Node-Red – Flow-Based Programming for the Internet of Things - <AUTHOR> https://nodered.org/ <comment><USER2> While I personally never used Node-Red to build anything, I am now a fan of this technology for a simple reason: I saw non-developers happily creating & deploying working and reasonable-quality solutions with it (more than I can say about several tools to supposedly allow non-developers to build working software).

When someone in the business team mentioned they were using this tool to automate a few flows I assumed it would be an abject failure (as happened in so many similar projects I saw before - in some cases in multi-million deployments with huge teams of tools such as PEGA ).

Fast forward a couple of weeks and to my surprise an entire pipeline of needs from the operation where solved/fulfilled with almost no interaction from anyone in the development team. More than that: the end result is understandable.

Cavet emptor, maybe other teams will build horrible piles of crap with it, etc, etc but overall I am still impressed.

</comment><comment><USER3> Another version of this is called "OctoBlu":

[https://octoblu.github.io/](https://octoblu.github.io/)

[https://github.com/octoblu](https://github.com/octoblu)

What I recall of that project:

I first came across the project at a meeting in Mesa or Tempe, AZ where they first started. This was sometime in 2013, I recall going to the TechShop pre- open-house, and also a Desert Code Camp around the same time period.

Chris Matthieu was the leader behind the whole thing, from what I recall. At that time, it was called "SkyNet" (if you scroll to the bottom of their page they mention that - but originally it was only called SkyNet - OctoBlu came later; Chris always mentioned the name change as being better for marketing).

SkyNet/OctoBlu was pretty advanced by this time, so I think it had been in development prior to this for a while. I don't recall when Node-Red first came out, though the GitHub repo has the first release (0.2.0) in October 2013.

OctoBlu/Skynet were later acquired by Citrix:

[https://thenewstack.io/citrix-acquires-octoblu-the-drone- net...](https://thenewstack.io/citrix-acquires-octoblu-the-drone-networking- company-formerly-known-as-skynet/)

...but then sometime later that didn't work out and Citrix dropped them, and Chris open-sourced everything.

Actually, it had been pretty much open source prior to that; in fact almost everything. What wasn't open source was the flow/node editor. Even now, it's difficult to find in the various repos, but if you dig, it is there.

I always liked the project because of how well it worked, how easy it was to create a flow diagram/system using the various node types available (there were a ton of them that I recall), plus how relatively easy it was to create new nodes (all in javascript/nodejs, that I recall).

It's too bad that Citrix didn't keep them around, but I am glad that Chris chose to open source everything for others to play with.

<comment><USER4> I was at Citrix when they dropped Octoblu, I agree it was a shame. I remember Chris giving a really interesting talk to my team about Octoblu and thinking it was super cool, and James Bulpin used to do some really cool demos with it around automating meetings and workspaces - there's probably stuff on Youtube actually. Those demos moved to Azure IOT, but I'm not familiar enough with either to talk about how they compare. Interesting that Chris ended up at Magic Leap too!

</comment></comment><comment><USER5> We tried this 3 years ago. All hosted by IBM. Support provided by IBM. Part of their cloud push.

The IBM DB2 connector from Node-Red would slowly and surely leak resources and finally disconnect after a couple of days. Took us weeks to figure out what was going on. No one could help us. No way to debug things.

Would recommend it for kids as a playground. Would recommend IBM cloud (bluemix) for kids as an expensive playground. Would not recommend either for production.

<comment><USER6> I am not sure if IBM can deliver anything nowadays. I had a run with their cloud but I would change profession rather than working with their system ever again.

<comment><USER7> IBM deliberately over-complicate and obfuscate technology, so that their Global Services can steal customers' wallets. To this end, they push for premature standardization of over-engineered specs through committee capture of OMG and occasionally W3C - just look what they did to SOA (IoT beware).

IBM is following the hallowed path of GE: lose your core business and use buybacks to prop-up dividends and the share price. Swapping equity for debt makes sense when interest rates are at 5,000 year lows.

A cartoon character who runs off a cliff can keep going for a while, but when they look down, to see business declining and interest rates rising, they fall rather rapidly, as gravity takes over from leverage.

I don't think Big Blue will survive the 2019/20 depression.

<comment><USER6> Not sure how could they let this go sideways. They used to create the most powerful computers and todays they create crappy nodejs frameworks. Maybe the world changed this much?

<comment><USER8> They became a "services" company which means they want that recurring revenue. When they sold a few million dollars in hardware to a company they didn't make another sale like that to that company for awhile. Sure, they could sell some software to the company but at the time, that paled in comparison to the hardware sale. Which was fine because a lot of companies back then were buying that hardware and the hardware kept getting faster and faster and after awhile IBM could convince those companies that an upgrade would result in faster revenue, which it would.

But in the early 90's things got fast enough. Little old PC's, in particular, could crunch things that the mainframes choked on 25 years prior, so companies started buying lower margin PC's instead of the mainframes. Companies like Microsoft and Dell were in the positions of power that IBM used to hold.

So Lou Gerstner came along and said, "Let's transition into a services company. Customers will pay recurring revenue to have IBM solve their problems on IBM hardware that the company buys or leases. And the sky's the limit on how much we can bill in services!"

As an aside; this happened to Qwest (now CenturyLink). IBM literally bought Qwests IT staff and leased them back to Qwest. I know someone who was part of that. It was a nightmare. The level of bureaucracy that IBM added was obscene. It took weeks of emails back and forth and meetings just to get approval to change a password.

Within about 15 years those hardware margins got so thin that IBM sold off its PC business to Lenovo and doubled down on services. And, as one commenter mentioned, they now had a direct incentive to make things even more complicated so that their services team could bill out even more.

Do they overcomplicate on purpose? I honestly don't think so. I think it's an emergence effect of a) trying to do things too fast without thinking them through, b) the aforementioned bureaucracy which is crippling, and c) offshoring a lot and which doesn't always get you the best quality. They still have a semblance of "Nobody ever got fired for going with IBM" working in their favor and they know it so nobody in a position of authority corrects that emergence effect, if they're even able to see it happening at all.

</comment></comment></comment></comment></comment><comment><USER9> Nice to see it mentioned here :) I am currently using it as a "helper application" to perform certain tasks such as health checks of my projects and automating several GitHub actions. I have wrote several blog posts about it: \- simple health check: [https://dev.to/krusenas/creating-your-own-health- check-monit...](https://dev.to/krusenas/creating-your-own-health-check- monitor-with-node-red-51fn) \- regenerating brew formula hash on update: [https://dev.to/krusenas/automating-github-tasks-with-node- re...](https://dev.to/krusenas/automating-github-tasks-with-node-red-3cgc)

While these things are trivial to do in my preferred languages (Golang, Python or Javascript), doing it in Node-RED is kinda fun.. :) Very easy to experiment, extend and do pretty much anything you want. You can always use a "function" node to just write some custom javascript logic if you see that you can't find a suitable node out-of-the-box.

All in all, I think Node-RED really shines when it comes to home automation. Comparing it to alternatives such as Home Assistant, Homeseer or Domoticz, it's a lot easier to understand what is happening and why. Of course, there's less magic involved here and it might make things a bit more difficult for non-developers, but the end result is definitely more stable and better long- term.

</comment><comment><USER10> Node-Red pretty much runs our hackspace. It integrates with almost everything. I'm also using it quite a lot professionally for prototyping. If you really know how to use it you seldom need Javascript. Most things can be done with switch, change and template nodes. If you want to get good with Node-Red look into JSONata.

The last project I did with it was reading data from modbus and sending it to SAP and vice versa. We don't have it in production, but I guess it will happen some time.

<comment><USER11> Which hackerspace is this? I'd really like to see it in action once.

</comment></comment><comment><USER12> Previously:

[https://news.ycombinator.com/item?id=8217664](https://news.ycombinator.com/item?id=8217664)

[https://news.ycombinator.com/item?id=8419984](https://news.ycombinator.com/item?id=8419984)

[https://news.ycombinator.com/item?id=13495156](https://news.ycombinator.com/item?id=13495156)

</comment><comment><USER13> Just a warning for anyone wanting to try it: make sure to set up authentication first thing. Last time I checked, this was not obviously mentioned anywhere in the "Getting started" tutorial.

[https://nodered.org/docs/security](https://nodered.org/docs/security)

By default, without auth setup, you're basically opening a friendly, public remote code execution web portal on a high TCP port. It's bound to all network interfaces (not just localhost as you would assume).

<comment><USER6> IoT default security is no security at all. Who needs that anyways, not the teenage kids in Eastern Europe who just want to have a 100GBPS ddos network.

<comment><USER14> The "S" in IoT is for security

<comment><USER15> Internet of ThingS, indeed security comes last.

</comment></comment></comment></comment><comment><USER16> I used it 3 years ago or so, but ultimately decided against it and went back to Python/Go for creating my IoT integrations.

It works (worked?) well, but had a few "gotchas" like where your workflows are stored, configuration, logging, monitoring of application status, and general NPM upgrade madness.

There is (probably) also the general issue of 4th gen development tools (point & click) where maintaining a codebase is rather tedious. I've worked with WebSphere Message Broker in the past, and major upgrades could be a chore.

I'm aware most of the issues i had have been fixed in later versions, but i've not had the need/urge to go back and try it again. That doesn't mean others shouldn't.

<comment><USER17> Interesting, I've always had way more trouble with pip than npm/yarn ecosystem.

<comment><USER16> Pip is easy once you start using requirement.txt files and virtualenv/docker/jails/whatever.

it all boils down to "pip install --upgrade -r requirements.txt"

Where most people start having trouble is when they install some packages through rpm/apt/pkg and then install others through pip, and there are shared dependencies between the two sets of packages with different versions.

</comment></comment></comment><comment><USER8> We tried this on a project with not great results, chief among them being the project maintainer always classifying a problem or defect as "Not a bug" even when it provably is.

<comment><USER13> I didn't have any contact with the maintainers, but I found node-RED pretty reliable. It was nice to work with, even though I'm not a big fan of Javascript and Node ecosystems. The third-party blocks from their web library did tend to be pretty buggy in my experience. I tried to stay away from them and (re-)implement my own blocks where I needed them.

Perhaps the worst offense was the insecure-by-default config I mentioned in the other comment. I was unknowingly running it on a public port on a dev machine without auth for months before I realized (the network I was on didn't happen to filter inbound connections on ports >1024).

I used Node-RED pretty extensively for controlling experiments (see e.g. [https://github.com/avian2/sigfox-toolbox](https://github.com/avian2/sigfox- toolbox))

<comment><USER18> Yep. This is probably the only egregious default. And that's horrible.

It should, like any other Linux server, be available via ::1 and 127.0.0.1 without credentials. Better yet would be to automatically run a credential script on install to bootstrap, as this project focuses on ease of use of node.js and modules.

I had my own bugs as well that I reported, to no avail. I did find solutions myself.

<comment><USER19> Hi - would like to hear what bugs you reported to no avail. There may well have been good reason they weren't addressed to your satisfaction - or we may have simple not fully appreciated what you were reporting.

<comment><USER18> Indeed. My bug was that setting/changing a proxy required restarting the service, something the service itself could not complete. I needed this to establish connections to Tor hidden services.

Instead, I fixed this via the DNS resolver daemon within Linux itself, so my systems natively can handle .onion sites. In a way, it was a better fix, since every program is torified if connecting to an .onion .

</comment></comment></comment></comment></comment><comment><USER20> I actually started nodered this night, it works suprisingly good.

Flow i created:

\- Live tracking application sends data to MQTT \- nodered checks if there is a region inside the location ( like ( Eg. House ( bruges), work). If it does, continue the flow. \- Stringify the regions and add to the payload \- Converts it to speech using Google-tts \- Send it to my chromecast

Only had a bug that isn't fixed yet ( not yet sure if it's my configuration error), that it uses the wrong property of the payload in the google-tts. So now my tv says: object object ( cfr. [object object] when you are trying to use a string in js, but the expected property is an array)

(disabled it before i left to work this morning though :p)

I also want to create something like this for having an integrated flow into one of my applications ( in c# though, haven't figured out the best way of doing it... But it's more Visual Programming UI related than NodeRed related)

</comment><comment><USER21> Not quite the same use case, but in some cases, XOD might be a good alternative.

[https://xod.io/](https://xod.io/)

</comment><comment><USER22> Does anyone have experience using this with Home Assistant? I've been meaning to try it for a while now.

<comment><USER23> Yes. Running in a docker container alongside my HomeAssistant container. Works great and a much improved upgrade over homeassistant's native YAML. If I knew python, I would probably just use appdaemon instead of nodered tho. Nodered with HomeAssistant has been rock solid for me. HomeAssistant is pretty much now just a state engine and all my automations are in nodered.

<comment><USER24> Same here. I haven't moved over my haaska routines but all other logic is in Node-Red and for some things I don't even need HA.

</comment></comment></comment><comment><USER25> Admittedly, whenever I see these graphical programming tools, I do get bad flashbacks from LabVIEW spaghetti projects - but this does look decent. Just what I need for quick'n dirty home projects and easy every-day data acquisition, without spending too much time on actual programming (which usually is the case - I want something done in 15 mins, but end up spending hours on setting everything up)

<comment><USER26> It's pretty easy to end up with spaghetti, even for tasks that are <500 lines when you'd write them out in actual code. It's great for some quick do-A-if-B- happens scenarios, though.

</comment></comment><comment><USER27> I have the pleasure of working with massive health systems who don't want to upgrade their system to use new API specifications from their vendors.

Over the last 10 years we have made 5 new versions of our API, and most of our customers are all using the oldest version.

Maintaining those old servers/endpoints is starting to add up, so we are in the process of migrating all our v1 and v2 APIs to use our latest API using Node Red.

Node Red has every piece of functionality we need to present the same exact API that our customers are currently using, but backed by our most (easily) maintained version.

There are some corner cases where the new API doesn't quite match the old API, but we can still reuse the old API routes as needed, or migrate that functionality into a newer one if desired.

So far we have been able to transparently migrate customers away from their existing version without a hitch.

</comment><comment><USER28> It is really good for quickly developing prototypes, and testing your workflows. But please don't consider it for any serious application that runs inside an unattended device for long periods of time. It is leaky, slow and consumes more resources than it should for the tasks it does.

</comment><comment><USER29> I really enjoy using Node-RED; I'm using it to handle a number of tasks:

 _Social media automation_

• scrape news sites for legislation stats and tweet about them when they're changed

• send me push notices when verified and/or popular accounts engage with me or my tweets (via Twitter user activity webhooks)

• notify me when certain thresholds are met with engagement, e.g. when a tweet has reached 500 likes, or its engagement velocity suggests it's going viral

• auto-retweet posts based on time of day, or if engagement velocity is slowing (so a post has a chance to be seen again)

• brand monitoring/engagement, triggering GA/other analytics events when a tweet mentioning my company or a client is posted/retweeted/replied

 _Chatbot /Chatops_

• Largely replaced Hubot to send notices to Slack channels based on other triggers

• Listens for certain identifiers and auto-expands them (e.g. a ticket number gets linked with a Slack attachment containing additional details from the ticket)

• automate some AWS operations, like spinning up VMs for students

• quick-and-dirty Alexa skills (it's seriously _fun_ to do this with my kids!)

 _Data-based navel gazing support, by regularly logging_

• my location

• various sensors from my HomeAssistant setup

• all social media engagement

• all email metadata

• other stuff (most of this gets securely posted to a separate ES cluster)

(I use other tools for reporting on those logs, but I use Node-RED as a more visual Logstash to manipulate records.

I could use standalone NodeJS/Python/Ruby/etc for all of that, and I'll often "graduate" some long-running tool once its specification has stabilized, but I have no performance issues with lots of various Node-RED flows running in a Dokku/Docker setup, and I really enjoy "designing" services for various pet projects as well as for production use by various clients.

I'm still missing a nice OAuth "node" for visually building mashups with third party tools, but since they added _git_ management for flows/projects, it's been such a joy to work with.

Coolest of all: my kids—who started programming with Scratch—are able to grok the flow-based architecture really well, and they're currently playing with Node-RED on a BeagleBone Black (works GREAT, btw) I have on the network to automate some stuff of their own, like push notices when their friends post certain things to social media/gamertag feed/YouTube/etc. I'm planning to teach them to use LittleBits (they got kits last year) to do some other things, like tie into our HomeAssistant setup, or to perform physical actions with servos, like making "haunted" Halloween decorations.

It's a playground, sure. But it's got the chops to handle serious work-work- type-work, too.

<comment><USER30> Just as an FYI for the kids, I've ported node-red to mobile devices: [https://github.com/alexisread/noreml](https://github.com/alexisread/noreml)

I need to finish creating a table plugin, but it's now possible to create apps, including UI, for mobile visually in node red, and actually on the device.

The UI part uses node-red-dashboard etc. And being able to do this might be useful for home automation.

Effectively what this is, is a nodeJs instance running node-red, with a Cordova webview set to point to the node-red dashboard URL. As such, you can do heterogeneous clustered processing across mobile devices using dnr nodes: [https://flows.nodered.org/node/node-red-contrib- dnr](https://flows.nodered.org/node/node-red-contrib-dnr)

You can reach the node-red UI from the usual URL in your browser

</comment></comment><comment><USER31> We use node-red quite a lot for protyping. It works really well and can easily have a working prototype running during the course of a meeting. Good stuff!

</comment><comment><USER32> So, this is for "plugged in" IoT devices only? Or at least ones with large batteries?

I've been experimenting with some IoT projects. Have been using ARM M4's and a Nordic nrf52840 dongle mostly. There's no way these things are running node, or anything beyond an RTOS for that matter.

Would this sit on a Thread Border Router maybe? Just trying to figure out a use case.

<comment><USER33> That was the intention, but it's a general purpose programming environment, you can build anything with it. Try a simple http server node.

</comment></comment><comment><USER34> We have been using Node Red for about 2 years and it has been a great experience and example of open source. The support from the maintainers, Slack and forums has been very good. It will not apeal to everone but 1 million downloads and many thousands of contribitors cannot all be on the wrong track

</comment><comment><USER35> One commercial alternative to Node-Red is ThingWorx, a PTC product. However we did some internal testing with ThingWorx and I would absolutely not recommend it. The web portal for creating your dashboards also gets gradually slower (massive web leaking SPA), and the platform is generally flakey.

</comment><comment><USER36> There is a new fully visual flow based programming language. I like the idea, there is no coding required. It is currently in early development more like alpha/beta, but looks quite interesting: [https://tryslang.com](https://tryslang.com)

</comment><comment><USER37> I've been following project flogo lately, which is a go based iot automation engine, and it seems it's more production ready than node-red

</comment><comment><USER38> What differentiates this from Apache NiFi?

<comment><USER18> Quite a lot, actually.

Node-red is simple. It's meant for "talk to this api and do this thing". There's no real thought to flow, or queues, or any of the details of message passing infra.

NiFi has queues at every level, and full customization of each. You can set each to either overflow a queue (and delete old messages) or force nodes to wait until handling is completed.

There's also a strong sense of provenance in how data is handled. Auditing is baked in at every layer.

Provenance and credential storage also allow me running my NiFi with my Reddit credentials to share the _access_ to you, without ever exposing the credentials.

Node-Red is a prototyping tool for making quick and dirty JS implementations of stuff.

NiFi is a professional data routing engine.

</comment></comment><comment><USER39> I use it for home automation with HomeKit/Zigbee2MQTT and a few other things. Pluses:

\- You can stuff it into a container very easily ([https://github.com/rcarmo/docker-node-red](https://github.com/rcarmo/docker- node-red) \- use the Ubuntu branch)

\- There are loads of extra components for IoT, automation and cloud services (including low end stuff like sniffing multicast packets and doing WoL, both of which I use a lot)

\- Works beautifully with MQTT

\- You can build simple metrics and control dashboards with nearly zero code (although it helps if you know Angular to inject directives into the templating)

\- It's very easy to develop your own nodes using JavaScript without leaving the GUI

Minuses:

\- Being based on Node means you have to deal with a dependency dumpster fire now and then (and I worry a lot about security)

\- Many plugins are old, brittle, unmaintained and buggy (HomeKit support crashes the entire runtime now and then)

\- Component behavior is inconsistent (some nodes pass on msg.topic, others eat it, etc.), even for built-ins.

\- Debugging can be a massive pain, since effectively all you get is a scrolling console output in the inspector pane and the ability to add more debug nodes to your flows to "sniff" traffic into it.

\- it's very easy to shoot yourself in the foot with JavaScript, and it does not support anything else in the function nodes (I would vastly prefer ClojureScript or Python, for instance)

\- there is no easy/intuitive way to join flows (i.e., do an AND gate) without doing trickery

\- versioning is a major pain (I snapshot my setup by pretty-printing the JSON flow store every now and then - [https://gist.github.com/rcarmo/f2a8a14ef5f3d77759555f3fea5e7...](https://gist.github.com/rcarmo/f2a8a14ef5f3d77759555f3fea5e7c37))

\- The GUI doesn't scale to manage large numbers of flows (I have 40 or something)

But I've resigned myself to all the above, because the alternatives are worse.

And, as an experiment, I recently built on it an App Store notification service to check when apps are discounted, GUI and all, with a SQLite back- end. Works great, although it lacks some elegance when dealing with databases.

Edit: forgot to add that it can be self-documenting up to a point (you can add Markdown notes to flows, and have a comments Node that you can drop amid your flows to annotate them), which is extremely useful when you go back to something a few months later and have to trace an entire flow end to end to figure out why it broke.

</comment><comment><USER40> A mature role model in this field could be Ptolemy Project ([https://ptolemy.berkeley.edu/](https://ptolemy.berkeley.edu/))

</comment><comment><USER11> I'm glad it turned up on HN.

</comment><comment><USER41> They had a new version some days ago, but still not commercial-ready.

<comment><USER19> Hi - project maintainer here. Always keen to get feedback, so interested where your 'not commercial-ready' comment comes from. There are quite a few companies using Node-RED in production today within their own products and services.

<comment><USER42> Nice job! I had a good experience as part of the applied machine learning data science coursera specialization. The cloudant support was great to have.

</comment></comment></comment><comment><USER43> Isnt flow based programming just a gui on top of functional programming?

<comment><USER44> Isn't functional programming just a gui on top of machine code?

</comment></comment><comment><USER45> People are inventig such tools over and over and over again, for many years. None of these tools succeeded so far.

<comment><USER46> Node Red has been around for many years. It isn't a me-too response to the current IoT environment.

<comment><USER45> By "such tools" I mean not IoT, but visual tools where non programmers can create systems from blocks "without writing a single line of code". I worked with several similar systems and they were very limited and inconvenient.</comment></comment></comment>


The Developer Coefficient: a $300B opportunity for businesses - <AUTHOR> https://stripe.com/reports/developer-coefficient-2018#hn <comment><USER2> It's interesting to put some questions and answers into contrast beside one another.

Asked of C level execs:

"How much of an impact can developers have to help your company with each of the following challenges?"

Top answer (71%) Bringing products to market faster

"How much of a priority is it for upper management to increase the productivity of its developers?"

Ans: High priority (96%)

Later, asked of developers:

"How many hours per week do you estimate developers at your company waste on maintenance (i.e. dealing with bad code / errors, debugging, refactoring, modifying)?"

Ans 17.3 hrs (of 41 hrs)...

Similar question on time spent on tech debt & bad code:

13.5 hrs spent on tech debt 3.8 hrs on "bad code" (this seems low in light of the above numbers).

The use of the word "waste" for maintenance work is interesting too. Perhaps if taken in a lean/manufacturing sense it's ok, but in a development process treating that as "waste" might lead one to think that's why the development speed is so slow in the first place. I would also note, unless you're building green field software, all the work is by definition "maintenance" because in the best case you'd be modifying old software to add new capabilities...

Not sure what conclusions Stripe is making here that is an "opportunity" for business. I would suspect the best advice is go slow to go fast (slow down development to be methodical in order to go faster systematically).</comment>


I'm still here: back online after a year without the internet - <AUTHOR> http://www.theverge.com/2013/5/1/4279674/im-still-here-back-online-after-a-year-without-the-internet

<comment><USER2> It sounds to me that cutting himself off the internet only cut him off from part of his "problem". He saw the internet as isolating and causing him to not live "real" life. However, it seems to me that technology in general was his distraction. Is cutting the internet connection going to keep you from spending 8 hours at home playing video games? Probably not. I almost felt like he was cheating by listening to audio books, or watching tv or playing video games. The internet is simply an enhancement to your computer/phone/game console. It sounds to me like he spent much of the year depressed, and that he struggles with social anxiety.

Barring some catastrophic event, technology is here for good. Shunning it wont make our lives better, finding the balance with it will.

</comment><comment><USER3> Sounds to me, like "the internet" (whatever this personificated entity might be) wasn't the writers real problem. Maybe he was asking the wrong questions in the first place. Maybe I am just reading too much into this. I don't know.

The strangest part was, when he wrote about is niece. Why didn't he talk to her in that year - do her parents not have a landline/mobile phone? What is the difference between the described strenuous phone-call and a skype-call?

Sorry, but I just didn't buy this part. It did not get me. His niece was right. If he would have wanted to talk to her, he would have found a way. And there are other things, I really didn't get:

If these special letters (between all the rest) would have really meant that much to him, he would have found a way to answer them.

But it just feels like, he really did not know himself before, during or after this sabattical. And he does not know himself (or his [perceived] problem) any better. Sorry to judge that hard, but this "journalistic" piece was really saddening me.

Sorry, but I take for granted the ability to be able to read some hundred pages of literature. Even Homer. Or Foucault.

Sorry, call me old fashioned, but I take for granted, that you listen when talking with someone.

And things like this.

</comment><comment><USER4> "It's reprogramming our relationships, our emotions, and our sensitivity," said one of the rabbis at the rally. It destroys our patience. It turns kids into "click vegetables."

</comment><comment><USER5> He seems like an introvert who was focused on the technology; I'm not sure he's the person I'd pick to have be the focal point of the story.</comment>


Machine Learning, Deep Learning and Prescriptive Analytics: What's the Difference? - <AUTHOR> https://blog.netapp.com/machine-learning-deep-learning-and-prescriptive-analytics-whats-the-difference/ <comment><USER2> What's the difference between content marketing, spam, and bad content? (Ex. what does this have to do with "Harness the Power of Hybrid Cloud?")</comment>


Ask HN: Good, experienced engineer but suck at interviews. Looking for a coach - <AUTHOR> I am an experienced engineer(10+) working as software engineer.
I know all the CS basics and concepts. I can 80% of the puzzles/coding questions in interviews. But I have few blindspots that I am hoping to use a coach for.  As I am not a beginner, most online portals are not useful for me. I want to use my time efficiently.
If you guys know anybody who can coach an experienced engineer, let me know. I will probably need a time commitment of 1-2 hours per week from you. I am happy to pay for the service.
All you have to mostly do is curate a few questions in my weak areas and pester me to solve them.
Something like youneedaboss.com but for software engineering interviews.
Please let me know how I can contact you. If you have experience hiring people before, it is even better!
My contact is in the profile. <comment><USER2> I'll leave a comment here in case anyone else is curious:

Hi, I'm a mathematician. I've made some hiring puzzles and problems. I didn't think it was particularly useful heuristic for hiring a good programmer, so when I stopped feeling like it was a fun project I did not continue.

I hire, I get hired. I do this often, I know what people want to think they see, aaand what they think they want to see. Big difference.

More than happy to mentor anyone taking on these problems or getting through the interview process. They're not that different in my experience from math olympiads or Putnam problems in a computer science flavor. An entire industry has risen overnight to acquiesce to the demand in the form of books, courses, tutors and schools. You can try all of these, and you will learn to 100% the test and successfully get the job you've always wanted. Cool.

That's not what I'm offering. I'm here to teach you how to study, how to manage your time, and how to learn how to learn to do these problems so you don't need me or the test. When I feel like administering one of these problems, sometimes I want to know how they handle themselves. Whiteboard quizzes do not tell me anything about a person's humanity, character or soul. 100% is disappointing to me. It ultimately betrays that programming is something they regard as a preptest. The 100% people are guilty of premature optimization which is the root of all evil. I'd prefer someone who can't whiteboard for their life but has ample examples of "dirty" code that I can read and play with. The 100% people do not seem like the people who take failure, rejection or mistakes very gladly.

Please reach out to me if this sounds interesting to you. I'd love to take on a few students. Doesn't matter how much experience you have, we are all always learning something new about technology.

Contact: email@example.com

<comment><AUTHOR> Thanks for the comment. I somehow missed it when you responded. I will reply to you offline.

I agree with your assessment of entire industry being born overnight. But given that just passing these tests gives $100K+ bump in salary, I think its kind of expected.</comment></comment>


PAWK - A Python line processor (like AWK) - <AUTHOR> https://github.com/alecthomas/pawk <comment><USER2> I'm going to go on a small tangent here and warn strongly against parsing the output of `ls` (cf. the examples given in the README).

Parsing `ls` is inherently fragile[1] and it _will_ break at some point. Please don't do it.

[1]: <http://mywiki.wooledge.org/ParsingLs>

</comment><comment><USER3> I really find this amazing.

I've been watching Larry Wall's Perl 6 talks off late, where he talks of designing Perl programming languages(1,2,3,4,5 and 6). He goes back to 1987 and talks about problems in 1987 about difficulties in sanely doing text processing then. He mentions the problems really were that if you wanted to do simple text processing work there was always awk/sed and other little unix utilities in form of a command line program using pipes. But any thing more than that and you really had to write program combining them in a language like C(The dominant language of the day;circa 1987).

I see the situation hasn't changed at all.

Almost anybody who doesn't use Perl, continues to bend <insert their favorite language here> in a way that badly implements what Perl was invented to do in 1987. Which is to really solve problems like these, in the most appropriately designed programming language for it.

Perl was designed to fit the niche between [c/python/java/<insert your language>] and [shell/unix text processing utils].

When you bend your language to fit that niche, like this tool does(This tool makes a good attempt at turning Python into a Perl like language). You make it largely look Perlish. This is dilemma languages trying to replace Perl must face, everytime you try to invent a language to replace Perl, you end up inventing a tool/language that largely looks and works like Perl(Read: Ruby/Perl 6). People who have learned Ruby after learning Perl know this fact, it really feels like you are just learning some more extra syntax above Perl.

Giving a powerful command line language is very difficult. Because by very definition you have to design a powerful syntax in the most terse ways ever. Where does that leave us? This in a C based syntax and what you get is Perl.

It will take a little while to understand that languages like Python and Ruby are not _replacing_ Perl. That is for the same reasons why Perl even in CGI days never came to replace Php. Its just these languages and tools like Perl/awk/sed are designed to rule a very different niche.

When you begin to understand the design and niche they occupy you will suddenly discover that your 100 custom scripts and jar files you spend days writing do badly what was already solved in one constant design paradigm some 2-3 decades ago.

This is the reason why the grey beard unix guy smiles at you every time you show him your world changing script.

<comment><USER4> Have you ever maintained some else's poorly written Perl code? I have. Rational or not, I hate Perl.

And yes you can write crappy code in any language, but Perl is just asking for a bad programmer to write bad code.

<comment><USER3> I have maintained Perl code.

I don't what you mean by the term 'poorly written Perl code'. I have maintained more horrible code in languages like Java than in Perl.

>>but Perl is just asking for a bad programmer to write bad code.

And what is that wand that other programming languages have, that when cast with a spell magically transform a bad programmer into a Dennis Ritchie?

<comment><USER5> It's just that Perl's power/expressiveness and TMTOWTDI mindset tend toward harder to _read_ code. You can write awful hard-to-understand code in any language, but in those other languages the reading part is usually easier. Except for maybe C++. :-)

</comment></comment></comment></comment><comment><USER6> Yet another option: pyliner - A Python line processor (like Perl): <https://gist.github.com/dgulino/4750088>

</comment><comment><USER7> This looks like a really useful tool, although the automatic importing of anything that smells like a module makes me a little uncomfortable:

        modules = re.findall(r'([\w.]+)+(?=\.\w+)\b', all_text)

then later:

        for m in modules:
          try:
              key = m.split('.')[0]
              self[key] = __import__(m)
          except:
              pass

</comment><comment><AUTHOR> I love awk but personally cannot remind the syntax to do complex stuff without googling or dig in the man. I didn't test the performance but I don't always need performance (or even rarely) ... I'm adding pawk in my toolbelt and I glad somebody built it

</comment><comment><USER8> You may find this useful, also in python:

[http://code.activestate.com/recipes/437932-pyline-a-grep- lik...](http://code.activestate.com/recipes/437932-pyline-a-grep-like-sed- like-command-line-tool/)

<comment><USER9> And if you find that useful, here's an extension of that same idea: <https://github.com/gvalkov/python-oneliner> (I haven't worked on it in months though)

</comment></comment><comment><USER10> A similar recipe: <http://code.activestate.com/recipes/577962-awk-like- module/>

</comment><comment><USER11> Hmm I feel uncomfortable if there's an eval going on in there; what if the commandline is tainted etc? Its something to keep in mind.

<comment><USER12> Surely if your command line is tainted then you have bigger problems?

<comment><USER11> people often have websites that take some parameters and then pass them to grep or whatever, in the exact same way that they pass parameters that came from the user to an SQL engine.

As long as its data, no problem...

Injection attacks are injection attacks.

</comment></comment></comment><comment><USER13> neat. not sure i'll use it, but neat nonetheless. thanks for sharing. i've been a big awk user for well over a decade (and a python user for nearly as long), so this was neat to see.

</comment><comment><USER14> mawk is fast like nobody's business. I mainly use awk for speedy filetype conversions for large data sets. I am not sure if I would reap any benefits from switching my awk interpreter into a JIT language, but this is a really cool project nonetheless.</comment>


Elements of Chip Music (2011) - <AUTHOR> http://www.linusakesson.net/music/elements/index.php

<comment><USER2> One of the better books on the topic of 'chip music' for me was Hal Chamberlin's "Musical Applications of Digital Microprocessors" [1]. What was more interesting to me was that I used his fixed point fractional scheduling algorithm to write an I/O scheduler for disks that would allow you to portion out I/O to different processes (or containers) by an arbitrary percentage of the disk channel's bandwidth.

[1] [http://www.amazon.com/Musical-Applications- Microprocessors-H...](http://www.amazon.com/Musical-Applications- Microprocessors-Hal-Chamberlin/dp/0810457687/)

</comment><comment><USER3> Not only is this a great talk, but sitting below the video is a humble link to his custom presentation hardware kit that drives it. Amazing!

[http://www.linusakesson.net/music/elements/presentation.php](http://www.linusakesson.net/music/elements/presentation.php)

</comment><comment><USER4> The exchange during the last question in the Q&A section is golden: "(...) and of course there was the infamous ahx tracker - (guy asking interrupts) - thanks, I wrote it"

</comment><comment> m-photonic I especially liked how he would give examples of similar techniques being used outside of chipmusic where similar constraints would come up, such as the bass player adding percussive slaps to the gaps in his melody.</comment>


Cache Missing for Fun & Profit - <AUTHOR> http://www.daemonology.net/papers/htt.pdf

<comment><USER2> Jacques Mattheij seems floored by the idea that you could look at something as obscure as cache timings in a hyperthreading-enabled processor and use it to deduce crypto keys. He's right: it's a clever attack. But if it _surprises_ you, please count it as another reason you should never implement your own crypto.

For the past 10 years or so, crypto researchers have been pawing through the x86 microarchitecture (microarchitecture: the part of the processor that isn't directly exposed in the instruction set; best example: cache) looking for side channels. They've found a lot of scary stuff.

For instance, every time your processor takes a branch, it's caching the computed branch target; it does that so that it can predict branches, so that when it snorfles instructions into its pipeline, it doesn't have to chuck them when a branch goes the "wrong" way. But the branch cache (the BTB) is finite. You can write a process that continuously profiles branch timing to deduce the state of the branch caches, and if that code runs alongside crypto code, it can make predictions about key bits (that's Aciicmez's paper).

There's every reason to believe that there are areas of the microarchitecture that aren't documented that have even worse effects.

There is actually a practical point to pull out of this (and here I've buried a lede): it is very probably unsafe to run "secure" code (SSL credit card processing, etc) on shared hosting of any sort. A motivated attacker can probably get their code running on the same physical hardware, and the odds right now say that attacker can pull key bits out of your processes.

<comment><USER3> An acquaintance of mine implemented a solution to this problem: it's an implementation of AES that used no tables _and_ no branches; it used the shuffle instruction (pshufb) in a very creative way combined with a different interpretation of the AES algorithm to make it possible. It should be invulnerable to (at least standard) timing and cache attacks. For bonus points, it was also far faster than most standard implementations.

Link to the paper: <http://mikehamburg.com/papers/vector_aes/vector_aes.pdf>

<comment><USER2> All mainstream modern crypto libraries are hardened in one way or another against timing attacks (Nate Lawson can probably be counted on to jump in here and correct us on this), but to my mind the bigger concern is that we simply don't know what trails our code is leaving inside the processor. Processor microarchitecture is vast, undocumented, complicated, and intricate.

<comment><AUTHOR> Essentially you'd have to audit the entire cpu design to be sure that you didn't leave any fat fingerprints all over the place. Any flip-flop that had changed state in a recoverable way would be a potential security leak.

Good luck getting that kind of access to a cpu design though, and even better luck trying to figure out _all_ the angles of attack, miss one and someone else has a vector, silicon is hard to change after the fact.

What is interesting here to me about this whole subject is that it has apparently long ago gone from 'theoretical' to 'practical', and you'd be hard pressed to prove that you didn't lose a key or two (or all of them) to an attacker sophisticated enough to do his snooping and then disappear quietly.

After all, any hack or hacker that you read about or hear about wasn't as good as they could have been, the ones you never hear about are the ones to worry about.

For me this whole idea of having someone plant a piece of software on a machine that I own without me detecting it was a prime reason in choosing not to do my own card processing (even though in the dark ages I wrote 'webpay', which later became the foundation for a major IPSP).

I realized that by simply having a page hosted that accepts credit cards on a https connection I would basically be putting up an open 'hack me' invite.

<comment><USER2> You want to google "Remote Timing Attacks Are Practical", which is the landmark paper in this subfield and also the one crypto people use to scare their children around campfires with.

What you're really observing is the flip side of the "covert channel problem", which has been a well-known Hard Problem driving systems research since the '70s (it's part of Saltzer/Schroeder). Systems security people generally concede that the covert channel problem is impractical to solve in theory, and have resigned themselves to occasional fire drills as theory becomes practice.

<comment><AUTHOR> Maybe I'm thinking about this too simply, but wouldn't fugding the timing on any cryptographic operation in a random fashion make it (much) harder to deduce the keys ?

<comment><USER2> No. This is basic signal processing. Increase the noise, and all you do is increase the number of measurements needed to recover the signal.

This is a really common misconception about defeating timing attacks.

A more pernicious problem is that many of these microarch side channel attacks don't rely on direct timing of crypto code, so much as on microarch artifacts.

(For what it's worth, the specifics beyond this get to a place where I'm out of my depth and Colin and Nate are still in theirs.)

<comment><AUTHOR> Right, I get that, increase the noise by a factor of two and you'd need more samples, increasing the chance of detection but ultimately not making the problem much harder.

But every factor of two that you make it harder is effectively one bit extra on the key that you're trying to find right ?

Assuming that's true (going out on a limb here) the more you are willing to waste time the harder it will get for an attacker to recover the keys, so ultimately it is a measure of efficiency vs security.

As for micro architecture, I don't know much about that other than reading up on the 68K when it came out and how it functioned at the block level, but one way to side-step that issue completely if you want to write bullet proof crypto code (if that is even possible) would be to write it for a controller on a separate plug in card (pci, possibly usb) that would be permitted to allow exactly one crypto operation per fixed interval of time to be performed.

That way you could effectively 'hide' the key and all its side-effects from view from both local and remote attackers.

It would then take at a minimum physical access to the card to monitor its buses in order to recover they keys.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Are there any scribd people around here? I sent the required DMCA notice to have this taken down on 2008-10-04, and I believe that it was taken down at that point; do I have to send a new DMCA notice every time the same document gets re-vacuumed?

<comment><USER2> It's a scientific paper. Why do you want it taken down?

<comment><USER4> I'd prefer to have people reading it from my website. Among other issues, this allows me to see from where it is being linked.

</comment></comment></comment><comment><AUTHOR> That's one of the most amazing side channel hacks I've ever heard of, I just ran in to this reading up on how hyperthreading works on the i7 and what the consequences are for performance.

Trust cperciva to use that to translate hyperthreading in to a security issue.

Wow.

<comment><USER4> _That's one of the most amazing side channel hacks I've ever heard of_

Thanks! The Osvik-Shamir-Tromer attack on AES via hyperthreading (the same shared-cache issue, just a different target) was pretty neat too, although I must say that I find my attack on RSA to be more aesthetically pleasing thanks to its ability to steal a key by observing just a single cryptographic operation.

<comment><AUTHOR> Not to put too fine a point on it, but I'm really completely floored by taking this from the general idea of a resource monitoring attack to actually figuring out how to retrieve the contents of the cache and working out which bits map on to which bits in the key.

Did you ever get it to a practical level where you were able to retrieve a complete key on a live system in a substantially reduced time ?

How much knowledge would you have to have about the process being monitored (in most cases I assume you would not have the luxury of knowing in advance that someone was going to run a key generator, so I assume that you'd have to be monitoring all the time, but then you have to pick the cryptographic activity out of the background of all activity by all processes) ?

(what I got from the article is that you basically stopped at the point where you retrieved a significant number of bits, but that leaves as guess as to how long it would take to recover the remainder, through brute force or otherwise, obviously every retrieved bit weakens the number of bit substantially, in other words, how practical is this attack ?).

Has intel done something againt this kind of attack on the i7, from the references I take it that you did this work before the i7 was released ?

Have you heard of this attack being used in the wild ?

edit: re-reading the paper, more questions :)

Do the people that write cryptography code spend time making sure that the code will generate as little opportunity to do this by ensuring that the length of the codepaths and the memory footprints of '1' bit operations in keys is the same as it is during the processing of '0' bits in keys ?

<comment><USER4> _Did you ever get it to a practical level where you were able to retrieve a complete key on a live system in a substantially reduced time ?_

I retrieved enough key bits to make the rest easily computable, yes.

 _How much knowledge would you have to have about the process being monitored ?_

Cryptographically speaking? None. Operationally speaking, if you don't know what program is running (or more importantly, what cryptographic library is being used) it may take you a few hours of "eyeballing" the timings before you see something which looks like a modular exponentiation -- but once you find it, you should be able to extract key bits (if the cryptographic code is vulnerable, that is).

 _you retrieved a significant number of bits, but that leaves as guess as to how long it would take to recover the remainder_

Recovering the remaining bits is just a problem of modular algebra -- computationally speaking it's trivial.

 _Has intel done something againt this kind of attack on the i7_

I don't know. I've asked, but they don't want to talk to me.

 _Have you heard of this attack being used in the wild ?_

Not exactly... but I've heard reports of certain government agencies suddenly getting very interested in how to defend against this sort of attack, so I suspect that some spooks are aware of this attack being used.

<comment><AUTHOR> Do you plan on verifying if this vulnerability is still present in nehalem/i7 ?

What about multi-core and level 2 cache monitoring, is that also feasible or do you get too much noise ?

<comment><USER4> _Do you plan on verifying if this vulnerability is still present in nehalem/i7 ?_

If I have the time and opportunity, probably. Right now I don't have an i7 processor or the time to spend on it.

 _What about multi-core and level 2 cache monitoring, is that also feasible or do you get too much noise ?_

Every L2 cache I've seen so far leaks data too slowly to be useful as a cryptographic side channel (at least for attacks like mine).

<comment><AUTHOR> Thanks for all your answers, if you ever get around to this and need access to an i7 let me know.</comment></comment></comment></comment></comment></comment></comment>


Shenzhen is a hothouse of innovation - <AUTHOR> http://www.economist.com/news/special-report/21720076-copycats-are-out-innovators-are-shenzhen-hothouse-innovation <comment><USER3> > The common perception that China is incapable of innovation needs re- > examining.

No one is saying Chinese people can't innovate. The real question is whether Chinese people can innovate while inside China. (I wonder what percentage of current captains of industry in China studied abroad?) Why? Because innovation is essentially disrupting and rebelling against the status quo. ie breaking rules, disobedience, opposition to the norm

When you demand that your people bow and obey, and imprison people like A1 WW, this goes against promoting and nurturing innovation

[https://steveblank.com/2012/11/06/entrepreneurs-as- dissident...](https://steveblank.com/2012/11/06/entrepreneurs-as-dissidents/)

[https://medium.com/@they_made_that/innovations-secret- ingred...](https://medium.com/@they_made_that/innovations-secret- ingredient-73da24fdd775)

[http://www.salon.com/2014/10/22/never_before_published_isaac...](http://www.salon.com/2014/10/22/never_before_published_isaac_asimov_essay_reveals_the_secret_to_true_creativity/)

When your culture is very antagonistic towards people who don't like the status quo and forces them to carefully think about what they say and write, the culture itself becomes a big obstacle to innovation. When you run garbage likethe Great Firewall that limits the sharing of information, that's another strike against innovation. (Of course one way to mitigate the effects of authoritarian rule is by being really favorable towards immigration from places with the opposite culture.)

I guess Shenzen is a place that's figuratively where "the mountains are high and the emperor is far away". I wonder how long before that changes?

<comment><USER4> China is not Russian style system where oligarchs close to leader step in and steal your stuff if you get rich.

China resembles (British) monarchy of the old. There are laws, but they are not same for the common man and to the noble (60 million members of the communist party). If you steer away from the politics, you can be entrepreneur and become rich.

Corruption exists of course, but that's like taxation. You pay your taxes and bribes. Bribing can sometimes allow more freedoms than completely lawful society, because it allows more.

China has basically the same bioethical laws as the west, but they are not enforced because party does not care. China became the first country to approve the commercial production of a gene therapy.

<comment><USER5> Rule by law, not rule of law. Once you understand the difference between these two concepts, you'll understand China a bit better.

<comment><USER6> That's not a particularly clear distinction, care to expand / unpack?

<comment><USER5> "Rule by law" is the use of law to control the people. You use laws as convenient to punish your enemies, but aren't particularly interested in enforcing laws fairly. It becomes more of the default whenever there is no independent judiciary to interpret the law, or an independent media to make sure the government stays honest.

"Rule of law" is the aspiration that we are used to in the west (fair application of the law, everyone is subject to the law, etc...). It isn't perfect, we often exist in between the two extremes, but our systems are set up to at least aspire to it, while the Chinese system self admittedly depends solely on the wisdom and benevolence of a singular ruling class (in this case, the top-down CPC).

<comment><USER7> With over a billion people in the country, the highest levels of leadership can't easily stop the kind of corruption that most businesses are victimized by: Extortion by local officials. It's like, they walk in to your factory, claim your fire extinguishers are not regulation, and demand that you buy a dozen of them from their friend and no one else, and it's going to cost you 50,000 RMB ($7k USD). And if you don't go and get them, right now, then they're taking the keys to your factory, kicking out all the employees (who you will still have to pay) and not letting anyone back in until you do. And it has to be cash. And no, you're not getting a receipt.

Or it will be things like, you order something, it's not delivered even close to spec, and the corrupt police make you pay for it anyway or else. Contracts are utterly meaningless. And of course this only starts happening when you start making money. And they'll know you're making money because the locals around you are definitely ratting you out and quite possibly in on it.

You need to have the right friends to avoid this, and those kind of friends cost money.

Our systems aren't perfect, but it's rare we have to put up with shit like that.

Still, I like it here. The cost of living is reasonable, the weather is good, it's a big city with lots of entertainment, and a lot of people are here doing stuff. Being right next to Hong Kong is also a big plus. Biggest downside is how bad the internet sucks.

<comment><USER8> > Our systems aren't perfect, but it's rare we have to put up with shit like > that.

I'd love to see a breakdown of the US economy, sketching which rules apply where. Including gray and black markets.

When a couple of Boston-NYC gray bus operators went legit, incumbent Greyhound fought them in various ways, including leveraging corruption in federal law enforcement. The sole battered survivor had to hire a DC lobbyist.

SpaceX is massively disrupting a large mature industry, while doing no defensive patenting at all. Apparently relying entirely on something like "you don't piss off US Senators and DoD".

There's a lot of fascinating texture to how the US economy is structured, but I've never seen a broadly scoped and roughly quantitative sketch.

<comment><USER9> SpaceX patenting ITAR-covered technology is a landmine of problems.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> WIRED UK did a great job going into more detail on Shenzhen, highly recommend watching the documentary. [https://www.youtube.com/watch?v=SGJ5cZnoodY&t=8s](https://www.youtube.com/watch?v=SGJ5cZnoodY&t=8s)

<comment><USER11> Wired doc is good in parts- there is no local "Maker culture" unless you invent a new use of the word.

</comment></comment><comment><USER12> I was in Shenzhen a few months back for the first time. I can only describe it as Disneyland for electronics enthusiasts.

Going into all the specialized malls in Huaqiang Bei and seeing the entire supply chain in one building is amazing.

Highly recommend that people interested in electronics hardware make a visit.

<comment><USER13> I've been reading Bunny's "The Hardware Hacker" and it does make me want to visit.

What I find particularly fascinating is that it provides powerful evidence that 'open' is innovative and 'closed' is stifling.

Early on in the tech business everything was 'open'. The IBM PC published the source code to the BIOS in its technical manual, Intel and Motorola documented all of the options on their chips and how to program them, early programmable logic (PALs and PLDs) were easy to program with available documentation.

As a result lots of people built a wide variety of devices and systems using those parts, and that supported (in the Bay Area at least) dozens of circuit board houses, small run manufacturers, fastener companies, assembly houses, and parts distributors.

Starting with 3D accelerator chips, documentation became locked up behind NDA walls, access to small quantities was nearly impossible, and it became harder and harder to build something out of off the shelf parts. Designers and inventors were held back, their reduced demand for services put pressure on the rest of the ecosystem and the vibrant economy around building hardware crashed and burned. The biggest loss was perhaps the small boutique chip houses that made interesting parts with a bit of this and a bit of that.

Reading Bunny's book and the economist's article it seems that a combination of "Gongkai" and many different small factories has created this environment in Shenzen. That is a good thing and bodes well for the future growth of the area (assuming it isn't crushed by the powers that be). I'd love to figure out how to rekindle that here in the Bay Area.

<comment><USER12> Actually, buying Bunnie's "The Essential Guide to Electronics in Shenzhen" [1] was what motivated me to make the trip. I was motivated enough to spent 7+ months learning basic Mandarin before making the trip. Not to mention the WIRED videos on Shenzhen featuring Bunnie [2].

Learning the Mandarin number system made negotiating prices a breeze.

I just got the Hardware Hacker a month or so ago. Great read.

[1] [https://www.crowdsupply.com/sutajio-kosagi/the-essential- gui...](https://www.crowdsupply.com/sutajio-kosagi/the-essential-guide-to- electronics-in-shenzhen)

[2] [https://www.youtube.com/watch?v=hp6F_ApUq-c](https://www.youtube.com/watch?v=hp6F_ApUq-c)

<comment><USER14>
      >> I was motivated enough to spent 7+ months learning basic Mandarin

That is impressive.

I have tried learning Mandarin, and found that in the same amount of time that you could be communicating (at a very basic level) in another language (even one considered 'hard' like Japanese), with Mandarin I am still trying to get tones right.

<comment><USER15> Tones are hard but far less important than people make out. If you can copy someone else's sound, you will eventually just get tones right automatically. This is how Chinese learn. There's no need to learn them formally. (Source: 16 years, native English speaker, fluent Mandarin, some capacity with multiple tonal languages + dialects)

<comment><USER14> What was your path to getting started?

(from beginner to being able to make basic conversation)

<comment><USER15> Alcohol.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> I'm so impressed with Shenzen, but there's nothing shocking about it. I've been following China's rise up the value chain since the late 90's. It is steady, predictable, and inexorable. They're not done yet. If America doesn't get serious about invigorating it's high tech manufacturing ecosystem, so we have the talent and supply chain needed to stay competitive innovating in the world of atoms they way we do with bits, we're gonna have a bad time... if we aren't already. (Here's looking at you, GoPro)

<comment><USER17> > If America doesn't get serious about invigorating it's high tech > manufacturing ecosystem, so we have the talent and supply chain needed to > stay competitive innovating in the world of atoms they way we do with bits, > we're gonna have a bad time... if we aren't already.

I'm convinced sufficiently that America has lost enough of that ecosystem and will continue the erosion trend enough for the foreseeable future that I'm giving serious consideration to physically moving closer to China if not establish physical residency there, a possibility that was unthinkable only 10 years ago. I don't think China will stop at atoms, and challenging US dominance in bits over the coming decades is no longer fanciful; maybe not in my generation, but perhaps my grandchildren's. The value-over-time delivered from "owning" an ecosystem was and is vastly underestimated by most US business leadership that is simplistically yield-chasing (focusing on ever- larger margins). Ownership in this context is the ability to iteratively turn around half-baked ideas into fully-executed forms cheaper and quicker than sourcing from an ecosystem where the local ecosystem's embedded culture (both socially and professionally), primary language, lingo, nuances, time difference, _etc._ , add up to a significant edge.

What I'm increasingly seeing is ever-more fragile design cycles in the US, with an emphasis upon getting it right as far up front as possible (leading to highly dysfunctional organizational behaviors arising from the gaming of the metrics around "getting it right"), and tossing the design over the fence to the "lower value rungs". There doesn't seem to be an awareness that continuous, small feedback loops built around fast iterations are an excellent method to break up complexity of an effort too large for one person or even one small team to load into working memory all at once. I even see this a lot in commercial sector "agile" software development efforts, where even if there is some feature/area that is completely _terra incognita_ to the team, there is little to no accommodation made to set aside generous time to perform discovery, experimentation, and trialing.

The focus upon ever-larger margins leads to value-ladder-justifications like ditching PC manufacturing, then wondering why your sales team all of the sudden can no longer organically find opportunities like they did before. Those PC's might have had "terrible" margins, but they were a built-in excuse for on-the-ball sales teams to uncover opportunities for cross- and up-sells of other products/services while discussing the latest PC refresh, for example. All that discussion that flows from those "low value" goods? The Chinese and Indian firms hold them now, and based upon what I'm seeing in the field, they know what they hold in their hands and they're inexorably leveraging those opportunities.

</comment></comment><comment><USER11> Ok, I'm probably more engaged in discussing and promoting Shenzhen with Westerners in English than any other Shenzhen resident. I'm a Hackaday contributor, tweet and vblog about it with more followers than any other local, all that. I'm also the most prolific Maker as Westerners tend to define "Maker" in Shenzhen, maybe China. No, I'm not bragging, check around.

>Shenzhen has only a handful of lacklustre institutions of higher learning

Shenzhen University- while not Tsinghua, it well regarded and it's graduates are quickly hired by local tech companies.

>Shenzhen spends over 4% of its GDP on research and development (R&D), double the mainland average; in Nanshan the share is over 6%.

This is true "on the ground" and it shows- I live in Nanshan High Tech Park right in the center of this. The amount of money local government and local companies are putting into innovation is staggering.

>Most of the money comes from private firms. Companies in Shenzhen file more international patents

Lots of these are questionable. There are financial incentives for the number of patents filed. Goodhart's law applies in China like no place else. Likewise- you can get grants and tax breaks opening a Makerspace, so we have over 600. In reality nearly all of these are empty offices.

>He insists this could not have been done even in Silicon Valley, because California cannot match Shenzhen's ecosystem of "makers".

Shenzhen has no Makers, and no Maker culture. We have one, maybe two Makerspaces in the Western tradition and their focus is almost entirely on kids classes. There are huge obstacles to actually building an authentic Maker Culture in China which we have been unable to overcome. As a result- the same factory bosses and businessmen we've always had, are now called "Makers". People who actually do technical things- let along things with their own hands are still called engineers and still very much looked down on.

We have large, fantastically equipped Makerspaces- these are about as real as a North Korean fruit stand. They are part of the local cargo cult mentality and purely for face. It is common here to have a huge, privately catered "Maker Meetup" of hundreds of people- and not a single person in the room will have ever fabricated anything with their own two hands. They are also quite proud of this.

Yes- some tremendous innovation occurring here and it's a fantastic place for hardware. No- very little authentic Maker culture and very little interest in actually fostering it.

<comment><USER18> the seed for a lively Maker culture is there though and I think that's where the article got it mostly right. shenzhen's unique access to a cornucopia of the world's hardware is bound to prompt more open minds to start tinkering and hacking than somewhere else where that sort of organic community growth would have never even taken root. There are definitely limitations - social stigma as you mentioned, a culture that worships the tried and true road to social ladder climbing (good test scores -> good university -> good job -> ??) and looks down on anything else. But then again, that's the whole cyberpunk dream right? it's the losers and the weirdos and the nerds of society that will have outsized impact in our high-tech future. and if any city is destined to be the cyberpunk mecca of 2050, it's shenzhen. love your stuff by the way, you're probably the first exposure alot of westerners have to the Shenzhen scene on reddit and other sites. have you lived in the US? always been curious where you picked up your fluency in english and western culture

<comment><USER11> >love your stuff by the way, you're probably the first exposure alot of westerners have to the Shenzhen scene on reddit and other sites.

Thanks!

>have you lived in the US? always been curious where you picked up your fluency in english and western culture

No, never been to the West I'm entirely locally educated. When I first posted on Reddit I just tried to reply to everyone- and I was usually on my phone so my English was very careless. After a while I realized my "chat Chinglish" really made it hard for people to take me seriously. I slowed down, started using my computer, Grammerly is a huge help but for important stuff like the above post or my Hackaday article there's a small group of overseas educated friends that help me proofread my posts. I make all my stuff and document it all carefully on video, but you'll see regular disclaimers when my English has been polished for readability (but not content).

</comment></comment></comment><comment><USER19> The "maker movement" is alive in Shentzen, but mostly dead in Silicon Valley. TechShop is mostly crafters, not people building anything innovative. Hacker Dojo is appslaves. If there's a maker space in Silicon Valley with a pick and place machine, I can't find it.

<comment><USER20> This is also true in Seattle. The "makerspaces" here are incapable of working with anything beyond PLA. There are some cool tool libraries, which can be useful for larger hardware projects, but there seems to be very little in the way of true hackerspaces. If you want to get into EE or circuitry in the US, there are plenty of good online resources, but you will be at a severe disadvantage to people living in parts of the world with active maker communities.

But I think there's a reason for that. Innovation faces a steep uphill climb in the USA.

1\. I have a cool idea, but I don't have the capital to bootstrap it right away. No problem, I can work and draw a wage while doing my research on the side, right? Nope! This is America, and your employer likely claims to own everything that you create or think of, on or off the clock.

2\. I have a cool idea, and want to play around with it even though I could use some help with some basic concepts. Well that's great, but I'm on my own. There are no incubators that specialize in electronics or circuitry, no groups of experienced hardware hackers to mentor newcomers, and no specialized training or local resources. You also cannot source circuit components locally when most cities seem to lack a single hobby shop. Often if you want to find out if a circuit will work, you need to wait a whole week for new parts, if you're lucky and can find them from a stateside retailer at a reasonable price.

3\. You might think that academic institutions would make themselves available to their surrounding communities, offering night classes and/or access to facilities like machine shops or lab equipment which are typically beyond the reach of an individual. You would be wrong; this is America, and if you don't pay full tuition, you can fuck right off.

<comment><USER21> >This is also true in Seattle

Especially with Metrix:Create completely abandoning hackerspacedom for blah structure. Extremely sad.

<comment><USER20> Metrix:Create...is that the place in Cap Hill with a laser cutter, poor lighting, unsupervised live-in children, a few tool drawers, a plastic mill, and a couple of 3D printers? Yeah, that place isn't even worth walking to when you're in the neighborhood. Surprised they're still in business.

<comment><USER21> Pretty much. What made it good was the open lab space and gathering area, then people would consume other services. I know I sure did when I was bootstrapping my startup.

The psuedo live-in children thing was kinda weird now that you mention it...

</comment></comment></comment></comment></comment><comment><USER22> Despite the politics, and crazy economics, China future looks amazing, because of the huge of human potential. If I were 20 years younger, and having the possibility of an interesting job in software programming, I would go to Shanghai or Shenzen.

<comment><USER23> > China future looks amazing, because of the huge of human potential.

I grew up in China and spent half of my life there before immigrated in the states while I was in college. Being bilingual and keeping an close eye on the start-up focused medias from both countries, I totally concur. And it's increasing clear to me that Silicon Delta[1][2] suppressing Silicon Valley is very probable. And Shenzhen is at the heart of it.

I am approaching 40, but if there is an interesting opportunity I would give Shenzhen calling a shot for sure.

[1]: [https://en.wikipedia.org/wiki/Pearl_River_Delta](https://en.wikipedia.org/wiki/Pearl_River_Delta)

[2]: [https://www.theguardian.com/cities/2015/jan/28/china- pearl-r...](https://www.theguardian.com/cities/2015/jan/28/china-pearl-river- delta-overtake-tokyo-world-largest-megacity-urban-area)

</comment></comment><comment><USER24> wake me up when connections to non-Chinese servers (the vast majority of them) don't time out half the time, or connections to neighbors like HK and Singapore don't do crazy routing through Beijing, to America, to HK/Singapore and back instead of directly to HK/Singapore, or numerous key websites aren't outright blocked

>lived in Shenzhen, the internets are broken and everybody knows it

<comment><USER15> It's not nearly so bad in Shenzhen as it is in some more remote parts of China. In Shenzhen, you can get around it in many ways, eg. HK phone with data roaming.

</comment></comment><comment><USER25> Shenzhen has to be one of my favorite cities. If you're at all interested in manufacturing or supply chain management you have to go to Shenzhen sometime and check out Huaqiangbei

</comment><comment><USER26> I've always wanted to visit Shenzhen. Ever since I studied it in a required elective in college ("Design the City") I've admired it.

sn: Sometimes the required but irrelevant/"easy" classes do provide some value. Anyone in college should remember that you need to expand your mind a bit too and sometimes take these stupid classes seriously enough to get something out of them.

</comment><comment><USER27> _Getting from early-stage research to manufactured product would require a massive amount of what he calls integrated innovation: "Materials, process, device design, circuit design—all needed to be innovated…if you changed one material, you had to change the process." His team had to develop entirely new materials and factory tools, including custom-built robots, to make his screens, accumulating over 600 patents along the way. He insists this could not have been done even in Silicon Valley, because California cannot match Shenzhen's ecosystem of "makers"._

This phenomenon has been under appreciated by the macroeconomists guiding the US. If the people with the expertise, their factories, their suppliers - <USER2> whole chain -- migrate to places far outside the US, then something extremely important is lost.

And favorable exchange rates plus container ship globalization is not enough to get that something back.

</comment><comment><USER28> What would it take to create a Shenzen in the US, say, to economically revitalize a Rust Belt industrial center that's near rock-bottom after decades of decline? I'm, uh...asking for a friend... :)

</comment><comment><USER29> Dangerous Prototypes used to host Hacker Camp Tours of Shenzhen:

[http://dangerousprototypes.com/blog/category/hacker-camp- she...](http://dangerousprototypes.com/blog/category/hacker-camp-shenzhen/)

Does anyone know if there is something similar that is still going on?

<comment><USER30> Ask Mitch Altman

</comment></comment><comment><USER15> Anyone keen on working in Shenzhen, please review our recent _Who 's Hiring?_ post at [https://news.ycombinator.com/item?id=14029295](https://news.ycombinator.com/item?id=14029295)

(We are currently relocating to Shenzhen from elsewhere in China.)

</comment><comment><USER31> _"order is important in the market." But one of the local speakers livened things up by delivering a surprisingly stout defence of disruptive innovation._

Order and disruptive innovation are not necessarily mutually exclusive. What happened to ordered disruptive innovation?

</comment><comment><USER32> For those unfamiliar, what sort of companies, products, etc has this innovative scene fostered?

<comment><USER33> If it's made in China and involves electronics it probably involves Shenzen

</comment></comment><comment><USER34> I lived there for a couple of months in 2014. Amazing city, even outside of the hacker world. The locals are very friendly and there's a great expat community too. I would love to go back.

</comment><comment><USER35> Every time there is good aspect about China, people in HN have to talk about Government. 4Q !</comment>


Edmunds.com expects Toyota to lose a full percentage point of U.S. market share - <AUTHOR> http://www.latimes.com/business/la-fi-toyota-marketshare12-2010feb12,0,5727035.story

<comment><USER2> Why is there such a big ruckus being made about Toyota? The largest recall in automotive history is on going and yet not a word in the media about it. The manufacture involved? Ford.

<comment><USER3> You're talking about the Speed Control Deactivation Switch fire problem?

It's just not in the same class as "uncontrolled acceleration". Can you name anyone who's been killed by the Ford issue?

As an engineer, I also put these two problems in completely different classes. Ford's is a "corrosion happens" one, Toyota's is entirely different and their handling of it is subpar at best.</comment></comment>