This Obamacare contractor doesn't take security seriously - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/25/this-obamacare-contractor-doesnt-take-security-seriously-that-needs-to-change/

<comment><USER2> > In Slavitt's defense, data security may not have been an explicit feature of > QSSI's federal contract

Coming from the construction industry, there isn't a contractor in the world that cares about things which aren't in the contract. Implementing features which the client has not asked for, in the design-bid-build world of public- sector contracting, just means you will lose the bid to a lower bidder who won't do those extras.

<comment><USER3> " _Coming from the construction industry, there isn 't a contractor in the world that cares about things which aren't in the contract._"

In the construction industry, a contract might not explicitly say that the building has to comply with local building, fire and electrical codes - that's taken as a given. To construct a web site that deals with sensitive information without taking security into account is like building a skyscraper with no fire exits - not something that any honest or competent builder would do.

<comment><USER4> Yes, but those are actual codes. In fact, _that 's why_ they're codes. Contractors won't do more than they're legally required to (nor should they be expected to), so safety features were made legal requirements.

Relying on the honesty or competency of your contractors go above & beyond their requirements is an inefficient and unsustainable solution in a free market. This is a clear case of Moral Hazard: In the same way that bad money drives out good, corner-cutting organizations out-compete honest ones.

<comment><USER5> What about reputation? I regularly do more than the legal minimum for my clients and there are companies who do the same for me. Meeting the legal minimums only makes sense for commodities, e.g. this salt is 99.5% pure. This software is 99.5% "secure"? This software is 99.5% "complete"?

<comment><USER6> I don't think that most RFPs require or make many allowances for "reputation."

<comment><USER2> True, but quantifiable aspects of reputation (like having successfully completed similar projects in the past) can be part of a pre-bid qualification process. This is common for large or complex projects.

</comment></comment></comment></comment></comment></comment><comment><USER7> Most organizations don't take security seriously.

I work in the information security industry--primarily focused on healthcare security--and you'd be amazed and appalled at the lengths that CIOs will go to say that they "don't need to be HIPAA compliant."

More and more, though--especially as high-profile incidents become more widely reported--security is starting to become an accepted norm. There's still not much budget for it, and it's still considered an inconvenience, but at least people recognize that spending some _preventative_ dollars can save a significant amount in _reactive_ responses (DFIR, legal fees, etc.).

The HN crowd might be interested to know that the _worst_ security offenders I've seen (even worse than old legacy systems) are _software startups._ Why? Slogans like "Ship First," or agile development cycles that don't include QA/security testing as part of a meaningful SDLC. What good is shipping something every two weeks, if one of those releases loses your customer database?

My latest drive is to help organizations realize that security is a _feature,_ not just an inconvenience. Once that idea is more commonly accepted, we'll all be better off.

</comment><comment><USER8> I might be horribly misreading this, but it reads like they're talking about no specific threat or problem but rather arguing if that was part of the contract or not?

If that's the case then shouldn't lawmakers, being lawmakers, pass laws so that future government projects include a clause in the contractual arrangement? Isn't that just common sense?

Seems like this is a trend with the US government, they try to find others to blame instead of just fixing the damn issue. They had this massive set of hearings about people abusing military disabilities (e.g. claiming for disabilities obtained before joining the US military) but didn't actually, you know, fix the freaking issue -- or even try to. They just berated the people being advantaged from it.

<comment><USER9> > If that's the case then shouldn't lawmakers, being lawmakers, pass laws so > that future government projects include a clause in the contractual > arrangement?

They already passed a law creating mandatory security requirements for Federal IT systems, whether contracted out or built in house or any combination. [1]

[1] [http://en.wikipedia.org/wiki/Federal_Information_Security_Ma...](http://en.wikipedia.org/wiki/Federal_Information_Security_Management_Act_of_2002)

</comment></comment><comment><USER10> So Rep. Mike Rogers is now suddenly concerned with protecting the security of data? The same guy that's been defending everything the NSA has been exposed to have done?

<comment><USER11> So, I know we are looking for hypocrisy here because _gasp_ hypocrisy, but there really isn't any. You were providing your information to the government, making sure nobody other than the government sees it isn't at conflict with defending the NSA's actions if you see this kind of activity as legitimate.

<comment><USER10> On one hand he's alarmed that enrollment data may not be properly protected. On the other hand, he's protecting an agency that's requiring technology companies to create back-doors and weaken encryption algorithms for the NSA's convenience. How are those two objectives not in conflict?

<comment><USER12> > How are those two objectives not in conflict?

A. The government wants all your data available to them. B. The government does not want all your data available to the public.

A != B

Edit: Not to come off as rude, I just tend to agree.

If you want to say that in that sense, the government is being hypocritical, perhaps that's true. At the same time, though, their goal here is (hopefully) to keep your data safe from outsiders, whereas we can "trust" them to be good with the data they backdoor from companies ;)

</comment></comment></comment></comment><comment><USER13> I hope (naively) that one day, software developer will collectively tell the governments that they work for "Sorry, no amount of money will deliver what you're asking for".

Pretty much every government IT projects I've seen fail, that's most of them here in Denmark, has done so because of politics, laws and regulations. The thing is: the big contractors like CGI, aren't going to turn down the money. They are only to happy to deliver a poor product because they are paid millions and never asked to account for the failures of these projects.

It would be better for the industry as a whole to say NO to projects we know will fail. I don't for a second believe that CGI software developers thought that they could make healthcare.gov a massive success, or even just plain decent. If they couldn't see that, then they shouldn't be doing software development in the first place.

Doing a postmortem this way is refreshing, except you'll never get the right answer: "With the time available (not the money) this was never going to work. The integration with legacy system and the shear amount of these integration points makes this an almost impossible project". In reality will get a lot of blame allocation and CGI won't be made accountable for accepting a project that should have be rejected by anyone with half a brain.

<comment><USER14> Do you think that when CGI signed the contract they realized the integrator, the government's CMS, plus those above, HHS and the White House, would be constantly demanding major changes, _right into the week before launch_??? Also check the date of the "you must register first, no window shopping" decision, it was quite late and had a very major impact.

That CMS, responsible for integration testing, would delay that until 1-2 weeks before launch (see above change orders problem), see the tests failed, and launched anyway.

Well, I'm actually sure CGI wasn't surprised by the latter, but, still, I can't blame them for any of the above. The White House -> HHS -> CMS, all insufficiently experienced in running a major development project, turned out to be a customer from hell. Heck, given how important this site is, a key part of Obama's legacy, I and many others assumed the Administration would treat it with appropriate seriousness. We were wrong.

<comment><USER13> >Do you think that when CGI signed the contract they realized the integrator, the government's CMS, plus those above, HHS and the White House, would be constantly demanding major changes, right into the week before launch???

When the second or third of the changes happens, CGI should have told them "NO, this cannot be done professionally" and hand them their money back.

<comment><USER14> Well, that's also a decision to get out of the business of Federal contracting, and to lose a lot more of their contracting business.

Did you notice how obsequious CGI's VP Cheryl Campbell was when asked the usual leading questions about the bureaucrats and political appointees running the show? This bit from the hearings is really telling ([http://www.washingtonpost.com/politics/house-panel-grills- co...](http://www.washingtonpost.com/politics/house-panel-grills-contractors- on-troubled-health-insurance-web- site/2013/10/24/8f42c748-3ca7-11e3-b7ba-503fb5822c3e_story.html?hpid=z1)):

" _Later, Rep. Leonard Lance (R-N.J.) asked the contractors whether they could conceive of "a more incompetent administrator" than CMS.

"I have no opinion on that," Campbell replied._"

Might be a lie, might be she's been jaded by so many customers from hell she really can't precisely rate CMS....

I'd also note that it wasn't necessairly the 2nd or 3rd change that were fatal, while the late ones clearly were. I'd further note that a lot of us are optimists, believing we can perserve in the face of tough situations including clients from hell, and we can take that too far when things become manifestly impossible.

It's also possible that CGI et. al. believed, certainly hoped, that when the first integration tests in the last 1-2 weeks before the scheduled launch resulted in total failures the administration would admit reality and delay opening a site that they _knew_ was going to fail hard. I mean, this steady dribble of bad news is a zillion times worse than a one time hit in a program that's had a zillion delays and waivers already.

I guess I'm saying I'm not sure CGI could accurately gauge the depths of stupidity of this client prior to the most insane decision to turn on the known failing system.

</comment></comment></comment></comment><comment><USER15> If anyone saw this briefing, it was mostly a lot of really technologically illiterate people asking pointed questions about a gigantic set of systems that can't easily be answered to technologically illiterate people. At one point, a congressman, with the tone of a disappointed parent, said (paraphrased) "I am very disappointed in you all. have yet to hear any one of you say sorry to the American people."

Someone in the room retorted with "we didn't hear an apology when the government shut down either."

(You'd expect someone to get timeout for this kind of pettiness.)

With that said, one of the obvious problems was blame shift, as this article points out. The guy was (I don't remember this particular interchange) most likely outlining the fact that the question being asked of him wasn't relevant to "his responsibilities" in the contract. However, when responsibilities of a project are distributed, things fall through the gap.

This article is a bit too short to give enough space for the subject, but I think it does point out the most important issue - no one really had full control of the project.

<comment><USER16> Totally agree. One of the thoughts that came to my mind is that a public project like this one sh(c)ould be _open source_ right from the beginning. That would solve a lot of quality issues on one hand, and probably the pricing will also be better for the Government/taxpayers.

While I am pretty sure that most congressmen do _not_ get it, but there are some very qualified and awesome technical people who work in the Government. Probably, someone has to have the balls and call it open source one fine day.

<comment><USER17> My opinion is that anything that the government funds should be open source. Patents that come from government funded research, software projects, electronic voting, should all be open source. If we, the people, paid for it, we should be able to have access to it.

<comment><USER16> > anything that the government funds should be open source.

Generalization to open source everything that the Government does, or taxpayers fund, might not be such a great idea. There are some projects which are supposed to be secret (Like a NSA that's focused only on anti-socials) because they give our Government an edge over others.

Probably a competent agency with an oversight to decide on open/closed aspect can help, but the subject needs much longer and detailed debate. IMO, healthcare, education, civil investigations are perfect examples where we can go completely _open source_. Or get disrupted the valley way.

<comment><USER18> To be fair, I'd imagine the technology running PRISM is really incredible... i'd love if they could open source any of that.

</comment></comment></comment></comment></comment><comment><USER19> In this latest witch hunt I am sure there is plenty of blame to go around. This is not the first 1.0 system to have serious problems. It will get better. You would think they crashed the Space Shuttle and killed some people given the level of grilling they have received.

<comment><USER20> Ummm.... many people are now legally required to buy insurance, and this marketplace is the only option for many of those people. Saying "use the system or pay a fine, oh and by the way the system doesn't work" is not the same comparison to many other "1.0" systems which are optional to use.

<comment><USER19> My understanding is that it IS possible to register rather quickly during non- peak times. You are also not required to go through the marketplace to acquire insurance. And finally, open enrollment ends in March 2014, so there is plenty of time to get this sorted.

The media coverage and congressional circus is blowing this way out of proportion.

<comment><USER20> Not entirely.

They've completely hosed up existing data.

Took me 2 weeks to get in, finally got in. Application created for my wife and I. System broke. Logged in a couple days later. My wife's data is gone. No ability to add it back in. No ability to delete current application. No ability to start a new application. It's a mess.

Registering and using vastly different. Given that it took them years to get this far, I don't have a whole lot of hope that this will be usable for everyone, with data problems sorted, by March. _Possible_ , but not likely. Especially because the attitude of "hey, just go somewhere else to buy" is so quick to be used. If that's really the case, why did we bother to even put this together, if it's not at all necessary or required?

There's going to be massive loads of hidden bugs that will plague this for months, if not years. Having such a tight deadline on it is crazy because it's not at all how any large insurance agency works, nor is it how the federal government works.

<comment><USER21> I think it's pretty obvious that if the bugs aren't sufficiently fixed within the next few weeks, the individual mandate penalty will be waived or at least delayed.

<comment><USER22> I don't give a flying rip about the individual mandate penalty. But..

If you need insurance and you just received a cancel notice from BCBS that your policy is gone as of Jan 1st it becomes imperative that this exchange work within the next few weeks.

This isn't a political game real people are going to be royally hozed and soon if this doesn't get fixed.

<comment><USER21> You've got more than nine weeks, I have faith that even the sub-par government contractors working on this will get it sorted out by then.

Feel free to come back and tell me how wrong I am if my faith turns out to be misguided.

<comment><USER14> No, 9 weeks would require everyone who _must_ get a new policy by Jan 1 to get all the way through all the systems, exchanges -> insurance companies, in the last three days of December.

Even if several paths are kludged for these most desperate millions of people losing their current coverage Jan 1, I can't see how any more time than 7 weeks is feasible, leaving 2 and a fraction to process them. And to know the system is really working, large numbers, 10s of thousands, had better be getting successfully through the systems before then.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> The most useful part about this article for me was to discover that Northrop Grumman's CISO is phishing its own employees. Brilliant. Wish I had thought of it. Great way to keep people on their toes and aware of what's going on in the space.

<comment><USER24> This is standard practice for all IT organizations, and any org that isn't testing its security is failing at security.

<comment><USER25> Same for backups. If you have six months of backups but you haven't tested any of them, and they broke four months ago, then it's going to be very unpleasant.

</comment></comment></comment><comment><USER26> Can we talk about software engineer certification yet? I tought things like this suppose to push on the movement.

<comment><USER27> I guarantee that the contractors involved were loaded with a significant number of Java & Microsoft certified developers. Furthermore, I'd guarantee that the Big Dig, et al, were loaded with certified "real" engineers. Certification (even some fancy "project management" certification) doesn't get you any guarantees of project quality as a whole.

If anything, I'd expect a focus on certification to decrease quality. Those things are expensive & time-consuming and the only ones who invest in them are the people who expect to be in that consulting ecosystem for a long time.

There are processes, not certifications, that result in generally high-quality projects (see NASA's processes) at the cost of being incredibly slow and expensive.

<comment><USER26> Sorry, perhaps I didn't make this clear enough. I wasn't talking about those Java/MS certs. I was talking about this: [http://cdn1.ncees.co/wp- content/uploads/2012/11/Exam-specifi...](http://cdn1.ncees.co/wp- content/uploads/2012/11/Exam-specifications_PE-Software-Apr-2013.pdf)

<comment><USER18> Is there like an example test online? I've been in this game for 7 years, but I still learn new things all the time. I'd be curious how well i'd do :D

</comment></comment></comment></comment><comment><USER28> Regardless, government site or not, who currently does care about security?

Most code I have seen widely in production is using old sql injection vulnerable code. No sanitization and no proper session handling.

You would think that people would care about something like security with all the privacy concerns.

I wish I had better words to say this, but I had just woke up and out the door to breakfast.

<comment><USER29> I keep thinking whether it would be a good idea or not to hold companies responsible for security issues affecting their users. If you fail to secure passwords, why shouldn't there be a fast-track way to sue? Almost any physical service provider I can think of already is responsible for damages. Your plumber fails - in most cases the company is insured and will fix at no cost and will be responsible for damages. Your mechanic fails - there's likely a clause in their agreement that allows you claim for the damage caused. Even if your payment card is misused, the bank is expected to reverse the charges. Why are the internet service providers excluded from this treatment?

Sure, it's possible that this kind of danger would be then aimed at separate developers working in those companies too... but I'm not sure it's a bad thing. It would be easier to resist stupid requirements (I won't do it, because it would bring legal issues on me) and even the comments on SO would be different too ("if you do this, you will be sued", rather than "this is not a secure way to do it").

</comment></comment><comment><USER30> It was a 3 year project with requirements changing up until the last 4 months where end-to-end was managed under waterfall (some pieces/contractors used agile like methodology)...and there was 2 weeks of final end-to-end manual QA...what the hell else did they expect to happen?

<comment><USER14> It was worse, the "no window shopping" decision was made less than 4 months before launch (August to September as I recall), and changes were made through the week before launch. The NYT reports 7 major changes in less than 10 months.

And it didn't matter what the QA reported, the site was hell or high water launch Oct 1st whatever they revealed.

As always, those with political power (reported to be the White House and CMS, maybe some of HHS) trump those who have to make it work in the real world.

</comment></comment><comment><USER31> I don't think the one line quote from the hearing necessarily supports the headline, but I certainly don't have high hopes that the site is secure; the number of bugs and inconsistencies I found just trying to create an account dissolved any hope of that.

</comment><comment><USER32> Blame the contractors?

Instead of the ridiculous way the gov't handled it, with constantly changing requirements and a "change the car tire while we are driving" attitude?

Sounds like the WashPost is trying to do some damage control.

<comment><USER14> I'm seeing enough of this trope, not to include the BBC initially, to wonder if this didn't hit the current incarnation of the Journolist.

Unfortunately this disaster is so huge that's not adequate to tamp it down. But it sure looks like some are trying ... hmmm, what is the broadcast part of the MSM aside from Fox saying?

</comment></comment><comment><USER33> Or else what?

</comment><comment><USER24> The overall project needs an _independent_ security evaluation by a separate organization. Without an audit and tests before launch (and ongoing after), any problems discovered in production are the primary contractor/procurors's responsibility.</comment>


Ask HN: How to stay focused? - <AUTHOR>

Hello, I'm trying to work on my own startup for a while. I sometimes do some Ruby and Javascript contracting to burn trough my savings a little slower (ping me if you're looking for a part-time UI guy).
I've started to work on my current idea more than a month ago. But I'm going forward REALLY slowly. And, mostly, because I cant focus. I waste a lot of time on 'hacking here and there' or writing some small utility for myself.
Do you have any ideas how to stay focused on my main project? How do you get rid of hacking on side-projects too much? <comment><USER3> You have to organize the world so that you get a series of small successes. And be prepared to take any success as a success.

Make it easier for yourself to accomplish things. If you can remove parts of your task list (punt for now or remove entirely) it can help -- a long todo list is demoralizing. I find that people generally try to build very large systems; this the enemy of productivity.

Choose a design that will allow you to arrive at as minimal a system as possible as quickly as possible, such that the system still retains conceptual integrity (that is to say, it is whole.) Then, afterwards, each time you sit down and do a bit of work, you'll have added a function or whatever instead of slogging along towards your first working system, which could be quite distant.

Finally, don't thrash when the working isn't happening. Instead, go goof off or go for a jog. This really helps. You can't work all the time, and if you've been pushing too hard your productivity gets diminished rapidly.

<comment><USER4> You have got this down to a science, haven't you.

<comment><USER3> I don't feel very productive. Most of what I wrote is about doing things. Right now I'm at a company. Different skillset.

</comment></comment></comment><comment><USER5> Use a revision control system, force yourself to commit only changes to one feature at a time. This restriction helps you to avoid wandering into other things, as it would take extra work to manage the unrelated changes.

"Release" frequently; if you don't have any customers, just pretend that you need to package something up. For instance, aim for a new build every day, and maintain release notes describing your changes. If you haven't been doing anything _worthy_ of a new build each day, you quickly realize that you're losing focus and not moving the project forward.

<comment><USER6> very true. As a noob github user I find my commits to be very "ugly". Git encourages you to write a short descriptive sentence of what you did. For example "added validation checks to users class".

Well the way I code is to jump around all over the place and make little updates here and there. The commit messages end up appearing on files that have absolutely nothing to do with the commit. It's a constant reminder of how to be more structured and orderly. And also to value your time better, since you want to package up and send the damned commit already, you just have to _get it done_.

Works for me!

<comment><USER7> Actually, one of the benefits of Git over, say, Subversion, is that it's much easier to hack away on multiple things, and then arrange a series of sensible, self-contained commits from your messy working directory.

It's not necessarily a great way to work at all times, but it's a handy facility to have. Personally I use it most in the early, somewhat experimental stages of a new feature or project, when I find it useful to mentally separate experimental hacking with organised committing.

For most things, though, I try to focus on one thing at a time, and here Git's quick-'n'-easy branching and merging helps out. Whenever I start something new, even if it's just fixing a minor bug, I'll create a new branch just for that work, often naming it after the ticket number in our issue tracking system. Then your being in that branch is a constant reminder of what you're supposed to be working on.

Ryan Tomayko has written a good article on these aspects of Git here: <http://tomayko.com/writings/the-thing-about-git>

</comment></comment></comment><comment><USER8> I had this very problem and what I did was use the Emergent Task Timer. Now, I know this sounds like lifehacker fluff, but it really worked for me. I used this:

<http://davidseah.com/tools/ett/alpha/>

Save it to your desktop and what you do is this, write 4-5 tasks you want to complete, and make sure you can hear the beep every 15 mins.

What I do is work on something, if I hear the beep and I'm still working, I keep going. If I hear the beep and I'm not working on said task, I go in to ETT and write what I did over the past 15-30-45-60 minutes. Make sure to put an entry for "IM", "Email", "Telephone","Bathroom" and "Food".

What happened is that when I started using it, I realized I only did about 2-3 hours of productive work a day. It took me a few months to push that up to about 7-8 in an 8-10 hour work day, but you get there by keeping track of how much actual work you do in a day.

Slimtimer.com also works well to this effect. Basically, just take the time to count where every minute goes. You'll soon identify where your focus is going instead of your project and be able to fix it.

Closing IM was key for me. :)

</comment><comment><USER9> Try tracking how you use your time. Go make a grid with hours between 7am and 1am for Sunday - Saturday. Print this. Then write down what you do. I do this to hold myself accountable (I do not use it for planning). I find doing this keeps me on track and lets the little successes build on each other.

<comment><USER10> _Go make a grid with hours between 7am and 1am for Sunday - <USER2>

You don't even need to be that labor-intensive - the Emergent Task Timer works great.

[http://davidseah.com/blog/the-printable-ceo-iii-emergent- tas...](http://davidseah.com/blog/the-printable-ceo-iii-emergent-task-timing/) [links to PDFs are at the bottom]

<comment><USER11> Use RescueTime instead of tracking by hand: <http://bit.ly/itYfb>

<comment><USER12> Or stuff to do:

<http://stufftodo.dedasys.com>

Very different approach, my code is free/open source.

</comment></comment></comment></comment><comment><USER13> Find a partner. For me at least, having someone else to work with is quite motivating.

</comment><comment><USER14> pomodoro technique ?

<http://www.pomodorotechnique.com/>

<comment><USER15> +1 for this. The Pomodoro technique usually helps me when morale is low. You can always commit to a 25 minute push.

If you want to try it you should also check out my open source client, <http://code.google.com/p/pomodairo/> =)

<comment><USER16> I looked at the Pomdoro site, and I'm intrigued. I don't understand something, though. How does it work with programming?

First of all, programming tasks defy time planning, as the next unplanned time-sinking bug or unforeseen difficulty always waits just around the corner.

Second, when you are in the zone, a timer going off every 25 minutes will just cause aggravation.

<comment><USER15> You can look at it as an agile process. You don't model your whole project at once, but when you start a Pomodoro you commit to working focused for 25 minutes. When the time is up you can prioritize differently or make a push on an unplanned item.

Also, I totally agree on your in-the-zone statement. I currently only use Pomodoro when I am having a slow day and I don't want to let the procrastination get the best of me. When I am in the zone I don't need Pomodoro to help me! =)

</comment></comment></comment></comment><comment><USER6> 2 things: My natural style of coding is to work on multiple aspects of my project rather than concentrate on one aspect. Maybe this does make me less productive, but what usually happens is I get burnt out constantly thinking about the same problem so much so that I start to avoid working to solve it! Secondly when you say "slow", relative to what? When you are developing a system from the ground up, working it out conceptually takes tons of time, probably much more than actually coding at first.

I am pretty sure I code at a snail's pace, and 60% of my time is spent working the problem out conceptually. Yes I think the process is very SLOW, but I have accepted that the cost is the cost.

In other words, don't be so sure these problems are caused by your inability to focus. Maybe the problems are just problems, and slow or not, you need to get them done.

</comment><comment><USER17> I felt the same when working on my startup, and something that helped me was to re-think what was required for my first release. Often it seems that everything you've spec'd out is required, but if you really think about it, you should be able to leave some things for subsequent releases.

Once you've culled some features like this, it's much easier to get excited and stay focused on that first release, as it will seem so much closer than before.

</comment><comment><USER18> I can sort of relate since I'm in the same boat with my startup. The key for me was to set some goals for each week, tell my friends about them (to help keep me honest) and then to simply get cracking. Beyond that, I'd suggest that keeping focused can be as simple as calling yourself out for BS'ing. :)

As for part-time UI work, drop me a line -- I may have some stuff for you: paul.singh [at] philtro.com

</comment><comment><USER19> Rethink your idea. Maybe you are not 100% sure what you want, and jumping left-and-right instead of facing it.

Once you clear up and the path is found everything will go smooth.

Pragmatically, put yourself one question: What will go into the first release?

</comment><comment><USER20> Go full time on your idea. Or at least make some commitment so that there is a monthly burn(say a hosted server or a github account at the minimum). Nothing like pressure to keep one focused. This is from my own experience.

</comment><comment><USER11> Make it a game: <http://bit.ly/iGxMB>

</comment><comment><USER21> One word: ADDERRALL</comment>


Ask HN: Agile for a team of 2? - <AUTHOR>

We are a team of two (developer + UX/UI designer) working in a web app. We are just starting and we are looking for a way to work seamlessly.
What Agile practices would you recommend us to start with?
Thanks <comment><USER2> Don't bother too much about how to split work, how to manage schedules, how not to step on each other toes (I actually recommend doing it). This all comes naturally.

Worry mostly about focusing and decision-making, how to cut unimportant stuff early enough. With 2 guys, that's the big challenge.

</comment><comment><USER3> It's not "agile" but very much suited to your situation, MVC, as a developer you would maintain the Model and Controllers. The UX/UI designer sticks to the Views. Apply agile methods around this. As to which, you will need to experiment and see what works for you.

And take the time to learn each others skill sets and talk about the reasons why you do things the way you do. Most of all challenge each other on a daily basis.

Oh, and have fun.

<comment><USER4> This. Hopefully you've selected a component or mvc web framework that enables clear separation of roles, to minimize integration bottlenecks.

As for processes, Scrum methodologies such as the daily stand up meeting and weekly defined iterations would probably be beneficial. But take that with a grain of salt, since some teams simply don't work well with such fixed parameters. Give it a try, but don't stick to it out of obligation. Stick to it if it works.

</comment></comment><comment><USER5> From working in extremely small things myself, I can recommend a few things:

1\. Write tests around everything you have the time to.

2\. Communicate frequently.

3\. Try to write things in vertical (shippable) slices.

4\. Work in short iterations.

5\. Keep what works, drop what doesn't

Ultimately, the most important element to reap the benefits of 'agile' was #5.

</comment><comment><USER6> I did a pseudo-agile process for a project where I was the solo developer. A lot of agile practices scale down quite nicely: defined scope, sprints, unit testing, etc. The key is to keep everything small: short sprints, small features or small parts of large features. ALWAYS deliver a shippable product at the end of each sprint, even if its just for morale purposes.

</comment><comment><USER7> We're a team of three working on a web app and we use Pivotal Tracker. We use it more as an agile-y way to do project management instead of something like Basecamp.

</comment><comment><USER8> in that small of a team i would say focus on one to two day sprints with releases to production at the end of day two.

unit testing is NOT agile (it's extrememe programming) but you should still do it.

be sure to continually evaluate whether what your doing makes sense, if it doesn't drop it/change it.

</comment><comment><USER9> Depends on what the app is as well and how you can split the work up into stages. Are the features clearly defined? Can you work on small feature driven iterations? Or is it better to work on goal based sprints? One general piece of advice I can offer is that since you are a team of two you might not need to take an approach which has a large review based section in it. This is again purely situational. If you are doing usability testing then this can change. Also are you two working in the same location or is it remote? In the end the methodology has to suit your needs. Consider the above stuff and if you can hit us back with a bit more details I'm sure there'll be more specific answers.

As for specifics... Look into FDD. Feature driven development.

Oh and good luck with the work :)

Edit: by less review I don't mean testing and stuff. I mean formal and rigid sort of meetings every week. Sure have a proper review at regular intervals but most of the reviewing should be happening automatically with every feature/sprint completed.</comment>


Older and Wiser... Up to a Point - <AUTHOR> http://beta.spectrum.ieee.org/tech-talk/at-work/tech-careers/older-and-wiser-up-to-a-point

<comment><USER3> Meaningless study is meaningless. There are so many complete breakdowns of basic logic here that it makes my head spin.

>>> Prejudice against older programmers is wrong, but new research suggests it's also inaccurate.

Setting aside the issue at hand for a second, I want to point out that holding some true belief is neither morally right nor morally wrong, it is just the state of being correct. I think most of us would agree being correct is always preferable to being incorrect. Yet here the author claims that believing something can be morally wrong even if it is a true belief? That's a little weird.

>>> A dandy natural experiment to test the technical chops of the old against the young has been conducted—or discovered—by two computer scientists at North Carolina State University, in Raleigh. Professor Emerson Murphy-Hill and Ph.D. student Patrick Morrison went to Stack Overflow, a Web site where programmers answer questions and get rated by the audience. It turned out that ratings rose with contributors' age...

No. Just no.

I see no reason to accept the assumption that how high your score is on stack overflow relates in any meaningful way to how effective you are at computer programming. For example, if I took two programmers who were equal in every way, except that one spends the entire workday on stack overflow and the other works very hard all day, the one that has the lower stack overflow score is far more effective.

I see no reason to accept the assumption that stack overflow is in any way representative of the programming community in any way. It is a self selected group of people that may or may not be employed as programmers.

This isn't a study, it's a joke.

The fact is, the quality of any individual programmer increases with age and experience. However, the average quality of all programmers of a given age decreases above some age. How are these two facts both true? People get promoted out of being programmers all the time, but very few people become programmers past a certain age. People become managers, consultants, executives, entrepreneurs.

<comment><USER4> > Yet here the author claims that believing something can be morally wrong > even if it is a true belief?

This is entirely consonant with deontological ethics, as I understand it.

<http://plato.stanford.edu/entries/ethics-deontological/>

<http://en.wikipedia.org/wiki/Deontological_ethics>

> the quality of any individual programmer increases with age and experience.

Until senility and other age-related infirmities set in, especially ones that negatively impact the ability to concentrate, remember details, visualize problems, and express concepts in symbolic form.

<comment><USER5>
        Until senility and other age-related infirmities set in,
        especially ones that negatively impact the ability to
        concentrate, remember details, visualize problems, and
        express concepts in symbolic form.

We're not talking about 80 year old programmers here, there's age discrimination against people in their 40s too.

</comment></comment></comment><comment><USER6> Why is it so difficult for the younger folks to concede that older folks have something solely by the virtue of being old?

From John Ciardi "About Crows" (Fast & Slow, March 1975, 3):

       The old crow is getting slow; the young crow is not.
       Of what the young crow does not know, the old crow knows a lot.
       At knowing things, the old crow is still the young crow's master.
       What does the old crow not know? How to go faster!
       The young crow flies above, below, and rings around the slow old crow.
       What does the fast young crow not know? Where to go!

<comment><USER7> > Why is it so difficult for the younger folks to concede that older folks > have something solely by the virtue of being old?

It's difficult to talk about this sort of stuff without sounding like I'm a kid throwing a fit, but I guess it's worth a shot:

Growing up it feels like older people should be, fairly uniformly from the perspective of a child, _incredibly formidable_. You've had three or four times our experience and you should really know your stuff. You should have done your homework on your opinions and actions, you should be more self- controlled, more insightful, more... everything that doesn't relate fairly directly to muscles really. And you don't exactly try to deny that either - build up this image of yourselves as people whose judgement should be deferred to and ... when does any of it ever get backed up?

When we talk to an adult, it's very rare to feel like we're dealing with someone more knowledgeable or experienced than us at all, let alone three or four times so.

Adults lock kids up in school for the a lot of their waking lives and even your average kids still manage to get up to a competitive standard with your average adult in a year or so. The difference on forty years of age should not be a single year.

Maybe part of that's selection bias, adults just never get to do anything particularly difficult in front of us - but I don't think so in this case. Unlike many people my age in this country, I've worked a real job before - doing things that require thought - and the job wasn't hard to learn or anything like that. The people there, while friendly and nice, didn't strike me as being people with positive multiples of my own skills, despite some of them being multiples of my age.

Which isn't to say that some old people _can't_ be incredibly formidable, from time to time you run into such people and can learn a lot from them - but most people seem to get to, say, their first job after school and some of the damage that school did them fades a bit, and then they just stop growing. If a kid like me can match or exceed most of the older people she meets, then there's something very wrong in the idea that you get something extra just from being old.

 _An nescis, mi fili, quantilla prudentia mundus regatur?_

You don't get better by ageing, I think - at least, not _solely_ by virtue of being older. Age represents opportunities to seek out new experiences and knowledge, and thus to get wiser. However, lots of people never _take_ them and make much of themselves at all.

My fifty year old father's response to locking his washing in the washing machine was to run another wash cycle, and when that didn't work to run the spin cycle - it was only when I came along and released the child-lock that he was able to get his washing. The manual was right there besides the machine.

And he's not suffering from dementia or anything like that. It's tempting to think he is but he isn't. He's just spent all his life working the same mediocre arts job and sitting in front of the TV every spare moment he gets.

Respect that, as better than me just because he's older? It's like looking at a cripple. But... he's still meant to be healthy, he was always that smart. And so many adults are like him. There doesn't seem to be anything biologically wrong with them. And I love him dearly, but what does he have that I don't? And if he doesn't have anything just by virtue of being older, why should I assume that anyone else does -- if age is the sole criteria?

<comment><USER6> > Respect that, as better than me just because he's older?

He's not better because he's older. He's more experienced because he's older. That experience has value because you cannot earn it any other way.

> what does he have that I don't?

Knowledge, tolerance, sacrifice, endurance, and perspective perhaps? When you are 50 you will have some of the same things simply due to the fact that you lived to that age. Older folks are human and make many mistakes just like every other human. It's because they've made more mistakes than younger folks that they are ahead on the opportunities to learn. There's nothing special, other than having been able to do everything you'll do, long before you can do it.

If you're having trouble seeing this point of view, compare your abilities and life experience to that of a 10 year old. Explain yourself to that 10 year old such that the youth will possess the sum total of your experiences and be able to act as you would act. Not possible you say? Perhaps now you can appreciate the value of aged experience?

<comment><USER7> _> He's not better because he's older. He's more experienced because he's older. That experience has value because you cannot earn it any other way._

If I put a pound coin in a fire, it doesn't become valuable to put your hand in the fire just because there's no other way to get it. You might, after being burnt, rationalise it as valuable because it had cost you dearly. It might even become a ritual; a way to prove that you were a manly man who liked money or something, _'I'm tough, look at me make small gains at massively disproportionate costs.'_ I don't know. However, beforehand, it would seem insane to value the pound in the fire above a pound that someone else might offer you in its stead without the risk of getting maimed.

Difficulty in attaining something makes sense for fashion, because it displays your fitness. However, the worth of things doesn't scale along every axis of value in proportion to the suffering or cost involved in attaining them - <USER2> I don't see how the suggested measure is of worth with respect to experiences that have nothing but age to recommend them. As far as experience goes, it seems that the experiences should be worth something for what they give you - whether that be hedons or skills or whatever - and that age is part of the cost you're paying.

They're going to cost you something you're never going to get back, a portion of your life, and the return shouldn't just be that they've cost you something.

The idea behind age seems to be that it's been pretty darned expensive and they must have bought something valuable with their lives because ... _well, look at how much they spent._ But that's not how spending works - people buy extended warranties and the like all the time. Maybe they're just bad consumers.

 _> Knowledge, tolerance, sacrifice, endurance, and perspective perhaps? When you are 50 you will have some of the same things simply due to the fact that you lived to that age. Older folks are human and make many mistakes just like every other human. It's because they've made more mistakes than younger folks that they are ahead on the opportunities to learn. There's nothing special, other than having been able to do everything you'll do, long before you can do it._

He hasn't been able to do everything I'll ever do, he can't even do everything I can do right now. He's never had the opportunity to learn about monads because he's never tried programming at all and gave up on maths when he left school. He's never had the opportunity to learn to fight properly because he's never put in the work to find decent teachers and then to practice diligently. He's never really had the opportunity to learn a great number of things about a great number of areas because he's never learnt the pre-requisites.

I suppose it's true enough that they show up as potentials if you go far enough down the tree of choices that he might make and might previously have made. That he could have made better choices to net himself wider/more interesting parts of the tree. But he's followed one path through life on which those things didn't show up.

Some opportunities multiply as they're seized, and if you never seize them then your range of opportunities is only ever linear with respect to time.

 _> If you're having trouble seeing this point of view, compare your abilities and life experience to that of a 10 year old. Explain yourself to that 10 year old such that the youth will possess the sum total of your experiences and be able to act as you would act. Not possible you say? Perhaps now you can appreciate the value of aged experience?_

When I was ten, people of my age now, who'd lived the life I've lived, were visibly smarter than me. Just as people who continue to live the sort of life I intend to live are visibly smarter than me nine years later on from this point.

But that was not my argument anyway - my argument was that age is just the chance to make something of yourself, that since many adults don't kids tend not to respect age. The two don't strongly correlate, the latter is not good evidence of the former.

</comment></comment></comment></comment><comment><USER8> Interestingly, I find that a lot of the questions on Stack Overflow are from such noobs that I'd have to spend time explaining how to program before getting to their actual question. This disuades me from participating, as it's hard to find the questions from programmers who I could help.

As a professional, if I can't find a way to contribute my expertise in a timely and efficient way, then I'll get on with something interesting and more lucrative. Which is a shame, because there is a lot of useful stuff on SO, and I'd like to contribute at a high level, but I'm not willing to put in 2 hours a day to find the 1 or 2 questions that would be worth the time.

I'm an older programmer, and this may be one explanation of why older programmers answers on SO aren't as useful - the good ones are not the ones answering questions!

This is just an anecdote, but one that certainly applies to me

<comment><USER9> The score in StackOverflow is meaningless without looking at profile of an individual and see what question they ask or how is their level of knowledge in their answers. Spending time to contribute to StackOverflow is not necessary a bad behavior. Programmers can meet challenges that they might have in feature and get ready for them.

I personally answer to questions that have no answer or not correct answer when I google for them but finally I've solved myself. I even googled and reached to my own answers!

</comment></comment><comment><USER10> The idea that I will not get better at software engineering as I continue to practise it is baffling, and slightly scary. Perhaps I do not want it to be true, but I cannot see how I will get worse with added experience.

</comment><comment><USER11> No comments about the truth of the prejudice against older programmers, but this study does not prove anything. There is a huge self-selection bias going on here, as not all programmers go on stack overflow and certainly not all programmers answer questions on stack overflow. There could be many older programmers who have not kept up to date with the latest skills and best practices, who know the only reason why their job is secure at BigCorp is because their code is so bad/intentionally obfuscated that no one else can read it, who don't answer questions on stack overflow.

</comment><comment><USER12> Find joy in working with accomplished hackers regardless of age. On this very forum I have discovered several worth following - I read their blogs, look at their code, aspire to learn from them, and sometimes despair at all that I still need to learn.

This article mentions how chess training software has sped the training of chess players to the IM level from a baseline rating of 2200.

Wouldn't it be fun if a similar training setup was available for hackers . . . I wonder what that would look like.

</comment><comment><USER13> I think this has parallels with the saying "I'm not young enough to save the world".</comment>


The Next Librarian of Congress Should Be an Actual Librarian - <AUTHOR> http://www.newrepublic.com/article/123045/next-librarian-congress-should-be-actual-librarian <comment><USER2> An actual Librarian would be an improvement to the current vocation, but even better would be a writer/musician/artist with an advanced education in a logic-intense field of study (ex: English, Philosophy, Law, or Finance).

Personally, I'd like to see Duff McKagen get the job.

Edit: I'd also love the responsibility of the job, being a somewhat-obsessive IP laws and technology guy, but I'd probably make so many enemies as to be unemployable after leaving it, due to likely smear campaigns.

</comment><comment><USER3> I think this misses the point of what the Librarian of Congress does. I agree that historians like the past few choices were are not a great fit, but the Librarian of Congress doesn't just run the actual Library of Congress; they make important decisions about copyright law. If we want reform to these laws, the Librarian needs to have a good background in copyright issues.</comment>


ScyllaDB Trends – How Users Deploy the Real-Time Big Data Database - <AUTHOR> https://scalegrid.io/blog/scylladb-trends-how-users-deploy-the-real-time-big-data-database/ <comment><USER2> Thanks for the writeup! What was the sample size on your survey?</comment>


Tech's Next Revolution Might Be Open Source Semiconductors - <AUTHOR> https://www.bloomberg.com/news/articles/2020-01-22/open-source-transformed-software-the-chip-industry-is-next <comment><USER2> Open source semiconductors is such a broad area, and sadly only a tiny spec of it is open source: The HDL code that describes the digital circuit.

Everything else is _very_ experimental at best. These days the FOSS FPGA tools are finally getting some traction, with Yosys and Nextpnr. But AsicOne tried to make an ASIC with open source, and faced endless troubles.

For ASIC there is basically QFlow, which is quite old, but used successfully to tape out a chip in the past, and there is OpenRoads, which is very new, experimental and ambitious. There are still major gaps in these tools, so in the end you inevitably have to sign an NDA and use proprietary tools and libraries.

And that's just talking about DIGITAL semiconductors where you compile HDL to pretty much generate the transistors from foundry cell libraries. So you have to sign an NDA to get the cell library, but you can at least release your code.

For analog chips, you can't do anything. An analog design highly depends on the parameters of the transistors you use, so before you even BEGIN designing, you have to sign an NDA to get the transistor models and you can NEVER open source an analog design.

The small dot of light at the end of the tunnel are projects like Minimal Fab, who make more accessible fabrication lines with open transistor models.

The crazy thing is that back in the days there were lambda rules, which were open rules anyone could use to design and model with. But with sub-micron devices, these scalable rules no longer scale, so fabs started producing secret models for their specific process.

I'm hopeful that after FPGA, and digital ASIC, analog will be next to be revolutionized.

<comment><USER3> > And that's just talking about DIGITAL semiconductors where you compile HDL > to pretty much generate the transistors from foundry cell libraries. So you > have to sign an NDA to get the cell library, but you can at least release > your code.

Yes you can release your code, but you can't release your netlist or GDS-II. There's no guarantee that somebody else will be able to take the same HDL and close timing, even with the same foundry libraries (say if they are using a different tool, or different options). You'll also need things like clock- gating cells, memories, IOs (at a minimum) and those are foundry specific, so those would need to be abstracted out in some way.

> For analog chips, you can't do anything. An analog design highly depends on > the parameters of the transistors you use, so before you even BEGIN > designing, you have to sign an NDA to get the transistor models and you can > NEVER open source an analog design.

Now this is where I disagree. Sure you can't open source your analog GDS-II, but maybe that's not the way to go. In my opinion what you want to do is build a foundry independent PDK for a generic 28nm, 40nm or whatever node using PTM models. A well designed analog circuit needs to be relatively independent of specifics, otherwise it's not going to work across all corners (this is more true for modern nodes than the kind of nodes the old textbooks talk about) and it'll be difficult to port to another process. So there's a good chance that analog circuits built for 'generic 28nm' or 'generic 40nm' could be ported to any foundries process (of course the PDK needs to be well designed). Yes you won't be able to push things to the limit as the DRC will be wider, but analog rarely needs to go to the limit. You could probably take the same approach for digital, but that's a lot more open source stuff to build.

Check out OpenRAM and FreePDK45 for academic projects taking this approach. Unfortunately FreePDK45 is only available to those with an academic email (despite being called 'open source'), which makes me very sad.

<comment><USER2> Yea, I think this is an interesting approach. But FreePDK45 slides mention that it's not designed for manufacture, and there does not appear to be an easy upgrade path. So you could design a chip with FreePDK, release the design, and then redo the whole thing in a vendor PDK.

I talked to someone who worked on AsicOne, and he said that even if you make your own PDK and draw your own transistors and everything, you'll still have to sign an NDK to do the sign-off and what not. I'm not intimately familiar with the whole process myself, but from what I understand it is basically impossible to have an open source analog design that you can actually manufacture. (sure, you can make a theoretical toy thing, but if you can't manufacture it, who cares?)

<comment><USER3> I'm quite familiar with the process and I believe it's entirely possible.

You will need to run foundry DRC decks, but the company you're taping out through will do this for you (I presume that you're not big enough to deal with TSMC directly). This is because a design that fails DRC could actually break other people's chips if you're sharing a wafer.

Of course if you really want to know that it'll work you need to also run foundry LVS and stimulate corners with foundry spice models and foundry PEX. But if you're gutsy you could skip this, if you believe you've put enough margin into your PDK corners.

Certainly there is zero need to redraw your transistors. Transistors are transistors, a few layers (od, poly, contact, implant, ...), there's no magic, no magic sauce. The foundry wants an SVG with overlapping rectangles (of some minimum size), nothing more.

</comment></comment></comment></comment><comment><USER4> I think the bigger thing for Open Source Chips is going to be the expiration of a ton of the x86 patents next year. That is going to free up a whole host of people to take a look at trying to build A better open x86 processor. Maybe then we can finally get to having a truly open source server from chip through software.

<comment><USER5> What's the point of open source for consumers, expect for maybe education, when you can't produce something from the source yourself nor be sure the product you buy is made from the source?

It's _very_ cost prohibitive to run a batch through a semiconductor fab. You are not going to request one offs unless you have a few millions to spare.

It's not like running make after cloning some sources.

<comment><USER6> Well the barriers are pretty low today. Even fairly small companies like Axis (they make security cameras) or ubiquiti (routers and access points) can work with CPU vendors to license their tech and get a custom CPU. With an opensource IP the barrier will be even lower. Maybe even within a well funded kickstarter range.

Maybe for a killer home router with a 100% open hardware+software platform that can route 8 ports of 5Gbit/port at line speed that would more trusted than random commodity hardware.

Or something to handle say 8 security cameras and use machine learning to handle all 8 streams for not just motion detection, but also identifying what person/object is in each stream.

I'd certainly pay a premium for smart devices in my home that I knew that I could trust, wasn't spying on me, doesn't require cloud connections, used open APIs/standards, and wouldn't die with the next time a company dies, gets bored, gets greedy, get purchased, etc.

<comment><USER7> I'm curious about the ubiquiti custom CPU, can you share a link to more info ? Thanks

<comment><USER8> "Custom CPU" seems like a bit of a stretch. They have ASIC people on staff (eg [https://rocketreach.co/ya-chau-yang- email_61973123](https://rocketreach.co/ya-chau-yang-email_61973123)), but based on the fact that you can flash basically all their devices with OpenWRT (including those disc-shaped APs), I think the "ASIC" is just a conventional ARM or MIPS core with some peripherals geared toward hardware acceleration of common network tasks— switch routing, vlan tagging, etc.

This page talks about the specific features available for hardware offloading:

[https://help.ubnt.com/hc/en- us/articles/115006567467-EdgeRou...](https://help.ubnt.com/hc/en- us/articles/115006567467-EdgeRouter-Hardware-Offloading)

</comment></comment></comment></comment></comment><comment><USER9> Is the real barrier to CPU production open source of the logic design or is it in research into chip production, node design, including hundreds or potentially thousands of process steps, maximising yields, segmentation of the market and other marketing issues, defining standards, chipset design and integration, validation, the generally prohibitive cost of building fabs and actually producing the chips and getting sufficient capital to make inroads into the marketplace, e.g. with OEMs.

The idea that open sourcing the logic is going to make other companies competitive with a financial behemoth like Intel is really a stretch.

<comment><USER10> Thermal packaging!

</comment></comment><comment><USER11> If silicon/chip IP becomes free, and the only major cost to tape-out is an integration team, and Fab related stuff, China, not silicon valley, is the real winner

<comment><USER12> All the more reason for companies to focus on true innovation instead of milking IP licensing.

All the more reason to make it profitable for fabs to exist within the US.

<comment><USER13> _> All the more reason to make it profitable for fabs to exist within the US. _

I'm particularly interested in this space. Anyone more familiar with it care to comment? Is there a push for more US fab capacity? Any startups? Any political push to change laws to make it more favorable to start one?

<comment><USER14> I can't answer your questions but may I piggy-back?

What stops Fab Facilities existing in "western" countries at the moment?

Someone told me a major reason for the move was because the chemicals used in top-tier facilities are basically banned in the west. Not technically banned but considered so dangerous (they're all carcinogenic) that the cost (health and safety, insurance, compensation) make them uneconomic.

Is that right?

Does it matter whether fab facilities are near to final manufacturing locations? Will Apple\Foxconn buy chips from a San Fran shop if they then have to be shipped to China for inclusion in the device? Since most devices are put together in SE Asia, the delay might be killer...

</comment></comment></comment></comment><comment><USER15> Open source, or open drain? :p

<comment><USER16> I think that depends on the gate.

</comment></comment><comment><USER17> When will optical CPUs become a reality?

Instead of pushing electrons with a voltage difference, to signify 0 or 1, a light wave of red or blue, can be used instead.

Anyone here a photonics expert?

<comment><USER18> [https://www.luminouscomputing.com/](https://www.luminouscomputing.com/)

There's at least some cool work going on in the GPU/TPU area.

<comment><USER19> Thanks for that link, I hadn't heard of Luminous.

</comment></comment></comment><comment><USER20> This trend (if it's actually happening) is a symptom of the death of Moore's law. When Moore's law was operating in full swing, it would rarely make sense to build your own chip using open source. In the time that you could design and build your chip, general processors would have doubled in speed and you'd be better off waiting for the general processor.

Here are a few predictions, some of which have already occurred, that may result due to the death of Moore's law:

 _Already Happening:_

\- More custom chips (squeezing the last bit of performance)

\- More reliance on the cloud, to push off processing power where there are more economies of scale

\- The rise of traditionally "second tier" processor manufacturers (e.g., AMD, ARM) to be head-to-head with traditional leaders (e.g., Intel).

\- A greater amount of chip manufacturers R&D dollars spent to each dollar of revenue.

 _Starting to Happen_

\- China and developing countries catching up with chip technology (when the leaders are no longer growing exponentially, it's easier to catch up)

\- Governments imposing their will on chip developers (when there is less competition over performance, other factors like trust and national origin will start mattering)

\- Trade secret theft, i.e., in the past if you stole Intel's designs, you would get one good chip, but that theft would be obsolete in 18 months. Now, it gives you a much longer advantage.

\- An societal shift from utility to branding, i.e., as all goods start becoming equal, branding is the main differentiation.

\- Living standards catching up to western and U.S. standards.

 _Further Afield:_

\- No significant technological improvements for decades.

\- Stagnant per-worker/capita productivity.

\- Economic growth becoming far more tied to population than individual productivity.

\- Economies/governments fighting to increase their population (e.g., through legal immigration or by force).

\- Government's power and control becoming based more on population rather than ideals or innovation (e.g., China).

\- More monopolies ... in a dynamic and innovative society, a small smart company can defeat a larger slower one. In a stagnant society, that won't work and the competitive advantage can only be obtained by consolidation and economies of scale.

\- Social unrest ... in an exponentially growing society, there is room for every generation to become wealthier than their parents, but in a flat society, on average half will become richer and half will become poorer.

<comment><USER21> I would argue there is more to an economy than processor speeds or price of transistors e.g. hardware security, software security, data integration, expansion of communication capabilities, not to mention other industries (biotech, transportation, energy), etc. Although I must admit that I do not know how much the increase in modern hardware capabilities contributes to the productivity of the economy. I disagree with your statement regarding significant future discoveries, as that is something that is very hard to predict.

If CPU and computer hardware become commodity, it would certainly be a new era of tinkering that is upon us. Perhaps more pressing problems than computational power f CPUs and transistor cost will then be attacked.

<comment><USER20> > there is more to an economy that processor speeds ... I frankly do not know > how much increase in modern hardware capabilities contributes to the > productivity of the economy.

In industrial times, you would be right. However since the "information revolution", a huge amount of productivity gains can be directly attributable to transistors. Sure it started with improving simple calculators, but then came spreadsheets, industrial CAD models, instantaneous global communication, remote teams, global branding and a whole lot more.

In fact, it's pretty fair to say, that nearly every standard of living improvement in western countries since roughly 1980 can be attributable to the transistor.

<comment><USER21> > In fact, it's pretty fair to say, that nearly every standard of living > improvement in western countries since roughly 1980 can be attributable to > the transistor.

Very interesting statement.

Out of cusiosity, is there any way you could back it up e.g. chemical or biological research was not very digital for a long time after the 1980s. Of course, digitization was transformative in the end of the 90s and beginning of the 2000s, and it seems to me that it is just now where we are in that exponential growth of exploiting IC technology.

I quickly checked your impressive background, and I guess you have seen a lot of the IC sector in terms of innovation and technology. I believe that you are making a sound call here.

At the end, everything is intertwined. Advances in material science go back to IC design and production, and vice versa.

</comment></comment></comment></comment><comment><USER22> Hygon knows how to make Zen, dudes. This cat is out of the bag and running for the door.

</comment><comment><USER23> Just a different pattern on the waffle iron. No mention of things like [1] [https://www.minimalfab.com/en/](https://www.minimalfab.com/en/) or at least [2] [https://www.wafertrain.com/](https://www.wafertrain.com/)

But hey, valley of silly cons, who cares?</comment>


Scientists discover six new coronaviruses in bats - <AUTHOR> https://phys.org/news/2020-04-scientists-coronaviruses.html <comment><USER2> Is this news, really? In China and elsewhere, scientists have been studying and discovering coronaviruses in bats for years. That research has not yet given us a solution to the present Covid-19 problem. One can only hope it has helped accelerate the process.

[https://www.nature.com/news/inside-the-chinese-lab-poised- to...](https://www.nature.com/news/inside-the-chinese-lab-poised-to-study- world-s-most-dangerous-pathogens-1.21487)

[https://www.scientificamerican.com/article/bat-cave- solves-m...](https://www.scientificamerican.com/article/bat-cave-solves- mystery-of-deadly-sars-virus/)

[https://www.sciencedaily.com/releases/2018/04/180404133529.h...](https://www.sciencedaily.com/releases/2018/04/180404133529.htm)

[https://www.economist.com/babbage/2013/11/01/out-of-the- shad...](https://www.economist.com/babbage/2013/11/01/out-of-the-shadows)

[https://www.nature.com/articles/d41586-017-07766-9](https://www.nature.com/articles/d41586-017-07766-9)</comment>


Awless: A Mighty CLI for AWS - <AUTHOR> https://github.com/wallix/awless <comment><USER2> I hate to pile on to the complaints about sending usage metrics to a server, but this is pretty funky. The metrics include the instance id, account id, a list of the commands run with timestamps, the region, a bunch of metadata about the number of VPCs, Subnets, IAM users and policies, etc. Which is kind of a lot to get, and definitely isn't anonymous. Why do they need to know how many VPCs, Subnets, IAM users, and IAM roles I have?

Then there's how the data is sent. The metrics are converted to JSON, gzipped, then AES encrypted with a random key. The random key is then encrypted with a constant public key. the encrypted key and encrypted payload are serialized into some JSON, and is then POST-ed to an HTTPS URL. This seems unnecessarily convoluted, and even with my meager knowledge of crypto I already see some problems (compressing then encrypting is a no-no) which could spell trouble. Shouldn't you just need to upload the JSON of the metrics over an SSL connection?

<comment><USER3> > compressing then encrypting is a no-no

Perhaps it is just my own meager understanding of cryptography, but I didn't know of anything that would make this a bad idea. Can you explain why it is potentially a problem?

<comment><USER4> The "CRIME" exploit relied on encrypted compressed data. [https://en.wikipedia.org/wiki/CRIME_(security_exploit)](https://en.wikipedia.org/wiki/CRIME_\(security_exploit\))

<comment><USER3> Thanks, that was quite helpful.

I would say that "compress, then encrypt is bad" is the wrong message to take away from this type of vulnerability. In the case of CRIME in particular, the issue was that:

1\. The attacker provided part of the message. 2\. The rest of the message contained a secret. 3\. The entire message (attacker-provided-part and secret) were compressed together.

We can stop there; the length of the compressed data now contains information about the similarity between the attacker-provided content and the secret.

The correct lesson to take away from this is "do not compress a combination of attacker-provided content and secrets". Compressing before encrypting is perfectly sensible. (And, by the way, compressing after encrypting isn't better, it is useless since your encrypted content ought to be incompressible.)

</comment></comment></comment></comment><comment><USER5> > We also collect a few anonymous data (CLI errors, most frequently used > commands and count of resources).

Looks cool, but this is an instant no for me. Sorry guys.

<comment><USER6> Project creator here (but obviously not the OP).

Yes, we do collect minimal anonymised statistics in the sole goal of improving awless. All the statistics code is here: [https://github.com/wallix/awless/blob/master/stats/stats.go](https://github.com/wallix/awless/blob/master/stats/stats.go)

As the project is Apache licensed, you're free to modify it if you don't want this. Also, if you're conscious about privacy you should use application firewalls on your client side like Little Snitch etc. since many software that you install on your machine also do this.

<comment><USER7> I like the look of this, so on the software side it's a thumbs up.

However, the fact that the code is active at all will rule it out for some companies (firewall or not).

Perhaps make it something users can turn off in a config file? Not everyone can code in go, especially if their job is as a sysadmin, which isn't unlikely given that this is an infrastructure tool, so it might not be as simple as forking and editing the code for them.

<comment><USER8> Or make it turn-off-able (?) with an environmental variable. There are a couple of ways to make the tool default to report and allowable in non- reportable environments. The key thing is to make what is happening transparent.

<comment><USER9> Must be an explicit "turn-on" option.

</comment></comment></comment></comment></comment><comment><USER10> Just wondering here, but why would you use this vs terraform? Given that I can define most of the stuff I need from AWS in terraform and check the state of the infra via plan command, what would be the use case for CLI? I'm actively trying to break the habit of modifying infra without first writing terraform document for it. This way I can always be sure that I have no surprises when creating a new environment.

<comment><USER11> Terraform can't tell you about the stuff it doesn't know about.

<comment><USER10> And this is exactly what I'm trying to avoid. Terraform should know about most of the stuff.

</comment></comment></comment><comment><USER12> Sorry for off-topic question, but is this considered good golang code ? [https://github.com/wallix/awless/blob/master/stats/stats.go](https://github.com/wallix/awless/blob/master/stats/stats.go)

I'm considering learning go but amount of 'return err' and 'return nil, 0, err' is instant turn-off. Is this best-practice error handling in go ? Thanks !

<comment><USER13> It's pretty normal and you will get used to it quickly. Thanks to this pattern it's very hard to ignore errors.

The only think that could be done better is instead of always blindly returning an error, one could wrap them in higher level errors and build a sort of error trace:

E.g:

      - task failed because
       - authentication failed because
        - could not load credentials because
         - because file xy.pem is not readable

But instead of the above, you often just receive a "permission error", but you don't know where it came from, which can make debugging hard.

Edit: formatting

<comment><USER12> Thank you !

>instead of always blindly returning an error, one could wrap them in higher level errors and build a sort of error trace

Isn't that basically just reinventing exceptions, sort-of ?

<comment><USER13> Basically. It's a little different because you have more control. It's way too easy to assume exceptions won't happen and basically ignore them. But they happen in unexpected places (e.g. every time when dealing with IO).

Exceptions only contain a function call trace (stack of function calls), while a logical error trace is more like an explicit try/catch/wrap/throw around every call and could be more informative to the end user if done properly.

</comment></comment></comment></comment><comment><USER14> How about some instructions on building it ?

It lacks a Makefile or any documentation in the tarball for the latest release (v0.0.13)...

I found some sparse documentation on the wiki, but that appears to fail. I tried: GOPATH=$(pwd) go build .

And got: $ GOPATH=$(pwd) go build . main.go:19:8: cannot find package "github.com/wallix/awless/commands" in any of: /usr/src/github.com/wallix/awless/commands (from $GOROOT) /home/rkeene/Downloads/awless-0.0.13/src/github.com/wallix/awless/commands (from $GOPATH)

<comment><USER15> It seems your GOPATH is not set correctly. First freshly install Go independently. Verify it is installed correctly with "go env".

Then do a "go get github.com/wallix/awless", "cd $GOPATH/src/github.com/wallix/awless" and "go install".

Then in the same prompt do "awless"

<comment><USER14> I downloaded the release tarball, so why would I also use "go get" to get the source I just downloaded ?

<comment><USER16> "go get" will download dependencies. You can also cd to the source as run "go get ."

<comment><USER14> I can fetch the dependencies myself as well. Is there documentation on which packages are depended-on, including release version ranges ?

</comment></comment></comment></comment></comment><comment><USER17> If anyone is interested in a more minimalistic alternative to this, I have been designing an "as simple as possible, but no simpler" devops toolkit and CLI on top of the AWS CLI: [https://github.com/kislyuk/aegea](https://github.com/kislyuk/aegea)

</comment><comment><USER18> Looks great. My main complaint is that the templates feature appears to be reinventing Terraform. Would have been cool if we could use the Terraform templates we already have, or even provide support for CloudFormation (given this is an AWS-only tool).

<comment><USER6> Thanks for your feedback.

awless is currently in its early life. We also plan to support both CloudFormation (first) and maybe Terraform at some point. CF and TF are exhaustive but more complex than awless templates.

awless is meant to simplify how we can create and manage an AWS infrastructure (which is originally our own need at Wallix), and we wanted to have simple templates as part of the CLI.

</comment></comment><comment><USER19> Can someone explain why this is different/better than the official CLI application?

<comment><USER7> For me, the output is friendlier, which is great if you're just trying to make a quick query about the running instances or something.

However, the whole thread above pointing out the data collection issues makes me far less likely to be moving away from the official cli + bash magic any time soon

<comment><USER20> I concur, I really don't see what value this brings over the official aws cli.

</comment></comment></comment><comment><USER21> The constant -less-ness of operations type tools these days is starting to get rather funny.

<comment><USER22> The state of being without a cutlass is 'cutlasslessness'!

</comment></comment><comment><USER23> This looks great. I use the boto tools for all my aws stuff but they're clumsy for working in an interactive fashion like this. Going to install now to have a play!

</comment><comment><USER24> Looks really slick. From my brief glance though it doesn't support the two things I love about the officials CLI: the filter and query facilities.

<comment><USER25> (I'm one of the core developpers of awless). We are going to add filters and queries very soon. We built awless by relying on RDF to represent the cloud resources. As a result, in addition to simple filters on the properties, we can also represent more complex queries such as "everthing inside a VPC", "the siblings of an instance", etc. Try the `awless show` command to have an insight of what we can do.

<comment><USER24> That sounds fantastic, thanks!

</comment></comment></comment><comment><USER26> Currently I'm using: [https://github.com/awslabs/aws- shell](https://github.com/awslabs/aws-shell) and I love it

</comment><comment><USER27> i like that RDF to sync states from between local and remote. Nice to see similar idea that I had for while to have a client for AWS that sync states between AWS and local.

</comment><comment><USER28> How do you manage multiple environments (staging / production) with these type of tools? How do you avoid making changes in the wrong environment?

<comment><USER6> As of now, you can create a template to deploy an environment, and for instance create one master node (for instance a subnet) for each environment.

The missing values in the template (aka "holes" will be asked for by awless), so you can have staging and production deployments.

Note that we just released the project last Friday, and in particular have an ambitious roadmap for the templates. For instance, we could password protect accessing some nodes, and prevent wrong actions on the production env.

</comment></comment><comment><USER29> "We also collect a few anonymous data (CLI errors, most frequently used commands and count of resources)." Nope.

</comment><comment><USER30> It should have been named "claws"

</comment><comment><USER31> For those who have experience with both, I wonder how does it compare with gcloud CLI?

</comment><comment><USER32> I would love to see a package in AUR. Are there more Arch people over here?

</comment><comment><USER33> Finally some competition for Terraform.

<comment><USER7> The trust has already been broken by this project, so I don't see it even getting traction, nevermind becoming competition.

<comment><USER33> It's open source. You can fork and disable the tracking.

</comment></comment></comment><comment><USER34> Nice!! Thanks for sharing @dcu

</comment><comment><USER35> To all those complaining about collection of stats: Pretty much _every_ SaaS company is collecting stats about your behavior. It seems a bit off that there is so much rage about a project whose code is out their in the open to collect stats.

Point me to atleast a single popular SaaS product that does not have analytics in it's page.

<comment><USER36> What part of "Awsless: A Mighty CLI for AWS" sounds like SaaS?

"SaaS" means software as a service, something someone else runs, generally web based where metrics are relevant, not a command line tool on your own machine talking to your own infra.

From read me:

Install

Choose one of the following options:

\- Download the latest awless binaries (Windows/Linux/macOS) from Github

\- If you have Golang already installed, build the source with: go get github.com/wallix/awless

\- On macOS, use homebrew: brew tap wallix/awless; brew install awless

Which of those sounds like SaaS?

<comment><USER35> Not sure how to respond. I wasn't comparing awsless to a SaaS at all. I was saying that SaaS collects info about you all the time and I don't see anyone going up in arms about that.

According to you, it's OK to collect data if the software is on another person's infra.

<comment><USER37> Yes, you compared them, or rather, compared the reactions of people to them. If you aren't implying by extension that SaaS and awsless are comparable then your argument makes no sense.</comment></comment></comment></comment>


Need Programmers - <AUTHOR> http://sfbay.craigslist.org/sby/sof/3383072829.html

<comment><USER2> A really challenging job offer given the server specifications:

> 10,000 compute cycles per month

I would consider assembler instead of PHP.

</comment><comment><USER3> I like the irony: posting on craigslist looking for someone to build a site like craigslist.</comment>


FE-Schrift: forgery-impeding typeface - <AUTHOR> https://en.wikipedia.org/wiki/FE-Schrift <comment><USER2> The Wikipedia page didn't seem to mention other similar systems created historically to impede modification/miscomprehension.

China has a separate set of accounting number glyphs specifically for this purpose, as the regular numbers 1-9, 100, 1,000 and 10,000 (一二三四五六七八九十百千萬) are obviously easy to change, for example 一 to 十 or 千, 二 to 三, 八 to 九, etc. The replacements are 壹貳參肆伍陸柒捌玖拾佰仟萬.

See [https://en.wikipedia.org/wiki/Chinese_numbers#Standard_numbe...](https://en.wikipedia.org/wiki/Chinese_numbers#Standard_numbers) for background.

<comment><USER2> Also check out also a mistranscription error database I defined in BNF at [https://raw.githubusercontent.com/globalcitizen/php- iban/mas...](https://raw.githubusercontent.com/globalcitizen/php- iban/master/mistranscriptions.txt) to help with rebuilding errors made by humans from invalid checksum IBANs.

</comment></comment><comment><USER3> Most typefaces are designed for regularity, so this is quite the purposeful twist. I found a comment from Erik Spiekermann that makes the point

> _While nobody could simply turn one of them into another one, now they all > look totally forged in the first place. No policeman would notice if you > invented new characters instead._ [0]

[0]: [http://www.printmag.com/article/hot_type_feschrift/](http://www.printmag.com/article/hot_type_feschrift/)

[1]: [http://spiekermann.com/gefalschtes- nummernschild/](http://spiekermann.com/gefalschtes-nummernschild/)

<comment><USER4> The goal of this system is too make faking license plates using a bit of black tape hard/impossible. So I have some trouble getting the point of Erik Spiekermann's comment.

<comment><USER5> Erik is just trying to position himself as the only one in Germany who knows something about typography...

Just bullshit talk imho, as the FE Schrift does exactly what it´s supposed to.

<comment><USER6> I flipped the bozo bit on him when he flatly denied the existence of the capital sharp s. Spiekermann is and remains an ignorant blowhard.

<comment><USER7> Well, that's one thing where he's right. Agree to disagree, I guess. ;-)

I had two online interactions with him that formed my opinion of him.

When I started being interested in typefaces, but not really able to discern one from another, I wrote him an email asking for the title of one or two books where I could see his FF Meta used for the body text. He's a busy man, so I only half expected him to reply, but I certainly didn't expect his condescending abusive email that he wouldn't help a lazy student with his homework. Great way to inspire people interested in your work!

The other time was in a type aficionado web forum where I mentioned that I had bought the Adobe Type Classics collection CD for much less than retail price (second hand). He accused me of piracy, again in pretty abusive manner.

Taken together with his holier-than-thou attitude, riling against "spec work" ([https://www.nospec.com/](https://www.nospec.com/)), but then asking designers for spec work, because "it's for the UN" (and he was on the jury).

Or with his blatant lie in a Fontshop brochure I have on my shelf, claiming that there is virtually no intellectual property protection for fonts in Germany, and how it would have been impossibly expensive to register for type protection… but somehow a lot of hobbyists and small fish managed to do it.

Erik Spiekermann is a very important designer who did lots and lots of outstanding work, but I've found him to be a deeply unpleasant person.

<comment><USER8> _claiming that there is virtually no intellectual property protection for fonts in Germany, and how it would have been impossibly expensive to register for type protection… but somehow a lot of hobbyists and small fish managed to do it._

What kind of protection is there? I've read that claim before.

<comment><USER7> Back then there was the "Schriftzeichengesetz" which offered protection roughly similar to a design patent called "Geschmacksmuster" (but with its own registry). It has since been subsumed by the "Designgesetz".

Typeface protection has always been weaker in Germany than copyright protection, but it existed and exists.

As an aside: Fontshop used to claim at every opportunity that they had achieved a verdict in a lawsuit that gave fonts full copyright protection. That only worked because nobody on the forums and the web had ever seen the verdict. It wasn't secret, just behind a paywall of a legal database. A friend who's a lawyer retrieved it for me and I was much amused: The verdict said precisely the opposite!

</comment></comment></comment></comment></comment></comment></comment><comment> m-ou-se Dutch license plates have similar properties. Not by changing the proportions of the letters, but by cutting out parts of letters. For example, the R is missing a piece so you can't make it from a P and some black tape: [https://commons.m.wikimedia.org/wiki/File:Netherlands_licens...](https://commons.m.wikimedia.org/wiki/File:Netherlands_licenseplate_car_trailer.JPG)

<comment><USER9> One could also use white tape as well...

<comment><USER10> They address this in the article, pointing out that white tape would look different under headlights from the reflective background paint.

<comment><USER11> I'm pretty sure you can get retroreflective white tape. Extra effort though.

<comment><USER12> I believe "extra effort though" is entirely the point.

</comment></comment></comment></comment></comment><comment><USER13> I really wonder how common this trivial faking of license plates is. The UK have printed plates that can be easily faked and seem to be doing well.

The FE font is still hidious even years after it was introduced.

<comment><USER14> It's an issue in China. As an anti-congestion and anti-smog measure, Beijing has rules which rotate the vehicles permitted on the roads according to the plate number (for example, on Fridays a vehicle whose number ends in 5 or 0 cannot be driven). And of course some people don't want to follow the rules, so they develop all sorts of ways to try to temporarily change their plate to one that's allowed to drive.

</comment></comment><comment><USER15> You might also be interest in ZXX, a typeface made for fooling OCR: [http://www.sang-mun.com/zxx](http://www.sang-mun.com/zxx)

<comment><USER16> Not just OCR. I read the first word as "Growing"

</comment></comment><comment><USER17> I don't get how this font makes hard to fake a plate. (yes, upon close inspection you'll get busted, but cameras are an easy target)

You can get the font and then 3D print your plate or invent your own process in the kitchen.

[http://www.autokennzeichen.info/kennzeichen- schriftart.htm](http://www.autokennzeichen.info/kennzeichen-schriftart.htm)

<comment><USER18> 3D printing an entire new plate and making it retroreflective seems quite a bit harder than "putting some tape on it" to me, so it seems like it's successful?

<comment><USER19> what about having a blank retroreflective tape and just getting vinyl lettering to stick on and change it when you want a different one?

My "James Bond" idea was to have a car with cameras front and back that could read the plates of the vehicles to either side. Then, the plate would be a retroreflective panel with an active LCD overlay.. you could change your plates to whatever you wanted, and the car could have a 'stealth' mode, where when you drove behind a car, your rear plate would match theirs.. and from the front, your plate would match the car behind.

</comment></comment></comment><comment><USER20> Did they forget about C and G? Surely the top of one should be modified otherwise you can add the "tail" to a C to make G??

<comment><USER21> There's a notch on the bottom of the G and the end of the top of the C has a different angle.

<comment><USER20> I see it now, thanks for the correction.

</comment></comment></comment><comment><USER22> I wonder why they chose monospace. Wouldn't a proportional font be more tamper-resistant?

<comment><USER23> I'd guess that's because it's designed for a fixed number of letters to a plate.

Monoscpace doesn't have spacing issues and possibly make the plates easier to recognize.

<comment><USER24> One of the peculeraties of german license plates is that the number is not fixed length at all. Another one is that the dash in the plate number (which is not printed on the FE ones and only implied by position of the inspection stickers) is significant and there could be two plates with same characters that differ only in placement of said "dash".

</comment></comment></comment><comment><USER25> Doesnt prevent taking two or more plates, splitting them vertically and re- combining them.

<comment><USER26> It also doesn't prevent you from stealing (or buying) a machine that can make licence plates.

You can't defend against everything, but any criminal who defeats the current license plates wouldn't have been caught based on his license plate anyway.

The font is enough to make plate manipulation not worth the effort for average criminals and for people trying to defeat speed cameras. Going any further than that isn't worth the effort.

<comment><USER2> _a machine that can make licence plates_

Isn't that basically any decent sized metal press?

If it only has to look the part, 3D printing plus paint will likely do it without the outlay.

<comment><USER27> In any case those would be devices that terrorists (usually kids who excel more in ideology than in training) on the run would not have with them, to quickly change the identity of the car they stole.

This is not a sophisticated anti-forgery scheme, it's a no-cost layer of tamper resistance.</comment></comment></comment></comment>