Write Virtual Modular Synth Modules in JavaScript or Lua with VCV Prototype - <AUTHOR> https://vcvrack.com/Prototype.html <comment><USER2> Hey very cool! I would love to find some time to get started with this</comment>


Are Hit Songs Becoming Less Musically Diverse? - <AUTHOR> https://pudding.cool/2018/05/similarity/ <comment><USER2> should a pop band be finish their concert by re-harmonizing an entire album by mahavishnu orchestra or Miles Davis?

IOW, why would music that is intentionally written to peak in the top 10, require to be musically diverse or innovative? Marketing the artist, or creating PR 'buzz' in the press seems to be more important than how many scales or time signatures an artist can play.

<comment><USER3> >why would music that is intentionally written to peak in the top 10, require to be musically diverse or innovative?

Of course it doesn't require it, but it's a nice feature.

One feature of good music is that it can surprise the listener (key changes, chord changes, sudden shifts in rhythm or even style).

<comment><USER2> agreed it's a nice feature, but if a song is too complicated it may negatively impact sales. it's like asking "Are fast food chains becoming less diverse?"

musical skill has been devalued in the top 40 for decades.

<comment><USER3> I think music listeners aren't dumb, they can appreciate more complex compositions.

It's just when you turn on the radio, it all sounds the same.

The promotion machine makes it such that the music put in front of us all tends to sound the same, because the industry is just trying to rehash the same hit over and over to milk us for money.</comment></comment></comment></comment>


Docs make fewer diagnostic mistakes in teams, study finds - <AUTHOR> http://www.modernhealthcare.com/article/20150120/BLOG/301209995/-docs-make-fewer-diagnostic-mistakes-in-teams-study-finds?utm_campaign=KHN:+Daily+Health+Policy+Report&utm_source=hs_email&utm_medium=email&utm_content=15678432&_hsenc=p2ANqtz-9ptnFL-1h1SGcLWRhtSDgXhRlW-c09OQ1sBjNfTAj-G9xlRMWsi0OFaQhNbWdS_nzs1VDqhr9tCM-vNweS3lZgvCyjYg&_hsmi=15678432

<comment><USER2> It's like in software, code review helps eliminate many of the worst pitfalls in doing stupid things. That is why the Linux Kernel is so damn stable, because it has so many people looking through the code on every level.

I think doctors should be in teams, and in fact, to setup a practice, maybe it should be the required norm, in order to practice, you must have a business partner, who can compliment your skillset in your profession, especially when it comes to the well being of others and their correct health diagnosis.

</comment><comment><USER3> Dr. House certainly made a lot of mistakes and he worked on a team.</comment>


Ask HN: What are your biggest regrets? - <AUTHOR> <comment><USER2> Listening to the well-intended advice of (unqualified) adults who told me there was little opportunity in pursuing the one subject I'd cared about all of the time I was growing up. Instead, find the people who are already doing it, wherever that takes you.

</comment><comment><USER3> Probably not networking or trying out different activities in university. Basically just took on the classes and got my degree, and that was that.

Unfortunately, I realised afterwards that who you know is a lot more important than what you know, as well as that university is one of the best times to both meet interesting new people and get involved in new hobbies. Not knowing anyone afterwards probably made it much more difficult to get my first job afterwards, as well as to find startup cofounders and what not.

Also regret shutting down my first major internet community/forum site, since it was pretty damn popular at the time (about 300,000 posts/a few thousand users), and when merged with my later ones, could have become the base for a much larger community.

Also regret not jumping on a few internet bandwagons/gold rush scenarios too. Seeing how successful some channels became on YouTube/Twitch/whatever kinda makes me wish I'd made the investment and gone all in on one of these platforms back when they were starting out. Writing doesn't exactly pay anymore, and those who made the transition to video earlier have sometimes built entire careers out of it.

</comment><comment><USER4> Not getting divorced sooner. Too much misery for too long.

Not raising capital when it would've been easy.

Not understanding my customer despite having a #1 market position.

Not spending enough time with my daughter when she was younger.

<comment><USER5> Hi, Can you share more details about #1 market position ?

<comment><USER4> Had the #1 selling product in the majority of the 450 doors I was in. Customers always raved about our flavors which was a direct result of having the strictest QC standards around our distillate manufacturing. We made sure to distill our oils so that there were no residual terpenes that could contribute to off flavors through oxidation. We were militant about it. Every other brand sourced oil from the open market. A side effect of having the most pure distillate oil is that it's also the most potent.

Listening to the customer feedback I never heard anyone compliment our potency. Later on the hardware for vape carts evolved and new carts came out that could provide higher doses. Our oil did not taste good in those carts so we didn't make the switch. Then when the feedback started rolling in that our cartridges weren't strong enough (they just didn't vaporize as much oil..) we finally made the switch. By then we had lost our market position. Turns out customers liked our flavor but the reason they were really purchasing was the potency.

When you're on top you think it's your brand or your QC that's carrying you...when really it was just a potency game all along.

</comment></comment></comment><comment><USER6> Pouring into a side project time and attention that I should have given to my kids.

<comment><USER7> If the side project could bring in money maybe it's too harsh to regret it. It could have meant spending less time in a job and more time with the kids.

</comment></comment><comment><USER8> I've only regretted what I've held back, never what I've done.

Be kind, but also be bold. Don't live in fear, we're all dead eventually.

<comment><USER9> What a lovely thought!

</comment></comment><comment><USER10> Spending too much time with computers.

</comment><comment><USER11> Not transitioning into a non-binary gender in my teens and instead in my mid- to-late-twenties where I am now.

I internalized a lot of rhetoric from other people that I simply had to accept myself or feel comfortable with a narrative of being "natural". Ultimately, after having a breakdown and taking effort to change my body/appearance did that prescribed self-acceptance finally happen. It just didn't happen on other people's terms.

The biggest takeaway I learned was not to lie to myself and not to accept other people's convictions too much. It was a lesson in individualism and boundaries.

</comment><comment><USER12> Not marrying my high school sweetheart and having kids right out of high school. Now I'm 38, never married and it's increasingly unlikely I ever will.

<comment><USER13> > Not marrying my high school sweetheart and having kids right out of high > school.

You really dodged a bullet with this one. Kids right after high school? Not in this day and age.

<comment><USER12> I wish people like you would stop spreading this fud.

</comment></comment></comment><comment><USER14> Getting a dog. It's been two years now and she's a lovable dog but the reward has not been worth the effort for me and I regret it.

<comment><USER15> You're probably overlooking something. These little creatures give us way more than we give them <3

Is there any relative that could keep her?

<comment><USER14> It's not that bad. Just like 5-10% less enjoyment of life? She loves me so it's not worth making her unhappy for that.

</comment></comment></comment><comment><USER16> Using personal time to work for my employer instead of investing it in myself.

</comment><comment><USER17> In hindsight, concentrating on finding a side hustle or a business of my own instead of just trying to be a better engineer. 90% of new ventures fail, but everyone thinks they will be the exception. I was basically broke with no savings and no job when I was 32. I'm 40 and bounced back a bit, but I feel so behind in my career and saving for retirement.

</comment><comment><USER9> \- Took some big decisions purely based on emotions, not my brain.

\- Wasted a hell lot of time doing nothing meaningful.

\- Held back myself, when I should not have.

</comment><comment><USER7> Didn't buy 1000btc @ $5 times. I'd have probably sold at $100 though!

<comment><USER18> You still have an opportunity buy at $8.5K and sell at $85K

<comment><USER7> I'll buy at 85k and sell at 850k instead, thx.

</comment></comment></comment><comment><USER19> At 0x39 I regret:

\- I never had a honeymoon.

\- I said a hurtful thing to someone a decade ago (she lost a son and I said something insensitive). The sort of thing you say when you don't have a good "filter" between your brain and your mouth.

\- That back then, nobody told me I didn't have a good "filter".

</comment><comment><USER20> All of the actions I didn't take.

</comment><comment><USER21> Not getting vasectomy sooner!

</comment><comment><USER22> Not studying enough to get tuition or to short the duration of college. Now I have a substantial debt because it took me too long to finish.

</comment><comment><USER23> Not understanding time-value of money in my early 20's and paying-down low interest debt instead of investing.

<comment><USER24> I'm in my early 20s now :) Do you have any concrete tips/things you wished you did differently?

<comment><USER23> Run numbers. Do simulations. Have a plan.

I concentrated too much on minimizing long-term interest expense. I didn't think about how the money I was using to pay-down principal could have returned income over the long term. The real estate asset I was paying on hasn't appreciated at all in 20 years. I could have seen major investment returns on that money which would far exceed the interest expense I alleviated.

</comment></comment></comment><comment><USER25> Spending time trying to convince investors of what I already know and just building the damn thing without them.

</comment><comment><USER26> Wasting time on browsing Internet without purpose.

</comment><comment><USER27> wasting years at an outsourcing firm

</comment><comment><USER28> Being born.

<comment><USER29> It gets better, I promise. Hope you can find that help and healing.

</comment></comment><comment> non-entity Not going to school, not doing anything for most of my late teenage years, going into software engineering.

<comment><USER30> What do you regret about software engineering?</comment></comment>


Resort Attracts Men With Virtual Girlfriends - <AUTHOR> http://news.discovery.com/tech/love-plus-dating-game.html#mkcpgn=hknws1 <comment><USER2> Same story submitted earlier, with comments ...

<http://news.ycombinator.com/item?id=1653396>

<http://news.ycombinator.com/item?id=1654812></comment>


Airline tells DACA attendant they're safe to fly abroad. ICE Detains Her - <AUTHOR> https://thepointsguy.com/news/ice-detains-flight-attendant-daca/ <comment><USER2> Regardless of what you believe about immigration, it really seems like people should be concerned about America being completely willing to embrace cruelty.

* She is someone who was trying to follow a legal path to citizenship.

* She was trying to work a job.

* She tried to follow the law and got legal advice, albeit from a terrible source (her employer.)

I don't mean any of this to sway how anyone feels about whether she should be ultimately allowed in the country, but it definitely feels like an argument in favor of some benefit of the doubt for her.

I moved to Europe because I was distressed about the direction America was going. I would really love for America to be a place that cares and loves people in their communities. I miss it. I miss being near my family. But when I read articles like this I really wonder how I could be a part of this world.

Edit: I vouched for this post. It seems things that are political of any sort frequently get flagged on HN, but this is an important story to tell. One woman trapped at immigration is a tragedy, one hundred thousand is a statistic.

<comment><USER3> If you don't like the laws, change them. It's really pretty straightforward. We live in a democratic republic where these processes are well defined and understood broadly.

When the people our society has charged to enforce our laws enforce the law, that's a good outcome; if they didn't, that'd be literally unjust.

I don't know this woman, but it seems pretty stupid of her to leave the country which she is illegally inhabiting and then be surprised when she's not allowed to re-enter. Play stupid games, win stupid prizes.

<comment><USER4> Law is not so simple. There are many layers, from The law itself, to judicial rulings and precedent, followed by enforcement and decisions on how to deal with conflicting situations between all of the above.

<comment><USER3> I agree, and I consider that to be harmful and bad. It should not be up to law enforcement whether or not they will enforce the law. Anytime they do not, they are unjust and harmful. If there are bad laws, let's get them removed.

</comment></comment></comment></comment><comment><USER5> I can't begin to imagine the pain both she and her husband are feeling right now. That we have institutions that so callously detain clearly innocent and productive members of our community is truly appalling.

Pieces like this make me so ashamed of my country.

</comment><comment><USER6> A lifetime of worry to varying degree, a seeming resolution, an absolutely unnecessary assault on a group of people who seem to embody exactly what the American spirit is all about.

<comment><USER7> :(

</comment></comment><comment><USER8> Xenophobia at the state level. I read some official policies yesterday, they are just malevolent.</comment>


Maserati Problem - <AUTHOR> http://www.urbandictionary.com/define.php?term=Maserati%20Problem <comment><AUTHOR> Come up with mock Ask HN "Maserati Problem" posts:

\- Ask HN: How do I deal with picking the right chef for my startup?

\- Ask HN: What is the best private airfield in the SF/Bay Area for the company jet?

\- Ask HN: Can anyone from Google recommend Baer's for employee transportation?

\- Ask HN: PS3 or XBox 360 in the break room?

\- Ask HN: How do I let my wife know I've slept with my EA?

<comment><USER2> \- Ask HN: Got Ramen Profitable. Then TGI Fridays Profitable. Then Prime House Profitable. Now French Laundry Profitable. What next?

<comment><AUTHOR> Hookers and blow profitable of course.

<comment><USER3> There are some things, that if you're not doing from day one, you're unlikely to ever do.

</comment></comment></comment></comment><comment><USER4> Hilarious. We use it amongst ourselves, but I didn't realize Brian had actually submitted it to the Urban Dictionary.

I tend to use it as a blanket answer to questions about extreme scaling. It's a way to tell someone that they're focusing on a problem that is really not an issue at such an early stage of a startup.

Q: "Can Rails scale to 100 million unique visitors a month?" A: "That's a Maserati Problem. No matter what the answer, you'll be happy as hell to have that problem."

Note: This is the guy who submitted it: <http://news.ycombinator.com/user?id=brianculler>

Used in context: <http://news.ycombinator.com/item?id=1275771>

</comment><comment><USER5> Flip side: Y2K was a Maserati problem in 1990.

<comment><USER6> Not exactly. By 1990 Y2K was an inevitability. However, the Maserati may never come.

<comment><USER7> Agreed but by the same token your company/software from 1990 would probably not be around in 2000.

I get the impression "Maserati problems" (not quibbling about the definition, but from a "should I care about this" stance) are those for which the cost of focusing on them now is greater in impact terms than leaving it until later.

Y2K was probably a Maserati problem at the time because if your software was going to be around for 10 years, the profits from it should easily cover the maintenance task of resolving the bug.

</comment></comment></comment><comment><USER8> Or, as Martin Mull might put it: <http://www.youtube.com/watch?v=aVfYos-- B_c#t=02m17s>

</comment><comment><USER9> i'll take a Maserati problem anyday</comment>


Show HN: SparkDC - Command-line file sharing over ssh. Python - <AUTHOR> https://github.com/sravfeyn/SparkDC I have developed these peer-to-server-to-peer sharing software for our campus IIT Delhi, as our administration has blocked normal LAN sharing protocols used by DC++ and oDC.

Code on github https://github.com/sravfeyn/SparkDC

Further details about the software at my blog http://divinequantum.blogspot.com/2011/12/spark-automated-file-sharing-over-ssh.html <comment><AUTHOR> I have done this for IIT Delhi network, as the normal peer-to-peer transfer protocols used by software like DC++ and oDC were blocked.

The code is at github <https://github.com/sravfeyn/SparkDC>

The story is at my blog [http://divinequantum.blogspot.com/2011/12/spark- automated-fi...](http://divinequantum.blogspot.com/2011/12/spark-automated- file-sharing-over-ssh.html)</comment>


Choosing a Rust web framework - <AUTHOR> https://www.lpalmieri.com/posts/2020-07-04-choosing-a-rust-web-framework-2020-edition/ <comment><USER2> What's the security posture of actix-web these days? The impression I got from the temporary deletion of the repo and maintainer switch about six months ago[1] was that actix-web was sort of a research platform rather than a production-ready server. It prioritized performance and ease of development in order to try (successful!) ideas the author had for writing really fast servers, and therefore made uses of unsafe code that many Rust developers thought unsuitable for production.

I don't mean to start drama -- I just feel like if the project is still prioritizing speed and experimentation over safety, that's worth including in comparisons like this, and if it's not anymore (or if I misunderstood the story in the first place), that would be good to know too.

[1] [https://steveklabnik.com/writing/a-sad-day-for- rust](https://steveklabnik.com/writing/a-sad-day-for-rust)

<comment><USER3> I think you misunderstood the story in the first place; it was always intended to be production ready. The new team has, in my understanding, fixed the unsafe issues, and development continues.

<comment><USER4> It's a bit more subtle than that, in that it depends on what you consider production-ready. It was originally intended to reach a level of robustness and soundness that the author considered production-ready, but which I personally didn't.

<comment><USER3> Yeah. You could also argue that it was production ready because it was (and is) being used, in production, by a lot of folks.

</comment></comment></comment></comment><comment><USER5> It's worth noting that actix-web has _much_ higher performance benchmarks than other other frameworks mentioned, including the other async/await ones: [https://www.techempower.com/benchmarks/](https://www.techempower.com/benchmarks/)

Looking at the benchmark code, it doesn't appear to be doing too many shenanigans to hit those benchmarks: [https://github.com/TechEmpower/FrameworkBenchmarks/tree/mast...](https://github.com/TechEmpower/FrameworkBenchmarks/tree/master/frameworks/Rust/actix)

</comment><comment><AUTHOR> Author here! This article started as a short section in Chapter 3 of Zero To Production ([https://www.lpalmieri.com/posts/2020-05-24-zero-to- productio...](https://www.lpalmieri.com/posts/2020-05-24-zero-to- production-0-foreword/)) to give some background on the decision making process I went through when picking the web framework we will be using to develop our email newsletter project throughout the book.

It eventually grew to be so long that it made little sense as part of Chapter 3 itself - I thus decided to publish it as its own article and link it in the introduction to Chapter 3 (hopefully to be released next week!).

</comment><comment><USER6> This is a reasonable overview with a few caveats -

Warp seems to have one of the better api experiences but has significant performance issues.

In the async world I think

[https://github.com/stjepang/smol](https://github.com/stjepang/smol)

is going to have a pretty big positive impact on the useability of the whole system so I wouldn't rush to go all in on either async-std or tokio just yet. Last I read it was still having some fairness issues that were next to fix though.

There is also

[https://github.com/withoutboats/ringbahn](https://github.com/withoutboats/ringbahn)

Which is very disruptive in that io-uring doesn't have a natural async interface?

<comment><USER7> IIRC, io-uring makes it very complex to expose a safe zero-overhead async interface, because the kernel expects any buffers that you pass it to live until the operation completes (ie, you can't allocate your own buffer, give it to the kernel, then decide you are uninterested and throw away your buffer). In Rust, this would mean that any buffer basically needs to be 'static.

It should be possible to create a an API that uses an intermediate, managed pool of buffers to pass to the kernel, but this would imply extra copies.

<comment><USER8> AIUI, withoutboats has described this issue in depth in [https://without.boats/blog/io-uring/](https://without.boats/blog/io-uring/) and follow-on blog posts, which also go into the design of ringbahn itself.

</comment></comment></comment><comment><USER9> > As of July 2020, I'd suggest picking actix-web if you are writing a > production API in Rust.

What about server rendered websites that aren't API? Which framework would you recommend in this case?

<comment><USER10> I'm enjoying using Rocket so far. I really like the FromRequest way of describing middleware and request guards. The docs are also very good.

I'm on the 0.4 branch, which isn't the 0.5 async branch, so I'm blocking on db calls and such, but I'm targeting very low qps so I don't care.

I got the diesel database integration working with little fuss, and can guard requests

        #[get("/me")]
        fn get(user: &User) {
            // Logged in view
        }

        #[get("/me")]
        fn get() {
            // Logged out view
        }

</comment></comment><comment><USER11> > It took some time for the whole Rust ecosystem to catch up and adopt it, but > it's fair to say that crates dealing with IO-bound workloads are now > generally expected to be async-first (e.g. reqwest).

Is this actually true? I've heard mixed things about this, including that Rust itself has no particular position on the preferred concurrency model. Even the async book[1] says:

> It's important to remember that traditional threaded applications can be > quite effective, and that Rust's small memory footprint and predictability > mean that you can get far without ever using async. The increased complexity > of the asynchronous programming model isn't always worth it, and it's > important to consider whether your application would be better served by > using a simpler threaded model.

[1] [https://rust-lang.github.io/async- book/01_getting_started/02...](https://rust-lang.github.io/async- book/01_getting_started/02_why_async.html)

<comment><USER3> The language does not prefer anything, one way or the other.

The community is overall very excited about async right now, and so the community may expect things to be async-first, even if the language itself does not have a preference.

</comment></comment><comment><USER12> Alternatively, if you're looking to create a web application but only expose it through an HTTP API, you can simply choose an HTTP router like Routerify [1] to route HTTP requests to a stateful handler and any number of middlewares. I'm coming from Go and learning backend web dev in Rust, and this crate has been a wonderful replacement for the Go library "Chi" [2].

This comes in handy when your frontend is a SPA (e.g. Vue, React) and it's just updating state via API calls

[1] [https://github.com/routerify/routerify](https://github.com/routerify/routerify) [2] [https://github.com/go-chi/chi](https://github.com/go-chi/chi)

</comment><comment><USER13> What's a good PostgreSQL interface in Rust? Not looking for ORMs.

<comment> Spartan-S63 Diesel is going to be your most ORM-like option, which isn't what you're looking for. `tokio-postgres` is great for async connections.

SQLx is also a really good option, too, and has some ORM-like features (such as transforming SQL rows into a Rust struct via macros) while still allowing SQL to be a first-class citizen. SQLx is also async, so that would probably be the best one to look at first.

</comment></comment><comment><USER14> Rocket seems to be something in between a full-blown web framework (Django, Rails, Laravel) and a web server library, which is confusing.

<comment><USER15> Is it? It seems like exactly what you'd expect from version 0.4.5 of something that aims to be a full-blown web framework.

Rome wasn't built in a day.

<comment><USER14> Right, I didn't look at it from this perspective. That was just my impression of using it.

</comment></comment></comment><comment><USER16> This article seems like a good exploration of the ecosystem, and it came to the same conclusions as I did.

</comment><comment><USER17> what's the state of gRPC in rust?

last week, in research i discovered a few different implementations. no clear winner.

<comment><USER18> I've used tonic for a number of personal projects and quite liked it.</comment></comment>


Internet's Sad Legacy: No More Secrets - <AUTHOR> http://bits.blogs.nytimes.com/2013/12/15/disruptions-internets-sad-legacy-no-more-secrets/?_r=0

<comment><USER2> _Whisper's privacy page says the company owns the intellectual property, both images and text, that people post; Whisper reserves the right to sell that stuff to third parties._

This is absolutely not true. From the TOS:

 _For clarity, you retain all of your ownership rights in your WhisperText Content. However, by submitting User Content to WhisperText, you hereby grant WhisperText a worldwide, non-exclusive, royalty-free, sublicenseable and transferable license to use, reproduce, distribute, prepare derivative works of, display, and perform the User Content in connection with the Service and WhisperText's (and its successors' and affiliates') business, including without limitation for promoting and redistributing part or all of the Service (and derivative works thereof) in any media formats and through any media channels. You also hereby grant each user of the Service a non-exclusive license to access your User Content through the Service, and to use, reproduce, distribute, display and perform such User Content as permitted through the functionality of the Service and under these Terms. The above licenses granted by you in User Content you submit to the Service terminate within a commercially reasonable time after you remove or delete your User Content from the Service. You understand and agree, however, that WhisperText may retain, but not display, distribute, or perform, server copies of your User Content that have been removed or deleted. The above licenses granted by you in user comments you submit are perpetual and irrevocable._

I have no connection with WhisperText, I was just interested by the legalimplications of such a policy, but decided to double-check the accuracy of the blog summary first.</comment>


How to incentivize research scientists - <AUTHOR> http://www.slate.com/id/2240838/pagenum/all/ <comment><USER2> Having worked at a major research facility as a research scientist I can say that providing incentives to researchers is usually not the problem.

At least where I worked, we worked on limited government contracts that were intended to scratch a particular itch (or explore where that itch might be). "Innovation" only really ever happened when the client asked the right question, and we managed to find a novel answer. Sometimes the contracts were for just a few months, sometimes for decades depending.

There was almost no room for self-guided exploration or innovation in the sense that I think this article is talking about. Nobody ever got a contract for a few million $$$ and a couple of years to just "go forth and do what you do and innovate".

On the front side of actually doing the work, we spent inordinate time and effort hunting for grant money and contracts and trying to secure those as well. But again, once we got the work, the strings attached were usually so restrictive that most of the work ended up being more or less mechanical except for a couple particularly sticky problem areas (which of course is why our services were employed).

<comment><USER3> DARPA funding mostly?</comment></comment>


Ask HN: looking for feedback on my startup idea: making hiring easier  - <AUTHOR>

Whenever I have had to hire a team, I would first figure out a process, then go through the hiring, which involves heaps of emails, often a wiki or something etc.
Idea: a startup that aims to make hiring easier by providing tools to make that process easier. You can easily define your hiring process (ie.: phone screen first? People submit resumes and answer certain questions. Then in-person interviews? etc..), invite your team to participate, and then post jobs and start hiring. All data around hiring for this job would be in one place. Thoughts?
If this description sounds interesting, can I ask you more questions about what you'd want/how you'd use it?
ps: tagline could be "make hiring easier" but not "make hiring easy", hiring is never easy :) <comment><USER2> This sounds pretty interesting.

We're currently in the process of hiring our first employee in our startup, so we're pretty amateurs at this. Here's what we did:

1\. Find some sites to advertise the job. Wrote up a description of the position and made up two problems the interviewee must complete to apply (it's at <http://scalien.com/pdf/job.pdf> but don't bother unless you're in Hungary =]). I guess if you could automate this part, eg. submission to a bunch of job sites, that'd be a killer feature I'd easily pay $5 for. Also, you could provide templates for the job description, reminders what not to leave out, host the files, etc.

2\. Went to the local Universities and physically posted printed out ads. Your service could offer that somebody picks up the ads from our office and posts them for us so I don't have to waste my time doing it, I'd pay for that.

3\. The person submits their CV and solutions per email. There's always a phase where I send the same template messages as an equalizer, I guess that could be automated, although it may be overkill. What could be nice, but only for a company with a lot of hiring, is to channel these emails to/from your service so you have a nice dashboard and history going back, etc. Again, it'd be nice if your service could provide reminders here, eg. did you remember to tell the guy what address to come to (eg. not the HQ but the other office).

4\. Then the person comes in for the interview. Here we wrote up ~20 questions in a word processor and printed them out, we hold this in our hands and ask the interviewee the questions ("what's a JOIN?"). Your site could store these questions, so we could check them off "knows"/"doesn't know" style per interviewee, with an additional comment field. The service has to be really streamlined though, as at this point the guy is sitting across me and waiting for me to ask the next question. Your site could recommend a general flow / template for the interview, and I could maybe time myself on each segment, so as not to spend more time than 60 mins per interview. In our case I noticed that we spend 90 mins per interview, but things are pretty obvious at the 30-45 minute part, so helping me (and my co-founder) save time would easily translate to money.

5\. ??? We actually haven't hired anyone, we're still deciding =)

Hope it helps.

<comment><AUTHOR> Yes that helps, thanks a lot!

<comment><USER2> You could use a freemium model where registration and tracking the first two candidates is free, then you have to sign up.

You should also try to contact other HNers who were active in this space, there may be an industry related catch you don't know about. I did this regarding a freelancer site idea, and learned interesting facts. And use a service like pickfu.com to test as much of your idea against real people as possible before writing a single LOC =) I tried this with my project idea, and it was interesting.

</comment></comment></comment><comment><USER3> The recruiting industry is ripe for disruption. Most headhunters use nothing more than keyword-matching software to find candidates. How many recruiting emails do you get where a recruiter finds one obscure line in your email, and presumes you are an expert in the field?

I'm thinking some additional intelligence can be added to the process. Figure out how many OSS projects I have contributed to; figure out how many Github commits I have; figure out who I'm connected to on LinkedIn; what conferences have I spoken at?

Its this sort of metadata, not my cold set of resume skills, that will help employers find a proper match.

<comment><AUTHOR> "figure out how many Github commits I have" -> That (and the others) are awesome ideas, thanks. Exactly the kind of features that add value that I was looking for.

</comment></comment><comment><USER4> I just thought of this, and it's been over 24 hours since I last slept, so this might not be the best idea. But, I'm imagining a world in which it exists, and it's pretty exciting. What I think would be awesome is if you made a company that screens for only the highest level candidates: You do all of the technical screening to ensure candidates are of a certain value. You look at open source contribution, their blog, some source code (which coders could submit to you with an NDA or something), experience, LinkedIn, references, interviews, etc. And you assign them a score, or maybe just a yes/no.

If you could have a screening process that was on par with, say, Google's, and became notorious for such a thing, I think you'd be in a position of extraordinary value. You'd be offering _Google Quality Engineers who are actively seeking jobs_. I think that's huge! You'd attract business that are willing to pay for the best, and you'd attract talent that wants the best pay.

The main goal here is to establish yourself as having a rigorous and "industry best" screening process. You only attract and accept awesome developers. You do all of the work in the technical screening, and you front your reputation on that. You only deal directly with candidates, and on the other end, with people in the position to hire.

Of course, there is a chicken and egg problem here. So you'd need a lot of publicity out the gate, a decent pool of acceptable candidates, or a decent set of job availabilities.

I'm tired of being asked if I know what a join is, the pros/cons of indexing, the difference between by reference and by value, various OO questions (What's an abstract class do?), design patterns, what memcached does, etc. And I'm sure places are tired of candidates that _don't_ know these things. Solve both of our problems.

<comment><USER5> You'd essentially be a recruiter with all the positives and negatives of that. Most of the job is sales not filtering and building connections with companies.

It's a very drawn out process as well, for a successful hire you might not get paid until 5-8 months after submitting someone for a job, so it's pretty much impossible to bootstrap and it takes a long time to build a decent revenue stream.

Plus you can't scale efficiently, your primary costs is skilled labour, and the cost of that grows linearly with your customer base.

<comment><USER4> In terms of scaling, if you're having to screen so many employees that it becomes your bottleneck, then it'd be a business on the path to success. It doesn't need to scale non-linearly, because each candidate screened is worth, on average, some dollar amount.

I see it as an analogy: YC is to Angels & VCs as <this thing> is to Companies that are Hiring. If you get into YC, you are definitely a noteworthy team. Furthermore, YC is able to prune down 1,000+ applicants to under 40 in a short amount of time. They probably turn down 75% of all applicants in 20 minutes or less per applicant. If it's your job to discern, you're going to figure out how to do it efficiently. They also attract very good applicants.

Why can't there be something like this for brilliant people seeking jobs just like YC is for brilliant people seeking to start companies?

You're right, though, about building connections with companies. Though, in this case the "connection" has more to do with reputation of "offers only Google quality candidates, via a rigorous screening process" than "hey, they are hit or miss but have provided some good hires in the past".

<comment><USER5> Sure but it's a service business like consultancy rather than a startup business where you might be able to scale rapidly.

Plus it comes with other complexities, it's very easy for your staff to leave and start competing services taking many of your customers and your candidates with them. Most recruiting firms have tighter computer lockdowns than banks because of this, they often do crazy things like have their contact/CV management system served over citrix as images to prevent employees walking off with the data.

</comment></comment></comment></comment><comment><USER6> This would be a viable product. I've worked on a custom Web HR system for a Fortune 500 company, back before the dot com bubble came about and burst. Those ERP systems are way too complex, have lots of bloat, etc. for a small shop to need.

Building something with base features of job posting, collect resumes (no forms to fill out, let people upload PDF or DOC), track applicants (notes, schedule interviews, etc.)

Maybe build in features to allow applicants to link-in their internet profiles from Facebook, LinkedIn, etc. Find domain specific things to add - like for programmers it would be OSS/github linkage, lawyers might be some sort of link to case work?

Maybe allow some calendar integration with the existing team so it would auto- schedule phone or in-person interviews. For example you just tell it to setup interviews for Thursdays or Fridays and it figures it out, contacts the applicant, blocks your calendars, etc.

Allow applicants to then save their info, and then they can apply any other companies using the SaaS.

Focus on the Applicant experience and the hiring manager experience aiming to simplify everything.

I think the 37signals guys mentioned this problem space as something they might consider... as they grow their team I can imagine they would build themselves a tool to make their lives easier.

</comment><comment><USER5> There's a bunch of companies already in this space. Taleo is the dominant player and is used by most of the Fortune 100 companies, Kenexa is their main competitor. Although both are aimed at the enterprise.

There might be room for a competitor targeting SME rather than the enterprise though.

There have been a few startups in this space as well, catchthebest.com which was in this area seems to have deadpooled, so it might be worth making contact with the founder and seeing why it failed.

<comment><USER7> I'm not quite dead yet! Catch the Best is still kicking, though I've stopped writing blog posts.

<comment><USER5> My apologies - I thought you'd moved on to other things !

</comment></comment></comment><comment><USER8> This topic is well-aligned with much of the work we've been doing, so I thought I'd chime in.

My previous company built software to help Fortune 500 companies hire more effectively, but I quickly learned that there are very few or no effective solutions for smaller businesses/startups with job openings that they need to fill.

Hiring a new employee is hard to do well, especially for small businesses, where it's a make-or-break decision; so we created ClearFit as an online hiring tool for the small business market. We want to help reduce the risk that's inherent to business growth.

We've tried to build our solution to make hiring the best person easy: matching people and employers using experience and personality, which is the most valid predictor of job success (assuming the basic hard skills requirements are met).

Feedback from early users was very similar to what I've been reading in these posts: there's real desire for a solution that can (i) find candidates, (ii) identify the best ones, based on how well they fit the personality and experience requirements, (iii) to be able to tell when candidates are stretching the truth/lying, and (iv) revealing the most critical interview questions that are specific/personalized for each candidate. So that's what we built.

The solution wasn't built for hard-core tech skills evaluation, but it's really good at finding the cultural/job fit in potential employees. With that said, we still have a few companies using it to hire for technical roles.

I'm posting here because I'm interested in what feedback the group may have. Remember that we want to keep our tool simple and we're not cool with adding lots of features (a la 37signals' philosophy).

If you want to try it, you can be my guest and try it for free to see if it works for you: <http://clearfit.com/hiring-tool>

I'm interested in any suggestions/feedback that any of you may have.

</comment><comment><USER9> It's an interesting space: hiring's a big challenge for a lot of companies, there's clearly opportunities for improving it, and there's already a lot of money being spent here so people may well be willing to pay for software that improves the process.

A couple of questions:

\- what would this add to a dirt simple solution like internal blog pages with the process and job description, and then a blog thread for each applicant going through the interview process?

\- who's your target market? tech startups, retail, recruiting firms, ... ?

\- what are the limitations of existing recruiting software?

<comment><AUTHOR> Internal blog pages with descriptions and stuff is what I've used before, and what I think most people use, which makes me think there's a market here for a good tool, because, at least for myself, those solutions never really worked well. As an example, I once invited someone to apply to a job that I had rejected a few months earlier. As someone wrote here earlier: if people are using spreadsheets (or wiki pages) for problem X, it's a market.

This would add spit, fit and finish. Make it easier to use. Add in easily publishing a page with a job description where people can apply/upload resume. Add an email address where you forward applications that then get automatically organized. Etc. In other words: it would add ease of use and features specific for hiring. (Still trying to determine which features exactly, which is what this post is for, but I've felt the pain myself and I'm sure many people have, so I see the problem part of this fairly clearly. Trying to figure out what a good solution would be.)

Existing recruiting software is aimed at HR and "recruiting". This would be aimed at people like (presumably) you and me, who just need to hire a few people for their team, who want to create their own process. I'm not "recruiting". I'm building a team!

Target market: people like me, ie. I would first go for people in tech firms hiring tech/ux people, because that is what I know best. We all read the "how to hire x" posts, it's not easy. The tools would make it easy to quickly set up a process etc.

Existing recruiting software is aimed at HR, at large companies, in other words, it's "enterprise" crap.

<comment><USER9> that makes a lot of sense, thanks.

one area that seems ripe for improvement is after resumes flood in, taking an initial pass and marking which ones you want others to give feedback on, and then tracking email and IM exchanges with and about the applicants.

at Qworky we used tags in a shared gmail account along with cut-and-pasting the IM logs for this which worked okay but even when we just had a couple of jobs open we messed up several times.

</comment></comment></comment><comment><USER10> The biggest problem in hiring seems to be finding good people. That might be a more important problem to tackle if you want to improve hiring.

<comment><AUTHOR> Yes, but harder to tackle.

When I read the "how we hire" posts, it's always about the process and how it helps to find good people. If I can make setting up a good process easier, I am presumably also making it easier for you to find good people. That's the thought anyways.

I also think that, after a while, I'd have one side of a market (the people who hire) lined up, and then I conceivably create a hiring marketplace. But that's a different (and harder) problem to tackle.

<comment><USER10> That's true. One way is to improve the process. Another way would be to increase chance encounters between good companies and good candidates.

For example, you could make it easier for companies to organise meetups (e.g. Github's drinkups - see this thread for details <http://news.ycombinator.com/item?id=1804527>).

I'm sure a lot of employers would like to do stuff like that, but never end up making the time to do it.

</comment></comment></comment><comment><USER11> I suppose it'd be useful, however, most larger companies already have these sorts of systems in place. Perhaps target mid-sized businesses that use smaller hiring departments, perhaps encouraging them to move away from staffing agencies and doing their own hiring?

<comment><AUTHOR> Speaking for myself as target market (and assuming there are a lot of people like me): I avoid those "company approved enterprise" systems as much as possible, going as far as bending the rules to avoid them. Wouldn't touch them with a stick, and that goes for most enterprise systems. And then I use some wiki/whatever tool + email to organize my hiring.

I'm not aiming to be the PeopleSoft or the SAP of hiring, I'm aiming to be the Basecamp of hiring.

</comment></comment><comment><USER12> I built <http://www.thehiringsquad.net/> last weekend with some friends to solve this same problem.

There's some confirmation you're on to a common problem.

</comment><comment><AUTHOR> To add some questions: I'm basically trying to figure out what domain-specific features (domain = hiring a team) would be useful to add. What would you like to see in a hiring tool?

</comment><comment><USER13> Show HN: HireForge is an applicant tracking system made for startups. (<http://www.hireforge.com>)</comment>


Bot vs. Bot- Email Thread – The Colloquy of Terry Smith - <AUTHOR> https://spa.mnesty.com/conversations/agbfssar/ <comment><AUTHOR> Someone forwarded a spammer's email to Spamnesty, which replied to the email, pretending to be a person called Terry Smith and starting a conversation.

This is that conversation.

spa.mnesty.com asks people to send it the spam emails; & try to reply from a auto-script & waste spammer's time/resourses. This particular thread resulted in whopping 1794 messages; although spamnasty stopped after few conversations but it is clear from the beginning that the other side was also a bot :)</comment>


CSS Sprites2 - It's JavaScript Time - <AUTHOR> http://alistapart.com/articles/sprites2 <comment><USER2> If you're interested in using a sprite technique without Javascript here's a tutorial video:

<http://css-tricks.com/videos/css-tricks-video-7.php></comment>


Tell HN: What I learned from 12k visitors in 4hrs - <AUTHOR> http://natanyellin.com/2012/01/26/politician-market/

<comment><AUTHOR> Alright, don't hate me for this. I have mixed feelings about meta-submissions, so I'm hoping that submitting this to HN is justified. This was my 2nd time launching, and my first time launching successfully. Ask me anything you want to know.</comment>


In New Jersey Student Loan Program, Even Death May Not Bring a Reprieve - <AUTHOR> http://www.nytimes.com/2016/07/04/nyregion/in-new-jersey-student-loan-program-even-death-may-not-bring-a-reprieve.html?_r=0 <comment><USER3> "Ms. DeOliveira-Longinetti, who co-signed on the loans, was shocked and confused." Be careful when co-signing any loan.

<comment><USER4> The article calls this abusive loan-sharking at the behest of the state's evil Goldman Sachs overlords. But the woman co-signed her son's loan. What did she think that meant?

<comment><USER5> Yeah it's pretty straightforward to pair a loan like this with life insurance (which is not only cheap for someone of college age but also generally requires no medical exam).

<comment><USER6> Then it would also be pretty cheap for the lender to insure against borrower's death or to bear the low (amortised) cost.

There is no reason a guarantor couldn't be responsible only for wilful failure to pay but not for after death.

I'm not saying these things apply in the agreement under discussion or under the relevant laws but just that different structures are possible.

<comment><USER7> > Then it would also be pretty cheap for the lender to insure against > borrower's death

It would. It would be so cheap for them that they might as well just cut out the middleman and self insure.

AKA just forgive the debt and that's all. Which apparently everyone else does, except NJ.

</comment></comment></comment></comment></comment><comment><USER8> Student loans are an impending financial disaster. Over a trillion in loans outstanding not, most of which have provided no benefit and serve little more than as the modern equivalent to a high school diploma. The debt burden follows students through life and impedes home ownership, children, and other middle class consumptive activities, and as a result the demand driven economy muddles along.

What is the solution? Forgive all loans after paying 10% of salary for 10 years? I don't know, but something needs to change.

<comment><USER4> > What is the solution? Forgive all loans after paying 10% of salary for 10 > years? I don't know, but something needs to change.

No that would just inflate the education bubble even more. You need to figure out how to reduce the demand for all this useless higher education.

<comment><USER8> So, trade schools? Reintroducing shop class and welding into high schools? An optional 2 year program similar to national guard, but for domestic efforts?

I'm in favor of affordable higher education for those who want it, either way.

<comment><USER9> Any and all of those options sounds like a good idea

</comment></comment></comment></comment><comment><USER10> Anyone who sues an indigent cancer patient in order to recover some vanishingly small fraction of the state's budget is a predator, and should be treated as such.

<comment><USER9> AS a cancer survivor, I would agree. Particularly for childhood patients, who cannot legally be responsible for ridiculous costs.

</comment></comment><comment><USER11> Can we all agree that greed is evil?

</comment><comment><USER12> School is for suckers anymore. Who in their right mind would put themselves through what amounts to institutional training for a life of future labor, middle class if you're lucky, working for a corporation as an at-will employee?

You've paid thousands and given up four years of your youth, and for what? To go to work (if you're lucky for many) for a big corporation making a select few wealthier? Meanwhile your salary is barely enough to make only but marginal dents in the debt you now owe.

You struggle to find meaning in your life, as you battle politics, desperately try to stay relevant in an environment of anxiety and fear; your peers are just as worried as you.

There needs to be an awakening where we stop telling our kids the "one way" to happiness and the dream is through an expensive undergraduate education. Sure, if you want to go to school to learn something, go...but something tells me, that to the architects of this system, education is the least of the priorities.

<comment><USER13> man, K-12 is no more. K-16 is the bare minimum to function in the current civilization. Obviously this new reality should be reflected in school organization, i.e. whole K-16 should be covered by the public.

<comment><USER14> In which case the "bare minimum" signaling will just move up to the next level, and then graduate degrees will be required. At which point post- graduate will be required. You can't signal that you're above average if everybody comes up to the same "above average" at the same time.

This isn't even hypothetical, there are already industries where this is how it works. A 4-year-degree in teaching or social work just gets you in the door; you are very much expected to keep going and get masters degrees if you want any sort of raise. (It is not clear to me how this makes anyone a better teacher or social worker. It is credentialism in a pure form.) Combined with the general drop in signaling quality of a 4-year-degree as the curricula get easier, this is the inevitable outcome.

We don't need to pour even more money into funding people's walking on the treadmill, we need to attack the reason why the treadmill is necessary in the first place.

<comment><USER13> >In which case the "bare minimum" signaling will just move up to the next level, and then graduate degrees will be required. At which point post- graduate will be required.

definitely. In the future where all "simple" jobs are automated the basic necessary skill level would be an ability to do research, ie. the post- graduate level. Without it, one would be able only to enjoy the life provided by the automated systems and wouldn't be able to contribute to the society. It has already happened several times for previous levels of education - <USER2> reading/writing as a sign of being "educated" hundreds years ago to manufacturing jobs (K-12 level) which were middle-class jobs just a few decades ago.

>A 4-year-degree in teaching or social work just gets you in the door; you are very much expected to keep going and get masters degrees if you want any sort of raise.

these are government jobs, not subject to market forces, it is more like armed forces in that regard.

<comment><USER15> Nope, social work is not just government jobs. My wife is a social worker at a hospice (not government). She had to have her masters to get the job. The next thing she has to get is a clinical license. Fun fact, that's a paying internship. She pays a mentor for 2 years to watch her do her job. After the monitoring, my wife is eligible to take a test. If she passes that test, she gets the license. That licenses enables her to increase her odds of getting a social work job in a hospital or government job like the VA, which is not just hospitals.

When all of this is said and done, she had her undergrad (fortunately paid for by her mother's employer, the school), which cost about 100k. Then we paid for her 30k masters. Now we'll pay 2-4k depending on the license mentor. So 132k for a job that pays...wait for it... at best 60k a year! Compare this to my BS in CS which opened at 42k and now is somewhere around 120k. Yay idiotic higher ed inflation.

As an interesting side note, most of this stupidity is caused by the social workers themselves. Like Rodney Dangerfield, they felt like they got no respect from the doctors, legislators and nurses. So they actually pushed for laws around mandated education! They pushed for licenses. They pushed for licenses that could only be obtained with job experience! You couldn't get experience to get the license to get the job that would get you the experience! We actually fled Indiana because of it. Florida is more reasonable.</comment></comment></comment></comment></comment>


Kaspersky OS - <AUTHOR> https://eugene.kaspersky.com/2016/11/15/finally-our-own-os-oh-yes/ <comment><USER2> No word on if this is FLOSS or not in the article so I'm assuming it'll be something closed. Which essentially renders the entire exercise moot form my POV. I also don't like how they mentioned Linux. They make it sound as if

(a) Linux is very insecure...I'm no expert but I'd like to see them prove their system is more secure than a Linux distro dedicated to security.

(b) Linux is the only viable option. There's plenty of other operating systems, some even focus on security (starting with the list of existing microkernels).

<comment><USER3> Linux _is_ very insecure. Maybe you have not been following the news lately.

<comment> at-fates-hands But comparatively speaking is still _more_ secure than Windows or OS X?

<comment><USER4> Depends on who you ask, for example, taking the top 50 products with new vulnerabilities discovered in 2016[1], Windows 10 got less vulnerabilities than the Linux Kernel and OS X.

This could either mean that Windows 10 has become more secure than its most popular competitors, or that researchers hadn't invested enough resources to audit Windows 10 properly.

Taking into account the results from previous years and previous versions (like 8.1), my personal conclusion is that Windows has actually become more secure.

[1] [https://www.cvedetails.com/top-50-products.php?year=2016](https://www.cvedetails.com/top-50-products.php?year=2016)

<comment><USER5> Well, there's also how serious the vulnerabilities are. Linux kernel had 4 code execution vulns, Windows 10 had 44. Linux had 44 gain privilege vulns, Windows 10 had 79. Linux seemed to have mostly DoS vulns, which is admittedly not great, but I'd rather a server go down then get compromised and used to take over the rest of the network. Then there's the fun stuff, like mimikatz, that's been around since windows XP and still can pull passwords from windows 10...

<comment><USER4> It is expected that the smallest attack surface will have less critical vulnerabilities, comparing an entire distro gives you a different picture, since categories like code execution get similar results.

The stark contrast is in the privilege escalation vulnerabilities from the Windows side vs the other categories on the Linux side.

I would assume that many persons prefer a server to go down, corrupt its data and leak it, rather than get compromised. The fine print is that the leaked data may contain information to compromise the server[1].

[1] [https://en.wikipedia.org/wiki/Heartbleed](https://en.wikipedia.org/wiki/Heartbleed)

<comment><USER5> Yeah, but now you swung in the opposite direction. Look at Debian Linux's 2016 code exec vulns and you'll see it's got a like Firefox and Chrome and Drupal and Mercurial... not exactly OS components... whereas the windows 10 vulns are are windows OS components. I'd personally be curious if any of those "debian vulns" would be equally applicable to the same software installed on windows.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> It sounds very interesting, for sure, but the announcement is a little thin on details. The OS is apparently based around a microkernel. Which sounds good, but AFAIK, microkernels are comparatively popular in the embedded space (think QNX, L4) - so that choice is not in itself revolutionary.

They mention signatures, and it kind of sounds as if the OS will refuse to execute any non-signed code. Again, sounds like a good idea in principle, but remember how Stuxnet came with - IIRC - _two_ valid signatures created with stolen keys. It might be better than nothing, but to an attacker with sufficiently deep pockets, no quantum computers are needed.

Of course, those are just random thoughts popping into my head. I should wait for more details before passing judgment. A (verifiably?) secure OS for embedded and "IoT" devices would be very desirable, that much is certain.

<comment><USER7> L4 is popular in embedded space? Can you provide some examples?

<comment><USER8> [https://en.wikipedia.org/wiki/L4_microkernel_family#Commerci...](https://en.wikipedia.org/wiki/L4_microkernel_family#Commercial_deployment)

> OKL4 shipments exceeded 1.5 billion in early 2012, mostly on Qualcomm > wireless modem chips. Other deployments include automotive infotainment > systems.

> Apple mobile application processors beginning with the A7 contain a Secure > Enclave coprocessor running an L4 operating system. This implies that L4 is > now shipping on all iOS devices, the total shipment of which is estimated at > 310 million for the year 2015.

<comment><USER7> So we have 2-3 very niche deployments. Does it really make L4 popular in embedded systems?

Also, OKL4, specially the version claimed to run on qualcomm is very different from the original L4 (I say claimed since multiple attempts to reverse engineer qualcomm baseband firmware showed no traces of OKL4)

 _edit: if you think this is incorrect please provide a valid counterpoint. downvoting a post this way to hide its presence is not a valid response._

<comment><USER9> It runs on billions of baseband processors. It's popular by any sane definition of the word.

<comment><USER10> Following that logic, iOS is also popular in the embedded space.

<comment><USER11> That's not the embedded space; an iPhone is a full (small) computer.

iOS _is_ quite popular, but embedded ≠ "runs on ARM".

<comment><USER8> Things like a cash register or a media player are also considered "embedded systems", even if they use x86 CPUs. Embedded ≠ incomplete computer.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Just a few days ago I became aware of CertiKOS, which is apparently a formally verified kernel [0] [1]. I think these two aspects--formal verifiability and being open source--are key for a truly secure OS of the future.

[0] [http://news.yale.edu/2016/11/14/certikos-breakthrough- toward...](http://news.yale.edu/2016/11/14/certikos-breakthrough-toward- hacker-resistant-operating-systems)

[1] [https://www.usenix.org/conference/osdi16/technical- sessions/...](https://www.usenix.org/conference/osdi16/technical- sessions/presentation/gu)

</comment><comment><USER13> My suspicion is that most attempts to create a better OS for IoT will fail for political reasons. AFIAKT, one really important characteristic of Linux (and JavaScript also) for large tech companies is that they can control their own stacks, without having to license tech from another corporation, but still have the benefit of network effects. Samsung have Tizen, Google have ChromeOS etc. etc.

At the component level, Linux also empowers the chip vendors to build what they want on their own timescales and then address a large market. Even open Linux drivers are sometimes loaders for proprietary firmware, so they aren't really giving up the ability to ship code in a black box.

I don't see any of them willingly cooperating with a company that wants to manage and deliver the whole OS from the the kernel up. TLDR: The industry probably does not want a Microsoft for IoT.

<comment><USER14> Linux doesn't scale down very well though. I really don't need the full Linux API for a lightbulb. Most embedded OSs are microkernels for this reason. If any mega-trend has a chance of unseating Linux and generally disrupting the OS space it's IoT.

<comment><USER15> A lightbulb will have an RTOS, not a microkernel. While microkernels provide utmost isolation between processes and well-defined primitives for communications, a lightbulb might not even have separate supervisor and user modes.

<comment><USER16> A lightbulb won't even have a RTOS. It will be a state machine or series of them in C language on cheapest MCU imaginable. Probably 8- or 16-bit. That keeps the cost at nickles or dimes.

</comment></comment></comment></comment><comment><USER17> > All the popular operating systems aren't designed with security in mind

Kaspy OS runs on a switch, and they're talking about popular operating systems, so in the same vein, OpenBSD wouldn't be a popular secure OS for e.g. routers?

But hey, I'd be really happy if they based it on seL4 and formally verified their security concepts. That would be a real game-changer. OTOH I'm really sceptical until they provide any relevant details.

<comment><USER6> Also, in a microkernel-based system, verifying the kernel itself is but a start.

To make a verifiably secure system for network infrastructure and IoT-devices, you need, at the very least, a provably correct IP stack. Want a nice web interface? Now you need to verify the HTTP server, too. Want to talk to other devices? You probably want a DNS resolver. And so forth...

Simply signing code and having the OS refuse to execute code without valid signatures is not going to be sufficient to convince a lot of people that it's a significant improvement security-wise.

(If, on the other hand, they make it open source _and_ provide proofs of correctness for all these components, that would indeed be a significant step forward.)

<comment><USER18> But isn't an isolation kernel enables you to limit spread of malware between modules and to detect when a module was compromised and reset it ? Isn't that a big improvement ?

<comment><USER6> It certainly is an improvement.

But my point was that it still leaves a whole lot of attack surface. If you want a provably secure system, you basically need to verify much more than "just" the kernel.

On the upside, if one did so, it would have benefits beyond security.

</comment></comment></comment></comment><comment><USER19> Only use it if you want to send all of your information to FSB (modern KGB). Evgeniy Kasperskiy has friends in government, police and FSB. He also is apologet of state surveillance.

<comment><USER20> I prefer the FSB to have access to my files than NSA. What FSB can do to me? Send to Guantanamo?

<comment><USER21> May I present you with exhibit a) [https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine...](https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvinenko)

<comment><USER20> How does it relate to my porn collection?

<comment><USER22> Blackmail?

</comment></comment></comment></comment></comment><comment><USER23> Will this be open source, or will we have to trust Kapersky that it is secure?

<comment><USER24> I guess you'll have to trust him and his friends from the FSB (former KGB) :)

<comment><USER25> Do you make the same remarks when Google, Microsoft, Apple or Palantir releases software?

<comment> yoz-y I have the impression that ever since Snowden happened, yes. Any mention of a non open source OS gets accompanied by remarks about NSA, FBI and co.

<comment><USER26> Open source projects are not shielded from this either. Plenty of paranoia, justified or not, going around these days.

[https://igurublog.wordpress.com/2014/04/08/julian-assange- de...](https://igurublog.wordpress.com/2014/04/08/julian-assange-debian-is- owned-by-the-nsa/)

[http://www.theverge.com/2013/12/20/5231006/nsa- paid-10-milli...](http://www.theverge.com/2013/12/20/5231006/nsa- paid-10-million-for-a-back-door-into-rsa-encryption-according-to)

[https://www.quora.com/Is-there-any-backdoor-left-in-Unix- or-...](https://www.quora.com/Is-there-any-backdoor-left-in-Unix-or-Linux- intentionally)

[https://blog.cloudflare.com/how-the-nsa-may-have-put-a- backd...](https://blog.cloudflare.com/how-the-nsa-may-have-put-a-backdoor-in- rsas-cryptography-a-technical-primer/)

On one hand, we've been privy to some of NSA's operations, on the other, there is still a lot left to be disclosed, most will of course, never be out in the open.

<comment> this-dang-guy Let's not forget the great OpenBSD code audit caused when someone from the FBI claimed to have planted a backdoor. [http://arstechnica.com/information- technology/2010/12/openbs...](http://arstechnica.com/information- technology/2010/12/openbsd-code-audit-uncovers-bugs-but-no-evidence-of- backdoor/)

</comment></comment></comment></comment></comment></comment><comment><USER27> This is _interesting_ , yes, but secure is not secure because we had a nice architectural idea. It's a long term process of review and improvement.

If they release this as open source I would be interested in looking and learning more and in a year or two, if the community develops maybe it's something worth deploying to production

But a completely new OS? Not on day one I think

</comment><comment><USER28> There are no real details about the OS in the article. Did anybody here work on the project?

<comment><USER29> From what I heard from people that work there, this company mistreats employees and has huge problems with management. I could provide a proof link, but it's in Russian.

<comment><USER30> It is preferable to even outright include the link in the original post when making that sort of statements.

Without specific details, it sounds pretty much like any random Glassdoor report from un unhappy employee.

<comment><USER29> And one more [http://pravda-sotrudnikov.ru/company/laboratoriya- kasperskog...](http://pravda-sotrudnikov.ru/company/laboratoriya-kasperskogo)

</comment></comment></comment></comment><comment><USER31> One of their developers said they're using C code generators in Haskell in this OS:

[https://youtu.be/f6TmB6Zw8MQ?t=1860](https://youtu.be/f6TmB6Zw8MQ?t=1860)

</comment><comment><USER32> > Meanwhile, all around this alchemy folks were fairly astonished: just what > were we thinking? We'd decided to make an unhackable platform and ruin our > other security business model?!

If a business wants to survive in the long term, it should always answer this question with: Would it be better if we would build it or others would do it? Because someone will eventually do it.

</comment><comment><USER33> Haha! I am curious how long will it take to have it completely cracked.

<comment><USER34> On the basis that the grander the announcement, the greater the motivation to break it, I reckon about 20 minutes.

<comment><USER33> Correct! Kaspersky has just placed a MASSIVE TARGET on his back.

Understandably, investors do want catchy stories and media buzz... :)

</comment></comment></comment><comment><USER35> I want to highlight how their "sign up to our newsletter" pop-up only popped up when I scrolled to the bottom of the article, and how it had a prominent "No thanks" button. So much better UI than all those pop-on-load-before-I've- read-anything ones out there.

</comment><comment><USER36> Somebody finally did this. Good for them. Unbreakable boxes for DNS, BGP, and routers will be a good start. Those boxes don't need to do anything else, and contain no user data.

Looking forward to hearing more about their OS.

<comment><USER37> Unbreakable?

From a company based in Russia?

Really?

<comment><USER25> Does Russia make backdoored hardware and software? Do you have proof of that?

But we do have proof USA does that. See Snowden leaks.

<comment><USER38> Recent Russian legislation mandates backdoors:

[http://arstechnica.com/tech-policy/2016/06/russias-new- spy-l...](http://arstechnica.com/tech-policy/2016/06/russias-new-spy-law- calls-for-metadata-and-content-to-be-stored-plus-crypto-backdoors/)

</comment></comment></comment></comment><comment><USER39> Quite literally the opposite of any reasonable definition of security. "Security" isn't magic fairy dust, or a tagline, it is a social property that arises only _after_ many years of use and adaptation > "everything has been built from scratch... it's simpler and safer to start from the ground up and do everything correctly. Which is just what we did."

</comment><comment><USER40> "In order to hack this platform a cyber-baddie would need to break the digital signature, which – any time before the introduction of quantum computers – would be exorbitantly expensive." I loled

<comment> this-dang-guy Very "Secrets from the future" of him :D

</comment></comment><comment><USER41> A lot of OpenBSD mentions here, but what about MINIX 3? It's so underrated and ignored :( They made a nice microkernel-based UNIX-like system with a NetBSD userspace.

Also, Redox is switching to a microkernel architecture...

<comment><USER16> re MINIX 3. It's not made for high-security. It's about high-reliability. Safety is usually a precursor to security but security can take a lot more. The core has to be designed for it like Genode is doing.

re Redox. It's a nice project I've praised before. It's an alpha work-in- progress, changing rapidly, and unclear how much of its design is truly for security. A trimmed OpenBSD is probably a safer bet than it so far given the staggering amount of review that went into it. Rust's features and a microkernel only prevent so many kinds of problems.

<comment><USER42> For the uninformed, what problems would Rust's features and microkernel not protect against?

<comment><USER16> I can't even remember for Rust. I just know Rust team here admitted there was a cut-off point in terms of safety features it provides like any other language. For microkernels, all they do is memory isolation plus limit kernel- mode damage. Past that, you have to design extra capabilities into the microkernel, trusted code, or apps. You can even have concurrency errors in your apps with those if there's a shared-memory space allowed.

</comment></comment></comment></comment><comment><USER43> some interesting finding:

\- [https://twitter.com/gN3mes1s/status/798992790436933632](https://twitter.com/gN3mes1s/status/798992790436933632)

\- RU slides [http://osday.ru/presentations/duhvalov/9jun.rifinnopolis16-1...](http://osday.ru/presentations/duhvalov/9jun.rifinnopolis16-17-30-19-00 --dyhvalov.pdf)

\- RU presentation [https://www.youtube.com/watch?v=_iEaY_CGcy8](https://www.youtube.com/watch?v=_iEaY_CGcy8)

</comment><comment><USER44> How is this more secure than any other L3 switch with an out of band (or otherwise hardened) management interface?

I'm not going to say no one is attacking switches, but that's definitely not where I'd start.

</comment><comment><USER45> > Third, everything has been built from scratch. Anticipating your questions: > not even the slightest smell of Linux.

Built from scratch and secure, no Linux input. It's the Holy grail, move over Theo.

</comment><comment><USER46> Closed source OS from an anti virus company with a dodgy history? I will pass.

<comment><USER47> Could you expand on the "dodgy history"? I always thought that Kaspersky was one of the "good guys"

<comment><USER48> Kaspersky had a history of working with Russian security agencies, has a lot of buddies there and a lot of people have throughout their careers moved from Kaspersky to these agencies and vice versa. If Russia will need somerhing from Kaspersky, government won't even need a warrant - he'll be happy to help.

<comment><USER49> Are there any news articles to substantiate the claim that Kaspersky readily gives information to the Russian government?

<comment><USER48> Don't have links at hand because for me personally it's firsthand knowlesge from friends and classmates working there. It's not a big secret though.

</comment></comment></comment></comment></comment><comment><USER8> No mention of verification like seL4 or CertiKOS?

<comment><USER30> I understand CertiKOS used Coq so the verification was at least half- automated? How L4 was certified -- what were the tools available at the time? Verification still remains huge work but sounds less heroic nowadays.

Now that we have tools and methodologies for verification, the announce of yet another secure OS suddenly sounds much less impressive.

<comment><USER50> Here is seL4 proof: [https://github.com/seL4/l4v](https://github.com/seL4/l4v)

To quote, "Most proofs in this repository are conducted in the interactive proof assistant Isabelle/HOL".

</comment></comment></comment><comment><USER51> Security through obscurity. I thought we all have learned that it doesn't work. Well, good riddance, KasperskyOS!

"And then there are some details that will remain for certain customers' eyes only forever, to ward off cyber-terrorist abuses."

[https://eugene.kaspersky.com/2012/10/16/kl-developing-its- ow...](https://eugene.kaspersky.com/2012/10/16/kl-developing-its-own- operating-system-we-confirm-the-rumors-and-end-the-speculation/)

<comment><USER52> I agree. What I find interesting is that real world security is also a function of popularity. You won't get many outside hackers to attack a platform, if it's hardly used.

So any new platform would first need broad adoption, then a few years of maturity in able for the outside world to assess if it's more secure than current systems.

Obviously, security centric design helps a lot, but on the other hand Kaspersky is a relatively small player in comparison with the other OS- movements (whether capitalist or FOSS).

<comment><USER53> Popularity is not exactly what attracts most hackers nowadays; it's profit.

Yes, in the common case, the more popular the system, the more profit can be made by hacking it. But if a system is running on a few, but very strategic places, it will be an interesting target and thus attract a lot of effort.

</comment></comment></comment><comment><USER54> What about Firebrick? the company that manufactures it says that it an in- house TCP/IP stack (I don't know if they run their own OS). [http://www.firebrick.co.uk/](http://www.firebrick.co.uk/)

</comment><comment><USER55> My thoughts went as follows - Interesting..., Hmmm Not much real information..., hope its open source..., is this for network appliances or for general use..., again if isn't open source I really don't care.

</comment><comment><USER56> > not even the slightest smell of Linux

Interesting to see if this catches on in the embedded / IoT space, I guess it's a bit of a leap writing drivers / software for a different OS

</comment><comment><USER57> Since this is an OS designed with security in mind, and since they even mentioned Linux (albeit not too nicely), I missed a comparison with or mention of OpenBSD.

</comment><comment><USER30> "not even the slightest smell of Linux."

So me too I have a dream. In my dream, every shop that needs two threads running and one semaphore synchronizing, will cease porting Linux and instead will roll up the sleeves, writes their own kernel 100% matching their need, prove its validity via formal verification and then use it.

In the world where this is possible, why would one go for a non-generic OS from a third party? Does look to me like Kaspersky might have that same vision for the future and tries to leverage their assets while it is not too late.

But security-by-brand-name is not really better than security-by-verification, isn't it?

<comment><USER58> > writes their own kernel 100% matching their need, prove its validity via > formal verification

It's hard enough for _one_ organisation to do this, given the fairly specialised set of skills it requires. Let alone every IoT vendor. There's no reason to massively replicate this kind of work. People would be better off building an ecosystem around sel4.

<comment><USER30> Agree, I'd like exactly to look closer inside "hard enough".

First, it depends on each specification -- what if the hardware is much-much smaller (IoT) and task to perform is well defined? It is hard today primarily because the required skill set becomes less and less current, but it is all demand-driven, it was not so some time ago.

Secondly, it could be replicated to some extent only -- for example, verified libraries for each device could come from each HW IP provider, instead of coming from the SoC vendor who integrated them. Say, Synopsis would provide a verified lib for the GbE controller -- to use with all SoCs that integrate it, etc. And the final integrator would take care of verifying the final integration, including his very small, fast, low-power-consuming and maintainable and 100%-dedicated kernel.

But my main argument is that the alternative is not so good-looking either. Porting and validation of the Linux kernel is performed mostly by engineers who have not the required skillset (managerial decision to spare on hires since "we have Linux") -- this is also something that I wish wasn't replicated among product makers but is, unfortunately.

<comment><USER58> > what if the hardware is much-much smaller (IoT) and task to perform is well > defined?

Anything IoT needs a full network stack at least, and usually a set of radio drivers for WiFi, 6lowpan, Zigbee, Bluetooth or whatever. That usually amounts to quite a lot of software, which in the case of the radio stuff is often proprietary and patent-encumbered.

Asking the hardware vendors is a dead end. You might as well ask for a pony while you're at it, you're not going to get it either.

"Verified libraries" would necessarily be written against a particular OS interface and its guarantees. I'm not even sure how this process would work in terms of formal verification; even sel4 is forced to make assumptions about hardware.

The reason why you get bad Linux ports with no source and universal default passwords is simply cost. Customers do not incorporate security into their purchasing decisions - or they wouldn't buy these things - so this is what we get.

<comment><USER30> In other words, you believe that Kaspersky OS has its place and future market?

> Anything IoT needs a full network stack at least ...

My point really is, every IoT device would need only its part of the full network stack, not all the protocols currently implemented in, say, Linux, and chances are, some device will require extremely reduced subset of the network stack, especially at the lower layers and with respect to kernel interaction.

I am not a verification expert, but verifying a very reduced subset of a well- defined specs seems at least feasible -- how would we verify something open- ended? Those pesky little theorems would become much more general and would come in even greater numbers?

Verifying a generic OS, good for all devices and all application, if at all doable from theoretical standpoint, looks too much of work for no particular profit for the verifier (very similar to the validation of the Linux kernel which is relayed on to the distro builders).

I wouldn't be as pessimistic either about the hardware vendors. After all, (some of them) already use formal verification in (some of) the silicon design, and verifying closer to the silicon seems simpler -- the closer to the metal the less genericity (assuming the verified silicon underneath).

</comment></comment></comment></comment></comment><comment><USER59> Given that there's not only software bugs, but the hardware ones, I wonder how secure it would be. I personally hate their software, but still, it would be nice to know.

P.S. Security without open-sourcing is impossible. Although, dunno how for other countries, but here in Russia some people have a different point of view.

Some people believe that "opensource is insecure by design, because everyone can see the code". Probably Kaspersky has the same point.

<comment><USER60> > Security without open-sourcing is impossible

is just as documented an assertion as

> opensource is insecure by design

The two are completely orthogonal.

<comment><USER59> Those were two different opinions. First is mine, the second is my interviewer's.

</comment></comment></comment><comment><USER61> Somehow this reminds me to John Draper's CrunchBox. Of course, it ran OpenBSD, an open source OS.

</comment><comment><USER62> >"All the popular operating systems aren't designed with security in mind"

I really disagree.

</comment><comment><USER63> Anybody know which microkernel they are using? I was not able to find it

</comment><comment><USER64> I would stay away from every snake oil product this KGB agent sells.

</comment><comment><USER65> I think after Microsoft is part of Linux foundation now, and now your telling us that you have a powerful and secure CLOSE source OS !!! .. I think Open Source already won the war!! and your somewhat 14 years late...

</comment><comment><USER66> I think [https://en.wikipedia.org/wiki/OpenBSD_security_features](https://en.wikipedia.org/wiki/OpenBSD_security_features) has good security features

</comment><comment><USER67> Russia. Ha. No my friend. Kaspersky. Ha. No my friend. Closed source. Ha no, and you ain't ma friend.

<comment><USER68> Please stop posting unsubstantive comments.

</comment></comment><comment><USER69> Happy Pocky Day! (11-11)

<comment><USER69> Alas, the allusion was lost on some.

</comment></comment><comment><USER70> The marketing makes it sound a bit like SeL4. [https://sel4.systems/](https://sel4.systems/)

</comment><comment><USER71> Should probably be named "Unbreakable Linux"... oh wait, that name is already taken by Oracle.</comment>


Making It Easier to Break Science Journal Paywalls - <AUTHOR> https://www.wired.com/story/its-gonna-get-a-lot-easier-to-break-science-journal-paywalls/ <comment><USER2> A friend was working on an amateur history project and I was helping them with the database. I figured that I'd start with the standards among professional historians for databases - people, place and event metadata; fields; schema, etc. That way my friend's work eventually could find a much broader audience, both among contemporaries and across time; there would be a much broader set of tools my friend could use (likely even existing FOSS databases); and of course I wouldn't have to reinvent the wheel.

I asked a few professional academic historians - and to my shock they said no such thing existed. They seemed to think I was confused about the need and accepted that everything was done ad hoc as it always had been. One suggested adapting a proprietary online genealogy database to the needs of the project (which was not genealogy nor even particularly focused on people).

It was depressing, thinking of the massive missed opportunity across academia to share and utilize their data much more efficiently. Imagine the state of software development if developers managed their work product the same way, in ad hoc hacked together silos on their personal computers, rather than through Github and the Internet

That was a few years ago, so I hope things have changed.

</comment><comment><USER3> Frankly, scientific journal publishing is obsolete. The only reason we needed journal publishers in the first place was to distribute the knowledge more widely -- when copying articles required industrial equipment. Now we have the Internet and journals are only sticking around because of their name recognition.

At least in some fields, progress has been made on rendering journal publishers a thing of the past:

[https://eprint.iacr.org/](https://eprint.iacr.org/)

<comment><USER4> I strongly disagree, and I think the disagreement probably is because we're in two different fields (biology vs CS). I think journals should be open access and non-profit. However, I also think they exist, and they should be tiered. This is how scientists indirectly communicate the importance of a work to the public and to the news media.

A lay-person can quickly grasp that a Nature or eLife or PLoS Biology paper is considered more trustworthy by the scientific community than a random blog post. It's a system that is far from perfect, but it does have predictive power for determining what the scientific community thinks of a work without having to be an expert. This is arguably the single most important utility in science communication, where it is essential that the scientific community is able to communicate updates on issues like climate, GMOs, vaccines, genetics, conservation biology, and evolutionary biology. These are all extremely important issues on which in some ways scientists are already losing the communication battle. If communicating science loses its journal hierarchy, loses pre-publication peer review, all of the pseudoscientists and charlatans and extremist think-tanks will jump on the chance to spew out paper after paper to confuse the public, and confuse journalists. They will engage 24-7 in "debate" about these papers on twitter and blogs, and probably win against scientists because pseudoscientists have more time, resources, and experience convicing people. Some scientists seem to think this is a silly hypothetical, and can't imagine that Ted Cruz could ever write something that looks like a scientific paper. Nothing is further from the truth. I encourage you to look up Answers In Genesis "research journal", a creationist website, and see if a lay-person could quickly distinguish any of those papers from real science (they can't). Climate denialists write equally long and convicing articles on blogs like Climate Audit and Watts Up With That. It takes high levels of domain expertise to debunk these works, or to understand why they're wrong. A world without a hierarchy of journals with pre-publication peer review is a world in which 99.9% of people become unable to determine high-quality pseudoscience from science. We should be making these systems stronger, by improving peer review within the scientific community, by establishing a more rigid and formal hierarchy of publications, not by encouraging communication anarchy. Because we will lose communication battles to pseudoscientists without journals.

<comment><USER5> The problem is that locking good research behind paywalls certainly does not help win the communication battle. Schools and grant givers need to stop relying on publishing in a prestigious journal as a criteria for being a good researcher.

I agree that proper, rigorous science needs to be marked as such, but the closed journals are part of the problem and not the solution.

<comment><USER6> tstactplsignore wrote _"I think journals should be open access and non- profit."_

=> (s)he isn't arguing the paywalls should stay, but that we shouldn't throw away the quality stamp that journals offer with the paywalls.

</comment></comment></comment></comment><comment><USER7> Someone was telling me (I haven't verified it) that the costs of access is charged to students per semester. A trivial (or non trivial for someone cheap like me) of $40 a semester. Now, I asked about a dozen people how often they access this resource at the library and none of them had used it. One lecturer enlightened me that some class encourages students to use it but students prefer to not read dense research paper and would rather read articles about the topic and cite the paper.

I don't know if colleges SHOULD pay high yearly subscription is the usage is low. But then, people who DO use it are left high and dry. Multiple colleges share books, too bad they can't do the same with these.

I don't have the numbers but I wonder what a college is charged and how many full ride scholarships a college would be able to give out with that fee?

<comment><USER8> > Someone was telling me (I haven't verified it) that the costs of access is > charged to students per semester.

I have not heard of this in the US. It's probably indirect through students -> tuition -> libraries -> subscriptions.

On low usage: it seems like you might be talking about undergraduates. Journal articles are primarily read (and generated) by faculty, post docs and graduate students. Considering that research grants bring in a lot of money to the university, I don't think it's so simple to consider scholarships that could be given with journal subscription money.

</comment></comment><comment><USER9> Its a miscarriage of science and justice, when publicly funded science goes behind a journal paywall.

People should be able to access what their taxes funded, and increase communication around science.

I really agree with this quote from the article.

"Access to science is going to be a first-world privilege," Geltner says. "That's the opposite of what science is supposed to be about."

<comment><USER10> In the Netherlands, at least, it will not be allowed for researchers to publish articles in journals that erect paywalls.

<comment><USER11> I think this was made a European rule: publicly funded research must be made available to the public (without paywalls).

There is currently a huge kerfuffle going on in Germany, with most universities canceling their Elsevier subscription because Elsevier doesn't do true open access.

As a scientist, I can only thank goodness for Sci Hub. It is so insulting to go through a grueling review, be expected to do reviews myself for free, then pay thousands of dollars for publishing a pdf, and then pay additional thousands of dollars for accessing my peers works. What a mess.

<comment><USER12> Even those who have licensed access to journals thank goodness for Sci-Hub, at least I do. It is often much easier to feed Sci-Hub a DOI and get the paper after negotiating a simple CAPTCHA than it is to log in through some portal so a cookie gets set which tells Wiley that this user has access to these, but not those journals today (but maybe tomorrow, or not), use their search feature to find the correct volume and then finally find the link which hopefully shows an open lock.

In this it is comparable to those copy protection schemes of old which made paying users jump through hoops while the pirates just had smooth sailing all the way. Arrrrrr!

<comment><USER13> The DOI should take you directly to the article-page. Sci-Hub works through that mechanism.

</comment></comment></comment></comment></comment><comment><USER14> TL;DR differential to sci-hub?

<comment><USER15> Nope, the article claims sci-hub is "falling to lawsuits", which seems a bogus statement -- to be determined.

Article fails to justify its title. Seems they got an interview with one of the Google Scholar founders, tacked on some random stuff related to scholarly publishing and search, and slapped an unsupported headline on it.

(I'm all for breaking science journal paywalls!)</comment></comment>


Is Machine Learning/AI Sexist? - <AUTHOR> https://shecancode.io/blog/is-machine-learningai-sexist <comment><USER2> The author cites word2vec as being biased and gives the example of it associating the 'father' with 'doctor' but associating 'mother' with 'nurse'

While this is certainly a bias, I think the insinuation is that this makes a program inherently sexist or racist.

I don't think anyone would really call the statement "in today's society, certain professions are male dominated" particularly sexist.

What I'm getting at is that I think there is a distinction to be made here where bias introduced via training data doesn't necessarily translate to sexism or racism.

Additionally, the problem doesn't as much exist in the programs as they do in the training data. No engineer at Google sat down at their computer and went "yep, men are doctors and women are nurses. Better program that into word2vec". That behaviour was learned from the information available.</comment>