Mit.edu is down - <AUTHOR> http://www.mit.edu/ <comment><USER2> Hi there! We know MITnet is down, and we're pretty sure its an issue with BGP. We've been having issues periodically over the past few weeks, and this is almost certainly not the result of an attack, just network misconfiguration.

\-- Luke from MIT SIPB

<comment><USER3> Is there a particular reason why Google servers are still accessible from within MIT despite MITnet being down?

<comment><USER2> Google peers directly with MIT, so connections there do not have to go to the public internet.

</comment></comment></comment><comment><USER4> MIT's name servers are all on their own network? Seriously?

      ;; AUTHORITY SECTION:
      mit.edu.              172800  IN      NS      bitsy.mit.edu.
      mit.edu.              172800  IN      NS      strawb.mit.edu.
      mit.edu.              172800  IN      NS      w20ns.mit.edu.

      ;; ADDITIONAL SECTION:
      bitsy.mit.edu.                172800  IN      A       126.96.36.199
      strawb.mit.edu.               172800  IN      A       126.96.36.199
      w20ns.mit.edu.                172800  IN      A       184.108.40.206

<comment><USER5> MIT owns the entire 18. /8 subnet.

[1][http://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addres...](http://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks)

</comment></comment><comment><USER6> From here in the Midwest USA, here's the last few lines of "mtr mit.edu --report":

      16.|-- ae-1-8.bar2.Boston1.Level 90.0%  10  83.3  83.3  83.3  83.3  0.0
      17.|-- ae-0-11.bar1.Boston1.Leve  0.0%  10  84.5  84.0  82.5  85.0  0.7
      18.|-- ae-7-7.car1.Boston1.Level  0.0%  10  83.1  83.9  81.8  92.9  3.2
      19.|-- MASSACHUSET.car1.Boston1.  0.0%  10  85.1  83.7  82.3  85.1  0.9
      20.|-- DMZ-RTR-2-EXTERNAL-RTR-1.  0.0%  10  89.9  88.8  86.1  94.2  2.9
      21.|-- ???                       100.0  10   0.0   0.0   0.0   0.0  0.0

(the full name for the last listed host is "DMZ-RTR-2-EXTERNAL-RTR-1.MIT.EDU")

</comment><comment><USER7> Traceroute to web.mit.edu (previously 126.96.36.199) dies after a Level 3 router in Boston. This isn't just DNS, although _both_ MIT.edu and DoJ.gov are returning NXDOMAIN right now.

Justice.gov and USDoJ.gov are functioning normally, though.

<comment><USER8> I can't even ping them. MIT has _huge_ pipes to the Internet. Someone has to be throwing a lot of bandwidth at them from very very close to choke them off, or has specifically attacked their routers.

</comment></comment><comment><USER9> Very disappointed if it's DDoS. This doesn't feel like the time for it.

</comment><comment><USER10> Is this the result of some kind of organized DDoS (Anonymous or some other hacktivist group), or merely a coincidence given their recent exposure re: aaronsw?

<comment><USER11> It's back up now, so if it was a DDoS it was a pretty ineffectual one (time between post and this comment is 20 minutes).

<comment><USER12> All .mit.edu domains I've tried appear down (stellar, my fraternity, etc)

</comment></comment></comment><comment><USER13> MIT's been having serious intermittent network problems over the past two weeks, although usually not a complete outage from all parts of the Internet (there were several points last week where it was reachable from Internet2 but not from a handful of residential ISPs). I have no knowledge here, but at this point I'd be more likely to credit some router somewhere sucking than Anonymous with doing anything.

</comment><comment><USER14> <https://twitter.com/Join____Us/status/290623433191092224>

</comment><comment><USER15> Looks like a DNS attack? Lack of name resolution vs. server response?

<comment><USER16> Lack of both --- the nameservers are unreachable, but so is everything else. (MIT apparently hosts its own DNS, but attempting to ping internal servers by IP address, bypassing DNS, also fails.)

</comment></comment><comment><USER17> I was very surprised to see that when mit.edu went away, we also lost emergency.mit.net.

</comment><comment><USER18> The site is back up</comment>


How I scaled Postbacks.io to send over 250k HTTP requests per minute - <AUTHOR> https://medium.com/postbacks/why-i-created-postbacks-the-callback-scheduler-72d47ac3d93c <comment><AUTHOR> Hi all, I recently launched Postbacks.io to solve a unique problem I encountered with another startup. I simply wanted to receive a callback at a particular time (not recurring) so I could run some task. In my case, this was sending a postcard when a user chose to do so.

Please leave any feedback you have! I'd love to hear how you could use this, or what needs to be improved.</comment>


YC S17 Rejection/ Acceptance - <AUTHOR> Hi Guys,
Wanted to know if you are seeing some activity on this front? I believe some international candidates are being scheduled for a Skype pre-interview.
I know this is a cliched, irritating and usually useless discussion that must be common every year :-) But can't help asking given an early answer can help us with some pending decisions.
Let me know in case you know about something.
Thanks in advance, Vardhan <comment><USER2> PRACTICE INTERVIEWS. What teams would like to do some practice interviewing together by phone? Each team interviews the other, and gives feedback, etc?

</comment><comment><USER3> We got a pre-interview where one of the YC partners asked some questions about the business model, so we were optimistic, but got a rejection letter today. For those of you who got an interview, congratulations! Good luck with your interview, but just in case it doesn't work out, check out this group which is thinking about setting up a Demo Day after the YC demo day for those who didn't make it: [https://news.ycombinator.com/item?id=14144922](https://news.ycombinator.com/item?id=14144922)

<comment><USER4> We're all in!

</comment></comment><comment><AUTHOR> Hi Guys,

Apparently, some invites have been sent already. Please follow the discussion on this newer thread on the topic:

[https://news.ycombinator.com/item?id=14137867](https://news.ycombinator.com/item?id=14137867)

</comment><comment><USER5> We're based in San Jose and had a pre-interview this morning (invite was on Sat). Mostly questions clarifying things from our application and further understanding of the product. Not sure if that means we will get a real interview invite or not...

</comment><comment><USER6> We had a pre-interview yesterday (we're based in Norway). Got the invitation On Tuesday I think.

<comment><USER7> Hey.. how many views did u get on your video? Did u already get the final invite? What was the pre interview all about?

<comment><USER8> Dont worry about the view count. They have said that thier software does not play well with YouTube view counters.

Best of luck to everyone!

</comment></comment></comment><comment><AUTHOR> The application page says that the invites are already sent. So those who did not receive it probably didn't make it this time. All the best folks!

<comment><USER9> I do not believe this to be true. It has always stated "Invites Sent" on April 18th.

</comment></comment><comment><USER10> Has anyone applied just a few days late in the past? Any idea how much later than the deadline one would hear back?

</comment><comment><USER7> Hey, Did anyone get any views on founder or demo video?

Also will they interview all possible international candidates through skype first?

<comment><USER11> We got 6 views on both. Didn't get any invitation for pre-interview and we're based in Hungary.

</comment></comment><comment><USER12> Anyone got accepts or rejects? Or is it just pre-interviews?

<comment><USER13> Not yet. As soon as I receive news I'll let you know!

<comment><USER12> thanks sir!

</comment></comment></comment><comment><USER14> Mind sharing idea or who got pre-interview?

</comment><comment><USER15> Hi all!! Any news so far?

<comment><USER16> Inside Startup School's chat they said: "Please keep waiting, emails go out by April 18th".

That's all. It could mean midnight Pacific time though...

<comment><USER15> Thanks!! We'll keep waiting then! Do you know if we're supposed to receive an email even if we're rejected?

<comment><USER16> As far as I know yes, you'll get an email either way.

<comment><USER15> Cheers!! Good luck!

</comment></comment></comment></comment></comment><comment><USER12> anyone else heard anything yet?

<comment><USER17> No, did you hear anything?</comment></comment>


Too Many 12mos - <AUTHOR> https://sarahwerner.substack.com/p/too-many-12mos <comment><USER2> If like me you have no idea what's going on here, it seems to be about book binding techniques/layouts. Just to save a few minutes of "what even is this?"

<comment><USER3> From what I gathered it's not about binding per se but the way to get from one _sheet_ (the large paper you're printing on) to whatever format you're targeting, and that for the duodecimo (where you get 12 leaves / 24 pages out of a sheet) there is a "standard" imposition but the author found a "non- standard" one which they discovered by having a book with uncut "conjugates" (where two leaves are connected elsewhere than the spine, so you have to cut them apart to read the book) at unexpected positions.

In both you cut out and fold a strip of 4 and a strip of 8 (2x4) from your sheet in order to get 12 leaves. In the "standard", you then put the folded strip of 4 _inside_ the strip of 8 (so when you enumerate the leaves from start to end you get the origins 8 8 8 8 4 4 4 4 8 8 8 8).

In the "non-standard" imposition — which the article says is mostly italian — you put the folded strips together in reverse (8 inside 4) so enumerating the leaves from start to end your origins are 4 4 8 8 8 8 8 8 8 8 4 4.

The article notes that you can also put both folded strips side by side (8 8 8 8 8 8 8 8 4 4 4 4 or the reverse) but then it's a bit awkward to bind as you get two groups instead of a single coherent one.

</comment></comment><comment> 52-6F-62 Weird. I took a course on Book History at U of T and I don't think we even covered 12mo.

Or I just plain forgot, or figured "why bother"... both of which are also as likely.

I used to run a couple small prints for my own amusement and don't think I ever ventured outside of quarto or ocatvo, but also probably because of the format of the paper I was using.

Interesting post.

</comment><comment><USER4> Re: the quirkiness of duodecimos, it seems like it'd be straightforward to fold it widthwise into thirds, then lengthwise into quarters, no? The first step there is pretty common for letterfolds, and the second step seems like it'd be common for sextodecimos.</comment>


Why would one choose GCP over other cloud providers? - <AUTHOR> http://www.xmsxmx.com/gcp-advantages-benefits-over-aws-azure/ <comment><USER2> If you really need their walled garden services perhaps.

Personally I feel like AWS has forever poisoned the well for me on those but I get the appeal.

<comment><AUTHOR> Every provider has their own walled garden. Several offerings just tie companies to the vendor. For example, with AWS - services like ECS, EKS or even Redshift go very well with the AWS ecosystem. Try getting data into Redshift for example.

</comment></comment><comment><USER3> No noisy neighbours.

</comment><comment><USER4> Counterpoint "GCP documentation is terrible" Example: Today I was auditing GCP firewall rules for a client. It's sort of hard to find orphaned rules so I asked on stack overflow. A kind Googler replied, "it's not built in but I whipped up this thing in node to do it". Great! So I clone his example code, install the deps, gcloud auth at the command line and run it. Oh no! auth failed. "Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the cloudasset.googleapis.com. ...Use a service account. [https://cloud.google.com/docs/authentication/"](https://cloud.google.com/docs/authentication/")

Great, I read that document. Big, long wordy thing. Nothing about service accounts. I see this other one in there that looks promising. [https://cloud.google.com/iam/docs/overview](https://cloud.google.com/iam/docs/overview) No dice, but I do see mention of service accounts in the nav bar. [https://cloud.google.com/iam/docs/service- accounts](https://cloud.google.com/iam/docs/service-accounts) Close, but ultimately not what I need, try two more. Now I'm 5 documents deep and I'm honestly wondering what I'm doing.

I finally piece together that I need to create a service account explicitly grant it a role download credentials export the credentials location

How hard would it be to write that in one place and call it something like "How to use service accounts (and why)"

But wait! It still doesn't work, gotta activate the Cloud Asset API (have you ever tried to use an AWS service and failed because the something something api wasn't active yet? No you haven't) Ever run into an api usage limit? That's a fun one. Imagine that api is the one you're using to report problems with your production cluster. Good luck getting that fixed in a reasonable period of time. I ended up just waiting 24 hours for it to reset. But I digress.

Ok, so I do all that. Only to figure out that's not quite what I need so now I'm chaining together some gcloud commands, filtering output, making tables, sorting in vi.

I wind up with a 192 line spreadsheet and a lot of manual work remaining to work through them all. Maybe this stuff is available in the Google Security Center, but I can't see it because it's helpfully hidden under the organization permissions not the project permissions. Great.

You know how you do this on AWS? This very important security thing that you should do quarterly if not more often? You click on trusted advisor, it shows you the unattached security groups you can safely delete, it advises the ones you should lock down. Done.

Don't get me wrong, Google network infrastructure is generations ahead of AWS. But it's all useless if you can't get it working right and GCP documentation is worse than nothing at all. So good luck getting things working right.

Also when things are just a bit more complicated the odds are good that even smart, capable people will screw something up (yes I found some problems during my audit today, no I don't think those problems would have been there if the client had deployed on AWS or Azure)

In conclusion think twice before choosing GCP

<comment><USER5> Oh lordy. The GCP docs. I straight up ignore them most of the time and just search for relevant guides elsewhere. So much of what Google puts up is marketing fluff, high-level descriptions, or at best a description of the happy-path to doing something.

The most galling thing is GCP support. I'm on a team which pays for google support and it is by far the most lax, useless nonsense I've ever encountered. They are literally no help.</comment></comment>


Clicking Facebook "Like" Buttons Gives Owner Permission To Spam You (w/ demo) - <AUTHOR> http://www.bingocardcreator.com/articles/facebook-like-button-spam

<comment><AUTHOR> I mentioned this the other day in a comment, but I figured it gets a lot more visceral punch if you actually see it happen, so I wrote up the consequences in an article and wired together a working tech demo. I haven't seen anybody exploit this misfeature "in the wild" yet, but then again I'm not exactly plugged into the social networking scene.

It _astounds_ me that somebody thought making the Like button be silent opt-in to "permission" marketing was a good idea.

Added bonus points (not covered in article): this creates a security hole in every Liker's account, because it slaves the security of their News Feed to the security of _every site they have ever liked_. Pretend you like something published by Scrappy Startup A. Six months pass. Scrappy Startup goes out of business and their URL gets grabbed, or Scrappy startup gets their server owned, or Scrappy Startup merely permits defacement of the contents of their HEAD. This lets the attacker immediately assert publishing privileges for all connections created by Likes (6+ months ago), and then spam the connected Facebook News feeds with live URLs carrying an endorsement from Scrappy Startup.

Now pretend Scrappy Startup is, or purported to be, Obama. (Thumbnail sketch: you and 10,000 other people favorite a picture of Obama hugging two puppies titled "Obama Gives Constituents a Lift", six months later the Facebook login crowd sees "Obama Gives Constituents a Lift: Click here and put in your bank account details to receive your instant stimulus package".)

<comment><USER2> I'm a bit surprised that you published this to your bingo blog and not Kalzumeus.com. Aren't you worried about your stereotypical user clicking it by accident?

<comment><AUTHOR> The only way in is via direct link to that URL. I put it there because I happened to have Rails code written to do most of the work here (back from when I implemented Like buttons for the site, prior to understanding what they actually do), and because I'm positive Nginx can take the load (it is 100% static content after the first access) but less than sanguine about my Apache setup.

</comment></comment></comment><comment><USER3> Maybe I'm missing something here, but this seems like much ado about nothing. I mean, I get it, if I "like" something then that site now has the ability to leave me messages. I just don't see this as much different than following someone on Twitter - once I follow them, they have the ability to DM me all they want (until I unfollow anyway).

 _Liking anything lets the owner spam you._

This just sounds like a scare-tactic to me. That's like saying "following anyone lets the owner spam you", or "emailing anyone lets the owner spam you".

I guess the real point here is to only "like" things that you trust. Just as I won't start following shady looking accounts on Twitter or handing out my email address to every website I visit, I won't "like" shady looking websites.

<comment><USER4> I certainly wouldn't _expect_ that kind of side effect at all, but maybe it's because I'm used to having a greater degree of control over who gets a claim on a slice of my attention. For me "like" is not a binary concept -- either you like it or you don't. I might like something enough to put it in my bookmarks, but that doesn't necessarily mean I'll want to recommend it to all of my friends or subscribe to its RSS feed. If signaling that I like something will automatically imply "subscribing" to it, then I'd like to be informed about it beforehand.

<comment><USER5> >For me "like" is not a binary concept

We're not talking about like the English language word we're talking about "like" the Facebook specific action indicating that you wish to be associated with a particular page of content on that site.

<comment><USER4> See, this is why computer applications keep failing "average" users: "Stupid users, why didn't they RTFM? Had they done that, they would have realized that Facebook's definition of the word 'like' is drastically different from the English language word they use every day."

</comment></comment></comment></comment><comment><USER6> I'm confused. Hasn't this _always_ been the case when you 'Like' (previously 'Become a Fan' of) something? Pages I became a Fan of well over a year ago (maybe longer!) have been publishing updates to my stream ever since. (The ones I don't want to get updates from have either been removed or blocked.)

The Page-to-User relationship is absolutely no different than the User-to-User one. By becoming Friends with someone, I'm letting them publish as frequently as they'd like to my stream. They can spam me if they want, and if I don't like it, I can block/remove them.

Saying that 'Like' buttons give Page owners permission to spam you is grossly misleading, and leaves out several important pieces of information that allow one to understand what is actually going on.

<comment><USER7> Yeah, it's always been the case. It's annoying when you don't realize it, but it's the kind of mistake you make only once.

</comment></comment><comment><USER8> I'm sorry to hear that this behavior was a surprise to you- Perhaps FB could do a better job at making it clear what this does, but to me this was always the expected (and desired!) behavior.

The Facebook "Like" button is akin to "Follow" on Twitter. It subscribes you to their feed. That's the whole POINT of the like button. The "Tell your friends" is ancillary; It's akin to twitter telling your feed "Colin is now following .... CocaCola"

It's a VERY useful feature, and the name makes sense to me; If you Like AntelopeFurniture.com, and they have a new sale running or something, you'd want to hear about it. You already said you like them ;)

With that understanding in mind ("Facebook:like == Twitter:Follow"), it starts to become clear that seeing their posts isn't spam- It's the entire point!

<comment><USER9> > _The Facebook "Like" button is akin to "Follow" on Twitter_

It doesn't "sound" like it to me ... I thought that when I pressed "Like" I simply got counted, nothing more.

And since when in English ... Like =~ Follow? Sure, maybe for maniacs.

<comment><USER5> >And since when in English ... Like =~ Follow? Sure, maybe for maniacs.

If you're going to be pedantic about made up web-2.0 (3?) terms then why not argue that "follow" on twitter doesn't let you actually follow the person only receive occasional messages from them.

Why don't they call it "receive occasional messages from"? There's your answer.

<comment><USER10> It is straight out ignorant to say follow doesn't imply you'll be interacting in the future with that person/company. Like (in itself) is an action verb that implies approval of the subject matter, not interaction. I like articles on HN (by up voting) but that does not mean I want to receive regular updates from the site due to a singular approval of one piece of content.

<comment><USER5> >It is straight out ignorant to say follow doesn't imply you'll be interacting in the future with that person/company.

Follow as a natural word is one-way relationship - you follow someone else, they don't have to take any action. It's thus not interaction. Nor is it a word that requires a continued future action; "following" would do that. I'm not sure there's a good word for the type of relationship you're [wrongly IMO] saying "follow" implies, perhaps "liaise" or "apprentice" is close?

<comment><USER11> On the contrary, follow specifically does refer to a continuing future action.

"Follow that cab!" doesn't mean just for one block. You expect the driver will follow that cab until you tell him to stop following it.

To agree with you, however, the cab being followed need not be aware of your continued future action. They can speed up, slow down, stop, U-turn, do whatever they would do if you weren't following them. To your point, "follow" is not "interactive". It's active for you, passive for the one being followed.

It's therefore the perfect word for Twitter's button.

</comment></comment></comment></comment></comment></comment><comment><USER12> This really doesn't seem like a big deal. You can click the 'X' next to the spam to end it forever. If a certain publisher is getting removed frequently, Facebook could block them from posting to anyone's news feed. I doubt this functionality will negatively affect many people unless Facebook fails to police it properly.

</comment><comment><USER13> Seing that there's this "Mark as Spam" functionality, I would guess that Facebook would quickly revoke the spammers ability to add like buttons to their page once enough people clicked that spam button (or even make any further business with Facebook)

IMHO, not that big a deal. Then again, I don't use Facebook, so I can't really know.

</comment><comment><USER14> I clicked it and haven't gotten my note yet... By "spam", I think you're saying they can put something into my news feed, right? If this opted me into email communication or even facebook messages, I might be alarmed. Related: I generally trust things that I "like" to behave in a polite way... And know that if they don't they are going to quickly eat a social media backlash.

I can see some nice ways this could be used-- for example-- I "like" Bingo Card Creator and you say, "Thanks Tony! I see you just bought your copy of BCC a few days ago. Holler if I can help!"

I agree that this is an odd/dumb thing for FB to do, but I'm not sure it's that scary.

<comment><USER15> Kind of agree; also, I'm just not as possessive of my Facebook feed as I am of my mail spool. I really don't feel like I own my feed. Also, Facebook acts against its own interests if they allow random sites to pollute the feed.

<comment><USER16> I have to agree that it's against Facebook's own interests. If they let random sites spam away, then pretty soon it will turn into MySpace, and competitors will eat its lunch.

</comment></comment></comment><comment><USER17> I would argue this already being taken advantage of (though 'exploited' seems a bit strong). There are pages such as this one: [http://www.facebook.com/pages/96-percent-of-people-cant- figu...](http://www.facebook.com/pages/96-percent-of-people-cant-figure-out- how-this-is-real/145455405484685) that require the user to 'like' it before they can see whatever it is.

It would be interesting to see what sectors are targeting this new spam avenue. Facebook's anti-spam approach is largely effective though -- as a centralised service they have a lot of behaviour metrics to characterise misbehaviour.

</comment><comment><USER18> I think the problem is simply in the name of the button.

I ran this by some of my less technical friends who use Facebook and they said some variation of " _yes, that's what it's for isn't it? It's just got a confusing name_ "

Something like "Follow" would be more descriptive.

EDIT: the problem stems from Facebook trying to switch from being a "person- to-person" social network to a Twitter-esque community network.

</comment><comment><USER19> Wow... I wonder how far we are from having a marketplace for widely Liked sites to sell their ability to post to their audience. (Unsavory startup idea!)

<comment><AUTHOR> Given that widely _linked_ sites are frequently bought after being abandoned and used by spammers (for link equity and direct traffic), I don't think that is far fetched at all.

A startup can reasonably achieve a metric truckload of likes (to the startup, to content, whichever), fail to achieve revenue, and fold in an N month period. The assets of a failed startup are worth close to nothing, and can probably be acquired for close to it. (Who at a shuttered company is in charge of re-registering the domain name, after all?)

All you have to do is one blaze-of-glory phishing scam, or something like "Save Twitrliciously! Donate $5 to help keep us open!", etc. (Not a unique risk, given that you could do that with just the web page, but it gets you instant distribution to a highly targeted audience and that is 90% of the battle.)

Facebook getting the memo and shutting down the site N hours later does not necessarily help all that much.

</comment></comment><comment><USER20> If users would actually understand it, it might actually make for interesting behavior. It would raise the price of Likes.

</comment><comment><USER21> Is the publishing of updates automatic? As in if a user 'likes' a blog page and the blog publishes a new article, does that new page get pushed into the user's news feed automatically? Or does the blog have to do something extra to keep pushing updates?

</comment><comment><USER22> I clicked the like button and I don't see any kind of notifications.

<comment><USER23> If you have Facebook Mobile (iPhone or Android) check there -- I'm not seeing it on the web but it took over my mobile news feed.

</comment></comment><comment><USER24> This was obvious during the conversion of random lists and groups into data- ized Like graphs. They made it known this was possible. That's why I saw the blip from Futurama when they post a clip from their new episode, etc...

It's intended, and for all intents and purposes, desired. If you don't want to see the New Items from a band/artist/website, don't like it.

Not sure what was expected.</comment>


Infinite Noise true random number generator - <AUTHOR> https://www.tindie.com/products/WaywardGeek/infinite-noise/ <comment><USER2> John Denker wrote a page on RNGs, [http://www.av8n.com/computer/htm/secure- random.htm](http://www.av8n.com/computer/htm/secure-random.htm)

 _" There is no algorithm that can generate entropy. Therefore any HRNG depends on input from some hardware device. It is necessary to calibrate the input device. For example, the entropy available from a soundcard depends on the input impedance, gain, bandwidth, and temperature. Calibration is not easy. It requires skill in a number of areas, including physics, electrical engineering, programming, and cryptography. However, just because it is hard is no excuse for skipping this step.

... My favorite proverb of all is the one that says for every proverb, there is an equal and opposite proverb. In this case, we should note that the proverb about not putting all your eggs in one basket is not necessarily a sound engineering principle. The right answer depends on the margin of error and on the per-basket failure rate. It also greatly depends on the chance of correlated, uncorrelated, and anti-correlated basket failures. Sometimes the best way to get your eggs from point A to point B is to put them all in one basket and take really good care of that basket.

... The phrase "random number generator" should be parsed as follows: It is a random generator of numbers. It is not a generator of random numbers."_

<comment><USER3> Obligatory quote: [http://dilbert.com/strip/2001-10-25](http://dilbert.com/strip/2001-10-25) \- "9, 9, 9, 9... -Are you sure that's random? -That's the problem with randomness: You can never be sure."

</comment></comment><comment><USER4> The article has a "drive-by" disparagement:

       Intel's DRNG appears controllable through
       a software based power droop attack

If true, this is big news. I did some quick Googling and couldn't find any confirmation.

Anybody have a link to the potential flaw in Intel's RNG?

<comment><USER5> I tried to google Atmel backdoor and I didn't find anything...

</comment></comment><comment><USER6> I've always wondered why TRNG like this one were not included in computers already. I know modern CPU also take advantage of physics phenomena (supposedly), but still...

Cool product, and great execution.

<comment><USER7> The problem is that it's pretty much impossible to verify that a supplied RNG is actually a secure RNG and isn't backdoored.

<comment><USER8> That's not entirely true. You can mix the entropy of the hardware RNG with other entropy.

And interesting thing about entropy is you can never make it worse - you can never reduce entropy by mixing in an independent stream from elsewhere. (A dependent stream is different, it might cancel out something else.)

So you can still use the hardware RNG without hurting anything, unless you think it's so sophisticated it's able to figure out your other sources of entropy and exactly cancel them out.

<comment><USER7> That is true _in the case of independent sources_. But a backdoored RNG is probably not an independent source!

<comment><USER9> See, for instance, [http://blog.cr.yp.to/20140205-entropy.html](http://blog.cr.yp.to/20140205-entropy.html) for a writeup by djb on a possible way to exploit this in practice.

<comment><USER8> You oversell the "in practice" part. That is not in the slightest possible in practice.

His writeup assumes the attacker knows everything about the way the random stream is generated. But a mass market CPU would not be able to do that.

<comment><USER7> It doesn't need to.

Even a simple "replace a RNG xor a register with <backdoored RNG>" in the microcode would catch almost everything. And remember - microcode updates happen all the time, and are not open. It's entirely possible that the microcode is updated in response to the type of RNG verification - in other words, with the attacker knowing everything about the way the random stream is generated, as you say.

<comment><USER8> I was not able to parse your sentence in quotes, so I can not reply to it.

It seems like you think the random stream is generated mathematically. It's not, it's based on various timing events, mouse movements, keyboard, etc. A mass market CPU would not be able to handle any of that.

You could always get the CPU random number first, then the external randomness - it would have to predict the future to do anything about it.

> the microcode is updated in response to the type of RNG verification

Hu? I don't understand what you mean. What RNG verification? You would have to tune to the microcode to the specific version and settings of the OS getting the random data, including which hardware was attached.

You massively underestimate how hard this would be. Yes, perhaps the NSA could do it for a single well known adversary - maybe - I doubt it, but maybe. But it would certainly be impossible in mass.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> This is an aside, but I'm curious why the noise in the reverse voltage of a Zener is preferable to just the Gaussian noise generated by a resistor. There must be a practical reason.

<comment><USER11> The reverse breakdown voltage is all over the place due to avalanche effects. You might get as much as 50 mV of pure noise out of a single Zener junction if you're lucky and it won't take much amplification at all (which might negatively affect your randomness) to get to a level that you can quantize easily. You could even do it un-amplified with the right biasing.

</comment></comment><comment><USER12> The other day I tried to snap photos from my webcam with my finger obstructing the objective. I looked at the files in binary and it was apparently always different (the image itself looked visually always the same though : full black).

I made a hash of an hundred files made this way and could not find any collision.

Could this be considered as a TRNG?

<comment><USER13> Yes, I know there have been projects that try to use this as a source of entropy:

[https://medium.com/the-physics-arxiv-blog/quantum-random- num...](https://medium.com/the-physics-arxiv-blog/quantum-random-number- generator-created-using-a-smartphone-camera-602f88552b64)

</comment></comment><comment><USER14> From a full-system threat analysis standpoint this seems like a truly bad idea. You think you have some kind of fancy rng but actually what you have is an rng that your adversary can sneak in and swap out with an infinite generator of zeroes while you're in the bathroom of the airplane. Essentially you've made yourself way more vulnerable to rng attacks than you would have been with a regular entropy source. If you bought one of these you'd have to be totally committed to keeping it on your person at all times.

<comment><USER15> Maybe the driver can verify that the real thing is there.

<comment><USER16> Indeed, they say that it looks for a deviation from expected random noise.

<comment><USER7> ...So someone replaces it with known random stream. Or, say, a known PRNG.

</comment></comment></comment></comment><comment><USER17> I can't think of any use case for this that you can't already get with hardware random number generators that computers have built-in. For most people TRNG's are only useful for things like generating keys and such, something that not much entropy is needed for. Typing in random letters and hashing them would suffice.

<comment><USER18> > Typing in random letters and hashing them would suffice.

That seems pretty iffy to me. Humans are _really_ bad at generating randomness, and the entropy from "randomly" typing letters is going to be far less than you think. It's better to go with hard drive and network latency, or the least significant bits of keypress times, which are far noisier than which keys were pressed.

</comment></comment><comment><USER19> > This USB key RNG also demonstrates what I feel should be considered best- > practices for TRNGs. It is low cost, reasonably fast, and has no firmware > that can be used to PWN your computer. The USB key can easily be taken apart > (with care!) using a toothless dinner knife, so the board can be compared to > those on the github site.

It's interesting to compare to another well known USB RNG, the Simtec's Entropy Key[1], which apparently is no longer available. The Entropy Key takes the opposite approach both on firmware and on easy of taking it apart.

Here's an overview of how Entropy Key worked (more detail on the "technical" tab on their site). They have two separate reverse biased PN junctions generating random streams. These streams are each tested using Maurer's universal statistical test for random bit generators, and their entropy is conservatively estimated. If the test fails or the entropy is too low, it is a fatal error and the device stops sending random data to the host, and reports an error.

The two streams are also xor'ed together, and that combined stream is tested with Maurer's test and its entropy is estimated. If this fails, it is fatal. (Combining the streams this way detects if the two generators have become correlated).

The two streams go through von Neumann debiasing, and are tested again with Maurer's test, and the entropy is estimated. If the test fails, or the entropy is varying too widely, fatal error.

The streams then go into a 256-bit cryptographic hash. When enough bits have gone in so that the input entropy is at least 150% of the number of output bits of the hash, the output is taken.

The hash output is mixed into a bit pool. When the pool has taken in at least 50% more entropy than it could possibly hold, a new pool is started. Enough pools are maintained to have 20000 bits of total pool data. The pool blocks are then tested following FIPS 140-2. The 20000 bits are then available for delivery to the host.

The protocol for host communication encrypts the data blocks that contain the random bits, using a session key based on a shared secret between the device and the host.

The device is filled with epoxy, and opening the case should destroy it.

So, are they any security experts who can comment on which is closer to best practice? A minimal device that just delivers fairly raw bits, with all the statistical testing and other processing necessary for good random numbers up to the host, and with no protection against hardware tampering (other than hoping that tampering would mess up the stream in a way the host will notice)? Or a device that does the testing and processing, and delivers ready to use random bits to the host, and that tries to prevent tampering?

I would think that even with the simple approach, you should put two theoretically identical generators on the device. That way, if someone does try to influence the device by external means, you have a better chance of detecting it because if it influences both devices the same way you'll get correlations.

[1] [http://www.entropykey.co.uk](http://www.entropykey.co.uk)</comment>


Attentiv - <AUTHOR> http://attentiv.com

<comment><AUTHOR> Hold better, more efficient meetings with Attentiv: Easy agenda creation, collaboration, anonymous Q&A, and automatic minute generation.</comment>


ARM: The Democratization of the CPU - <AUTHOR> http://mobilelocalsocial.com/2010/03/arm-the-democratization-of-the-cpu/

<comment><USER2> Interesting tidbit about the first ARM ever made (the acronym ARM stands for 'Acorn Risc Machine').

When Acorn first decided to create their own more powerful cpu than the 6502 and the 65C02 that were powering the BBC model B as well as the 'tube' co processor they simulated the whole thing on a BBC micro.

When they finally had their first silicon delivered the first batch of chips simply worked. Now, of course this CPU was orders of magnitude simpler than modern day CPUs but still, I thought it was pretty impressive.

<comment><USER3> Very impressive, especially for that era. They then used the good chips from that batch to help make the first commercial one.

I also liked how they very strongly desired that its waste heat be below the limit for a plastic package (1 W), and that due to the general lack of tools for that at the time, they used good olf fashioned Victorian conservatism, which resulted in a 0.1 W chip (!). Which of course set them up for vast success in the mobile market.

A great example about how far a good combination of ambition and humility can take you.

</comment></comment><comment><USER4> It amazes me to read some weird political take on what is simply a decent business strategy for embedded CPUs. You still have to pay licensing fees and such. Democracy is a strange word to use.

Also, as to W7 and the full OS X on ARM, is there a 64-bit variant of the ARM instruction set. We seem to be passing 4G on the desktop and portable market (look at the new Atom chips).

<comment><USER3> Not to my knowledge. For their current low power niche I doubt the case is compelling, especially since you can buy MIPS 64 bit IP that's I gather is at least a bit stingy in power consumption.

Also note that to make this work, you might need on the order of say 6 GB of physical RAM just to break even given that a canonical pointer doubles in size. Given that there's a lot of work in the ARM world for reduced, 16 bit or mostly so instruction sets ("Thumb") to run the CPU when it's basically idle and most of it is powered down, I suspect it'll be a long time until we see a 64 chip from them.

Especially since their market is 5-9 billion parts per year; people who want a 64 bit chip are in the noise.

<comment><USER5> A 64-bit instruction set is about more than just the size of a pointer. A 64-bit CPU has 64-bit general-purpose registers, and it has versions of arithmetic and logic instructions operating on these. Because 32 bits is enough for most purposes, instructions must also have a variant operating only on the lower half of the registers, the upper half being either ignored or sign-extended from the lower as appropriate. This makes the CPU core a fair bit more complicated, meaning larger silicon footprint are higher power consumption. I agree a 64-bit ARM is unlikely in the immediate future.

Extending the physical address space beyond 4GB is possible without any changes to the instruction set. See x86 PAE for an example. In short, the MMU translates a 32-bit virtual address into a wider physical address. This allows running multiple processes with a total memory requirement of more than 4GB. As the vast majority of applications never need more than 4GB of virtual space anyway this isn't much of a restriction in practice. I reckon this kind of thing is something we might see in an ARM core relatively soon, at least if they keep growing in the netbook market.

<comment><USER6> >A 64-bit instruction set is about more than just the size of a pointer. A 64-bit CPU has 64-bit general-purpose registers, and it has versions of arithmetic and logic instructions operating on these.

No. x86_64 only has sixteen general purpose registers, and 64-bit MIPS still has 32 (one is hardwired to zero, so really 31).

Registers in the instruction set are bit-mapped---with five bits you get 32 registers (2 __5). The size of a register and the number of registers are completely independent.

<comment><USER7> >> A 64-bit CPU has 64-bit general-purpose registers

> No. x86_64 only has sixteen general purpose registers

Right, but they're still 64 bits wide, like he said.

</comment></comment></comment></comment></comment><comment><USER8> Windows software, the key benefit of Windows, won't be compatible with a Windows on ARM, without a x86 simulator (slow) or a re-compiler of executables (tricky).

<comment><USER9> Unless the Windows software is .NET code - in which case Jazelle RCT on ARM provides a performant solution for bytecode languages.

<comment><USER10> With some luck, .NET code runs in Mono, so you don't even need a Windows to run it. So if .NET was really the killer app, _BSD and_ Linux would be applicable, too, and those run fine on many architectures.

Thus, I think the real "key benefit" are still the _native_ Windows applications.

Also, don't forget that most modern computer games use the graphics card more than the CPU, and ARM will have more trouble to compete more with modern graphics cards than with x86.</comment></comment></comment>


What Every CEO Need to Know about Distributed Version Control Systems - <AUTHOR> http://blog.jdwyah.com/2014/12/what-every-ceo-need-to-know-about.html

<comment><USER2> The Biblical allusion to "In the beginning", was a very long time ago. SCCS, the first version control system for Unix, started in the 1970s. VMS used the Files-11 file system, with built-in file versioning.

A more complicated but more correct story is that PCs come out of a different heritage. VMS admins would purge old documents when the disk was full (see [http://www.neurophys.wisc.edu/comp/docs/oper/dspace.html#use...](http://www.neurophys.wisc.edu/comp/docs/oper/dspace.html#userd) for an example) and before that point contact users to purge their own space. But PCs don't have admins the same way. Unix people learned about the tools from other Unix people, including USENIX and IEEE publications. PCs users tended to have quite different background and training. But a story which starts "you learned poor practices because of your cultural upbringing" might offend the sensibilities of a CEO. ;)

Dropbox is a modern example of a file-based networked versioning system. It keeps older versions of a file so people can go back them.

(Before going further, I have to complain bitterly: many of the examples imply that it's a good thing for workers to spend their free time - '3 in the morning' and 'Saturday afternoon' \- on company work instead of one's self or family. It's very easy to go from there to the narrative that distributed version control is meant to exploit workers. Why can't these examples be "at 3 in the afternoon" and "on Tuesday"? Oh, right: because then there's network shared directories, which ruins the rest of the story.)

I'll evaluate the branching examples, to evaluate how unimportant branching really is for the goals.

0) "pull P&L statements on a Saturday afternoon"

Read-only access to an Excel file doesn't require branching, only secure access to the office network.

1) "to change our marketing and communications theme. Awake at 3 in the morning..."

A DVCS is much less useful when working with single file projects, like Word documents.

If that's in PowerPoint then branching is little different than making a new directory on the network drive and copying the PPT file there. If there's auto-versioning on the network drive then it's _easier_ to use than a DVCS like git.

Since my Mac has built-in Time Machine, I also get auto-backups every hour or so, even for local files.

2) "Distributed branches"

Right, so I've worked on it on my own machine, and when ready I copy it to the network drive and tell collaborators the filename. This is significantly worse than a branching version control system because ...?

3) "Without a distributed system, the normal way of controlling the system is through something we call Access Control Lists"

A distributed system also has ACLs. There is such a thing as a private repo, for example.

Regarding "Access control is a crude instrument. A user can change something or they can't." That's an incomplete statement. If I have read access then I can change the file on my local machine. I just can't commit the changes to the original server. I can of course make my own CVS repo with the modifications. I'll lose distributed history tracking, but the essay doesn't give examples of why that might be useful or important.

Then again, even under a distributed system I might be prevented by the server's ACL from pushing the change on the server. There's anonymous access to read github, but not make a new repo on github. There's not even an anonymous way to make a pull request - you have to have an account on github first.

The solution proposed was "simply request a 'pull' to the maintainer, who can easily see that this is a simple change and merge it", but that's cheating. It requires a human to take the place of the ACL. If you have a human doing that then it's not much better than sending a context patch to the human via email.

If OpenBSD can somehow develop an entire OS with a distributed development environment under SVN, then perhaps things are not 'a million times better'?

I am not convinced that an auto-backup network drive like what Dropbox does can't be better for some of these scenarios than a distributed version control system.

<comment><AUTHOR> (author of the post here)

Dropbox et al all solve the fundamentals quite well. And yes, sure OpenBSD etc all got built pre-git.

The thing I'm trying to highlight is the cultural effects of something like GitHub on how organizations function. When you can subscribe to user commit histories, and pull requests comments are built in I do think something 'magic' happens that leads to a solution much greater than its constituent parts (versioning/branching/network-shares/etc).

A public, recorded, specific conversation emerges out of GitHub that I think is simply different from what's come before it.

For businesses in particular I think the move to distributed information will necessitate moving away from the concept of Docs & PPT that currently form the backbone of communication. Smaller components of thought work better in a DVCS and I think businesses will want to conform to that model.

<comment><USER2> Your thoughts may be true, but the scenarios you gave didn't explain how subscribing to user commit histories and pull requests comments connect to evaluating a P&L, changing the marketing and communications theme, or editing sales documents.

Instead, you require a migration to an entirely different system (which you haven't described) without MS Word documents and Powerpoint presentations in order to achieve that magic.

How much time will it be until a DVCS-assisted document editor can manage the fine-grained UI presentation of something like MS's "Track Changes" for Word?</comment></comment></comment>


Ask HN: What do people buy most on Craigslist? - <AUTHOR>

Working on a new idea and am not sure what most people buy on Craigslist. I use it for buying sports tickets, cheap/gently used furniture, and sometimes electronics, but do you think this is what most people use it for or am I missing big categories/products? <comment><USER2> The reason why craigslist is so successful is because people can buy anything depending on the need. So I am not sure if there is a way to quantify what people are buying "most". I would say "everything". Look at any "for sale" section. There are lot of ads on a daily basis. For example, I have bought furniture, laptops, cell phones, cars on craigslist but if I needed anything else, I would not hesitate. The only reason I don't buy on craigslist is if I need something new OR it is for my kids which I don't want used.

<comment><USER3> That's _a_ major reason for craigslist's success but not the _only_ reason. Clearly another is network effects. Given that, I wonder whether targeting the largest sales category is a good plan for a competitor -- surely it has to do with your goals, resources, etc., but imho it's worth considering that the best opportunity may be in the categories where craigslist facilitates the fewest sales.

</comment></comment><comment><USER4> I tend to think of Craigslist similar to digging for treasure. A lot of people are selling junk, but some people just need to get rid of their stuff quickly. For example, I got a great surfboard probably like $300 off the regular price because this guy wanted to get rid of it because his wife said the garage needed more space.

Personally, I tend to be a little more wary about electronics as I would like to test it thoroughly, and make sure it isn't stolen.

</comment><comment><USER5> A friend of mine sold a bunch of building supplies, appliances and furnishings successfully on there, my sister sold a van, etc. Just about anything

You might be able to figure out what's popular by looking at the ads, the more polished ones are probably the ones folks have done repeat sales.

</comment><comment><USER6> I dont know if cragslist has an api but if so you could compare states over two time periods and tally the products that have been removed.

Amazon has an api that you can narroq down to region, age, product, and more. This may have similar results as CL.

</comment><comment><USER7> Kids toys and clothes. Lots of wooden train tracks and K'nex. There's a big second-hand market for kids' stuff as a lot of it is built to be indestructible, but it only gets used for a few years. And parents are cheap. Source: I yam one.

</comment><comment><USER8> Idea: look at Craigslist for some big cities like NYC and see which categories have the most posts, and use that as a proxy for sales?

</comment><comment><USER9> Cars are pretty huge. Toyotas and Hondas can get sold an hour after posting (I've witnessed it).

</comment><comment><USER10> mobile Electronics (cell phones, tablets)are by far the most popular.

</comment><comment><USER11> housing, cars, employment.</comment>


Ask HN: Recommendations for a book about algorithms and data structures? - <AUTHOR> Is there any book that acts as a reference book for algorithms and/or data structures that have the following:<p>* Explanation<p>* Code examples<p>* History (when/who first used it)<p>* Application examples <comment><USER2> Hm, is history important? There's wikipedia if you're interested in the 'history' of a specific algorithm. For the rest, most books I've seen have pseudo-code, which is easy to translate to code.

The classic textbooks are:

      * "Algorithms" by Robert Sedgewick et al.
      * "Introduction to Algorithms" by Cormen et al.

If you're _extremely serious_ about algorithms, you might wanna go directly with the bible: TAOCP[1].

[1] [http://www-cs-faculty.stanford.edu/~uno/taocp.html](http://www-cs- faculty.stanford.edu/~uno/taocp.html)

<comment><AUTHOR> I would love to go with The Art of Computer Programming.. but I am already confused reading that page. Is this:

[http://www.amazon.co.uk/Art-Computer-Programming- Fundamental...](http://www.amazon.co.uk/Art-Computer-Programming-Fundamental- Algorithms/dp/0201896834/ref=sr_1_2?s=books&ie=UTF8&qid=1444594221&sr=1-2&keywords=the+art+of+computer+programming)

part 1 or is this:

[http://www.amazon.co.uk/Computer-Programming-Fascicle- MMIX-M...](http://www.amazon.co.uk/Computer-Programming-Fascicle-MMIX- Millennium/dp/0201853922/ref=sr_1_4?s=books&ie=UTF8&qid=1444594221&sr=1-4&keywords=the+art+of+computer+programming)

<comment><USER3> You'll be wanting the first one, volume 1, and also Volume 2 for data structures. These are classics, still relevant, and will give you a good grounding to pursue the more recent offerings suggested by other answerers here.

Fascicles is a new effort by Knuth and is more hardware oriented.

</comment></comment></comment><comment><USER4> The Algorithm Design Manual by Stephen Skiena

[http://www.algorist.com/](http://www.algorist.com/)

<comment><USER5> I second that. It's what Google recommend (among other things) to prepare for an interview.

<comment><USER6> Hyperlink to the recommendation: [https://www.google.com/about/careers/students/guide-to- techn...](https://www.google.com/about/careers/students/guide-to-technical- development.html)

It's under the "Develop a strong understanding of algorithms and data structures" part.

</comment></comment></comment><comment><USER7> Look up "Introduction to Algorithms: A Creative Approach" by Manber and "Algorithm Design Manual" by Skiena.

The former has the best exercises (borderline mathematical), but is lightest on implementation. The latter has the best introductory pedagogy and has implementation code, but is not what I would use if I want to grok algorithms deeply.

People keep recommending Cormen. He's the book you get AFTER you understand algorithms. Cormen reads more like a reference manual. Cormen can substitute in for Skiena in a pinch. Skiena sounds like the one you want most of all though.

</comment><comment><USER8> Algorithms [Dasgupta, Papadimitriou, Vazirani] (2008)

Algorithm Design [Kleinberg, Tardos] (2005)

</comment><comment><USER9> I like Grokking Algorithms (pdf only, book done in december). It's quite easy to understand and start with, compared to other algorithms books I have seen.

<comment><USER10> +1 for mentioning entry level book. Can anyone comment about quality?

</comment></comment><comment><USER11> CLR is probably the easiest to get started with: [http://www.amazon.com/Introduction-Algorithms-Edition- Thomas...](http://www.amazon.com/Introduction-Algorithms-Edition-Thomas- Cormen/dp/0262033844)

</comment><comment><USER12> How to Solve it by Computer was popular (probably still is in some places) but uses Pascal.

[https://en.wikipedia.org/wiki/How_to_Solve_it_by_Computer](https://en.wikipedia.org/wiki/How_to_Solve_it_by_Computer)

</comment><comment><USER13> _The Art of Computer Programming_

It also contains instructive exercises and answers.

</comment><comment><USER14> [http://visualgo.net/](http://visualgo.net/)

</comment><comment><USER15> Very specific to OOP : "Design Patterns: Elements of Reusable Object-Oriented Software" by Erich Gamma, Richard Helm, Ralph Johnson and John Vlissides

<comment><USER5> Great book, but as you said very OOP specific. It has no contents on big-O complexity and very little on algorithms.</comment></comment>


AMD Plans 64-Core Threadripper CPU: Report - <AUTHOR> https://gizmodo.com/too-many-cores-1835486780 <comment><USER2> Holy smokes.

        make -j128 bzImage

Oh, the kernel compile is done? I haven't even sugared my coffee yet...

<comment><USER3> But will _your SSD_ be able to handle that?

<comment><USER4> Yes: [https://www.guru3d.com/news-story/eight-nvme-m2-ssds-in- raid...](https://www.guru3d.com/news-story/eight-nvme-m2-ssds-in-raid- on-x399-threadripper-reach-28-gbs.html)

<comment> pickle-wizard Add some 50GB Ethernet and that would make one hell of a storage server. With all the cores in a Threadripper you could do on the fly compression too.

</comment></comment></comment></comment><comment><USER4> Unfortunately, this is a Gizmodo article quoting wccftech.com. Both sites are prone to false rumors.

Keep this flagged as a rumor, and keep an eye out for a legitimate website to actually confirm (or deny) the claims.

</comment><comment><USER5> I don't understand the resistance I saw in the article. I say bring it on: 64 cores is great. Cost isn't an issue because everything trickles down eventually.

Modern operating systems have plenty of things to do with multiple cores. Just having extra cores and running multiple single-threaded applications makes for a smoother experience. With actual multithreading, eg compiling, graphics rendering things trivially get better. That was certainly the case going from 4 to 16 using a 1950x when I upgraded my desktop.

The real limit will probably become bandwidth to keep all those cores humming at full speed. I can easily see a future where we'll routinely expect some cores to be io or ram limited and that particular performance tradeoff will be commonly known to non-technical people. (Not just CS, dev / ops datacenter types).

This kind of tradeoff is already in the current 32 core offering AFAIK.

</comment><comment><USER6> Very awesome, but a bit outside my budget considerations... right now, looking at about $3500 for a 3950X build, and that's about my max on this. If they do a 32 core for $1200 or so, _might_ be able to swing that.

</comment><comment><USER7> Can cores really be merged for better single thread performance?

<comment><USER8> No. That was one of the main reason behind introducing multi-core architectures. It is getting harder and harder to optimize the CPU cores, neither can you keep pushing the CPU frequency. So the only option is to create multi-core processors and build multi-threaded applications.

<comment><USER7> The article said cpus could be merged I must have misunderstood the meaning.</comment></comment></comment>


New Refillable Batteries Could Fuel an Electric Car Revolution - <AUTHOR> https://www.nbcnews.com/mach/science/new-refillable-batteries-could-fuel-electric-car-revolution-ncna974556 <comment><USER2> These are flow batteries. The limitation is the limited solubility of the charged ions in the carrying fluid. The charged fluid is pumped in - discharged - and then pumped out. Well suited to stationary systems where huge tanks on the land are used. You could do it now with 2 50 gallon tanks. Fill tank 1 with charged fluid and discharge it into tank 2. AFter 80-100 miles, stop and pump new fluid into tank1 and put the discharged fluid into the roadside charge station. [https://en.wikipedia.org/wiki/Flow_battery](https://en.wikipedia.org/wiki/Flow_battery)</comment>


Congress Quietly Deletes Key Disclosure of Free Trips Lawmakers Take - <AUTHOR> http://www.nationaljournal.com/congress/congress-quietly-deletes-a-key-disclosure-of-free-trips-lawmakers-take-20140630

<comment><USER2> Maybe a new problem for AllAreGreen to solve?</comment>


Aaron Draplin on Finding Inspiration in 'Dead Stuff' - <AUTHOR> https://vimeo.com/132326932

<comment><AUTHOR> Aaron James Draplin of Draplin Design Co., is working solo in the mighty Pacific Northwest, where he rolls up his sleeves on graphic design projects for companies like Nike, Patagonia, Target, Ford Motor Company and even the Obama Administration. In this interview Webydo asked Aaron to share his creative journey and views on what it takes to make it in the graphic design industry.</comment>


Life and Death in the App Store - <AUTHOR> http://www.theverge.com/2016/3/2/11140928/app-store-economy-apple-android-pixite-bankruptcy <comment><USER2> Would be curious to hear how app developers here are dealing with the saturation in the US market. How do you cut through the noise?</comment>


Both geniuses and madmen pay attention to what others ignore - <AUTHOR> http://nautil.us/issue/18/genius/if-you-think-youre-a-genius-youre-crazy <comment><USER2> When you want to do anything new, you have to go against the flow, and this is psychologically very hard.

When I decided to quit my job and create a company I went against everybody. My parents, my girlfriend, my friend, all them thought I was crazy quiting a good position for something so risky.

E.g My girlfriend told me that if I was doing my company the relationship was over, so I said to her, ok, go away. The next week she wanted to come back, but I preferred to risk this alone.

Of course, when whatever you did works, everybody believes you are a genius, and they always remind you how much they KNEW that. Success is contagious, and once the media says that, you are a genius for everyone.

People like Newton, who was a geek, had to suffer isolation all his life in order to do what he felt right.

Fortunately today there are two differences with Newton's time:

1-There is Internet. Whatever you do you are not alone. There is a 1 per cent or 1 per thousand people like you, and with Internet you can find them, meet them. In the past getting enough critic mass was only possible in cities, with millions of people.

2-We know a lot more about psychology, you have amazing educational materials to improve your live, be happy and not getting in holes like suicidal thoughts.

<comment><USER3> Any advise for a person who had success, then had compound PTSD surface, get mingled with the concept of ego, leading to a negative sorts of ego death, and is still trying as hard as they can to become genius? I can't get the concept of being past my prime, out of my head, and I think that is precisely what is holding me back.

<comment><USER4> My company's CEO passed away last week. During her memorial I found out that she was 70 when she died, and had founded the company 25 years ago, when she was 45. Which I think shows that people's "prime" actually comes a lot later than they think.

The way I look at it is that if you start a business in your 20s, the odds are against you. You may be young and full of energy, but you don't know shit about the world yet and will make a ton of mistakes. If you do it in your 30s, the odds are neutral. You are more seasoned and possibly have some domain experience under your belt that you can leverage. If you do it in your 40s, the odds are in your favor. You probably have significant domain expertise as well as connections you have established earlier in your career that can help you. It's only in your 50s that you can justify feeling like you're past your prime. Then again, that hardly stops some people.

<comment><USER5> The average age of a _successful_ entrepreneur is 40. So for every Zuckerberg, there's a 60-something balancing him out: [http://blogs.hbr.org/2013/06/entrepreneurs-get-better- with/](http://blogs.hbr.org/2013/06/entrepreneurs-get-better-with/)

</comment></comment></comment></comment><comment><USER6> This article gives the following quote some context:

"Mathematics requires a small dose, not of genius, but of an imaginative freedom which, in a larger dose, would be insanity. And if mathematicians tend to burn out early in their careers, it is probably because life has forced them to acquire too much common sense, thereby rendering them too sane to work. But by then they are sane enough to teach, so a use can still be found for them."

\--Angus K. Rodgers

(The word genius seems to be rather ill-defined, as evidenced by Rodger's reluctance to use it in a context that seems identical to that of the article.)

<comment><USER6> I also like the following quotation of N. Bohr, appearing in an Amazon book review[1] of Dr. Simonton's[2] "Creativity in Science: Chance, Logic, Genius, and Zeitgeist":

"We are all agreed that your theory is crazy. The question which divides us is whether it is crazy enough to have a chance of being correct. My own feeling is that it is not crazy enough."

[1] [http://www.amazon.com/review/RV4Y43WKRK6LO](http://www.amazon.com/review/RV4Y43WKRK6LO)

[2] Dr. Simonton is the UC Davis professor who authored the article.

</comment></comment><comment><USER7> > The most important process underlying strokes of creative genius is the > tendency to pay attention to things that normally should be ignored or > filtered out.

I'd add that it's not only paying attention to these things, but _questioning_ them.

Noticing something no one else does is useless unless it incites action. Deciding to act upon something can only happen if there's sufficient curiosity. Curiosity comes from questions. Why? What if? How might one...?

Questions are so fundamental to everything from creativity to innovation, management, sales, relationships...I just had my eyes opened by _A More Beautiful Question_ by Warren Berger.

<comment><USER8> >I'd add that it's not only paying attention to these things, but questioning them.

Personally, I feel the rebellious aspects of intellectualism are far, far overplayed to the point of absurdity. It leads to buying into marginalized, if not discredited, ideas and not doing a proper investigation into mainstream knowledge. I mean, how many more reddit posts about the "evil" Federal Reserve or how terrible of a person Thomas Edison was do we need? Especially when these opinions are tied to politicized propaganda from the opposition and not remotely tied to a legitimate interest into monetary policy or late 19th century industry.

I don't think young geeky introverts need to be told to be more rebellious, if anything they should learn to conform more, learn better social skills, understand the power of teams and collaboration, etc. I really wish someone told me this when I was younger. These attitudes did me a big disservice in life and I imagine I would have been much more successful otherwise.

<comment><USER7> > I mean, how many more reddit posts about the "evil" Federal Reserve or how > terrible of a person Thomas Edison was do we need?

Is that rebellion or groupthink? Either way, yes, most of it probably is useless.

But what about the rebelliousness that brought about the hyperlink, the mouse, and the iPhone? Surely those inventions were rooted in questions that sought rebellion against established ways of doing things?

There's a time to rebel and a time to conform. Rebellion without conformity leads to thinkers who have great ideas but no output. Conformity without rebellion leads to complacency and no progress.

As with everything else, one needs balance.

<comment><USER8> >But what about the rebelliousness that brought about the hyperlink, the mouse, and the iPhone?

Are those really rebellions? TBL was a pretty milquetoast guy who built on top of a lot of things before him: TCP/IP, server OS, interconnected networks, and of course text-based predecessors to the web like Archie. He didn't wear all black and call everyone an idiot and magically produce something wonderful. He stood on the shoulders of giants and reached a little further.

<comment><USER7> Do you need to be a black-wearing, idiot-calling rebel in order to be a creative genius?

Of course not.

But you need to observe reality, question it, and then act on your question. That's it. Milquetoast guys can do it too.

</comment></comment></comment></comment></comment><comment><USER9> this difficulty inhibiting thoughts that i know are irrelevant has long been an issue for me. i had to build a "memory palace" style visualizing technique for "disposing" of thoughts that i know aren't relevant, but can't help fixate on.

i imagine writing the thought down in vim, then moving the file to a USB stick, then taking the usb stick into a zip-lock bag, putting that into a specific pocket of my backpack, getting on my bike, and riding from my apartment down 101 to the NASA base at AMES, throwing the backpack into a red bin which is loaded into a rocket and shot into space.

the visualization is so detailed and specific that it takes all my attention to render that internal movie; after having expressed the thought syntactically (i actually imagine writing the thing down in vim and moving my fingers accordingly), it gets moved from "the thing actively afflicting my consciousness now" to "a thing i was thinking about". often after the rocket takes off, i can remember i was thinking something that bothered me, but i can't remember what it was. my mind will sometimes grab after it, trying to remember - and if it surfaces i get agitated again - but i can usually stay focused enough to distract myself by going for a walk or establishing a small, easily obtainable goal to fire up the ol' task positive network again.

<comment><USER10> It's not quite as detailed as yours, but I use a "trick" of the same kind to chase those obsessive thoughts.

I see myself on top of a miles high cliff, standing next to a safe. I somehow extirpate the thought by breathing it out into the vault, which I then lock and push off the cliff. I then have to wait and when I "hear" a distant noise, I can't remember the thought, even though my mind perversely tries to remember.

Anyway, I'm glad to see I'm not the only one having to resort to such tactics...

</comment></comment><comment><USER11> The author is talking about idea generation. As Edison wrote, "Genius is 1% inspiration and 99% perspiration."

Here are a few ideas I don't have time to pursue.

1\. Make extruder-type 3D printing work better by heating the material just laid down, just ahead of the weld point. Use hot air or a small, maybe 5W laser diode. Use 3 heat points 120 degrees apart so you can heat ahead of the direction of travel. Modulate the laser with pulse-width modulation, then read the temperature during the off period with two photodiodes with different IR filters. Go closed-loop on the temperature.

2\. Initial application for automatic driving - airport auto rental. Book rental in advance. When customer's phone shows up at destination airport, dispatch car to terminal, timed to show up just after luggage pickup. Use phone to direct customer to car. On return, customer drops off car at terminal, and it head back to rental lot on its own. Self-driving is limited to low speed in known areas. Expand system by adding parking garages at likely car rental destinations, such as convention centers.

3\. Conference room automation. Video projector should have camera, find screen, put up test pattern, focus, correct for parallax. Room lights should sense projector/external lighting situation. Microphone system should automatically track speaker from a distance (this exists, using a hemisphere with a large number of microphones and a lot of CPU power) without any effort by speaker. Video feed of talks and classroom should have people tracking and automatically generate a useful video feed. The whole thing should Just Work. Internet of Things crowd, get busy.

4\. Integer overflow, both signed and unsigned, should trap in CPUs. If you want modular arithmetic modulo the word size, you should write "x+= (x % 65536)", and the compiler should understand that as an idiom, generating an cheap unchecked unsigned add.

5\. Set import duties to recover about half the wage difference between the exporting and importing countries. This escapes the "race to the bottom" problem. Half, so as not to have too much protectionism. Politically difficult, but the current ratio for the minimum wage in Shentzen to the US is 5.6. China is getting close to where this is feasible.

Idea generation is easy. Implementation is hard.

<comment><USER12> MIPS had trap on overflow.

<comment><USER11> So did VAXen. If you turned it on, about half the UNIX utilities broke.

</comment></comment></comment><comment><USER13> Anyone who will unironically define themselves as a genius has issues with ego. Genius is something only history can bestow on people.

<comment><USER14> Your theory is that, let's say, John Carmack can't self-identify as a genius after all he has accomplished, and given how far out in front of most others he has always been on the technology curve?

Bill Gates possesses a genius level intelligence, has the accomplishments and mental demonstrations to back it up, and is apparently fully aware of it. What's the problem exactly?

Let's define genius:

"exceptional intellectual or creative power or other natural ability."

or

"a person who is exceptionally intelligent or creative, either generally or in some particular respect."

As though it should be difficult for a genius to recognize that their abilities far exceed those of other people.

I would argue that being oblivious to that level of blatant genius - having no idea you're so much better than most others - would be more of a negative mental trait vs being aware of it. You'd have to be incredibly ignorant, and almost entirely non-self-aware to miss such a thing across a lifetime.

If you can reasonably be defined as to be in possession of X trait, there is absolutely nothing wrong with recognizing that. It is not an ego problem to do so. If my brain is capable of great feats of mathematics, and I can tell that I'm drastically better at math than my peers, there is nothing irrationally egotistical about recognizing it. With there being a critical distinction between recognizing your capabilities, vs. obnoxiously promoting them to others.

<comment><USER15> If John Carmack or Bill Gates thought of themselves as geniuses, they wouldn't have accomplished a fraction of what they did. Nothing is more destructive to someone's intelligence or creativity than believing the hype that people put on you, and that goes 10x if that hype comes from yourself.

Put another way, I consider both of those guys geniuses, but if either of them made that claim about themselves, I would have to reconsider the position.

Put another another way, no good can possibly ever come from acknowledging your own genius, even if that was something a person was capable of perceiving about themselves, which I don't think it is.

<comment><USER16> I completely agree with most of your comment. I wonder, though, if some good could come from (erroneously) acknowledging one's own genius privately and temporarily. If that person were above a certain threshold, wouldn't the acknowledgement of one's own genius evoke the conflict that there must be much more left to learn that the person isn't yet aware of? It might just provide enough motivation to search for the reasons why it was so ignorant to have considered oneself a genius.

<comment><USER17> Very interesting! I find that what geniuses are secretly proud of is seldom what others perceive as their top achievements, so it would be hard to parallel the external "you are a genius" with the internal "I'm a genius".

Or maybe I'm just talking about highly intelligent people != genius.

</comment></comment></comment></comment></comment><comment><USER14> "Suicide victims like painters Vincent Van Gogh ..."

Van Gogh very likely did not kill himself.

[http://www.bbc.com/news/entertainment- arts-15328583](http://www.bbc.com/news/entertainment-arts-15328583)

<comment><USER18> That's a nice idea, but most evidence suggests suicide: [https://en.wikipedia.org/wiki/Death_of_Vincent_van_Gogh](https://en.wikipedia.org/wiki/Death_of_Vincent_van_Gogh)

</comment></comment><comment><USER19> I had an IQ score higher than Marilyn vos Savant's once. I like to think I'm a more creative thinker than most, but I haven't exactly made any world-shaking discoveries ...

</comment><comment><USER20> "Second, the permanent inhabitants of mental asylums do not usually produce creative masterworks."

But how many sedatives are they on?

<comment><USER21> Indeed. Sedatives, anti-psychotics, mood stabilizers - all have a decidedly negative effect on creativity.

</comment></comment><comment><USER22> "Amateurs look for inspiration; the rest of us just get up and go to work." ― Chuck Close

</comment><comment><USER23> Ninety nine percent of genius is genius and not sweat; just ask Gauss.

<comment><USER24> Or, as Telsa is rumored to have remarked: "If Edison spent a little more time thinking, he wouldn't have to perspire as much"

</comment></comment><comment><USER25> Reminds me of the sesame seed trade from Silicon Valley.

</comment><comment><USER26> Interested in this article, take up a book "Outliers: The Story of Success" by Malcolm Gladwell

</comment><comment><USER27>
      > Psychopathy, noun
      > mental disorder especially when marked by egocentric and antisocial activity [1]

      > Antisocial: adjective
      > hostile or harmful to organized society; especially :  being or marked
      > by behavior deviating sharply from the social norm [2]

So if you're more intelligent (deviating sharply from the social norm) and you know you're intelligent (egocentric), you're kind of a psychopath, by definition of the word psychopath. What's the surprise there?

Not being accepted or understood by the society that you excel above would also be expected.

[1] [http://www.merriam- webster.com/dictionary/psychopathy](http://www.merriam- webster.com/dictionary/psychopathy)

[2] [http://www.merriam-webster.com/dictionary/antisocial](http://www.merriam- webster.com/dictionary/antisocial)

<comment><USER28> The M-W dictionary might not be the best source for that definition. The people best disposed to curate the meaning of that word, psychiatrists and psychologists, would characterize psychopaths as being bold, disinhibited, and utterly lacking in empathy or remorse.

In other words, they do what they want, when they want, and don't care about how it impacts anyone else, not during the act, and not after they finish. Correctly believing yourself to be smarter than most other folks is barely a nudge from the normal end of that spectrum.

But if I were to guess, r is probably very slightly positive when correlating genius with psychopathy, psychopathology, and several other "that guy's a little odd" disorders.

<comment><USER29> In case of psychopathy, or better anti-social personality traits in general, there is some research into this, and it indicates that "genius level" intelligence is a _protective_ factor. So a person with amoral/anti-social traits and very high score on the G factor (I think) is able to compensate, high cognitive abilities can sort of inhibit amoral impulses through sheer brute force of intellect, sort of. This makes sense because anti-social/amoral behaviour is in the general case not very adaptive and beneficial (for each successful psycho, you have vastly more of them leading miserable lives). Also, the relationship is non-linear, it only works for very high levels of intelligence. I'd love to give you some reference, but unfortunately I don't have the literature at hand ATM.</comment></comment></comment>


Cities look at subsidized housing to stem teacher shortages - <AUTHOR> http://www.bigstory.ap.org/article/f4cbc9ca2cad46ebb6fdb2c3008919c8/cities-look-subsidized-housing-stem-teacher-shortages <comment><USER2> _About $35 million of the $310 million to be raised has been earmarked for construction of up to 100 new apartments on surplus land owned by the San Francisco Unified School District. The units would be rented at below-market rates to the district 's 3,500 teachers and 1,600 classroom aides, who also would be eligible for new rental housing allowances and home down payment loans aimed at reducing living costs for another 300 educators, Deputy Superintendent Nyong Leigh said._

5100 staff per 100 apartments. A 2% dent in the problem for $35 million. Even if the entire $310 million were put toward housing, it would still mitigate housing costs for less than 20% of the staff.

<comment><USER3> Sounds like the cost of business licenses in SF should go up...

</comment></comment><comment><USER4> Instead of paying teachers a livable wage, we will meddle with the housing market and cause everyone else's rents to go up! HOOOORAY!

<comment><USER5> Teacher's wages are only not "livable" in SF, because the housing market is dicked.

<comment><USER4> Exactly. Increase taxes on homeownership to pay the teacher's salaries. If homeowners don't like this, they can cut out their NIMBY ideals and allow adequate construction of new housing.

</comment></comment></comment><comment><USER6> Teachers in San Francisco should demand to be paid more instead of receiving subsidized housing.

</comment><comment><USER7> I can't understand why we don't just pay teachers more. Is it even controversial?

<comment><USER8> Paying for better performance only applies for CEOs and engineers. Teachers should live in squalor for the love of educating.

<comment><USER9> (1) Measuring teacher performance is hard (and because it's taxpayers miney, there's much less space for subjective opinions), (2) supply/demand ratio of teachers is quite different.

<comment><USER8> Wouldn't paying them more across the board lead to more competition for positions which should lead to higher overall quality?

<comment><USER9> There's quite a lot of competition already. It's not a startup, you can't select this teacher over that one because of your gut feeling: it's public money, so you have to have clear and transparent selection process to ensure that you're not corrupt.

Which means that this competition doesn't necessarily translate into higher quality of teachers, but instead into skills of navigating bureaucracy in western countries and navigating corrupt bureaucracy in others.

<comment><USER7> Just because it's already competitive doesn't mean the best people are competing. If you're really good at math, you can end up with a full 10x difference on disposable income being a teacher versus other available careers. There's no way we're getting the best people or anywhere close to it into education, competition or not.

(Your point about the difficulty of measuring performance is a very good one though)

</comment></comment></comment></comment></comment></comment><comment><USER10> Few thoughts:

1) expensive areas have a proportional amount more to spend on teachers. If they actually were short teachers and needed to pay teachers more, the easily could and would.

2) teachers are generally easy to find. Open teaching positions routinely have hundreds of applicants. It is a very desirable job despite the 'low' wages. Working with kids, month long holidays, and tenure appeal to a lot of people.

3) 45% of your income on housing is not that extreme. I pay 30% and I'm in LA on a CS wage

I'm not convinced this is a problem, just your typical heart throb emotional piece.

<comment><USER11> Normally, expensive areas _would_ have a proportional amount more to spend. But California's Proposition 13 locked the land values that property taxes are based on to 1978 levels. And in SF specifically, rent control laws lock tenants into the same rent price as when they started renting (for pre-1978 apartments, which is most of them).

Therefore the seemingly "expensive" rent of rentable apartments in SF is not an indicator of the actual rent being paid by most renters, much less of the taxes the owners pay to fund things like schools. So even if _open_ apartments are rented for $4k/month, the level of service residents are able to fund could be more like that of a poorer city where apartments rent for $1.5k/month.

</comment></comment><comment><USER12> Build apartments above the schools.</comment>


Social media use is associated with a number of psychological dangers - <AUTHOR> https://effectiviology.com/dangers-of-social-media/ <comment><USER2> Something that's slowly becoming more and more troubling to me is when I come across proper adults, people between the age of 30-46 who are more obsessed and compulsive with instagram than I am. Especially those who aren't using it for commercial purposes or to push a personal brand of some kind.

It's sad and scary at the same time that an adult is eliciting the same kind of selfish over indulgence and conceit as a spoiled 13 year old.</comment>