Why the falling cost of light matters (2017) - <AUTHOR> https://www.bbc.com/news/business-38650976 <comment><USER2> > Switch off a light bulb for an hour and you are saving illumination that > would have cost our ancestors all week to create

> But the price of light alone tells a fascinating story: it has fallen by a > factor of 500,000, far faster than official inflation statistics suggest.

This is a fantastic anecdote in favour of automation, technology, science and research.

I can imagine how the sperm whale sailors, candle stick makers and matchbox makers felt when the light bulb started to become commonplace and replace their jobs. We will see the same arguments against progress coming through again and again over the next 100 years, I hope we continue to prevail in our growth and find a solution for those displaced when technology overtakes their job.

<comment><USER3> > I can imagine how the sperm whale sailors, candle stick makers and matchbox > makers felt when the light bulb started to become commonplace and replace > their jobs.

And now the match industry has an upper-end, boutique product for wealthy millennials. Markets in everything.

[http://skeemshop.com/apothecary-match- bottles/](http://skeemshop.com/apothecary-match-bottles/)

<comment><USER4> Huge, dim "Edison" bulbs also appear to be trendy. The cycle seems to be accelerating.

</comment></comment></comment><comment><USER5> Sadly there are a lots of flaws of LEDs, I think they are put in the spotlight a bit too early. While they are a lot better than previous light saving technologies (like CFLs which took a minute or two to warm up), most of the bulbs in the market currently have lots of drawbacks:

\- Their CRI is pretty low, around 80.

\- They flicker causing eye strain.

There are now LEDs that solve both, its just a pain to find them (and cost 2-10x more than other LEDs.)

<comment><USER6> How do you go about finding high-quality LEDs? Are they easily available in standard bulbs?

<comment><USER7> Just tinkering, I've found several factors are important.

First is the color temp and CRI of the bulb/chip; make sure they match your application. Sometimes mixing bulbs/chips works well to get a more pleasing & usable spectrum. I've also found that the strip LEDs with multiple colors and a tunable controller produce good results.

Second, find a power supply/controller that has a very high frequency. LED's don't inherently flicker, and when powered straight from a source like a battery provide a completely steady light. The flicker is typically from a time-chopping brightness controller. Cheap ones may use 60Hz, which the eye can still see, especially in the peripheral vision areas (rod cells, sensing only grays detect motion much better, whereas color-sensing cone cells at the center of the visual field have a slower response so detect flicker less well). Ideally, get a controller well above 25KHz to also eliminate any audio artifacts.

I'd very much like to see someone more expert chime in!

<comment><USER6> Are there any dimmable LED strips that operate by fully illuminating X% of the LEDs? As opposed to time-slicing all the LEDs. I don't know enough about hardware to know if that would be feasible.

The flickering and whining is pretty bad in all the dimmable LED bulbs I've used (but I haven't yet looked hard for high-end ones).

<comment><USER8> That severly shortens the lifetime of an LED, like by a factor of 10. So I would guess it is not common because much of the benefit that gets marketed is the longer lifetime. It is possible to build a better dimmer switch which actually works across the full profile of voltage variation but the problem then is you have to pay an engineer money and why do that when you can spend money on booze and dinners to win more sales contracts with your lighting distributors and get a higher ROI? The lighting world is a very consolidated place.

</comment></comment></comment></comment></comment><comment><USER9> Nice try Mr. Moth.</comment>


Small regional conferences lead to deeper communities in tech-oriented people - <AUTHOR> http://everythingsysadmin.com/2011/04/smaller.html

<comment><USER2> Plug: One such small regional conference with a security bent happening in Raleigh, NC is <http://www.carolinacon.org/> at the end of April.

<comment><AUTHOR> Cool, thanks for the tip!

</comment></comment><comment><USER3> I especially liked the Ruby Hoedown, and Magic Ruby conferences because they were free admission. All you had to do was convince your company to pay for travel and lodging. The quality of talks and technical skills of people who went to those conferences were definitely not lacking

</comment><comment><USER4> Getting to meet local peers and discuss tech & worklife issue = priceless

</comment><comment><USER5> Small means more one on one contacts. Regional means Cheaper. A win-win.</comment>


Why Social Proof Matters To Your Startup - <AUTHOR> http://dshipper.posterous.com/why-social-proof-matter-to-your-startup

<comment><USER2> It's an interesting post but I don't think the statistics actually support the conclusion. The 1st blog post _referred_ 1'500 people -- we don't know how many actually visited the blog post. The second post had 3'000 visitors. Without knowing the bounce rate from the first post we can't compare these stats.

UPDATE: The other point to consider is that this is purely post-hoc reasoning. I can think of at least one alternative explanation -- the people who arrived from the first blog post were already motivated enough to click another link so they were more likely to purchase. Without doing some kind of experiment to differentiate these hypotheses we can't make a judgement one way or the other.

It probably sounds like I'm raining on the author's parade. That's not my intention. I really like that he's put these figures online and is trying to analyse. I hope I'm just showing that the issues are more subtle than they seem at first.

<comment><AUTHOR> Hey Noel thanks for the feedback! For your first point about the blog post both of the stats that I referred to when it comes to visitors 1500 vs 3000 are both the number of people that were referred to the site from each blog post. So I wasn't talking about the traffic stats for the blog posts themselves, I was only talking about stats that I know for both of them which was how many times they referred visitors to DomainPolish.

I think that your second point is interesting. What do you mean by more motivated to click? I can tell you that the bounce rate on the home page was a fairly consistent 30% for both posts, which leads me to believe that people just trusted the site more when they read a review from someone else and felt more comfortable buying.

</comment></comment><comment><USER3> It's also a very good example on how to use HN to get exposure for your product:

1- show HN post

2- let someone else blog about it (or ask for it) and submit to HN

3- post again about the comparison of #1 and #2, with a interesting reflexion (social proof)

I wonder what's coming up next :-)

<comment><USER4> I think part of the winning formula in this case was that it's relevant to HN - (HN readers are the demo for DomainPolish). I wrote the article because I thought it was a cool service, I never expected anyone to read it.

I wrote the whole post in 15 minutes, it was a stream of thought that turned out to be relavent to the community.

</comment></comment><comment><USER5> Social proof is very important. Even subtle aspects can have significant impacts. I think social proof ties in with another area that I think may even be more important: the impression of longevity.

With both my own and others' projects, I've noticed that if you don't give an impression that you've been around a while or that your project/product is in active use or production, you'll find it significantly harder to gain traction. I think this is why the "trick" of using screenshots, videos, and so forth, tends to work well, since people get to see something that, supposedly, is in action, rather than a floaty promise.

If you're launching a podcast, an e-mail newsletter, or something where a sign of activity will boost signups, make sure you get a "few in the bag" and can do your public launch at episode 5, issue 7, or whatever. Likewise, with a business like that described in the post, make sure you can get some early reviews, some testimonials, and some blog posts in the bag so that you look like you're going places, even when you aren't.

<comment><AUTHOR> I think that this is a great point. You want your project to feel like its been around forever and will continue to be around for a long time. That inspires confidence in your users to buy from you and/or recommend you to their friends. Without longevity they can't be confident enough in you to invest themselves.

</comment></comment><comment><USER6> It doesn't even have to be someone credible.

Simply puting some images of human faces on your site near the call-to-action button helps. The Facebook widgets that show who has "liked" your site work great for this. Our eyes are drawn to pictures of faces and a group of faces next to a button says "these people tried it, what is wrong with you?"

Some more: * Pictures of faces * A testimonial (one face and one sentance) * A number indicating usage (4,243 downloads today!) * Expert reviews (TechCrunch loved it!)

<comment><AUTHOR> Excellent point. I should definitely add a few more things like that.

</comment></comment><comment><USER7> I don't think this is a good example of social proof in the sense Cialdini referred to in _Influence_.

<comment><USER3> It is social proof IMHO. A social proof of one, but a social proof nonetheless - social proof coming from a fellow HN user might add some authority to the mix:

"social proof: People are more willing to take a recommended action if they see evidence that many others, especially similar others, are taking it."

"authority: People are more willing to follow the directions or recommendations of a communicator to whom they attribute relevant authority or expertise" (summary of Influence: [http://www.sellingandpersuasiontechniques.com/influence- summ...](http://www.sellingandpersuasiontechniques.com/influence- summary.html))

</comment></comment><comment><USER8> Working servers matter more, the page doesn't load for me.</comment>


General Atlantic, Sequoia Capital Are Key Drivers in Oracle Bid for TikTok - <AUTHOR> https://www.wsj.com/articles/general-atlantic-sequoia-capital-are-key-drivers-in-oracle-bid-for-tiktok-11598310734 <comment><AUTHOR> New info revealed by article:

"The investment firms, which own large stakes in Beijing-based ByteDance Ltd., are key drivers behind a possible bid for TikTok by a group including Oracle Corp."

"Microsoft had said it might invite some U.S. investors to join its bid. But more recently Sequoia and General Atlantic grew concerned that they wouldn't have a place in a Microsoft deal and looked for another potential tech partner that could give them a piece of the action, some of the people said. "

"Bidders have been asked to submit offers by the end of the week, and one of the parties could enter exclusive negotiations soon, according to people familiar with the matter. "

"TikTok representatives have engaged with other companies about potential involvement in a bid. They approached Netflix Inc. to gauge its interest in a deal, people familiar with those discussions said, but the video-streaming giant passed, one of them said."

"Zhang Yiming, ByteDance's founder and chief executive, favors Microsoft, said people familiar with his thinking."</comment>


What to Watch When Uber Goes Public - <AUTHOR> https://www.nytimes.com/2019/05/09/us/uber-ipo-public-drivers-strike.html <comment><USER2> Blade Offers New York Airport Transfers for $195, Aiming at Uber Black

[https://www.bloomberg.com/news/articles/2019-05-08/fastest-w...](https://www.bloomberg.com/news/articles/2019-05-08/fastest- way-to-get-to-new-york-city-airports-a-195-helicopter)</comment>


Using JavaScript and Web Timing API to Measure Page Performance on IE9 - <AUTHOR> http://blog.yottaa.com/2010/10/using-web-timing-api-to-measure-page-performance-on-ie9/

<comment><USER2> excellent article.

</comment><comment><USER3> very good

</comment><comment><AUTHOR> Great news. Google Chrome and FireFox both are adding support for Web Timing API. This is great for web development community (posted updated accordingly).</comment>


Mobello - An HTML5 Framework For Building Native-Like Mobile Apps - <AUTHOR> http://functionn.blogspot.fr/2012/06/mobello-html5-framework-for-building.html#.T90AL4liGf0 <comment><USER2> Wow, this is an extremely good effort at building a mobile app framework, and makes jquery mobile look like an amateur effort in comparison (which it is).

Rough around the edges, but so far, it shows great promise.

</comment><comment><USER3> Seems a lot more performant on my old Android HTC Desire Z (2.2/2.3). Even the latest jQuery Mobile is sluggish on it.

However, I don't think it's correctly using URL history states.

</comment><comment><USER4> Anyone manage to get the demo working? Won't load for me.

EDIT: Emulator only seems to work in Safari.

</comment><comment><USER5> Holy shit. Jquery Mobile, eat your heart out. Step aside, and move over.

I'm trying this. looks great!</comment>


The Rise and Fall of Thinking Machines (1995) - <AUTHOR> https://www.inc.com/magazine/19950915/2622.html <comment><USER2> Yes this article is very old, and really only scratches the surface of Hillis' genius and puts a business failure angle on it.

Here's a great video describing the architecture of the CM-5

[https://youtu.be/Ua-swPZTeX4](https://youtu.be/Ua-swPZTeX4)

Note how similar the programming concepts are to CUDA (at an abstract level). Hillis also in the 80s published his MIT thesis as a book: The Connection Machine

[https://www.amazon.com/Connection-Machine-Press- Artificial-I...](https://www.amazon.com/Connection-Machine-Press-Artificial- Intelligence/dp/0262081571/ref=sr_1_1?ie=UTF8&qid=1525195204&sr=8-1&keywords=the+connection+machine)

An incredibly well written and fascinating read, just as relevant today for programming a GPU as it was for programming the ancient beast of a CM-2. It's about algorithms, graphs, map/reduce, and other techniques of parallelism pioneered at Thinking Machines.

For example, Guy Blelloch worked at TM, and pioneered prefix scans on these machines, now common techniques used on GPUs.

[https://www.youtube.com/watch?v=_5sM-4ODXaA](https://www.youtube.com/watch?v=_5sM-4ODXaA)

[http://uenics.evansville.edu/~mr56/ece757/DataParallelAlgori...](http://uenics.evansville.edu/~mr56/ece757/DataParallelAlgorithms.pdf)

There's also been a lot of hum lately on HN about APL, much of Hillis' *Lisp ideas come from parallelizing array processing primitives ("zectors" and "zappings"), ideas that originating in APL as he acknowledged in the paper describing the language:

[http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.108...](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.108.5413&rep=rep1&type=pdf)

What's old is new... again.

<comment><USER3> One should note that CM-1/2 (which is essentially an FPGA turned inside out which you can reconfigure for every program step) has radically different architecture than CM-5 (which is essentially the same as modern many-CPU distributed memory supercomputers).

Also of note is that * Lisp described by Hillis' paper (xectors and xappings with more or less hidfen mapping to hardware) is completely different from * Lisp that was actually sold by TMC, which handled embedding of the problem geometry into hardware, but otherwise was Paris assembler (ie. what you send through the phenomenally thick cable from frontend to CM to make stuff happen) bolted onto Common Lisp. IIRC the commercial *Lisp got somehow opensourced and you can run it (in emulation mode) on top of SBCL.

<comment><USER2> You're right, he talks in the video I linked above about how different the CM-1/2 architecture is to the CM-5, but how the ideas of "data parallelism" on "virtual processors" maps onto both designs.

Thanks for the info, I have seen variants in old pdfs around that have the !! parallelism construct instead of using the algebraic forms of alpha, beta, and dot. I find the latter form as described in the book The Connection Machine to be very elegant.

</comment></comment></comment><comment><USER4> You might also like _Richard Feynman and The Connection Machine_ [1] written in 1989 by Daniel Hillis.

[1] [http://longnow.org/essays/richard-feynman-connection- machine...](http://longnow.org/essays/richard-feynman-connection-machine/)

</comment><comment><USER5> Biggest previous discussion was in 2014. Some great comments in there:

[https://news.ycombinator.com/item?id=7121058](https://news.ycombinator.com/item?id=7121058)

Second biggest was in 2009, complete with "seriously, how many times does this article has to be posted in HN?"

[https://news.ycombinator.com/item?id=743170](https://news.ycombinator.com/item?id=743170)

</comment><comment><USER6> Real computers have blinken lights. In an age of dull beige boxes, that's what truly set them apart, at least to a layman.

I'm half joking, but half not. Nvidia, Cray, etc need to put some blinken lights on these drab racks. Something with AI needs lights, and it looks sexy to Joe Public.

Like in classic sci-fi, a sentient AI machine would have columns of blinken lights, tended to by women with clipboards, lab coats, and high heels.

<comment><USER7> I've watched blinken lights on my motherboard for about 2 seconds when it performed automatic overclocking. POWER, CPU, DRAM, CPU, DRAM, CPU, DRAM, TPU, BOOT. Quite entertaining.

<comment><USER3> I've seen some PC motherboards that contained integrated "POST card" in the form of bunch of LEDs or pair of 7segment displays. Sadly this seems to got replaced by few highlevel LEDs and bunch of meaningless ones, which includes stuff like backlighted PCB.

By the way many DEC Alpha boards had large amount of LEDs near the CPU (probably driven directly by the CPU) which shown state of PALcode (and thus blinked in entertaining way even when the system is up and running)

</comment></comment></comment><comment><USER8> I have a friend who works on Ab Initio software. Sheryl Handler is still the company CEO. The made him sign strict NDA.

On an unrelated note, I bought "The Pattern on the Stone" by W. Daniel Hillis last year. He gives a lot of examples on Tic Tac Toe

<comment><USER9> I have one story to tell about Ab Initio.

They invited me in for an interview. At the end of the day, they weren't done. So we did another day of interviews. And another.

They interviewed me, phone and in-person, for over 20 hours.

Then we got to discussing what sort of compensation I would require... and then they decided that they didn't want to hire me.

I have a friend there who is pretty happy, but they can't tell me what they do except in the broadest terms.

</comment></comment><comment><USER10> It's interesting to see how some of what Connection Machines thought would happen in the future, has now come to pass, such as scientists renting computing capacity by the hour, with e.g. GPU rental on cloud computing.

<comment><USER11> Wasn't it how everything worked back in the early mainframes and timesharing days?

<comment><USER12> And has always worked with compute clusters too.

</comment></comment></comment><comment><USER13> What with all the people drooling over the LEDS, how about a PCI board that shows the top bits of the address bus?

<comment><USER14> You can't see the cpu address bus from a pci(e) card sadly.

<comment><USER13> Ah yes, of course, it's more like a bunch of serial links. Ok, how about a vacant RAM slot then?

<comment><AUTHOR> Well... Each board had 32 LEDs (the top 16 were doubled, I don't know for what), each cube had 16 boards, 8 on one side, a couple in the middle without LEDs and doing communications, IIRC, and 8 more on the other side. Not sure it had LEDs on the back cubes.

I'm seriously thinking about building a cluster of ARM-based thingies and use LEDs controlled from each node to show usage of cores, NEON lanes (patching the Ne10 library) and so on. There are some octa-core big.LITTLE (I forget the new name) boards that would make the carrier boards simpler (only 4 per carrier needed, considering CPUs alone). The boards themselves would be simple, having only LEDs connected to the GPIO pins and power being fed to the nodes, which would be wired together using ethernet.

Another, way cooler but waaaaay dumber (because it'd be a shitload of work for me), would be to design a board around an ethernet switch and a bunch of Octavo SiPs (or, maybe, some Pi-like CPU Soc with PoP RAM on top, provided it has ethernet on board to reduce chip count). Having everything on a single board would avoid PHY transceivers and reduce board complexity, but it still would be a ton of work for someone who hasn't designed a PCB since the dawn of the SMD era. Also, the Octavo parts are single core and we'd need 32 of them per board to light up 32 LEDs in a meaningful way. I'd rather restart my hardware engineer career with something less megalomaniac.

The final, laziest, approach would be to get a cluster board and 7 SOPINE modules from the fine people at Pine64 and wire their GPIO lines to a couple LED matrix modules. With 28 cores per board, the use of 28 of the 32 lights would be simple to figure out, but we'd need something for the other 4 LEDs (2 could be from the on-board ethernet upstream port, but 2 still remain. Also, since the SOPINES stand perpendicular to the cluster board, spacing would be very tight.

<comment><USER13> That'd be one very impressive lightshow :)

<comment><USER15> Replace the LEDs with laser diodes if you want something _truly_ impressive.

<comment><AUTHOR> I don't want to get killed while running benchmarks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> This was the company where Richard Feynman's job was to paint walls and buy office supplies.

<comment><USER6> He did more than that, but painting a wall, or other manual labor that doesn't require concentration, gives time for deep thinking. I'm sure he didn't mind it.

<comment><USER17> Hillis gives a written account of it. He wanted to do stuff that actually needed to get done; not BS.

[http://longnow.org/essays/richard-feynman-connection- machine...](http://longnow.org/essays/richard-feynman-connection-machine/)

""" We were arguing about what the name of the company should be when Richard walked in, saluted, and said, "Richard Feynman reporting for duty. OK, boss, what's my assignment?" The assembled group of not-quite-graduated MIT students was astounded.

After a hurried private discussion ("I don't know, you hired him..."), we informed Richard that his assignment would be to advise on the application of parallel processing to scientific problems.

"That sounds like a bunch of baloney," he said. "Give me something real to do."

So we sent him out to buy some office supplies. While he was gone, we decided that the part of the machine that we were most worried about was the router that delivered messages from one processor to another. We were not sure that our design was going to work. When Richard returned from buying pencils, we gave him the assignment of analyzing the router. """

</comment></comment></comment><comment><USER18> Great writing by Gary A. Taubes who is now better known for writing about carbohydrates and sugar through books like "Good Calories, Bad Calories"

<comment><USER8> How is "Good Calories, Bad Calories" as a book? What does it talk about?

<comment><USER19> Haven't read his book but I've listened to him talk on podcasts. I think he makes some excellent criticisms on the horrible state of dietary science. He can be a bit digmatic himself and sometimes makes unhelpful statements but he also has some great points. I'd probably credit him with the chain of events that resulted in me deciding to go low carb which has turned out to be a great decision so far for me.

</comment></comment></comment><comment><USER20> Reading this on mobile I got really confused: this was published in 1995.

<comment><AUTHOR> Yes. In those days spirits were brave, the stakes were high, and supercomputers looked super. ;-)

note: I fixed the headline.

</comment></comment><comment><USER21> Cool and awesome does not pay. The top companies may be using cool stuff to accomplish things, but the things being done are ultimately pedestrian. Google sells ads, Amazon runs an online marketplace, Apple makes personal communicators and Facebook is a place for chatting with friends. None of them are doing anything like "searching for the origins of the universe."

<comment><USER13> Cool and awesome pays just fine. Ask NVIDIA. Many of the ideas pioneered in the Connection Machine have been validated by time. Hillis was only a couple of decades or so ahead of his time.

<comment><USER22> It doesn't pay when it is ahead of its time :)</comment></comment></comment>


Ask HN: Do you think we will see a rise in remote jobs now? - <AUTHOR> If so do you think we will then see a decrease in the amount of "bullshit" jobs or an increase in freelance culture? <comment><USER2> Across the entire globe, businesses, investors, and employees are being ruthlessly punished to the degree they cannot operate remotely.

Previous/quick adopters of remote work capabilities will be relatively rewarded.

Suppliers of remote work capabilities and services are being highly rewarded.

Going forward, the motivation for companies and suppliers to highlight remote operation capabilities will be very high. Even where it is simply a useful option or makes no sense.

And when something is easier to do, more people will do it.

</comment><comment><USER3> Less bullshit jobs? Surely not!

Contrast someone doing non-work in his cube all day, where you may mistaken what he's doing for something useful, against simply forgetting about the existence of an employee who no longer needs to even pretend to do work.

<comment><USER4> Presenteeism and the ability to watch people doing pretend work plays a huge part in bullshit jobs. Arguably, it's the main reason those jobs exist at all.

Where's the point in employing someone to act as if they were doing anything useful if you can't watch them while doing so?

There might be a remote work variation of this but in general bullshit jobs shouldn't fare as well in that kind of setting.

</comment></comment><comment><USER5> I've been doing remote work for 15+ years. As long as you (the customer) can clearly articulate what you want done, I can do it.

So long story short - as long as you know what tasks you want done and in how long a period of time, this (=remote work) will work.

In the current global context, there should be an increase in freelance work. A lot of "managers" will try to fight it, but there's no way around it.

</comment><comment><USER6> Personally I am not sure. I am not that productive working 100% remote. I like flexibility but I like being in an office that is not in my house.

</comment><comment><USER7> In some fields sure. I suspect we'll see a lot more web development/software engineering companies allow/offering remote work than before, since the current situation has basically confirmed said fields don't require employees to be in an office.

Same with digital marketing companies, design companies, advertising agencies, etc.

I don't think it'll affect all fields though.

</comment><comment><USER8> As someone working as a remote Product Manager, I think the current situation is quite possibly one of the worst ways "remote work" could have gone mainstream. I have been working remote for three years now and even I'm not enjoying it as much as I normally do.</comment>


Amazon Is Becoming the New Microsoft - <AUTHOR> http://www.cringely.com/2017/11/17/15468/ <comment><USER2> At some point, Microsoft became the new IBM, which was good for Microsoft.

Then Google became the new Microsoft, which was good for Google, forcing Microsoft became the new IBM again, which was bad for Microsoft.

My question, which new version Microsoft will Amazon become? The old new version like the one that replaced IBM, or the new new version like the one that replaced IBM?</comment>


Show HN: Remind'em gives you the power to set reminders in your friends' phones - <AUTHOR> http://www.remindem.in/

<comment><USER2> There's an Android app by the same name that does the same thing: [https://play.google.com/store/apps/details?id=br.com.intelco...](https://play.google.com/store/apps/details?id=br.com.intelco.remindem)

Not available on iOS though...

<comment><AUTHOR> That app is too primitive. We made this because we felt the need for this.

</comment></comment><comment><USER3> Location reminder is a very nice idea. I would like to use it, for myself only (but it would be much better if I could make my friends use it), but I can't. Using smartphones with lots of apps destroys my life (and my battery).

<comment><AUTHOR> We are trying our best to keep the battery usage minimum. We are currently using the GCM service for all our push notifications. It helps in keeping battery usage low since the same service handles all the Android notifications.

</comment></comment><comment><USER3> It is a shame that everything are apps and for them to work we need to convince people to install them and keep them running.</comment>


The case against queues - <AUTHOR> http://teddziuba.com/2011/02/the-case-against-queues.html

<comment><AUTHOR> Some interesting views about queues and whether you need them.</comment>


How to translate Japanese - <AUTHOR> http://www.the-tls.co.uk/tls/public/article1569460.ece

<comment><USER2> Good find, that was a great read.

I'm not sure Japanese is being replaced, just going through a period of rapid change. Like many other languages living under English's shadow. I see French, one of the most conservative linguistic cultures, constantly mangle English idioms into supposedly creative and original French.

The article made me wonder about that lucid, unstructured quality of the Japanese language and whether that was a reflection of Japanese culture. Peaceful, unassuming, curious. It mentioned the structured thought of the Western mind in contrast, which on the face of it seems beneficial, but on reflection might channel thought down narrow, blinkered lines.

Perhaps we could learn from Japanese vagueness of expression. Freedom to interpret multiple meanings could lead to increased connections and discoveries across social, scientific and political areas. This, instead of constant affirmations, confirmations, congratulating and ego-stroking might actually be one of Japan's greatest gifts to the world. It's not as if it has held them back as a nation and culture, after all.

This small island, tucked away on the periphery of planet Earth, has led the world in technology, art and science. Perhaps it is not a world literary power, but perhaps that's only right for the culture around the language. Maybe the author's longings for classics in Japanese to match those of her French degree course were a case of unmanaged expectations. Like the Tokyo-ite surviving on the cheapest of noodles just to fund their Louis Vuitton habit, perhaps the author is missing the point of the wider context surrounding Japanese language and culture, and how it relates to the rest of the world. If she were less angered by what doesn't exist and more in praise of what does, she might be more at peace with her language and culture.

That's all a whole lot of speculation and assumption on my part, but sometimes it's fun to break out of fact-land and get a little vague. Cheers to the article author, book author, translators and link sharer here for the reminder.

<comment><AUTHOR> I occasionally filch URLs from from [http://www.aldaily.com](http://www.aldaily.com), which was the case with this one. Their tag was:

 _" The Japanese literary scene is plagued by rehashed American literature. Contemporary novelists are "brainless writers of crap." Exhibit A: Haruki Murakami..."_

(I modestly used as a title the last sentence of this bit:

 _" Mizumura discusses the problem in a broad cosmopolitan context, warning the world not only of the impending fall of Japanese but the likely fall of all national languages in the age of English and the internet. Japanese is just the canary in the coal mine."_

but the inexorable "original article title" HN policy eventually prevailed ;-)</comment></comment>


User Experience Trumps Pretty URLs, The End. - <AUTHOR> http://fascinated.fm/post/3314181609/user-experience-trumps-pretty-urls-the-end

<comment><USER2> can someone provide some context for this #! thing, for the uninitiated?

<comment><USER3> The text after the # is a Fragment identifier. Wikipedia: "In the most common case, the agent scrolls a Web page down to the anchor element which has an attribute string equal to the fragment value.". Basically, fragment identifiers are commonly used to link to specific content in long documents.

More recently, however, ajax applications have started using them to push state into the browser's history. This enables the expected functionality for bookmarking and the back button. Since fragment identifiers are only used by the client you can link to them without refreshing the page. Using the ! in #! is a convention proposed by Google for stateful ajax applications.

<http://en.wikipedia.org/wiki/Fragment_identifier>

[http://googlewebmastercentral.blogspot.com/2009/10/proposal-...](http://googlewebmastercentral.blogspot.com/2009/10/proposal- for-making-ajax-crawlable.html)</comment></comment>


15 years later: remote code execution in qmail - <AUTHOR> https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-execution-qmail.txt <comment><USER2> Oh, dear. Another "will never happen" issue which, after not so long (in the history of mankind) takes place. And this one would not have been so complicated to fix (just enforce a limit as the author suggests).

        /* this line is unreachable */
        printf("You have reached unreachable code\n");

10 years later, it gets printed...

<comment><USER3> Why not exit/panic at that point? Seems like the right thing for any "unreachable" code.

<comment><USER4> I could see an argument (similar to for assert()) to omit such a check in most production builds. Maybe you could enable it for a small amount of hosts, so that if it does happen with any frequency, somebody sees it somewhere.

But not every "unthinkable" case being reached represents a security problem as it does in this case. So in the general case of how to approach such assert-type checks, an abort might take down the process when not necessary, turning it into a DoS.

Edit: I am not sure if my friend the downvoter realizes I am not trying to justify legit security bugs, just talking abstractly about varying approaches to handling asserts for unforeseen or "allegedly impossible" circumstances.

<comment><USER5> I didn't downvote you and I interpreted your comment the way you said you meant it. I do happen to disagree, though.

For a project in a space that's notoriously vulnerability prone - I mean, when it was released it was competing with Sendmail - it seems very reasonably cautious to pepper the code with panic handlers in "impossible" places. They won't slow the code down any because they should never be evaluated, but give nice, noisy explosions when unexpected things happen. There's no downside to doing this.

<comment><USER6> Solaris also notably bundles 32-bit binaries for most everything in /bin with 64-bit distributions, and that begins to look like a wise choice.

I recently observed that SmartOS does the same.

</comment></comment></comment></comment></comment><comment><USER7> That's quite interesting because the bug was there and was quite clear, and was not fixed by one of the most brilliant security persons out there (DJB). Maybe here the attitude really was the wrong one, considering how security oriented qmail was since the start, because the simplest possible fix does not seem to demand any other dimension, like complexity or performances.

<comment><USER8> While I think that he should have rewarded the original 2005 bug report I do not think that he did anything wrong after that. He was pretty clear about the memory limit for years now.

<comment><USER9> If the program only runs correctly with a memory limit in place, perhaps it should (if this is possible?) check for a memory limit when it starts and abort if it's missing.

</comment></comment></comment><comment><USER10> Serious question: Was there a legitimate reason they didn't patch this stuff when it was first discovered?

<comment><USER11> It's not "they", it's Daniel J. Bernstein. That's the reason :)

(If you don't know: he is a top cryptographer that can amazingly correct code. However, he also has a very big ego...)

<comment><USER12> I don't understand. Most people with a big ego would not want a critical vulnerability associated with them. Can you elaborate?

<comment><USER13> he had such confidence in his software and abilities that he thought it was actually secure, and there were no bugs, and posted a bounty for any exploit that could be found. Patching it means acknowledging it's an exploit, and that his code was not without bugs.

Given that his principles of writing secure software (included in the Qmail guarantee[1]) includes this: "7\. Write bug-free code." that might be a bit hard for him to swallow.

1: [https://cr.yp.to/qmail/guarantee.html](https://cr.yp.to/qmail/guarantee.html)

<comment><USER14> Well, he used it with memory limits command line switches, so it could never be exploited. So he was technically correct. One should not use so much memory for a mail server, way too risky.

Problem is, these switches were not default, people didnt use it because they are dumb, and DJB never cared to properly maintain it. like limiting memory per default, 32bit only builds or such.

<comment><USER15> > One should not use so much memory for a mail server, way too risky.

Is there a table or formula I can consult that will give this particular dumb person(myself) a handy guide for what amounts of addressable memory will introduce security risks for particular applications? Apparently more than 32-bits is obviously[0] a problem for email; what about databases? Should I feel bad I use more than 64GB of memory in my DB installations? Am I being irresponsible? What about web servers? How much risk does each additional bit of memory add?

My final question is, why does pretty much every other software maintainer not have a problem fixing the memory allocation themselves, obviating the need for external tools to fix these issues? I guess they're going the extra mile!

[0] So obvious a problem that sendmail, postfix, and exim don't require me to apply workarounds for it for some reason. Very irresponsible of them, if you ask me.

</comment></comment></comment></comment></comment></comment><comment><USER16> This is great. I remember when this came out. Georgi Guninski was a very accomplished bug hunter. Well known for finding vulnerabilities in web browers (ie. internet explorer) But the security community frowned upon that a bit as "not real hacking" so he was like "hold my beer", went after the hardest "real" target you could find and this was the result.

The guy is a legend

</comment><comment><USER17> The surprising thing here for me was that you can send qmail a 4GB email message and it will not immediately reject it in the default configuration.

<comment><USER18> 4GB was impossible when qmail was last updated.

<comment><USER19> According to Wikipedia DJB's last release was 1998. 64-bit Alpha and SPARC V9 were in widespread use by then. Even Linux was ported to Alpha in 1995.[1] See [https://www.linuxjournal.com/article/1044](https://www.linuxjournal.com/article/1044)

[1] Actually, Jim Paradis announced the Linux/Alpha development kit January 23, 1995 on comp.os.linux.announce (Message-ID: firstname.lastname@example.com). So it's possible he had the kernel ported in late 1994. He announced a fully functional distribution July 1, 1995. (Message-ID: firstname.lastname@example.com)

</comment></comment></comment><comment><USER20> "Finally, we also discovered two minor vulnerabilities in qmail-verify (a third-party qmail patch that is included in, for example, Debian's qmail package): CVE-2020-3811 (a mail-address verification bypass), and CVE-2020-3812 (a local information disclosure)."

The vulnerabilities were introduced in a third party patch, not source code that was authored or advocated by djb.

"As recommended by Daniel J. Bernstein, qmail can be protected against all three 2005 CVEs by placing a low, configurable memory limit (a "softlimit") in the startup scripts of all qmail services."

Seems much simpler than patching, let alone trusting someone else's patches.

Interesting that they developed their exploit against Debian's default configuration. qmail from its source at [https://cr.yp.to/qmail.html](https://cr.yp.to/qmail.html) comes with no such default configuration.

<comment> loup-vaillant > _The vulnerabilities were introduced in a third party patch_

Which patch are you talking about? I don't see anything about a patch in the CVE.

> _Seems much simpler than patching, let alone trusting someone else 's > patches._

We can patch the issue for good (and with a simple patch, apparently), or we can rely on users not to mess with seemingly unrelated init scripts. Do you trust third party users more than a (likely heavily scrutinised) small third party patch?

<comment><USER20> qmail-verify. It is an "update" of the third party "realrcptto" patch by another third party. It says "third party patch" right there in the sentence I quoted. There is no qmail-verify in original qmail.

As to the second question, I trust softlimit from daemontools and that is what I use. [https://cr.yp.to/daemontools/softlimit.html](https://cr.yp.to/daemontools/softlimit.html)

Not sure what "messing with seemingly unrelated init scripts" means. Can you be more specific?

<comment> loup-vaillant I could trust softlimit all right, but my point was that I wouldn't trust _users_ to wield it correctly.

<comment><USER20> softlimit is not difficult to use, certainly no more difficult than patch. programs like tinydns-conf for example autmatically generate a run script containing softlimit with a recommended -m setting. maybe qmail needs something similar.

<comment> loup-vaillant I was talking about patching _upstream_ , okay? It's not like the patch would have to be individually applied to each installation by its own admin. Patch upstream once, and poof, all users worldwide are safe as soon as they update.

<comment><USER20> Perhaps "Seems much simpler than patching" was an ambiguous statement. I was only referring to the perspective I take as an admin for one user: me. I already use softlimit on a daily basis so it is simpler for me than patching. To me, it seems like a cleaner solution. The two _complete_ mitigations presented were a choice between (a) using softlimit and the -m setting used by qmail's author versus (b) applying a third party patch to fix problems caused by another third party patch (qmail-verify, which was an "upadte" of yet another third party patch) and third party configuration settings (Debian). I thought that was noteworthy.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Do we know if they have applied for the $500 bug bounty from DJB?

<comment><USER22> My guess is that he'd never accept it. He originally didn't allow people to distribute qmail with changes; this is squarely a Debian issue.

<comment><USER23> If he takes that stance than it will cast doubt on everything else he has done. If there is a footgun on the wall, by the end it must go off, and chaining "non-exploitable" bugs together is routine stuff for hackers.

<comment><USER18> It's been 20 years; I don't think he's concerned.

<comment><USER23> Ahhh I see now that "qmail last had an official release in the late 90's". That changes everything, obviously.

<comment> loup-vaillant In case it wasn't sarcasm: I would say it does not. What would, would be a note on the website explicitly mentioning that Qmail is unmaintained, and people should either take over maintenance or use something else.

Seeing no such disclaimer at [https://cr.yp.to/qmail.html](https://cr.yp.to/qmail.html) means DJB is (possibly unintentionally) still vouching for it. Right now in 2020.

</comment></comment></comment></comment></comment></comment><comment><USER24> Maybe this will be useful to someone adding the following flags LDFLAGS='-z relro -z now' help with one of the holes (they mentioned it, but not what flags) Check out: [https://github.com/slimm609/checksec.sh](https://github.com/slimm609/checksec.sh)

      * System-wide ASLR (kernel.randomize_va_space): Full (Setting: 2)
      * Does the CPU support NX: Yes
      * Core-Dumps access to all users: Restricted
               COMMAND         PID RELRO      STACK CANARY            SECCOMP          NX/PaX        PIE                     FORTIFY
      # checksec --proc-all |grep qmail
          qmail-injectXXXXX27 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
           qmail-queueXXXXX97 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
            qmail-sendXXXXX78 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
          qmail-lspawnXXXXX89 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
          qmail-rspawnXXXXX90 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes
           qmail-cleanXXXXX91 Full RELRO      Canary found            Seccomp-bpf      NX enabled    PIE enabled             Yes

</comment><comment><USER25> DJB makes great code, but it always leaves a sour taste to use his code, because he has such a big ego and refuses to admit when he makes a mistake. He can't admit that it's possible to be the best but still make mistakes.

I really hate supporting that.

<comment><USER26> I once was talking to one of the household-name DNS guys and asked what he thought about djbdns and he said something along the lines of: "It's unfortunate that he's so abrasive, because he has some really great ideas that nobody will listen to because of it."

I've more recently come a little bit to terms with this whole abrasive thing being a brain chemistry artifact, and not just being an asshole for assholes sake. Because it seems to disproportionately impact those of us in the technical field. Not to excuse it, but to understand it.

<comment><USER27> I'm not a psychologist so I should probably shut up, but I'll continue:

It seems like it does hit the tech field more often, yet overwhelmingly I see leading people in tech get softer, more empathetic, and more open to outside ideas the longer they work and the more experience they gain.

Perhaps this is selection bias (the people I see are the "popular" ones, so of course they are the ones with more social awareness), or perhaps there is no hard and fast "genius requires ego". Note: I'm aware you didn't say that it did, you only mentioned that abrasive-ness seems disproportionately frequent in the tech field.

I'm all for improving our understanding and ways of communication - I've definitely known people in the "asshole" category that were surprised and bothered to discover that was how they came across - but I'm not interested in normalizing abuse as a necessary cost. Which, again, you didn't say nor imply, but the concepts are related to what you've brought up, so I mention it here because the topic is interesting, not as a counterpoint.

</comment></comment></comment><comment><USER28> This is why you don't run software that fossilized back in the nineties. Qmail was solid code but hasn't received the support and on-going development it needed. Use postfix instead for a secure MTA.

<comment><USER29> Your prejudice against out-of-fashion software is unfounded. Qmail had a bug because qmail had a bug, not because it hasn't been rewritten in the past week. The major web browsers, for example, are all under very active development, yet new RCE (!) bugs are regularly introduced into them.

<comment><USER30> "But we need to rewrite it with Rust!!" Crazy..

<comment><USER28> I said nothing about rust, and the alternative I proposed (postfix) is written in C.

</comment></comment></comment></comment><comment><USER31> Does anybody still use qmail in Production. I see on DJB's website that it is used in 700K sites but I doubt that assumption. Also the code has not been updated in almost a decade. How or why do sysadmins decide to go with qmail in 2020

<comment><USER32> You can use a heap of patches for qmail, but I wouldn't recommend it.

I was using Courier MTA for a while for self-hosting email.

I may do so again, and will likely use mailcow or mail in a box. Neither are based on qmail.

</comment></comment><comment><USER33> I would bet a lot of upvotes on this come from people misreading this as Gmail as I did :)

<comment><USER34> No. I ran several Qmails for many years on Mandrake with daemontools to supervise. All compiled from source. Lovely. "Life with Qmail" is a classic.

I needed some additional flexibility and switched to Exim for my MTA of choice instead but have fond memories of Qmail.

</comment></comment><comment><USER35> One thing that might help to improve overall qmail code quality (even though it's already written by a genius of our time) is to rewrite qmail in Rust[1].

[1] [https://github.com/notqmail/notqmail/issues/115](https://github.com/notqmail/notqmail/issues/115)

<comment><USER36> The only way that could improve the quality is for _DJB_ to rewrite it in Rust. If anyone else rewrote it in Rust, it would just contain different security bugs, and probably run worse.

<comment><USER37> The code is concise k&r c, converting it to any language could be an informative experience</comment></comment></comment>


LinkedIn called me a white supremacist because I happen to share a name with one - <AUTHOR> http://www.slate.com/articles/technology/technology/2016/05/linkedin_called_me_a_white_supremacist.html?wpsrc=sh_all_dt_tw_ru <comment><USER2> Not this serious, but when I updated my position from entry level at Microsoft to CTO of a startup, LinkedIn notified all of my connections that I was now CTO of MICROSOFT.

Customer service said it was a "known issue". My friends thought it was funny, but I'm stia little annoyed because it made me look sloppy.

Come on, LinkedIn, you have one job!

<comment><USER3> Turn off the option to notify your network in your Linkedin profile, that'll sort out most of these issues.

"Congrats on your new role !" \- No, dude, I got the promotion a year ago, it's just that I am now looking to jump ship so I updated my Linkedin

<comment><USER4> I often get suggestions to connect to my dead mother. I just figured linkedin liked me as much as I like them.

<comment><USER5> I get connect requests from women who are the manager of Ford Motor Company in Nigeria, or the Vice President of some bank in London, or other ludicrous and unlikely occupations. Always women. Every other day or so.

<comment><USER6> LinkedIn is just looking out for you. They know kids will continue your legacy, bigger userbase. Cough cough. >.<

</comment></comment></comment></comment></comment><comment><USER7> This is a good opportunity for everyone to disable this feature before LinkedIn sends any news articles to your contacts about you.

Go here ([https://www.linkedin.com/psettings/privacy](https://www.linkedin.com/psettings/privacy)) and turn off the setting labeled "Notifying connections when you're in the news". It's the last item in the first section. While you're still on that page, scroll to the bottom and enable two factor auth too.

<comment><USER8> This is also a good opportunity to close your LinkedIn account and never look back. Between the password thefts and algorithmically-generated libel, I have no idea why people continue to trust LinkedIn with their data and likeness.

<comment><USER9> Because all the information you add to your LinkedIn is public information that you want everyone to see.

It's not like Facebook where people can get access to personal photos or intimate conversations.

<comment><USER8> The person in the article didn't post that they were a white supremacist, but somehow LinkedIn communicated that to the world. The issue isn't that they're making information you added public, it's that they're making up information about you.

</comment></comment></comment></comment><comment><USER10> It's rather odd that their news algorithm exists in the first place.

I use LinkedIn for one reason and one reason only: to maximize my career options, both in scope and magnitude of opportunities. While I'm happily employed, I learned long ago that if you're not spending a few hours a month thinking about other career opportunities, you're hurting yourself in the long run. LinkedIn is a great platform to stay on top of that several-hours-per- month workflow.

For example, you see that an acquaintance has changed jobs....you send them a text...you grab coffee and talk about their career change....you gather the data point and keep your network primed. LinkedIn has made this process way easier to initiate than it used to be -- for me, at least.

So I really, really don't get why someone thought it would be a good idea to build an algorithm that assigns news stories to LinkedIn members. If I find myself in the news, and I think it's a cool story that makes me look good to potential employers, _I can share it to my LinkedIn network_. Hell, if I really like the article, I can embed it permanently on my profile.

Thank God I have a relatively rare first-last name combo that makes it very unlikely that something like what happened to Will Johnson could happen to me. That's straight-up nightmare material.

It's pretty boggling that LinkedIn would implement a feature that not only doesn't create value for its users, but actively poses a risk to their ongoing career development. The whole point of the site is essentially to serve as a cloud-mounted, data-rich business card. Why jeopardize that platform with crappy AI that spreads harmful falsehoods about members?

<comment><USER11> I think it's so that people can congratulate you first. Think of it as the "local boy makes good" storyline. I've done that a few times when I meant to email someone, got distracted, and was reminded when their name popped up on TwitbookIn or whatever the site is now.

And you're right, "Leroy Masochist" is a rare name combo.. ;)

<comment><USER10> That's a good point, but isn't the distribution of "local boy makes good" stories a bit of an edge case? I mean do we really need AI to do that for us at the risk of something bad happening?

I'm not trying to imply that you personally agree with LinkedIn's decision, by the way; just trying to get my head around why _they_ think it makes sense.

<comment><USER12> I think they see it as an issue where most of the time it's "close enough" that if it's wrong it'll just be wrong in a way that people will laugh off and that will _still_ generate engagement.

As long as the cases where it goes wrong enough to be offensive and hurtful are rare enough, there's very little downside to them.

<comment><USER11> That makes sense as the closest answer (but still guessing).

They could further limit it by location/region or companies mentioned to improve the quality but that may be overkill and reduce the number of notifications too much for their tastes.

</comment></comment></comment></comment></comment><comment><USER13> The web is simply a comedy of errors and agendas.

\- LinkedIn sends the wrong guy's network a libelous e-mail

\- Slate reports on said wrongdoing and has to issue corrections about the details [1]

\- Turns out the author is a writer with a play to hawk [2]

\- And the original 'White Supremacist' gets still more press than most of us want he and his organization to receive.

It all represents everything that is wrong with the web in a single post.

From the article's footnotes:

[1] *Correction, May 25, 2016: This article originally misspelled David Sacks' last name. It also misstated that his birthday party cost $125 million. It took place in a house then being sold for $125 million. (Return.)

[2] Will Johnson is a teacher and writer based in New York City. His newest play, Blue Balls, will premiere at the Labute New Theater Festival in St. Louis this July.

<comment><USER14> Given the context, I kinda hope the error/correction was intentional, committed by someone who doesn't like David Sacks.

<comment><USER15> so his name was misspelled intentionally so linkedin would not inform his lawyer and/or publicist of the article?

</comment></comment></comment><comment> daniel-levin How did this "Connections in the news" feature use a person's name and surname to uniquely identify them? This is appallingly asinine, as this example indicates. My name is as generic as they come, and so this is a risk for me. I wonder if LinkedIn were to group its members by name and count them, how many people (excluding those not on LinkedIn) would actually be uniquely determined by a name/surname combo? A quick search for "William Johnson" yields 7,476 results. Why didn't LinkedIn even ask this guy to confirm if he was indeed that William Johnson in the news? What an absolute fuck-up.

<comment><USER16> Did all 7486 William Johnsons on LinkedIn have that sent out to their contacts?

The top William Johnson on my LinkedIn page is black. I wonder if the algorithm cared about the race of the guy in the photo before sending out the mail. In some ways that would be even worse.

<comment><USER5> I don't remember: they don't ask your race on LI, do they? And let's hope, hope hope that they aren't doing facial analysis of photos for something that is absolutely irrelevant.

</comment></comment></comment><comment><USER17> >Correction, May 25, 2016: This article originally misspelled David Sacks' last name. It also misstated that his birthday party cost $125 million. It took place in a house then being sold for $125 million.

Kind of ironic, in an article about accidental identification.

<comment><USER18> I'm surprised that a "$125 million birthday party" passed the author's BS meter when he wrote it.

<comment><USER16> When you look at the other things he complains about, you can see he totally wanted it to be true, and so why bother checking it?

<comment><USER19> Unless of course no person checked it. Might this be, and I am wildly hypothesizing, an experiment with algorithmic content creation?

<comment><USER20> Using another source of algorithmicly generated content to produce its own content? If it was, then I'd love to see linked in do a news post with this as the news item, which could then force Slate to do a story update.

This guy would never _not_ be in the news!

</comment></comment></comment></comment></comment><comment><USER21> _> It's similar to the arrogance of Dropbox and Airbnb employees booting neighborhood residents off a soccer field they've used for years._

Seriously? People expecting to be able to use a field they reserved using the city's official reservation system is "arrogance"?

If anyone is at fault for that incident it's the city for not getting more input from community, or subsequently not communicating the changes.

<comment><USER16> It was tone deaf, especially posting it on the Internet.

But this article is a good reminder that there are folks who don't like property rights when the wrong people have them.

<comment><USER22> What "property rights"? Public space is meant to be available to, you know, the public.

<comment><USER23> > reserved using the city's official reservation system

</comment></comment></comment></comment><comment><USER24> I feel like the author went too easy on LinkedIn.

> I don't expect much from companies like LinkedIn, but when their > incompetence makes our lives more difficult, they could at least pretend to > care a little more.

This had the potential to do a lot more harm than just making his life "more difficult".

</comment><comment><USER25> I don't trust LinkedIn at all. They are constantly trying to trick you into engaging just a little bit more. One example is iOS accepts of invites to connect. They use cards to show network requests. Once you've gone through the pending batch they use the same card but instead of accepting your now requesting someone or congratulating someone. It's just one of those products where you need to constantly have your guard up.

</comment><comment> rm_-rf_slash I'm lucky in that I'm pretty sure my combination of first and last name is a first in history, but I feel for the "William Johnson"s of the world. He is lucky for having there been a notification about this. He could just have easily been passed over for job offers or more after a quick search and no correspondence, just a "we're not interested."

Maybe the European "right to be forgotten" has something to it after all...

<comment><USER26> I'm not searching for a job right now, but I've decided that the next time I do, my resume will also contain a "This is me" that says what is me on HN, reddit, github, etc., and a disclaimer that anything else with that name isn't necessarily me. There are at least two other programmers that share my name, one of which even has vaguely similar programming language skills, to say nothing of all the other hits it gets. And my handle "jerf" is merely rare, not unique, and not everything that comes up under that is stuff I'm associated with either.

I recommend this to everybody.

<comment><USER27> I feel reasonably secure that "Morgante Pell" is globally unique and "morgante" is only slightly less so.

</comment></comment></comment><comment><USER28> Incredible that they would ship something so potentially damaging when they openly acknowledge that it's unreliable. It would be trivial to include an emailed request for confirmation to the subject before spamming her/his contacts. Move fast and break people's reputations!

<comment><USER29> 1\. Establish a news website. 2\. Spend a few years so people respect your site as legitimate. 3\. One day, issue headline "LinkedIn executives X, Y, Z, etc. arrested in pedophile ring investigation". Or some other heinous crime. 4\. "Enjoy your update emails, you fuckers."

</comment></comment><comment><USER30> LinkedIn's likely response: "We had a 'Wrong Person?' link right there." See it? It's in color:#999999 way off to the right.

Edit: Reading the entire article, it appears that is more or less what they said.

</comment><comment><USER31> Honestly, I have no idea what LinkedIn's strategy and long term goals are. They are supposed to a professional networking site that helps members advance their careers. Now they are trying to play the Facebook and Twitter engagement game of "growth hacking" at all costs. It works for Facebook to spam people and do all sorts of questionable stuff since they are not a professional networking site. But it is completely misguided for LinkedIn to play fast and lose.

<comment><USER32> They've just started a gig-economy site (Profinder) using their social data to score the workers.

As if there wasn't enough of a reason to game them before.

</comment></comment><comment><USER33> Libel As A Service arrives!

<comment> rm_-rf_slash Nothing new: just post a misleading infographic to Tumblr and they'll take it from there.

</comment></comment><comment><USER34> There is a fellow with my exact name that used to live in the same town as I did, had a son with the same name as my son. He ran a startup and sold it for large dollars, but ended up with a giant IRS bill on the order of 8 figures.

And one of the fellows on my team worked for him before working for me.

Which is hilarious, but what was not so funny is that the perscriptions at Walgreens for our respective sons ended up tangled up and it took 45 minutes on the phone to straighten it out. After that, Walgreens began verifying your address.

Fortunately my story is mostly positive, unlike this poor fellow.

</comment><comment><USER35> A libel case resulting from a situation like this could be important in setting precedent for how responsible companies need to be with (for?) their AI.

<comment> rm_-rf_slash Simple: penalize the lack of oversight unless it can be proven that an AI/algorithm is significantly superior at performing a task than a human. So if a human trucker is asleep at the wheel while the AI drives and the truck crashes, fault the driver (and possibly company if policy) for negligence. If the driver is awake and the AI glitches out and the driver does the best they can to rectify the situation but still results in a crash, then it it was it is: a mistake.

<comment><USER36> The question is whether you are rating superiority on the overall set of classifications, or the smaller set of problems. I suspect it's a much easier task to make an AI that's better at reducing accidents than the general public, than it is to do that and also be better given a specific set of error conditions, such as "in a direction with a glare, and with roadwork and changed road conditions, correctly notice that the dog running ahead off to the side with people chasing it might be a situation that could spill into the road..."

In this case though, I imagine they allocated far more resources towards positive correlations than exclusions, since they just want a way to get their name in front of you.

</comment></comment></comment><comment><USER37> You have to code for the 99% of cases, not the 1%. You can't assume there to be more than one example of a combination of the fifth most common first name in the US and the second most common US surname. And even if that happens, you can't expect more than 1% of people to be named William Johnson, so it's better dealt with on a case-by-case basis. Linkedin's market cap is only 17 billion; they're not made of money.

</comment><comment><USER38> I dunno, I made a joke about "White People" years ago on Twitter (something like "White People won't dance") and then Klout figured I was an expert on "White People" and sent me a free subscription to the Red Bulletin.

</comment><comment><USER39> From the article: "The nature of profit is that you take more than you give, so it's not surprising that these billion-dollar behemoths that call themselves startups take far more from us than we get in return."

Other commenters have weighed in on this remark, which displays a shockingly childish view of economics. But if the author believes this, then his decision to use LinkedIn can not be rational, unless his goal is to lose.

I'm not on LinkedIn, but I get emails from them all the time. I assume it's just another cesspool and con job. This guy, at some point, decided to trust them with data about him. I'm finding it hard to feel very sympathetic.

<comment><USER40> You can fail to understand basic economics, and even make pretty dumb decisions, and still be pissed off if all your friends and colleagues get an email that says you're a racist.

</comment></comment><comment><AUTHOR> Holy shit.

<comment><USER41> Yup. But par for the course, when you have a culture of "good enough".

It's all fine until you accidentally Nazificate people...

<comment><USER42> He should be happy they think his name is real. You can get some real fun going when they won't acknowledge that.

</comment></comment></comment><comment><USER43> Of all the social networks, LinkedIn in seems to frequently do things that make it look like not only the shadiest social network but also the most incompetent.

</comment><comment><USER44> stopped reading when I hit this gem:

"The nature of profit is that you take more than you give,"

um, no, actually the nature of profit is that you generate more value than the worth of the inputs. Some (but not all) of that extra value is your reward for doing this. So in fact, the nature of profit is that you make more than you get.

I don't mind anti-capitalist diatribes every now and again, but getting the basics right is a must.

</comment><comment><USER45> How did this get to the #1 spot of Hacker News?

I love this forum because I find I can engage in meaningful discussion and actually get thought out replies, but it seems like any mention of LinkedIn, degrades into a cesspool of "LinkedIn only spams me!" (Uh... have you heard of email settings?) "LinkedIn is totally irrelevant, I don't understand why people still use it!" (Uh... okay, not everyone has a well paying, highly demanded tech job) "LinkedIn is literally satan. (Uh... okay no argument).

I'm all for constructive discussion about the engineering mistakes or product decisions behind this, but it just seems like its repeatedly the same inane comments about how "useless" LinkedIn is. It seems like stuff like this is always spun into a story about how evil or incompetent a corporation is, but I feel like we tend to forget that at the end of the day, behind these products are simply engineers trying their best to create tools and products that they think add value. (FYI: This email comes from a startup LinkedIn acquired called Newsle.)

(disclaimer: I work for LinkedIn)

<comment><USER46> Way to defend dark patterns. "Uh... have you heard of e-mail settings?" is particularly tone-deaf when it comes to the terribleness of LinkedIn's e-mail settings.

If the best argument for your product is that people literally have to use it to get by, that's not something to be proud of.

<comment><USER45> I'm not responsible for the email settings, but could you point out exactly what is terrible about LinkedIn's email settings? I'll link it to you directly: [https://www.linkedin.com/psettings/email- controls](https://www.linkedin.com/psettings/email-controls).

I've had no problem unsubscribing (even as an employee, I'll admit a lot of these emails are not useful to me). The volume of email I receive from LinkedIn, even before I unsubscribed, was much less compared to what I get from Hipmunk or Airbnb. But I don't complain about that in a public forum, because I realize I can unsubscribe, and it's a minor nuisance. (Also, not to bash Airbnb, but I'm a host and I really want to unsubscribe from receiving emails when a guest messsages me, but I can't find the option anywhere!)

It's not my job to convince you to like LinkedIn, but I want to make it clear that our engineers are not in the market of "dark patterns" or whatever you want to spin it as. I will eagerly forward any feedback you have to the engineers who work on email/privacy settings.

<comment><USER46> Here's the hilarious thing about that page. I've been there before in an attempt to opt-out of LinkedIn e-mails. It has a lot of categories of e-mails it wants me to opt-out of separately, and I know I opted out of all of them that I possibly could last time I was there. (I believe there were other well- hidden pages I also had to go to.)

Since then, you've _added_ one called "Jobs and Opportunities", and it's switched on. This has happened before. Of course your company is aware it's doing this, but it would be bad for business if you never sent e-mail to people just because they unsubscribed, wouldn't it.

It's great that you had me check because now I have solid evidence of the "adding new categories that are automatically opted-in" behavior.

How _often_ do you expect me to log in to LinkedIn, a service that I hate, and remind it that I really don't want its spam?

<comment><USER45> Well... I'm sorry that you truly hate LinkedIn, and you're definitely free to use whatever services you like. I think you bring up a valid point about emails being default opt-in. Honestly, I'm just a junior engineer so I don't have much sway, but you can take my word that I'll try to find the owners of the email service and bring your issue up.

</comment></comment></comment></comment></comment><comment><USER47> LinkedIn is now what Yahoo was after the Microsoft offer fell through.

They're just going to stay in a state of limbo, doing stupid things like this (I bet this 'product' has a whole Product team behind it), getting presumably half of their userbase pwned (makes you wonder if Yahoo ever experienced that) and doing whatever they can to milk their resource/site for new revenue.

I don't think anybody can suggest a decent way for them to keep growing (in numbers and revenue) without some element of sleaziness involved, because they've probably attempted those sleazy strategies already.

Sadly though, like so many proponents here say, LinkedIn has become the monopoly in the professional networking market. So we're all stuck with a shit site that makes privacy-related matters _opt-in_ and nothing can really be done about it (suggesting that a _" better linkedin"_ be started isn't exactly an option either), but we all need it to find better jobs or grow our networks.

<comment><USER5> > I bet this 'product' has a whole Product team behind it

I bet this product was done by an intern who's no longer there, and lots of people at LI don't even know it exists until someone complains about it.

</comment></comment><comment><USER48> _slow clap_

It sounds like a database call somewhere has a cardinality bug, or that they search purely by name instead of some unique identifier.

<comment><USER49> I'd guess they just search by name, that's all they consistently have to go off for news stories from a third party.

<comment><USER50> What I wonder is, from a libel perspective, is putting an up-front disclaimer that your association of a person with information is done without even rudimentary validation that is true information about the person it is associated with a _defense_ against libel, or just an _admission_ of one of the key elements of the tort?

I'd be interested to see this litigated; I'm hoping the latter, because otherwise I expect the rate of algorithmic defamation to increase to rather intolerable levels in the not-to-distant future.

<comment><USER51> From my newspaper days, no amount of disclaiming will get round the fact that they put a picture of the guy next to the article. The test in the UK is if whatever you publish will make a reasonable person think worse of an individual and there are only a handful of very specific defences available, the best of which is that whatever you say is true.

<comment><USER52> Libel laws in the UK are notoriously very favorable to the plaintiff. At least in the US, the test is more along the lines of "knowingly false".

</comment></comment></comment></comment></comment><comment><USER53> I'm not entirely surprised. The LinkedIn site and customer service is just awful. Then again I'm not their customer, I'm their product so why should they give a shit about my issues or the issues of the author? Granted mine were more minor but I reported all sorts of issues with their messages system all of which have gone unresolved but one (took them months to finally make my notification indicator go away; an issue one of their engineers confirmed to me was an issue).

Honestly I would just close my LinkedIn account but being in the technology industry it seems almost impossible to escape it if you want to have a career. Yes you don't _need_ it but not having it makes applying for jobs, having people find you, and even you finding jobs all more difficult.

<comment><USER50> > Then again I'm not their customer, I'm their product so why should they give > a shit about my issues or the issues of the author?

You aren't their "product", you are one of very many suppliers, each of which provides a very small quantity of the product they are reselling.

Which is not to say your general point is wrong, but LinkedIn and similar firms aren't in the slave trade.

<comment><USER53> > LinkedIn and similar firms aren't in the slave trade.

It's just a generalization that people use to describe a technology company that essentially requires users to bring value to a company's paying customers.

<comment><USER50> I'm familiar with the pattern: I'm saying that its a bad description, and that there is a much better one available.

<comment><USER53> I don't know seems pedantic to me. I see a very minimal difference between the two. Doesn't even seem like a worthwhile conversation to be honest.

</comment></comment></comment></comment></comment><comment><USER54> Whilst abhorrent, it's easy to see how this happened. No matter how much you train a machine it will make mistakes in this kind of classification when natural language is involved. Identifying that an article is about something or someone is a very very hard problem.

<comment><USER55> I agree. I feel this points towards the limits of linguistic-based technology. Relying just on text strings to find correlations/matches is not enough. What I wonder is: why don't recommendation engines go beyond and try to cluster entities by more sophisticated means? It must be possible to determine that, in this case, the person involved was not clustered -not 'close enough'\- to the universe of entities related to white supremacists. Relying just on words/names will lead to this kinds of results, specially where ambiguity is involved (the person's name is unfortunately very common).

</comment></comment><comment><USER20> Their response time to this sort of thing is dreadful. If their algorithm is this inaccurate and potentially harmful then they need to be responding within at least 3.75 hours to the reporter and within the day they should have a correction that goes out the door.

I wish that they had been sued in this case. There's nothing like losing lots of money on lawyers and damages to drive positive change in most large companies. Pity it has to be that way, but it was a calculated risk that nobody would have their reputation harmed by this dodgy algorithm.

</comment><comment><USER56> The quote re: David Sacks is incorrect: UPDATE: Sacks tweeted to correct our sources' recollection of the invitation they'd seen: "It's 'let _him_ eat cake' not them. It's a birthday party. Get it?" We get it, David. Apologies for the error. ([http://www.businessinsider.com/yammer-david-sacks-party- let-...](http://www.businessinsider.com/yammer-david-sacks-party-let-them-eat- cake-2012-6))

<comment><USER16> It's good to see how little this author cares to fact-check negative stories about people he doesn't like.

Is sending out a incorrect and reputation-damaging statement better if done by an dumb algorithm or by a self-absorbed human?

</comment></comment><comment><USER57> Linkedin keeps suggesting a girl I went on a date with ONE FREAKING MISTAKE OF A TIME, who I seriously never ever want to talk to again, is a potentially awesome connection. I know it's because she let them scan her email inbox. This actually disturbs me more than something which is obviously a mistake. If my professional connections mistake me for a nazi war criminal, well, they're so stupid, they're not worth knowing.

</comment><comment><USER58> I closed my Linkedin account few days ago. I'm still baffled at how little my life has changed. Actually I just stopped receiving annoying messages!

<comment><USER39> I've never been on LinkedIn and they spam me constantly.

</comment></comment><comment><USER59> I have a moderately common name, shared by several people with more impressive public accomplishments than I have. I always laugh about people Googling someone's name to research them, because that'd be completely impossible for me without adding a few search terms.

But you don't even need that. If you've ever searched Facebook for a name, surely you know that most names are not unique identifiers.

</comment><comment><USER60> Man a similar thing happen. Some random tech blogger wrote an article about a node module I wrote calling it "a new npm" _cringe_ it was pretty embarrassing to say the least.

I wouldn't have shared the article with anyone but all of my LinkedIn connections got pinged with the article. The CTO of npm even called out the article on Twitter. Super embarrassing.

</comment><comment><USER61> I ended up deleting my LinkedIn and now days I send traffic meant to go to LinkedIn towards localhost in my /etc/hosts file.

</comment><comment><USER62> I'm very glad about less freedom of speech here in germany. It surely has it's downsides (mostly because it's a slippery slope). Here you would win big in court (several hundred euros, you're rich afterwards), but also you'd win the right to publish a correction on the same place and the same prominence as the original article.

</comment><comment><USER63> My favorite - if you don't like somebody, give them an endorsement for water fall project methodologies.

</comment><comment><USER64> Shit like this, plus the leaked passwords is why I decided to deactivate my LinkedIn account altogether

</comment><comment><USER65> I'm thinking if he wanted to it could be a good oooortunity to come out with a project promoting compassion and do his own humorous meta campaign negating the extremism of his namesake.

</comment><comment><USER66> My father-in-law has the unfortunate name "David Duke" AND lived in Texas. He always gets asked if he's the leader of the KKK.

He tries to take it in stride and not let it affect him.

</comment><comment><USER67> I don't understand how people can believe that Google or Facebook "sell people's data" as claimed in the article.

Both of these companies very clearly run their own ad networks and sell people's attention and time, not their data. Why is this completely inaccurate claim so often repeated? Because it's catchy?

Getting angry at how Google and Facebook make money is like getting angry at a cable company for showing commercials. It's not their fault that people watch so much horrible television, nor is it LinkedIn's fault that the author continues to use their horrible site.

<comment><USER68> Well, that's splitting hairs, isn't it?

If I run a pizza parlor, and somebody describes my restaurant as "selling flour, water and cheese", should I loudly object "No, in fact I take those ingredients and process them into something _else_ that I sell!"

<comment><USER67> No, they really are different. The objectionable part seems to be that data should be protected and respected, while products made using the data should be treated with less careful scrutiny. Nobody would object morally to a restaurant selling flour, water and cheese.

I think a more apt analogy would be somebody describing the pizza restaurant as "selling an insult to Italian culture". The sale of a culture seems morally objectionable, and the statement is emotionally charged.

</comment></comment></comment><comment><USER69> Well there's one benefit of having an uncommon name (I've never even met anyone outside of my family with the last name Matyi).

</comment><comment><USER70> Irony wants that the author made a mistake himself when writing that post. See the (*) note at the end of the page.

</comment><comment><USER71> Google+ (remember that) keeps asking me if I know myself. It's very existential but clearly idiotic.

</comment><comment><USER72> > The nature of profit is that you take more than you give, so it's not > surprising that these billion-dollar behemoths that call themselves startups > take far more from us than we get in return.

This is an excellent argument for prohibiting the existence of companies, or any commercial transactions at all.

<comment><USER73> But it's not true.

The nature of profit is that you make more than you spend. But that does not mean you take more than you give - value is also created in the exchange (or at least it should be).

(Maybe that is what you're pointing out, reductio ad absurdum? I'm not sure.)

<comment><USER72> Yes, that was my point. The nature of profit does mean that you receive more from your customer than you give back to them. Gains from trade mean that your customer also receives more from you than they give to you.

I was going to provide that as further text to my original comment, but thought it would be more effective to let the quote speak for itself.

Guess not. :/

</comment></comment></comment><comment><USER74> Isn't LinkedIn supposed to have an amazing data science team?

Hmmmm.

</comment><comment><USER75> Is this not why we have libel laws?

<comment><USER76> I think intent factors in. LinkedIn's information was false but (in all likelihood) not malicious.

<comment><USER51> Being malicious makes defamation worse, but it doesn't have to be malicious to defame.

</comment></comment></comment><comment><USER77> Libel lawsuit immediately...

</comment><comment><USER78> > My email included the words libel and attorney

I understand why this is offensive, but really?

<comment><USER79> If an organization circulated emails to all your professional contacts which stated that you were a "white nationalist", would you sit back and rely on their good intentions to resolve things?

Especially if your professional contacts weren't people that worked in tech that could spot a shitty algorithm from a mile off

<comment><USER78> I'd send an email asking them to change it.

actually it's linkedin, so I'd probably delete the email without reading it and maybe email them when someone asked me about it later.

</comment></comment></comment><comment><USER80> Is this really a problem? The author doesn't say that anyone from his linkedin network contacted him and asked "Are you a white supremacist?" Most people would see the headline and immediately realize that it was an algorithm error, a common part of daily life. Anyone who was invested in the author's reputation would probably check the details of the story and see that it was talking about a completely different person. I have a hard time imagining that anyone was fooled by this.

If someone could possibly confuse me for a white supremacist Donald Trump delegate then either 1) that person isn't trying very hard and I probably don't want to work with them or 2) I need to take a serious look at my life choices

<comment><USER81> _At this point, I'd received a bunch of messages from confused connections_

i.e. some of his connections had contacted him.</comment></comment>


Opensource WinRT subsonic client - <AUTHOR> http://apps.microsoft.com/windows/en-US/app/subsonic8/1b8ef98c-8e57-48ea-b55b-57e70355a717 Subsonic is our open source subsonic client.
At the moment, a user can:
play audio filss play video files search for songs/albums/artists can create playlists (not Subsonic playlists but a specific format) shuffle songs
We plan to add some missing features that where not so critical right now like: progress bar for audio playback skipping inside a while file playing it use the random songs feature of Subsonic save/load playlists to Subsonic
Fork us at https://github.com/agilefreaks/Subsonic8 <comment><AUTHOR> Subsonic is our open source subsonic client.

At the moment, a user can: play audio filss play video files search for songs/albums/artists can create playlists (not Subsonic playlists but a specific format) shuffle songs

We plan to add some missing features that where not so critical right now like: progress bar for audio playback skipping inside a while file playing it use the random songs feature of Subsonic save/load playlists to Subsonic

Fork us at <https://github.com/agilefreaks/Subsonic8></comment>


Facebook Case Study: Atlas and Tommy Hilfiger [pdf] - <AUTHOR> https://atlassolutionstwo.files.wordpress.com/2015/08/atlas_successstory_tommy-hilfiger.pdf <comment><USER2> Great, but like most case studies this glosses over the technical details that industry folks like myself care about.

Things like:

\- If ads influenced only 13% of in-store purchases, were they able to determine if they were actually profitable from an ROAS standpoint?

\- How did they determine attribution weighting and what model did they use? Static? Dynamic? This data tells me "we hit the right people and serving multiple touch points across devices seems to show an increased likelihood of converting" but we still are left blind as to how they leveraged that data to determine the _incremental_ value of the display dollars. Ie. what is a viewthrough worth? What is an impression worth? Ultimately those are the questions that matter.

\- How accurate is the data? Cross-device tracking and especially in-store tracking are far from super accurate at this point. They often rely on cookie onboarding brokers and such to map CRM data to cookie IDs in the DSP, and there are definitely gaps there.

Cross-channel attribution is incredibly cool and Atlas is doing some very interesting things there to try to prove the value of display. This barely scratches the tip of the iceberg though.</comment>


Flexible Muscle-Based Locomotion for Bipedal Creatures - <AUTHOR> http://www.cs.ubc.ca/~van/papers/2013-TOG-MuscleBasedBipeds/index.html And the demo video from SIGGRAPH: http://vimeo.com/79098420 <comment><AUTHOR> And the demo video from SIGGRAPH: [http://vimeo.com/79098420](http://vimeo.com/79098420)</comment>


Ask HN: Day-by-day plan for starting gym - <AUTHOR> I have never stepped inside a gym and would like some help (day-by-day plan/curated lists) for first timers.<p>Bonus points if it includes nutrition/dietary guidelines too. <comment><USER2> I used this workout for a while. [https://stronglifts.com/5x5/](https://stronglifts.com/5x5/)

Simple, fast, and basically any gym will have the necessary equipment.

If you don't know the exercises, the videos are good. But getting someone to teach you how to properly squat, deadlift, and press is worth the trainer time. Or basically any friend who has spent anytime in a gym should know those exercises.

<comment><USER3> I cannot recommend this enough. The app is so simple and the workouts are around one hour (with heavy lifts).

I highly recommend Mark Rippetoe's book Starting Strength[0] to learn the mechanics of the lifts. StrongLifts is a sorta rip off of Starting Strength.

[0] [https://www.amazon.com/Starting-Strength-Basic-Barbell- Train...](https://www.amazon.com/Starting-Strength-Basic-Barbell- Training/dp/0982522738/ref=sr_1_1?keywords=Starting+Strength&qid=1555959117&s=gateway&sr=8-1)

<comment><USER4> Careful with that: [https://i.imgur.com/2WOj0eN.png](https://i.imgur.com/2WOj0eN.png)

</comment></comment></comment><comment><USER5> I learned a lot by joining a good CrossFit gym. I can now do my own thing, but that would have been daunting previously. The absolute worst thing about CrossFit is quality control. Not knowing anything to start makes it hard to find one. Ask them when you go in about mobilization/stretching/warm-ups and cool downs and how they are managed in the program (ideally baked in). Ask about how they handle skill progression and scaling exercises based on ability (they should talk about safety and form and not pushing to do the workout "as prescribed"). Ask how they can help when things become stiff or sore (they should want you to bring up this stuff and be able to give you suggested stretches and tips). Ask if they have a anything guiding their workout programming (they should have cycles they go through focusing on different skills or muscle groups). Ask if they do nutrition guidance. You might have to go to a few places before finding a place that has answers for all of these. The advantages are pushing harder than you will on your own, trying things you wouldn't have know to try, suffering with a small group of people and building a sense of community, and getting stronger and fitter.

Edit, oh, and ask about class size to instructor ratio. Smaller is better. I think the sweet spot is sub 10 to one instructor. It allows them to really notice how you are doing and give one on one improvement help.

</comment><comment><USER6> I think the single most important part of starting out at the gym is to keep it as simple and friction-less as possible. The most important thing is to go consistently for a couple of months. Most failures happen when a person skips one day, than decides to call the week, and snowballing from there to not going.

If you've never been to the gym, a lot of the equipment may be intimidating, so skip it for now. For the first couple of weeks just get on the treadmill/elliptical/whatever for 30 minutes. As you build a routine, you'll be able to branch out from there.

</comment><comment><USER7> If you're completely clueless, I would join a gym with a range of machines. Machines are great, because they are low skill, you don't have to talk with anyone or feel embarrassed if you're not doing an exercise correctly.

Level 0:

Write down some goals you want to accomplish. For me, I want to do 15 pull ups without a rest. But it could be run a mile in under 8 minutes. Write down when and how often you will be going to the gym. Hold yourself to this.

Put this list in a place you will see it often.

Level 1:

At the machine, sit down, look at the picture, do the the motion (at a light weight) 10 times. Move onto the next machine. If you have questions about how to use a machine, ask the staff.

Here, you are forming the habit of going to the gym. Don't worry about pushing yourself. Just focus on going to the gym 3 times per week. as u/jhauris said, keep things as friction-less as possible.

Level 2:

After a couple weeks of level 1, start doing multiple sets at each machine. Do the motion 10 times, rest for 1-2 minutes, do it again. repeat 3x. Stay in the gym exercising for at least 60 minutes.

Level 3:

After 2+ months of this, you can add cardio before your workout. If you have a bad back, try the bike machines or stepping machines. Many gyms offer classes which can be fun and motivating as well.

Level 4:

You will start noticing your weights are not improving as fast as they used to. Up to this point, you have been doing a full body workout each time you're at the gym. You should try to shift into using the free weights with a focus on different muscle groups per day. Monday: Legs; Wed: Back and biceps; Friday: Chest, shoulders, and triceps

<comment><USER8> I've done this a few times, but the depressing thing with fitness is that you can recede. I was able to run 5km or do 20 push ups a while back, but now I struggle to do 3km. The depressing part is realizing that it has to be a maintained lifestyle thing.

Running has some morale benefits, like scenery and fresh air. Sports has social benefits. Machines not so much.

</comment></comment><comment><USER9> Non-gym option, follow these instructions: [http://www.startbodyweight.com/2014/01/basic-routine- infogra...](http://www.startbodyweight.com/2014/01/basic-routine-infographic- poster.html)

Skip the parts that require a pull-up bar the first week or two, of course, because you don't have one yet.</comment>


Ask HN: How much do you pay for Google Cloud? - <AUTHOR> I migrated to GCP a couple months ago, and I love it. Super convenient, great services.
But boy oh boy, every time I check that billing tab it gives me a mini heart attack. I am scared to look anymore, the damn thing gives me anxiety.
I got two Kubernetes clusters with small instances for two of my side projects, and a VM for automation stuff.
One month the forecasted cost was over $800 ... I panicked, I cut as many corners as possible. This month I got an invoice for $250+ ... which is manageable I guess, but the forecasted amount for April is around $450... Come. On. Google, you're killing me here.
So, I guess what I'm trying to find out is how much do you guys pay for Google Cloud and how are you keeping your cost under control? <comment><USER2> We are around 3-7k / month.

We do: \- big nodes -> less k8s overhead [https://cloud.google.com/kubernetes- engine/docs/concepts/clu...](https://cloud.google.com/kubernetes- engine/docs/concepts/cluster-architecture#memory_cpu) \- [https://github.com/kubecost](https://github.com/kubecost) -> grafana shows us what we spend \- autoscaling -> default nodepool for stuff which has to run \- keeping logs and especially metrics on gcloud low. Metrics are really expensive

Thats what we do professionally. For my startup, i use digital ocean as it is just so much cheaper and my trusty homeserver (core i7, 32gig ram, 4 hdds with zfs, 1tb nvm ssd) runs argocd + gitlab builds.

This way i have the much cheaper server at home for all load related things and as my server was build as low power machine, it only consumes 50watt if it is not doing anything.

With this setup i predict something like 100-250,- Euro per month infrastructure costs.

Of course buying that server would cost something like 500-700,- Euros but i had it running already and i'm using it for tons of other things. And the hardware inside is already 3 years old (core i7 2700k) but still much cheaper then using GKE nodes.

If i would not have the option to have a homeserver, i would probably configure my GKE cluster to connect with a very lightweight service mesh an additonal node from some other server provider like hetzner.de. They offer very current core i7 with 32gig/64gig for 50,- Euros per month.

It clearly depends what you have more: Money or Time. I personally have more time on my hand then Money so i don't mind really having a slightly more complex and more self managed setup. I also did not spend more then 1-2 weekends on getting it running. Nonetheless if you can bill your hours, thats probably not worth it.

<comment><AUTHOR> Great insights, thanks for sharing. Recently I found myself plotting how much extra time I spend on maintaining and configuring, which is basically the money vs time problem. No conclusion reached yet on my side.

</comment></comment><comment><USER3> I pay ~$300 a month for a small application. gcp & K8s is great services but it is not good for your bottom line or startups.

Kurian is focusing on enterprise customers

<comment><AUTHOR> Yeh I agree.

</comment></comment><comment><USER4> You need to look at the billing tab to see what's costing you.

I recently reduced a company's spend by 60%

\- increase VM size in k8s, force cluster pool size down \- turn off stackdriver logs (want to run EFK here instead)

Why do you need a cluster per project? The point of k8s is to run lots of applications in the same cluster to reduce costs.

FYI, your k8s clusters will start costing ~$72 / month in June (iirc)

<comment><USER2> As far as i know, k8s stackdriver logs are included.

We create a few hundred gb k8s logs per month and we also run grafana/prometheus but i would highly doubt that running grafana/prometheus/loki etc. yourself is cheaper then using stackdriver.

<comment><USER4> It is, we have proof by billing statements

1TB of logs is $500</comment></comment></comment>