama.jamanetwork.com/article.aspx?articleid=2513561)

The big correlates seem to be income and behavior (e.g. smoking, obesity).

<comment><USER16> Behavior has to be the biggest. If we look outside the US and populations known for longevity we see exercise and lower caloric correlations.

Looking at studies surrounding exercise, even simply walking 30 minutes every day leads to better quality life in terms of health including preventing cognitive decline. Exercise is also associated with preventing the shortening of telomeres which scientist believe are connected with aging.

</comment></comment></comment><comment><USER17> My argument (currently) is that money can buy a housing location next to your office. Completely removing a commute is a pretty big happiness booster.

</comment><comment><USER18> Or, perhaps, people who have health issues make less money?

Correlation is not causation.

<comment><USER19> Or something else contributes to both income and health (intelligence seems like a good candidate, there's a similar multi year life expectancy difference between the high and low ends).

I wonder how much simply controlling for parents' money and health would make this go away, although that doesn't separate effects from monetary inheritance.

<comment><USER19> Although poverty might affect intelligence (I'm not sure the current state of research. Definitely there's a correlation, but I don't know whether genetics fully explains it or whether we can point a causal arrow from poverty to lower IQ.)

<comment><USER9> Common sense would appear to suggest that, on the whole, lower IQ could be a cause for poverty.

<comment><USER20> Why do we need to study anything at all when we can just rely on our self- serving intuitions?

<comment><USER9> So you think having an IQ below 100 wouldn't hamper you in the job market?

<comment><USER20> Depends on the work; not all work requires you to be a genius. But simply saying it's "obvious" that that must be one of the prime drivers of poverty strikes me as 1) not that obvious at all 2) self-serving

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Having money is strictly better than not having money. This is not something that is in question.

Money doesn't solve all problems in life. However, nearly every problem that exists without money will be no worse with money. The reverse is not true.

</comment><comment><USER22> I think the conclusion can also be read like this:

A social system were everything is for money is deadly for some.

I wonder if the same conclusion can be replicated in countries with more social protections (Scandinavia for example).

</comment><comment><USER23> It is useful to look at the comparison between countries:

\- just static graphics: [http://static.gapminder.org/files/vector- graphics/gapminder-...](http://static.gapminder.org/files/vector- graphics/gapminder-world-2013.pdf)

\- interactive, new data: [http://www.gapminder.org/tools/bubbles#_state_marker_size%2F...](http://www.gapminder.org/tools/bubbles#_state_marker_size%2F_label_extent@:0&:1;;&axis%2F_y_zoomedMin:45.8;&axis%2F_x_zoomedMin:543.53&zoomedMax:140375.09)

\- text: [http://www.gapminder.org/posters/gapminder- world-2013/](http://www.gapminder.org/posters/gapminder-world-2013/)

To be honest, since there is variation between countries (for Russia vs Japan it is ~20 years!) it would be really surprising if there were no variation within countries (especially as uneven economically as US).

</comment><comment><USER24> It would be interesting to correlate this with IQ.

It's well known that higher IQ correlates with greater income. I wonder if higher IQ also correlates with better health.

Even more interesting is if being around people with (on average) higher IQ, correlates with better health by osmosis of sorts, by people picking up good habits from those around them.

<comment><USER25> Yep. And both of those correlations have plausible causations in both directions.

* Higher income -> less likelihood of lead poisoning -> higher intelligence

* Higher intelligence -> more success in job market -> higher income

* Better health as a child -> better brain development -> higher intelligence

* Higher intelligence -> more likely to exercise, eat healthy -> better health

</comment></comment><comment><USER26> This is pretty interesting, given the article about NY's poor being healthier than other poor Americans that was on the front page of HN yesterday [1]. I wonder how much of this can be attributed to environmental factors (long commutes to work, few quality grocery stores, violent crime, etc.) I'm glad there seems to be a fair bit of interest in figuring this mess out.

[1] [http://www.nytimes.com/2016/04/11/upshot/poor-new-yorkers- te...](http://www.nytimes.com/2016/04/11/upshot/poor-new-yorkers-tend-to-live- longer-than-other-poor-americans.html?_r=0)

</comment><comment><USER27> Everybody works hard to make money so they can live longer and better then they realize they forgot to live.

</comment><comment><USER28> People fixate over these tiny things, little differences in the arrangement of deck chairs, as they are dying of a medical condition called aging, that might be controlled and prevented entirely if enough of them stopped fixating on tiny things and started helping to fund rejuvenation therapies.

There are startup companies now, today, working on the first rejuvenation treatments that address one of the actual root causes of aging. Oisin Biotechnologies and UNITY Biotechnology. Look them up, look up the senescent cell clearance methodologies they are turning from labwork to clinical treatment. These therapies will not cost very much when ready, simple mass- produced infusions.

Yet what is in the news and the thing that people pay attention to? Tiny differences in the status quo, who has a better deck chair as the ship is going down.

It is a frustrating thing to be living in the human condition.

<comment><USER29> Didn't you post this exact thing last night?

<comment><USER28> It is an important thing to say.

Among the less attractive aspects of human nature are a fixation with what is rather than what can be, the tendency to limit the definition of success and desired outcomes to whatever the best of the present options might be, and a burning desire to tear down those who have more than you rather than work to create more for everyone. Even in an age of rapid, radical change driven by advancing technology, the vast majority of people focus entirely on the distribution of present assets and opportunities, giving little to no thought to the much larger set of assets and opportunities that we could create for tomorrow.

You see this in the vastly greater attention given to any evidence for distributions and correlations in life expectancy between populations today, and the tiny amount of attention and support given to the production of rejuvenation therapies to greatly increase life for everyone at a modest cost. Given the realization of SENS rejuvenation treatments, the first of which are already under development in startup companies, and most of which will take the form of comparatively low-cost, mass-produced infusions, ten year variations in longevity due to lifestyle choices or access to medicine will be swamped, made irrelevant and small.

</comment></comment></comment><comment><USER30> Note that the centenarian populations of various blue zones are not typically high income - in fact, many of them are members of rural, agrarian communities.

Eat good food, get plenty of exercise, and try to relax and be gracious.

</comment><comment><USER31> This does not surprise me anyone. Richer people can afford better life in general, better healthcare, better spouses etc. etc. It would be a surprise if they dont live longer than others.

</comment><comment><USER32> Another good reason for [https://en.wikipedia.org/wiki/Basic_income](https://en.wikipedia.org/wiki/Basic_income)

</comment><comment><USER33> It looks like Universal Income will not drastically improve life expectancy.

</comment><comment><USER20> Is this news to anyone?

<comment><USER34> While it is an obvious truth, it's nice to have some statistics to back up the notion.

<comment><USER20> Fair enough.

</comment></comment></comment><comment><USER35> Come to Europe. We have cookies.

</comment><comment><USER36> I wonder whether they accounted for suicide. I'd expect the rates to be higher in the rust belt.

</comment><comment><USER37> Correlation doesn't equal causation. I'd bet that an alcoholic millionaire would have a shorter life expectancy than a healthy street sweeper. It isn't money that matters, it's the cultural norms.

<comment><USER38> Indirect causation is still causation.

Two people have heart-attacks in middle age after eating cheeseburgers their whole lives. One of them doesn't have health-insurance, and dies, perhaps having never even received good health advice from a yearly check-up. The other is well-off, and so gets stabilized in the hospital and eventually provided with heart surgery (and a whole load of admonishments regarding lifestyle).

<comment><USER37> As I said before, it's about the cultural norms, which is exactly what you've just described.

For an example showing that money and cultural norms are not necessarily linked, take a look at Ikaria:

[http://www.nytimes.com/2012/10/28/magazine/the-island- where-...](http://www.nytimes.com/2012/10/28/magazine/the-island-where-people- forget-to-die.html?_r=0)

<comment><USER38> What cultural norms? We're talking about two men who made exactly the same _bad_ lifestyle choices. And I know a number of living candidates to be both these guys!

</comment></comment></comment></comment><comment><USER39> Call me a heretic, but a 10-15 years discrepancy at a baseline of 70+ years life expectancy does not sound that scary or problematic to me.

<comment><USER40> With a median yearly household income of $51,939, that's up to $779,085 you only get if you're rich.

<comment><USER41> I think his argument is that you've already retired at that age and it's to be expected that your live will end in a few years.</comment></comment></comment>


Review My App: A Sprite Generator - <AUTHOR> http://quicksprites.com After seeing DHH's keynote at RailsConf and http://37signals.com/svn/posts/2336-using-css-sprites-with-rails-helper-methods, I decided to try and build a better Sprite Generator. I don't want to bias any potential reviewers, so that's all I'll say for now. If this gets a good response, I'll post some further details in a few hours. <comment><USER2> File uploads are terrible.

I was looking for the single textbox where you could paste an URL and the generator would then crawl either that page (or the page and all its subpages) and produce a montage of all images found, along with the corresponding CSS.

Now that would have been not only possible but really simple!

</comment><comment><AUTHOR> After seeing DHH's keynote at RailsConf and [http://37signals.com/svn/posts/2336-using-css-sprites- with-r...](http://37signals.com/svn/posts/2336-using-css-sprites-with-rails- helper-methods), I decided to try and build a better Sprite Generator. I don't want to bias any potential reviewers, so that's all I'll say for now. If this gets a good response, I'll post some further details in a few hours.

</comment><comment><USER3> I wish this could be done server-side.

In Rails maybe you could put all of your images in one directory, as an initializer or on demand it would create a sprite image, and it could automatically handle the rest as well.

</comment><comment><USER4> Your web application looks quick, simple and to the point. I like it!</comment>


The new totalitarianism of surveillance technology - <AUTHOR> http://www.guardian.co.uk/commentisfree/2012/aug/15/new-totalitarianism-surveillance-technology?fb=optOut

<comment><USER2> I have said it before and I will say it again:

A police state is simply a free society where only the police can see the tapes.

We need laws, now, that provide for all forms of surveillance and tracking of humans in public and semi-public locations to be made known, and the (raw) output of the surveillance to be published in real- or reasonable- time.

Only in cases of valid, warrant-backed surveillance should this not apply.

It does not matter that the surveillance is pico-second lasers, big CCTV cameras, GPS phones or whatever else. Make the laws cavier surveillance, tracking and monitoring. Not specific technologies.

After that, of course, hiding your affairs from your wife will become, quite literally, your affair.</comment>


Xp - agile programming tools in Coffeescript - <AUTHOR> https://github.com/Marak/xp

<comment><USER2> For the love of Kernighan & Ritchie, please do not promote this as "a convenience library aimed towards non-expert users." The only way beginners are going to learn is experimenting with the command line, not having their hands held with a tiny subset of what's available.

And the positioning -- what's agile about knowing your public ip or uploading images to imgur? Is this a belated April Fool's day joke I'm not getting?

Ok, now that I'm done venting, here's the *nix equivalents for all but the pair command (will edit in. EDIT: added. also did s/python2/python):

        # base64 is already a command, supports -d

        function imgur_up() {
          curl -F key=yourkeyhere -F "image=@$1" http://api.imgur.com/2/upload
        }

        function public_ip() {
          curl -sL myip.dk | egrep '[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}'
        }

        function sloc() {
          sed '/^$/d' $1 | wc -l
        }

        # no args clears users
        # with args, assigns usernames
        function gpair() {
          if [ -z "$1" ]; then
            echo "Resetting to default user"
            git config --unset-all user.name
          else
            git config user.name "$(echo $@)"
          fi
          echo "User is now: $(git config user.name)"
        }

        function tab_to_space() {
          sed 's/\t/  /g' $1
        }

        function space_to_tab() {
          sed 's/  /\t/g' $1
        }

        function url_decode() {
          echo "$1" | python -c 'import sys,urllib;print urllib.unquote(sys.stdin.read().strip())'
        }

        function url_encode() {
          echo "$1" | python -c 'import sys,urllib;print urllib.quote(sys.stdin.read().strip())'
        }

        function web_serve() {
          python -m SimpleHTTPServer
        }

EDIT: Brought to my attention: <http://news.ycombinator.com/item?id=1448309> =\

<comment><USER3> "The only way beginners are going to learn is experimenting with the command line, not having their hands held with a a tiny subset of what's available."

        function public_ip() {
          curl -sL myip.dk | egrep '[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}'
        }

Do you _seriously_ think that people should have to type that text mess for the sake of "learning?" In fact, except for the sed and base64 commands, I'd say none of these are anywhere near trivial.

</comment></comment><comment><USER3> Truth be told, if anyone actually gets butthurt because xp duplicates functionality found elsewhere, then they're just being silly. People duplicate functionality all the time. In a lot of cases, we just call it "competition."

So, here's a question: I've noticed that the nodejitsu guys usually use Cloudhead's node-static for static file serving. On the other hand, I usually use Connect's staticProvider. Why do they use node-static over staticProvider? Also, can node-static be used as Connect middleware? Given that fileServer.serve seems to take "req" and "resp" arguments it would seem so, but I also see it being used with the stock http interface in all the examples.

<comment><AUTHOR> node-static can be used as a "middleware". Here's an example of it being used in Stack: [https://github.com/Marak/bugger/blob/master/lib/stack/static...](https://github.com/Marak/bugger/blob/master/lib/stack/static.stack)</comment></comment>


Russia Tries to Get Smart about Artificial Intelligence - <AUTHOR> https://wilsonquarterly.com/stories/russia-tries-to-get-smart-about-artificial-intelligence/ <comment><USER2> They should get smart on the environmental effects of that Nuclear Missile that the US deemed too crazy to continue funding back in the 1960s. Project Pluto</comment>


Blogs Are Godless Communist Bullshit - <AUTHOR> http://gilesbowkett.blogspot.com/2009/12/blogs-are-godless-communist-bullshit.html <comment><USER2> I liked this post quite a bit, but I think that essentially what he's complaining about is that bloggers write from their own perspective. That's the whole point of blogs, isn't it? They're one person's voice?

<comment><USER3> He is also warning that their perspective can be misleading. Like saying that Stack Overflow participants are the best developers on the planet, for example.

</comment></comment><comment><USER4> Hilarious and biting. Well worth reading through the whole thing.

</comment><comment><USER5> _Paul Graham, the great grand-daddy of feeding bullshit to impressionable young hackers for the sake of recruiting_

Had to laugh at that one :)

</comment><comment><USER6> excellent post, thanks for sharing... what the post fails to zero in on (at least state directly) is that all of these people are simply marketing. is all marketing bullshit? i dunno, but that's what these guys are all doing...</comment>


Juniper: GraphQL server library for Rust - <AUTHOR> https://github.com/mhallin/juniper <comment><USER2> This looks nice.

> GraphQL turns the REST paradigm as it's usually implemented on its head: > instead of providing a fixed structure of all types and relations in the > system, GraphQL defines a schema which your users can query.

I have no idea what that means.

<comment><USER3> It doesn't mean anything, at least not anything correct.

REST defines media formats, and the relationships are described by hyperlinks in the media.

GraphQL is much the same in that it has a relational schema.

The difference is that GraphQL has filter and join capabilities. Vanilla REST is usually all-or-nothing for a resource.

<comment><USER4> The writer "meant it to mean" that, given a static REST-backend codebase, there will essentially be a static set of message schemas that will flow over the wire. (In "really dedicated to HTTP principles" REST, these are each indicated with their own application/vnd.org.example.barapp.v1.foo- message+json media type.) You could write C client with a `struct` definition for a given message type, and said code would never break, because a message of a given type always has that schema.

GraphQL, meanwhile, allows the user to specify the "shape" of the result they want, by specifying what fields or associations they want to be included in the result—but these can also be _parameterized_ , and the accessor-function that receives the arguments is free to do anything it likes with them, instead of just using them to _select_ an association or field to pass back. It's effectively equivalent to the ability, in SQL, to do "SELECT arbitrary_function(field) AS column".

There's no way to create a compile-time static type, especially on the _backend_ , which could hold the response to an arbitrary GraphQL query. (Or, equivalently, you can think of a GraphQL response as being a tree of widely- product-typed fields, similar to modelling a decoded JSON object in a statically-typed language.)

<comment><USER3> > There's no way to create a compile-time static type

Aren't you just saying that one GraphQL query corresponds to several REST requests?

There is the same level of typedness between an arbitrary GraphQL query and an arbitrary set of REST requests.

<comment><USER4> It's somewhat hard to communicate my exact thought here... in REST, a given verb applies an operation to one resource, and a given resource has a known- at-compile-time representation, where the schema of the returned representation should have a domain that depends only on the referred-to resource itself—i.e. the request path—where the client picks from that domain using the Accept header.

A GraphQL query, meanwhile, can include parameterize associations—essentially _function calls_ —and these calls can have _non-deterministic return types_. I.e., you can't create a static set of types to describe the shapes a GraphQL response might take, because there is a non-finite (push-down automata number of states rather than FSM number of states) number of possible types to the value that the function might spit out.

Or, to put that _another_ other way: there's no way to receive a GraphQL response without the ability to dynamically allocate memory. You can't say "I want a response of exactly this shape" and then stream the decoded response into e.g. a protobuf. Because the client has no way of saying to the GraphQL parser, "don't vary your schema here."

For GraphQL to be a proper "kind of" thing to use with HTTP, each association in the request would have to be able to take its own Accept-header-alike attribute, so that the client could ensure that if a response is produced, it is of a defined shape.

<comment><USER3> > there's no way to receive a GraphQL response without the ability to > dynamically allocate memory

You can allocate a fixed amount of memory for a particular GraphQL response.

You can allocate a fixed amount of memory for a particular REST resource.

You cannot allocate a fixed amount of memory for an arbitrary GraphQL query.

You cannot allocate a fixed amount of memory for an arbitrary set of REST resources.

So...I agree with what you are saying. _At the the level of a single HTTP request,_ there is more dynamism in GraphQL. But that's not a deep distinction; REST just presents that dynamism at a level above a single HTTP request.

\---

Note: it is common for people to define sets of REST requests with function calls, but write GraphQL queries in a string. If you defined your set of REST requests in a string and wrote your GraphQL queries with function calls, you'd see many observations reversed.

<comment><USER4> To be clearer, what I was saying is that you can't _predict_ how much memory you'll need to allocate for a GraphQL response _given_ the particular query you've made, because there's no way to get the server to give you a guarantee that all the field types are scalars or length-limited strings (or arrays of known-typed maps whose members are all scalars or length-limited strings, etc.)

In REST, you can, by Accept-ing only media-types that guarantee such a condition. But there's no way to _annotate_ the "function calls" [field- accessors-with-attributes] that appear within a GraphQL request, to force the GraphQL backend to act in a similar way to a web server with regards to media types of associated fields. You can't say "for this response field, I only Accept these types", and then have the GraphQL backend realize that its response would be unwanted and throw away its work, sending back a 406 error instead.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> At least now the NSA backdoors will be safe from memory corruption bugs.

[https://arstechnica.com/security/2016/01/juniper-drops- nsa-d...](https://arstechnica.com/security/2016/01/juniper-drops-nsa- developed-code-following-new-backdoor-revelations/)</comment>