Ask HN: Why do you want to start a startup? - <AUTHOR>

I'm interning in a series-B San Francisco startup this summer, and probably more than half of the people I know - from multiple-exit CEOs to high school dropouts - are entrepreneurial in some way.
I'm vaguely interested myself in starting a startup, but I'm really wondering if I'm interested in it for the right reasons. Sure, for most people they usually fall into a very small set - getting rich, being famous, solving a niche problem, building the next big thing, making the world a better place - but I'm interested in everyone's story.
So... why do you want to start a startup? <comment><USER2> "Taking a risk for getting richer by having a freedom for doing what you love".

(Freedom) Working for others could be fine if you are key person, because others will listen for you, otherwise you are treated just yet another (hard) worker. You don't have freedom, that's fine in business, they understand their business well.

(Rich) Zuckerberg, Page, Brin, Ellison, Gates, Jobs, Jack Ma, you name it, all of them are founders, sure some others can get richer by joining later, but you should work really really hard in order to be a key person in a well established Corp.

(Risk) You might lose lots of things, not just money and founders love to take a risk, they are driven by adrenaline :)

(Passion) You are going to do things what you love, because that would be yours. when you don't have motivation you don't care and you will work, because that's yours. when you are tired, you take little rest and you will work again, because its yours. In hard days, you will find a way, because that's yours. But when you are working for someone, you don't always feel this, you might quit anytime, but when that's yours you are not going to quit easily ;)

</comment><comment><USER3> Freedom! In your job you are always operating under restricted boundaries eg.timing, tech stack.

</comment><comment><USER4> Because I had a specific vision of how I could make things better for a well- defined group of people and because I am driven to create stuff. If all you are is vaguely interested you probably aren't ready yet.

</comment><comment><USER5> Happiness!

I want to make people happier, that is my "why" and in every decision I make I investigate whether it makes me, an employee or a customer happier.

I dream of making every Maker and Manager out there a little bit happier and believe I have the tool in my TimeBlock method.

</comment><comment><USER6> Because skewness.

Skewness is what brings some toward riskier propositions, in hopes for a small chance of huge success. Those of us that start companies also don't like the middle of a probability distribution (i.e., predictable returns for a predictable amount of effort).

</comment><comment><USER7> We're creators and its about making difference in other's life than just your's.

</comment><comment><USER8> Because it's hard. And because building things is awesome.

</comment><comment><USER9> Because no values your time or sacrifice unless you control the frame.</comment>


Show HN: Keepasswd – Script to automate changing ssh passwords from KeePass DB - <AUTHOR> https://github.com/jodiecunningham/keepasswd <comment><USER2> I think this is really cool but why not use SSH keys instead of passwords?

<comment><AUTHOR> Thanks!

Some systems allow keys, but still expire account passwords.

Some systems also do not have NOPASSWD: for every group in sudoers. On those systems you are likely to have to use a password with sudo to elevate privileges.

Changing via SSH also updates shadow entries that are often used many other places, like console logons or local user references implemented in software.

Temporary passwords for firecalls.</comment></comment>


Creating Business Applications with REBOL (2013) - <AUTHOR> http://business-programming.com/business_programming.html

<comment><USER2> It's fun to see angular app google ads on top of this page</comment>


Ask HN: What is something you like or don't like in a newsletter? - <AUTHOR> I am currently unsubscribing from lots of design newsletters, mostly because it doesn't give good contents anymore. I don't care what's the latest design trends or "how to" something. I care about something that will likely still relevant for the next year, like: Why we need to use small caps or text figures correctly.
So, I had an idea to build a design newsletter and curation the way I want, like newsletter from Nielsen Norman Group, or UX Thoughts by User Interface Engineering. No "5 Design Trends in 2017" nor "5 Design Tips from Design Leaders", just good content.
Do you have any advice? What is something you like or don't like in a newsletter?
Thank you! <comment><USER2> One thing I've appreciated is summaries. Means the newsletter author is actually putting some thought into what they include, instead of just copy/pasting some links.

Another approach is custom content: write stuff yourself. That gives you a more personal connection to audience, helps you learn by teaching, and tends to suffer less from trendiness of link-based articles. This is what I do with [https://codewithoutrules.com/softwareclown/](https://codewithoutrules.com/softwareclown/).</comment>


Amazon Explores Possible Premium Sports Package with Prime Membership - <AUTHOR> http://www.wsj.com/articles/amazon-explores-possible-premium-sports-package-with-prime-membership-1479757001 <comment><USER2> That would be make perfect sense for Amazon and for it's subscribers.</comment>


Avoiding Microservice Megadisasters - <AUTHOR> https://www.youtube.com/watch?v=gfh-VCTwMw8 <comment> tony-allan [https://youtu.be/gfh-VCTwMw8?t=2378](https://youtu.be/gfh-VCTwMw8?t=2378) (39:00)

Conway's law: Any organization that designs a system (defined broadly) will produce a design whose structure is a copy of the organization's communication structure.

Jimmy's law: A broken, dysfunctional organization driven by meeting unhealthy goals and metrics will produce broken, dysfunctional systems.

Inverse Conway Maneuver: Design the organization you want, the architecture will follow, kicking and screaming.</comment>


Launch HN: Federacy (YC S18) – bug bounties for startups - <AUTHOR> Hey all, we're James and William, founders of Federacy (YC S18). We're building a bug bounty platform for startups. (https://www.federacy.com)
I was an early engineer at MoPub, responsible for security and infrastructure. By the time we were acquired by Twitter, we were 20+ engineers, but growing so fast that building software and systems securely was almost an impossible task. I found that there were never enough hands; I couldn't peel engineers from revenue-driving features and it was really difficult to find contract or full-time security engineers.
William and I started Federacy to make it easier for startups to secure themselves. We think the key is to pair startups with extremely talented, outside security researchers to test their applications for vulnerabilities, review code, and help implement best practices—essentially serving as an outsourced CISO.
We saw that the best security minds we knew either weren't interested in a full-time role for a single company, weren't able to work in the United States, or already had day jobs at the largest Internet companies. We thought that if we provided an efficient, no-bullshit way for them to do work that they enjoy, make a real difference in how startups secure themselves, and make money while honing their skills, we could unlock a huge amount of talent that wasn't accessible previously.
We have a lot of respect for what HackerOne and BugCrowd have built, but they are focused on serving mostly enterprise companies with large engineering and security teams, who can afford their services. Their revenue comes largely from triaging the high volume of low-quality and automated/spam bug reports that come through their platforms. These services can be in the six figure range. It may be a good business, but that isn't where our passion lies.
Startups can't afford these services and the burden of triaging low-quality bug reports can completely overwhelm even the best dev teams, leaving them worse off than they started.
We think there is a better way:
• We hand-pair startups with a small team of pre-vetted researchers who are subject matter experts in your stack.
• Researchers test your infrastructure for vulnerabilities in an initial scan, and work closely with you to resolve issues and implement best practices.
• Your program can be private, where only you and the researchers you approve will have access to your program. You don't have to provide source code and all initial testing is done with only the information and access your normal users have.
• We create your program for you and have you up and running in 5 minutes (or you can self-serve, if you prefer).
• We only charge for results (when a researcher finds a vulnerability).
We just started building a couple months ago and are looking for early feedback. Here's an invite link we made for HN:
https://www.federacy.com/signup?invitation_id=3b4d06c5-ac02-...
We'll be around all day to chat and are very happy to answer any questions as well as discuss how we built our product, security-related topics (systems automation, vulnerability reporting, coping with imposter syndrome, etc.), what it's like building a startup with family (we're twin brothers), or anything in between.
Some specific questions we have:
If you're familiar with other bug bounty platforms, are there any issues we can tackle early on that made the experience frustrating for you?
Would you consider contracting an outsourced CISO or a pentest with a security researcher that has reported vulnerabilities to you through your bug bounty program? <comment><USER3> We've used HackerOne at a startup I work at (10-20 employees). We had to turn it off because we were getting bombarded every couple days with the same issues, that were just run by crackers/hackers running basic pen test scripts. They all seemed to have the same toolkit, and would just run the same tests and report the same bugs. Most of which were either invalid, or just not a priority and, so, a waste of our time to read. The write-up of the bug was also poor, with poor English, and this causes wasted time..

Before signing up for another bug bounty program I'd want to know that:

1) The testers were not mostly just amateur crackers running the same toolkit on 100 sites per day, and the same toolkit that 10 testers ran yesterday.

2) The amount of dupe reports was basically 0.. If we get a bug reported and we ignore it, and make zero response, we still do not want to get the same report 10 times over the next 2 months.

3) The write-ups should have proper English, good grammar, and be very clear.

4) If a user reports 10 bugs, and we only want to pay for 1, that should be totally fine. The other 9 are either dupes that we have ignored before, or new reports that are just not a priority or worth looking at.

5) We basically never want to get into a negotiation with the hackers over if a payout should be $2000 because 10 bugs were reported when we know of all the bugs and, basically, don't value them.

<comment><USER4> Your experience is exactly why we're building Federacy.

Bug bounties can be an incredibly efficient way to work with outside security researchers to find vulnerabilities, test for best practices, etc., but done poorly, can cause more damage then they help. We want to make them work for startups as well as they do for companies like Dropbox, Shopify, and Google. We have our work cut out for us -- but if we're successful, we think it could materially improve how startups secure themselves.

All the dev teams we've been part of share the same challenges. We're always overburdened with work on revenue-producing features, so being flooded with more work that ultimately doesn't add much value in securing our software is the last thing we want.

Right now our solution for spam, dupes, and low-quality reports is to be extremely selective with the security researchers we allow on the platform.

We're launching in private beta so James and I can hand-pair researchers, help companies write their VRP, and review every vulnerability report.

Other ideas we're working on:

\- Very clear "Known Issues" / "Not Issue/Out of Scope" sections

\- De-duping based on comparing report attributes

\- Utilizing machine learning to improve de-duping based on description of vulnerability

\- Collaboration. Encouraging companies to look at their approved outside researchers as a part of their team and building tools to facilitate this

Do you think any of these would help? Are there other ideas we should be focusing on that might solve these problems more efficiently?

<comment><USER5> Every bug bounty platform has tried to be "selective" in the researchers they allow in when they start. You'll soon discover that selective doesn't scale.

The only way you are going to disrupt the current market is by hiring on your own salaried pentesting talent to participate.

<comment><USER4> What do you think caused being selective not to scale at other platforms? What do you think we can do to keep the quality of our researchers extremely high?

What we've heard in talking about this to a bunch of talented researchers is that they've been frustrated with payout rates (too low for amount of work), tone of the interactions between researcher and company, number of opportunities/companies where they can add value (given their skillset - <USER2> have said they do the work in large part to learn).

I think there is probably a lot we can do to create/keep balance in the marketplace to address a lot of these if we take things slow.

Would love to hear more of your thoughts on the strategy of building out our team with salaried pentesting talent. Why do you think that is critical to adding a lot of value for startups?

</comment></comment></comment></comment><comment><USER6> As a "researcher" I don't find your vulnerability levels too informative. I'd suggest you use or adapt the bugcrowd taxonomy: [https://bugcrowd.com/vulnerability-rating- taxonomy](https://bugcrowd.com/vulnerability-rating-taxonomy)

That is a model that has been shaped from the experience of many programs and has a clear, "yes this is an issue but no you're not getting paid" level which is important for avoiding thousands of time-wasting reports such as non- perfect HTTPS headers, etc.

I'd be interested in hearing how you plan to deal with duplcate reports. This is an area that hackerone does better than bugcrowd. Hackerone is more interested in disclosure and getting reports to a point where they can be disclosed. If a bug is marked duplicate you are given access to the original report which prevents falsely marking duplicates to avoid bounties.

<comment><AUTHOR> I agree with you, they aren't very informative. We're big fans of BugCrowd's work in this area, and intend to adopt their VRT, though we're still considering how to make P1/P2/P3/P4 more clear/descriptive at a glance.

We're also still brainstorming and looking for good ideas on how to handle duplicate reports. At this point, we're tackling it by vetting researchers and helping with the ones who ignore 'Known Issues' and out of scope limitations. Like HackerOne, we're very interested in encouraging companies to disclose their vulnerabilities, because these disclosures are important to their users, the people who may build on top of any service they offer, and the researchers who are being given public credit.

In regard to a company marking a bug a duplicate to avoid bounties, those are definitely not the type of companies we want to work with. I'm not sure that technical solutions to mitigate that sort of behavior is necessary when we can curate those who have access to the platform. We're going to keep a high quality of researchers and companies -- and it goes both ways.

Our Vulnerability Disclosure Policy Template, which is based primarily on Chris Evan's work @ Dropbox, and is inspired by a bunch of other well-written programs too, puts full control of payments/recognition into the hands of the company. I think our best recourse on this issue is to simply not include bad actors.

Do you have any ideas for other ways we can limit dupes? Or how to really effectively communicate what is out of scope or a known issue?

<comment><USER7> The baseline VRT P5's a bunch of things most startups really want to know about, like exposed admin consoles and broken password reset flows.

</comment></comment></comment><comment><USER7> What does it mean to "contract an outsourced CISO" to a researcher who reported through a bug bounty program? What's an "outsourced CISO"?

I think it's unlikely that "CISO" is the word you want to use in your copy.

How are you vetting researchers? I logged in as a researcher, and it looks like it works just like H1 works: there are public bounties, and private ones for which admission is gated by performance on the public bounties.

It is not the case that H1 typically costs six figures; typical costs for a startup on H1, with triage, are low five figures.

We manage bug bounties for several of our clients (we run outsourced security teams for startups). If there's a problem we have with bounties, it's _not getting enough_ submissions from them. Triage can be annoying (I kind of enjoy it), but we do full-scope penetration tests for each of our clients, and it's noteworthy how much more a real pentest finds than a bounty program. There are different incentives, different information available, and different kinds of work result.

(There are things bounties do better, too; bounties are good for finding oddball XSS and CSRF problems, and good at corner-case web hygiene stuff).

How are you attracting talent? I don't really understand the business model. Bounty researchers already have a bunch of platforms they can use if they want to do bounty-type scanning. Why are they using yours?

<comment><USER4> Just a quick preface: we started building Federacy a little over two months ago as part of this batch of YC companies. We're a team of two FTE. Many or all of our assumptions could well prove to be woefully off-target. But.. we think that if we keep our heads down and build what the startups and researchers on the platform ask for, we can make at least a small difference in how startups can secure themselves.

A huge majority of the startups we've talked to don't have a bug bounty program, haven't worked with an outside pentester, and honestly, don't know where to start.

Most startups don't have a CISO or dedicated security team, so by "outsourced CISO" we mean: having a designated, vetted, and experienced person/team on- hand who can help with higher-level strategy and architectural decisions; essentially, a small piece of what you provide at Latacora. We think there are very few firms with your level of experience that are working with non- enterprise customers. Do you agree? Do you think there is a better description?

We're at the very early stages of conceptualizing how we can make the high- level advisory services work. In talking to a bunch of talented security people at large Internet companies etc, we found a lot were interested in working directly with startup CTOs if they could make a significant impact and not have to deal with the tedious aspects of running a consultancy. Our thinking was that if we could build matchmaking on top of the VRP and other tooling we're building, it could be an efficient way to connect the two and create a lot of value for both sides. What do you think?

I think the value of a bug bounty program probably comes down to the quality of the people doing the work and the willingness of the company to engage actively with the researchers. It's our job to manage the balance between the researchers on the platform, and the active programs, so that both find value -- and ultimately, yield more secure startups.

We hope the best startups will use our bug bounty program alongside full-scope pentesting and a myriad of other outside resources. I think you see this done well at some companies that have really good security postures. Shopify, Dropbox, etc. have really strong internal teams, work with outside researchers, and still pay out a lot of bug bounties.

We're currently vetting researchers manually -- James and I are reviewing each registration and reaching out individually so we can pair them with startups on the platform. We'll build out functionality to help over the long run, and are already tossing around ideas to infer trust through vouching, etc. But, we think it's important to show our work early and get people using the platform to help guide these decisions.

We're reaching out to researchers directly -- through our friends, the Y Combinator network, and even cold, if we find someone we think would be a good fit for one of our programs. It's definitely self-selecting, to an extent, as we're very much an early-stage startup ourselves, and the work they'll be doing is with mostly early-stage startups.

Appreciate the heads up wrt H1 costs, edited the original post (edit: can't edit the original post, derp, but duly-noted). I think low five figures still puts H1 out of the reach of a lot of companies, and that a well-run bug bounty program can add a lot of value for almost every startup. I think there are probably tens of thousands of startups that really should be engaging outside security researchers, and, of course, that, in itself, creates a pretty big challenge for an already severe talent crisis.

What do you think?

</comment></comment><comment><USER8> "Would you consider contracting an outsourced CISO or a pentest with a security researcher that has reported vulnerabilities to you through your bug bounty program?"

Budget permitting, this seems like a no brainer. I mean, they already have some familiarity with our app. The only thing I would be worried about is people gaming the system: finding some low hanging fruit or running their toolkits on a bunch of apps, then charging a lot of money and providing no more value.

<comment><USER4> Yeah, that definitely makes sense, and I agree.

At the core, Federacy is a marketplace, and the surest way for us to constrain the transactions will be to make it difficult for startups to extract a lot of value. We'll have to work hard on the tools (reputation, vetting, etc), for startups to trust and work with really talented researchers.

Not quite as important, I think, but also interesting is what tooling we can build to let researchers focus on the work they enjoy, and that adds the most value for startups. If we can make the reporting process more intuitive, they can focus more on research -- and less on writing traditional pentest reports.

</comment></comment><comment><USER9> Your bullets all line up with what Synack and Cobalt.io are doing. How do you differentiate from the two of them, who themselves are already competing hard with each other? Both of them strictly curate their test base, allow for strictly-private programs, allow for researchers to work closely with firms for resolution, can launch and operate your whole program, and charge per finding.

<comment><USER4> To be completely forthright, we don't know. Have you used Synack or Cobalt? Would love to hear your experience. We haven't heard much about Cobalt, but there are some sharp people behind Synack.

That said, I don't think there can be too many people trying to help companies secure themselves.

I think HackerOne and BugCrowd have <1,000 customers each. I'd guess Synack and Cobalt have less. I think less than 1% of YC companies have a bug bounty program -- and almost none below 50 employees have one.

We would like every company to have a bug bounty program, and that is what we're tailoring our product to. (We'd certainly rather pay an outside researcher if they find a vulnerability than risk our customer's data). Synack et al, I'm guessing, run tens to hundreds of thousand per month and accordingly, their software is focused on supporting a small number of large/enterprise customers. We think something important happens when you have tens of thousands of startups/companies using the same marketplace for bug bounties and pentests.

I think we probably all share the same general mission -- but our approach is a bit different: to build software that will be tailored to startups, and to have a lot more of them.

<comment><USER10> Hi James and William - congrats on founding Federacy.

I'm the CEO and Co-founder of Cobalt.io. I love startups and it takes a lot of courage to get going, so I applaud you for taking the leap and helping innovate in this space.

We started building the Cobalt.io platform back in 2013. We originally started as a bug bounty platform and since then evolved into a Pen Testing as a Service platform [PTaaS] over the last 5 years.

During this evolution I did a lot of thinking around crowdsourcing freelancers for security testing. I'll recommend these two blogs around how the market has evolved over the years and the different cases where bug bounties make sense vs. pen tests and vuln assessments. \- [https://blog.cobalt.io/deconstructing- and-rewiring-bug-bount...](https://blog.cobalt.io/deconstructing-and-rewiring- bug-bounty-programs-f76c2b72dd11) \- [https://blog.cobalt.io/the-third-wave- of-application-securit...](https://blog.cobalt.io/the-third-wave-of- application-security-d4a260f0a752)

I believe you are in the bay area. Feel free to ping me at linkedin or twitter and I'll be happy to meetup.

Cheers Jacob

<comment><USER4> Hey Jacob, thanks for the kind words, and taking the time to leave a comment. I'd love to meet up, pinging you now!</comment></comment></comment></comment>


FreeBSD Journal announced - <AUTHOR> http://www.freebsdnews.net/2013/11/26/freebsd-journal-announced/ <comment><USER2> How is it that FreeBSD has such great documentation[1], now this while Linux is stuck with random wikis and blogposts, usually out-of-date?

[1] [https://www.freebsd.org/doc/handbook/](https://www.freebsd.org/doc/handbook/)

<comment><USER3> Smaller community, more central management.

Linux is seen as a programming platform a lot more than freeBSD.

man pages work wonderfully though.

<comment> X-Istence The man pages that come with FreeBSD are absolutely fantastic and top notch, more so than most of the man pages I have found with Ubuntu for example.

I don't see how Linux being seen as a programming platform makes much if a difference. FreeBSD has a pretty large community as well, but the core community that puts together the OS seems to take much more pride in their work and having it be fully documented than any other open source organisation.

<comment><USER4> The man pages of BSD are the official documentation. The man pages of, for instance, GNU LibC are _not_ the official documentation. _This_ is:

[https://www.gnu.org/software/libc/manual/](https://www.gnu.org/software/libc/manual/)

<comment><USER5> Which is the problem with Linux as a whole for me.

WiFi configuration is a particular problem where everything has awful documentation so when you need to set up your WiFi without NetworkManager or some other behemoth, much eye poking and googling on other devices is required.

FreeBSD/OpenBSD/NetBSD: man ifconfig (and dmesg)

As a rule, and this happened to me more than once, you might need to configure your network connection without the aid of Google and online documentation. Either that or you're stuck on a train in the middle of nowhere with no WiFi and no 3G and you want to read the docs.

<comment><USER4> The official documentation is _available_ on the link I gave, but it should also be available in the Info format on your local drive.

I find it much easier to search Info documents for something than grepping compressed man pages.

<comment><USER5> Info is horrible. Case in point:

Awk manpage: [http://www.openbsd.org/cgi- bin/man.cgi?query=awk](http://www.openbsd.org/cgi-bin/man.cgi?query=awk)

Gawk info (in html): [http://www.gnu.org/software/gawk/manual/gawk.html](http://www.gnu.org/software/gawk/manual/gawk.html)

Both fully describe the capabilities of the software without resorting to compressing it.

Elegance in simplicity.

<comment><USER4> I disagree; In general, I prefer Info. I would explain why, but that would be repeating myself; I instead refer to my previous post on this very topic:

[https://news.ycombinator.com/item?id=6656656](https://news.ycombinator.com/item?id=6656656)

<comment><USER5> I think it's funny that someone else picked exactly the same example however I respect your opinion on the subject.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> The actual link for the future magazine's website (with the same info on freebsdnews.net) --> [http://www.freebsdjournal.com/](http://www.freebsdjournal.com/)

</comment><comment><USER7> "The Journal will be a bi-monthly publication and will be available on the web or as an Android/iPhone/Kindle app."

Why make it an app? Making "app" magazines seems really dumb to me, when you could simply make it available in an open format like PDF or ePub or text.

<comment><USER8> I'm willing to bet it will be available in an open format "on the web".

The additional formats probably exist to serve a wider audience.

It would be nice if I could get it in TeX though.

<comment><USER7> I think you are the first person I have ever seen say that. If I may ask, what benefits would having it TeX bring to you?

<comment><USER9> Not speaking for the GP of course, but I often like to see the Latex source of a well laid-out document. I learn from reading it as an example.

</comment></comment></comment></comment><comment><USER10> There's also BSD Now, which is pretty cool. More BSD coverage is always nice!

<comment><USER11> Also, there is BSD Magazine too: [http://bsdmag.org/](http://bsdmag.org/)

</comment></comment><comment><USER12> It's great to see many resources for keeping up with the unknown giant nowdays!</comment>


New Discovery Around Juniper Backdoor Raises More Questions (2016) - <AUTHOR> https://www.wired.com/2016/01/new-discovery-around-juniper-backdoor-raises-more-questions-about-the-company/ <comment><USER2> Over a decade ago I worked for a CLEC. One day one of our engineers was on a support call with our client side TDM vendor, who had remoted into his computer to troubleshoot some issue. During that session the vendor's employee used a backdoor account to log in, and our engineer was recording his terminal session, so we had the password from there on out. We could not disable the account or change it's password, and it didn't show up as a logged in user when it was being used. So we made it a point to only turn on the SSH daemons on IP's that weren't available to the public. It did come in handy a few times to reset a real password when using a console cable was not feasible.

</comment><comment><USER3> The post makes it sound like the nonce size increase was a decision made by "Juniper" after a careful consideration by a committee of grayhaired security experts. More likely than not it was done by a random dev because 32 is the smallest power of 2 that's close to 20 and it increased their Smartbit throughput metrics by a fraction of percent and because it aligned shit better in the packet.

As elegant as this conspiracy theory is, it's likely not true. It _is_ an elegant one though, I'll give it that.

<comment><USER4> One of the researchers here. We wrote a paper about this that you might be interested in: [https://eprint.iacr.org/2016/376.pdf](https://eprint.iacr.org/2016/376.pdf)

The nonce size isn't a particularly significant element of the "conspiracy theory" here. Those things are worth looking at because they would rule _out_ exploitability. If one requires a conspiracy theory in this case, it would be based on the following amazing facts:

1\. In addition to the pseudorandom generator (PRNG) described in FIPS certification docs, all Juniper ScreenOS devices shipped with a second _unannounced_ public-key pseudorandom number generator (Dual_EC_DRBG) that works in parallel with the certified PRNG.

2\. This generator is well known to be easy to backdoor if one replaces the standard NIST parameters with custom parameters, and this has been known since well before the generator was added in ScreenOS.

3\. Amazingly, the standard NIST parameters have been replaced with new parameters, and no justification for these new parameters was provided by Juniper -- after the presence of the generator was revealed (in 2013) or after they were hacked some years later.

4\. Many years after initially shipping this generator, and due to a very public de-certification of the Dual_EC_DRBG generator, Juniper quietly admitted use of that generator and parameters, but declined to remove it -- claiming that post-processing by the (official) PRNG would prevent the backdoor from being exploited.

5\. Except that due to a _frankly amazing_ coding error, the second (avowed) RNG never actually runs, ensuring that raw output from the flawed Dual EC generator is transmitted. This renders the alleged backdoor exploitable.

6\. There are a number of other conditions that must be present for this flaw to be efficiently exploitable (this is one of the places where nonces come in) and every single exploitability condition is present.

7\. Many years later, some outside hacker comes along, replaces the (Juniper- derived) PRNG parameters with their own parameters, and _despite no further code changes_ the manufacturer admits that this enables a passive decryption attack on all ScreenOS devices.

I don't think you need much of a conspiracy theory to ask what the heck is going on with this. Issues like the nonces aren't really proof of a conspiracy; they are things one would look for to determine whether there were specific barriers that would prevent exploitation.

You can draw any conclusions you want from all of this, but it's really about as bad a fact pattern as you're ever going to see.

</comment></comment><comment> scott-smith_us Untrustworthy is untrustworthy, whether due to incompetence or malice.

</comment><comment><USER5> This is from over 2 years ago, I thought "OH NO NOT ANOTHER ONE" but it's not all that new now. Maybe needs a [2016] tag?</comment>


How To Make Tilt Scrolling That Doesn't Suck - <AUTHOR> http://www.marco.org/2014/07/24/tilt-scrolling-that-doesnt-suck

<comment><USER2> … and yet, I still found the Instapaper implementation (and all other implementations of this that I have ever seen) completely unusable and cumbersome.

Scrolling is not exactly a complicated gesture on smartphones. It's also precise, direct and quick, three attributes in which all tilt scroll implementations inherently do worse. All they have going for is that you don't have to move a finger (but you have to move your whole hand _precisely_ ) and that you don't cover the screen with said finger (but I can't read while scrolling anyway).

I'm really not sure we desperately need a replacement for it. Even if we do (and I'm just not clever enough to see that, which is very possible), I really don't think tilt scrolling is what we want.</comment>


Ask HN: Best Online CS courses? or night class in NYC? - <AUTHOR>

I am a recent graduate of the University of Michigan majoring in Economics and Statistics.
After a few months working in corporate finance, I realized this is completely and absolutely not what I want to do with my life. I have been a silent reader of hackernews for the past six months and my interest in programming has slowly been on the rise. I would like to give it a try, but my student loans force me to stay at my current job.
I have done some research but am just a little lost as to where to start. Are the google search results for online courses legit? I'm not exactly sure if this is the path I want to follow, but I'm willing to give it a good shot and see if I would actually enjoy it. I would ideally like to attend a good programming night class in New York City, available anytime after 5 PM, since I do learn a lot better with an interactive class, but a good online course would be helpful as well.
Future plans? I was hoping to incorporate my business background and programming and pursue graduate school for financial modeling and programming…but I want to first see if programming is ultimately my cup of tea.
Any suggestions?
edit: I did see stanford and MIT's websites for free online course materials. Would this be the best way to start? I wanted to enroll and attend a real CS class where I would be graded. I do not mind paying money for class either. <comment><USER2> You might want to take a look at this page. These are some links I've collected in regards to Stanford and their CS classes.

[http://www.cancelbubble.com/search.php?q=stanford&catego...](http://www.cancelbubble.com/search.php?q=stanford&category=1&submit=Search&category=1)</comment>


Show HN: FoundersKit – $6k of discounts for the best startup tools for only $39 - <AUTHOR> https://founderskit.co/?ref=hackernews

<comment><AUTHOR> Hey all!

Dylan, Mike and I have been working on this project for a few months and are super excited to finally release it into the wild!

FoundersKit is a bundle of the best tools & services to help founders launch and build startups. The bundle consists of 68 deals which are valued at $6,268. We've kept the bar really high, only including tools & services we really recommend.

We'll be adding deals to the site as we go (with lots already in the pipeline) to keep the bundle slowly growing. The membership is valid for one years access to all the discounts.

Let us know if you have any questions or feedback. We'll be around all day!

<comment><USER3> Really like the collection. I saw this the other day when you posted it on Product Hunt. [http://www.producthunt.com/tech/founderskit](http://www.producthunt.com/tech/founderskit)

<comment><AUTHOR> Hey Brandon, thanks for the kind words :)

</comment></comment></comment><comment><USER4> arent you getting paid for these referrals? Why would an end user pay you for these free trials? i think you'd be better off to just list them with affiliate links and call it a day. buying discounts doesnt make any sense to me... but good luck with it.

<comment><USER5> this is pretty much my thought, a lot of these are offered anyway, and often for completely free.. why pay $39 for a bunch of affiliate links?

<comment><USER6> You have a great point. However, we are NOT using affiliate links, and we are NOT collecting any commission at all.

Every deal on FoundersKit is a unique partnership between us and the specific company. It took us about 4 months to establish all of the existing relationships. We are even still working on more partnerships to add more value to the bundle (as Fred mentioned).

A lot of the companies on our bundle do have an affiliate program but our coupons are not associated with that, and offer a higher discount (or longer trial).

Great example would be Grasshopper - $125 credits are not handed out to affiliates. Affiliates get $100 kick back, we do not take any kick back.

Please do comment back if you have an example from our site where our discounts offer the same value as an affiliate program. We would love to address it.

Thanks for taking the time to leave feedback :)

Best, Dylan

<comment><USER5> My apologies on the affiliate link thing then, all of your "Visit Site" links on each deal append `?ref=founderskit.co` to the end of the url.

Some of them, like crazyegg, hand out the same discount to everyone without paying for it - <USER2> [https://www.google.com/search?q=site%3Acrazyegg.com+"Egg+is+...](https://www.google.com/search?q=site%3Acrazyegg.com+"Egg+is+happy+to+provide+you+an+exclusive+FREE+trial+of+90+days"&filter=0)

Platejoy, another on your list, offers coupon code TRYPJ (I used this a while ago) for the same discount without paying for it, publicly.

There's a lot more, but those are the two that stood out because I recently used the trial/coupons. For quite a large number of your offers in the bundle, you can get the same offer at no cost just by googling sitename + coupon. Maybe not offered by the copmany directly, but still freely claimable via another deal site.

Personally, I don't mean any offense, but I would likely pass on this.

I would be more interested in say, a $99 bundle that provided services for a bunch of these SaaS for a year or longer, not "first month free" or "$10 off first purchase" or anything like that. A lot of your discounts aren't lifetime, but a small amount off the first month - which is really just not very "deal like" to me.

</comment></comment></comment></comment><comment><USER7> Great selection of deals!! Awesome man!

<comment><AUTHOR> Thanks man! We're really excited by the partners we've got on board so far, plus those that are in the pipeline :)</comment></comment>


Draft: Google and Facebook to be forced to share revenue with media in Australia - <AUTHOR> https://www.theguardian.com/media/2020/jul/31/google-and-facebook-to-be-forced-to-share-revenue-with-media-in-australia-under-acccs-draft-code <comment><USER2> Draft: Google and Facebook make Australia look like a Turkey...</comment>


New Office Hours Aim for Well Rested, More Productive Workers - <AUTHOR> https://www.nytimes.com/2018/12/24/well/mind/work-schedule-hours-sleep-productivity-chronotype-night-owls.html <comment><USER3> I manage a team of 20 fully remote devs, so I get to see exactly when everyone is working. When they're chatting, when they're pushing code. We don't force people to be working at any particular time, so I'm guessing when I see them is when they want to be working.

You can tell some people are complete night owls. One guy checks in code at 3am and rarely talks to anyone until the evening. I guess he sleeps when the sun is out.

Other people are a bit more ordinary, but still it seems the most productive hours are not quite as early as when most schools or businesses tend to be open. I'd say maybe 10am is the de facto "opening time".

There's also a tendency to have a lull in chat in the early afternoon. People go off to lunch having some ideas about what to do, and then they come back and do it before dinner. Or they are in deep thinking mode and don't want to talk, and then check in the code.

Having no meeting time and no commute seems to help everyone. It gives everyone an extra work day each week, and they can spend their time when they want to. It also makes managing easier, as I don't have to chase everyone at the exact same time.

<comment><USER4> What is your experience regarding productivity? There is the wide-held belief that remote teams are less productive than co-located ones. I have no clue if this was ever measured, but my gut tells me there could be something to it.

<comment><USER5> > There is the wide-held belief that remote teams are less productive than co- > located ones.

This is true in my experience. I've worked in on many remote teams and colocated ones and colocated ones have always been more productive. Sure remote teams are sometimes equally as productive but thats in select circumstances.

I am on 100% remote team now for past 3 yrs and remote teams lack any human connection, team culture or shared struggle. Sure I know where everyone lives and how many kids they have but I don't have any real connection with any of them. There is no random conversations/ideas to be shared at lunch ect.

<comment><USER6> I sort of like that part of remote life. As horrible as it may sound, I never really cared for my coworkers lives outside of work. I have enough friends and family to worry about that remote life gives me way more time to spend with them.

<comment><USER5> I was implying that you work better with people you really know vs acquaintances. Not, I need friends from work.

<comment><USER7> I never understood this. I mean, I was in teams that cooperated well and I did not even knew whether they are married. And in bad team with a lot of personal knowedge and out of work time spend.

<comment><USER5> ok?

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'd love to see more information about the assertion that there are innate qualities in people which make them Larks versus Owls.

I believe I am a night owl. On an average day, I don't get tired until 2am, and without an alarm clock I could sleep until 10am; by any definition this makes me a night owl.

But, I question how much of this behavior is environmental versus innate. I drink a lot of coffee (never after 6pm). I work on a computer all day (blue light). My hobbies generally come alive at night (video gaming, spending time with friends, concerts). I have a naturally addictive and obsessive personality combined with low self-control (when I get started on something, like a new work problem or video game, I can't put it down).

Is there research in the area of identifying actual biological reasoning behind why someone would be an owl versus a lark (genetics, etc)? Or do all of these studies just rely on behavioral self-reporting, which even the article says, is completely vulnerable to the very real problem that people really only know their behavior in the face of all of their vices, and that behavior might be different if the vices weren't there.

The reason I believe that's important is because it should be a factor in our response to this. Yes, people need sleep, and they need good sleep. But if a big reason why you get tired at 2am and thus wake up at 10am is because you're watching Netflix in bed until the minute you shut your eyes, we can't ask society to accept that starting work at 11am is fine.

<comment> xkcd-sucks When backpacking in the wilderness for weeks, I like to sleep around 12-2am and wake up at least eight hours later. When I need to wake up early for a long period of time, I do it and it never stops feeling suboptimal. I appreciate the your point re: lifestyle, technology and sleep hygiene.

But I'm close to forty and it FUCKING PISSES ME OFF how seemingly everyone minimizes and deflects my concerns and observations about my own body. I function best when I sleep eight hours beginning at 2-4am. A consistent early schedule, plus daily exhausting exercise, minus artificial light changes nothing about my sleep preferences. Two plus two does not equal five.

<comment><USER9> Talking about "sleep hygiene" is still perpetuating this backwards paradigm based around expecting that people must wake up early to be productive. The early bird may get the worm, but the early worm gets eaten.

I've personally found that dark hours are more productive for mental tasks like programming. AFAICT not because of secondary factors like quietness or people being around, but simply that bright light undermines my ability to concentrate. After loading a problem into one's head, and getting "in the zone", one is supposed to interrupt what they're doing to go to bed at a "reasonable hour" to live up to someone else's expectations of what a productive person should look like? Give me a break.

The times I've driven across the country car camping, I've naturally fallen into waking up much earlier. And I'd much rather do physical tasks when it's light. But consciousness is not a scalar, and so it's inappropriate to extrapolate these patterns as indicative of some "true natural cycle" that's being distorted.

<comment><USER10> > The early bird may get the worm, but the early worm gets eaten.

This makes no sense. All worms get eaten randomly because all worms have to surface at the same time. Earliness and lateness don't change the chance you will be eaten by the early birds. But the original phrase is true that the early bird gets the worm because it shows up in the window the worms are all surfacing and the late bird misses the window and goes hungry. Leave the original phrase intact and maybe ditch the added second part.

<comment><USER9> The point is a quip to push back against the culture of early risers lording their being up early over everyone else.

<comment><USER10> It doesn't really push back though because it doesn't make sense. Phrases are powerful because they are compressed versions of larger truths. This new version doesn't work as a phrase like the one it is built from.

<comment><USER9> It doesn't actually have to fully make sense per se, to invalidate the earlier saying.

The truth of the whole matter is that we're not birds, but distinct creatures who live technological lives because of our _lazy ancestors_ who looked for better ways rather than just competing to do the straightforward thing first. If you can find some way to stuff that into a tight phrase, please do!

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I am just finishing reading the fantastic book Why We Sleep [1], and as in so many well-meaning studies and articles, I can't help but feel like this effort is misguided. Just like an addict cannot accept help until they want it, I don't see how "adjusting" work schedules for those who don't even understand their own biology can possibly be helpful.

I've ALWAYS considered myself a night owl. I'm still not sure I'm not. But I've spent the past year rising earlier than I'm used to, and the past 7 months rising even earlier than that due to an enforced carpool with my wife. For the first time in my working life, I HAVE to be awake at a certain time (incidentally, far earlier than I'm used to). Instead of snoozing for an hour, I bolt from bed far earlier than I want to. I go to sleep marginally earlier. But my routine is regular I'm happier. I feel better. I feel healthier. I started reading the book and am acutely interested in tuning my sleep times to make this work even better.

Maybe I've never been a night owl. Maybe I've just had horrible sleep habits. Or maybe I AM a night owl, and I'd be even _better off_ than I can possibly imagine, if I take all of these habits and processes and move them later in the day.

But I just feel like you can't possibly know if you're a morning bird or a night owl until you're already, consistently, religiously, getting enough sleep every night, on a consistent sleep/wake schedule.

[1] [https://www.amazon.com/Why-We-Sleep-Unlocking- Dreams/dp/1501...](https://www.amazon.com/Why-We-Sleep-Unlocking- Dreams/dp/1501144316)

<comment><USER12> > Instead of snoozing for an hour,

I've never understood the snooze button. Either it's time to get up or it's not.

<comment><USER11> I find it INCREDIBLY difficult to wake from sleep. As do many others, apparently.

Getting enough sleep is a first step, but we know most people do not -- so very few are in the great position you are to treat it as a 100% conscious choice to snooze or not to snooze.

<comment><USER12> The point is if you have the time to snooze for an hour, would you not get better sleep by just setting your alarm an hour later?

<comment><USER13> No. I can naturally wake up after 6 or so hours of sleep on weekends when I go to sleep at 4am, but the entire work week I have to ease myself up with a few hits of the snooze button, even after 7-8 hours.

(My snooze is also set to 5 minutes, not an hour)

</comment></comment></comment></comment></comment><comment><USER14> > Put it this way: If you rely on an alarm clock to wake up, you're out of > sync with your own biology.

I get told, especially by lots of armchair wannabe doctors here on HN that I need 8 hours of sleep but if I don't set my alarm (I actually rarely set my alarm) I often wake up in naturally in 6 hours regardless of when I go to sleep. Maybe 30% of the time I can go back to sleep, the other 70% I'm not tired.

Otherwise in relation to the topic in general I'm not 100% I want my most awake time to go to the company I work for. Is that wrong?

<comment><USER15> > Otherwise in relation to the topic in general I'm not 100% I want my most > awake time to go to the company I work for. Is that wrong?

Nope, I completely agree with that also. I personally don't want to spend my most awake time for the company I work either.

Also just to comment on something that has been said times and times again, the 8 hour working schedule was introduced more than 150 years ago and started getting implemented 100 years ago. Its time for humanity to move on and find different systems that will allow us to work less and enjoy more of what life has to offer. We did have the computational revolution during the 90's early 2000 and now we've reached a point where a lot of jobs have been automated and a lot more to come. Think of everything out there and how much faster its been done with the use of computers and the internet. So our productivity must have went up by tremendous amounts although the working hours didn't go down at all, they remained exactly the same.

My personal belief is we can easily bring it down to 6 hours a day and slowly slowly bring it down to 4 working days per week. Of course such thing must happen massively around the globe, given how interlinked countries are nowadays.

</comment></comment><comment><USER16> For what it's worth, I'm pretty sure my body clock is, like many others, cycles every 24.75 hours.

In other words, it kind of doesn't matter, I'm always going to be fighting it.

It's been that way for my entire life: coffee or tea, winter or summer, college or home, single or married. Pretty much regardless, I'm going to feel tired at 11p today and ~11:45p tomorrow and 12:30a the following day before I do a dramatic reset and start again.

<comment><USER17> Sounds like you should move to Mars! The Mars day is roughly 40 minutes longer than Earth's.

<comment><USER16> See you there! I hear it's nice this time of year!

</comment></comment></comment><comment><USER18> It would be lots easier to align work with our natural sleep cycles if the standard work week was less than 40 hours. People don't really want to wake up at the crack of dawn, but you've got to get those hours in!

<comment><USER19> Many people who have jobs in urban areas have to deal with long commutes on top of a standard work week.

I'm one of those rare people who will happily go to bed at 9 pm every night. My favorite job was when I teleworked from 6 AM - Noon. 30 hours a week, with no commute, and my choice of hours? It was heaven.

<comment><USER20> I worked at a job where a coworker of mine would commute 1.25-1.50 hours one way, every day. I'm not sure how he did it.

To get to work at 8am, he'd have to wake up at 6am, assuming he gets ready quickly. Then, after leaving at 5, he'd arrive home around 6:30. So all in all, about 4 hours of time to himself, assuming he didn't work late. That's a hell of a way to live.

<comment><USER21> Mine is same as your ex-coworker's, 1.25-1.50 hours one way, around 2.5 hours for commute.

</comment></comment></comment></comment><comment><USER22> > Put it this way: If you rely on an alarm clock to wake up, you're out of > sync with your own biology.

You're out of sync if you're not feeling the air around you warm up with the sun, or watching the sky above you change from black to the glimmer of dawn, or hearing the birds start to chirp with the sunrise. I've experienced all of these with hundreds of nights backpacking in the wilderness, and indeed it has been the best sleep of my life. If you've any semblance of a modern, industrial lifestyle though then you're so screwed up by the rest of your life that an alarm clock is the least of your artifical interruptions.

<comment><USER23> Are you sure that the physical effort and the cleaner wilderness air weren't the actual factors that made you sleep better than in the city?

</comment></comment><comment><USER24> Interesting that corporate America typically likes to have cookie cutter schedules that often intrude into our mornings. However, Jeff Bezos, arguably one of the more successful business people in the world doesn't schedule early morning meetings, sleeps 8 hours a night and wakes up naturally without an alarm clock.

[https://www.businessinsider.com/jeff-bezos-daily- routine-201...](https://www.businessinsider.com/jeff-bezos-daily- routine-2017-7)

<comment><USER25> Well, it certainly can be argued that you are a more successful business person if you're not getting ripped off by your negotiation counterparts as you fight your wish to sleep.

There's a reason I don't do the "fly to X in the morning, have meeting, fly back" racket. I always have either a night train or a sleepover in a hotel, when I have to travel for workshops or hands-on work - making me get up at 4 o'clock in the morning means my employer loses at minimum half a day of productivity or more plus either night trains or hotel are cheaper than the productivity loss.

</comment></comment><comment><USER26> It's not enough to have flexible policy at one or even many workplaces. The world is run by Larks and as long as that's the case, meetings will "need" to be scheduled at certain times, people will "need" to be at home at certain times, errands will "need" to be run at certain hours because places close, children will "need" to be picked up, social events will happen at certain times. Owls will always be second class citizens.

</comment><comment><USER27> They should start with kids then. I remember how painful was to wake up in the morning to go to school at a very early age. Worst memories of my childhood.

<comment><USER28> School and work hours is a very similar problem to the metric system. Even though there's a more efficient system, the switching cost is significant in that you're out of sync with all those that don't make the switch, or don't make it at the same time as you.

Once the majority or a popular minority start using later work/school hours or the metric system, then there will be a catalyst for change. But for those early adopters there is a significant burden of extra communication that needs to take place.

<comment><USER29> I almost had a car crash while driving to high school half asleep. Now I'm older and I get up at the same time but I don't feel tried at all.

<comment><USER30> Glad it didn't turn out badly, but from a sleep cycle perspective it's normal. Kids usually have fairly early sleep cycles, and as they age it gradually gets later, peaking around late adolescence where it can be three or so hours later than an adult. After that, it shifts back to normal over the next decade or so. Aparantly this has been observed not just with humans but in various animal species as well.

But there are various disorders where people either have unusually late or early sleep cycles that can be up to several hours different from normal.

</comment></comment></comment></comment><comment><USER31> I like waking up early because more than at any other time of the day you have a period of quiet that you can have for yourself. I lived in nyc for a short period of time and there's a joy in stepping out between 5:30-7 and feeling how quiet the city can be.

<comment><USER32> It's the same at night if you're a night owl, with the added benefit of knowing you don't have a bunch of other things you also need to get done that day (because you already did them).

<comment><USER33> In my experience NYC is way more quiet at 6am than 1am, even residential neighborhoods. It's also not super dark out (outside of winter).

</comment></comment></comment><comment><USER34> That was an interesting read. I was glad to hear the article point out that many people don't know their chronotype. My schedule has changed a lot over the years and I've alternated between having to be up early and up late, with both being difficult to adjust to initially. The suggested diagnostic techinique (spend two weeks on vacation with no alarm clock) sounds like a nice idea :)

</comment><comment><USER35> I was able to adjust my sleep schedule with just 300 μg of melatonin to trigger sleep. Whereas previously I'd sleep at 0100 now I sleep at 2200. Very useful.

<comment><USER36> Is it addictive? Are there any side effects?

<comment><USER37> While it didnt seem to be addictive to me I only used it for a week and then the vividness of some of the dreams bad and good caused me to stop. It never helped get me to sleep earlier. I didnt think that drastic of a change from normal was worth my mental safety.

<comment><USER38> Could it just be that you werent used to getting a significant amount of REM sleep?

<comment><USER39> It could be the REM rebound effect as mentioned here: [https://podcastnotes.org/2018/04/29/why-we- sleep/](https://podcastnotes.org/2018/04/29/why-we-sleep/)

I'm working my way through the book, very interesting stuff.

</comment></comment></comment></comment></comment><comment><USER40> I recently started using an app called Sleep Cycle to help my body's response to the alarm. It measures how deep your sleep is and wakes you when your sleep is shallow (within the time range). I find myself waking up thirty-plus minutes earlier and feeling much better and awake, all day.

My next endeavor will be to build a Circadian Rythm light clock that changes the ambient light in the room to naturally wake me up.

</comment><comment><USER41> Been fully remote since mid 2016. I've never received positive comments on my work attitude before this position.

\- I am thin and tall, constantly feeling cold in air-conditioned offices.

\- The office lights hurt my eyes.

\- I prefer music playing instead of people talking, and I do not feel bad for taking an hour long break when I feel exhausted or frustrated.

\- I usually wake up around 8, so I get out the door after coffee&breakfast is done, and we get dressed with the wife. We don't leave the house before 9:30 on average.

\- I also think commuting longer than a 15 minute walk/bus ride is a waste of my time.

\- I am working from a laptop, so I think it should be completely acceptable to send a mail in the morning saying "I'll be working from under a warm blanket & my cat today" when there is no in-person meeting scheduled.

In my current position I'm assigned projects that get done on time and feedback is positive. Work is done, all is well. Noone cares when you start the day, just show up for the calls, which are never scheduled before 9:30 on my request.

We got a junior fired because she couldn't keep up with expectations. I think full-remote wasn't for her. She also had untreated schizophrenia, I bet that didn't help either. When you are a couple screws loose, it helps to have people around to keep you grounded. On winter days I almost exclusively work from cafes, so as to avoid winter depression.

</comment><comment><USER42> I don't want to be at work when I'm most productive! I want to be on my own time doing the things I actually want to do.

</comment><comment><USER43> I had a co-worker who only needed 4 hours of sleep, a DBA manager. He told me had multiple sleep studies by the washington state college, he just won the genetic lotto, and just had more time to get things done.

I've been into sleep hacking for the last 3 months, and thinking on and off about sleep cycles for myself for the last decade. Picked up a sleep tracker and newer fitbit that can track my sleep and verify each others recording. I tend to want 8 to 9 hours, but with an officer job, its been 5x 6 hours and 2x 12 hours on the weekend. This just isn't maintainable anymore for me as I'm getting older and limiting my caffeine, etc.

I've switched to a 10pm to 6am with possible modifications. It makes the days 2 hours shorter, but I get time back on the weekend as I'm not re-charging up from the week, and I wake up rested every day.

I've done segmented sleep when I was working a service job in my 20s while living in dorm. Crash at 10pm, Get up at 4am, work an hour, go back to sleep at 5am, and get back up at 7am. That worked great, and want to try to replicate that again. Love waking hours in the twilight mornings when its quite and refreshed.

Plus, you get the benefit of another deep sleep cycle after being awake and active, and going to sleep again. (As my sleep trackers are reporting to me).

And thats not even talking about supplements and exercise to effect sleep. But I recommend magnesium for everyone.

<comment><USER12> > I've switched to a 10pm to 6am with possible modifications. It makes the > days 2 hours shorter, but I get time back on the weekend as I'm not re- > charging up from the week, and I wake up rested every day.

This is basically the 'early' schedule I have settled on. I get up between 5-6am, workout immediately, and start the day.

</comment></comment><comment><USER44> Some simple life hacks that work for me (depending external constraints).

1) I don't set an alarm clock unless I plan to get up really early to catch a plane or something like that. Normal work days, I wake up when it is light; generally around 8 am. Later in the winter and earlier in the summer. I don't fight it. That's 7-8 hours after going to bed. I need those; this is normal from what I understand. Besides, I enjoy sleeping so why cut on quality time?

2) I avoid caffeine after lunch. It causes me to sleep later and generally not get enough rest. Coffee is a short term fix when I'm tired but it sets me up for poor sleep. It works better for me when I consume less of it.

3) I eat light lunches to avoid my digestive system shutting down my brain in the afternoon.

4) I stop working when I'm tired in the early evening. The better I sleep, the later this is. Decision making goes out of the window when I'm tired and I know trying to solve complex stuff when tired is a waste of time and I can do the same job more efficiently in the morning. However, when I'm in the zone, I often keep on pushing on. This seems to happen for me a lot between 6pm and 9pm but only when I'm not distracted and well rested in the morning.

<comment><USER45> Re point 1, since I'm living a bit up north it's not bright enough outside in the morning, and my job requires me to be there by 9. So I got one of those Philips wake-up lamps, which gently fades up to a rather bright light. That helps a lot with feeling well rested when I wake up during the winter.

A key point though is to allocate enough time for sleep. My morning light won't save me if I've only had 5 hours of sleep.

Re point 3, I found the same incidentally when I tried (and managed) to lose weight. In order to cut down on calories I opted to simply skip lunch, and rather have a late breakfast. So I'd bring breakfast (two rather manly slices of >90% whole-grain bread) and eat it at around 10. Then I'd have dinner when I got home at around 5-6 pm.

This made me have a much more even energy level throughout the work day, making me significantly more productive.

</comment></comment><comment><USER46> From reading a blog post a while back I got into believing that I have a 25-hour circadian rhythm. This means that if I wouldn't use an alarm to wake up, I would end up waking up and going to bed later and later as days go by.

Is there such a thing? Does anyone have any similar experience/advise?

</comment><comment><USER47> One of the barriers to seeing more of this is the current focus on "team-ism". In the technical world, practices like pair programming and daily stand ups are big drivers of regular working hours in a field that was historically one of the better ones for individual flexibility.

</comment><comment><USER48> >And at some pharmaceutical, software and financial companies, managers expect employees to come to the office for only a few hours in the middle of the day — or to work off site entirely.

I am curious how pharma jobs can be carried out offsite(from home?).

</comment><comment><USER49> Getting up early is my super power.

I wake up at 5 AM every day without an alarm. I make my bed (1), I walk my dogs, I make breakfast, I hit the gym, I get a nice long shower, I have time to do things before all the distractions kick in. I have a short commute. Highly recommend getting up at 5 AM.

(1) If You Want to Change the World, Start Off by Making Your Bed - <USER2> McRaven, US Navy Admiral - YouTube || [https://www.youtube.com/watch?v=3sK3wJAxGfs](https://www.youtube.com/watch?v=3sK3wJAxGfs)

</comment><comment><USER50> I realised after reading this that if indeed there's a cognitive peak an hour or two after waking, then that's a pretty good argument for remote working: it enables one to enjoy _two_ peaks per day while working instead of just the one late-afternoon one, since one doesn't waste one's peak somewhere between breakfast and commuting.

It does also make the old routine of reading the morning paper seem pretty smart, since presumably doing so during a cognitive peak increases reading comprehension & retention.

</comment><comment><USER51> I know people who have to work 3 days in the morning, 1 day rest, 3 days in the afternoon, 1 day rest, and 3 days at night. I understand that there are places where they have to keep the workers in rotation, but why don't they change this monthly, for example? I don't think that in 3 days your internal clock can adjust.

</comment><comment><USER52> Finally! I am most productive at night, but not all places want to have you working during that time, which is a lose-lose.

</comment><comment><USER53> Is anyone aware of any studies done on whether and how soon the "circadian rhythm" adjusts and changes?

Personally, I easily and fully adjust within a few weeks to any new sleep schedule. For 10-14 days, I definitely feel more fatigued and productivity decreases after a drastic schedule change, but things get to normal very soon. I currently sleep at 7am and wake up at 3pm. Just a few months back, I used to sleep at 9pm and wake up at 4am. Previous few years have seen 10am-6pm, 7am-3pm, 2am-10pm, 8pm-4am etc.

As for personal preference, I prefer my 7am-3pm sleep schedule the most simply because nights are more peaceful with no distractions.

tl;dr I have changed my schedules countless times over the years, and after an adjustment period of few weeks, there's little difference in terms of productivity or how I feel.

<comment><USER54> A cool trick to adjust your schedule in just 1 night is to stop eating 12-16 hours before you want to wake up. This is particular great for travel to adjust quickly to time zone changes.

</comment></comment><comment><USER55> I was a night owl. I would sleep around 2-3AM. Then I started working out and Stopped drinking coffee. These days, I feel tired by 11 and wake up around 7AM.

</comment><comment><USER56> Not all hours are equal in terms of productivity. Realising this made me change so that I dont overwork.

</comment><comment><USER57> As a night owl I like that day shift. I love having the most productive hours for myself

</comment><comment><USER58> What about those with cycles that aren't 24 hours?

</comment><comment><USER59> There is an excellent episode on Joe Rogan show about sleep. Don't have a link handy but highly recommend it.

<comment><USER60> Is it this one? [https://podcastnotes.org/2018/04/29/why-we- sleep/](https://podcastnotes.org/2018/04/29/why-we-sleep/)</comment></comment>


Which messaging would make you want to subscribe to this mobile app? - <AUTHOR> https://betterdesign.io/poll/59049b6a5eea1d0ccfcb6f27 <comment><USER2> sorry I'm poor. No amount of marketing will make me buy something I don't absolutely need</comment>


Google in China: When 'Don't Be Evil' Met the Great Firewall - <AUTHOR> https://www.bloomberg.com/news/features/2018-11-08/google-never-stopped-trying-to-go-to-china <comment><USER3> I can't help but think the Chinese market winds up a trap of sorts - <USER2> international compromises that can harm their footing in other markets only to find that breaking into it is hard and there either already had or will have plenty of native competition making it less greenfield a market than they think.

Although China in turn has difficulties when attempting expansion outside their borders as well apparently according to some stories.

</comment><comment><USER4> "Biggest untapped market in the world"

is the phrase I hear nearly every day, sometimes many times a day, on CNBC, when talking about China. Once you start setting up expectations for wall street research firms it becomes very difficult to undo those expectations, no matter the reason. This keeps happening repeatedly with many US/European companies and China.

</comment><comment> a-fried-egg Doesn't matter as long as each entity maintains their "bottom line".

</comment><comment><USER5> There isn't any more "don't be evil" left to meet anything. Google has been divorced from that for years.

But anyway, China's too big and too tempting. They'll try any weasel word to justify getting in there

</comment><comment><USER6> At the time of this writing:

This story: 19 points, 46 min ago, 2 comments: rank 35 (2nd page)

[https://news.ycombinator.com/item?id=18405775](https://news.ycombinator.com/item?id=18405775): 17 points (less votes), 2 hours ago (older), zero comments: rank 11 (1st page)

It appears this story was suppressed off the front page.</comment>


Manufacturing bombshell:  AMD cancels 28nm APUs, starts from scratch at TSMC - <AUTHOR> http://www.extremetech.com/computing/106217-manufacturing-bombshell-amd-cancels-28nm-apus-starts-from-scratch-at-tsmc

<comment><USER2> Yup, Semiaccurate reported on this story a week ago. Its probably a good move, given that the slips in GF's 28nm process mean that the two products would only have been produced for 6 months or so.

[http://semiaccurate.com/2011/11/15/exclusive-amd-kills- wichi...](http://semiaccurate.com/2011/11/15/exclusive-amd-kills-wichita-and- krishna/)

<comment><AUTHOR> SemiAccurate got the story wrong and blames the issue on GF pushing back their SHP process. They don't mention the move to TSMC and they claim there will be a follow-up in months.

</comment></comment><comment><USER3> In case anyone else read that article and wondered "what's all this gate-last vs. gate-first business?"

<http://www.eejournal.com/archives/articles/20111114-gate/>

<comment><USER4> I'm not even sure what an "APU" is, frankly. Lots of undefined buzzwords in that article.

<comment><USER5> <http://www.amd.com/us/products/desktop/apu/Pages/apu.aspx>

tl;dr - AMD's new GPU+CPU combined chipset... the logical extension of their purchase of ATI.

</comment></comment></comment><comment><USER6> The following little piece of news is also interesting. Brad Burgess (chief architect of Bobcat) is now at Samsung (<http://www.linkedin.com/pub/brad- burgess/26/aa9/93>).

From what little I've read about AMD's recent processors, the low power line is kicking butt (Bobcat, etc) while the high end (Bulldozer) is not.

</comment><comment><USER7> So...

Are these Bulldozers really as bad as I keep reading about?

A friend of mine who is very knowledgeable when it comes to hardware insists that the issues are being overblown, and that if you get the correct configuration of hardware (ram/mobo/etc) along with the right overclocking setup, these procs are just as good, as well as more future-proof. He says most benchmarking tests are more single-threaded examples of load, which the Bulldozer obviously performs worse with, despite this being a more realistic representation of the kind of load you'd find in your average desktop, especially when it comes to gaming.

Thoughts?

<comment><USER8> As you note, for desktop/gaming purposes it's pretty obvious that single- or few-threaded performance is still king, and I see no reason to expect that to change in the foreseeable future. And Bulldozer is really, really, really bad at it. "But you can overclock it!" is a silly argument; you can get an i7 up to 5GHz or something equally unnecessary and it'll blow away whatever you can get that Bulldozer silicon up to. The bigger problem is in the hardware design, which is intensely over-shared and results in hardware-level blocking conditions, as evidenced by the various reviews out there...and overclocking doesn't help that.

I'd consider Magny-Cours for some types of server workloads, though I'd probably go with Sandy Bridge (and definitely would for a desktop). I wouldn't buy Bulldozer for anything.

<comment><USER7> Thats a shame...

I'm looking into a new rig, and he's completely sold on the design. I can imagine a world in, lets say, 2013-2014 where the desktop becomes a more multithreaded environment, but that just isn't where were at today, and thats just my guess. He's convinced the overclocking aspect makes all the difference, and Intels don't OC as well, but thats not what i'm reading (nor what you're saying).

I do like the conceptual architectural changes made with the bulldozer, but current, and forthcoming, software just doesn't seem like it will make use of it. It definitely seems like more of a server-minded approach to an architecture.

<comment><USER8> I think you're being optimistic. We're going to see all our desktop applications become pervasively multi-threaded in two years?

And Bulldozer is going to be better at this than Sandy Bridge, which is good at both single- and multi-threaded loads?

Ehhh. Not likely. The design isn't even that good or interesting; as I mentioned before, it's overly reliant on shared components that aren't conducive to the sort of magical perf improvements that "but you can overclock!" would require.

</comment></comment></comment></comment><comment><USER9> Extremetech's mobile interface is still unusable.

<comment><USER10> Yep, I couldn't read the first column on my ipad, it's half cut off on first view, scroll over and the other half is cut off.

Wonder if privoxy could do that in for me.</comment></comment>


Do without English in Computer architecture? - <AUTHOR>

Is it theoretically or/and practically possible to make a new computer architecture and subsequent devices and technologies like Desktop, Tablet's, Smartphone, Camera, Video Recorder etc. without using the anything of the English Language from hardware level programming to high level. From the design of the motherboard to every aspect of Hardware and Software. <comment><USER2> Out of curiosity, why are you asking this? Sure, most of those topics are covered in other popular languages too. Most of it is translated though, so I'm not sure if that would be allowed. You would have to reinvent the wheel many times if you don't want anything that's in English.

<comment><AUTHOR> I think that alternative to anything should be there even if it means reinventing the wheel.

</comment></comment><comment><USER3> In theory, sure. In practice, it's easier to learn English than to translate all the field's knowledge into another language (or reinvent it).

<comment><AUTHOR> From where do I start, if I don't want the easier way of learning English but reinvent it.

</comment></comment><comment><AUTHOR> I am looking kind of a guide on where to start.</comment>