Tesla Model S JSON API - <AUTHOR> http://docs.timdorr.apiary.io/?cmd=honk-horn

<comment><USER2> While this is clearly not REST-ful, the fact that the comments here can spend so many words philosophizing over whether this _ought_ to be PUT vs. POST vs. PATCH illustrates why REST is not my favorite technology.

It's like XML all over again. Should it be an attribute or a child node? Should the parameter go in the header, or in the body, or in the URL? Should it be part of the URL path, or a URL parameter? Should the error be indicated in the HTTP status code or just in the body? Did we get it right, or do we need to find a Roy Fielding quotation illustrating the principle we violated?

Normally this wouldn't bother me, since I generally have faith that the "free market", so-to-speak, will favor the best technologies in the long run. But HTTP and REST have an artificial boost in that they are the only way to get through many firewalls, so in essence everyone has to go along with REST whether they want to or not (or at least tunnel over it). And of course everything _can_ be made to work with REST, so everyone eventually converges on it, even if it's not the best fit, and its dominance grows.

<comment><USER3> I (really do) hate posting this but I swear every single "REST" or "RESTful" or "REST-ful" API post I see, there's always _that guy_ that chides it for not being pure or _REST_ or "-ful" or something. Do we really care that much? Does the API work? If so, move on...

<comment><USER4> If it doesn't follow the design pattern in some form that it states it does, then it should be referred to as the technological interface it's offered through - in this case a web service.

</comment></comment></comment><comment><USER5> > This is unofficial documentation of the Tesla Model S REST API

Very few concepts have been so hugely corrupted to mean exactly the opposite of what they mean as REST. This is probably the least REST API in existence.

<comment><USER6> I agree with you, but I have trouble understanding the right way to implement "commands" like this - I must be thinking about it in the wrong way. How would you design a "real" REST interface for a command like this? What's the advantage a "real" REST interface gives you in this case?

<comment><USER7> I don't know the whole state of the vehicle. I don't want to. So I'll use PATCH. I know I want the horn to be in a honking state and remain in that state for 1 second. The implementation is responsible for doing what it needs to do in order to get the resource into the state (or differential state in this case) I told it to take.

I'm not usually in favor of nested API design, but complex resources like cars make sense, so:

PATCH /vehicles/{id}/horn { "enabled": true, "timeRemaining": 1000 }

<comment><USER8> My initial thought would be that a request for a "honk action" is not idempotent, so it should be a POST.

You could do it as a PUT or PATCH, but you'd have to do it differently from in your example in order to preserve idempotence, due to the complications of working with time.

Remember, if the request successfully goes through twice that should have the same effect as if only the first succeeded. One way to accomplish that would be to give an absolute start and end time for honk to be on. e.g.,

PUT /vehicles/{id}/horn { "enabled": true, "time_start": "2014-04-12T20:12:36.1", "time_end": "2014-04-12T20:12:36.6"}

for a half-second honk.

</comment></comment></comment></comment><comment><USER9> Wait. GET's can unlock my doors and honk my horn and stuff? Don't let anything spider that page of links!

<comment><USER10> Right, since it has side effects this should be a POST action.

<comment><USER9> I'd humbly submit that PUT is the better choice. POST is to create the resource, PUT would be better to change its state. I don't want to make a new horn, just honk the one thats there. (PUT is also usually considered idempotent, honk as much as you want!)

      PUT /vehicles/{id}/horn

      {
      "command": "honk"
      }

<comment><USER11> POST doesn't have to create a resource; it can also be used to annotate existing resources.

The main problem with using PUT is that PUT is supposed to be idempotent; the result of two PUTs with the same content should be the same as the result of a single PUT with that content. But two PUTs to honk the horn would honk the horn twice, not once.

Since we're all being pedantic about HTTP methods here, we should have a link to RFC 2616 :)

[http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html](http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html)

<comment><USER9> Ahh. Good point. I was considering PUTting the horn into the honking state vs POSTing horn honks for execution. In the first case, 2 PUT honks would just result in a honking car, in the second, 2 POSTs would get you 2 "honks" whatever those are defined to be.

I guess I was thinking of the idempotent "panic" button on my cars key fob.

<comment><USER11> _the idempotent "panic" button on my cars key fob_

Hmmm, mine actually isn't--one hit turns panic mode on, the second turns it off.

</comment></comment></comment></comment></comment></comment><comment><USER12> Let's talk bout the real reason this was posted: YOU CAN HONK THE HORN VIA A REMOTE API!

</comment><comment><USER13> If anyone ever manages to penetrate the central VPN server which Tesla uses for its cars, this will be total mayhem.

Also, which server are they using? That alone is an interesting fact, as it has to support tens of thousands of simultaneous connections...

<comment><USER14> Nothing special about Tesla

Many of the other car manufacturers provide remote access to cars. See GM's OnStar, Ford's Sync Services, etc... One of those companies used to advertise on TV you calling them and having them unlock your car remotely and IIRC starting the engine.

<comment><USER15> The difference is that those services are optional and often opt-in, whereas with the Tesla it appears to be mandatory.

Personally, I'm not too fond of my car being accessible remotely unless it's me who has control over that access.

<comment><USER16> I doubt they're really opt-in, in the face of a hack. Having your car still connect to the network means that they can activate a new account instantaneously and without user intervention. It means they could potentially sell non-subscribers on a car unlock right on the spot, rather than saying, "tough luck, you should have subscribed to our service, after you get a locksmith to unlock your door, call us back and we can help stop it from happening again."

I would bet five Zimbabwe dollars that most systems of this type can be used to control the cars of non-subscribers if taken over.

</comment></comment></comment></comment><comment><USER17> It's good to know that cars can now be remotely controlled via CSRF attacks.

</comment><comment><USER18> A company has an API FOR A CAR, and discussion devolves immediately into which characters should be at the start of the HTTP request.

</comment><comment><USER19> How do these commands get invoked, and how do the commands get delivered to the individual cars? Is this something that people can invoke on the official Tesla web site after authenticating to it in some way, or is it something that people invoke on a web server running on their individual car?

<comment><USER20> The URL includes the car's ID number, strongly implying that this is a centralized service running in a data center, not a server running on the car's computer.

<comment><USER21> I can't wait for somebody to hack this and make every Tesla on the planet start honking at the same time. (Presuming there's a 3G hookup of some kind going on here)

</comment></comment></comment><comment><USER22> Pretty sure this be a POST request.

</comment><comment><USER23> This API documentation has already been posted here twice today [1].

I remarked how non-RESTful this API is, which may have been the motivation for the title of this submission [2].

[1] [https://news.ycombinator.com/item?id=7961944](https://news.ycombinator.com/item?id=7961944)

[2] [https://news.ycombinator.com/item?id=7962260](https://news.ycombinator.com/item?id=7962260)

</comment><comment><USER24> Other discussion on this topic here: [https://news.ycombinator.com/item?id=7961944](https://news.ycombinator.com/item?id=7961944)

</comment><comment><USER25> How _should_ one RESTify methods? If my 'state' is represented as objects, and I want to execute a method on one of those [remote/server-side] object, what's the RESTful way of calling that method? I don't even know what RPC over HTTP should look like, let alone whether mixing it with REST would even be acceptable.

<comment><USER26> > let alone whether mixing it with REST would even be acceptable

Why wouldn't it be acceptable? Can you think about any reason? Because I can't. (And you could reach some very nice API independence by carrying RPC metadata at the REST API.)

The only thing I see here that I think is wrong is that the API uses GET when it should use other verbs. But lots of people already pointed that.

</comment></comment><comment><USER27> Holy fucking pedantics, It's too bad people are focusing on REST.

This API makes me want to have a Tesla. There are so many interesting apps/utilities that can be made with this!

</comment><comment><USER3> Hm.. wondering if:

/vehicles/{id}/snooplion/hydraulics/bounce

is idempotent or not?

</comment><comment><USER28> Watch Dogs anyone?

</comment><comment><USER29> shouldn't this be a POST ?

</comment><comment><USER30> imagine if this was stuck on loop. hopefully some rate limiting is already built in.</comment>


Show HN: Cppbase – A template for a simple CMake-based C++ project - <AUTHOR> https://github.com/kartikkumar/cppbase <comment><AUTHOR> Hi all,

I thought I'd kick off the new year by submitting an open-source project of mine that I haven't been tracking on Github at all until recently. I happened to check my Github account a few weeks ago and saw that it had quite a few stars (at least for my standards). I figured maybe it's useful to more people.

Moreover, I'd be happy for any and all feedback. This project is the culmination of fighting with CMake and C++ for a few years and I use it as the basis for most new codebases that I build.

I have a few ideas on how to expand it further and would be grateful for input, even if it means ripping the project to shreds.

Thanks!

<comment><USER2> Awesome project - thanks for this

<comment><AUTHOR> Thanks!</comment></comment></comment>


Ask HN: What's a modern equivalent of the 80's "War Games" movie? - <AUTHOR>

I saw "War Games" (1983) movie as a teenager and that changed my world. For a European guy like me, it was the first time I saw a home computer or a modem. Matthew Broderick's incarnation of an computer geek was so cool I was determined to become one. I didn't even know the term "hacker" but that movie definitely was influential enough to make me want being one of them.<p>That was back in the 80's. What movies (if any) are driving young hackers nowadays? <comment><USER2> Somewhat related: They made a WarGames sequel. <http://www.imdb.com/title/tt0865957/>

I don't know of any hacker-related movies specifically, but I'd note a few sci-fi movies that inspired technological creativity: Flubber (the hovering robot), I Robot, Ironman. Also Futurama, in a somewhat different way.

</comment><comment><USER3> Strangely enough, I'd say Iron Man. A lot of people I've talked to about the movie were more into Tony Stark's smart home tech than they were into the suit. I distinctly remember one female friend of mine who _despises_ tech talk, asking me all about whether it would be possible to engineer those self- dimming window displays.

Maybe it's not as realistically grounded as others, but it definitely shows people why we do what we do: we like building cool stuff.

</comment><comment><USER4> I'm inclined to just say WarGames. But the closest that I've seen in a more modern tone was Antitrust. None of my computer-inclined friends seemed to respect it though.

</comment><comment><USER5> The feel of the computer culture back then was so different. Perhaps now the reality of the web itself is enough? We don't need movies about cyberspace any longer, it's here now, and that's exciting.

</comment><comment><USER6> Live Free or Die Hard maybe? War Games Dead Code? Antitrust?

Not sure if those are driving people, but they try to put kids in those sort of situations to help save the world.</comment>


Three Other Models of Computer System Performance (2018) - <AUTHOR> https://arxiv.org/abs/1901.02926 <comment><USER2> To anyone who finds these models interesting and wants to learn a lot more - I'd highly recommend Mor Harchol-Balter's textbook: [https://www.amazon.com/Performance-Modeling-Design- Computer-...](https://www.amazon.com/Performance-Modeling-Design-Computer- Systems/dp/1107027500) (She is currently a professor at Carnegie Mellon).

</comment><comment><USER3> The three models here are intimately related I believe.

For a generalisation of all them, see [https://en.wikipedia.org/wiki/Neil_J._Gunther#Universal_Law_...](https://en.wikipedia.org/wiki/Neil_J._Gunther#Universal_Law_of_Computational_Scalability)

Neil's books, software and "gaphorisms" are all good reading.

[http://www.perfdynamics.com/Manifesto/gcaprules.html](http://www.perfdynamics.com/Manifesto/gcaprules.html)

</comment><comment><USER4> Hmmm, I think I know where the OP saw this link posted originally :-).

<comment><USER5> Where? I'm always looking for other stuff to read.</comment></comment>


Building companies for the long haul (Index Ventures) - <AUTHOR> http://indexventures.com/cgi-local/kNewsRd2Ext <comment><USER2> Link broken due to index website using frames. Could you edit with direct link to sunday times please?

<http://business.timesonline.co.uk/tol/business/industry_sectors/technology/article1496283.ece></comment>


Ask HN: Generalist or Specialist - <AUTHOR>

Recently I have seen quite a few articles on HN regarding the benifits and trend toward being a generalist. My question to the HN community, is do you see this as the direction of developers or even in the tech community in general? That we should become generalists in our field rather than specialists? <comment><USER2> Men have been trending towards specialization ever since we started seriously urbanizing. Specialization is important when you need a greater depth of understanding in one (usually) narrow field. Assuming that you have a maximum amount of "skill" or "talent", it then behooves you to distribute that in the most optimal fashion, within that context.

All that means is this: when you have a larger, more diverse, population base, specialization can be afforded. My corporate office has an employee dedicated to shipping and receiving FedEx packages. But the underlying structure can support that, because we have many analysts, etc.

Being a specialist is just different than a generalist. Do what fits you best. I know I like dabbling in a lot of different things (was a double major, English and CS, in college), so being a generalist works to my strengths. However, I know people who only like their narrow view, but like to know how deep the rabbit hole goes.

Also, some fields require specialization. Working crypto implementations? You'd better be damned specialized. But starting a company requires so many different types of work, that you pretty much have to be a generalist to succeed (or else have 15 people as co-founders who can immediately specialize).

One other thing -- even when there is a group of specialists, you need generalists to bring them together. All things being equal, I would probably prefer a team of generalists for a cofounding team (say, 2-3 people) versus a team of specialists.

</comment><comment><USER3> I think it would depend on where you're working. If you're at a startup, you must be a generalist because there is a need to do as much as possible with the least amount of resources. A generalist who can perform 3 functions reasonably well is therefor much better for a startup than 3 people who perform these functions to perfection (at least in most cases). In a large corporation, there is often an inherent degree of specialization (whether or not it's efficient).

<comment><AUTHOR> Thank you for your reply. Now that I think about it more and in line with your comment, with HN being a start-up atmosphere, I guess it makes since to see more of the generalist mentality.</comment></comment>


How will business cope with massive content inflation? - <AUTHOR> http://www.zdnet.com/business-in-the-age-of-content-inflation-7000011085/

<comment><USER2> People either pay for the content they consume with money, or surplus attention which you can redirect to other things via advertising & brand messaging. When a content consumer isn't prepared to pay more for your content than the attention required to consume it, the market rate for that content is - by definition - zero.

Because so much content is created, and the barriers to creating it are so low, the imbalance of supply and demand is so great that the vast majority of content has a market value of zero.

Unfortunately the content creators, used to a time of limited content supply and therefore an ability to make good money for that content, have not adjusted to this reality. There isn't likely to be an adjustment that lets them continue things as they were.

What concerns me is the willingness of the major content publishers to throw their lot in with totalitarian governments in pushing solutions which enable censorship and remove control people have over their own devices. In reality this won't work as anything more than a stop gap for those industries (but hey, short term share price wins all arguments), yet will have the effect of letting the genie out of the bottle regarding the acceptance of the mechanisms for censorship and control.</comment>


Removed SAIC Job: Palantir Experience to Analyze Social Data (from NSA) - <AUTHOR> http://www.techcareers.com/job.asp?id=90159304&aff=AC44BA2E-E3EB-4DBC-8BDB-9FCE01C58B09

<comment><USER2> Screenshot would be helpful. And juicy.

<comment><AUTHOR> Can you not see the full description on the site? It is pretty long (more than one screen even zoomed way out). I saved the full page in Chrome; here are the juicy excerpts:

Social Networks Analyst Job

Job Number: 90159304 Company Name: SAIC Job Location: Washington, DC US Job Category: Information Technology

Social Networks Analyst Job Social Networks Analyst (Job Number:327223)

Description: SAIC is looking for an exceptional Analyst to join our technically deep and diverse team in Washington DC. You will be working in a dynamic, operational environment, in which the contractor support team works side-by-side with our government customers, supporting a system user base distributed globally.

Primary duties include, but are not limited to, the following:

• Assemble facts and information from a variety of data sources and work products made available by various federal intelligence agencies; these may include data contributed by, but not be limited to, ICE, CBP, NCTC, FBI, NCIS, DEA, DIA, NSA, and open source materials.

Qualifications: TYPICAL EDUCATION AND EXPERIENCE:

•Candidate must possess an active TS/SCI at a minimum with the ability to pass a polygraph.

The following are desired but not required: Familiarity with Palantir</comment></comment>


How smart contract upgrades fail in practice - <AUTHOR> https://blog.trailofbits.com/2018/09/05/contract-upgrade-anti-patterns/ <comment><USER2> The Solidity language is deceptively low level, which partially stems from implementation details related to how the solc compiler chooses to implement language features.

Developers coming to Solidity from a language like Javascript or Python expect names in objects (~Contracts) to be significant determinants in terms of where the data associated with those names are stored. This is due to Javascript objects basically being dictionaries.

I think this problem could have been avoided early on if the storage locations of contract variables were derived from keccak256 hashes of their names. This type of implementation decision, though, would likely require disallowing shadowing of contract variable names in inheritance hierarchies (something I think is a good idea).

If you're not familiar how the solc compiler compilers Solidity to EVM, then using a keccak256 to determine where in persistent storage a value is placed might seem kind of crazy. In fact, this is par for the course. For example, solc implements Solidity key-value mappings by hashing the key along with some other stuff, and then writes the value into memory. This means that mapped values are spready out wildly through the persistent store -- so why not do this for variables?

<comment><USER3> Very diplomatic. I'd say tire fire.

</comment></comment><comment><USER4> People writing these things want a trustless, secure, easily changed, pseudo- anonymous contact.

I'm fairly sure you can do all those at once.

I think they are fighting a losing battle and we are going to see more dApps go back to central servers and just use the blockchain to hold certain ownership information. The rest of the account and logic will be in private servers.

<comment> mike-myers Did you mean "cannot do"?

It does seem like a tradeoff.

<comment><USER4> Opps. Yes.

</comment></comment></comment><comment><USER5> Smart contract programming requires a different engineering mindset than you may be used to. The cost of failure can be high, and change can be difficult, making it in some ways more similar to hardware programming or financial services programming than web or mobile development.

<comment><USER6> True, but why do we need to assume that all code should be written by web/javascript developers? Software is a big space.

</comment></comment><comment><USER7> I've been thinking about this problem for a few weeks now and I'm not certain you can safely upgrade any deployed contract.

I know a lot of dApp developers want to be more agile with their deployments but you shouldn't be changing the contract terms after the fact.

<comment><USER8> _You shouldn 't be changing the contract terms after the fact._

Exactly. The contract having an "owner" other than the parties who agreed to it is just wrong. Any real-world contract can be changed by mutual consent of the parties. The company that printed a contract form can't change a signed copy of that form.

 _" An agreement to agree is not an agreement"_ \- legal maxim.

<comment><USER6> Looks like this a known issue : [https://github.com/ethereum/EIPs/issues/763](https://github.com/ethereum/EIPs/issues/763)

although one of the proposed solutions involves having the contract maintain a list of owners. The list being maintained by ... the owner...<doh>:

[https://github.com/christianlundkvist/simple- multisig/blob/m...](https://github.com/christianlundkvist/simple- multisig/blob/master/contracts/SimpleMultiSig.sol)

It seems to me that you'd need to extend Ethereum such that contracts were created with multiple owners, by having each owner sign the creation txn. Once created, contracts could subsequently permit additions to the owner list by quorum logic implemented within the contract.

<comment><USER8> _although one of the proposed solutions involves having the contract maintain a list of owners. The list being maintained by ... the owner... <doh>_

That retains the control-freak EULA approach common to web design. The site is in charge, and you peons will take what we give you.</comment></comment></comment></comment>


Startup Relationships - <AUTHOR> http://codingskyscrapers.com/2013/01/14/startup-relationships <comment><USER2> Wow, I'm in an eerily similar situation. I'm also at the height of it I think. I am locked up all day working, spend almost every night, including weekends working until 2am -3am. I have trouble justifying spending time with anyone unless we are working on something. Also broke up with my girlfriend of 3 years a few months ago. I hired an assistant to help, which she does, but did not expect the amount of added stress having someone depending on you for income brings. Oddly, I thought it was all a good thing. I still do but am also factoring in this post and will need to re-evaluate.

<comment><AUTHOR> I used to feel exactly the same way. To me it felt like sacrificing things in my personal life was all 'just part of being an entrepreneur'. Sure you're going to need to give up some things if you want to succeed, but I don't think that should ever include spending time with the people that are closest to you.</comment></comment>


Sorting improvements in PostgreSQL 9.2: the case for micro-optimisation - <AUTHOR> http://pgeoghegan.blogspot.no/2012/08/sorting-improvements-in-postgresql-92.html

<comment><USER2> Dupe of <http://news.ycombinator.com/item?id=4327654> (thanks to non-canonical URL).

<comment><USER3> This submission's title (taken from the blog post) is more interesting.

</comment></comment><comment><USER4> Incidentally, this is the same reason why sorting in C++ using std::sort is much faster than qsort[1]. Basically, std::sort, which is templated, lets the compiler do the same specialization and inlining that this article talks about.

[1] <http://radiospiel.org/sorting-in-c-3-times-faster-than-c>

</comment><comment><USER5> (Reposting the comment I had left on the other version of this article:)

PostgreSQL should really be using a radix sort for these data types, not a quick sort (however "optimized").</comment>


Shroud of the Avatar (Ultima's Lord British / Richard Garriott's Latest Game) - <AUTHOR> https://www.shroudoftheavatar.com/ <comment><USER2> I can't wait to get home from my long day selling chairs to make chairs for Shroud.</comment>


Hermann Hauser: 'It's in Nvidia's Interests to Destroy Arm' - <AUTHOR> https://tech.newstatesman.com/business/hermann-hauser-nvidia-destroy-arm <comment><USER2> The UK is actually the one that has ignored and destroyed ARM (and Imagination Technologies) and it has been compared to 'selling off the crown jewels' [0] to SoftBank which was welcomed by a UK government cabinet minister in 2016 as a 'big vote of confidence in British business.' [1]

Actually, SoftBank got ARM at a special Brexit discount. For them, they saw it as the best deal of 2016 and for the UK, you might as well say they got scammed.

So fast forward to 2020, SoftBank didn't get that 10x return they wanted from ARM and is now selling to get a tiny profit, where it is apparently heading for Santa Clara.

The rest of the UK didn't care and didn't know what they had, until it was too late and the same fate was repeated for Imagination Technologies. What a shame.

[0] [https://qz.com/734882/the-32-billion-japanese-takeover- of-a-...](https://qz.com/734882/the-32-billion-japanese-takeover-of-a-british- tech-giant-is-not-a-big-vote-of-confidence-in-post-brexit-britain/)

[1] [http://blog.policy.manchester.ac.uk/posts/2016/08/arm- holdin...](http://blog.policy.manchester.ac.uk/posts/2016/08/arm-holdings- takeover-deal-are-we-selling-the-crown-jewels/)

<comment><USER3> Would be curious on any Brits' opinions on if this (failure to support revolutionary technology) happens more there, and if so then why.

Recognize biases of hindsight, but it seems like private equity markets in Britain aren't interested in technology at the requisite scale.

There's an incredible historical tradition [1], but the majority tend to be either developed with the help of a (1) few angel investors (and the luck and smaller scale that entails) or (2) government contracts (and the politics that entails).

[1] [https://en.m.wikipedia.org/wiki/List_of_British_innovations_...](https://en.m.wikipedia.org/wiki/List_of_British_innovations_and_discoveries)

<comment><USER4> I think Paul Graham went to the UK once to try to find technology investors. Once. (Can't find that essay right now.)

<comment><USER3> Speaking to something I have little experience with, but 'old, @&$@-you money isn't adventurous' would seem to apply.

<comment><USER5> Makes sense. If I had old f you money, I'd be more concerned about preserving it for multiple generations than growing it significantly.

</comment></comment></comment></comment></comment><comment><USER6> While the article talks about the possibility of the UK government blocking a sale to Nvidia, the situation with Brexit and the need to get trade deals with the US means it's _really_ likely the government here would allow the sale to go ahead should the US government make it a condition of a deal. Brexit has _screwed_ the UK.

<comment><USER7> A US trade deal is a symbolic and political victory but makes virtually no difference economically. I don't think the UK government will calculate that prospect of one would outweigh losing ARM.

<comment><USER8> I don't have the same level of confidence you do – the current UK government's strategy is very much "symbolic and political" over absolutely all other concerns.

Faced with the political impact of "that amazing US trade deal we promised you is off the table" versus "a company you probably haven't actually heard of, which was already Japanese-owned, is becoming US-owned"… well, I don't have much confidence.

<comment><USER9> you misspelt shambolic.

</comment></comment></comment></comment><comment><USER10> > Hauser says the acquisition would allow Nvidia to swipe "the microprocessor > crown from Intel", and become the chip supplier for 95 per cent of mobile > phones, 90 per cent of embedded controllers for the internet of things, as > well as taking the PC and data centre markets.

Is it a possibility that an acquisition by Nvidia will be blocked due to anti- trust reasons? Who is the authority who has to decide on that? Is it the UK cause ARM is a UK company? Or Japan because SoftBank is the largest shareholder?

<comment><USER11> Each country/country group that the to-be-merged company will have presence in can block the merger within its borders (assuming it has anti-trust laws, which most, if not all, will have)

Of course, the larger such a country (group), the more the to-be-merged companies will think pursuing the merger isn't worth it.

</comment></comment><comment><USER12> It's this short sighted argument. If Nvidia "destroys" Arm then they just end up flushing a billion dollars down the drain. ARM's is important because it's what everyone uses. Once Nvidia destroys it nobody will use it and therefore Nvidia will gain no leverage. If anything, once Nvidia buys ARM it will have to keep it alive.

<comment><USER3> The best play would be to take the Intel approach: run ARM independently, and just build best-in-class integration with Nvidia GPUs / features.

Substantial anti-trust concerns are avoided, while building exactly the moat you want: no competitor can afford to compete with the level of integration investment.

<comment><USER13> Why can't NVidia achieve this without spending tens of billions buying ARM?

<comment><USER3> You have a lot of options available when you own a company, that you don't have when they're independent.

Example: Nvidia would prefer certain specifications on an internal bus they'd use, but nobody else uses as a standard.

<comment><USER14> They can already do that

<comment><USER3> Not exclusively. ARM's roadmap is driven by what all of their customers want, not just Nvidia.

There doesn't appear to be sufficient profit margin in the industry for too many greenfield, non-reference custom implementations.

So if Nvidia-ARM sticks out a reference implementation or architecture choice that's beneficial to Nvidia, there's limited capability for others (Apple, Cavium/Marvell, Qualcomm, & Samsung?) to strike their own path, and they'll certainly be paying steeply to do so.

</comment></comment></comment></comment></comment></comment><comment><USER15> > would not only strike a blow to the UK's technological sovereignty

ARM is currently owned by a Japanese conglomerate.

[https://en.wikipedia.org/wiki/Arm_Holdings](https://en.wikipedia.org/wiki/Arm_Holdings)

<comment><USER16> I'm pretty sure Hermann Hauser is aware of this, since he co-found and later sold ARM.

He doesn't consider the Japanese conglomerate owing ARM a blow to the UK's technological sovereignty, but he does for Nvidia.

<comment><USER17> Didn't he complain about Japanese conglomerate owning ARM as well?

<comment><USER18> He did: [https://www.bbc.co.uk/news/business-36827769](https://www.bbc.co.uk/news/business-36827769)

</comment></comment></comment></comment><comment><USER19> Hauser is worried NVidia will pay $40B so it can light ARM on fire. That's crazy on it's face.

Follow-up by noting ARMs actual economic value is less than $10B, do it seems unlikely NVidia or anyone else would pay what SoftBank is asking.

Lastly Hauser says NVidia would do this to become the "dominant microprocessor company" in the world, then cut its customers off from new developments.

First, ARM isn't a dominant microprocessor company, it's architecture is dominant but it's revenues make it a flea among elephants. It doesn't make anything like Intel, AMD, or TSMC, it simply licensed designs. And it's own designs for that architecture, while popular, aren't near the best, Apples are.

Apple and others have perpetual licenses allowing them to make their designs and enhancements. No one is getting "cut off" from ARMs mediocre next gen designs, they may never use them to begin with.

<comment><USER20> ARM might be sold from SoftBank to get money. They aren't doing so well after the 'WeWork' garbage.

<comment><USER19> I understand they need money, but expect it will have to be a fire-sale. Unless my understanding of ARM financials is far off base, no financial buyer would pay even $10B, and it's hard to imagine strategic buyers paying over 3x that.

</comment></comment></comment><comment><USER21> Hauser seems like a fanatical UK nationalist nutjob who has lost sight of the simple reality that ARMs growth chances are looking very bleak. Everyone who wants one already has a perpetual license, all their licensees are better at improving the processors and extracting value than ARM has been.

</comment><comment><USER22> People who say that Nvidia "gonna destroy ARM" know nothing about Nvidia. All their history Nvidia live on lock-in integrations and for profiting from that they need ARM alive and thriving. A lot of open source folks might hate it, but Nvidia is R&D heavy company. Every year they come up with many new proprietary technologies that help them to keep perceived leadership and also keeps everyone locked-in into their tech.

All these technologies are intentionally built to make them hard to copy for competitors and easy to protect with patent encumbrance, but on the bright side technologies that actually prove to be useful slowly turn into open industry standards. So basically Nvidia invest a lot in niche features and then recoup the costs using their top-notch marketing.

IMHO what people missing about ARM is that on mobile market there are already companies with worse lock-in who don't tend to share their hardware innovations with others at all, e.g Apple. And high-end ARM SOCs market would only benefit if someone finally gonna compete with Apple on more than just marketing.

<comment><USER23> Company which is heavily pushing lock-in shouldn't be allowed to buy ARM, since it can cause too much damage by it.

Lock-in is not a driver of innovation, it's a brake on it.

<comment><USER22> I talked with you on several different platforms over years and I'm also a bit of open source zealot. But the deal is: reason why Nvidia able to keep their lock-in going for decades is because they actually do invest a lot into R&D and take risks.

There simply very few companies that doing it. Big reason why Intel and AMD have their open source teams is because that's give them edge against Nvidia. All we see from Nvidia competitors is just reimplementation of the same tech Nvidia already had, but once AMD have some good tech they keep it proprietary too.

ARM space is already locked-in and fully-proprietary company (Apple) have leadership. I don't see how Nvidia getting into competition can make it any worse.

<comment><USER23> ARM chips are used even by someone like AMD.

Point is, Nvidia can't be trusted not to use that anti-competitively, given their existing reputation and amount of leverage they would get on even more things. So if competition laws would have worked as intended, Nvidia wouldn't have been allowed to buy ARM.

</comment></comment></comment></comment><comment><USER24> I used to own ARM stock before the Softbank aquisition -- I'd love to be able to buy some again.

</comment><comment><USER25> Seems to promote IPO as an alternative to being bought, but doesn't seem happy with Softbank or (potentially) Nvidia.

<comment><USER26> ARM was previously listed, so would this be an Initial Public Offering?

<comment><USER27> Yep, because they don't currently have stock on any market.

</comment></comment></comment><comment><USER14> Time to buy RISC-V stock

<comment><USER28> What RISC-V stock, there is not a "RISC-V company". Which is one of the main points where it makes a difference.

Through you could decide go for SiFive, Inc through I have no idea if they entered or will enter the stock marked.

</comment></comment><comment><USER29> "However, Hauser fears that CFIUS regulation could be applied more broadly than this. "If the president decides Britain doesn't deserve to have any more microprocessors, then he can decide that Britain isn't allowed to use its own microprocessors," he says, adding that "these decisions should be made in Downing Street, not in the White House". "

Don't worry mr. Hauser. The target of the US cornering of the chip market is of course China ...

<comment><USER30> Which is why I would have thought SoftBank selling ARM to Huawei would be an absolutely perfect strategic move.

<comment><USER28> It also would be somewhat crazy, tbh.</comment></comment></comment>


App Store Rejected My App Due To Release Note - <AUTHOR> http://kuvalab.tumblr.com/post/78589668502/app-store-rejected-my-app-due-to-release-note

<comment><USER2> This happened to me once. I had a joke in the help file. They actually called me to discuss it.

</comment><comment><USER3> Proper SSL is nowhere to be seen. Please provide information.</comment>


Sunrise Shutting Down - "This is just the beginning". Part 2 - <AUTHOR> http://blog.sunrise.am/post/132088346354/this-is-just-the-beginning-part-2 <comment><USER2> I hate what Microsoft is doing with small innovative start ups. Buy them, shut them down. Integrate into their office ecosystem. I don't want and never will use their Outlook or Office programs. And especially not on Android or iOS.</comment>


Phone Numbers Were Never Meant as ID. Now We're All at Risk - <AUTHOR> https://www.wired.com/story/phone-numbers-indentification-authentication/ <comment><USER2> > But the United States doesn't offer any type of universal ID, which means > private institutions and even the federal government itself have had to > improvise.

Oh, please! No! No! No! India bulldozed a national identification number (called Aadhaar) on its residents and it has made more people vulnerable to many kinds of attacks, including phone number hijacking, draining people's bank accounts, etc. To say that it's been an unmitigated disaster would be an understatement. As with things related to government, the governing organization for Aadhaar, called UIDAI, always claims that it's completely secure, while ignoring the fact that linking one number to everything in one's life increases the attack surface and the severity of the threats.

So please research on the number of ways Aadhaar has failed, and is making some feeble attempts to recover, before getting into a "let's create a new static number to identify people with instead of a phone number or SSN". That'd just be changing the narrative without achieving anything.

Bottom line, it's not the phone number that's the problem, but having a unique and non-changing number and linking it to everything else (including one's phone numbers).

<comment><USER3> I disagree; I think the issue is people using a mechanism for _identification_ as a mechanism for _authentication_.

If all it takes to drain someone's bank accounts is to be able to uniquely identify them, then there's an enormous issue with the banking system.

> Bottom line, it's not the phone number that's the problem, but having a > unique and non-changing number and linking it to everything else (including > one's phone numbers).

Totally disagree. Linking it to a phone number is fine, but the _entire point_ of such a number is that you should be able to print in on your business cards or wear it on your t-shirt. :) Knowing it should grant no privileges to anyone.

Of course, I think your underlying point is that the real issue isn't that we want a good way of identifying people, it's that we want a good way of _authenticating_ them, and we're no closer to solving that. And people keep misusing ways of identifying people as ways of authenticating them. But maybe we should be focusing on that instead?

<comment><USER4> Estonia gives everyone a smart card they can use to digitally sign things. Obviously someone can steal your card but it's pretty hard to forge otherwise.

It's a solved problem, just nobody wants to fix it.

<comment><USER5> How much trouble are you in if your card gets stolen?

Would you call a number to temporarily block it, and a fine to get a new one? If so, how does the call authenticate you?

Second question, "pretty hard to forge otherwise", is about roughly how hard? Has it been proven possible / proof of concept? Or did you mean to say you're unaware of any successful forgeries but (naturally/obviously) can't honestly claim it's totally impossible, because you never know.

I'm real curious about the Estonian smart card thing. Does it work well? Can you only sign government things with it, or really just about anything that needs your authentication? (say, commercial contracts) Does it have a private/public key type of thing so that you could also encrypt something with someone's public key so that only that one individual cardholder can ever decrypt it?

<comment><USER6> Basically it's a physical device that stores your private key.

So if you can forge that, you can crack open the whole Internet :)

</comment></comment></comment></comment></comment><comment><USER7> Bootstrapping identity is a very hard problem, and implementors can't resist the easy path of piggy-backing on someone else's identity or authentication system -- social security numbers, email addresses, telephone numbers, etc.

AT&T is being sued by someone who lost $24M in cryptocurrency because someone decided to piggy-back authentication on AT&T. While AT&T should certainly be called out for having sloppy security, I can't help but feel that they never really signed up for the job of protecting such a valuable asset. It's like trying to protect Fort Knox with a consumer-grade padlock, then going after the padlock manufacturer when someone cuts it open.

<comment><USER8> This is fundamentally a regulatory and economic problem. The exact challenge- response flow and physical artifacts/electronic credentials we use to assert identity and request access with change over time. Businesses are only motivated to prevent fraud if they will be liable for losses. They have managed to label it "identity theft," as if you forgot to lock up your bicycle, and give ironic post-breach advice to their customers like installing anti-virus software and not surrendering information to unsolicited callers.

Incentives need to be aligned. The Trump Administration cancelled the investigation into Equifax. Target's stock price barely budged. Regulations may not be a panacea as the OPM breach suggests. "Cyber insurance" is an interesting market. Ideally insurers would require best practices to be followed for policy issuance and claim payout. But that can lead to compliance box checking, and litigation/coverage struggles instead of actual security.

<comment><USER9> What you say about Target's stock price is true, but markets exist to price assets, not to punish malefactors. What this shows is that the market decided losing a ton of data wouldn't affect Target's bottom line; this supports your point about incentives but is itself not something in need of adjustment. The market is literally signaling that losing customer data isn't going to cost a company anything.

</comment></comment></comment><comment><USER10> Phone numbers are obviously flawed as identifiers, but so are social security numbers, drivers license numbers, etc. If the United States introduced a national ID it, how would it avoid the same problems as the de-facto national ID, the social security number?

Biometric data can be replicated, e.g. fake fingerprints and synthesized voices. Good facial recognition is still a step ahead of scammers but they may catch up at some point. And you can't easily change your biometric data if someone manages to make a copy.

At this point everyone knows passwords by themselves are not good enough.

Physical tokens like Yubikeys can be stolen, although that's clearly more difficult than stealing some of these other identifiers.

If everyone had a cryptographic private key, they would have to store it somewhere -- how would they keep it secure without resorting to one of the flawed systems I just mentioned?

So, I find it difficult to blame companies for using phone numbers as identifiers -- it's easy, and all of the alternatives are also flawed. I haven't seen any foolproof identifier, probably because it's not possible to create one.

<comment><USER11> > If the United States introduced a national ID it, how would it avoid the > same problems as the de-facto national ID, the social security number

Everyone gets a national ID number. This number is considered public and is used for signing up for public and private services.

Everyone gets a ID card, issued by the government. This ID card holds a private key, used to enter legally-binding agreements, and the card is printed with the photo of the holder. Attempts to use the card to authorize purchases online redirect to a government-managed identity provider (think SAML 2.0), where the user must provide either a password (preferable) or, if there is no password, some other knowledge proof that is not discernible from the physical ID card, either of which were set up when the card was issued. When people become incapacitated for publicly-known reasons (incarceration, hospitalization, etc.), their public certificates are temporarily added to a revocation list. When issued, the card comes with three one-time-use secret codes, each of which triggers a 24-hour temporary revocation, which must be kept secret-enough to prevent abuse. Obtaining more temporary revocation codes, or permanent revocation (in case of loss or theft), or password/knowledge proof reset without the previous password/knowledge proof, is handled in physically secure government facilities, by providing DNA and other biometrics, that were registered when the card was issued and are not used for any other purpose. Corruption is combated at the DNA-collection stage by requiring the secure facilities to actually collect fresh physical samples each time - this constitutes a biological sort of paper trail for auditing revocation requests.

No, it's not impossible to game the system. People can be bribed to overlook the photo; DNA can be stolen and used to continually permanently-revoke victims. Paper trails are not magic cure-alls. There are serious ethical concerns with entrusting the government with a populace's DNA (particularly, the potential to re-index it for the purposes of ethnic cleansing). And yet, when compared to modern-day systems, I'm hard-pressed to complain. If you ask, quite simply, which is better, the system proposed above or the contemporary system, one or the other, I have a hard time imagining people defending the contemporary system.

<comment><USER12> What you have described is (mostly) how Swedish society already works. Even the SAML part — we'll be forced to support eIDAS as of next month!

Everyone resident in Sweden must be registered in the Swedish Population Register, and receives a personal identity number. Due to the Swedish constitution, information held by the government must be publicly available, so people's names, dates of birth, addresses and indeed identity numbers are not secret (though the last of these isn't on Google). This means that in order to prove your identity, people use ID cards and corresponding digital ID issued by the government and banks. Said digital ID is a passcode-protected certificate, either on a phone, a computer, or a physical ID card.

The government doesn't have your DNA here though, although citizens' passports and ID cards contain fingerprint data.

</comment></comment></comment><comment><USER13> Tieing 2fa directly to the phone is much better than tieing it to a phone number, until you don't control your phone. Then, how do you recover? You can't go down to the local Google (or whoever) kiosk, prove your identity, and get a new device added to 2fa, but you can get a new sim (downside, so can pretty much any carrier kiosk employee, or social engineer).

Also, phone numbers are pretty useful for contacting people, and most people have an address book with their friends and family and other important contacts. There's tremendous social value for people in those numbers continuing to work, to the extent possible. You're never going to be able to tell everyone who might want to know when your number changes, especially if you for a new number when yours was assigned to someone else.

<comment><USER14> > how do you recover?

* By using the TOTP recovery codes (you did write them down, right ?)

* By using a TOTP client on another device (the client I use syncs it's (encrypted) database with all my iDevices)

* By restoring from a backup of your phone (you do have a backup, right ?)

<comment><USER15> The iCloud backup of my phone when restored to another phone didn't bring over any of my authenticators. I don't know if a physical backup would or not but it's worth noting.

<comment><USER16> Well, if that were not the case, your apple id would be the second factor to everything.

<comment><USER15> You're right. I'm not criticizing, just noting it for anyone that might think the online backup would be sufficient after reading the comment I replied to.

</comment></comment></comment></comment></comment><comment><USER17> I implemented number porting for a startup I worked for. It's all pretty scary: yes, it's easy to impersonate someone if you have some information about them, but some carriers don't check any sort of porting pin at all. That is, attackers sometimes do not need to impersonate you, they just have to ask for your number.

It would be great if we all had something big more secure, but in the meantime understand your carrier's port out process and that you have your number secured.

</comment><comment><USER18> My UK NI number is burned into my brain. It might be because it was given to me at a highly emotional time (transition from school to unemployment and university) or because I had to know it to complete forms (UB-40 and P-45 employment status).

From thirty years distance, trying to re-connect to my UK pension rights, as a non-resident migrant, it floated back up into my consciousness instantly. I suspect even with dementia its one of the digit strings I'll hang onto.

FWIW former forces probably have their serial number forwards and backwards because of hazing. I only have my NI number because of money.

</comment><comment><USER19> We should more than ever be teaching everyone not to use their real name on the internet, not to give out their phone number or private email address. In the internet and for businesses for advertising or any other avoidable purpose. This would eventually prevent the assumption that everybody has a phone number that can be used as authentication, or even worse, a Facebook account!

</comment><comment><USER20> Every factor is vulnerable.. phones, phone provider, gmail accounts, yubi keys and even yourself. What if someone points a gun at you and asks you to transfer all the bitcoins?

Why not distribute the authentication factors among multiple trusted parties instead of a single person? This would not scale for normal use cases, but could help for mission critical updates. For example, if I change my gmail password or port my phone number or update my auth factors (which are all considered major/mission critical changes), then the change has to be verified by at least 51% of my trusted contacts. So, instead of verifying authentication just with me, the provider has to send 2fa tokens to all my trusted parties (my spouse/partner, close friends, family members, etc). If 3 (out of 5) have verified and approved the change, then the provider would implement the change.

</comment><comment><USER21> Never meant for identification purposes, just like social security numbers:

[https://www.npr.org/templates/transcript/transcript.php?stor...](https://www.npr.org/templates/transcript/transcript.php?storyId=593603674)

(interesting Planet Money episode on the history of the SSN)

</comment><comment><USER22> I repeat this on related threads: taking over _any_ US phone number's inbound/outbound SMS traffic with the ability to intercept inbound SMS as well as send SMS originating from a particular number is dangerously easy. It takes one minute, and ALL numbers are vulnerable. Worse, there is no fix for this. Never ever use SMS for authentication, or sensitive communication of any kind.

I believe this is being exploited on a regular basis and people just have no clue. This is likely used for anything from gaining access to email accounts to insider trading to political leverage to who the heck knows what else.

<comment><USER23> There are a couple of vendors out there who at least try to detect SIM swapping and traffic hijacking. It's better than nothing and eliminates the simplest attacks, but still has it flaws, including happy path case support (like only working on the network and needing a smart phone).

</comment></comment><comment><USER24> So, do phone numbers get recycled?

For instance, if I change phone company and decide not to keep the number or they're unable to transfer it, can it be assigned to someone else?

<comment><USER25> Happened to my number at least (I live in Sweden). A person sent me a text message saying he had my previous number and that he got frequent calls from my friends.

<comment><USER24> Jesus... Yes, this is NOT good, considering the number of services that you can log in into with just a SMS confirmation (my bank, for instance).

</comment></comment></comment><comment><USER26> I see no problem with using phone numbers can be used as an ID. They should not be used for _authentication_ though.

For some reason it has become fashionable to force 2-factor authentication on users using SMS as the 2nd factor. That is a terrible idea, and yet it proliferates, especially at most calcified institutions (banks, DMV, twitter). This has to end.

</comment><comment><USER27> The US absolutely offers universal id, it's just federated. All states will have common identity standards shortly (all but 2-3 do today).

There's a parallel system through the various passport and trusted traveler schemes that are controlled by the US government directly as well.

</comment><comment><USER28> Neither were social security numbers. If OPM and equifax breaches weren't enough,I don't know what is.

I think the west as a whole would change fast when this information is used against them in war with a formidable adversary(russia,china...)

</comment><comment><USER29> Lebanon was fun. When I arrived and purchased a SIM card, after getting on the different smartphone instamessage systems everyone that knew the previous owner started contacting me.

</comment><comment><USER30> Well, Germany could have provided a (relatively) easy solution with the new (ah well, 10 years old by now) Personalausweis identity cards - they're RFID capable and contain crypto functions.

Actually, there _is_ a solution for using them to sign stuff - but it's proprietary in any case, and requires expensive certificates.

<comment><USER31> Not everyone has a Personalausweis.

<comment><USER30> Nearly all Germans do have one (yes, I know, having a passport is sufficient... but, anecdata, never met anyone with only a passport), and iirc the Elektronischer Aufenthaltstitel required for non-German residents of Germany has the same functions.

It's a perfect model of "the tech would be there but government is incompetent/corrupt and so it is not freely available for the benefit of citizens".

</comment></comment></comment><comment><USER32> tl;dr

> The use of phone numbers as both lock and key has led to the rise, in recent > years, of so-called SIM swapping attacks, in which an attacker steals your > phone number. When you add two-factor authentication to an account and > receive your codes through SMS texts, they go to the attacker instead, along > with any calls and texts intended for the victim. Sometimes attackers even > use inside sources at carriers who will transfer numbers for them.

</comment><comment><USER33> We're seeing more biometric authentication with fingerprints, face recognition, perhaps retina scan. How do these methods perform in practice, considering both their contribution to security and their practical application?

I currently authenticate on my iPhone with fingerprint. How hard is that to crack? If you had the victim's fingerprint, it's apparently trivial [1]. But accessing my fingerprint is not something that a random hacker/thief on the Internet would reasonably be able to do.

Since our phones are becoming our life-key. Would a 3-factor authentication sufficiently protect us?

Something you have: SmartPhone.

Something you know: Password.

Unique part of you: Fingerprint.

[1] [https://www.businessinsider.com/fingerprint-hacked- smartphon...](https://www.businessinsider.com/fingerprint-hacked- smartphones-2016-3)

<comment><USER34> Fingerprints are so fucking dumb.

You can't change them and you leave them everywhere!

They're good against stopping your nosy family members from seeing your password, but what am I supposed to do when dining or paying someone? Wear gloves?

If the cybersec game turns into "collect physical fingerprints" then the gangs are going to collect physical fingerprints and then what?

What we need is something dynamic that's hard to fake, like a human voice or face, tied to a government issued cryptographic device with no input ports / volatile memory / inbound network adapter.

You say a challenge sentence out loud. The device validates. Then the device signs or authenticates or whatever. For integrity it could optionally encrypt and broadcast what happened.

You lose the device, you get a new one just like you get a passport. In person with other documents, etc.

This really isn't that hard. We could have done it decades ago.

<comment><USER35> > government issued cryptographic device

I don't trust my government to be competent at cryptography.

Some people don't trust their government to be non-malicious.

<comment><USER36> > I don't trust my government to be competent at cryptography.

Which government is it? If it is the US, you might as well not trust any cryptographic schemes, considering how many of them were developed by NSA.

<comment><USER31> Not the ones that "count" or should be used. Just look at the Dual_EC_DRBG desaster.</comment></comment></comment></comment></comment>


Simple-peer: Simple WebRTC video, voice, and data channels - <AUTHOR> https://github.com/feross/simple-peer <comment><USER2> I'd love to use something like this that forced all to go through a turn server, I'd like to be able to protect each participants ip address from getting taken by the other person.

I know in a way that is backwards to the whole peer to peer thing - but maybe there is a way to let people spin up virtual turn servers that would increase the turn-mesh-net's bandwidth - and so all using this sub-system could benefit and yet all be protecting from having their ip discovered ?

This webrtc stuff is great for friends / family / coworkers, but strangers on the internet gets a little dicey once in a while.

</comment><comment><USER3> What drives me insane is why are not people using WebRTC for video game client-server communication on the web. It works similar to UDP but controlled, so the security risks are significantly reduced. Now with simple- peer there's an easy way to implement this in the server, and you can have the same engine running on node and on the browser as well.</comment>


Ask HN: Building several small companies, how to incorporate them? - <AUTHOR>

I am going to prototype a few really small lifestyle businesses. Just little companies to try and generate some income. I want to make sure I am protected from liability, but due to how limited the income will be, I don't know how to proceed.
These will be small companies and projects. Does it make sense to just incorporate one entity and then run the companies under a single umbrella? This would open other companies up to the liability of all of them?
Should I make a single master entity, and then have small subsidiaries? What makes sense for operating a few small lifestyle businesses, while limiting liability? <comment><USER2> Short answer - ask your lawyer/accountant.

I personally run a few small businesses out of 1 LLC. Because I am a single employee of the LLC, the LLC gets treated as a disregarded entity ([http://www.irs.gov/Businesses/Small-Businesses-&-Self- Employ...](http://www.irs.gov/Businesses/Small-Businesses-&-Self- Employed/Single-Member-Limited-Liability-Companies)). I work with my accountant to report everything from all the different websites/business but at the end of the day, it gets reported on my personal tax.

<comment><AUTHOR> I don't have and an't afford a lawyer. At te end of the year I will get an accountant to do my taxes. It sounds like you are running a couple companies under a single entity. I think that makes sense. In a best case situation any individual company would generate ~10k in annual revenue. Maybe the better ones would be 80k.

What did your lawyer say about liability. If one company got sued, couldn't they come after the assets of another because it is knly a single entity?</comment></comment>


Michel Jouvet, Who Unlocked REM Sleep's Secrets, Dies at 91 - <AUTHOR> https://www.nytimes.com/2017/10/11/obituaries/michel-jouvet-who-unlocked-rem-sleeps-secrets-dies-at-91.html?module=WatchingPortal&region=c-column-middle-span-region&pgType=Homepage&action=click&mediaId=thumb_square&state=standard&contentPlacement=17&version=internal&contentCollection=www.nytimes.com&contentId=https%3A%2F%2Fwww.nytimes.com%2F2017%2F10%2F11%2Fobituaries%2Fmichel-jouvet-who-unlocked-rem-sleeps-secrets-dies-at-91.html&eventName=Watching-article-click&_r=0 <comment><USER2> Once cats' pons were destroyed, the cats began to move on sleep suggesting that they were dreaming.

Does that mean those who sleepwalk also have damaged pons?

<comment><USER3> I don't know the answer to your question, but I'm a very regular sleep walker. I also have no recollection of my dreams (except a few).

I've been known to rip out electric outlets (in my sleep, I was convinced my blankie was stuck in the wall), scratch plaster walls until my fingers were bleeding (I was looking for a hidden door), conduct hour-long conversations about topics that my conscious self knows nothing about, or throw all the bed linen out the window into the swimming pool (this is related to a recurring night terror where I think a spider has fallen on the bed). That last one sounds funny, but it gets annoying for the hotel clerks after the second or third night in a row.

There's also the issue of having intimate relations with people who happen to be in the same bed/room/house, without me knowing about it.

Happy to answer questions if you have any.

<comment><USER2> I am recalling my own sleepwalking experience. As a kid with severe allergies, I would get out of bed, go downstairs, grab a tissue sometimes a towel tissue, and then go back to bed. I would have no recollection of it when I woke up.

Was this muscle memory doing its thing? Or was this instincts? Or was it something embedded in the mind? I am not sure.

What your comment does bring up the possibility of is that maybe the pons are not damaged. But rather the other brain functions out power the pons of the brain. Otherwise, you would always be sleepwalking. Maybe the pons are there to absorb body movements that come from thought.

Very exciting questions indeed.

</comment></comment></comment><comment><USER4> I hope he died in his sleep

</comment><comment><USER5> No tears now, only dreams.

</comment><comment><USER6> In one of his experiments, Jouvet deprived cats of sleep until they drowned in a vat of water. The cats survived an average of 35 days: [http://web.archive.org/web/20140821072716/http://psychology4...](http://web.archive.org/web/20140821072716/http://psychology4a.com/sleep8.htm)</comment>


Apple's iOS 6 Wi-Fi problems linger on - <AUTHOR> http://www.zdnet.com/apples-ios-6-wi-fi-problems-linger-on-7000004799/

<comment><USER2> I think that by now, everyone should have learned the lesson to not buy anything the instant it comes out. It seems like every first batch of hardware has issues, and every major software revision requires bug fixes.

The very simple solution is to wait. I always wait for the first major patch to OS X before upgrading, and a couple of months before new hardware. While I don't have the latest shiny gadget, my life is a lot simpler.

I shudder whenever I see someone upgrading the development machine their professional life depends upon to the new version of OS X on release day.

<comment><USER3> > I shudder whenever I see someone upgrading the development machine their > professional life depends upon to the new version of OS X on release day.

The Arch Linux demographic.

<comment><USER4> Doesn't Arch use rolling release? Kind of the opposite I think.

I use Fedora these days out of laziness, but rolling releases was one of the things I really enjoyed about Gentoo. _Far_ less upgrade induced stress.

<comment><USER5> Rolling release is favorable in that sense. I prefer dealing with a single problem every other month or so as opposed to many things breaking all at once.

<comment><USER4> Exactly. It's also _much_ easier to rollback one change with a regression with a rolling release system than it is when that single change with a regression came packaged with hundreds of other functional changes.

Kernel regression in Gentoo? No worries, boot the old one.

Kernel regression in Fedora? No worries, boot the old one... unless this was across an upgrade boundary. _Then_ you get to have fun.

</comment></comment></comment></comment></comment><comment><USER6> I have owned every iPhone model and have never one one issue with Wifi. And I work in the mobile business so I have probably been on 500+ wifi networks.

<comment><USER7> I have had a similar experience until iOS6, I am not happy.

</comment></comment><comment><USER8> Apple's software development seems to play a second fiddle to their hardware development a lot.

This is OK in most instances since I don't buy a lot of their software, but if you fail to get the firmware and the drivers working, it's a major problem.

</comment><comment><USER9> Me and many others are encountering similar issues on Apple laptops since upgrading to OS X 10.8 (search for mountain lion wifi problems). Things that appear to help for me are running a ping to the router in the background, or disabling WPA 2.

Also, iOS 6/OS X 10.8 users are having trouble access points at my workplace, while other devices appear to be working fine. Since OS X 10.8, I'm also having trouble connecting it to my Samsung Galaxy S3's WiFi hotspot, whereas my girlfriend's 10.7 laptop is connecting without issue.

That said, every OS upgrade seems to have a bunch of issues that affect a small number of users, and the current ones don't seem particularly abnormal.

</comment><comment><USER10> Android doesn't get a pass here either. I have a GSM Galaxy Nexus with the OS directly provided by Google. After the Android 4.1 update wifi is completely unreliable. I work from home so the phone is on wifi most of the time. I usually have to reboot it to get wifi working again, although sometimes turning wifi off and then on works after a minute or so. (This doesn't affect any of my other wifi devices nor this phone with the prior OS version.)

Google have known about it since mid-July <https://code.google.com/p/android/issues/detail?id=34942>

</comment><comment><USER11> Much as they've made other mistakes, lingering WiFi issues are not necessarily Apple's fault. There are all sorts of things that can go wrong.

For example, I've had routers be unstable with some particular devices because of specific encryption settings. Ironically, I learned about that chipset problem while I was getting ready to throw dd-wrt on the offending router in frustration. I've had access points give super-slow connections to new devices until the AP was rebooted. And on and on.

WiFi works most of the time, but when it doesn't it usually isn't easy to figure out what (or even where) the problem really is.

</comment><comment><USER12> Does anyone else feel the iOS6 has more drawbacks than previous updates?

<comment><USER13> Like having ONE issue, the Maps, and everything else being better?

<comment><USER14> Says he in a thread about wifi problems? I'm regretting upgrading and not because of the maps. My work wifi has become completely unreliable.

</comment></comment></comment><comment> X-Istence I have an iPhone 4S and my Wifi is WPA2-AES secured and I haven't had any issues with Wifi in any locations that I've used it.

<comment><USER7> I have a 4S and my home WiFi with AES is nearly unusable (extremely slow and major packet loss), I have to disable WiFi and use cellular. Was working fine with iOS 5.

At work my iPad3 is doing the same thing with our AES WiFi but working fine at home.

Also WiFi tethering is not working with similar issues between the two devices but bluetooth is fine.

Again iOS5 had been working perfectly for a year on these networks. I am not happy.

</comment></comment><comment><USER15> I had this issue with my iPad, but not my iPhone (same wifi network) and then an hour later.... magic. It worked.</comment>


The Simulated Annealing Algorithm - <AUTHOR> http://katrinaeg.com/simulated-annealing.html <comment><USER2> You can get a lot of the way (just not to `exp((E_old - E_new) / Temp)`) by explaining the origin of the algorithm:

People who work metals have a process for making metals more supple, called "annealing". In annealing, you heat the metal up almost to the point where it loses its shape, then let it cool slowly. In the atomic picture, this chunk of metal has knots of stress and tiny mis-aligned crystals, but if we let the atoms jiggle, the knots can just work themselves out and the crystals can grow, because atoms want to align with their neighbors. It works the other way too though: If atoms jitter randomly then at any time they can exhibit a chaotic state, so if you suddenly stop that jitter ("lowering the temperature too fast"), then you just get a random state. So there is a sweet spot. You want just enough jitter to undo knots, but not so much jitter that you create new ones. By slowly reducing the temperature, you get to pass some special points where the neighbors have about the same impact on the crystal as the jitter, and as you slowly pass that, the jitter starts undoing the knots for you and then growing the crystals for you. You still often don't get perfection, but you can get closer.

What does this have to do with optimization? Physicists like to think of this "aligning with neighbors" process as minimizing some "interaction energy". But you can minimize whatever function you want with the same approach: (1) take any state you want, (2) let it randomly jitter to neighboring states, (3) accept the new states when it makes your function smaller, but also (with some probability p) when it makes your function larger, and (4) slowly lower p as you allow the system to randomly jitter around.

You can also get a good idea of what's going on with a graph:

        \   _b    / _
         \_/ \   /  _|-- B
              \_/   _|-- A

Let's explain simulated annealing by looking that the barrier above (b), which has two different energy costs to jumping over it: B from the left and A + B from the right.

Here we understand the jitter as having a typical energy E which lets it jump up the graph, but it still tends to fall in the holes. When E > A + B then it will jump from the deeper valley on the right into the left and back. But as we get into the range B < E < A + B, then it's possible to jump from left to right, but not easily from right to left. The more we allow the system to jitter in this region as we slowly reduce E, the more likely the state ends up on the right somewhere, and then from that point on the algorithm mirrors your normal gradient descent algorithm.

<comment><USER3> > You can get a lot of the way (just not to `exp((E_old - E_new) / Temp)`) by > explaining the origin of the algorithm

The exp is from the so-called Boltzmann factor [1] which (in somewhat simplified terms) describes the likelihood that a physical system in equilibrium at temperature T will transition from a state with energy E_old to one with energy E_new. So sure, you can derive the whole algorithm from classic "annealing" and physics alone.

1\. [http://en.wikipedia.org/wiki/Boltzmann_distribution](http://en.wikipedia.org/wiki/Boltzmann_distribution)

<comment><USER2> I mean, I know where it comes from; I just don't think that there's a nice hand-wavy way to get people to understand what's going on there: you really need to start with how uncertainties multiply across a system, define entropy as log(W) in the NVE ensemble, discover temperature hiding there too, then switch to the NVT ensemble (i.e. connect to an infinite reservoir of energy at a certain temperature) -- then you can get at Boltzmann factors.

Even then, as was pointed out to me recently, it's not clear that the "always accept a lower energy, accept a higher energy proportional to the Boltzmann factor" yields a steady-state Boltzmann distribution -- especially because that would imply that the result is independent of the number of configurations with a given energy (the "density of states"), which seems surprising. If that doesn't hold then it's either a convenient approximation or a bit of magical thinking...

</comment></comment></comment><comment><USER4> It's very hard to have 'proofs' about convergence of global optimization algorithms, because to do so, you have to make assumptions about the smoothness of the fitness landscape, the type of minimas, etc, etc.. This means that when someone is interested in publishing a new optimization algorithm, they just cherry pick a subset of problems and show that their algorithm works better on those, when used with a given set of hyper- parameters.

In theory, the no-free-lunch theorem means that there is no optimal algorithm for an arbitrary fitness landscape, but in practice, almost every single optimization of actual interest is somewhat smooth.

Anyway, here is an interesting set of benchmarks by Andrea Gavana about different optimization algorithms: [http://infinity77.net/global_optimization/ampgo.html](http://infinity77.net/global_optimization/ampgo.html). In my experience, as long as the fitness landscape is relatively smooth, multi-start gradient based methods tend to perform better, assuming you can get a somewhat decent approximation of the gradient (with AD, it's not too difficult).

</comment><comment><USER5> As introductions go, this is not very good.

For example, the first sentence "Simulated annealing is a method for finding a good (not necessarily perfect) solution" is incorrect in theory, while correct in practice. I feel that it is this dichotomy that brings the most insight to the strengths and weaknesses of the approach. Further, the post doesn't give any good intuition on why it works, or how it works, or how it compares to alternatives... everything you would want to know. It also gets other details not quite right, like the origin of the Gibbs measure (the name "simulated annealing" comes from analogy to the annealing process in metallurgy, but the Gibbs formulation comes from probability theory, and the application here via the Ising model and electromagnetism). This isn't very important to a practical intro I guess, but it makes it harder to find the right places to read deeper if you wish to.

It's fairly easy to prove that simulated annealing done "properly" will converge to a uniform distribution over all global minima. The "properly" here involves a logarithmic cooling schedule and a little thought should convince you that this is in practice not going to help you any more than exhaustive search will.

It's very difficult to prove useful properties about convergence or distribution on faster cooling: therin lies the rub.

I suspect a big part of the popularity of the approach is that it is extremely easy to implement, but unfortunately naively application often doesn't work very well on complicated energy state spaces.

<comment><USER6> > It's fairly easy to prove that simulated annealing done "properly" will > converge to a uniform distribution over all global minima. The "properly" > here involves a logarithmic cooling schedule and a little thought should > convince you that this is in practice not going to help you any more than > exhaustive search will.

Are you sure this is proven? What if ergodicity is broken?

<comment><USER5> Too late to edit the parent, but you are right to call me out on this, thanks!. Clearly without some ergodicity constraint you cannot have uniform distribution.

I was sloppy with terminology, sorry. The original approach to this require weak and strong ergodicity conditions on an inhomogeneous Markov chain (but not stationarity of the chain, i.e. you don't have to run it forever). This was worked out in the mid 80s by Gidas and Mitra if I recall correctly, and several interesting updates since then. There are other probabilistic arguments made as well, after that.

I can dig out references if anyone asks.

<comment><USER6> The problem then is that proving ergodicity is extremely hard for anything that is not a Markov chain to begin with.

IIRC ergodicity of hard spheres is not yet proved in full generality (n spheres, d dimensions), and that's basically the simplest physical system there is!

</comment></comment></comment></comment><comment><USER7> I nearly snorted my coffee through my nose at this:

        "Simulated annealing's strength is that it
         avoids getting caught at local maxima ..."

It's true that SA generally has better local-maximum avoiding properties than simplistic hill-climbing, but I've generally found that shotgun stochastic ballistic hill-climbing works at least as well.

But all these things work the same way:

* Do something random and see how good it is;

* Jiggle it at random and see if it's better;

* Consider changing.

<comment><USER8> > shotgun stochastic ballistic hill-climbing works at least as well

This is the method that I'd like a lot of these stochastic optimization algorithms compared to, especially genetic algorithms.

At least brute force sampling of the entire space is guaranteed to find the global extremum at some point, an argument I've heard for random sampling & minimising vs. GAs for random structure searching in materials science (a very high dimensional problem). It doesn't code any assumptions about the surface in, so can't be optimal, but that can be a benefit if you want to find something surprising.

<comment><USER7>
      >> shotgun stochastic ballistic hill-climbing
      >> works at least as well

      > This is the method that I'd like a lot of these
      > stochastic optimization algorithms compared to,
      > especially genetic algorithms.

      > At least brute force sampling of the entire space ...

Not sure you meant it to do so, but this sounds like you think that "shotgun stochastic ballistic hill-climbing" is a brute force sampling of the entire space. It's not, it's a stochastic optimization algorithm. Brute force sampling of the entire space, or even reasonable portions of it, is completely infeasible for the problems I deal with, so I'm not sure what you're saying here. You might like to explain a little more.

<comment><USER8> Now I've read your other comment with the terminology, I think "shotgun hill- climbing" is the appropriate phrase for the sort of materials science thing I'm talking about - you start atoms in random configurations, with minimal bias, and then minimise using the forces (available analytically) on those atoms using gradient descent/whatever optimiser (usually BFGS) until you find local minima. There's no momentum involved, and the gradient is available, but you still start in random positions and minimise to local minima. That sort of method is in competition with other structure finding algorithms that use GAs, SAs or some other fudged hybrids.

My reference to "brute force" was that, as far as I understand, in the limit of lots of attempts, "shotgun" will approach "brute force" \-- imagine a really nasty landscape with lots of tiny basins. I understand "stochastic ballistic" modifies things slightly.

<comment><USER9> If gradient is available then it makes little sense to say you want people to compare that method to GAs. GAs are for black box search.

<comment><USER7> Discrete gradients are always available - you can step in random directions and re-evaluate giving an approximation. If your space is smooth(ish) (and usually it's "smooth enough") then you can use the local approximations.

Yes, sometimes it's not possible, but usually local random search gives enough to use the concept of "gradient" to help. Mostly I find that people doing the optimisation/search don't know enough about the techniques they're using to adapt them and transform their problem to get the best out of things.

<comment><USER9> Yes, but it still makes no sense to compare GA performance with a gradient- based method on the problem GP is talking about, because an explicit gradient is available.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> As a tangent, I'm really happy to see that Python is slowly but surely becoming the go-to demonstration language of posts like this. Wasn't always this way. Python is so lucidly readable that it serves great as "executable pseudocode". I mean, if you provide pseudocode for an algorithm, might as well write Python - it's mostly as readable and a huge advantage is that you can actually run and test it.

<comment><USER11> I think the widespread use of scipy/numpy is directly correlated. Python code is generally very easy to port, too, so I'm very happy when it's used for examples even though I don't "know" or write Python.

</comment></comment><comment><USER12> This method comes from statistical physics. Basically you want to generate a Boltzmann-distribution of states in the function of "energy". By defining the Markov chain in a certain way you can achieve this. This is the Metropolis- Hasting algorithm[1].

I believe it's somewhat hard to use this algorithm for optimum finding. You have to tune the temperature and it's works best if you have a good initial temperature and you need to cool the system down slowly (so you have to choose a reasonable timescale for thermalization). Some physical insight could help with both.

However this algorithm is used to actually simulate physical systems on finite temperature where you do not need dynamics. You only simulate the Boltzmann- distribution and you measure interesting mean values and correlations. Mostly used for describing phase transitions.

[1] [http://en.wikipedia.org/wiki/Metropolis%E2%80%93Hastings_alg...](http://en.wikipedia.org/wiki/Metropolis%E2%80%93Hastings_algorithm)

</comment><comment><USER13> Genetic algorithms and simulated annealing are probably some of my favorite topics which ended up not being applicable in my day job, despite working very heavily in non-linear optimization. Our problems are of the size where gradient-based wins the day, hands down. But GA/SA are still very fun for my side projects.

<comment><USER4> Simulated annealing can be gradient based - the simulated annealing step refers to the probability of accepting a given minima as a function of the 'temperature'.

<comment> a-priori Simulated annealing is gradient based. It's an extension of gradient descent and in the degenerate case (zero temperature) they're the same: it generates random neighbouring states, and if the fitness of that state is better than the current one then it jumps there. That is, it seeks the local minimum.

The key part that simulated annealing adds is that when the temperature is non-zero there's also a chance of jumping to _worse_ states. The probability depends on how much worse the new state is and what the temperature is. It's unlikely to make the jump if it's much worse or if the temperature is too cold. The idea here is to jump out of local minima to (hopefully) find the global minimum.

The temperature is a knob that trades off between exploration (high temperature) and exploitation (low temperature). You start off with a high temperature and jump around a lot, hopefully seeking the general vicinity of the global minimum. As you do so, you gradually decrease the temperature and settle on a locally-optimal solution.

Let's say the fitness landscape looks like this:

        \   B     /
         \A/ \C  /
              \D/

If you are at A and you're seeking the lowest point, then there's a probability that you will jump to B _even though it is worse_. The hope is that you'll then discover C and finally D, the global minimum. There's no route from A to D with monotonically increasing fitness, so gradient descent won't find it. But simulated annealing might.

<comment><USER4> The local minimization step does not have to be gradient based. You could use something like Nelder-Mead to do the local minimization step, and still use an annealing schedule to decide whether to accept or reject that particular minima.

</comment></comment></comment></comment><comment><USER14> There's a whole genre of stochastic optimization algorithms in the same family - parallel tempering in particular has some nice theoretical properties (it strictly dominates simulated annealing, assuming you have computational power to run all the replicas, and has a light guarantee that "eventually" it will converge), and there are adaptive methods to optimize the step sizes, number of replicas, and temperature ranges.

</comment><comment><USER15> Aaah good old simulated annealing, i remember using it for my computational modelling based final year project (which lead to a workshop paper [1] ) where brute forcing wasn't really a viable option.

[1] [http://ieeexplore.ieee.org/xpl/abstractAuthors.jsp?tp=&arnum...](http://ieeexplore.ieee.org/xpl/abstractAuthors.jsp?tp=&arnumber=6690725)

</comment><comment><USER16> If only I'd implemented the obvious extension to my graduate dissertation on optimising taxi routes (using a slightly different mechanism, tabu search and squeaky wheel)...

Unfortunately someone has fairly recently done it.

</comment><comment><USER17> Although she doesn't say so, it appears she is assuming the cost function is normalized (range is 0-1), in this formula: exp((E_old - E_new) / Temp). Is that the case?

</comment><comment><USER18> Okay, once I looked into simulated annealing and here just read all the comments on this thread. So, apparently what I have to contribute is not here yet.

Here I outline _non-linear duality theory and Lagrangian relaxation_ and report a war story where this approach badly beat some efforts with simulated annealing.

Basically non-linear duality theory has some surprising properties commonly just too powerful to ignore.

Basically we're considering a case of _optimization_ or _mathematical programming_.

So, let R denote the set of real numbers, and suppose positive integers m and n are given. Let R^n be the usual n-dimensional real vector space of n-tuples. To use matrix notation, we regard each n-tuple x in R^n as a matrix with n rows and one column, that is, as n x 1.

Similarly for R^m.

We are given set C a subset of R^n and functions

f: R^n --> R

g: R^n --> R^m

We seek x in R^n to solve non-linear program (NLP)

min z = f(x)

subject to

g(x) <= 0

x in C

where the 0 here is the m x 1 matrix of zeros.

We let the _feasible_ region R, a subset of R^n, be

F = { x | x in C and g(x) <= 0 }

We regard g as m x 1 where for j = 1, 2, ..., m component j of g is

g_j: R^n --> R

where here g_j, borrowing TeX notation, is g with subscript j.

Okay, given 1 x m l, we let the _Lagrangian_

L( x, l ) = f(x) + l g(x)

Then for l >= 0 and x in F,

f(x) >= L( x, l )

and

z >= L( x, l )

Then the _dual_ is to find l to maximize

M( l ) = min_{x in C} L( x, l )

Then M( l ) <= z to that M( l ) is a lower bound on z.

In particular (H. Everett), if g(x) = 0, l >= 0, and

z >= M( l ) = min_{x in C} L( x, l ) =

min_{x in C} f(x) + l g(x) = f(x)

and x in F so that x solves NLP.

A practical special case is essentially if spend all the productive resources and do so optimally, then are optimal.

Of course, the usual notation used for l is lambda, and for a while around DC Everett ran Lambda Corporation which did resource allocation problems for the US DoD.

Theorem: M is concave.

Proof: For t in the interval [0,1] and m x 1 l_1 and l_2, we have

M( tl_1 + (1 - t)l_2) =

min_{x in C} L( x, t l_1 + (1 - t) l_2) =

min_{x in C} f(x) + ( t l_1 + (1 - t) l_2) g(x) =

min_{x in C} ( t + (1 - t)) f(x) + ( t l_1 + (1

\- t) l_2) g(x) =

min_{x in C} t L( x, l_1 ) + (1 - t) L( x, l_2 )

>= t min_{x in C} L( x, l_1 ) + (1 - t) min_{x in C} L( x, l_2 )

= t M( l_1 ) + (1 - t) M( l_2 )

so that M is concave. Done.

Immediately we have supporting hyperplanes for our concave M:

Suppose y and l are given and

M( l ) = L( y, l )

Then for 1 x m u,

M( l + u ) = min_{x in C} L( x, l + u )

= min_{x in C} ( L( x, l ) + u g(x) )

<= L( y, l ) + u g(x)

= M( l ) + u g(x)

so that for 1 x m u

s( u ) = M( l ) + u g(x)

is a _supporting hyperplane_ for concave M( l ); that is,

M( l + u ) <= s( u ) = M( l ) + u g(x)

and s( 0 ) = M( l + 0 ) = M( l ).

So, here we have the basic theory of non-linear duality as needed by the iterative algorithmic approach of _primal-dual Lagrangian relaxation_.

War Story:

Once some guys had a big resource application problem having to do with a suddenly legal case of _cross selling_ for banks. They had formulated their problem as a 0-1 integer linear program with ~40,000 constraints and 600,000 variables.

They had tried simulated annealing, ran for days, and quit with no idea how close they were to optimality.

I looked at their formulation and found that, except for 16 of the constraints, the problem was comparatively easy.

So, I wrote out

L( x, l ) = f(x) + l g(x)

where l was 1 x 16 and g represented the 16 troublesome constraints. The set C represented the 0-1 constraints and the rest of the 40,000 constraints.

Then for each l, finding x to solve

M( l ) = min_{x in C} L( x, l )

was easy. Then I just had to find l to solve

max M( l )

subject to

l >= 0

and that was just to maximize a concave function.

So, I did some _primal-dual_ iterations:

              Set

                   k = 1

              Pick l^k >= 0

         Step 1 (Primal):

              Find x = x^k to solve

                   min_{x in C} L( x, l^k )

              Then

                   M( l^k ) = L( x^k, l^k )

         Step 2 (Termination)

              If x^k in F then

                   M( l^k ) <= z <= f( x^k )

              so that if

                   M( l^k ) - f( x^k )

              is sufficiently small, then
              terminate.  Else if k i
              to large, terminate.

              Step 3 (Dual):

              Find 1 x m u and w in R to solve

                   max w

                   subject to

                   w <= M( l^p ) + u g(x^p)

                   p = 1, 2, ..., k

              Of course, this is just a linear
              program.  Set

                   l^(k + 1) = l^K + u

                   k = k + 1

              Go to Step 1.

There are refinements: E.g., for the linear program to find l^{k + 1}, can hope to get better numerical performance with by using _central cutting planes_.

For the real problem, in 905 seconds on a 90 MHz processor, I ran 500 primal- dual iterations and, then, had a feasible solution, from the bound inequalities, guaranteed to be within 0.025% of optimality.

Worked fine! So, simulated annealing is not the only tool in the tool box! Sometimes Lagrangian relaxation can work well, too!

<comment><USER19> Introducing lagrangian relaxation quickly in a comment to a simulated annealing post is perhaps not the best way to convey a method. The machinery of mathematical programming you have to introduce quickly becomes an incomprehensible wall of text to most people. Better write this in a blog post somewhere and refer that.

Indeed, there are often better solutions than simulated annealing, if the problem you are facing have some nice properties. I've been doing optimization on a highly nonlinear mathematical problem, but the objective function is so nice it only has a single maxima in the region I'm looking. So I just ran Nelder-Mead which terminates much quicker.

<comment><USER18> For anyone interested in simulated annealing, what I wrote could be of more interest to them than simulated annealing and, really, easier to read than a comparably detailed description of simulated annealing.</comment></comment></comment>


Ask HN: My ISP notified me my router was hacked, what do I do? - <AUTHOR>

HN, my ISP notified me that my router was hacked and was used to attack other computers.<p>I was told to simply disable UPnP and block port 1900. That's simple enough and I suppose I should reset and upgrade the firmware first. I don't know much about UPnP vulnerabilities. Is it possible that the computers connected to my wifi were compromised? <comment><USER2> Yes.

Also all traffic you sent through (meaning a lot of passwords) could have been sent somewhere.

<comment><USER3> This is an important point. Change your passwords on all your accounts (after patching up that hole first, of course).

Good luck!</comment></comment>


Ask YC: S-Corp debts on personal credit report? - <AUTHOR>

A friend of mine has an S-Corp that's going under. A lawyer is saying that unpaid credit card debt the s-corp owes will appear on my friend's personal credit report, and be quite a severe blemish. Is this how it usually works? <comment><USER2> Not in my experience (don't ask). Unless he personally guaranteed the card, in which case, well, it's pretty obvious.

Part of the benefit of incorporation is the separation between personal and corporate liabilities. But, if you use a personal card for corporate stuff (even if you ONLY used it for corporate expenses) you are personally liable because it's YOUR card, not the companies.

</comment><comment><USER3> Is the card tied to the S-Corp's EIN or the S-Corp owner's SSN?</comment>