Show HN: Lynk – Securely expose local TCP and HTTP services to the web - <AUTHOR> https://lynk.sh <comment><USER2> I want to be supportive, and I believe this solves a real issue, but this giving me serious pause:

> We take security very seriously, especially when it comes to our users. This > is why we offer end-to-end SHA-256 encryption

You take security seriously, but are confusing pretty basic and fundamental concepts of encrypting vs hashing.

Given that the point of this service to expose local services to the internet, and only provides compression benefits if I expose the plaintext traffic of my service, I'm not seeing a lot of information that gives me confidence you truly understand the importance of doing what you are doing securely and safely. Not to mention confidence to defend against what an attractive target this makes you for attackers to passively tap or pivot into your customers.

<comment><AUTHOR> This was a mistake on our website, which as since been removed.

1\. We'll be open sourcing our client in the coming weeks so you can check out our code yourselves.

2\. We will be offering a self-hosted version which will decouple you entirely from our infrastructure and you can provide you own SSL certificates.

3\. Lynk can forward traffic to your encrypted services - which of course would mean losing out on compression benefits, but Lynk is designed primarily for quick development work like testing out a Stripe or Github webhook on your local machine, or demoing your webapp to a remote client. For production use we recommend a reverse proxy or self-hosting Lynk.

<comment><USER3> You allow the user's machine to obtain a valid certificate for a subdomain of lynk.sh? (This would seem to me the only way to accomplish E2EE, given the example of connecting over TLS to a lynk.sh host, and it also seems very unlikely.)

<comment><USER4> why does that seem unlikely?

</comment></comment></comment></comment><comment><USER5> This product offering is a bit confusing. Not that I don't get the offering - but that the marketing around it confuses me.

It's designed for forwarding applications for development purposes? But then why the in-depth monitoring and alerting (something that seems to imply a production system might be running on top of this.)

The "meaning your website performance won't take a hit no matter where your users are" doesn't really make sense in this context either. My "users" are hopefully my coworkers/the client I'm demoing to. And if I'm tunneling up my site over wifi from my laptop, a "highly available" and "globally distributed" load balancer setup really doesn't make sense, nor is it relevant for the development use-case.

And if it's "6x more performant" than ngrok- is that really relevant if you're using it for a trivial amount of traffic in a development environment? Why is this a selling point to me?

Further - if I'm tunneling TCP, does "end to end" really matter? If I'm tunneling something that's not encrypted on my application (let's say a plaintext redis connection) the link between this service and the person connecting to the tunnel is still unencrypted. Which means the whole "end to end" marketing really doesn't make much sense - unless of course I don't trust the network I'm running on - but for some reason maybe trust the network the person accessing the tunnel is on (super unlikely situation...)

The example also irks me - exposing a database directly to the internet (if it's a database for development, hopefully - it's probably fine?)

Is this trying to compete with ngrok, or something like Cloudflare's Argo tunnels? Because the marketing material leads me in two different directions, which is pretty confusing.

</comment><comment><USER6> The standard answer to this problem is ngrok, so it'd be useful to have a direct comparison. I couldn't find any encryption code in the Github repos you have exposed (I didn't look hard); obviously, since you've documented "SHA-256 encryption", you should probably write that up a lot better. I assume that at least the client side of this will be open source, in that people are going to be squeamish about running closed source desktop tunneling software.

<comment><AUTHOR> Hi!

I've written an analysis of Lynk's performance vs. Ngrok here: [https://medium.com/@shivanshvij/building-a-better-ngrok- dbc1...](https://medium.com/@shivanshvij/building-a-better-ngrok-dbc104754822) and our documentation stating "SHA-256 Encryption" has been since removed as a mistake.

The client side will absolutely be open sourced probably by the end of next week once I've cleaned up some spaghetti code.

<comment><USER6> It might be a good idea to make that post or something like it way more prominent.

</comment></comment></comment><comment><USER7> If I can just offer one bit of feedback, if you just type any email and password in the "Sign in / Register" page, it just creates an account for you if it doesn't exist.

There's a ton of reasons you don't want that, and should probably have a separate "sign up" flow for email/password login. Here's a few:

1\. It's not at all clear you can actually do that. One guy in the comments below thinks you can only sign up using Github/Gitlab/etc.

2\. Many of us have multiple emails, what if I don't remember what email I used for your service? Every time I try the wrong one, it'll just create a separate account, and it'll take me a few minutes to realize this isn't my account, but I just created a new one.

3\. No double "password confirmation". Some sites skip this step now, so I guess it's not required, but not having it is part of why people will think this isn't a sign up field.

<comment><AUTHOR> That makes a lot of sense, thanks for pointing this out! I assumed that asking people to verify their emails would be enough but it never hurts to make things clear.

I'll make those changes as soon as possible.

<comment><USER8> Yeah, I was extremely confused at not finding a way to sign up with just email, and was about to leave when I saw this comment.

</comment></comment></comment><comment><USER9> I wanted to like this, but I couldn't get passed the awful landing page.

It brought my phone to crawl. Moving wireframes in the background would have been distracting at the best of times, let alone on an older phone.

It gives me the impression they value style over function, which is a huge turn off for me.

</comment><comment><AUTHOR> Hi Hackernews,

We're excited to announce that the Lynk Beta is now live!

We've been hard at work building out Lynk's tunnelling protocols to make them faster, more stable, and all around better. We're happy to announce that vs. Ngrok our tunnels perform up to 6 times faster (source: [https://medium.com/@shivanshvij/building-a-better-ngrok- dbc1...](https://medium.com/@shivanshvij/building-a-better-ngrok- dbc104754822)) and support technologies such as HTTP/2 (with HTTP1 fallback) and Websockets.

Check out our open beta and documentation here: [https://lynk.sh](https://lynk.sh)

<comment><USER10> I'm curious about the note that you apply compression. Are you proposing your customers rely on your encryption rather than doing their own E2E encryption? If not how significant are the compression savings if you're just compressing encrypted data.

<comment><AUTHOR> Yes, we are doing E2E encryption and compression between the Lynk Infrastructure and Lynk Clients. As with Ngrok, for a quick hosted tunnel our encryption will be more than suitable, and we are working to release a self- hosted version soon that will allow you to bring your own certificates (for both ingress traffic and the traffic between the Lynk Client and the Lynk Infrastructure).

<comment><USER2> You didn't really answer the question about the value of the compression. There are 2 options:

1- If people are using their own E2E encryption below your tunnel, then your compression provides essentially zero value, since properly encrypted traffic should not have repeating patterns to compress.

2- If you are telling people to not use their own E2E encryption, and instead rely on the Lynk tunnel's E2E encryption (with Lynk applying compression before encryption) then people are exposing their raw traffic to you, a seemingly random person on the internet.

<comment><AUTHOR> I should have been more clear.

The client compresses responses from your local services before they're encrypted and sent to the Lynk infrastructure. This application is designed primarily for development work and takes the hassle out of setting up a reverse proxy or dealing with port-forwarding.

If your local application provides its own encryption (ie, it's running over HTTPS), then your traffic won't be exposed to Lynk. In this scenario, you're right - there would be very little compression gain.

<comment><USER11> Theres an important security tradeoff here. Compress then encrypt leaves you vulnerable to attacks like CRIME[1]. How much this matters depends on the application.

[1] [https://security.stackexchange.com/questions/19911/crime- how...](https://security.stackexchange.com/questions/19911/crime-how-to-beat- the-beast-successor/19914#19914)

</comment></comment></comment></comment></comment></comment><comment><USER12> One piece of feedback: for security reasons use a different domain for tunnels.

lynk.sh & lynkapp.sh

Heroku, Netlify, Github made the same mistake of originally using their main domains for user hosted apps and it lead to several vulnerabilities.

</comment><comment><USER13> I honestly don't see the use of this. Why would anyone want to expose a development environment to the internet, especially in the age of devops and reproducible environments. 98% of all my development happens over 127.0.0.1 now. I have zero need to expose a service when I can replicate multi sites on a lan with the lightweight environment given to me with containers and vms.

<comment><USER14> One of the original popular use cases for services like this was if you're developing against a third-party service that wants to send you webhooks.

But it's also useful if you want to run something locally and show it to a friend or co-worker. The co-worker bit is especially useful now with people working from home.

Regardless, this space is pretty crowded, so I'm not sure what a new offering could do to differentiate. I'm skeptical of their "6x faster than ngrok" claim, and even if it is true, I don't think this is a use case where that metric really matters all that much.

(Full disclosure: the founder of ngrok is a friend of mine, so I'm certainly biased here.)

</comment></comment><comment><USER15> How are you handling connections? I think the original ngrok had a control connection and then opened a new connection for each request. I think they have now switched to multiplexing. I've heard multiplexing multiple HTTP connections over a single HTTP connection can have issues if there is packet loss.

For example if you have 1% chance of dropping a packet, and your conversation involves 1 packet then if you have 10 conversions each with its own TCP connection you will average 0.1 conversations being stalled from packet loss.

But if you multiplex those 10 conversations over 1 TCP connection then you will average ~ 1 conversation being stalled from packet loss.

I'm guessing this is not such a big problem with typical packet loss and a low number of conversations but if you are pushing a lot of conversations simultaneously over a single TCP connection then it could become noticeable.

</comment><comment><USER16> > we offer end-to-end SHA-256 encryption

Is this a mistake?

<comment><AUTHOR> Yes, it was and this has since been removed.

</comment></comment><comment><USER17> [https://lynk.sh/faq/#privacy](https://lynk.sh/faq/#privacy)

> We only ask for personal information when we truly need it to provide a > service to you. We collect it by fair and lawful means, with your knowledge > and consent. We also let you know why we're collecting it and how it will be > used.

Be specific on this _in_ your privacy policy. What information do you collect?

</comment><comment><USER18> I echo the sentiments that the features you promote seem overkill for the "primary use-case" of local development.

On another note I suggest you improve the accessibility of your pages. The contrast of the text in the navigation bar and on the FAQ page makes it hard to read, and is below the WCAG standards.

</comment><comment><USER19> Canyon add up comparisons with inlets and cloudflare warp? It may help migrate existing customers.

<comment><USER20> ??

</comment></comment><comment><USER21> Interesting. But I hate getting random endpoints, that means I need to keep updating configs. I'd rather use a self hosted solution, there are some easy ones out there.

<comment><AUTHOR> We'll be releasing an update soon that will enable both custom domains (so you can bring your own) and reservable subdomains. Furthermore we plan on releasing a self-hosted version and open-sourcing the client.

</comment></comment><comment><USER22> Immediately reminds me on [https://ngrok.com/](https://ngrok.com/) which should do basically the same

</comment><comment><USER20> Author of [https://inlets.dev](https://inlets.dev) here, inlets is open-source (client and server) and can be self-hosted along with link encryption with TLS. We use web sockets which can penetrate almost any firewall/NAT situation. It's also important to note the Kubernetes and cloud integration for provisioning your own exit hosts. Take a look. TCP support in PRO edition with personal license available.

</comment><comment><USER23> This reminds me of cloudflare access with faster ui/ux. The cli interface looks very similar to cloudflared.

Will give it a go when in need, cheers.

</comment><comment><USER24> Malware/bots will abuse this a lot just like with ngrok.io because of the free tier.

</comment><comment><USER25> How is this better than ngrok?

<comment><AUTHOR> I've written up an in-depth analysis here: [https://medium.com/@shivanshvij/building-a-better-ngrok- dbc1...](https://medium.com/@shivanshvij/building-a-better-ngrok-dbc104754822)

</comment></comment><comment><USER26> Can the client run on a raspberry pi?

</comment><comment><USER27> To tunnel your whole infrastructure traffic through a third party is one of the dumbest ideas I have ever heard of.

<comment><AUTHOR> We'll be releasing a self-hosted server and client soon that will allow you to decouple completely from our infrastructure and bring your own SSL certificates.

However, to be clear, this is intended primarily for local development use, for traffic that isn't necessarily sensitive.</comment></comment>


Tesla sues ex-Autopilot director for taking proprietary info, poaching employees - <AUTHOR> https://techcrunch.com/2017/01/26/tesla-sues-ex-autopilot-director-for-taking-proprietary-info-poaching-employees/ <comment><USER2> It's pretty ballsy to use a company laptop, on company time, at a company office to do work for a competitor (which is essentially what the suit is alleging).

My guess is that if he was more circumspect in this - waiting until he quit, working on it after hours on a personal computer, etc - Tesla would not be suing him over this (if the allegations are true). It's rare to see lawsuits over these things if all of the activity is taken after the employee has quit.

<comment><USER3> If an ex company sues you, of course they will say that you did it on company time, at work, on the company laptop. That you did that or not, it's hard to prove you did not anyway.

<comment><USER4> isn't the burden of proof on Tesla's shoulder?

<comment><USER5> Yes, and that doesn't stop most lawyers from _claiming_ it. Let's see about Tesla.

</comment></comment></comment></comment><comment><USER6> As soon as any company sues someone for 'poaching employees' I don't need to think more about the merits of their case because they clearly have none. The idea that such a claim doesn't just get your case thrown out with extreme prejudice is baffling. It's a market. You don't own your employees and if someone can take them from you you're underpaying them and or treating them less well than you should. Probably both. This restraint of trade bullshit treating employees like goods is just disgusting and totally unacceptable in any civilized society. It goes way beyond what is or isn't "legal"

<comment><USER7> Really? Legally obligating your employees to not try to hire their coworkers at a competing business _on company time while using company resources_ is treating employees like goods? That's a pretty bold statement, though I suspect you simply "didn't think about the merits of their case".

<comment><USER8> Does it really matter whether it's on "company resources," in any sense other than the outmoded legal sense? Or company time? Perhaps for termination, but it's not against the law to hurt your employer, nor should it be.

Perhaps you may want to refresh your perspective by remembering some of the times managers have colluded to keep wages down. "Poaching" is such a ridiculous term for "offering somebody better rewards for their work and them accepting."

Stealing proprietary information is another story though, let's not make this whole thing binary.

<comment><USER7> > Does it really matter whether it's on "company resources," in any sense > other than the outmoded legal sense? Or company time? Perhaps for > termination, but it's not against the law to hurt your employer, nor should > it be.

As was mentioned elsewhere in this thread, even California's Labor Code contains such a provision:

"An employee who has any business to transact on his own account, similar to that entrusted to him by his employer, shall always give the preference to the business of the employer."

> Perhaps you may want to refresh your perspective by remembering some of the > times managers have colluded to keep wages down.

How exactly does a senior manager using his position to recruit his subordinates fight that? In fact, it seems like a great way to put employees in precisely that position.

<comment><USER8> > even California's Labor Code contains such a provision

Again "Any sense _other than_ the outmoded legal sense." I hope you aren't arguing that something not being illegal in California is evidence that the thing is morally good?

> "Using his position to recruit his subordinates"

What's your implication? That somehow Anderson threatened their careers? Because I don't see anything suggesting that in the article. And frankly, it's disingenous to promote that kind of theory with no evidence and a clear knowledge that such a threat would never fly (I.E. any employee could go to HR and say "he's firing me because I won't join his company with that google guy" and they'd get rehired and potentially win a whistle-blower lawsuit).

If you're not implying that some threat was involved, then I have no pity on the people he so maliciously offered superior jobs to.

<comment><USER7> I was responding to the later sentence where you asserted that it wasn't illegal. No, I don't think everything in the California labor code (or any other for that matter) is in accordance with what is moral.

You can have an unhealthy power dynamic without ever directly threatening someone's career. Do you generally hold that when an employee is put in an uncomfortable position by a superior, they can't complain if they could've just gone to HR and hoped that they would be receptive?

Calling my speculation disingenuous when you tried to use the fact that managers have colluded to keep employee wages low without any evidence Tesla's in fact did that is pretty hypocritical.

<comment><USER8> >>> Do you generally hold that when an employee is put in an uncomfortable position by a superior, they can't complain if they could've just gone to HR and hoped that they would be receptive?

What I'm contending is that there is absolutely no evidence any employees were made uncomfortable by what happened. And moreover since I know I at least would much rather receive a poach offer than not from my manager, it's hard for you to make a blanket statement that these anti-poaching rules are somehow to protect employees.

I'm not suggesting that Tesla colluded to keep wages down. My point is that many C-level executives and investors see their dynamic with their employees as antagonistic (i.e. 0-sum-game). Without the opportunity to get bought by other companies the competitiveness of the market is undermined, and employees get paid below their value. Preventing poaching does exactly that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> "The suit accuses Anderson of having tried to recruit away employees from Tesla" ... I hope not, since that's not a thing that's illegal.

Tesla should certainly know that most non-solicits are not enforceable in california (and i only say most because occasionally, one is found valid, but the vast majority are not)

<comment><USER10> > _most non-solicits are not enforceable in California_

To clarify:

"Provisions preventing former employees from competing with their former employers by soliciting their customers (absent use of trade secrets) are...void... The law regarding agreements prohibiting an employee from soliciting employees from former employers, however, is far less clear at this point.

...

Provisions that outright bar the hiring of employees are likely to be found unenforceable in many circumstances and should generally be avoided. Where such provisions are used, they should be narrowly tailored, apply only to employees with whom the restrained individual works or becomes aware of during their employment, and/or make any hiring contingent on the payment of fixed sum liquidated damages.

Separately, non-solicitation agreements between employer and employee, like the one at issue in _Loral_ , are likely permissible with the caveat that they should be limited in term and scope. The term of such provisions is typically limited to one or two years, and large employers should consider limiting the scope to employees that the individual worked with and/or became aware of during the individual's employment."

Regarding _Loral_ :

"The court noted that unlike a no-hire provision, the non-solicitation agreement 'only slightly affects'' Loral employees, because they were not prevented from seeking employment by contacting [the defendant] – they were only affected insomuch as [the defendant] could not contact them."

TL;DR It sounds like Tesla's ex-employee broke his non-solicit by soliciting employees he worked with at Tesla.

[http://www.jonesday.com/files/Publication/49d21da6-33cb-45ff...](http://www.jonesday.com/files/Publication/49d21da6-33cb-45ff-8452-7c7ab1bad622/Presentation/PublicationAttachment/713339ae-5178-4bb9-a5c6-82c1b12afb9c/FEB2015%20CLEB.pdf)

<comment><USER11> Got it, that's helpful. So basically, you can't prevent a former employee from hiring your employees, but you can limit the extent to which the former employee can proactively recruit your employees, so long as the terms of the agreement are limited and well defined?

<comment><USER12> You cannot prevent a former anyone except in many states of US via non-compete agreements. (not in california)

Non-soliciting agreement is a separate matter untested in court.

However, he was an employee at the time of soliciting, making it a very different matter. Directly prohibited by california work code.

</comment></comment></comment></comment><comment><USER13> Tesla is suing Chris Urmson, who never worked for Tesla. He worked for Google.

Tesla didn't have any good autonomous vehicle technology. They bought a Mobileye and a radar, hooked them up to get lane-keeping and auto-brake, and hyped that into their so-called "autopilot".

<comment><USER14> Yes! My previous (A6) and current (S6) Audi's can basically do the same (and could for years!) without all the hype. Whenever I show it to friends they seem to be amazed it's possible and, until then, thought only Tesla was capable of such a feat.

<comment><USER15> Agreed. My subaru forester can do this with just 2 cameras by the rearview mirror. And it was <<30k out the door with 7 year warranty and 3 year maintenance.

That's marketing for you I guess. (Don't get me wrong, would get a Tesla if money were no object)

<comment><USER16> Having owned an Eye-Sight Subaru and AP Tesla at the same time I can attest they aren't nearly the same.

For one Eye-Sight turns off if you come to a complete stop and won't re-engage until you get over a threshold(I believe 18mph). It has a pretty limited HUD to communicate what the system is seeing.

In comparison the Tesla will do full rush-hour traffic flawlessly and does a much better job of communicating what it's seeing in the vicinity of the car. It also bounces the radar under the car ahead of you so it has the ability to see heavy braking conditions much sooner.

C&D did a pretty good comparison recently[1], it didn't include the A8/S8 but most of the other competitors but Tesla was far and away the better system.

[1] [http://www.caranddriver.com/features/semi-autonomous-cars- co...](http://www.caranddriver.com/features/semi-autonomous-cars-compared- tesla-vs-bmw-mercedes-and-infiniti-feature)

<comment><USER15> You are mistaken.

Yes the eyesight disengages if you're stopped for more than about 2 seconds (will acknowledge it's annoying), but you can restart it at the touch of a button even from a stand still. This might be a recent change.

That car and driver review doesn't fully explain the features.

I'm sure the Tesla is a bit nicer and more autopilotey, but it will cost you 70-80k MORE out the door which is the point. Eyesight gets you 80-90% there. The tech is otherwise similar features wise.

If anything what you could argue is that the Tesla can get you on the freeway on its own which is pretty cool. Can it do that?

<comment><USER16> How many times are you pressing that button in 40 minutes of rush hour traffic? That to me is where Tesla's AP really shines, 70mph AP is nifty but not nearly as useful.

I was just commenting since we've owned both systems, if you haven't had a chance to give Tesla's a spin they are happy to do free test-drives, on paper they look similar but in execution I found Tesla's to be miles ahead(and constantly improving).

That extra 60k also gets you some really acceptable 0-60 times :).

<comment><USER15> It's more than 60k all in when I looked into getting.

You'd be surprised, during most drives home I only have to hit it 2-3 times.

Listen, I'm not trying to argue that my Forester is nicer than your Tesla. By no means is that the case.

My comment was more to point out that the tech is a lot more common than people think.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> > He also wiped the iPhone issued by Tesla, the suit says, in order to erase > evidence of his attempts to poach fellow employees.

Don't most of us wipe the phones before turning them back to the employer? They tend to have a lot of personal stuff on them - and not really any unique company data.

<comment><USER18> The status of your private info on a company issued phone is an excellent topic to discuss with the company HR department when you are issued the phone (and laptop).

<comment><USER19> I just had two phones, work issued and mine, after 6pm the work phone went on 'do not disturb' until 9am next day

Ive noticed that work issued phones aren't the perk they appear, its a social pressure of 'we know you have a phone, we gave it to you' combined with the expectation you'll answer.

I was a software engineer at that job, I wasn't on call and I was salaried for X hours.

I still have two phones noe even though I work for myself, one for work one for home, I did think about dual-sim but I like the separation of concerns.

<comment><USER18> That works, though I'd really rather not carry two phones around. I'd make an appointment with HR first.

<comment><USER19> For me its not about checking with HR (and even trusting them) its about the complete seperation of work/life devices, I don't want my employer having access to any of my personal data/metadata and using a work phone as a personal phone does that.

As for carrying two phones, I just leave my personal phone in my coat pocket, I don't get a huge volume of calls anyway since people long ago figured out I don't answer them (and I disabled voicemail), if it's urgent text basically.

</comment></comment></comment></comment></comment><comment><USER20> This goes above the regular poaching lawsuits... he downloaded data from Tesla to a external hard drive, returned the laptop but not the drive, tried changing the timestamps and secure erasing his laptop.

Here is a link to the lawsuit with all the details of what he did: [https://assets.documentcloud.org/documents/3422711/17CV30564...](https://assets.documentcloud.org/documents/3422711/17CV305646.pdf)

</comment><comment><USER11> So non-solicitation agreements are valid in CA? I know that non-compete's are not (to be clear, as I understand it, this means that Anderson is completely free to start a competitor to Tesla, but it does not in any way allow him to use any resources of Tesla in the formation and operations of said competitor), and had sort of just assumed that non-solicitation agreements fell into the same category.

EDIT: other comments have clarified - the crux of the poaching issue in this case is that he was actively soliciting Tesla employees for his competitor while employed by Tesla. That's a far more specific scenario than trying to enforce a non-solicitation agreement after leaving the company.

<comment><USER21> Non-solicitations even after leaving the company are enforceable.

<comment><USER11> It seems that the current state of the law is that they're not categorically unenforceable in the way non-competes are, but that courts have found some limits in their scope. It also seems that there hasn't been a direct challenge to them yet. Either way, the issue in this case is Anderson's behavior while employed, so it doesn't seem like it will come up.

</comment></comment></comment><comment><USER22> One wonders how much this is thought to be winnable vs as a way to chill others who might be loose in the socket as the saying goes.

</comment><comment><USER23> Any theories on how Tesla would know he manipulated the last-accessed timestamps on documents?

<comment><USER24>
      ~/.bash_history ?

<comment><USER25>
      shred ~/.bash_history; clear; exit

<comment><USER26>
       unset HISTFILE; shred ~/.bash_history; exit

You want to unset the current HISTFILE so that it doesn't become apart of ~/.bash_history when you exit.

<comment><USER27> Putting a space in front of commands prevents them from being recorded in the history file.

<comment><USER26> I never knew that! This is awesome, not sure why I never picked up on this before.

Thank you.

</comment></comment></comment></comment></comment></comment><comment><USER28> Elon Musk has said that Apple is "The Tesla Graveyard" because they hired so many of his top engineers away. But I guess that Sterling Anderson's tiny startup is a much more convenient victim to pick on than Apple.

</comment><comment><USER29> I feel like the most interesting part of this is the effort to stop Aurora from using their tech. Anyone know if there is legal precedent to doing that from a civil suit?

</comment><comment><USER30> Any idea who "DOES 1 through 10" are? Investors?

<comment><USER31> "DOES" are 'John/Jane Does". These are placeholders for potential defendants unnamed at filing of the lawsuit, but who may be added to the named defendant list later.

<comment><USER30> I know that, duh. I was wondering if someone has any idea who those potential defendants might be.

</comment></comment></comment><comment><USER32> Illegal and Immoral by Tesla

</comment><comment><USER33> Tesla has a number of patents on this, which they made available on a reciprocal basis. They can easily refuse to allow the startup ANY USE of the patents. The startup can do the same, but may not have much in it's patent portfolio. Whatever it has are likely to be stole Tesla stuff

<comment><USER34> Startups don't typically go out and look to see if they violate any IP. Likewise, forward thinking companies like Tesla don't typically go around suing startups for using their IP. They would rather buy them up if they are doing really interesting things. IP lawsuits only get filed if there is a real threat to the business.

Telsa's patent sharing announcement doesn't really amount to much IMHO. It was a press release, not a legal contract.</comment></comment>


Paul Graham is a Socialist - <AUTHOR> http://news.google.com/news/directory?pz=1&cf=all&ned=ca&hl=en&sort=rated&author=04006731158544105119&csep=false&csed=ca

<comment><AUTHOR> I was just searching for labour disputes on Google News and someone named Paul Graham put together a Socialist News section heh.

When I added it to my sections, it was appropriately coloured red! Thanks Google ;p</comment>


Ask HN: What is your viable aka money making startup or side project idea? - <AUTHOR> I want to be clear before we start.  I am not looking for fantasy ideas. E.g. Uber for X , AirBnB for Y. No , it doesn't work that way.  I do personally know 3 founders who tried this stuff and failed.  Uber is Uber and AirBnB is AirBnb.  No more this for that.  Also, ideas such as AI, deep learning, space travel require more research work than near immediate monetization opportunities available for solo entrepreneur. Notes app , timetracker, project management software have tons of tools and app so I am reluctant to try in these areas.  AI Personal assistant also have large blockade for monetization.  At this point I don't have necessary skillset for building AI bots.
I am looking for ideas like Improvely, ticket search, fashion cloths and marketplace optimization.
I want to know what is your startup idea that could also make money ?
We all have ideas but 90 % of them are fantasies or have near zero market potential.
You might not have time to realize that idea but I do.  You could help make world better place.
If I like your idea and find potential in it I will build it myself and will compensate you at good amount at my discretion ( one time ).
I also have few of my own ideas but I don't think they have potential to make money much or might not have market potential.  Here are few of them.
1. Better search engine than Amazon for retail. 2. Porn search engine  ( I don't want to try but there is gigantic piece of money ) 3. CPC advisor for publishers and advertisers
I have background in tech.  Right now I work for one of the top 10 tech companies in Bay area.  My skill set includes business intelligence, system design and architecture, hadoop ecosystem, new business opportunities and optimization.
Unfortunately I don't have much knowledge of finance but I think over time I will do fine as I am starting from zero.
Please let me know your ideas. <comment><USER2> Ok, here's an idea:

Make a content channel which is for nothing but curated ad content. In other words, advertisers only get to post their ad if it is judged entertaining or informative enough to count as content. Of course, they pay for accepted content. The audience is attracted by the interesting ads.

This channel would compete with some aspects of YouTube (those ads that are interesting enough to get 10 million YouTube views). The idea is that by providing a curated mix of ads with no repetitive play, that it would be entertaining enough to be an entertainment destination on its own. Instead of a channel creating or purchasing interesting content to attract an audience, the curation and presentation of the ads is the value which is added.

In the ideal case, it becomes a 24/7 channel of nothing but superbowl ads. Wouldn't you or some of your friends want to watch that?

</comment><comment><USER3> A) A simple financial options trader for hot ideas.AKA - trading weekly options on Netflix, or facebook. $ could also be pooled so smaller than 1 option positions could be taken. I know a lot about finance and could help you make this tool.

B) An email sorting tool. Assigning importance scores to emails and then having the email predict where you want incoming emails to be in your list (higher scores = near the top)

C) A tool for entering your course list, and having the page find all of the cheapest markets to buy your books from. Then transacting the total deal from one webpage.

Message me if you want me to discuss further any of these ideas. These are rather simple ideas that could make a good side project. If we actually get something done, I have much bigger projects.

<comment><USER4> _An email sorting tool_

There is no contact info in your profile... I'm interested in the email idea, check out [https://github.com/alain94040/coolbox](https://github.com/alain94040/coolbox) for my own list of ideas regarding email.

<comment><USER3> cool its email@example.com - email me if you want to talk about it more.

I'm looking over your stuff and I like where your ideas are headed. You cover a lot of topics in your write up on Github. My thinking has been towards a much smaller feature set, specifically one that would help the most busy people who need the product most. After this has been achieved with a solid market share of the target market, then we begin adding additional features.

One of the major hurtles, is that email is intrinsically different for everyone. A great email solution is one accepts this natural hurtle and uses it to create an economic moat against the inevitable competition.

While I am not an expert in email or programming for email software, I have developed a feature set and interface that I believe would solve these email issues.

This project is important to me, because I think it would not only improve my life and productivity, but the lives of many others who are enslaved by emails.

</comment></comment></comment><comment><USER5> 1) 99 Designs for Voice Acting.

Particularly for videogames / commercial video production, there's a lot of small parts that are strictly scripted, and where I'd imagine it's inefficient to spend a lot of time searching through voice actors' portfolios when what you really want is just to hear a good take.

2) WordPress-native, content-aware, publisher-friendly analytics

There's a big gap in analytics software for analytics that are tightly integrated with the CMS, and focus on providing insights about content, not just pages. The same piece of content appears in many forms, in many places across the site, for varying lengths of time. How does content length affect bounce rate? How long should content stay in a particular slot before it starts getting diminishing returns on traffic? How much traffic do articles with a particular tag typically get within their first week since publishing vs their first year?

Most publishers would be totally unable to answer those questions without a month-long data integrations effort from multiple sources (assuming they've done some of the setup work with something like Google Analytics event- tracking to have the data in the first place), even though it has big implications for everything from site layout to editorial guidelines to long- tail traffic potential for content around a topic.

3) Street team marketplace, dynamic printing, and verification system as an app.

An elance-for-street-team-members site that could let companies post 'missions' for people in any major metro or college campus who want to do street team tasks, who have signed up through an app. Flyer posting, handouts, chalking, etc. Street teamers verify their work with the app through a combination of photos and location-tracking during the time they mark they're working on a mission.

Companies could optionally use the marketplace's software to create the flyers or handouts, which allows for the marketplace to both make sure it's print- shop ready and provide dynamic URLs / QR codes unique for each flyer or handout, for additional verification and results tracking.

</comment><comment><USER6> I hate to tell you, but this isn't a good way to go about looking for ideas. Either:

A.) The people who have ideas don't want to share them, especially for a nebulous offer to compensate them a "good amount at [your] discretion". Is that $100 or $100,000? It's a worse gamble than the lottery, especially if nothing is in writing beforehand.

B.) The idea should be the least of your concerns. You're looking in the wrong place for the wrong thing.

Now that I've said the harsh words, let me try to help you out.

You seem like you have your head on your shoulders with respect to tech. That's a good thing. Who you need to partner with, then, is a salesman or marketing guru. This needs to be someone with business connections or the tenacity to pound the pavement until sales start rolling in. This must be a partnership, and not one entered into lightly. Think of it as a marriage: if you join to the wrong person, it will be painful for a very long time.

I'm a good programmer. I've built a lot of websites and tools across many different technologies, and I am currently in my 3rd year of PhD studies in CS. My first business failed because I had a "If I build it, they will come" mindset. Nobody came, and I lost $12,000. Another project of mine failed because, although the idea was ahead of its time, I did not have the business contacts in that field necessary to reach critical mass. A startup that I worked for also folded because they did not have a valid monetization strategy.

What I am trying to say is that the idea is a very small part of the equation. Execution, marketing, and networking are just as important as the technology, but you haven't mentioned those at all. A good idea will not get you where you want to go, just as tires will not move you across town. It is a part of the solution, and an important part, but there are other important parts, too.

My unsolicited advice to you is this: spend more time looking for business partners that you can trust with your future, both in terms of skill set, business acumen, and financial integrity. Then, together with them, develop the idea that you want to pursue. With the right team, you can be very successful. By yourself, you might as well try playing the lottery. In fact, the lottery will be quicker and will probably cost a lot less.

<comment><USER7> Why do you think you have to lose money to attempt to build a side project?

I built one in my spare time over about a month, with a specific niche market in mind, and my first customer ready to purchase. It was profitable, not counting my lost leisure time, from day 1. A few years in it's not made a ton of money, but it's still profitable every single month without fail, because even one customer will maintain that.

I have not touched a line of code in ~18 months.

"They didn't come" to my project, either. The niche needs non-adsense sales, and my partner failed me on that front. Still, I didn't spend a dime.

</comment></comment><comment><USER8> Most of the people here are likely to be techies capable of bringing the good, feasible ideas to light themselves

Unfortunately I think you've over-specified yourself out of a discussion here. What ideas do you have and why have you ruled them out?

"A better search engine than Amazon" isn't an idea, how would you do it. What technologies would you use? Amazon was built at a time when computing wasn't as powerful as it is now and iterated on and hacked on. If you started from scratch what would you do? Once you've done that how would you monetize it?

Same with the porn search. Where's the _idea_? You've given us the headlines but not the articles!

I don't want to come across as harsh, just give your discussion a bit of a bump -- and my _good_ ideas are my ideas - I'm working on them already!

</comment><comment><USER9> > We all have ideas but 90 % of them are fantasies or have near zero market > potential.

Agreed. Who's going to judge which one is which? A random guy working on a top-whatever company, when even top investors get it wrong 8 out of 10 times? ...

</comment><comment><USER10> I'd like international ACH/checking transfers to every country out there, mainly as a tool to pay international freelancers or similar self-employed people. I can say it's viable because I'd use it.

PayPal does this quite well, but they unfortunately mix this with accepting credit cards so they're subject to VISA and MasterCard's rules(hence all the cries of "PayPal shut us down and froze our accounts due to something triggering their chargeback risk alarm!").

Dwolla looks like what I want, but they're only in the US. Still, I'll probably use them to start with as an option.

</comment><comment><USER11> > 2\. Porn search engine

Sounds like a good idea. I wonder why isn't this a thing yet?

Edit: I googled "porn search" instead of using DDG and found out that is a thing. Looks like, there are tons of porn search engines. That means it's not enough just to create one anymore. Some unique advantage is needed, isn't it?

P.S.: My humble observation is on Reddit you get downvoted for "Good try Zuckerberg", "they'll steal my idea", and not accepting "idea is nothing, implementation is everything". Looks like that's not the case here on HN.

<comment><USER9> "porndude" for once seems to be rather big one. I used it as a starting point for an iptables script that re-routed access to porn websites through VPN ;-)

</comment></comment><comment><USER12> A ClearOS (or whatever other Linux/BSD gateway/firewall distro you like) add- on/plugin that blocks access to/from Tor. Basically a thing that takes the torproject's published exit node IP address list that updates every 30 minutes & plugs those addresses into IPTables- or something along those lines. Currently this functionality doesn't exist for firewall/gateway distros (AFAIK).

<comment><USER13> Because it is a mini bash script. Nobody aint gonna write polished software for a 3 line bash script.

</comment></comment><comment><USER13> About the porn thingy. Next to that there are already a lot of these and that monetizing porn sites really is a pain and very different from everything else. What makes you believe that there is a need for this?

</comment><comment><USER14> "I work for one of the top 10 tech companies in Bay area"

Has been on HackerNews for 23 hours

Choose one.

<comment><USER15> In fairness, he didn't say _which_ Bay.

</comment></comment><comment><USER16> Good try, Winklevoss twins :^)

<comment><AUTHOR> Haha... your comment made me chuckle. I am not looking for your next gen. DNA mapping idea. It could be something as simple as a sales website idea that you always had but never had time to create one.</comment></comment>


Time series with SiriDB - <AUTHOR> http://siridb.net/blog/time-series-with-siridb/ <comment><USER2> I like the idea, especially that it's written in C (the core part, anyway) and there's just a few dependencies to install. However, the part of README that shows how to run it is completely unreadable for me, as it uses magic Docker incantations that I can't separate from SiriDB's own command line options.

Also, a collection of time series is not a flat space, contrary to your data model, where a time series only has a name. Usually there are multiple dimensions, e.g. (location) x (server name) x (cpu number) for CPU usage collected from servers from multiple server rooms. Note that it's not hierarchical and the dimensions can differ between metrics (mount point for disk space, device name for I/O operations, <nothing> for RAM usage, and so on).</comment>


Is the Nobel Prize Award Subject to Income Taxation? - <AUTHOR> https://taxfoundation.org/nobel-prize-award-subject-income-taxation/ <comment><USER2> Tldr- yes, unless you have them donate the prize money to charity in your name.</comment>


Show HN: Team communication without all the effort - <AUTHOR> https://www.checkinhq.com/ <comment><USER2> Any plans for plugins for slack/other communication platforms outside of just email?

<comment><AUTHOR> Thanks for checking it out!

I decided to focus on email since it's something everyone already uses and I didn't want to introduce yet another platform people have to check.

I'd like to add additional ways that people can be notified when a check-in has been sent out (for those that aren't great about email), but no plans for anything to deeply integrated with Slack. Monitoring real-time chat can be stressful and distracting, so I actually want to encourage people to move away from that for these kinds of updates.</comment></comment>


How Accurate Are Fitness Trackers? - <AUTHOR> http://well.blogs.nytimes.com/2013/06/12/how-accurate-are-fitness-monitors/

<comment><USER2> It doesn't matter if they're inaccurate, so long as they're consistently inaccurate. The point of a tracker is to show you the trend in your activity - if you want to get fitter then you need to simply do more. By tracking _something_ you can tell whether you're doing more, less, or the same amount as you were in the _n_ weeks prior to today. That's where the value lies, not in the actual numbers.</comment>


Ask HN: API-only startups? - <AUTHOR>

Are there any API-only startups, or other businesses that are either successful or have good prospects? <comment><USER2> Sendgrid is a great example of an API-only startup. They've sent 45 Billion transactional emails for over 60,000 customers.

<comment><USER3> Along similar lines:

<http://www.mailgun.com/>

<http://postmarkapp.com/>

And a couple of non-mail-related ones:

<http://www.fliptop.com/> \- social intelligence API

<http://www.twilio.com> \- SMS & IP Telephony API

</comment></comment><comment><USER4> The Echo Nest (<http://the.echonest.com/>)

</comment><comment><USER5> Mashery would be another example.

Often companies that have a strong business case for developers using their APIs will sponsor hackathons, so you could find more such companies by looking at lists of hackathon sponsors.

</comment><comment><USER6> <http://phaxio.com>

</comment><comment><USER7> <http://www.feedsapi.com> fits well in this category

</comment><comment><USER8> NewsCred (<http://www.newscred.com>)

</comment><comment><USER9> <https://www.opencnam.com/>

</comment><comment><USER10> I think Kinvey fits into this category. Backend as a Service.

</comment><comment><USER11> Urban Airship. Parse.

</comment><comment><USER12> Twilio?

</comment><comment><USER13> Tropo

</comment><comment><USER14> Zapier?

<comment><USER15> Love Zapier, but I'd say they're basically the opposite... They have a product based almost exclusively on external APIs.

</comment></comment><comment><USER16> Pusher?

</comment><comment><USER17> apiary.io

</comment><comment><USER18> janrain?</comment>


Unlimited Data Storage Using Image Steganography and Cat GIFs - <AUTHOR> http://minimaxir.com/2016/03/gif-unlimited/ <comment><USER2> That's pretty neat, but it can be way easier. File formats have never really been robustly verified. The difference between `file` telling you that a binary file is "data" versus your image format is about 3 bytes.

I wrote a program[0] a few years ago that does exactly this "steganography" without encoding it in as pixels. It just prints a tiny png and then concatenates your data on to the back of it. Even my script could be way simpler if I was a better programmer at the time =]. To image sites, etc it's all the same. I thought it was pretty cool when I did it. Simple concept. Worked well. All you need is to encrypt your data first, since stego is hand wavy mumbo jumbo. Here[1] is an example

[0] - [https://github.com/ejcx/pnger/blob/master/pnger.py](https://github.com/ejcx/pnger/blob/master/pnger.py)

[1] - [http://i.imgur.com/J9OJZfS.png](http://i.imgur.com/J9OJZfS.png)

</comment><comment><USER3> >The potential amount of encodable data is larger than the file size of the image itself! Screw secret messages, we're literally creating data storage out of nothing!

Uh, nope. The file is small because the frames are non random, and thus heavily compressed. If you wanted to store arbitrary data, the frames would be far more random, and therefore take up more space.

(The above was written halfway through the article)

I disagree that you need "deep knowledge of how image compression works". I have very little idea how the actual compression works, the only thing I needed to know was that images are compressed and random/arbitrary data doesn't compress as well for fundamental algorithmic reasons. It's obvious that changing images can make them larger even without any knowledge of the particular compression used.

<comment><USER4> I thought the same thing from the opposite direction. My understanding of jpg compression is that the algorithm says, "I see you have a lot of color X, X+1, and X+2 in this area. Let's just call all of that region color X+1." Now you only have the ability to hide a bit in that whole region, instead of for every pixel within.

<comment><USER3> That's lossy compression. If you try to embed data and then use lossy compression, your data will be messed up. If you insist on not losing anything, it will take up as much space as it would otherwise.

</comment></comment></comment><comment><USER5> Can this be demonstrated as true? I'm pretty sure the only reason it appears that the cat GIF could contain itself is because of compression. I imagine there's some mathematical proof that by adding more information effectively, you'll likely reduce the compression ratio and thus this infinite "trick" doesn't hold up. Happy to be proved wrong.

<comment><AUTHOR> If you haven't, scroll down past the email address.

There's the issue with image compression admist noise, but there's a _second_ issue with GIF animation compression specifically which makes the math I provide a complete sleight of hand.

I dicuss the GIF file size issue and the quest to minimize it in my original GIF post ([http://minimaxir.com/2015/08/gif-to-video- osx/](http://minimaxir.com/2015/08/gif-to-video-osx/)), which is why I think mechanics of GIF file size are interesting and why I will write a followup.

<comment><USER5> Completely missed that, well played. Oddly enough I tried PixelJihad on an image and the PNG size was actually reduced nearly 25% but resolution and quality kept the same.

</comment></comment></comment><comment><USER6> I'm on the fence if this is horrible or brilliant. On the one hand the technique has been available for decades, and UMich's Citi group did an interesting project to see if people could both exchange messages on Ebay using pictures of things for sale, and if so did any images on Ebay have steganographic content (at the time it was the largest source of user supplied images). They didn't find any (except for their own test images). But it presumably continues to be a channel people check.

Now you flood the web with images that have had data added to them, and it creates potentially millions of false positives. That then actually _enables_ using the channel for covert conversations because so many images are now carrying data, they no longer stand out.

Anyway, given that a 2TB drive is like $90, so you can create a dual parity raid set of 6 for less than $600, that seems like way more storage than you'll probably use and if you amortize it over 3 years its way less than the cost of your Internet connection over that same time.

<comment><AUTHOR> The goal of the post was "brilliantly horrible" so it appears I have succeeded. :p

Another issue I am looking into is "could an image steganography SaaS startup exist today?" I believe the answer is no because web services are inconsistent about how they modify the picture in transit. (e.g. Twitter lossly compresses the photo with no way to retrieve the original.)

<comment><USER7> Digital watermarking methods are usually resilient against some levels and kinds of manipulation of the original image (flipping horizontally or vertically, cropping, magnification); JPEG compression can probably be accounted for as well.

</comment></comment></comment><comment><USER8> When you understand basic information theory you know this is impossible.

In gifs you have a separate "color map" that stores at most 256 colors. So by modifying the LSB of each color you get at most 256 bits aka 32 bytes.

</comment><comment><USER9> Many years ago I was asked how to convert a .gif file to a .wav file. I remember taking the time to patiently explain that it just doesn't work that way. Looks like I owe someone an apology.

<comment><USER10> rename _.gif_.wav

One of my actual obfuscations a long time ago against casual users. Except it worked the other way around to hide midi's and mp3's as broken executables, etc. :)

<comment><USER11> Nope; your header won't match which is an easy thing to detect and red flag.

In regards to the original challenge, you could convert a gif to wav a number of ways, the simplest being just copying image data as raw PCM.

Of course you can make it even more interesting.

Imagine turn each color channel into notes (dark red = C, blue = D, etc...). Better yet, what if remapped each byte value of a color into a table of chord progressions. What if you only allowed harmonized chord progressions and made it in a 4/4 rhythm. You just turned a gif into a song.

If you wanted to go even more ambitious, use something like OpenCV to identify shapes, objects, people/animals. Take what you find and create a sound mixer that generates a cacophony of sounds.

Use your imagination; code can be beautiful.

<comment><USER10> "casual users"

It won't matter given my use case of non-technical people snooping on computers or half-assed educators finding what I stashed on barely maintained PC's. I'm not speculating: they were fooled to the point they gave up trying far as I know.

"Of course you can make it even more interesting."

This is true. Your ideas are interesting. My brief foray into this sort of thing brought in a problem: compression passes applied at different points in apps and services. Your file might get modified at some point by a cheap storage service.

Also, the readers are lossy by design. So, these two things must be considered in any of these stego designs using multimedia formats disguised as actual multimedia. Plenty of methods still left.

</comment></comment></comment></comment><comment><USER10> Neat trick. I'll pass on dropping tens of millions on your startup. Might still use the trick for storage, though. I'll run the stuff through GPG or bcrypt first. :)

</comment><comment><USER12> Except that if your adversary finds your secret trove of a billion cat GIFs somewhere... then it isn't "steganography" anymore.</comment>


Roundup Philippines: A country that has it all - <AUTHOR> http://escapology.eu/2014/06/26/roundup-philippines-a-country-that-has-it-all/

<comment><USER2> I'm from TX originally, but spent over a decade in Silicon Valley. I responded to a craigslist ad that said I could telecommute, so I took that to an extreme. I chose .ph because of previous experience with people, research, and the ease of maintaining a visa. I'm a director at an ecommerce company. I love it--it's allowed me to tailor my life around the things I like and that make me most effective as a person. I don't miss home--I am not an overly emotional person. Filipino food is awesome :)

</comment><comment><USER2> I've lived in the Philippines for 5 years now, in different locations. I'll monitor this for 24hrs and answer any questions you might have.

<comment><USER3> Where are you from originally? How did you end up living in the pi? What do you do professionally? Do you like it? Do you miss home? Sorry for all the questions, but I think it's totally cool that you live there. I love fillipino food!</comment></comment>


I Would Rather Cry In A BMW - <AUTHOR> http://en.wikipedia.org/wiki/I_would_rather_cry_in_a_BMW

<comment><USER2> Can we safely say Communism hasn't panned out then.

<comment><USER3> They successfully transmogrified it into state capitalism.

<comment><USER4> One could argue that real-socialist or "communist" states were actually running capitalism all the time, although a degenerate form where the state was the only monopolist.

I mean, people there work for a wage, someone else extracts the surplus value, people buy the products of their labour on a kind of market with said wage, most people are miserable, those who control the means of production get filthy rich and have a lot of power, and hilarity ensures. This is basically the definition of capitalism according to Marx.</comment></comment></comment>


Comparing Java GC Collectors - <AUTHOR> http://eivindw.github.io/2016/01/08/comparing-gc-collectors.html <comment><USER2> I know that profiling using VisualVM (or most other profilers) can substantially change the garbage collection behavior of an application ([http://psy-lob-saw.blogspot.com/2014/12/the-escape-of-arrayl...](http://psy- lob-saw.blogspot.com/2014/12/the-escape-of-arraylistiterator.html)).

I don't know if using VisualVM in the way this article does has the same effect--sounds like the author is not doing any actual profiling, so it may not be an issue. Additionally, since this is a synthetic benchmark, you might argue that it's not important. Still, I'd tend to think it makes more sense to use OS level tools to monitor the CPU usage and avoid changing the behavior of the JVM.

<comment><USER3> I concur. These results would have been better if they'd been generated using the native GC logging format and then run through an analysis tool.

Similarly, the article mentions that the synthetic benchmark was run for only a minute. I am heavily suspicious of this - any results you get here will be useless until HotSpot has had a bit of time to optimize the running code. I heavily suspect that the G1 throughput would have been significantly higher if the benchmark had been allowed to run longer.

<comment><USER4> Not only did he not give the Hotspot time to warm up but we have no idea what the overhead of the Dropwizard stack is (i.e., if its heavily IO dependent that's going to obviously shift things), what Application<T> looks like, what the emitted code is. If it's anything like Clj, the overhead of the package runtime is not insignificant. The native GC logging is way better than using log4j (which is great for logging, but abymsal in situations like this for obvious reasons...). He's on OSX, if he wanted to conduct this with even the slightest bit of rigor he would have used Dtrace and probed a few application runs with appropriately placed probes. Like it's already been mentioned, he should be using whatever the JDK (or ideally JMH, IME) gives him to bench rather than that log4j derivative, because that could potentially introduce disk seek variance between the two GCs (i.e one could be simply buffering, then capturing stdout's FD, and flushing -- rather than having 60 very significant potential 'get FD, (potentially block until you can acquire a mutex on it; then potentially wait to seek out) , write, flush/sync' while the other one might have just done it once (as I have no idea about the the library he's using to log, nor have I used an OS X file system in production (unless it uses UFS1 in which case I when I was 13 or 14 for a bit). He's writing to a tty so that's probably not going to impact performance too much I'd imagine, but if you've real-time cat'd a 200 meg file out to a tty, you'll see that the benchmark is actually output to the screen rather than the throughput of the disk (again, not sure why, probably has a lot to do with the X11/Xorg frame-buffer being slammed and/or the bloat of the term you're using (you'd absolutely see variance between something minimal like xterm + sh, vs gnome-terminal + zsh)). Anyways, yeah, he should have read some Oracle docs to minimize the number of independent variables between his two cases to make this even moderately definitive. (Also I'm baffled why he even put in any IO what so ever if the whole point was to bench the 4 different modes of GC...).

Anyways, instead of tearing apart his post by pointing out the complete lack of rigor and experimental design foresight he exhibited, something fun to do is to take the Sun JVM, IBM J9, OpenJDK, Graal (or something along the lines of that) and Zulu (if you can scare up a Zulu license you're in for a pretty interesting treat). It's amazing how one IL can yield so many different performance results.

<comment><USER2> I don't see anything about log4j, he's using the JVM built in GC Logging, and can you explain the dtrace reference? Wouldn't think it's what you'd use for Java GC analysis. Is this some kind of odd sarcasm?

<comment><USER4> Absolutely nothing sarcastic about it.

RE: Log4j. I haven't written Java professionally in almost a decade, so my mind substitude "something similar to log4j" in. Slf4j, log4j 2.0, both libs serve (as I understand it, am I horribly off base here?) the same purpose -- your kernel will be forced to make a syscall to write, in this case to his stdout, introducing unnecessary variance when your goal is to contrast two states of GC.

RE: Dtrace is a fantastic tool for making granular benchmarks. Again, theres nothing sarcastic about it. As I previously mentioned here JMH would be ideal, confirmed by Oracle[1] as the method to use. (Read the second section, starting with a few paragraphs up from Listing 6.) He basically gives a prescriptive method by which one can use the same tool I mentioned to combat the same issues I brought up, especially for situations like this (micro- benching). DTrace would take it one step further (again, assuming you're skilled enough to use it appropriately) -- you'd end up getting effectively a caliber of measurements on par with Intel PIN. I suppose drastic overkill for this situation, but no, there was nothing sarcastic (nor incorrect, as far as I can tell) about anything I said.

Edit: As I re-read my response to him, I'm baffled as how you can even think this was some sort of sarcastic jab. The dude made an awful post, and I tried to diplomatically raise a few of _many_ issues with his method. I guess I was being a bit of a dick to him by just hammering him away. He's probably just some 19 year old and I should have been constructive instead by spending 15 seconds to search for one of the plethora of sources available on how to properly benchmark the variance of different styles of garbage collection on stack-based VMs. I suppose my foul mood and an easy blog post as a target will yield make for poor manners. Apologies, OP

[1] [http://www.oracle.com/technetwork/articles/java/architect- be...](http://www.oracle.com/technetwork/articles/java/architect- benchmarking-2266277.html)

<comment><USER2> Sorry for the bit about sarcasm, I was just really confused by some things, and said something silly and obnoxious.

 _The native GC logging is way better than using log4j (which is great for logging, but abymsal in situations like this for obvious reasons...)_

He's using the native GC logging. The log4j clone is application level logging, which is what originally confused me.

I see you're worried about variance, but I'm not sure a super synthetic benchmark is better. With GC measurement, you're concerned about how an actual application produces garbage--unlike writing a controlled benchmark with JMH. I'd rather see an actual Dropwizard app/servlet hit with JMeter or something like that, and enough runs to smooth the variance--the opposite of tearing out the logging.

 _he would have used Dtrace and probed a few application runs with appropriately placed probes._

Still confused by this. Hotspot does GC logging. How do you propose he improve on that with DTrace?

</comment></comment></comment></comment></comment></comment><comment><USER5> Main point of the article was really to show how to use gc logging correctly - calculating max, avg pause-times plus throughput. The VisualJ stuff was just added for fun. I ran without it - and the numbers are the same. Also running for a minute was just to get images to compare.

In a real application you just need gc logging and a tool to calculate metrics. Point is that you have to measure - my numbers are only valid for a 1 min running testapp..

</comment><comment><USER6> There are so many other factors that ultimately determine GC performance. The GC must be tuned based on the workload. For instance, the out of the box defaults for things like newRatio [1] are not ideal for web services with lots of short-lived objects.

[1] [https://blogs.oracle.com/jonthecollector/entry/the_second_mo...](https://blogs.oracle.com/jonthecollector/entry/the_second_most_important_gc)

<comment><USER5> Yes, choice of collector is just one of many tuning options. Point is you need to log and measure your own app for every change you make.

</comment></comment><comment><USER7> Article is trash.

There are different collectors. They are different.

No really?

<comment><USER8> also i was unable to find a reference to the version/build of java the author was using - thus negating any numbers/benchmarks presented.

</comment></comment><comment><USER9> What is the default GC for the 1.8 JVM?

<comment><USER2> Parallel. G1 will be default in 1.9.

Edit: the part about 1.8 is wrong. 1.8 doesn't have a standard default.

<comment><USER10> Not sure what you meant in the edit, but the first sentence is correct. Hotspot 1.8 does default to Parallel collector in the absence of any explicit GC setting VM arguments.

[1]: [http://hg.openjdk.java.net/jdk8u/jdk8u60/hotspot/file/37240c...](http://hg.openjdk.java.net/jdk8u/jdk8u60/hotspot/file/37240c1019fd/src/share/vm/runtime/arguments.cpp#l1569)

<comment><USER2> That's what I initially thought, but then looked at

[http://docs.oracle.com/javase/8/docs/technotes/tools/unix/ja...](http://docs.oracle.com/javase/8/docs/technotes/tools/unix/java.html) and confused myself.</comment></comment></comment></comment>


Was $1 Billion Too Little to Ask for Instagram? - <AUTHOR> http://www.slate.com/blogs/business_insider/2013/11/14/facebook_s_1_billion_instagram_buy_did_kevin_systrom_sell_too_soon.html <comment><USER2> Asking this is like asking if Google should have IPO'd at a mere ~$35B valuation back in 2004. They could have got 10x that today!

Obviously, as time progresses, a successful company's value will grow. But there's also risk. The real question was if $1 billion that day was better than $5 billion in a year? When you're not already a millionaire, the answer is probably yes.

Even sweeter of a deal when you get the mentorship of Facebook to help your business grow and improve your likelihood of success.</comment>


The Biggest and Weirdest Commits in Linux Kernel Git History - <AUTHOR> https://www.destroyallsoftware.com/blog/2017/the-biggest-and-weirdest-commits-in-linux-kernel-git-history <comment><USER2> Clauset Shalizi Newman 2007 has not-nice things to say about the classic physicist's idiot trick of fitting power law distributions by drawing a straight line on a log-log graph: it's got huge bias. [https://arxiv.org/abs/0706.1062](https://arxiv.org/abs/0706.1062)

However, the other difficult thing about power law distributions is that the dataset size requirements for proper determination of the fact that it's a power law distribution are occasionally incredibly difficult. So their critique is very strong, given the comparative lack of data. It is often the case that computer systems, with the overflowing reams of data, are still not enough. Note that the paper I cited up there suggests MLE and then a Kolmogorov-Smirnoff test, so it'll say a lot of things aren't power laws that could well be.

Another way to look at it is from a more geometric point of view. The metric entropy of any generic system of variables is defined as the sum of the positive Lyapunov exponents: and as an "entropy" that quantity does have a lot of commonalities with the other entropies. But to have positive Lyapunov exponents is often to have a chaotic dynamics, so it could just be conjectured that the time series of commits and merge octopus sizes in kernel git history is chaotic, so the evolution of the time series will be fractal in nature.

But it's also really fucking hard to confirm or deny that one, because there are varied and strange definitions of chaos itself and the methods that have been suggested to measure Lyapunov exponent in real systems are arcane and difficult. You could try some synchronization methods, but they remain arcane and crap. Fractal measurement methods are also shitty and full of dark magic.

One neat little trick might be to discretize the series, symbolic dynamics- style (it's already discretized but discretize further, into like percentiles or something) and run it through one of the dynamical machine learning dealies to see if there's patterns. Not too much literature on that but it's a thing that some randoes in like 2004 or something did

<comment><USER3> There's an old saying among scientists: any set of data points will fit a power law if plotted on log-log paper with a fat enough magic marker.

<comment><USER4> That's a corollary of "no one will prove your statement wrong if you use language ambiguous enough."

<comment><USER5> > Maybe it was or it was not a bug that may have been impacting or not the > staging or maybe production systems.

I've not been fired yet for saying that.

</comment></comment></comment></comment><comment><USER6> There is a mention of the 66 parent merge from Linus himself:

[http://marc.info/?l=linux- kernel&m=139033182525831](http://marc.info/?l=linux-kernel&m=139033182525831)

<comment> semi-extrinsic > "Christ, that's not an octopus, that's a Cthulhu merge"

<comment><USER7> Related - from Twitter recently: [https://twitter.com/HenryHoffman/status/694184106440200192/p...](https://twitter.com/HenryHoffman/status/694184106440200192/photo/1)

</comment></comment></comment><comment><USER8> Another interesting piece of trivia: the very first more-than-two-parent merge in the kernel history is a mistake. The second and third parents are _the same commit_.

        commit 13e652800d1644dfedcd0d59ac95ef0beb7f3165
        Merge: 4332bdd 88d7bd8 88d7bd8
        Author: David Woodhouse <firstname.lastname@example.com>
        Date:   Sun May 8 13:23:54 2005 +0100

            Merge with master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6.git

</comment><comment><USER9> Some of my favorite commits come from Rusty Russel, who wrote the lguest toy hypervisor documentation as a story:

[https://github.com/torvalds/linux/commit/f938d2c892db0d80d14...](https://github.com/torvalds/linux/commit/f938d2c892db0d80d144253d4a7b7083efdbedeb#diff-847230dec604827964905e0dfec81e42R1)

</comment><comment><USER10> I don't like OP's definition of divergence. I prefer to take the size of the diff along first-parent instead.

Here's how I would do it:

      time git log -m --first-parent --shortstat --pretty="%H" --min-parents=2 |
      grep -v '^$\|3e1dd193edefd2a806a0ba6cf0879cf1a95217da'                   |
      sed 's/.* file.* changed,//'       |
      sed 's/insertion.*,/+/'            |
      sed 's/deletion.*//'               |
      sed 's/insertion.*//'              |
      sed 's/^\ \(.*\)\ $/\$\(\(\1\)\)/' |
      xargs -d '\n' -L 2 echo echo       |
      bash                               |
      sort -k 2,2 -g

Note: I skip 3e1dd193edefd2a806a0ba6cf0879cf1a95217da because that commit has no diff along first-parent, and thus screws up my xargs result (which depends on every 2nd line having the --shortstat output).

Of course "\--first-parent" doesn't guarantee that we're walking the mainline (see: [https://developer.atlassian.com/blog/2016/04/stop- foxtrots-n...](https://developer.atlassian.com/blog/2016/04/stop-foxtrots- now/) ), but it _usually_ is.

On my laptop it takes 3 mins 30 seconds. Here are the 5 biggest merges by this definition:

      099bfbfc7fbbe22356c02f0caf709ac32e1126ea 463702
      3f17ea6dea8ba5668873afa54628a91aaa3fb1c0 466320
      ce519e2327bff01d0eb54071e7044e6291a52aa6 500074
      7ea61767e41e2baedd6a968d13f56026522e1207 504965
      f063a0c0c995d010960efcc1b2ed14b99674f25c 569691

And here's "git show" for those 5:

      099bfbfc7fbb 2015-06-26T13:18:51-07:00 Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux
      3f17ea6dea8b 2014-06-08T11:31:16-07:00 Merge branch 'next' (accumulated 3.16 merge window patches) into master
      ce519e2327bf 2009-01-06T17:04:29-08:00 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6
      7ea61767e41e 2009-09-16T08:11:54-07:00 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6
      f063a0c0c995 2010-10-28T12:13:00-07:00 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6

<comment><USER10> This approach also helps with those orphan branches since it just calculates the diff caused by bringing the orphan branch into the mainline.

Whereas OP's definition counts every line ever created on both sides (e.g., counts every line of code in the original project as well as the orphan at the moment of the merge).

<comment><USER11> If you want the diff caused by bringing a topic branch into master (i.e. its unmerged parts), you can also do

      git diff master...topic

with three dots instead of two.

<comment><USER10> Or in this case (since we're processing merges one at a time to make the calculation): git diff COMMIT^1...COMMIT^2 (aka, parent1...parent2).

I find the three-dot diff notation very useful, but confusing, and always have to type "git help diff" first and stare at the docs a bit to find this bit:

      "git diff A...B" is equivalent to
               "git diff $(git-merge-base A B) B"

Also, I prefer first-parent since it gets the actual change to the mainline, whereas "git diff parent1...parent2" might miss some changes with dirty merges (e.g., conflict resolution). More info here: [http://stackoverflow.com/a/41356308/5819286](http://stackoverflow.com/a/41356308/5819286)

</comment></comment></comment></comment><comment><USER12> > _" Christ, that's not an octopus, that's a Cthulhu merge"_

Perhaps git should throw a warning when you try to do an octopus merge with more parents than an octopus has legs. If you really want to proceed, add the --cthulhu option. The default behavior would be --no-cthulhu.

<comment><USER11> Because Git totally needs more obscure command line options. /s

</comment></comment><comment><USER13> It only has one parent, but this would be the commit that I'm least proud of (not in Linux, obviously):

[https://github.com/cyrusimap/cyrus- imapd/commit/fdc0eb3d09bc...](https://github.com/cyrusimap/cyrus- imapd/commit/fdc0eb3d09bcc2ce916d2790c98839a61d403937)

Showing 126 changed files with 14,128 additions and 20,617 deletions.

(ok, I'm pretty proud of reducing code size by 6k+ lines while improving lots of stuff, but the commit is a shitshow)

</comment><comment><USER14> GitHub's logo always reminds me of the octopus merge; not sure if it was chosen for this reason, but I think it's quite suitable.

<comment><USER15> Given that the name refers to octopus ("octocat"), it's very likely.

</comment></comment><comment><USER16> I think Gary's commit counts are off:

      $ git log | wc -l

This should count the number of lines in the entire git log, including metadata (not just commits). I think he means this:

      $ git log --oneline | wc -l

The number of commits for Rails should be closer to 61,000.

<comment><AUTHOR> That would explain why the commit frequency seemed to improbably high. I just updated it with correct numbers. Thanks.

</comment></comment><comment><USER17> _Octopuses are more common than you might expect_

The etymologically correct plural is _octopodes_. (Some people accuse "octopodes* of being pedantic, but as I see it "pedantic" is just a euphemism for "correct in a way I don't like".)

<comment><USER18> 'The standard pluralized form of "octopus" in the English language is "octopuses" although the Ancient Greek plural "octopodes", has also been used historically.'[1].

The book "Octopus: The Ocean's Intelligent Invertebrate"[2] which I have here says this on the matter: "By the way, the plural of octopus isn't octopi, because the word is Greek -- octopus to be exact -- not Latin. The Greek plural would be octopodes, but we call them octopuses."

You're not being pedantic as it pertains to this word in the English language, you're just wrong.

1\. [https://en.wikipedia.org/wiki/Octopus#Etymology_and_pluraliz...](https://en.wikipedia.org/wiki/Octopus#Etymology_and_pluralization)

2\. [https://www.amazon.com/Octopus-Intelligent-Invertebrate- Rola...](https://www.amazon.com/Octopus-Intelligent-Invertebrate-Roland- Anderson/dp/1604690674)

<comment><USER17> I didn't say _commonly used_ ; I said _etymologically correct_.

The word "octopus" comes from Greek, just like the word "corpus" comes from Latin (and has the etymological plural "corpora").

<comment><USER19> How a word is affected by grammatical rules (such as pluralization) is not determined by etymology (but it can be).

Here's the german conjugation of "mailen" (writing an e-mail), borrowed from "to mail":

Ich maile, du mailst, er/sie/es mailt, wir mailen, sie mailen.

I don't know any loanwords that break english pluralization rules in german, but for the reverse: The correct plural for "Kindergarten" would be "Kindergärten" (not "kindergartens"), which I imagine some english speakers would have problems with. And "Autobahnen" is rather unintuitive compared to "autobahns".

<comment><USER20> > I don't know any loanwords that break english pluralization rules in german

The plural of 'Baby' is 'Babys' (instead of 'Babies' – though some people also use that form) and 'Computer' doesn't change.

On the other hand, both 'Indices' and 'Indexe' are used and for 'Tempus' the only plural is 'Tempora'.

</comment></comment></comment></comment></comment><comment><USER21> Slight article nitpick: a distribution that 'looks like a straight line' in a log-log plot is often _not_ power-law distributed.

One could say that the distribution has a fat one-sided tail though.

<comment><AUTHOR> I thought about trying to clarify this, but "power law" is the term that's been thrown around to describe this effect in software systems for many years. Really, I only care about the fat-one-sided-ness (for its practical implications); I don't care so much about the precise mathematical formulation.

</comment></comment><comment><USER11> I used octopus merges once for a deployment system that I built when my team switched from SVN to Git. Since there were a lot of developers working on different parts, it was many times required to test multiple different changes in parallel in the QA system.

I built a small web UI where developers could select and unselect development branches, and it would octopus-merge all selected branches into the master branch, and force-push that state onto the QA branch (and deploy it to QA, of course). So QA would always be master + all development branches that were currently being verified. By using a Github webhook, it would update the QA system whenever master or one of the branches being verified was pushed to. I'm not in that team anymore, but I think that deployment tool is still humming along nicely.

<comment><USER22> There must have been many times this would fail because of merge conflicts?

</comment></comment><comment><USER23> Has anyone asked Laxman Dewangan what he was up to with that initial commit and merge thing?

<comment><USER8> It's common in a lot of Git UIs (GitHub, for instance) to prompt you to create a README when you create a new repo. I think this is because when you're _actually_ starting a project, older versions of git would get confused if you cloned an empty repo, but using `git clone` to get a directory to work in is much nicer than `git init` + do work + `git remote add origin` + `git push -u` or whatever the command is. So, the hosting tool generates an initial commit for you so that a clone works smoothly.

My guess is that Nvidia has some internal Git hosting tool or a private GitHub account, and this developer clicked the most obvious "create a repo" button and tried to push their local git clone of Linux it. That push was rejected because it would have clobbered the auto-generated commit, so they did a `git pull` and a `git push`, i.e., they merged in the auto-generated commit.

</comment></comment><comment><USER24> That was the worst diagram today. <1 Commits on the y-axis? Where would be 30 on the x-axis? Can't tell if you only have 3 markers on a log axis.

<comment><AUTHOR> What were you trying to do, locate your favorite commit?</comment></comment>


Ask HN: Any suggestions for a good registrar to register .io domain? - <AUTHOR>

<comment><USER2> Gandi.net costs 40 bucks for first year!

<comment><AUTHOR> Thank you. worked.</comment></comment>


Chess Hustlers (2001) - <AUTHOR> http://www.slate.com/articles/arts/culturebox/2001/05/chess_hustlers.html <comment><USER2> good read, thanks for the share</comment>


Lasers could cut lifespan of nuclear waste from "a million years to 30 minutes," - <AUTHOR> http://Www.bigthink.com/technology-innovation/laser-nuclear-waste.html <comment><USER2> > _If he gets pulses 10,000 times faster, he says he can modify waste on an > atomic level._

> _Mourou and Tajima hope to be able to shrink the distance a light beam has > to travel to transmute atoms by a further 10,000 times._

The article is not very clear, and it makes no sense to use a short (in time) pulse and even less a short (in distance) pulse.

Perhaps they want to increase the frequency of the light 10,000 times that will shrink the wavelength and period 10,000 times. It also increases 10,000 times the energy of each photon so it _may_ induce nuclear reactions. This would create a gama-ray laser. It looks very difficult.

</comment><comment><USER3> 404 error. Here's the full link... [https://bigthink.com/technology- innovation/laser-nuclear-was...](https://bigthink.com/technology- innovation/laser-nuclear-waste)

<comment><AUTHOR> Thanks. My bad. I can't seem to edit the url anymore.

</comment></comment><comment><USER4> "magical" thinking.

Meanwhile, what happens with the energy surplus/deficit which occurs with changing one nucleus to another?

To put that another way, think of "a million years" of breakdown energy being released in a mere "30 minutes".

I reckon it's a scam in trying to attract 'research funds'.

</comment><comment><USER5> At non trivial rates?</comment>


In 2008 it became compulsory for Norwegian companies to appoint a substantial number of women to their management boards - <AUTHOR> http://news.bbc.co.uk/2/hi/business/7176879.stm

<comment><USER2> " Days after the 1 January 2008 deadline passed, almost every single listed firm has female faces on its board. The government can now proclaim its policies a success"

That's just incredibly sick (the calling it a success part). The definition of success is that people follow the laws? In what other profession might it be so easy to be successful?

</comment><comment><USER3> So now when you hear about female Norwegian executives, you can assume with a fifty percent chance that they are only hired to comply with the law, and are thus to incompetent for their job.

</comment><comment><USER4> It's like stock photos of board meetings propagated back into the real world...

</comment><comment><USER5> Will be interesting to look at Norway vs Sweden, Finland, Denmark and other European firms in five years or so, and see if there is any impact.</comment>


TypeScript: Using the Compiler API - <AUTHOR> https://github.com/Microsoft/TypeScript/wiki/Using-the-Compiler-API <comment><USER2> TypeScript doesn't really have a plugin system (language service plugin are very limited), but the compiler API does give you access to a quite a lot. This includes niche use cases such as building inside a browser, dynamically generate files, transform the output, run type-aware migrations on an entire project.</comment>


Ask HN: Has anyone been using and reaping the benefit of the Pomodoro technique? - <AUTHOR>

How long do you keep each Pomodoro? What do you do during the 5 minute breaks? <comment><USER2> I've tried it in the past. It's hard to keep up over long periods of time in my opinion. It started to feel like a chore and pretty restrictive after a while. But that's just me.</comment>


Senate Nears Final Vote on Patents - <AUTHOR> http://thecaucus.blogs.nytimes.com/2011/03/07/senate-nears-final-vote-on-patents/

<comment><AUTHOR> I'm sorry, the notion that this somehow levels the playing field is completely wrong. It's very difficult for a layperson to file a patent properly, in the proper legalese and keep track of all the necessary actions. This bill definitely opens up patents to large corporations and patent holding companies that can essentially throw teams of lawyers at particular fields.

After spending 5 years and more money than I'd like to admit on our patent that has still yet to be awarded I can tell you from personal experience that every response is cryptic, and the necessary follow-up actions are extensive and intensive. Furthermore, if they're not written in the proper legalese you have even less of a chance.

This is yet another boon to large corporations and their lawyers. Now that companies such as Apple, Google, and Microsoft don't have to worry about prior-art we'll see innovation slow to a crawl, and startups will have even less of a chance of disrupting the status quo as a lawsuit won't be too far behind. I can see it now, _We demand you shutdown as you're infringing on the patent we were recently awarded_ , it won't matter that you were already operating. They can simply pay extra fees, get a faster approval and you're gone. This is supposed to be progress and improvement? Only to the lobbyists and their employers.

</comment><comment><USER2> I'm so tired of the whole thing, I'm not even keeping track of it anymore. Reform these days _(1)_ has just become doublespeak for "like it is now, only more so". Status_quo++.

They're going to do what they're going to do. Its going to be the opposite of what would be best for us, and we'll find a way to work around it.

 _(1)_ I think perhaps this is the way its always been, and I was just too young to notice.

</comment><comment><USER3> Does the Senate seriously think THIS is the sort of reform we need in the patent system? Are they that out of touch?

The article itself isn't much better, it barely touches on the real problems in patent law.

</comment><comment><USER4> If prior art doesn't matter, what stops anyone from patenting someone else's publicly known invention and then suing them?

<comment><USER5> Wait, what?

Who is suggesting that prior art wouldn't/shouldn't matter?

"First to file" patents would still be invalidated by any published (or publicly available) prior art. It just means that you couldn't invalidate by demonstrating that you were privately working on the same idea.

<comment><USER4> What counts as private/public? If I show someone a project I'm working on but I've never shown anyone else, can this person go patent it?

</comment></comment></comment><comment><USER6> This is basically an abdication of any attempts at making certain a patent is valid on the part of the PO.

Their job will be reduced to simply checking that the format and wording is in order and making sure there's a timestamp.

<comment><USER7> How so? First to file doesn't eliminate the requirements of novelty and non- obviousness. It just means that if two people both claim the invention the first to file wins instead of whoever can prove they invented first. First to file is used everywhere except the US.

</comment></comment><comment><USER8> From my limited understanding, if you simply submit a application, you are protected until it is reviewed plus the time granted with a patent. So if you pay the new smaller amount, and it takes the PO 5 years to review your patent instead of the normal 1 for corporations, you'll have an extra 4 years of protection over the life of the patent. Clock starts once it's reviewed and accepted, but protection starts once it's filed. Depending on how much cheaper this is for small businesses, it could potentially help them out by offering longer protection for less money, if only because it takes longer for their patents to be reviewed.

But I think I agree with asnyder for the most part. Most people don't even know where to start, and may lose protection simply because they didn't know what to do before the idea spread and someone else with the know-how made the product and patented it.

<comment><USER9> > Clock starts once it's reviewed and accepted, but protection starts once > it's filed.

If so, that's a change (back).

A "long time ago", the clock started at issue, so some folks filed and kept an application alive for (in some cases) decades until the patent was worth something. They then let it issue and ... profit. That's what was known as "submarine patents".

A while back (20+ years IIRC), the rules were changed so the clock started on filing. (Despite that, some folks still rant about submarine patents.)

Have those rules really changed back? When?

<comment><USER8> I apologize for being unclear. You are correct on the clock starting, but the clock can also be adjusted by the PTO if your patent is delayed in approval if I am understanding what is below correctly. If all patents granted to 'small business/inventors' are delayed to a great extent due to larger companies paying more for earlier patent approval, I assume that smaller inventor's patents will be adjusted, allowing them a longer term of protection, as they can start their business as soon as they file.

See #3 here (also great info on patents in general): <http://www.bpmlegal.com/howtoterm.html>

"Patents based on applications filed on or after May 29, 2000 (actual filing date, not priority date), might have had their terms extended for Patent Office delays beyond certain limits. Such extensions, called "patent term adjustments", are automatically given when the patent is issued, and they are usually marked on the face of the patent, flagged with "( _)". For example, see patent 7,613,700 - "(_ ) Subject to any disclaimer, the term of this patent is extended or adjusted under 35 USC 154(b) by 291 days." These adjustments are calculated mathematically based on a formula which takes into account when each office action was sent by the USPTO as compared with a standard for such actions, and subtracts any delays caused by the applicant's delay, and so on."

However, if the standard is now different because of the new law, or if it is segmented by pricing, I have no clue what may happen.

<comment><USER9> > I apologize for being unclear. You are correct on the clock starting, but > the clock can also be adjusted by the PTO if your patent is delayed in > approval if I am understanding what is below correctly.

It's only adjusted if delayed "as compared with a standard for such actions". I'll bet that the vast majority of patents get no such adjustment because the office actions were within standard, even if their issue takes 5 years.

</comment></comment></comment></comment><comment><USER10> What would it take to DDOS the patent office?</comment>